From a4d3c664823f428abc1ca402772861e937928345 Mon Sep 17 00:00:00 2001
From: James Peru Mmbono <jmsperu@gmail.com>
Date: Fri, 11 Sep 2026 12:51:00 +0300
Subject: [PATCH 01/41] KVM: assign the hot-plugged NIC the next PCI slot above
 existing NICs (monotonic interface naming) (#12826)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* KVM: assign explicit PCI slot when hot-plugging NIC to ensure sequential naming

When hot-plugging a NIC to a running VM, libvirt auto-assigns the next
free PCI slot. Since non-NIC devices (virtio-serial, disk, balloon,
watchdog) occupy slots immediately after existing NICs, the hot-plugged
NIC gets a much higher slot number (e.g. 0x09 instead of 0x05), causing
the guest to see non-sequential interface names (ens9 instead of ens5).

This fix queries the domain XML to find all used PCI slots and assigns
the next free slot after the highest existing NIC slot. This matches
the approach already used by LibvirtReplugNicCommandWrapper which
preserves PCI slots during re-plug operations.

Fixes #12825

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* fix(kvm): NPE in PlugNic when libvirt domain XML is unavailable

LibvirtPlugNicCommandWrapper.findNextAvailablePciSlot calls
vm.getXMLDesc(0) and pipes the result straight into Pattern.matcher,
which NPEs if libvirt returned null (or, in the
LibvirtComputingResourceTest.testPlugNicCommandNoMatchMack unit test,
when the Domain mock isn't stubbed for getXMLDesc). Reported by
@DaanHoogland after the SL packaging run on #12826.

Defensive null check returns null from findNextAvailablePciSlot when
the domain XML can't be parsed, which falls through to libvirt's
auto-assignment of the PCI slot — same behaviour as before this PR
when nextSlot is null.

Also stubs Domain.getXMLDesc(0) in testPlugNicCommandNoMatchMack with
a minimal <domain> XML that exercises the parser path (rather than
just relying on the null-fallback), so the test continues to cover
the happy path of the new logic.

* address review (#12826): parse PCI addresses with an XML parser, split slot selection into helpers, add unit tests

- getUsedPciSlots() parses the domain XML with the safer DocumentBuilderFactory
  and only considers <address type='pci'> elements, replacing the regex.
- getHighestNicSlot() and getFirstFreeSlotAbove() are separate methods.
- The javadoc now states the guarantee precisely: deterministic and monotonic
  after the last NIC, not contiguous when other devices sit in between.
- LibvirtPlugNicCommandWrapperTest covers parsing, selection and the fallbacks.

Signed-off-by: James Peru <jmsperu@gmail.com>

---------

Signed-off-by: James Peru <jmsperu@gmail.com>
Co-authored-by: James Peru <jamesperu@Jamess-Mac-mini.local>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Co-authored-by: jmsperu <jmsperu@users.noreply.github.com>
---
 .../wrapper/LibvirtPlugNicCommandWrapper.java | 105 +++++++++++++
 .../LibvirtComputingResourceTest.java         |   9 ++
 .../LibvirtPlugNicCommandWrapperTest.java     | 147 ++++++++++++++++++
 3 files changed, 261 insertions(+)
 create mode 100644 plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPlugNicCommandWrapperTest.java

diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPlugNicCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPlugNicCommandWrapper.java
index b0950376a93d..acf95edeb954 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPlugNicCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPlugNicCommandWrapper.java
@@ -30,15 +30,29 @@
 import com.cloud.resource.CommandWrapper;
 import com.cloud.resource.ResourceWrapper;
 import com.cloud.vm.VirtualMachine;
+import org.apache.cloudstack.utils.security.ParserUtils;
 import org.libvirt.Connect;
 import org.libvirt.Domain;
 import org.libvirt.LibvirtException;
+import org.w3c.dom.Document;
+import org.w3c.dom.Element;
+import org.w3c.dom.NodeList;
+import org.xml.sax.InputSource;
+import org.xml.sax.SAXException;
 
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.ParserConfigurationException;
+import java.io.IOException;
+import java.io.StringReader;
+import java.util.HashSet;
 import java.util.List;
+import java.util.Set;
 
 @ResourceWrapper(handles =  PlugNicCommand.class)
 public final class LibvirtPlugNicCommandWrapper extends CommandWrapper<PlugNicCommand, Answer, LibvirtComputingResource> {
 
+    /** Highest PCI slot number on a bus (0x00 is the host bridge). */
+    private static final int MAX_PCI_SLOT = 0x1f;
 
     @Override
     public Answer execute(final PlugNicCommand command, final LibvirtComputingResource libvirtComputingResource) {
@@ -65,6 +79,15 @@ public Answer execute(final PlugNicCommand command, final LibvirtComputingResour
             if (command.getDetails() != null) {
                 libvirtComputingResource.setInterfaceDefQueueSettings(command.getDetails(), null, interfaceDef);
             }
+
+            // Pin the PCI slot to the lowest free one above the existing NICs so the guest sees a
+            // deterministic, monotonic NIC order across hot-plugs (see findNextAvailablePciSlot).
+            Integer nextSlot = findNextAvailablePciSlot(vm, pluggedNics);
+            if (nextSlot != null) {
+                interfaceDef.setSlot(nextSlot);
+                logger.debug("Assigning PCI slot 0x" + String.format("%02x", nextSlot) + " to hot-plugged NIC");
+            }
+
             vm.attachDevice(interfaceDef.toString());
 
             // apply default network rules on new nic
@@ -96,4 +119,86 @@ public Answer execute(final PlugNicCommand command, final LibvirtComputingResour
             }
         }
     }
+
+    /**
+     * Picks the PCI slot for the NIC being hot-plugged: the lowest free slot above the highest slot
+     * already used by a NIC. The choice is deterministic and monotonic with respect to the NICs that
+     * are already present (a new NIC never lands below an existing one), which is what keeps the
+     * guest's predictable interface names stable across hot-plugs. It does not guarantee contiguity:
+     * slots between the last NIC and the new one may already be taken by other devices (disks,
+     * controllers, balloon), in which case the next free slot above them is used.
+     *
+     * @return the slot to assign, or {@code null} to let libvirt auto-assign (domain XML unavailable
+     *         or unparseable, or no free slot left).
+     */
+    protected Integer findNextAvailablePciSlot(final Domain vm, final List<InterfaceDef> pluggedNics) {
+        try {
+            final String domXml = vm.getXMLDesc(0);
+            // getXMLDesc can return null on certain libvirt error paths; fall back to libvirt's own choice.
+            if (domXml == null) {
+                logger.debug("Domain XML unavailable, letting libvirt auto-assign PCI slot");
+                return null;
+            }
+            final Set<Integer> usedSlots = getUsedPciSlots(domXml);
+            if (usedSlots == null) {
+                return null;
+            }
+            final Integer slot = getFirstFreeSlotAbove(getHighestNicSlot(pluggedNics), usedSlots);
+            if (slot == null) {
+                logger.warn("No free PCI slots available, letting libvirt auto-assign");
+            }
+            return slot;
+        } catch (final LibvirtException e) {
+            logger.warn("Failed to get domain XML for PCI slot calculation, letting libvirt auto-assign", e);
+            return null;
+        }
+    }
+
+    /**
+     * Collects the slot numbers of every {@code <address type='pci' .../>} element in the domain XML,
+     * whichever device or bus they belong to. Returns {@code null} if the XML cannot be parsed.
+     */
+    protected Set<Integer> getUsedPciSlots(final String domXml) {
+        final Set<Integer> usedSlots = new HashSet<>();
+        try {
+            final DocumentBuilder builder = ParserUtils.getSaferDocumentBuilderFactory().newDocumentBuilder();
+            final Document doc = builder.parse(new InputSource(new StringReader(domXml)));
+            final NodeList addresses = doc.getElementsByTagName("address");
+            for (int i = 0; i < addresses.getLength(); i++) {
+                final Element address = (Element) addresses.item(i);
+                if (!"pci".equals(address.getAttribute("type")) || address.getAttribute("slot").isEmpty()) {
+                    continue;
+                }
+                usedSlots.add(Integer.decode(address.getAttribute("slot")));
+            }
+        } catch (final ParserConfigurationException | SAXException | IOException | NumberFormatException e) {
+            logger.warn("Failed to parse domain XML for PCI slot calculation, letting libvirt auto-assign", e);
+            return null;
+        }
+        return usedSlots;
+    }
+
+    /** Highest PCI slot used by an existing NIC, or 0 when no NIC carries a slot. */
+    protected static int getHighestNicSlot(final List<InterfaceDef> pluggedNics) {
+        int highest = 0;
+        for (final InterfaceDef pluggedNic : pluggedNics) {
+            if (pluggedNic.getSlot() != null && pluggedNic.getSlot() > highest) {
+                highest = pluggedNic.getSlot();
+            }
+        }
+        return highest;
+    }
+
+    /**
+     * Lowest slot strictly above {@code from} (and no higher than {@link #MAX_PCI_SLOT}) that is not in
+     * {@code usedSlots}; {@code null} when the range is exhausted. Slot 0 is reserved for the host bridge.
+     */
+    protected static Integer getFirstFreeSlotAbove(final int from, final Set<Integer> usedSlots) {
+        for (int slot = from + 1; slot <= MAX_PCI_SLOT; slot++) {
+            if (!usedSlots.contains(slot)) {
+                return slot;
+            }
+        }
+        return null;
+    }
 }
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java
index 4683a76fac9a..b7d66e66542d 100644
--- a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java
@@ -3549,6 +3549,15 @@ public void testPlugNicCommandNoMatchMack() {
             when(vifDriver.plug(nic, "Other PV", "", null)).thenReturn(interfaceDef);
             when(interfaceDef.toString()).thenReturn("Interface");
 
+            // Stub vm.getXMLDesc(0) so findNextAvailablePciSlot can scan the domain XML
+            // for in-use PCI slots. Returning a minimal <domain> with a single NIC at
+            // slot 0x03 exercises the production parser without forcing the production
+            // code into its null-fallback path.
+            when(vm.getXMLDesc(0)).thenReturn(
+                    "<domain><devices><interface type='bridge'>" +
+                    "<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>" +
+                    "</interface></devices></domain>");
+
             final String interfaceDefStr = interfaceDef.toString();
             doNothing().when(vm).attachDevice(interfaceDefStr);
 
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPlugNicCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPlugNicCommandWrapperTest.java
new file mode 100644
index 000000000000..979ffda2f279
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPlugNicCommandWrapperTest.java
@@ -0,0 +1,147 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+import static org.mockito.Mockito.when;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+import java.util.Set;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.libvirt.Domain;
+import org.libvirt.LibvirtException;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.hypervisor.kvm.resource.LibvirtVMDef.InterfaceDef;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtPlugNicCommandWrapperTest {
+
+    /**
+     * Typical q35-less layout: NICs at 0x03 and 0x06, other PCI devices at 0x01, 0x02, 0x04, 0x05 and 0x07,
+     * plus non-PCI addresses (drive, usb) that must be ignored.
+     */
+    private static final String DOMAIN_XML =
+            "<domain type='kvm'>\n"
+            + "  <name>i-2-42-VM</name>\n"
+            + "  <devices>\n"
+            + "    <disk type='file' device='disk'>\n"
+            + "      <target dev='vda' bus='virtio'/>\n"
+            + "      <address type='pci' domain='0x0000' bus='0x00' slot='0x05' function='0x0'/>\n"
+            + "    </disk>\n"
+            + "    <disk type='file' device='cdrom'>\n"
+            + "      <target dev='hdc' bus='ide'/>\n"
+            + "      <address type='drive' controller='0' bus='1' target='0' unit='0'/>\n"
+            + "    </disk>\n"
+            + "    <controller type='usb' index='0'>\n"
+            + "      <address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x2'/>\n"
+            + "    </controller>\n"
+            + "    <controller type='virtio-serial' index='0'>\n"
+            + "      <address type='pci' domain='0x0000' bus='0x00' slot='0x04' function='0x0'/>\n"
+            + "    </controller>\n"
+            + "    <interface type='bridge'>\n"
+            + "      <mac address='02:00:7c:98:00:01'/>\n"
+            + "      <address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0'/>\n"
+            + "    </interface>\n"
+            + "    <interface type='bridge'>\n"
+            + "      <mac address='02:00:7c:98:00:02'/>\n"
+            + "      <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>\n"
+            + "    </interface>\n"
+            + "    <channel type='unix'>\n"
+            + "      <address type='virtio-serial' controller='0' bus='0' port='1'/>\n"
+            + "    </channel>\n"
+            + "    <video>\n"
+            + "      <address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0'/>\n"
+            + "    </video>\n"
+            + "    <memballoon model='virtio'>\n"
+            + "      <address type='pci' domain='0x0000' bus='0x00' slot='0x07' function='0x0'/>\n"
+            + "    </memballoon>\n"
+            + "  </devices>\n"
+            + "</domain>\n";
+
+    @Mock
+    private Domain domain;
+
+    private final LibvirtPlugNicCommandWrapper wrapper = new LibvirtPlugNicCommandWrapper();
+
+    private static InterfaceDef nicAtSlot(final Integer slot) {
+        final InterfaceDef nic = new InterfaceDef();
+        nic.setSlot(slot);
+        return nic;
+    }
+
+    private static List<InterfaceDef> nicsFromXml() {
+        return Arrays.asList(nicAtSlot(0x03), nicAtSlot(0x06));
+    }
+
+    @Test
+    public void getUsedPciSlotsOnlyCountsPciAddresses() {
+        final Set<Integer> used = wrapper.getUsedPciSlots(DOMAIN_XML);
+        assertEquals(Set.of(0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07), used);
+    }
+
+    @Test
+    public void getUsedPciSlotsReturnsNullOnMalformedXml() {
+        assertNull(wrapper.getUsedPciSlots("<domain><devices><interface>"));
+    }
+
+    @Test
+    public void getHighestNicSlotIgnoresNicsWithoutAddress() {
+        assertEquals(0x06, LibvirtPlugNicCommandWrapper.getHighestNicSlot(Arrays.asList(nicAtSlot(0x03), nicAtSlot(null), nicAtSlot(0x06))));
+        assertEquals(0, LibvirtPlugNicCommandWrapper.getHighestNicSlot(Collections.emptyList()));
+    }
+
+    @Test
+    public void getFirstFreeSlotAboveSkipsOccupiedSlotsAndStopsAtBusEnd() {
+        assertEquals(Integer.valueOf(0x08), LibvirtPlugNicCommandWrapper.getFirstFreeSlotAbove(0x06, Set.of(0x07)));
+        assertEquals(Integer.valueOf(0x07), LibvirtPlugNicCommandWrapper.getFirstFreeSlotAbove(0x06, Collections.emptySet()));
+        assertNull(LibvirtPlugNicCommandWrapper.getFirstFreeSlotAbove(0x1f, Collections.emptySet()));
+    }
+
+    @Test
+    public void findNextAvailablePciSlotPicksLowestFreeSlotAboveLastNic() throws LibvirtException {
+        when(domain.getXMLDesc(0)).thenReturn(DOMAIN_XML);
+        // 0x07 is taken by the balloon, so the NIC goes to 0x08: monotonic after the last NIC, not contiguous.
+        assertEquals(Integer.valueOf(0x08), wrapper.findNextAvailablePciSlot(domain, nicsFromXml()));
+    }
+
+    @Test
+    public void findNextAvailablePciSlotFallsBackWhenXmlUnavailable() throws LibvirtException {
+        when(domain.getXMLDesc(0)).thenReturn(null);
+        assertNull(wrapper.findNextAvailablePciSlot(domain, nicsFromXml()));
+    }
+
+    @Test
+    public void findNextAvailablePciSlotFallsBackWhenLibvirtFails() throws LibvirtException {
+        when(domain.getXMLDesc(0)).thenThrow(Mockito.mock(LibvirtException.class));
+        assertNull(wrapper.findNextAvailablePciSlot(domain, nicsFromXml()));
+    }
+
+    @Test
+    public void findNextAvailablePciSlotFallsBackWhenBusIsFull() throws LibvirtException {
+        when(domain.getXMLDesc(0)).thenReturn(DOMAIN_XML);
+        assertNull(wrapper.findNextAvailablePciSlot(domain, Collections.singletonList(nicAtSlot(0x1f))));
+    }
+}

From 8261beca2fb4415015450f78fbf24c6c679abce3 Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Fri, 11 Sep 2026 16:08:56 +0530
Subject: [PATCH 02/41] ui: fix info card showing invalid template, iso link
 (#13199)

Template/ISO for a VM could be in deleted state therefore links should not be shown for them in the VM info-card.

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
---
 ui/src/components/view/InfoCard.vue | 12 +++--
 ui/src/utils/links.js               | 72 +++++++++++++++++++++++++++++
 2 files changed, 79 insertions(+), 5 deletions(-)

diff --git a/ui/src/components/view/InfoCard.vue b/ui/src/components/view/InfoCard.vue
index 0272df028a35..34c29923123b 100644
--- a/ui/src/components/view/InfoCard.vue
+++ b/ui/src/components/view/InfoCard.vue
@@ -560,7 +560,8 @@
               <div class="resource-detail-item__details">
                 <resource-icon v-if="resource.icon" :image="getImage(resource.icon.base64image)" size="1x" style="margin-right: 5px"/>
                 <SaveOutlined v-else />
-                <router-link :to="{ path: (resource.templateformat === 'ISO' ? '/iso/' : '/template/') + resource.templateid }">{{ resource.templatedisplaytext || resource.templatename || resource.templateid }} </router-link>
+                <router-link v-if="validLinks.template" :to="{ path: (resource.templateformat === 'ISO' ? '/iso/' : '/template/') + resource.templateid }">{{ resource.templatedisplaytext || resource.templatename || resource.templateid }} </router-link>
+                <span v-else>{{ resource.templatedisplaytext || resource.templatename || resource.templateid }}</span>
               </div>
             </div>
             <div class="resource-detail-item" v-if="resource.isoid">
@@ -568,7 +569,8 @@
               <div class="resource-detail-item__details">
                 <resource-icon v-if="resource.icon" :image="getImage(resource.icon.base64image)" size="1x" style="margin-right: 5px"/>
                 <UsbOutlined v-else />
-                  <router-link :to="{ path: '/iso/' + resource.isoid }">{{ resource.isodisplaytext || resource.isoname || resource.isoid }} </router-link>
+                <router-link v-if="validLinks.iso" :to="{ path: '/iso/' + resource.isoid }">{{ resource.isodisplaytext || resource.isoname || resource.isoid }} </router-link>
+                <span v-else>{{ resource.isodisplaytext || resource.isoname || resource.isoid }}</span>
               </div>
             </div>
             <div class="resource-detail-item" v-if="resource.serviceofferingname && resource.serviceofferingid">
@@ -881,7 +883,7 @@
 <script>
 import { api } from '@/api'
 import { createPathBasedOnVmType } from '@/utils/plugins'
-import { validateLinks } from '@/utils/links'
+import { validateLinksAsync } from '@/utils/links'
 import Console from '@/components/widgets/Console'
 import OsLogo from '@/components/widgets/OsLogo'
 import Status from '@/components/widgets/Status'
@@ -966,12 +968,12 @@ export default {
     },
     resource: {
       deep: true,
-      handler (newData, oldData) {
+      async handler (newData, oldData) {
         if (newData === oldData) return
         this.newResource = newData
         this.showKeys = false
         this.setData()
-        this.validLinks = validateLinks(this.$router, this.isStatic, this.resource)
+        this.validLinks = await validateLinksAsync(this.$router, this.isStatic, this.resource)
 
         if ('apikey' in this.resource) {
           this.getUserKeys()
diff --git a/ui/src/utils/links.js b/ui/src/utils/links.js
index fa650cdd7b8b..3524dcc8f8ed 100644
--- a/ui/src/utils/links.js
+++ b/ui/src/utils/links.js
@@ -15,6 +15,27 @@
 // specific language governing permissions and limitations
 // under the License.
 
+import { api } from '@/api'
+
+async function isValidObject (apiName, id, params) {
+  try {
+    const allParams = { ...params, listAll: true, id }
+    const json = await api(apiName, allParams)
+    const responseName = Object.keys(json).find(key => key.endsWith('response')) || apiName.toLowerCase() + 'response'
+    const response = json?.[responseName]
+    if (!response) {
+      return false
+    }
+    const objectName = Object.keys(response).find(key => key !== 'count')
+    if (!objectName || !Array.isArray(response[objectName])) {
+      return false
+    }
+    return response[objectName].some(item => item.id === id)
+  } catch (e) {
+    return false
+  }
+}
+
 export function validateLinks (router, isStatic, resource) {
   const validLinks = {
     volume: false
@@ -34,3 +55,54 @@ export function validateLinks (router, isStatic, resource) {
 
   return validLinks
 }
+
+export async function validateLinksAsync (router, isStatic, resource) {
+  const validLinks = {
+    volume: false,
+    template: false,
+    iso: false
+  }
+  const pendingChecks = []
+
+  if (isStatic) {
+    return validLinks
+  }
+
+  if (resource.volumeid && router.resolve('/volume/' + resource.volumeid).matched[0].redirect !== '/exception/404') {
+    if (resource.volumestate) {
+      validLinks.volume = resource.volumestate !== 'Expunged'
+    } else {
+      validLinks.volume = true
+    }
+  }
+
+  if (resource.templateid) {
+    const templatePath = (resource.templateformat === 'ISO' ? '/iso/' : '/template/') + resource.templateid
+    if (router.resolve(templatePath).matched[0].redirect !== '/exception/404') {
+      pendingChecks.push(
+        isValidObject('listTemplates', resource.templateid, { templatefilter: 'executable' }).then(result => {
+          validLinks.template = result
+        })
+      )
+    }
+  }
+
+  if (resource.isoid) {
+    const isoPath = '/iso/' + resource.isoid
+    if (router.resolve(isoPath).matched[0].redirect !== '/exception/404') {
+      pendingChecks.push(
+        isValidObject('listIsos', resource.isoid, { isofilter: 'executable' }).then(result => {
+          validLinks.iso = result
+        })
+      )
+    }
+  }
+
+  if (pendingChecks.length) {
+    await Promise.all(pendingChecks).catch(error => {
+      console.error('Error validating links:', error)
+    })
+  }
+
+  return validLinks
+}

From 8eeccdbb8a24ad68978a153dc929fc705a027d53 Mon Sep 17 00:00:00 2001
From: dahn <daan@onecht.net>
Date: Mon, 14 Sep 2026 10:34:23 +0200
Subject: [PATCH 03/41] =?UTF-8?q?UI:=20don=E2=80=99t=20continue=20with=20s?=
 =?UTF-8?q?ession=20with=20an=20expired=20userid=20(#13969)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ui/src/store/modules/user.js | 131 ++++++++++++++---------------------
 1 file changed, 53 insertions(+), 78 deletions(-)

diff --git a/ui/src/store/modules/user.js b/ui/src/store/modules/user.js
index 21cd603e378c..eb3fdccb5e23 100644
--- a/ui/src/store/modules/user.js
+++ b/ui/src/store/modules/user.js
@@ -46,6 +46,51 @@ import {
   LATEST_CS_VERSION
 } from '@/store/mutation-types'
 
+function setLoginCookies (result) {
+  Cookies.set('account', result.account)
+  Cookies.set('domainid', result.domainid)
+  Cookies.set('role', result.type)
+  Cookies.set('timezone', result.timezone)
+  Cookies.set('timezoneoffset', result.timezoneoffset)
+  Cookies.set('userfullname', result.firstname + ' ' + result.lastname)
+  Cookies.set('userid', result.userid)
+  Cookies.set('username', result.username)
+}
+
+function processLoginResponse (commit, response) {
+  const result = response.loginresponse || {}
+  setLoginCookies(result)
+  vueProps.$localStorage.set(ACCESS_TOKEN, result.sessionkey, 24 * 60 * 60 * 1000)
+  commit('SET_TOKEN', result.sessionkey)
+  commit('SET_TIMEZONE_OFFSET', result.timezoneoffset)
+
+  const cachedUseBrowserTimezone = vueProps.$localStorage.get(USE_BROWSER_TIMEZONE, false)
+  commit('SET_USE_BROWSER_TIMEZONE', cachedUseBrowserTimezone)
+  const darkMode = vueProps.$localStorage.get(DARK_MODE, false)
+  commit('SET_DARK_MODE', darkMode)
+  const cachedCustomColumns = vueProps.$localStorage.get(CUSTOM_COLUMNS, {})
+  commit('SET_CUSTOM_COLUMNS', cachedCustomColumns)
+
+  commit('SET_APIS', {})
+  commit('SET_NAME', '')
+  commit('SET_AVATAR', '')
+  commit('SET_INFO', {})
+  commit('SET_PROJECT', {})
+  commit('SET_HEADER_NOTICES', [])
+  commit('SET_FEATURES', {})
+  commit('SET_LDAP', {})
+  commit('SET_CLOUDIAN', {})
+  commit('SET_DOMAIN_STORE', {})
+  commit('SET_LOGOUT_FLAG', false)
+  commit('SET_2FA_ENABLED', (result.is2faenabled === 'true'))
+  commit('SET_2FA_PROVIDER', result.providerfor2fa)
+  commit('SET_2FA_ISSUER', result.issuerfor2fa)
+  commit('SET_LOGIN_FLAG', false)
+  const latestVersion = vueProps.$localStorage.get(LATEST_CS_VERSION, { version: '', fetchedTs: 0 })
+  commit('SET_LATEST_VERSION', latestVersion)
+  notification.destroy()
+}
+
 const user = {
   state: {
     token: '',
@@ -192,45 +237,7 @@ const user = {
     Login ({ commit }, userInfo) {
       return new Promise((resolve, reject) => {
         login(userInfo).then(response => {
-          const result = response.loginresponse || {}
-          Cookies.set('account', result.account, { expires: 1 })
-          Cookies.set('domainid', result.domainid, { expires: 1 })
-          Cookies.set('role', result.type, { expires: 1 })
-          Cookies.set('timezone', result.timezone, { expires: 1 })
-          Cookies.set('timezoneoffset', result.timezoneoffset, { expires: 1 })
-          Cookies.set('userfullname', result.firstname + ' ' + result.lastname, { expires: 1 })
-          Cookies.set('userid', result.userid, { expires: 1 })
-          Cookies.set('username', result.username, { expires: 1 })
-          vueProps.$localStorage.set(ACCESS_TOKEN, result.sessionkey, 24 * 60 * 60 * 1000)
-          commit('SET_TOKEN', result.sessionkey)
-          commit('SET_TIMEZONE_OFFSET', result.timezoneoffset)
-
-          const cachedUseBrowserTimezone = vueProps.$localStorage.get(USE_BROWSER_TIMEZONE, false)
-          commit('SET_USE_BROWSER_TIMEZONE', cachedUseBrowserTimezone)
-          const darkMode = vueProps.$localStorage.get(DARK_MODE, false)
-          commit('SET_DARK_MODE', darkMode)
-          const cachedCustomColumns = vueProps.$localStorage.get(CUSTOM_COLUMNS, {})
-          commit('SET_CUSTOM_COLUMNS', cachedCustomColumns)
-
-          commit('SET_APIS', {})
-          commit('SET_NAME', '')
-          commit('SET_AVATAR', '')
-          commit('SET_INFO', {})
-          commit('SET_PROJECT', {})
-          commit('SET_HEADER_NOTICES', [])
-          commit('SET_FEATURES', {})
-          commit('SET_LDAP', {})
-          commit('SET_CLOUDIAN', {})
-          commit('SET_DOMAIN_STORE', {})
-          commit('SET_LOGOUT_FLAG', false)
-          commit('SET_2FA_ENABLED', (result.is2faenabled === 'true'))
-          commit('SET_2FA_PROVIDER', result.providerfor2fa)
-          commit('SET_2FA_ISSUER', result.issuerfor2fa)
-          commit('SET_LOGIN_FLAG', false)
-          const latestVersion = vueProps.$localStorage.get(LATEST_CS_VERSION, { version: '', fetchedTs: 0 })
-          commit('SET_LATEST_VERSION', latestVersion)
-          notification.destroy()
-
+          processLoginResponse(commit, response)
           resolve()
         }).catch(error => {
           reject(error)
@@ -241,45 +248,7 @@ const user = {
     OauthLogin ({ commit }, userInfo) {
       return new Promise((resolve, reject) => {
         oauthlogin(userInfo).then(response => {
-          const result = response.loginresponse || {}
-          Cookies.set('account', result.account, { expires: 1 })
-          Cookies.set('domainid', result.domainid, { expires: 1 })
-          Cookies.set('role', result.type, { expires: 1 })
-          Cookies.set('timezone', result.timezone, { expires: 1 })
-          Cookies.set('timezoneoffset', result.timezoneoffset, { expires: 1 })
-          Cookies.set('userfullname', result.firstname + ' ' + result.lastname, { expires: 1 })
-          Cookies.set('userid', result.userid, { expires: 1 })
-          Cookies.set('username', result.username, { expires: 1 })
-          vueProps.$localStorage.set(ACCESS_TOKEN, result.sessionkey, 24 * 60 * 60 * 1000)
-          commit('SET_TOKEN', result.sessionkey)
-          commit('SET_TIMEZONE_OFFSET', result.timezoneoffset)
-
-          const cachedUseBrowserTimezone = vueProps.$localStorage.get(USE_BROWSER_TIMEZONE, false)
-          commit('SET_USE_BROWSER_TIMEZONE', cachedUseBrowserTimezone)
-          const darkMode = vueProps.$localStorage.get(DARK_MODE, false)
-          commit('SET_DARK_MODE', darkMode)
-          const cachedCustomColumns = vueProps.$localStorage.get(CUSTOM_COLUMNS, {})
-          commit('SET_CUSTOM_COLUMNS', cachedCustomColumns)
-
-          commit('SET_APIS', {})
-          commit('SET_NAME', '')
-          commit('SET_AVATAR', '')
-          commit('SET_INFO', {})
-          commit('SET_PROJECT', {})
-          commit('SET_HEADER_NOTICES', [])
-          commit('SET_FEATURES', {})
-          commit('SET_LDAP', {})
-          commit('SET_CLOUDIAN', {})
-          commit('SET_DOMAIN_STORE', {})
-          commit('SET_LOGOUT_FLAG', false)
-          commit('SET_2FA_ENABLED', (result.is2faenabled === 'true'))
-          commit('SET_2FA_PROVIDER', result.providerfor2fa)
-          commit('SET_2FA_ISSUER', result.issuerfor2fa)
-          commit('SET_LOGIN_FLAG', false)
-          const latestVersion = vueProps.$localStorage.get(LATEST_CS_VERSION, { version: '', fetchedTs: 0 })
-          commit('SET_LATEST_VERSION', latestVersion)
-          notification.destroy()
-
+          processLoginResponse(commit, response)
           resolve()
         }).catch(error => {
           reject(error)
@@ -304,6 +273,11 @@ const user = {
         commit('SET_DARK_MODE', darkMode)
         commit('SET_LATEST_VERSION', latestVersion)
         if (hasAuth) {
+          if (!Cookies.get('userid')) {
+            reject(new Error('Identity session expired'))
+            return
+          }
+
           console.log('Login detected, using cached APIs')
           commit('SET_ZONES', cachedZones)
           commit('SET_SHOW_SECURITY_GROUPS', cachedShowSecurityGroups)
@@ -433,6 +407,7 @@ const user = {
         })
       }).catch(error => {
         console.error(error)
+        throw error
       })
     },
 

From 273b2ea32bfa24396431b9bb0df055e0ac6c1c02 Mon Sep 17 00:00:00 2001
From: Abhisar Sinha <63767682+abh1sar@users.noreply.github.com>
Date: Sat, 19 Sep 2026 14:10:47 +0530
Subject: [PATCH 04/41] Fix importVM for use with dummy template (#14195)

findByID will fail for dummy template as it is stored in the deleted state.
---
 .../src/main/java/com/cloud/vm/UserVmManagerImpl.java | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
index a10218269ed7..7636ef6b152c 100644
--- a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
+++ b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
@@ -9608,11 +9608,10 @@ public UserVm importVM(final DataCenter zone, final Host host, final VirtualMach
             }
 
             // Ensure template details are loaded so that commitUserVm can copy them into the VM's details map
-            VMTemplateVO vmTemplateVO = _templateDao.findById(template.getId());
-            if (vmTemplateVO == null) {
-                throw new InvalidParameterValueException("Unable to find template with id " + template.getId() + " for virtual machine import");
+            if (template instanceof VMTemplateVO) {
+                VMTemplateVO vmTemplateVO = (VMTemplateVO) template;
+                _templateDao.loadDetails(vmTemplateVO);
             }
-            _templateDao.loadDetails(vmTemplateVO);
 
             final long id = _vmDao.getNextInSequence(Long.class, "id");
             String instanceName = StringUtils.isBlank(instanceNameInternal) ?
@@ -9626,8 +9625,8 @@ public UserVm importVM(final DataCenter zone, final Host host, final VirtualMach
 
             final String uuidName = _uuidMgr.generateUuid(UserVm.class, null);
             final Host lastHost = powerState != VirtualMachine.PowerState.PowerOn ? host : null;
-            final boolean dynamicScalingEnabled = checkIfDynamicScalingCanBeEnabled(null, serviceOffering, vmTemplateVO, zone.getId());
-            return commitUserVm(true, zone, host, lastHost, vmTemplateVO, hostName, displayName, owner,
+            final boolean dynamicScalingEnabled = checkIfDynamicScalingCanBeEnabled(null, serviceOffering, template, zone.getId());
+            return commitUserVm(true, zone, host, lastHost, template, hostName, displayName, owner,
                     null, null, userData, null, null, isDisplayVm, keyboard,
                     accountId, userId, serviceOffering, template.getFormat().equals(ImageFormat.ISO), guestOsId, sshPublicKeys, networkNicMap,
                     id, instanceName, uuidName, hypervisorType, customParameters,

From ac8d69c5c1d7d2a30b9e49e8f484a365123557d9 Mon Sep 17 00:00:00 2001
From: Abhisar Sinha <63767682+abh1sar@users.noreply.github.com>
Date: Sat, 19 Sep 2026 14:14:17 +0530
Subject: [PATCH 05/41] importVM improvements: RBD support, volume format, and
 cluster selection (#14162)

* kvm: allow importVm importsource=shared from an RBD pool

The CheckVolumeCommand wrapper on the KVM agent only accepted file based
pools, so importing a root disk straight from Ceph failed on the agent
with "Unsupported Storage Pool" and surfaced as "Disk not found or is
invalid" on the management server. Add RBD to the supported pool types,
take the virtual size from the disk libvirt resolved (qemu-img cannot
open a bare RBD image name), skip the QCOW2 header check for raw RBD
images, and build the rbd: URI when running qemu-img info, the same way
LibvirtGetVolumesOnStorageCommandWrapper already does for
listVolumesForImport.

* kvm: record the real image format on an imported volume

importVolume and updateImportedVolume both stamped the cluster default
format for the hypervisor, so a volume imported from an RBD pool was
recorded as QCOW2 while a natively deployed volume on the same pool is
RAW. This affected both entry points: importVm importsource=shared for a
root disk, and importVolume for a data disk.

Pass the format the hypervisor reported for the existing image, from the
check answer for a root disk and from the volume listed on the pool for
a data disk, and fall back to the hypervisor default only when no format
is reported. This also corrects a raw image imported from a file based
pool.

* vm import: plan the instance inside the pod and cluster of the requested pool

importKVMInstanceFromDiskImage planned with the pod and cluster unset, so
the planner was free to pick any host in the zone by capacity. When it
picked a host in a cluster that cannot see the pool the caller named, the
volume check ran against whichever pool that cluster does have, and the
import failed with "Disk not found or is invalid" although the image was
fine.

Take the pod and cluster from the pool the caller passed, the same way
importVolume already derives its host from the pool's scope

* verify qemu is able to read the rbd image since check can not be done on a raw file

* use computed volumeDetails in success path as well.

* ui: do not call the imported disk a QCOW2 image

The import wizard for local and shared storage described the disk as a
QCOW2 image. An image on an RBD pool is raw, and a raw image on a file
based pool can be imported as well, so the wording is wrong for both.
Call it a disk image instead.

Only the English strings are changed; the other locales come from
Transifex.
---
 .../api/command/admin/vm/ImportVmCmd.java     |  2 +-
 .../command/admin/volume/ImportVolumeCmd.java |  2 +-
 .../service/VolumeOrchestrationService.java   |  6 +-
 .../orchestration/VolumeOrchestrator.java     | 14 +++--
 .../orchestration/VolumeOrchestratorTest.java |  2 +-
 .../LibvirtCheckVolumeCommandWrapper.java     | 29 ++++++---
 .../VolumeImportUnmanageManagerImpl.java      | 19 +++++-
 .../vm/UnmanagedVMsManagerImpl.java           | 56 ++++++++++++++---
 .../VolumeImportUnmanageManagerImplTest.java  | 11 +++-
 .../vm/UnmanagedVMsManagerImplTest.java       | 63 ++++++++++++++++++-
 ui/public/locales/en.json                     |  8 +--
 ui/src/views/tools/ManageInstances.vue        |  4 +-
 12 files changed, 182 insertions(+), 34 deletions(-)

diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ImportVmCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ImportVmCmd.java
index db7dcc3fb44f..a32b8dd604e7 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ImportVmCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ImportVmCmd.java
@@ -92,7 +92,7 @@ public class ImportVmCmd extends ImportUnmanagedInstanceCmd {
 
     @Parameter(name = ApiConstants.DISK_PATH,
             type = CommandType.STRING,
-            description = "path of the disk image")
+            description = "path of the disk image. It is the file name on file based storage pools (NFS, Local, SharedMountPoint), and the image name on RBD storage pools")
     private String diskPath;
 
     @Parameter(name = ApiConstants.IMPORT_SOURCE,
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/volume/ImportVolumeCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/volume/ImportVolumeCmd.java
index 57c3ee586d35..9f29c0e9a6df 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/volume/ImportVolumeCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/volume/ImportVolumeCmd.java
@@ -63,7 +63,7 @@ public class ImportVolumeCmd extends BaseAsyncCmd {
     @Parameter(name = ApiConstants.PATH,
             type = BaseCmd.CommandType.STRING,
             required = true,
-            description = "the path of the volume")
+            description = "the path of the volume. It is the file name on file based storage pools (NFS, Local, SharedMountPoint), and the image name on RBD storage pools")
     private String path;
 
     @Parameter(name = ApiConstants.NAME,
diff --git a/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/VolumeOrchestrationService.java b/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/VolumeOrchestrationService.java
index 8686e4dd3a5a..fc9245b89704 100644
--- a/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/VolumeOrchestrationService.java
+++ b/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/VolumeOrchestrationService.java
@@ -183,10 +183,12 @@ List<DiskProfile> allocateTemplatedVolumes(Type type, String name, DiskOffering
      */
     DiskProfile importVolume(Type type, String name, DiskOffering offering, Long sizeInBytes, Long minIops, Long maxIops,
                              Long zoneId, HypervisorType hypervisorType, VirtualMachine vm, VirtualMachineTemplate template,
-                             Account owner, Long deviceId, Long poolId, Storage.StoragePoolType poolType, String path, String chainInfo);
+                             Account owner, Long deviceId, Long poolId, Storage.StoragePoolType poolType, String path, String chainInfo,
+                             Storage.ImageFormat format);
 
     DiskProfile updateImportedVolume(Type type, DiskOffering offering, VirtualMachine vm, VirtualMachineTemplate template,
-                                     Long deviceId, Long poolId, Storage.StoragePoolType poolType, String path, String chainInfo, DiskProfile diskProfile);
+                                     Long deviceId, Long poolId, Storage.StoragePoolType poolType, String path, String chainInfo, DiskProfile diskProfile,
+                                     Storage.ImageFormat format);
 
     /**
      * Unmanage VM volumes
diff --git a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestrator.java b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestrator.java
index 933accbda524..da827b17ff34 100644
--- a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestrator.java
+++ b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestrator.java
@@ -2328,7 +2328,8 @@ public void updateVolumeDiskChain(long volumeId, String path, String chainInfo,
     @Override
     public DiskProfile importVolume(Type type, String name, DiskOffering offering, Long sizeInBytes, Long minIops, Long maxIops,
                                     Long zoneId, HypervisorType hypervisorType, VirtualMachine vm, VirtualMachineTemplate template, Account owner,
-                                    Long deviceId, Long poolId, Storage.StoragePoolType poolType, String path, String chainInfo) {
+                                    Long deviceId, Long poolId, Storage.StoragePoolType poolType, String path, String chainInfo,
+                                    ImageFormat format) {
         if (sizeInBytes == null) {
             sizeInBytes = offering.getDiskSize();
         }
@@ -2367,7 +2368,9 @@ public DiskProfile importVolume(Type type, String name, DiskOffering offering, L
             vol.setDisplayVolume(userVm.isDisplayVm());
         }
 
-        vol.setFormat(getSupportedImageFormatForCluster(hypervisorType));
+        // The format the hypervisor actually reported for the existing image wins; pools such as RBD
+        // hold raw images even though QCOW2 is the cluster default for KVM.
+        vol.setFormat(format != null ? format : getSupportedImageFormatForCluster(hypervisorType));
         vol.setPoolId(poolId);
         vol.setPoolType(poolType);
         vol.setPath(path);
@@ -2379,7 +2382,8 @@ public DiskProfile importVolume(Type type, String name, DiskOffering offering, L
 
     @Override
     public DiskProfile updateImportedVolume(Type type, DiskOffering offering, VirtualMachine vm, VirtualMachineTemplate template,
-                                    Long deviceId, Long poolId, Storage.StoragePoolType poolType, String path, String chainInfo, DiskProfile diskProfile) {
+                                    Long deviceId, Long poolId, Storage.StoragePoolType poolType, String path, String chainInfo, DiskProfile diskProfile,
+                                    ImageFormat format) {
 
         VolumeVO vol = _volsDao.findById(diskProfile.getVolumeId());
         if (vm != null) {
@@ -2411,7 +2415,9 @@ public DiskProfile updateImportedVolume(Type type, DiskOffering offering, Virtua
             vol.setDisplayVolume(userVm.isDisplayVm());
         }
 
-        vol.setFormat(getSupportedImageFormatForCluster(vm.getHypervisorType()));
+        // The format the hypervisor actually reported for the existing image wins; pools such as RBD
+        // hold raw images even though QCOW2 is the cluster default for KVM.
+        vol.setFormat(format != null ? format : getSupportedImageFormatForCluster(vm.getHypervisorType()));
         vol.setPoolId(poolId);
         vol.setPoolType(poolType);
         vol.setPath(path);
diff --git a/engine/orchestration/src/test/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestratorTest.java b/engine/orchestration/src/test/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestratorTest.java
index b4a26c17e2e5..259dfaa6b1fa 100644
--- a/engine/orchestration/src/test/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestratorTest.java
+++ b/engine/orchestration/src/test/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestratorTest.java
@@ -241,7 +241,7 @@ public void testImportVolume() {
 
         volumeOrchestrator.importVolume(volumeType, name, diskOffering, sizeInBytes, null, null,
                 zoneId, hypervisorType, null, null, owner,
-                deviceId, poolId, Storage.StoragePoolType.NetworkFilesystem, path, chainInfo);
+                deviceId, poolId, Storage.StoragePoolType.NetworkFilesystem, path, chainInfo, null);
 
         VolumeVO volume = volumeVOMockedConstructionConstruction.constructed().get(0);
         Mockito.verify(volume, Mockito.never()).setInstanceId(Mockito.anyLong());
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckVolumeCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckVolumeCommandWrapper.java
index 6788516df741..3a42f230f845 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckVolumeCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckVolumeCommandWrapper.java
@@ -50,7 +50,8 @@ public final class LibvirtCheckVolumeCommandWrapper extends CommandWrapper<Check
     private static final List<Storage.StoragePoolType> STORAGE_POOL_TYPES_SUPPORTED = Arrays.asList(
             Storage.StoragePoolType.Filesystem,
             Storage.StoragePoolType.NetworkFilesystem,
-            Storage.StoragePoolType.SharedMountPoint);
+            Storage.StoragePoolType.SharedMountPoint,
+            Storage.StoragePoolType.RBD);
 
     @Override
     public Answer execute(final CheckVolumeCommand command, final LibvirtComputingResource libvirtComputingResource) {
@@ -64,14 +65,25 @@ public Answer execute(final CheckVolumeCommand command, final LibvirtComputingRe
             if (STORAGE_POOL_TYPES_SUPPORTED.contains(storageFilerTO.getType())) {
                 final KVMPhysicalDisk vol = pool.getPhysicalDisk(srcFile);
                 final String path = vol.getPath();
-                try {
-                    KVMPhysicalDisk.checkQcow2File(path);
-                } catch (final CloudRuntimeException e) {
-                    return new CheckVolumeAnswer(command, false, "", 0, getVolumeDetails(pool, vol));
+                final boolean isRbd = Storage.StoragePoolType.RBD.equals(storageFilerTO.getType());
+
+                Map<VolumeOnStorageTO.Detail, String> volumeDetails = getVolumeDetails(pool, vol);
+                if (MapUtils.isEmpty(volumeDetails)) {
+                    return new Answer(command, false, "Unable to read the volume on the storage pool");
+                }
+
+                if (!isRbd) {
+                    try {
+                        KVMPhysicalDisk.checkQcow2File(path);
+                    } catch (final CloudRuntimeException e) {
+                        return new CheckVolumeAnswer(command, false, "", 0, volumeDetails);
+                    }
                 }
 
-                long size = KVMPhysicalDisk.getVirtualSizeFromFile(path);
-                return new CheckVolumeAnswer(command, true, "", size, getVolumeDetails(pool, vol));
+                // Images on RBD are raw and the path is an image name that qemu-img cannot open
+                // without the rbd: URI, so take the size libvirt already reported for the volume.
+                long size = isRbd ? vol.getVirtualSize() : KVMPhysicalDisk.getVirtualSizeFromFile(path);
+                return new CheckVolumeAnswer(command, true, "", size, volumeDetails);
             } else {
                 return new Answer(command, false, "Unsupported Storage Pool");
             }
@@ -122,6 +134,9 @@ private Map<String, String> getDiskFileInfo(KVMStoragePool pool, KVMPhysicalDisk
         try {
             QemuImg qemu = new QemuImg(0);
             QemuImgFile qemuFile = new QemuImgFile(disk.getPath(), disk.getFormat());
+            if (Storage.StoragePoolType.RBD.equals(pool.getType())) {
+                qemuFile = new QemuImgFile(KVMPhysicalDisk.RBDStringBuilder(pool, disk.getPath()), disk.getFormat());
+            }
             return qemu.info(qemuFile, secure);
         } catch (QemuImgException | LibvirtException ex) {
             logger.error("Failed to get info of disk file: " + ex.getMessage());
diff --git a/server/src/main/java/org/apache/cloudstack/storage/volume/VolumeImportUnmanageManagerImpl.java b/server/src/main/java/org/apache/cloudstack/storage/volume/VolumeImportUnmanageManagerImpl.java
index abc2e5ca2255..4a69e32e77e4 100644
--- a/server/src/main/java/org/apache/cloudstack/storage/volume/VolumeImportUnmanageManagerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/storage/volume/VolumeImportUnmanageManagerImpl.java
@@ -461,10 +461,27 @@ private VolumeVO importVolumeInternal(VolumeOnStorageTO volume, DiskOfferingVO d
                                           Account owner, StoragePoolVO pool, String volumeName) {
         DiskProfile diskProfile = volumeManager.importVolume(Volume.Type.DATADISK, volumeName, diskOffering,
                 volume.getVirtualSize(), null, null, pool.getDataCenterId(), volume.getHypervisorType(), null, null,
-                owner, null, pool.getId(), pool.getPoolType(), volume.getPath(), null);
+                owner, null, pool.getId(), pool.getPoolType(), volume.getPath(), null, getImageFormat(volume.getFormat()));
         return volumeDao.findById(diskProfile.getVolumeId());
     }
 
+    /**
+     * Maps the format the hypervisor reported for the volume on the pool onto an image format, so that
+     * the imported volume records what is actually on the pool (raw on RBD, qcow2 on file based pools)
+     * instead of the cluster default for the hypervisor. Returns null when the format is not recognised.
+     */
+    protected Storage.ImageFormat getImageFormat(String format) {
+        if (StringUtils.isBlank(format)) {
+            return null;
+        }
+        try {
+            return Storage.ImageFormat.valueOf(format.toUpperCase());
+        } catch (IllegalArgumentException e) {
+            logger.warn("Unrecognised image format {} reported for the volume being imported, falling back to the hypervisor default", format);
+            return null;
+        }
+    }
+
     protected void checkResourceLimitForImportVolume(Account owner, VolumeOnStorageTO volume, DiskOfferingVO diskOffering, List<Reserver> reservations) {
         Long volumeSize = volume.getVirtualSize();
         try {
diff --git a/server/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImpl.java b/server/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImpl.java
index 846eab599fd1..585f00d80eb3 100644
--- a/server/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImpl.java
@@ -796,14 +796,16 @@ private Pair<DiskProfile, StoragePool> importExternalDisk(UnmanagedInstanceTO.Di
         }
         diskProfile.setSize(copyRemoteVolumeAnswer.getSize());
         DiskProfile profile = volumeManager.updateImportedVolume(type, diskOffering, vm, template, deviceId,
-                storagePool.getId(), storagePool.getPoolType(), copyRemoteVolumeAnswer.getFilename(), chainInfo, diskProfile);
+                storagePool.getId(), storagePool.getPoolType(), copyRemoteVolumeAnswer.getFilename(), chainInfo, diskProfile,
+                getImageFormatFromVolumeDetails(copyRemoteVolumeAnswer.getVolumeDetails()));
 
         return new Pair<>(profile, storagePool);
     }
 
     private Pair<DiskProfile, StoragePool> importKVMLocalDisk(VirtualMachine vm, DiskOffering diskOffering,
                                                               Volume.Type type, VirtualMachineTemplate template,
-                                                              Long deviceId, Long hostId, String diskPath, DiskProfile diskProfile) {
+                                                              Long deviceId, Long hostId, String diskPath, DiskProfile diskProfile,
+                                                              Storage.ImageFormat format) {
         List<StoragePoolVO> storagePools = primaryDataStoreDao.findLocalStoragePoolsByHostAndTags(hostId, null);
         if(storagePools.size() < 1) {
             throw new CloudRuntimeException("Local Storage not found for host");
@@ -812,22 +814,44 @@ private Pair<DiskProfile, StoragePool> importKVMLocalDisk(VirtualMachine vm, Dis
         StoragePool storagePool = storagePools.get(0);
 
         DiskProfile profile = volumeManager.updateImportedVolume(type, diskOffering, vm, template, deviceId,
-                storagePool.getId(), storagePool.getPoolType(), diskPath, null, diskProfile);
+                storagePool.getId(), storagePool.getPoolType(), diskPath, null, diskProfile, format);
 
         return new Pair<>(profile, storagePool);
     }
 
     private Pair<DiskProfile, StoragePool> importKVMSharedDisk(VirtualMachine vm, DiskOffering diskOffering,
                                                               Volume.Type type, VirtualMachineTemplate template,
-                                                              Long deviceId, Long poolId, String diskPath, DiskProfile diskProfile) {
+                                                              Long deviceId, Long poolId, String diskPath, DiskProfile diskProfile,
+                                                              Storage.ImageFormat format) {
         StoragePool storagePool = primaryDataStoreDao.findById(poolId);
 
         DiskProfile profile = volumeManager.updateImportedVolume(type, diskOffering, vm, template, deviceId,
-                poolId, storagePool.getPoolType(), diskPath, null, diskProfile);
+                poolId, storagePool.getPoolType(), diskPath, null, diskProfile, format);
 
         return new Pair<>(profile, storagePool);
     }
 
+    /**
+     * Reads the image format the hypervisor reported for an existing volume, so that the imported
+     * volume records what is actually on the pool (raw on RBD, qcow2 on file based pools) instead of
+     * the cluster default for the hypervisor. Returns null when the agent did not report a format.
+     */
+    protected Storage.ImageFormat getImageFormatFromVolumeDetails(Map<VolumeOnStorageTO.Detail, String> volumeDetails) {
+        if (MapUtils.isEmpty(volumeDetails)) {
+            return null;
+        }
+        String fileFormat = volumeDetails.get(VolumeOnStorageTO.Detail.FILE_FORMAT);
+        if (StringUtils.isBlank(fileFormat)) {
+            return null;
+        }
+        try {
+            return Storage.ImageFormat.valueOf(fileFormat.toUpperCase());
+        } catch (IllegalArgumentException e) {
+            logger.warn("Unrecognised image format {} reported for the volume being imported, falling back to the hypervisor default", fileFormat);
+            return null;
+        }
+    }
+
     private Pair<DiskProfile, StoragePool> importDisk(UnmanagedInstanceTO.Disk disk, VirtualMachine vm, Cluster cluster, DiskOffering diskOffering,
                                                       Volume.Type type, String name, Long diskSize, Long minIops, Long maxIops, VirtualMachineTemplate template,
                                                       Account owner, Long deviceId) {
@@ -842,7 +866,7 @@ private Pair<DiskProfile, StoragePool> importDisk(UnmanagedInstanceTO.Disk disk,
         }
         StoragePool storagePool = getStoragePool(disk, zone, cluster, diskOffering);
         DiskProfile profile = volumeManager.importVolume(type, name, diskOffering, diskSize,
-                minIops, maxIops, vm.getDataCenterId(), vm.getHypervisorType(), vm, template, owner, deviceId, storagePool.getId(), storagePool.getPoolType(), path, chainInfo);
+                minIops, maxIops, vm.getDataCenterId(), vm.getHypervisorType(), vm, template, owner, deviceId, storagePool.getId(), storagePool.getPoolType(), path, chainInfo, null);
 
         return new Pair<DiskProfile, StoragePool>(profile, storagePool);
     }
@@ -2647,6 +2671,13 @@ private UserVmResponse importKvmInstance(ImportVmCmd cmd) {
                 throw new InvalidParameterValueException("Disk image is already in use");
             }
 
+            // A host the planner is pinned to must be able to see the pool, otherwise the volume check
+            // runs on a host that cannot reach the image and reports it as missing.
+            if (ImportSource.SHARED == importSource && hostId != null && storagePoolHostDao.findByPoolHost(poolId, hostId) == null) {
+                throw new InvalidParameterValueException(String.format(
+                        "Specified host does not have access to the storage pool: %s", storagePool.getUuid()));
+            }
+
             DiskOffering diskOffering = diskOfferingDao.findById(serviceOffering.getDiskOfferingId());
 
             if (diskOffering != null && !storagePoolSupportsDiskOffering(storagePool, diskOffering)) {
@@ -2923,7 +2954,13 @@ private UserVm importKvmVirtualMachineFromDisk(final ImportSource importSource,
             ServiceOfferingVO dummyOffering = serviceOfferingDao.findById(userVm.getId(), serviceOffering.getId());
             profile.setServiceOffering(dummyOffering);
             DeploymentPlanner.ExcludeList excludeList = new DeploymentPlanner.ExcludeList();
-            final DataCenterDeployment plan = new DataCenterDeployment(zone.getId(), null, null, hostId, poolId, null);
+            // Confine the plan to the pod and cluster of the pool the caller asked for. Otherwise the
+            // planner is free to pick a host in another cluster that cannot see the pool, and the volume
+            // check then runs against whichever pool that cluster does have. Both are null for a zone
+            // wide pool, which every host can see.
+            StoragePoolVO importStoragePool = primaryDataStoreDao.findById(poolId);
+            final DataCenterDeployment plan = new DataCenterDeployment(zone.getId(), importStoragePool.getPodId(),
+                    importStoragePool.getClusterId(), hostId, poolId, null);
             DeployDestination dest = null;
             try {
                 dest = deploymentPlanningManager.planDeployment(profile, plan, excludeList, null);
@@ -2968,12 +3005,13 @@ private UserVm importKvmVirtualMachineFromDisk(final ImportSource importSource,
             List<Pair<DiskProfile, StoragePool>> diskProfileStoragePoolList = new ArrayList<>();
             try {
                 long deviceId = 1L;
+                Storage.ImageFormat diskFormat = getImageFormatFromVolumeDetails(checkVolumeAnswer.getVolumeDetails());
                 if(ImportSource.SHARED == importSource) {
                     diskProfileStoragePoolList.add(importKVMSharedDisk(userVm, diskOffering, Volume.Type.ROOT,
-                            template, deviceId, poolId, diskPath, diskProfile));
+                            template, deviceId, poolId, diskPath, diskProfile, diskFormat));
                 } else if(ImportSource.LOCAL == importSource) {
                     diskProfileStoragePoolList.add(importKVMLocalDisk(userVm, diskOffering, Volume.Type.ROOT,
-                            template, deviceId, hostId, diskPath, diskProfile));
+                            template, deviceId, hostId, diskPath, diskProfile, diskFormat));
                 }
             } catch (Exception e) {
                 logger.error(String.format("Failed to import volumes while importing vm: %s", instanceName), e);
diff --git a/server/src/test/java/org/apache/cloudstack/storage/volume/VolumeImportUnmanageManagerImplTest.java b/server/src/test/java/org/apache/cloudstack/storage/volume/VolumeImportUnmanageManagerImplTest.java
index f3ed13c3d6ba..08bcaeaced3c 100644
--- a/server/src/test/java/org/apache/cloudstack/storage/volume/VolumeImportUnmanageManagerImplTest.java
+++ b/server/src/test/java/org/apache/cloudstack/storage/volume/VolumeImportUnmanageManagerImplTest.java
@@ -274,7 +274,7 @@ public void testImportVolumeAllGood() throws ResourceAllocationException {
         doNothing().when(volumeApiService).validateCustomDiskOfferingSizeRange(anyLong());
         doReturn(true).when(volumeApiService).doesStoragePoolSupportDiskOffering(any(), any());
         doReturn(diskProfile).when(volumeManager).importVolume(any(), anyString(), any(), eq(virtualSize), isNull(), isNull(), anyLong(),
-                any(), isNull(), isNull(), any(), isNull(), anyLong(), any(), anyString(), isNull());
+                any(), isNull(), isNull(), any(), isNull(), anyLong(), any(), anyString(), isNull(), eq(Storage.ImageFormat.QCOW2));
         when(diskProfile.getVolumeId()).thenReturn(volumeId);
         when(volumeDao.findById(volumeId)).thenReturn(volumeVO);
 
@@ -290,6 +290,15 @@ public void testImportVolumeAllGood() throws ResourceAllocationException {
         }
     }
 
+    @Test
+    public void testGetImageFormat() {
+        Assert.assertNull(volumeImportUnmanageManager.getImageFormat(null));
+        Assert.assertNull(volumeImportUnmanageManager.getImageFormat(""));
+        Assert.assertNull(volumeImportUnmanageManager.getImageFormat("not-a-format"));
+        Assert.assertEquals(Storage.ImageFormat.RAW, volumeImportUnmanageManager.getImageFormat("raw"));
+        Assert.assertEquals(Storage.ImageFormat.QCOW2, volumeImportUnmanageManager.getImageFormat("qcow2"));
+    }
+
     @Test
     public void testListVolumesForImportInternal() {
         Pair<HostVO, String> hostAndLocalPath = mock(Pair.class);
diff --git a/server/src/test/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImplTest.java b/server/src/test/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImplTest.java
index bee6c4ad257f..30bc769d5d4f 100644
--- a/server/src/test/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImplTest.java
+++ b/server/src/test/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImplTest.java
@@ -25,6 +25,7 @@
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.ArgumentMatchers.nullable;
 import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.lenient;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
@@ -64,12 +65,14 @@
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
 import org.jetbrains.annotations.NotNull;
 import org.junit.After;
+import org.apache.cloudstack.storage.volume.VolumeOnStorageTO;
 import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.mockito.BDDMockito;
 import org.mockito.InjectMocks;
+import org.mockito.ArgumentCaptor;
 import org.mockito.Mock;
 import org.mockito.MockedConstruction;
 import org.mockito.MockedStatic;
@@ -103,6 +106,7 @@
 import com.cloud.dc.dao.DataCenterDao;
 import com.cloud.dc.dao.VmwareDatacenterDao;
 import com.cloud.deploy.DeployDestination;
+import com.cloud.deploy.DeploymentPlan;
 import com.cloud.deploy.DeploymentPlanningManager;
 import com.cloud.event.ActionEventUtils;
 import com.cloud.event.UsageEventUtils;
@@ -952,13 +956,55 @@ public void importFromsharedStorage() throws InsufficientServerCapacityException
         importFromDisk("shared");
     }
 
+    @Test
+    public void importFromsharedStorageOnRbdPool() throws InsufficientServerCapacityException {
+        importFromDisk("shared", Storage.StoragePoolType.RBD, "cloudstack-image", "raw", Storage.ImageFormat.RAW);
+    }
+
+    @Test
+    public void importFromsharedStorageOnZoneWidePool() throws InsufficientServerCapacityException {
+        // A zone wide pool carries no pod or cluster, so the plan must stay unconstrained and the
+        // planner is free to pick any host in the zone, exactly as it did before the pool was consulted.
+        importFromDisk("shared", Storage.StoragePoolType.NetworkFilesystem, "/mnt/pool/zonewide.qcow2",
+                "qcow2", Storage.ImageFormat.QCOW2, null, null);
+    }
+
+    @Test
+    public void testGetImageFormatFromVolumeDetails() {
+        Assert.assertNull(unmanagedVMsManager.getImageFormatFromVolumeDetails(null));
+        Assert.assertNull(unmanagedVMsManager.getImageFormatFromVolumeDetails(new HashMap<>()));
+        Assert.assertNull(unmanagedVMsManager.getImageFormatFromVolumeDetails(
+                Map.of(VolumeOnStorageTO.Detail.IS_LOCKED, "false")));
+        Assert.assertNull(unmanagedVMsManager.getImageFormatFromVolumeDetails(
+                Map.of(VolumeOnStorageTO.Detail.FILE_FORMAT, "not-a-format")));
+        Assert.assertEquals(Storage.ImageFormat.RAW, unmanagedVMsManager.getImageFormatFromVolumeDetails(
+                Map.of(VolumeOnStorageTO.Detail.FILE_FORMAT, "raw")));
+        Assert.assertEquals(Storage.ImageFormat.QCOW2, unmanagedVMsManager.getImageFormatFromVolumeDetails(
+                Map.of(VolumeOnStorageTO.Detail.FILE_FORMAT, "qcow2")));
+    }
+
+    private static final Long POOL_POD_ID = 11L;
+    private static final Long POOL_CLUSTER_ID = 22L;
+
     private void importFromDisk(String source) throws InsufficientServerCapacityException {
+        importFromDisk(source, Storage.StoragePoolType.NetworkFilesystem, "/var/lib/libvirt/images/test.qcow2",
+                "qcow2", Storage.ImageFormat.QCOW2);
+    }
+
+    private void importFromDisk(String source, Storage.StoragePoolType poolType, String diskPath,
+                                String reportedFileFormat, Storage.ImageFormat expectedFormat) throws InsufficientServerCapacityException {
+        importFromDisk(source, poolType, diskPath, reportedFileFormat, expectedFormat, POOL_POD_ID, POOL_CLUSTER_ID);
+    }
+
+    private void importFromDisk(String source, Storage.StoragePoolType poolType, String diskPath,
+                                String reportedFileFormat, Storage.ImageFormat expectedFormat,
+                                Long poolPodId, Long poolClusterId) throws InsufficientServerCapacityException {
         String vmname = "testVm";
         ImportVmCmd cmd = Mockito.mock(ImportVmCmd.class);
         when(cmd.getHypervisor()).thenReturn(Hypervisor.HypervisorType.KVM.toString());
         when(cmd.getName()).thenReturn(vmname);
         when(cmd.getImportSource()).thenReturn(source);
-        when(cmd.getDiskPath()).thenReturn("/var/lib/libvirt/images/test.qcow2");
+        when(cmd.getDiskPath()).thenReturn(diskPath);
         when(cmd.getDomainId()).thenReturn(null);
         HostVO host = Mockito.mock(HostVO.class);
         when(hostDao.findById(anyLong())).thenReturn(host);
@@ -972,12 +1018,16 @@ private void importFromDisk(String source) throws InsufficientServerCapacityExce
         Map<Volume, StoragePool> storage = new HashMap<>();
         VolumeVO volume = Mockito.mock(VolumeVO.class);
         StoragePoolVO storagePool = Mockito.mock(StoragePoolVO.class);
+        lenient().when(storagePool.getPoolType()).thenReturn(poolType);
+        lenient().when(storagePool.getPodId()).thenReturn(poolPodId);
+        lenient().when(storagePool.getClusterId()).thenReturn(poolClusterId);
         storage.put(volume, storagePool);
         when(mockDest.getStorageForDisks()).thenReturn(storage);
         when(mockDest.getHost()).thenReturn(host);
         when(volumeDao.findById(anyLong())).thenReturn(volume);
         CheckVolumeAnswer answer = Mockito.mock(CheckVolumeAnswer.class);
         when(answer.getResult()).thenReturn(true);
+        when(answer.getVolumeDetails()).thenReturn(Map.of(VolumeOnStorageTO.Detail.FILE_FORMAT, reportedFileFormat));
         when(agentManager.easySend(anyLong(), any(CheckVolumeCommand.class))).thenReturn(answer);
         List<StoragePoolVO> storagePools = new ArrayList<>();
         storagePools.add(storagePool);
@@ -990,6 +1040,17 @@ private void importFromDisk(String source) throws InsufficientServerCapacityExce
              MockedConstruction<CheckedReservation> mockCheckedReservation = Mockito.mockConstruction(CheckedReservation.class)) {
                 unmanagedVMsManager.importVm(cmd);
         }
+        // the imported volume must record the format the agent reported for the image on the pool,
+        // not the hypervisor default, so an RBD image is stored as RAW
+        verify(volumeManager).updateImportedVolume(any(), any(), any(), any(), anyLong(), anyLong(), Mockito.eq(poolType),
+                Mockito.eq(diskPath), Mockito.isNull(), any(), Mockito.eq(expectedFormat));
+
+        // the plan must be confined to the pod and cluster of the pool the caller asked for, so that the
+        // volume check cannot land on a host in another cluster that has no access to that pool
+        ArgumentCaptor<DeploymentPlan> planCaptor = ArgumentCaptor.forClass(DeploymentPlan.class);
+        verify(deploymentPlanningManager).planDeployment(any(), planCaptor.capture(), any(), any());
+        Assert.assertEquals(poolPodId, planCaptor.getValue().getPodId());
+        Assert.assertEquals(poolClusterId, planCaptor.getValue().getClusterId());
     }
 
     @Test
diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index 5fc06f9bccdd..bf27ec0bb437 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -834,8 +834,8 @@
 "label.desc.db.stats": "Database Statistics",
 "label.desc.importexportinstancewizard": "Import and export Instances to/from an existing VMware or KVM Cluster.",
 "label.desc.import.ext.kvm.wizard": "Import Instance from remote KVM host",
-"label.desc.import.local.kvm.wizard": "Import QCOW2 image from Local Storage",
-"label.desc.import.shared.kvm.wizard": "Import QCOW2 image from Shared Storage",
+"label.desc.import.local.kvm.wizard": "Import disk image from Local Storage",
+"label.desc.import.shared.kvm.wizard": "Import disk image from Shared Storage",
 "label.desc.import.unmanage.volume": "Import and unmanage volume on Storage Pools",
 "label.desc.ingesttinstancewizard": "Ingest instances from an external KVM host",
 "label.desc.importmigratefromvmwarewizard": "Import instances from VMware into a KVM Cluster",
@@ -3330,8 +3330,8 @@
 "message.desc.created.ssh.key.pair": "Created a SSH key pair.",
 "message.desc.host": "Each Cluster must contain at least one host (computer) for guest Instances to run on. We will add the first host now. For a host to function in CloudStack, you must install hypervisor software on the host, assign an IP address to the host, and ensure the host is connected to the CloudStack management server.<br/><br/>Give the host's DNS or IP address, the user name (usually root) and password, and any labels you use to categorize hosts.",
 "message.desc.import.ext.kvm.wizard": "Import libvirt domain from External KVM Host not managed by CloudStack",
-"message.desc.import.local.kvm.wizard": "Import QCOW2 image from Local Storage of selected KVM Host",
-"message.desc.import.shared.kvm.wizard": "Import QCOW2 image from selected Primary Storage Pool",
+"message.desc.import.local.kvm.wizard": "Import disk image from Local Storage of selected KVM Host",
+"message.desc.import.shared.kvm.wizard": "Import disk image from selected Primary Storage Pool",
 "message.desc.import.unmanage.volume": "Please choose a storage pool that you want to import or unmanage volumes. The storage pool should be in Up status. <br>This feature only supports KVM.",
 "message.desc.importexportinstancewizard": "By choosing to manage an Instance, CloudStack takes over the orchestration of that Instance. Unmanaging an Instance removes CloudStack ability to manage it. In both cases, the Instance is left running and no changes are done to the VM on the hypervisor.<br><br>For KVM, managing a VM is an experimental feature.",
 "message.desc.importingestinstancewizard": "This feature only applies to libvirt based KVM instances. Only Stopped instances can be ingested",
diff --git a/ui/src/views/tools/ManageInstances.vue b/ui/src/views/tools/ManageInstances.vue
index 6f625961ea8f..28166c233c52 100644
--- a/ui/src/views/tools/ManageInstances.vue
+++ b/ui/src/views/tools/ManageInstances.vue
@@ -612,7 +612,7 @@ export default {
       },
       {
         name: 'local',
-        label: 'Import QCOW2 image from Local Storage',
+        label: 'Import disk image from Local Storage',
         sourceDestHypervisors: {
           kvm: 'kvm'
         },
@@ -621,7 +621,7 @@ export default {
       },
       {
         name: 'shared',
-        label: 'Import QCOW2 image from Shared Storage',
+        label: 'Import disk image from Shared Storage',
         sourceDestHypervisors: {
           kvm: 'kvm'
         },

From f23766d7c33b32a30caeb2d2b04039d0c6b24f13 Mon Sep 17 00:00:00 2001
From: Wei Zhou <weizhou@apache.org>
Date: Thu, 24 Sep 2026 12:48:18 +0200
Subject: [PATCH 06/41] core: introduce a set of type adapters (#13624)

* There is a set of TO classes with renamed fields, which makes impossible to correctly communicate between Management Servers and Agents

* fix logger

* Apply suggestion from Daman

* Apply suggestion from Daman 2

* Fix nested TO renaming, log redaction and cleanup in compat TypeAdaptors

AbstractTOAdaptor built its own private Gson to run the pre-rename
serialization step through, which meant it never honoured the
LoggingExclusionStrategy the enclosing Gson (GsonHelper's logging
instance) was configured with, so fields marked @LogLevel(Off) (e.g.
VirtualMachineTO.vncPassword) leaked in plaintext when logged. It also
had no adapters for the sibling compat TOs, so nested TOs (disks/nics
inside a VirtualMachineTO, or a VirtualMachineTO inside a
MigrateCommand) kept their new field names instead of being renamed
for backward compatibility with older Agents.

AbstractTOAdaptor no longer owns a Gson at all: it takes one via
initGson(), mirroring the existing InterfaceTypeAdaptor pattern.
GsonHelper.setDefaultGsonConfig now wires each compat adaptor's
delegate Gson incrementally off the same builder, snapshotting it via
builder.create() right before each adaptor registers itself, so every
adaptor's delegate carries its sibling adaptors (for correct nested
renaming) without ever routing back into itself and recursing
forever. NetworkTO is now registered via registerTypeHierarchyAdapter
since VirtualMachineTO.nics is declared as NicTO[] (a NetworkTO
subclass) and was never matched by the previous exact-type
registration.

This also removes AbstractTOAdaptor's now-unused loggerBuilder/LOGGER
and its duplicate copy of GsonHelper.setDefaultGsonConfig, and
replaces a dead null check (getAsJsonObject() never returns null) with
a real isJsonObject() check.

Added RequestTest#testCompatFieldRenamingNestedTOs covering a
StartCommand and a MigrateCommand with nested disks/nics, asserting
old field names appear at every nesting level on the wire and that
vncPassword never appears in the logging serialization.

* fix logger

* fix build error RequestTest

* fix unit test failures RequestTest.java

---------

Co-authored-by: mprokopchuk <mprokopchuk@gmail.com>
Co-authored-by: Daman Arora <damans227@gmail.com>
---
 .../transport/compat/AbstractTOAdaptor.java   |  86 +++++++++++
 .../agent/transport/compat/DiskTOAdaptor.java |  28 ++++
 .../compat/MigrateCommandAdaptor.java         |  28 ++++
 .../transport/compat/NetworkTOAdaptor.java    |  28 ++++
 .../compat/VirtualMachineTOAdaptor.java       |  29 ++++
 .../java/com/cloud/serializer/GsonHelper.java |  44 ++++++
 .../cloud/agent/transport/RequestTest.java    | 138 +++++++++++++++++-
 7 files changed, 380 insertions(+), 1 deletion(-)
 create mode 100644 core/src/main/java/com/cloud/agent/transport/compat/AbstractTOAdaptor.java
 create mode 100644 core/src/main/java/com/cloud/agent/transport/compat/DiskTOAdaptor.java
 create mode 100644 core/src/main/java/com/cloud/agent/transport/compat/MigrateCommandAdaptor.java
 create mode 100644 core/src/main/java/com/cloud/agent/transport/compat/NetworkTOAdaptor.java
 create mode 100644 core/src/main/java/com/cloud/agent/transport/compat/VirtualMachineTOAdaptor.java

diff --git a/core/src/main/java/com/cloud/agent/transport/compat/AbstractTOAdaptor.java b/core/src/main/java/com/cloud/agent/transport/compat/AbstractTOAdaptor.java
new file mode 100644
index 000000000000..ed5630183ead
--- /dev/null
+++ b/core/src/main/java/com/cloud/agent/transport/compat/AbstractTOAdaptor.java
@@ -0,0 +1,86 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.agent.transport.compat;
+
+import com.cloud.utils.StringUtils;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.google.gson.Gson;
+import com.google.gson.JsonElement;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonSerializationContext;
+import com.google.gson.JsonSerializer;
+
+import java.lang.reflect.Type;
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+/**
+ * JSON serializer adapter for transport classes (com.cloud.agent.api.to.*) that ensures backward compatibility
+ * with older Agent versions due to rename of the fields
+ * (see https://github.com/apache/cloudstack/pull/10514)
+ *
+ * This class does not build its own Gson instance: doing so would silently drop whichever exclusion
+ * strategy (e.g. log redaction) and sibling compat adaptors (for nested TOs) the enclosing Gson was
+ * configured with. Instead, whoever registers an instance of this class into a GsonBuilder is
+ * responsible for also calling {@link #initGson(Gson)} with a Gson that (a) carries that same
+ * exclusion strategy and (b) has adapters registered for any nested TO types that also need field
+ * renaming, but not for this adaptor's own type (to avoid infinite recursion). See
+ * {@link com.cloud.serializer.GsonHelper#setDefaultGsonConfig(com.google.gson.GsonBuilder)}.
+ */
+public class AbstractTOAdaptor<T> implements JsonSerializer<T> {
+    private Gson gson;
+    private Map<String, String> fieldMappings;
+
+    protected AbstractTOAdaptor(String... fields) {
+        this.fieldMappings = new LinkedHashMap<>();
+        for (int i = 0; i + 1 < fields.length; i += 2) {
+            String sourceField = fields[i];
+            String destinationField = fields[i + 1];
+            // skip empty fields
+            if (StringUtils.isBlank(sourceField) || StringUtils.isBlank(destinationField)) {
+                continue;
+            }
+            this.fieldMappings.put(sourceField, destinationField);
+        }
+        if (this.fieldMappings.isEmpty()) {
+            throw new CloudRuntimeException("Field mappings must not be empty");
+        }
+    }
+
+    public void initGson(Gson gson) {
+        this.gson = gson;
+    }
+
+    @Override
+    public JsonElement serialize(T src, Type typeOfSrc, JsonSerializationContext context) {
+        if (src == null) {
+            return null;
+        }
+        JsonElement tree = gson.toJsonTree(src);
+        if (tree.isJsonObject()) {
+            JsonObject obj = tree.getAsJsonObject();
+            for (Map.Entry<String, String> field : fieldMappings.entrySet()) {
+                String sourceField = field.getKey();
+                String destinationField = field.getValue();
+                if (obj.has(sourceField)) {
+                    obj.add(destinationField, obj.get(sourceField));
+                }
+            }
+        }
+        return tree;
+    }
+}
diff --git a/core/src/main/java/com/cloud/agent/transport/compat/DiskTOAdaptor.java b/core/src/main/java/com/cloud/agent/transport/compat/DiskTOAdaptor.java
new file mode 100644
index 000000000000..6b45529de05f
--- /dev/null
+++ b/core/src/main/java/com/cloud/agent/transport/compat/DiskTOAdaptor.java
@@ -0,0 +1,28 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.agent.transport.compat;
+
+import com.cloud.agent.api.to.DiskTO;
+
+/**
+ * See {@link AbstractTOAdaptor}.
+ */
+public class DiskTOAdaptor extends AbstractTOAdaptor<DiskTO> {
+    public DiskTOAdaptor() {
+        super("details", "_details");
+    }
+}
diff --git a/core/src/main/java/com/cloud/agent/transport/compat/MigrateCommandAdaptor.java b/core/src/main/java/com/cloud/agent/transport/compat/MigrateCommandAdaptor.java
new file mode 100644
index 000000000000..ddac8afe5975
--- /dev/null
+++ b/core/src/main/java/com/cloud/agent/transport/compat/MigrateCommandAdaptor.java
@@ -0,0 +1,28 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.agent.transport.compat;
+
+import com.cloud.agent.api.MigrateCommand;
+
+/**
+ * See {@link AbstractTOAdaptor}.
+ */
+public class MigrateCommandAdaptor extends AbstractTOAdaptor<MigrateCommand> {
+    public MigrateCommandAdaptor() {
+        super("destinationIp", "destIp", "windows", "isWindows", "virtualMachine", "vmTO");
+    }
+}
diff --git a/core/src/main/java/com/cloud/agent/transport/compat/NetworkTOAdaptor.java b/core/src/main/java/com/cloud/agent/transport/compat/NetworkTOAdaptor.java
new file mode 100644
index 000000000000..01b0cdb4cdf9
--- /dev/null
+++ b/core/src/main/java/com/cloud/agent/transport/compat/NetworkTOAdaptor.java
@@ -0,0 +1,28 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.agent.transport.compat;
+
+import com.cloud.agent.api.to.NetworkTO;
+
+/**
+ * See {@link AbstractTOAdaptor}.
+ */
+public class NetworkTOAdaptor extends AbstractTOAdaptor<NetworkTO> {
+    public NetworkTOAdaptor() {
+        super("securityGroupEnabled", "isSecurityGroupEnabled");
+    }
+}
diff --git a/core/src/main/java/com/cloud/agent/transport/compat/VirtualMachineTOAdaptor.java b/core/src/main/java/com/cloud/agent/transport/compat/VirtualMachineTOAdaptor.java
new file mode 100644
index 000000000000..24a8c02a59c5
--- /dev/null
+++ b/core/src/main/java/com/cloud/agent/transport/compat/VirtualMachineTOAdaptor.java
@@ -0,0 +1,29 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.agent.transport.compat;
+
+import com.cloud.agent.api.to.VirtualMachineTO;
+
+/**
+ * See {@link AbstractTOAdaptor}.
+ */
+public class VirtualMachineTOAdaptor extends AbstractTOAdaptor<VirtualMachineTO> {
+
+    public VirtualMachineTOAdaptor() {
+        super("details", "params");
+    }
+}
diff --git a/core/src/main/java/com/cloud/serializer/GsonHelper.java b/core/src/main/java/com/cloud/serializer/GsonHelper.java
index 7de98c08b7e0..7fcfb28f983c 100644
--- a/core/src/main/java/com/cloud/serializer/GsonHelper.java
+++ b/core/src/main/java/com/cloud/serializer/GsonHelper.java
@@ -21,6 +21,14 @@
 
 import java.util.List;
 
+import com.cloud.agent.api.MigrateCommand;
+import com.cloud.agent.api.to.DiskTO;
+import com.cloud.agent.api.to.NetworkTO;
+import com.cloud.agent.api.to.VirtualMachineTO;
+import com.cloud.agent.transport.compat.DiskTOAdaptor;
+import com.cloud.agent.transport.compat.MigrateCommandAdaptor;
+import com.cloud.agent.transport.compat.NetworkTOAdaptor;
+import com.cloud.agent.transport.compat.VirtualMachineTOAdaptor;
 import com.cloud.hypervisor.Hypervisor;
 import org.apache.cloudstack.transport.HypervisorTypeAdaptor;
 import org.apache.logging.log4j.Logger;
@@ -78,6 +86,42 @@ public static Gson setDefaultGsonConfig(GsonBuilder builder) {
         }.getType(), new NwGroupsCommandTypeAdaptor());
         builder.registerTypeAdapter(Storage.StoragePoolType.class, new StoragePoolTypeAdaptor());
         builder.registerTypeAdapter(Hypervisor.HypervisorType.class, new HypervisorTypeAdaptor());
+
+        // added for compatibility purposes, remove after all Agents migrate to the new version
+        //
+        // Each compat adaptor below needs a "base" Gson to run its own reflective (pre-rename)
+        // serialization through, so that nested TOs are renamed too and the exclusion strategy set
+        // on `builder` (e.g. log redaction) is honoured consistently at every nesting level. That base
+        // Gson is built incrementally off the same builder, snapshotted (via builder.create()) just
+        // before each adaptor's own type is registered on it, so it carries every sibling adaptor it
+        // can nest without ever routing back into itself and recursing forever.
+        DiskTOAdaptor diskAdaptor = new DiskTOAdaptor();
+        NetworkTOAdaptor netAdaptor = new NetworkTOAdaptor();
+        VirtualMachineTOAdaptor vmAdaptor = new VirtualMachineTOAdaptor();
+        MigrateCommandAdaptor migrateAdaptor = new MigrateCommandAdaptor();
+
+        // DiskTO and NetworkTO don't nest any other compat TO, so the plain config built so far is
+        // already the correct base Gson for them.
+        Gson leafDelegateGson = builder.create();
+        diskAdaptor.initGson(leafDelegateGson);
+        netAdaptor.initGson(leafDelegateGson);
+
+        // VirtualMachineTO nests DiskTO[] and NicTO[] (NicTO extends NetworkTO), so its base Gson needs
+        // Disk/Network adapters too. registerTypeHierarchyAdapter is used for NetworkTO so that the
+        // NicTO[]-declared "nics" field is matched via its supertype.
+        builder.registerTypeAdapter(DiskTO.class, diskAdaptor);
+        builder.registerTypeHierarchyAdapter(NetworkTO.class, netAdaptor);
+        Gson vmDelegateGson = builder.create();
+        vmAdaptor.initGson(vmDelegateGson);
+
+        // MigrateCommand nests a VirtualMachineTO, so its base Gson needs the VirtualMachineTO adapter
+        // (which already renames the nested disks/nics above).
+        builder.registerTypeAdapter(VirtualMachineTO.class, vmAdaptor);
+        Gson migrateDelegateGson = builder.create();
+        migrateAdaptor.initGson(migrateDelegateGson);
+
+        builder.registerTypeAdapter(MigrateCommand.class, migrateAdaptor);
+
         Gson gson = builder.create();
         dsAdaptor.initGson(gson);
         dtAdaptor.initGson(gson);
diff --git a/core/src/test/java/com/cloud/agent/transport/RequestTest.java b/core/src/test/java/com/cloud/agent/transport/RequestTest.java
index 0fe42c7cede8..d68107e64917 100644
--- a/core/src/test/java/com/cloud/agent/transport/RequestTest.java
+++ b/core/src/test/java/com/cloud/agent/transport/RequestTest.java
@@ -19,14 +19,21 @@
 
 package com.cloud.agent.transport;
 
+import java.lang.reflect.Field;
 import java.nio.ByteBuffer;
+import java.util.HashMap;
+import java.util.Map;
 import junit.framework.TestCase;
 
+import org.apache.logging.log4j.Level;
 import org.apache.logging.log4j.Logger;
 import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.core.config.Configurator;
 import org.junit.Assert;
 import org.mockito.Mockito;
 
+import com.google.gson.Gson;
+
 import org.apache.cloudstack.storage.command.DownloadCommand;
 import org.apache.cloudstack.storage.to.TemplateObjectTO;
 
@@ -35,19 +42,28 @@
 import com.cloud.agent.api.Command;
 import com.cloud.agent.api.GetHostStatsCommand;
 import com.cloud.agent.api.GetVolumeStatsCommand;
+import com.cloud.agent.api.MigrateCommand;
 import com.cloud.agent.api.SecStorageFirewallCfgCommand;
+import com.cloud.agent.api.StartCommand;
 import com.cloud.agent.api.UpdateHostPasswordCommand;
 import com.cloud.agent.api.storage.DownloadAnswer;
 import com.cloud.agent.api.storage.ListTemplateCommand;
+import com.cloud.agent.api.to.DiskTO;
 import com.cloud.agent.api.to.NfsTO;
+import com.cloud.agent.api.to.NicTO;
+import com.cloud.agent.api.to.VirtualMachineTO;
 import com.cloud.agent.transport.Request.Version;
 import com.cloud.exception.UnsupportedVersionException;
+import com.cloud.host.Host;
 import com.cloud.hypervisor.Hypervisor.HypervisorType;
+import com.cloud.serializer.GsonHelper;
 import com.cloud.storage.DataStoreRole;
 import com.cloud.storage.Storage.ImageFormat;
 import com.cloud.storage.Storage.TemplateType;
 import com.cloud.storage.VMTemplateStorageResourceAssoc.Status;
 import com.cloud.template.VirtualMachineTemplate;
+import com.cloud.template.VirtualMachineTemplate.BootloaderType;
+import com.cloud.vm.VirtualMachine;
 
 /**
  *
@@ -57,7 +73,28 @@
  */
 
 public class RequestTest extends TestCase {
-    protected Logger logger = LogManager.getLogger(getClass());
+    private static final Logger logger = LogManager.getLogger(RequestTest.class);
+
+    /**
+     * Changes GsonHelper's logging Gson level AND clears its cached TypeAdapters.
+     *
+     * Gson bakes each Command class's shouldSkipClass/shouldSkipField decision into a TypeAdapter
+     * the first time that class is serialized, then caches it (Gson#typeTokenCache) for the life
+     * of the Gson instance. Since GsonHelper.getGsonLogger() is a static singleton shared for the
+     * whole test JVM, just calling Configurator.setLevel() again has no effect on classes already
+     * cached - they'd keep reflecting whichever level was active the first time they were logged.
+     * Clearing the cache after every level change forces a fresh (correct) evaluation.
+     */
+    private static void setGsonLoggerLevel(String loggerName, Level level) {
+        Configurator.setLevel(loggerName, level);
+        try {
+            Field field = Gson.class.getDeclaredField("typeTokenCache");
+            field.setAccessible(true);
+            ((Map<?, ?>)field.get(GsonHelper.getGsonLogger())).clear();
+        } catch (ReflectiveOperationException e) {
+            throw new RuntimeException(e);
+        }
+    }
 
     public void testSerDeser() {
         logger.info("Testing serializing and deserializing works as expected");
@@ -73,6 +110,32 @@ public void testSerDeser() {
         Request sreq = new Request(2, 3, new Command[] {cmd1, cmd2, cmd3}, true, true);
         sreq.setSequence(892403717);
 
+        Logger gsonLogger = LogManager.getLogger(GsonHelper.class);
+        Level level = gsonLogger.getLevel();
+
+        setGsonLoggerLevel(gsonLogger.getName(), Level.DEBUG);
+        String log = sreq.log("Debug", true, Level.DEBUG);
+        assert (log.contains(UpdateHostPasswordCommand.class.getSimpleName()));
+        assert (log.contains(SecStorageFirewallCfgCommand.class.getSimpleName()));
+        assert (!log.contains(GetHostStatsCommand.class.getSimpleName()));
+        assert (!log.contains("username"));
+        assert (!log.contains("password"));
+
+        setGsonLoggerLevel(gsonLogger.getName(), Level.TRACE);
+        log = sreq.log("Trace", true, Level.TRACE);
+        System.out.println(log);
+        assert (log.contains(UpdateHostPasswordCommand.class.getSimpleName()));
+        assert (log.contains(SecStorageFirewallCfgCommand.class.getSimpleName()));
+        assert (log.contains(GetHostStatsCommand.class.getSimpleName()));
+        assert (!log.contains("username"));
+        assert (!log.contains("password"));
+
+        setGsonLoggerLevel(gsonLogger.getName(), Level.INFO);
+        log = sreq.log("Info", true, Level.INFO);
+        assert (log == null);
+
+        setGsonLoggerLevel(GsonHelper.class.getName(), level);
+
         byte[] bytes = sreq.getBytes();
 
         assert Request.getSequence(bytes) == 892403717;
@@ -186,6 +249,79 @@ public void testCompress() {
         }
     }
 
+    public void testLogging() {
+        logger.info("Testing Logging");
+        GetHostStatsCommand cmd3 = new GetHostStatsCommand("hostguid", "hostname", 101);
+        Request sreq = new Request(2, 3, new Command[] {cmd3}, true, true);
+        sreq.setSequence(1);
+        Logger gsonLogger = LogManager.getLogger(GsonHelper.class);
+        Level level = gsonLogger.getLevel();
+
+        setGsonLoggerLevel(GsonHelper.class.getName(), Level.DEBUG);
+        String log = sreq.log("Debug", true, Level.DEBUG);
+        assert (log == null);
+
+        log = sreq.log("Debug", false, Level.DEBUG);
+        assert (log != null);
+
+        setGsonLoggerLevel(GsonHelper.class.getName(), Level.TRACE);
+        log = sreq.log("Trace", true, Level.TRACE);
+        assert (log != null);
+
+        assert (log.contains(GetHostStatsCommand.class.getSimpleName()));
+        logger.debug(log);
+
+        setGsonLoggerLevel(GsonHelper.class.getName(), level);
+    }
+
+    public void testCompatFieldRenamingNestedTOs() {
+        logger.info("Testing that renamed fields are restored on nested TOs too, for backward compatibility with older Agents");
+
+        DiskTO diskTO = new DiskTO();
+        diskTO.setDetails(new HashMap<String, String>());
+
+        NicTO nicTO = new NicTO();
+        nicTO.setSecurityGroupEnabled(true);
+
+        VirtualMachineTO vmTO = new VirtualMachineTO(1, "i-2-3-VM", VirtualMachine.Type.User, 1, 512, 512L * 1024 * 1024, 512L * 1024 * 1024,
+                BootloaderType.HVM, "Other PV (64-bit)", true, true, "vncpassword123");
+        vmTO.setDetails(new HashMap<String, String>());
+        vmTO.setDisks(new DiskTO[] {diskTO});
+        vmTO.setNics(new NicTO[] {nicTO});
+
+        Host host = Mockito.mock(Host.class);
+        Mockito.when(host.getPrivateIpAddress()).thenReturn("10.1.1.1");
+        StartCommand startCmd = new StartCommand(vmTO, host, false);
+
+        Request startReq = new Request(1, 1, startCmd, true);
+        String startWireJson = GsonHelper.getGson().toJson(new Command[] {startCmd});
+        assert startWireJson.contains("\"params\"") : "VirtualMachineTO.details should be serialized under its old name 'params'";
+        assert startWireJson.contains("\"_details\"") : "nested DiskTO.details should be serialized under its old name '_details'";
+        assert startWireJson.contains("\"isSecurityGroupEnabled\"") : "nested NicTO.securityGroupEnabled should be serialized under its old name 'isSecurityGroupEnabled'";
+        assert startWireJson.contains("vncpassword123") : "wire serialization should still contain the real vncPassword value";
+
+        Logger gsonLogger = LogManager.getLogger(GsonHelper.class);
+        Level gsonLoggerLevel = gsonLogger.getLevel();
+        setGsonLoggerLevel(GsonHelper.class.getName(), Level.TRACE);
+        String startLogJson;
+        try {
+            startLogJson = startReq.log("Trace", true, Level.TRACE);
+        } finally {
+            setGsonLoggerLevel(GsonHelper.class.getName(), gsonLoggerLevel);
+        }
+        assert startLogJson.contains("\"isSecurityGroupEnabled\"") : "renamed fields should still show up in the logging serialization";
+        assert !startLogJson.contains("vncpassword123") : "logging serialization should never contain the plaintext vncPassword value";
+
+        MigrateCommand migrateCmd = new MigrateCommand("i-2-3-VM", "10.1.1.2", true, vmTO, false);
+        String migrateWireJson = GsonHelper.getGson().toJson(new Command[] {migrateCmd});
+        assert migrateWireJson.contains("\"destIp\"") : "MigrateCommand.destinationIp should be serialized under its old name 'destIp'";
+        assert migrateWireJson.contains("\"isWindows\"") : "MigrateCommand.windows should be serialized under its old name 'isWindows'";
+        assert migrateWireJson.contains("\"vmTO\"") : "MigrateCommand.virtualMachine should be serialized under its old name 'vmTO'";
+        assert migrateWireJson.contains("\"params\"") : "VirtualMachineTO nested in MigrateCommand should still be renamed";
+        assert migrateWireJson.contains("\"_details\"") : "DiskTO nested inside the VirtualMachineTO nested in MigrateCommand should still be renamed";
+        assert migrateWireJson.contains("\"isSecurityGroupEnabled\"") : "NicTO nested inside the VirtualMachineTO nested in MigrateCommand should still be renamed";
+    }
+
     protected void compareRequest(Request req1, Request req2) {
         assert req1.getSequence() == req2.getSequence();
         assert req1.getAgentId() == req2.getAgentId();

From 51c52490c95cffc0d77a1880ca44912c25d7b18e Mon Sep 17 00:00:00 2001
From: Nicolas Vazquez <nicovazquez90@gmail.com>
Date: Mon, 28 Sep 2026 07:46:20 -0300
Subject: [PATCH 07/41] Add schema upgrade path for 4.22.2 (#14179)

---
 .../upgrade/dao/Upgrade42210to42220.java      | 35 +++++++++++++++++++
 .../db/schema-42210to42220-cleanup.sql        | 21 +++++++++++
 .../META-INF/db/schema-42210to42220.sql       | 21 +++++++++++
 3 files changed, 77 insertions(+)
 create mode 100644 engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42210to42220.java
 create mode 100644 engine/schema/src/main/resources/META-INF/db/schema-42210to42220-cleanup.sql
 create mode 100644 engine/schema/src/main/resources/META-INF/db/schema-42210to42220.sql

diff --git a/engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42210to42220.java b/engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42210to42220.java
new file mode 100644
index 000000000000..9985705dff34
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42210to42220.java
@@ -0,0 +1,35 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.upgrade.dao;
+
+import java.sql.Connection;
+
+public class Upgrade42210to42220 extends DbUpgradeAbstractImpl implements DbUpgrade {
+    @Override
+    public String[] getUpgradableVersionRange() {
+        return new String[] {"4.22.1.0", "4.22.2.0"};
+    }
+
+    @Override
+    public String getUpgradedVersion() {
+        return "4.22.2.0";
+    }
+
+    @Override
+    public void performDataMigration(Connection conn) {
+    }
+}
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42210to42220-cleanup.sql b/engine/schema/src/main/resources/META-INF/db/schema-42210to42220-cleanup.sql
new file mode 100644
index 000000000000..c1e9bbe191e9
--- /dev/null
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42210to42220-cleanup.sql
@@ -0,0 +1,21 @@
+-- Licensed to the Apache Software Foundation (ASF) under one
+-- or more contributor license agreements.  See the NOTICE file
+-- distributed with this work for additional information
+-- regarding copyright ownership.  The ASF licenses this file
+-- to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance
+-- with the License.  You may obtain a copy of the License at
+--
+--   http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing,
+-- software distributed under the License is distributed on an
+-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+-- KIND, either express or implied.  See the License for the
+-- specific language governing permissions and limitations
+-- under the License.
+
+--;
+-- Schema upgrade cleanup from 4.22.1.0 to 4.22.2.0
+--;
+
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42210to42220.sql b/engine/schema/src/main/resources/META-INF/db/schema-42210to42220.sql
new file mode 100644
index 000000000000..8db41ed2e294
--- /dev/null
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42210to42220.sql
@@ -0,0 +1,21 @@
+-- Licensed to the Apache Software Foundation (ASF) under one
+-- or more contributor license agreements.  See the NOTICE file
+-- distributed with this work for additional information
+-- regarding copyright ownership.  The ASF licenses this file
+-- to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance
+-- with the License.  You may obtain a copy of the License at
+--
+--   http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing,
+-- software distributed under the License is distributed on an
+-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+-- KIND, either express or implied.  See the License for the
+-- specific language governing permissions and limitations
+-- under the License.
+
+--;
+-- Schema upgrade from 4.22.1.0 to 4.22.2.0
+--;
+

From 31b6855b70821d24897eef237d93fcc2a22b2548 Mon Sep 17 00:00:00 2001
From: Rene Peinthor <rene.peinthor@linbit.com>
Date: Tue, 29 Sep 2026 07:58:00 +0200
Subject: [PATCH 08/41] linstor: escape dashes in the LVM volume group name of
 snapshot paths (#14066)

Device-mapper doubles every dash in both the volume group and the
logical volume name. getSnapshotPath only escaped the resource and
snapshot name, so on a VG like "linstor_pool-lvm-thin" the computed
/dev/mapper path did not exist and backing up a snapshot to secondary
storage failed with "qemu-img: Could not open".

Fixes #14011
---
 .../storage/datastore/util/LinstorUtil.java        |  4 +++-
 .../storage/datastore/util/LinstorUtilTest.java    | 14 ++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java
index 67c070f84eb0..bf5be24f8238 100644
--- a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java
+++ b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java
@@ -204,8 +204,10 @@ public static String getSnapshotPath(com.linbit.linstor.api.model.StoragePool sp
         final String path;
         switch (sp.getProviderKind()) {
             case LVM_THIN:
+                // device-mapper doubles every dash in the VG and LV name, so the VG part needs escaping too
+                final String vgName = backingPool.split("/")[0];
                 path = String.format("/dev/mapper/%s-%s_%s_%s",
-                    backingPool.split("/")[0], rscName.replace("-", "--"), suffix, snapshotName.replace("-", "--"));
+                    vgName.replace("-", "--"), rscName.replace("-", "--"), suffix, snapshotName.replace("-", "--"));
                 break;
             case ZFS:
             case ZFS_THIN:
diff --git a/plugins/storage/volume/linstor/src/test/java/org/apache/cloudstack/storage/datastore/util/LinstorUtilTest.java b/plugins/storage/volume/linstor/src/test/java/org/apache/cloudstack/storage/datastore/util/LinstorUtilTest.java
index 55f0c6ebe6dc..e50769b3f9dd 100644
--- a/plugins/storage/volume/linstor/src/test/java/org/apache/cloudstack/storage/datastore/util/LinstorUtilTest.java
+++ b/plugins/storage/volume/linstor/src/test/java/org/apache/cloudstack/storage/datastore/util/LinstorUtilTest.java
@@ -103,6 +103,20 @@ public void testGetSnapshotPath() {
             Assert.assertEquals("/dev/mapper/storage-cs--cb32532a--dd8f--47e0--a81c--8a75573d3545_00000_snap3", snapPath);
         }
 
+        {
+            // dashes in the volume group name must be escaped as well (GH issue #14011)
+            StoragePool spLVMThin = new StoragePool();
+            Properties lvmThinProps = new Properties();
+            lvmThinProps.put("StorDriver/StorPoolName", "linstor_pool-lvm-thin/thin");
+            spLVMThin.setProps(lvmThinProps);
+            spLVMThin.setProviderKind(ProviderKind.LVM_THIN);
+            String snapPath = LinstorUtil.getSnapshotPath(spLVMThin,
+                "cs-12fc4055-3985-4025-8eb5-d6fd53effe37", "cs-d7aea646-5f40-46a2-b9dc-77e41ea29336");
+            Assert.assertEquals(
+                "/dev/mapper/linstor_pool--lvm--thin-cs--12fc4055--3985--4025--8eb5--d6fd53effe37_00000_cs--d7aea646--5f40--46a2--b9dc--77e41ea29336",
+                snapPath);
+        }
+
         {
             StoragePool spZFS = new StoragePool();
             Properties zfsProps = new Properties();

From 250695ec331328e9fec08a5422d27e91fd4cdf87 Mon Sep 17 00:00:00 2001
From: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
Date: Tue, 29 Sep 2026 18:43:57 +0530
Subject: [PATCH 09/41] Escape snapshot names in libvirt XML (#14201)

Co-authored-by: mprokopchuk <mprokopchuk@apple.com>
---
 ...LibvirtCreateVMSnapshotCommandWrapper.java |  3 ++-
 .../LibvirtManageSnapshotCommandWrapper.java  |  3 ++-
 .../wrapper/LibvirtUtilitiesHelper.java       |  5 ++--
 .../wrapper/LibvirtUtilitiesHelperTest.java   | 27 +++++++++++++++++++
 4 files changed, 34 insertions(+), 4 deletions(-)

diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateVMSnapshotCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateVMSnapshotCommandWrapper.java
index de95f785d44b..e3b5c0363f1e 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateVMSnapshotCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateVMSnapshotCommandWrapper.java
@@ -19,6 +19,7 @@
 
 package com.cloud.hypervisor.kvm.resource.wrapper;
 
+import org.apache.commons.lang.StringEscapeUtils;
 import org.libvirt.Connect;
 import org.libvirt.Domain;
 import org.libvirt.DomainInfo.DomainState;
@@ -57,7 +58,7 @@ public Answer execute(final CreateVMSnapshotCommand cmd, final LibvirtComputingR
                         "Create Instance Snapshot Failed due to Instance is not running: " + vmName + " with domainState = " + domainState);
             }
 
-            String vmSnapshotXML = "<domainsnapshot>" + "  <name>" + vmSnapshotName + "</name>"
+            String vmSnapshotXML = "<domainsnapshot>" + "  <name>" + StringEscapeUtils.escapeXml(vmSnapshotName) + "</name>"
                     + "  <memory snapshot='internal' />" + "</domainsnapshot>";
 
             dm.snapshotCreateXML(vmSnapshotXML);
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtManageSnapshotCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtManageSnapshotCommandWrapper.java
index ec900e9981e0..53813a0ed1bc 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtManageSnapshotCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtManageSnapshotCommandWrapper.java
@@ -22,6 +22,7 @@
 import java.io.File;
 import java.text.MessageFormat;
 
+import org.apache.commons.lang.StringEscapeUtils;
 import org.libvirt.Connect;
 import org.libvirt.Domain;
 import org.libvirt.DomainInfo.DomainState;
@@ -79,7 +80,7 @@ public Answer execute(final ManageSnapshotCommand command, final LibvirtComputin
                         + "            <uuid>{1}</uuid>" + "        </domain>" + "    </domainsnapshot>");
 
                 final String vmUuid = vm.getUUIDString();
-                final Object[] args = new Object[] {snapshotName, vmUuid};
+                final Object[] args = new Object[] {StringEscapeUtils.escapeXml(snapshotName), vmUuid};
                 final String snapshot = snapshotXML.format(args);
                 logger.debug(snapshot);
                 if (command.getCommandSwitch().equalsIgnoreCase(ManageSnapshotCommand.CREATE_SNAPSHOT)) {
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtUtilitiesHelper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtUtilitiesHelper.java
index 70e7f074c879..0a37c971a571 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtUtilitiesHelper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtUtilitiesHelper.java
@@ -26,6 +26,7 @@
 import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
 import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
 import org.apache.cloudstack.storage.to.PrimaryDataStoreTO;
+import org.apache.commons.lang.StringEscapeUtils;
 import org.apache.logging.log4j.Logger;
 import org.apache.logging.log4j.LogManager;
 import org.libvirt.Connect;
@@ -112,9 +113,9 @@ public Script buildScript(final String scriptPath) {
     }
 
     public String generateVMSnapshotXML(VMSnapshotTO snapshot, VMSnapshotTO parent, String domainXmlDesc) {
-        String parentName = (parent == null)? "": ("  <parent><name>" + parent.getSnapshotName() + "</name></parent>\n");
+        String parentName = (parent == null)? "": ("  <parent><name>" + StringEscapeUtils.escapeXml(parent.getSnapshotName()) + "</name></parent>\n");
         String vmSnapshotXML = "<domainsnapshot>\n"
-                + "  <name>" + snapshot.getSnapshotName() + "</name>\n"
+                + "  <name>" + StringEscapeUtils.escapeXml(snapshot.getSnapshotName()) + "</name>\n"
                 + "  <state>running</state>\n"
                 + parentName
                 + "  <creationTime>" + (int) Math.rint(snapshot.getCreateTime()/1000) + "</creationTime>\n"
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtUtilitiesHelperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtUtilitiesHelperTest.java
index f18f3f83a12f..5b9c91fb20aa 100644
--- a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtUtilitiesHelperTest.java
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtUtilitiesHelperTest.java
@@ -25,6 +25,7 @@
 import org.mockito.Mockito;
 import org.mockito.junit.MockitoJUnitRunner;
 
+import com.cloud.agent.api.VMSnapshotTO;
 import com.cloud.utils.Pair;
 
 import junit.framework.TestCase;
@@ -75,4 +76,30 @@ public void validateIsLibvirtVersionEqualOrHigherThanVersionInParameterLibvirtVe
         Assert.assertEquals(String.valueOf(libvirtVersion), result.first());
         Assert.assertTrue(result.second());
     }
+
+    @Test
+    public void generateVMSnapshotXMLEscapesSnapshotName() {
+        VMSnapshotTO snapshot = Mockito.mock(VMSnapshotTO.class);
+        Mockito.doReturn("i-2-3-VM_VS_</name><disks><disk name='vda'/></disks><name>x").when(snapshot).getSnapshotName();
+        Mockito.doReturn(1000L).when(snapshot).getCreateTime();
+
+        String xml = libvirtUtilitiesHelperSpy.generateVMSnapshotXML(snapshot, null, "<domain/>");
+
+        Assert.assertTrue(xml.contains("<name>i-2-3-VM_VS_&lt;/name&gt;&lt;disks&gt;&lt;disk name=&apos;vda&apos;/&gt;&lt;/disks&gt;&lt;name&gt;x</name>"));
+        Assert.assertFalse(xml.contains("<disks>"));
+    }
+
+    @Test
+    public void generateVMSnapshotXMLEscapesParentSnapshotName() {
+        VMSnapshotTO snapshot = Mockito.mock(VMSnapshotTO.class);
+        Mockito.doReturn("child").when(snapshot).getSnapshotName();
+        Mockito.doReturn(1000L).when(snapshot).getCreateTime();
+        VMSnapshotTO parent = Mockito.mock(VMSnapshotTO.class);
+        Mockito.doReturn("parent</name><disks/>").when(parent).getSnapshotName();
+
+        String xml = libvirtUtilitiesHelperSpy.generateVMSnapshotXML(snapshot, parent, "<domain/>");
+
+        Assert.assertTrue(xml.contains("<parent><name>parent&lt;/name&gt;&lt;disks/&gt;</name></parent>"));
+        Assert.assertFalse(xml.contains("<disks/>"));
+    }
 }

From 730d11fc57fd240b7867da670f0e35169dc9e44f Mon Sep 17 00:00:00 2001
From: Nicolas Vazquez <nicovazquez90@gmail.com>
Date: Wed, 30 Sep 2026 03:06:26 -0300
Subject: [PATCH 10/41] [4.22] Fix CI Pre-commit failure (#14268)

---
 .../main/resources/META-INF/db/schema-42210to42220-cleanup.sql   | 1 -
 .../src/main/resources/META-INF/db/schema-42210to42220.sql       | 1 -
 2 files changed, 2 deletions(-)

diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42210to42220-cleanup.sql b/engine/schema/src/main/resources/META-INF/db/schema-42210to42220-cleanup.sql
index c1e9bbe191e9..85563b6daf03 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-42210to42220-cleanup.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42210to42220-cleanup.sql
@@ -18,4 +18,3 @@
 --;
 -- Schema upgrade cleanup from 4.22.1.0 to 4.22.2.0
 --;
-
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42210to42220.sql b/engine/schema/src/main/resources/META-INF/db/schema-42210to42220.sql
index 8db41ed2e294..f6d73def74fd 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-42210to42220.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42210to42220.sql
@@ -18,4 +18,3 @@
 --;
 -- Schema upgrade from 4.22.1.0 to 4.22.2.0
 --;
-

From a772e8d13bad6954b516dca560fd114ac003e7d1 Mon Sep 17 00:00:00 2001
From: Pearl Dsilva <pearl1594@gmail.com>
Date: Wed, 30 Sep 2026 03:58:38 -0400
Subject: [PATCH 11/41] CKS/CSI: fix PVC deletion script to avoid '(standard
 input)' and use kubectl -o name/jsonpath (#11968)

---
 .../script/delete-pv-reclaimpolicy-delete     | 82 ++++++++++++-------
 1 file changed, 52 insertions(+), 30 deletions(-)

diff --git a/plugins/integrations/kubernetes-service/src/main/resources/script/delete-pv-reclaimpolicy-delete b/plugins/integrations/kubernetes-service/src/main/resources/script/delete-pv-reclaimpolicy-delete
index aac0cbf07e4a..34e07e0bbe30 100755
--- a/plugins/integrations/kubernetes-service/src/main/resources/script/delete-pv-reclaimpolicy-delete
+++ b/plugins/integrations/kubernetes-service/src/main/resources/script/delete-pv-reclaimpolicy-delete
@@ -33,23 +33,33 @@ delete_workloads_using_pvc() {
     local deleted_count=0
 
     # Find & delete any deployment using the PVC
-    /opt/bin/kubectl get deployments -n "$namespace" -o json 2>/dev/null | grep -l "$pvc_name" | \
-    while IFS= read -r deployment; do
-        if [ -n "$deployment" ]; then
-            deployment_name=$(echo "$deployment" | cut -d'/' -f2)
-            echo "$(timestamp) -   Deleting Deployment: $deployment_name"
-            /opt/bin/kubectl delete deployment "$deployment_name" -n "$namespace" --ignore-not-found=true
+    # Iterate resource names and check the volumes via jsonpath to avoid grep -l on JSON (which prints "(standard input)")
+    /opt/bin/kubectl get deployments -n "$namespace" -o name 2>/dev/null | \
+    while IFS= read -r resource; do
+        if [ -z "$resource" ]; then
+            continue
+        fi
+        name=${resource#*/}
+        dep_volumes=$(/opt/bin/kubectl get deployment "$name" -n "$namespace" -o jsonpath='{.spec.template.spec.volumes[*].persistentVolumeClaim.claimName}' 2>/dev/null || echo "")
+        if [ -n "$dep_volumes" ] && echo "$dep_volumes" | grep -F -q "$pvc_name"; then
+            echo "$(timestamp) -   Deleting Deployment: $name"
+            /opt/bin/kubectl delete deployment "$name" -n "$namespace" --ignore-not-found=true
             deleted_count=$((deleted_count + 1))
         fi
     done
 
     # Find and delete any StatefulSet using the PVC
-    /opt/bin/kubectl get statefulsets -n "$namespace" -o json 2>/dev/null | grep -l "$pvc_name" | \
-    while IFS= read -r sts; do
-        if [ -n "$sts" ]; then
-            sts_name=$(echo "$sts" | cut -d'/' -f2)
-            echo "$(timestamp) -   Deleting StatefulSet: $sts_name"
-            /opt/bin/kubectl delete statefulset "$sts_name" -n "$namespace" --ignore-not-found=true
+    /opt/bin/kubectl get statefulsets -n "$namespace" -o name 2>/dev/null | \
+    while IFS= read -r resource; do
+        if [ -z "$resource" ]; then
+            continue
+        fi
+        name=${resource#*/}
+        # Check both template volumes and volumeClaimTemplates
+        sts_volumes=$(/opt/bin/kubectl get statefulset "$name" -n "$namespace" -o jsonpath='{.spec.template.spec.volumes[*].persistentVolumeClaim.claimName} {.spec.volumeClaimTemplates[*].metadata.name}' 2>/dev/null || echo "")
+        if [ -n "$sts_volumes" ] && echo "$sts_volumes" | grep -F -q "$pvc_name"; then
+            echo "$(timestamp) -   Deleting StatefulSet: $name"
+            /opt/bin/kubectl delete statefulset "$name" -n "$namespace" --ignore-not-found=true
             deleted_count=$((deleted_count + 1))
         fi
     done
@@ -71,34 +81,46 @@ delete_workloads_using_pvc() {
     done
 
     # Find and delete any DaemonSet using the PVC
-    /opt/bin/kubectl get daemonsets -n "$namespace" -o json 2>/dev/null | grep -l "$pvc_name" | \
-    while IFS= read -r ds; do
-        if [ -n "$ds" ]; then
-            ds_name=$(echo "$ds" | cut -d'/' -f2)
-            echo "$(timestamp) -   Deleting DaemonSet: $ds_name"
-            /opt/bin/kubectl delete daemonset "$ds_name" -n "$namespace" --ignore-not-found=true
+    /opt/bin/kubectl get daemonsets -n "$namespace" -o name 2>/dev/null | \
+    while IFS= read -r resource; do
+        if [ -z "$resource" ]; then
+            continue
+        fi
+        name=${resource#*/}
+        ds_volumes=$(/opt/bin/kubectl get daemonset "$name" -n "$namespace" -o jsonpath='{.spec.template.spec.volumes[*].persistentVolumeClaim.claimName}' 2>/dev/null || echo "")
+        if [ -n "$ds_volumes" ] && echo "$ds_volumes" | grep -F -q "$pvc_name"; then
+            echo "$(timestamp) -   Deleting DaemonSet: $name"
+            /opt/bin/kubectl delete daemonset "$name" -n "$namespace" --ignore-not-found=true
             deleted_count=$((deleted_count + 1))
         fi
     done
 
     # Find and delete any Job using the PVC
-    /opt/bin/kubectl get jobs -n "$namespace" -o json 2>/dev/null | grep -l "$pvc_name" | \
-    while IFS= read -r job; do
-        if [ -n "$job" ]; then
-            job_name=$(echo "$job" | cut -d'/' -f2)
-            echo "$(timestamp) -   Deleting Job: $job_name"
-            /opt/bin/kubectl delete job "$job_name" -n "$namespace" --ignore-not-found=true
+    /opt/bin/kubectl get jobs -n "$namespace" -o name 2>/dev/null | \
+    while IFS= read -r resource; do
+        if [ -z "$resource" ]; then
+            continue
+        fi
+        name=${resource#*/}
+        job_volumes=$(/opt/bin/kubectl get job "$name" -n "$namespace" -o jsonpath='{.spec.template.spec.volumes[*].persistentVolumeClaim.claimName}' 2>/dev/null || echo "")
+        if [ -n "$job_volumes" ] && echo "$job_volumes" | grep -F -q "$pvc_name"; then
+            echo "$(timestamp) -   Deleting Job: $name"
+            /opt/bin/kubectl delete job "$name" -n "$namespace" --ignore-not-found=true
             deleted_count=$((deleted_count + 1))
         fi
     done
 
     # Find and delete any CronJobs using the PVC
-    /opt/bin/kubectl get cronjobs -n "$namespace" -o json 2>/dev/null | grep -l "$pvc_name" | \
-    while IFS= read -r cronjob; do
-        if [ -n "$cronjob" ]; then
-            cronjob_name=$(echo "$cronjob" | cut -d'/' -f2)
-            echo "$(timestamp) -   Deleting CronJob: $cronjob_name"
-            /opt/bin/kubectl delete cronjob "$cronjob_name" -n "$namespace" --ignore-not-found=true
+    /opt/bin/kubectl get cronjobs -n "$namespace" -o name 2>/dev/null | \
+    while IFS= read -r resource; do
+        if [ -z "$resource" ]; then
+            continue
+        fi
+        name=${resource#*/}
+        cron_volumes=$(/opt/bin/kubectl get cronjob "$name" -n "$namespace" -o jsonpath='{.spec.jobTemplate.spec.template.spec.volumes[*].persistentVolumeClaim.claimName}' 2>/dev/null || echo "")
+        if [ -n "$cron_volumes" ] && echo "$cron_volumes" | grep -F -q "$pvc_name"; then
+            echo "$(timestamp) -   Deleting CronJob: $name"
+            /opt/bin/kubectl delete cronjob "$name" -n "$namespace" --ignore-not-found=true
             deleted_count=$((deleted_count + 1))
         fi
     done

From 2e63c601fc224de20c345172d9b805ffb6bdbeac Mon Sep 17 00:00:00 2001
From: Andrija Panic <45762285+andrijapanicsb@users.noreply.github.com>
Date: Wed, 30 Sep 2026 11:00:46 +0200
Subject: [PATCH 12/41] Clarify KVM import template requirement (#13126)

---
 .../api/command/admin/vm/ImportUnmanagedInstanceCmd.java        | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ImportUnmanagedInstanceCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ImportUnmanagedInstanceCmd.java
index d60c627163b8..fd18e44754a4 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ImportUnmanagedInstanceCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ImportUnmanagedInstanceCmd.java
@@ -115,7 +115,7 @@ public class ImportUnmanagedInstanceCmd extends BaseAsyncCmd {
     @Parameter(name = ApiConstants.TEMPLATE_ID,
             type = CommandType.UUID,
             entityType = TemplateResponse.class,
-            description = "The ID of the Template for the Instance")
+            description = "The ID of the Template for the Instance. Required when the instance to import is an unmanaged KVM Instance.")
     private Long templateId;
 
     @Parameter(name = ApiConstants.SERVICE_OFFERING_ID,

From 5deb6a958df549b68232f9e7dedff8de4422e603 Mon Sep 17 00:00:00 2001
From: Manoj Kumar <manojkr.itbhu@gmail.com>
Date: Thu, 1 Oct 2026 03:30:06 +0530
Subject: [PATCH 13/41] Improve date/timestamp handling performance in
 GenericDaoBase and DateUtil (#13809)

* Improve date/timestamp handling performance in GenericDaoBase and DateUtil

* address review comment
---
 .../apache/cloudstack/backup/BackupVO.java    |   2 +-
 .../com/cloud/utils/db/GenericDaoBase.java    |  78 ++++++++----
 .../cloud/utils/db/GenericDaoBaseTest.java    |  75 ++++++++++++
 .../main/java/com/cloud/api/ApiServer.java    |   7 +-
 .../java/com/cloud/api/ApiServerTest.java     |  69 +++++++++++
 .../main/java/com/cloud/utils/DateUtil.java   |  63 +++++-----
 .../java/com/cloud/utils/DateUtilTest.java    | 113 ++++++++++++++++--
 7 files changed, 330 insertions(+), 77 deletions(-)

diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupVO.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupVO.java
index b4cd2f7badae..a11de51ed63f 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupVO.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupVO.java
@@ -60,7 +60,7 @@ public class BackupVO implements Backup {
     private String backupType;
 
     @Column(name = "date")
-    @Temporal(value = TemporalType.DATE)
+    @Temporal(value = TemporalType.TIMESTAMP)
     private Date date;
 
     @Column(name = GenericDao.REMOVED_COLUMN)
diff --git a/framework/db/src/main/java/com/cloud/utils/db/GenericDaoBase.java b/framework/db/src/main/java/com/cloud/utils/db/GenericDaoBase.java
index e6a4bb8f9b9e..3290d7125f2f 100644
--- a/framework/db/src/main/java/com/cloud/utils/db/GenericDaoBase.java
+++ b/framework/db/src/main/java/com/cloud/utils/db/GenericDaoBase.java
@@ -34,6 +34,9 @@
 import java.sql.ResultSetMetaData;
 import java.sql.SQLException;
 import java.sql.Statement;
+import java.sql.Time;
+import java.sql.Timestamp;
+import java.sql.Types;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Calendar;
@@ -67,7 +70,6 @@
 import org.apache.commons.lang3.exception.ExceptionUtils;
 
 import com.amazonaws.util.CollectionUtils;
-import com.cloud.utils.DateUtil;
 import com.cloud.utils.NumbersUtil;
 import com.cloud.utils.Pair;
 import com.cloud.utils.Ternary;
@@ -129,6 +131,28 @@ public abstract class GenericDaoBase<T, ID extends Serializable> extends Compone
 
     protected final static TimeZone s_gmtTimeZone = TimeZone.getTimeZone("GMT");
 
+    /**
+     * Returns a fresh GMT {@link Calendar} for a single JDBC get/set timestamp call. Calendar is
+     * mutable and JDBC drivers may mutate the instance passed to them, so a new one is used per call
+     * rather than sharing a single instance across concurrent DAO operations.
+     */
+    protected static Calendar gmtCalendar() {
+        return Calendar.getInstance(s_gmtTimeZone);
+    }
+
+    /**
+     * Returns the SQL type ({@link Types}) matching the temporal flag of the given attribute, so a
+     * null date/time/timestamp column is bound with the correct type instead of always TIMESTAMP.
+     */
+    protected static int temporalSqlType(Attribute attr) {
+        if (attr.is(Attribute.Flag.Date)) {
+            return Types.DATE;
+        } else if (attr.is(Attribute.Flag.Time)) {
+            return Types.TIME;
+        }
+        return Types.TIMESTAMP;
+    }
+
     protected final static Map<Class<?>, GenericDao<?, ? extends Serializable>> s_daoMaps = new ConcurrentHashMap<Class<?>, GenericDao<?, ? extends Serializable>>(71);
     private final ConversionSupport _conversionSupport;
 
@@ -598,20 +622,16 @@ protected void setField(Object entity, Field field, ResultSet rs, int index) thr
                     field.set(entity, rs.getInt(index));
                 }
             } else if (type == Date.class) {
-                final Object data = rs.getDate(index);
-                if (data == null) {
-                    field.set(entity, null);
-                    return;
-                }
-                field.set(entity, DateUtil.parseDateString(s_gmtTimeZone, rs.getString(index)));
+                final Timestamp ts = rs.getTimestamp(index, gmtCalendar());
+                field.set(entity, ts == null ? null : new Date(ts.getTime()));
             } else if (type == Calendar.class) {
-                final Object data = rs.getDate(index);
+                final Timestamp data = rs.getTimestamp(index, gmtCalendar());
                 if (data == null) {
                     field.set(entity, null);
                     return;
                 }
-                final Calendar cal = Calendar.getInstance();
-                cal.setTime(DateUtil.parseDateString(s_gmtTimeZone, rs.getString(index)));
+                final Calendar cal = Calendar.getInstance(s_gmtTimeZone);
+                cal.setTime(data);
                 field.set(entity, cal);
             } else if (type == boolean.class) {
                 field.setBoolean(entity, rs.getBoolean(index));
@@ -732,11 +752,11 @@ protected static <M> M getObject(Class<M> type, ResultSet rs, int index) throws
                 return (M) (Long) rs.getLong(index);
             }
         } else if (type == Date.class) {
-            final Object data = rs.getDate(index);
-            if (data == null) {
+            final Timestamp ts = rs.getTimestamp(index, gmtCalendar());
+            if (ts == null) {
                 return null;
             } else {
-                return (M)DateUtil.parseDateString(s_gmtTimeZone, rs.getString(index));
+                return (M) new Date(ts.getTime());
             }
         } else if (type == short.class) {
             return (M) (Short) rs.getShort(index);
@@ -779,12 +799,12 @@ protected static <M> M getObject(Class<M> type, ResultSet rs, int index) throws
                 return (M) (Byte) rs.getByte(index);
             }
         } else if (type == Calendar.class) {
-            final Object data = rs.getDate(index);
+            final Timestamp data = rs.getTimestamp(index, gmtCalendar());
             if (data == null) {
                 return null;
             } else {
-                final Calendar cal = Calendar.getInstance();
-                cal.setTime(DateUtil.parseDateString(s_gmtTimeZone, rs.getString(index)));
+                final Calendar cal = Calendar.getInstance(s_gmtTimeZone);
+                cal.setTime(data);
                 return (M)cal;
             }
         } else if (type == byte[].class) {
@@ -1696,7 +1716,12 @@ protected void insertElementCollection(T entity, Attribute idAttribute, ID id, M
             while (en.hasMoreElements()) {
                 pstmt = txn.prepareAutoCloseStatement(ec.insertSql);
                 if (ec.targetClass == Date.class) {
-                    pstmt.setString(1, DateUtil.getDateDisplayString(s_gmtTimeZone, (Date)en.nextElement()));
+                    Date d = (Date) en.nextElement();
+                    if (d == null) {
+                        pstmt.setNull(1, Types.TIMESTAMP);
+                    } else {
+                        pstmt.setTimestamp(1, new Timestamp(d.getTime()), gmtCalendar());
+                    }
                 } else {
                     pstmt.setObject(1, en.nextElement());
                 }
@@ -1800,28 +1825,28 @@ protected void prepareAttribute(final int j, final PreparedStatement pstmt, fina
         } else if (attr.field.getType() == Date.class) {
             final Date date = (Date)value;
             if (date == null || date.equals(DATE_TO_NULL)) {
-                pstmt.setObject(j, null);
+                pstmt.setNull(j, temporalSqlType(attr));
                 return;
             }
             if (attr.is(Attribute.Flag.Date)) {
-                pstmt.setString(j, DateUtil.getDateDisplayString(s_gmtTimeZone, date));
+                pstmt.setDate(j, new java.sql.Date(date.getTime()), gmtCalendar());
             } else if (attr.is(Attribute.Flag.TimeStamp)) {
-                pstmt.setString(j, DateUtil.getDateDisplayString(s_gmtTimeZone, date));
+                pstmt.setTimestamp(j, new Timestamp(date.getTime()), gmtCalendar());
             } else if (attr.is(Attribute.Flag.Time)) {
-                pstmt.setString(j, DateUtil.getDateDisplayString(s_gmtTimeZone, date));
+                pstmt.setTime(j, new java.sql.Time(date.getTime()), gmtCalendar());
             }
         } else if (attr.field.getType() == Calendar.class) {
             final Calendar cal = (Calendar)value;
             if (cal == null) {
-                pstmt.setObject(j, null);
+                pstmt.setNull(j, temporalSqlType(attr));
                 return;
             }
             if (attr.is(Attribute.Flag.Date)) {
-                pstmt.setString(j, DateUtil.getDateDisplayString(s_gmtTimeZone, cal.getTime()));
+                pstmt.setDate(j, new java.sql.Date(cal.getTimeInMillis()), gmtCalendar());
             } else if (attr.is(Attribute.Flag.TimeStamp)) {
-                pstmt.setString(j, DateUtil.getDateDisplayString(s_gmtTimeZone, cal.getTime()));
+                pstmt.setTimestamp(j, new Timestamp(cal.getTimeInMillis()), gmtCalendar());
             } else if (attr.is(Attribute.Flag.Time)) {
-                pstmt.setString(j, DateUtil.getDateDisplayString(s_gmtTimeZone, cal.getTime()));
+                pstmt.setTime(j, new Time(cal.getTimeInMillis()), gmtCalendar());
             }
         } else if (attr.field.getType().isEnum()) {
             final Enumerated enumerated = attr.field.getAnnotation(Enumerated.class);
@@ -1955,7 +1980,8 @@ protected void loadCollection(T entity, Attribute attr) {
                     }
                 } else if (ec.targetClass == Date.class) {
                     while (rs.next()) {
-                        lst.add(DateUtil.parseDateString(s_gmtTimeZone, rs.getString(1)));
+                        final Timestamp ts = rs.getTimestamp(1, gmtCalendar());
+                        lst.add(ts == null ? null : new Date(ts.getTime()));
                     }
                 } else if (ec.targetClass == Boolean.class) {
                     while (rs.next()) {
diff --git a/framework/db/src/test/java/com/cloud/utils/db/GenericDaoBaseTest.java b/framework/db/src/test/java/com/cloud/utils/db/GenericDaoBaseTest.java
index ebf514f532f7..41a7be4ab867 100644
--- a/framework/db/src/test/java/com/cloud/utils/db/GenericDaoBaseTest.java
+++ b/framework/db/src/test/java/com/cloud/utils/db/GenericDaoBaseTest.java
@@ -18,9 +18,14 @@
 
 import java.sql.ResultSet;
 import java.sql.SQLException;
+import java.sql.Timestamp;
+import java.sql.Types;
 import java.util.ArrayList;
+import java.util.Calendar;
 import java.util.Collection;
+import java.util.Date;
 import java.util.List;
+import java.util.TimeZone;
 
 import org.junit.Assert;
 import org.junit.Before;
@@ -331,4 +336,74 @@ public void testLockOneRandomRowReturnsFirstElement() {
         Assert.assertNotNull(result);
         Assert.assertEquals(expectedResult, result);
     }
+
+    @Test
+    public void gmtCalendarUsesGmtTimeZone() {
+        Calendar calendar = GenericDaoBase.gmtCalendar();
+
+        Assert.assertEquals(TimeZone.getTimeZone("GMT"), calendar.getTimeZone());
+    }
+
+    @Test
+    public void gmtCalendarReturnsFreshInstancePerCall() {
+        Assert.assertNotSame(GenericDaoBase.gmtCalendar(), GenericDaoBase.gmtCalendar());
+    }
+
+    @Test
+    public void temporalSqlTypeDate() {
+        Attribute attr = new Attribute("table", "column");
+        attr.flags = Attribute.Flag.Date.setTrue(attr.flags);
+
+        Assert.assertEquals(Types.DATE, GenericDaoBase.temporalSqlType(attr));
+    }
+
+    @Test
+    public void temporalSqlTypeTime() {
+        Attribute attr = new Attribute("table", "column");
+        attr.flags = Attribute.Flag.Time.setTrue(attr.flags);
+
+        Assert.assertEquals(Types.TIME, GenericDaoBase.temporalSqlType(attr));
+    }
+
+    @Test
+    public void temporalSqlTypeDefaultsToTimestamp() {
+        Attribute attr = new Attribute("table", "column");
+        attr.flags = Attribute.Flag.TimeStamp.setTrue(attr.flags);
+
+        Assert.assertEquals(Types.TIMESTAMP, GenericDaoBase.temporalSqlType(attr));
+    }
+
+    @Test
+    public void getObjectDateReadsViaGmtTimestamp() throws SQLException {
+        Timestamp ts = new Timestamp(1_700_000_000_000L);
+        Mockito.when(resultSet.getTimestamp(Mockito.eq(2), Mockito.any(Calendar.class))).thenReturn(ts);
+
+        Date result = GenericDaoBase.getObject(Date.class, resultSet, 2);
+
+        Assert.assertEquals(ts.getTime(), result.getTime());
+    }
+
+    @Test
+    public void getObjectDateNullTimestampReturnsNull() throws SQLException {
+        Mockito.when(resultSet.getTimestamp(Mockito.eq(3), Mockito.any(Calendar.class))).thenReturn(null);
+
+        Assert.assertNull(GenericDaoBase.getObject(Date.class, resultSet, 3));
+    }
+
+    @Test
+    public void getObjectCalendarReadsViaGmtTimestamp() throws SQLException {
+        Timestamp ts = new Timestamp(1_700_000_000_000L);
+        Mockito.when(resultSet.getTimestamp(Mockito.eq(4), Mockito.any(Calendar.class))).thenReturn(ts);
+
+        Calendar result = GenericDaoBase.getObject(Calendar.class, resultSet, 4);
+
+        Assert.assertEquals(ts.getTime(), result.getTimeInMillis());
+    }
+
+    @Test
+    public void getObjectCalendarNullTimestampReturnsNull() throws SQLException {
+        Mockito.when(resultSet.getTimestamp(Mockito.eq(5), Mockito.any(Calendar.class))).thenReturn(null);
+
+        Assert.assertNull(GenericDaoBase.getObject(Calendar.class, resultSet, 5));
+    }
 }
diff --git a/server/src/main/java/com/cloud/api/ApiServer.java b/server/src/main/java/com/cloud/api/ApiServer.java
index 6e058746ccb8..396ec5059480 100644
--- a/server/src/main/java/com/cloud/api/ApiServer.java
+++ b/server/src/main/java/com/cloud/api/ApiServer.java
@@ -192,6 +192,7 @@
 
 import static com.cloud.user.AccountManagerImpl.apiKeyAccess;
 import static org.apache.cloudstack.user.UserPasswordResetManager.UserPasswordResetEnabled;
+import static org.apache.commons.lang3.StringUtils.deleteWhitespace;
 
 @Component
 public class ApiServer extends ManagerBase implements HttpRequestHandler, ApiServerService, Configurable {
@@ -1372,11 +1373,10 @@ private void checkCommandAvailable(final User user, final String commandName, fi
             throw new PermissionDeniedException("User is null for role based API access check for command" + commandName);
         }
 
-        final Account account = accountMgr.getAccount(user.getAccountId());
-        final String accessAllowedCidrs = ApiServiceConfiguration.ApiAllowedSourceCidrList.valueIn(account.getId()).replaceAll("\\s","");
         final Boolean apiSourceCidrChecksEnabled = ApiServiceConfiguration.ApiSourceCidrChecksEnabled.value();
-
         if (apiSourceCidrChecksEnabled) {
+            final Account account = accountMgr.getAccount(user.getAccountId());
+            final String accessAllowedCidrs = deleteWhitespace(ApiServiceConfiguration.ApiAllowedSourceCidrList.valueIn(account.getId()));
             logger.debug("CIDRs from which account '" + account.toString() + "' is allowed to perform API calls: " + accessAllowedCidrs);
             if (!NetUtils.isIpInCidrList(remoteAddress, accessAllowedCidrs.split(","))) {
                 logger.warn("Request by account '" + account.toString() + "' was denied since " + remoteAddress + " does not match " + accessAllowedCidrs);
@@ -1384,7 +1384,6 @@ private void checkCommandAvailable(final User user, final String commandName, fi
                 }
         }
 
-
         for (final APIChecker apiChecker : apiAccessCheckers) {
             apiChecker.checkAccess(user, commandName);
         }
diff --git a/server/src/test/java/com/cloud/api/ApiServerTest.java b/server/src/test/java/com/cloud/api/ApiServerTest.java
index dedd6e02ec5c..8ecdc458018c 100644
--- a/server/src/test/java/com/cloud/api/ApiServerTest.java
+++ b/server/src/test/java/com/cloud/api/ApiServerTest.java
@@ -17,14 +17,20 @@
 package com.cloud.api;
 
 import com.cloud.domain.Domain;
+import com.cloud.exception.OriginDeniedException;
+import com.cloud.exception.PermissionDeniedException;
 import com.cloud.user.Account;
+import com.cloud.user.AccountManager;
 import com.cloud.user.User;
 import com.cloud.user.UserAccount;
 import com.cloud.utils.exception.CloudRuntimeException;
+import org.apache.cloudstack.config.ApiServiceConfiguration;
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.user.UserPasswordResetManager;
+import org.junit.After;
 import org.junit.AfterClass;
 import org.junit.Assert;
+import org.junit.Before;
 import org.junit.BeforeClass;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -33,9 +39,12 @@
 import org.mockito.MockedConstruction;
 import org.mockito.Mockito;
 import org.mockito.junit.MockitoJUnitRunner;
+import org.springframework.test.util.ReflectionTestUtils;
 
 import java.lang.reflect.Field;
+import java.net.InetAddress;
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.List;
 
 import static org.apache.cloudstack.user.UserPasswordResetManager.UserPasswordResetEnabled;
@@ -49,6 +58,12 @@ public class ApiServerTest {
     @Mock
     UserPasswordResetManager userPasswordResetManager;
 
+    @Mock
+    AccountManager accountMgr;
+
+    private static final String DEFAULT_CIDR_CHECKS_ENABLED = ApiServiceConfiguration.ApiSourceCidrChecksEnabled.defaultValue();
+    private static final String DEFAULT_ALLOWED_CIDRS = ApiServiceConfiguration.ApiAllowedSourceCidrList.defaultValue();
+
     @BeforeClass
     public static void beforeClass() throws Exception {
         overrideDefaultConfigValue(UserPasswordResetEnabled, "_value", true);
@@ -59,6 +74,17 @@ public static void afterClass() throws Exception {
         overrideDefaultConfigValue(UserPasswordResetEnabled, "_value", false);
     }
 
+    @Before
+    public void setupCommandAvailableChecks() {
+        apiServer.setApiAccessCheckers(Collections.emptyList());
+    }
+
+    @After
+    public void resetCidrConfig() throws Exception {
+        overrideDefaultConfigValue(ApiServiceConfiguration.ApiSourceCidrChecksEnabled, "_defaultValue", DEFAULT_CIDR_CHECKS_ENABLED);
+        overrideDefaultConfigValue(ApiServiceConfiguration.ApiAllowedSourceCidrList, "_defaultValue", DEFAULT_ALLOWED_CIDRS);
+    }
+
     private static void overrideDefaultConfigValue(final ConfigKey configKey, final String name, final Object o) throws IllegalAccessException, NoSuchFieldException {
         Field f = ConfigKey.class.getDeclaredField(name);
         f.setAccessible(true);
@@ -176,4 +202,47 @@ public void testVerifyApiKeyAccessAllowed() {
         Mockito.when(account.getApiKeyAccess()).thenReturn(null);
         Assert.assertEquals(true, apiServer.verifyApiKeyAccessAllowed(user, account));
     }
+
+    @Test
+    public void testCheckCommandAvailableSkipsCidrLookupWhenDisabled() throws Exception {
+        overrideDefaultConfigValue(ApiServiceConfiguration.ApiSourceCidrChecksEnabled, "_defaultValue", "false");
+        User user = Mockito.mock(User.class);
+
+        ReflectionTestUtils.invokeMethod(apiServer, "checkCommandAvailable", user, "listVirtualMachines", InetAddress.getByName("127.0.0.1"));
+
+        Mockito.verify(accountMgr, Mockito.never()).getAccount(Mockito.anyLong());
+    }
+
+    @Test
+    public void testCheckCommandAvailableAllowsMatchingCidr() throws Exception {
+        overrideDefaultConfigValue(ApiServiceConfiguration.ApiSourceCidrChecksEnabled, "_defaultValue", "true");
+        overrideDefaultConfigValue(ApiServiceConfiguration.ApiAllowedSourceCidrList, "_defaultValue", "127.0.0.1/32");
+        User user = Mockito.mock(User.class);
+        Mockito.when(user.getAccountId()).thenReturn(1L);
+        Account account = Mockito.mock(Account.class);
+        Mockito.when(account.getId()).thenReturn(1L);
+        Mockito.when(accountMgr.getAccount(1L)).thenReturn(account);
+
+        ReflectionTestUtils.invokeMethod(apiServer, "checkCommandAvailable", user, "listVirtualMachines", InetAddress.getByName("127.0.0.1"));
+
+        Mockito.verify(accountMgr).getAccount(1L);
+    }
+
+    @Test(expected = OriginDeniedException.class)
+    public void testCheckCommandAvailableDeniesNonMatchingCidr() throws Exception {
+        overrideDefaultConfigValue(ApiServiceConfiguration.ApiSourceCidrChecksEnabled, "_defaultValue", "true");
+        overrideDefaultConfigValue(ApiServiceConfiguration.ApiAllowedSourceCidrList, "_defaultValue", "10.0.0.0/8");
+        User user = Mockito.mock(User.class);
+        Mockito.when(user.getAccountId()).thenReturn(1L);
+        Account account = Mockito.mock(Account.class);
+        Mockito.when(account.getId()).thenReturn(1L);
+        Mockito.when(accountMgr.getAccount(1L)).thenReturn(account);
+
+        ReflectionTestUtils.invokeMethod(apiServer, "checkCommandAvailable", user, "listVirtualMachines", InetAddress.getByName("127.0.0.1"));
+    }
+
+    @Test(expected = PermissionDeniedException.class)
+    public void testCheckCommandAvailableThrowsWhenUserNull() throws Exception {
+        ReflectionTestUtils.invokeMethod(apiServer, "checkCommandAvailable", null, "listVirtualMachines", InetAddress.getByName("127.0.0.1"));
+    }
 }
diff --git a/utils/src/main/java/com/cloud/utils/DateUtil.java b/utils/src/main/java/com/cloud/utils/DateUtil.java
index 00ae5565dadc..73036285cdca 100644
--- a/utils/src/main/java/com/cloud/utils/DateUtil.java
+++ b/utils/src/main/java/com/cloud/utils/DateUtil.java
@@ -19,17 +19,16 @@
 
 package com.cloud.utils;
 
-import java.text.DateFormat;
 import java.text.ParseException;
-import java.text.SimpleDateFormat;
-import java.time.LocalDateTime;
-import java.time.ZoneId;
 import java.time.ZonedDateTime;
 import java.time.YearMonth;
 import java.util.Calendar;
 import java.util.Date;
 import java.util.TimeZone;
+import java.util.concurrent.ConcurrentHashMap;
 
+import java.time.LocalDateTime;
+import java.time.ZoneId;
 import java.time.format.DateTimeFormatter;
 import java.time.format.DateTimeParseException;
 import java.time.OffsetDateTime;
@@ -49,7 +48,11 @@ public class DateUtil {
     public static final TimeZone GMT_TIMEZONE = TimeZone.getTimeZone("GMT");
     public static final String YYYYMMDD_FORMAT = "yyyyMMddHHmmss";
     public static final String ZONED_DATETIME_FORMAT = "yyyy-MM-dd'T'HH:mm:ssZ";
-    private static final DateFormat ZONED_DATETIME_SIMPLE_FORMATTER = new SimpleDateFormat(ZONED_DATETIME_FORMAT);
+
+    private static final DateTimeFormatter OUTPUT_FORMATTER =
+            DateTimeFormatter.ofPattern(ZONED_DATETIME_FORMAT).withZone(ZoneId.systemDefault());
+
+    private static final ConcurrentHashMap<String, DateTimeFormatter> s_formatterCache = new ConcurrentHashMap<>();
 
     private static final DateTimeFormatter[] parseFormats = new DateTimeFormatter[]{
         DateTimeFormatter.ISO_OFFSET_DATE_TIME,
@@ -68,6 +71,11 @@ public static Date currentGMTTime() {
         return new Date();
     }
 
+    private static DateTimeFormatter getFormatter(String pattern, ZoneId zone) {
+        String key = pattern + "|" + zone.getId();
+        return s_formatterCache.computeIfAbsent(key, k -> DateTimeFormatter.ofPattern(pattern).withZone(zone));
+    }
+
     public static Date parseTZDateString(String str) throws ParseException {
         for (DateTimeFormatter formatter : parseFormats) {
             try {
@@ -85,13 +93,12 @@ public static Date parseDateString(TimeZone tz, String dateString) {
     }
 
     public static Date parseDateString(TimeZone tz, String dateString, String formatString) {
-        DateFormat df = new SimpleDateFormat(formatString);
-        df.setTimeZone(tz);
-
+        ZoneId zoneId = tz.toZoneId();
+        DateTimeFormatter formatter = getFormatter(formatString, zoneId);
         try {
-            return df.parse(dateString);
-        } catch (ParseException e) {
-            throw new CloudRuntimeException("why why ", e);
+            return Date.from(LocalDateTime.parse(dateString, formatter).atZone(zoneId).toInstant());
+        } catch (DateTimeParseException e) {
+            throw new CloudRuntimeException("Failed to parse date string: " + dateString, e);
         }
     }
 
@@ -108,21 +115,14 @@ public static String getDateDisplayString(TimeZone tz, Date time, String formatS
             return null;
         }
 
-        DateFormat df = new SimpleDateFormat(formatString);
-        df.setTimeZone(tz);
-
-        return df.format(time);
+        return getFormatter(formatString, tz.toZoneId()).format(time.toInstant());
     }
 
     public static String getOutputString(Date date) {
         if (date == null) {
             return "";
         }
-        String formattedString;
-        synchronized (ZONED_DATETIME_SIMPLE_FORMATTER) {
-            formattedString = ZONED_DATETIME_SIMPLE_FORMATTER.format(date);
-        }
-        return formattedString;
+        return OUTPUT_FORMATTER.format(date.toInstant());
     }
 
     public static Date now() {
@@ -155,7 +155,7 @@ public static IntervalType getIntervalType(short type) {
 
     /**
      * Return next run time
-     * @param intervalType  hourly/daily/weekly/monthly
+     * @param type  hourly/daily/weekly/monthly
      * @param schedule MM[:HH][:DD] format. DD is day of week for weekly and day of month for monthly
      * @param timezone The timezone in which the schedule string is specified
      * @param startDate if specified, returns next run time after the specified startDate
@@ -177,7 +177,8 @@ public static Date getNextRunTime(IntervalType type, String schedule, String tim
         int minutes = 0;
         int hour = 0;
         int day = 0;
-        Date execDate = null;
+        Date execDate;
+        Date now = new Date();
 
         switch (type) {
             case HOURLY:
@@ -199,7 +200,7 @@ public static Date getNextRunTime(IntervalType type, String schedule, String tim
                 // During testing we use a test clock which runs much faster than the real clock
                 // So startDate and execDate will always be ahead in the future
                 // and we will never increase the time here
-                if (execDate.before(new Date()) || !execDate.after(startDate)) {
+                if (execDate.before(now) || !execDate.after(startDate)) {
                     scheduleTime.add(Calendar.HOUR_OF_DAY, 1);
                 }
                 break;
@@ -225,7 +226,7 @@ public static Date getNextRunTime(IntervalType type, String schedule, String tim
                 // During testing we use a test clock which runs much faster than the real clock
                 // So startDate and execDate will always be ahead in the future
                 // and we will never increase the time here
-                if (execDate.before(new Date()) || !execDate.after(startDate)) {
+                if (execDate.before(now) || !execDate.after(startDate)) {
                     scheduleTime.add(Calendar.DAY_OF_YEAR, 1);
                 }
                 break;
@@ -252,10 +253,9 @@ public static Date getNextRunTime(IntervalType type, String schedule, String tim
                 // During testing we use a test clock which runs much faster than the real clock
                 // So startDate and execDate will always be ahead in the future
                 // and we will never increase the time here
-                if (execDate.before(new Date()) || !execDate.after(startDate)) {
+                if (execDate.before(now) || !execDate.after(startDate)) {
                     scheduleTime.add(Calendar.DAY_OF_WEEK, 7);
                 }
-                ;
                 break;
             case MONTHLY:
                 if (scheduleParts.length < 3) {
@@ -283,7 +283,7 @@ public static Date getNextRunTime(IntervalType type, String schedule, String tim
                 // During testing we use a test clock which runs much faster than the real clock
                 // So startDate and execDate will always be ahead in the future
                 // and we will never increase the time here
-                if (execDate.before(new Date()) || !execDate.after(startDate)) {
+                if (execDate.before(now) || !execDate.after(startDate)) {
                     scheduleTime.add(Calendar.MONTH, 1);
                 }
                 break;
@@ -302,14 +302,7 @@ public static Date getNextRunTime(IntervalType type, String schedule, String tim
     }
 
     public static long getTimeDifference(Date date1, Date date2){
-
-        Calendar dateCalendar1 = Calendar.getInstance();
-        dateCalendar1.setTime(date1);
-        Calendar dateCalendar2 = Calendar.getInstance();
-        dateCalendar2.setTime(date2);
-
-        return (dateCalendar1.getTimeInMillis() - dateCalendar2.getTimeInMillis() )/1000;
-
+        return (date1.getTime() - date2.getTime()) / 1000;
     }
 
     public static CronExpression parseSchedule(String schedule) {
diff --git a/utils/src/test/java/com/cloud/utils/DateUtilTest.java b/utils/src/test/java/com/cloud/utils/DateUtilTest.java
index 98b4d11c9d76..77079986cbee 100644
--- a/utils/src/test/java/com/cloud/utils/DateUtilTest.java
+++ b/utils/src/test/java/com/cloud/utils/DateUtilTest.java
@@ -18,30 +18,36 @@
 //
 package com.cloud.utils;
 
+import com.cloud.utils.DateUtil.IntervalType;
+import com.cloud.utils.exception.CloudRuntimeException;
+import org.junit.Test;
+
 import java.text.DateFormat;
 import java.text.ParseException;
 import java.text.SimpleDateFormat;
 import java.time.Instant;
+import java.time.OffsetDateTime;
 import java.time.ZoneId;
+import java.time.format.DateTimeFormatter;
 import java.util.Calendar;
 import java.util.Date;
 import java.util.TimeZone;
-
-import java.time.format.DateTimeFormatter;
-import java.time.OffsetDateTime;
-
-import com.cloud.utils.DateUtil.IntervalType;
-
-import org.junit.Test;
-
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
 
 public class DateUtilTest {
+    private static final String TEST_DATE_GMT = "2023-06-15 10:30:00";
+    private static final String TEST_DATE_EST = "2023-06-15 05:30:00";
+    private static final String TEST_DATE_ISO = "2023-06-15T10:30:00Z";
+    private static final String TEST_DATE_YYMMDD = "20230615103000";
+    private static final TimeZone GMT = DateUtil.GMT_TIMEZONE;
+    private static final TimeZone EST = TimeZone.getTimeZone("EST");
+
     // command line test tool
     public static void main(String[] args) {
         TimeZone localTimezone = Calendar.getInstance().getTimeZone();
-        TimeZone gmtTimezone = TimeZone.getTimeZone("GMT");
-        TimeZone estTimezone = TimeZone.getTimeZone("EST");
+        TimeZone gmtTimezone = GMT;
+        TimeZone estTimezone = EST;
 
         Date time = new Date();
         System.out.println("local time :" + DateUtil.getDateDisplayString(localTimezone, time));
@@ -49,7 +55,9 @@ public static void main(String[] args) {
         System.out.println("EST time   :" + DateUtil.getDateDisplayString(estTimezone, time));
         //Test next run time. Expects interval and schedule as arguments
         if (args.length == 2) {
-            System.out.println("Next run time: " + DateUtil.getNextRunTime(IntervalType.getIntervalType(args[0]), args[1], "GMT", time).toString());
+            System.out.println("Next run time: " + DateUtil.getNextRunTime(IntervalType.getIntervalType(args[0]),
+                            args[1], "GMT", time)
+                    .toString());
         }
     }
 
@@ -130,4 +138,87 @@ public void zonedTimeFormatIsoNoColonZMs() throws ParseException {
 
         assertEquals(str, time.toString(), dtParsed.toString());
     }
+
+    @Test
+    public void parseDateStringDefaultFormat() {
+        TimeZone gmt = GMT;
+        Date date = DateUtil.parseDateString(gmt, TEST_DATE_GMT);
+        assertEquals(TEST_DATE_GMT, DateUtil.getDateDisplayString(gmt, date));
+    }
+
+    @Test
+    public void parseDateStringInterpretedInRequestedTimezone() {
+        TimeZone est = EST;
+        Date date = DateUtil.parseDateString(est, TEST_DATE_EST);
+        assertEquals(TEST_DATE_GMT, DateUtil.getDateDisplayString(GMT, date));
+    }
+
+    @Test
+    public void parseDateStringCustomFormat() {
+        TimeZone gmt = GMT;
+        Date date = DateUtil.parseDateString(gmt, TEST_DATE_YYMMDD, DateUtil.YYYYMMDD_FORMAT);
+        assertEquals(TEST_DATE_GMT, DateUtil.getDateDisplayString(gmt, date));
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void parseDateStringInvalidInputThrows() {
+        DateUtil.parseDateString(GMT, "not-a-date");
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void parseDateStringFormatMismatchThrows() {
+        DateUtil.parseDateString(GMT, TEST_DATE_GMT, DateUtil.YYYYMMDD_FORMAT);
+    }
+
+    @Test
+    public void displayDateInTimezoneGmt() {
+        Date date = Date.from(Instant.parse(TEST_DATE_ISO));
+        assertEquals("2023-06-15T10:30:00+0000", DateUtil.displayDateInTimezone(GMT, date));
+    }
+
+    @Test
+    public void displayDateInTimezoneEst() {
+        Date date = Date.from(Instant.parse(TEST_DATE_ISO));
+        assertEquals("2023-06-15T05:30:00-0500", DateUtil.displayDateInTimezone(EST, date));
+    }
+
+    @Test
+    public void getDateDisplayStringGmt() {
+        Date date = Date.from(Instant.parse(TEST_DATE_ISO));
+        assertEquals(TEST_DATE_GMT, DateUtil.getDateDisplayString(GMT, date));
+    }
+
+    @Test
+    public void getDateDisplayStringTimezoneShift() {
+        Date date = Date.from(Instant.parse(TEST_DATE_ISO));
+        assertEquals(TEST_DATE_EST, DateUtil.getDateDisplayString(EST, date));
+    }
+
+    @Test
+    public void getDateDisplayStringCustomFormat() {
+        Date date = Date.from(Instant.parse(TEST_DATE_ISO));
+        assertEquals(TEST_DATE_YYMMDD, DateUtil.getDateDisplayString(GMT, date, DateUtil.YYYYMMDD_FORMAT));
+    }
+
+    @Test
+    public void getDateDisplayStringNullDate() {
+        assertEquals(null, DateUtil.getDateDisplayString(GMT, null));
+    }
+
+    @Test
+    public void displayDateInTimezoneNullDate() {
+        assertEquals(null, DateUtil.displayDateInTimezone(GMT, null));
+    }
+
+    @Test
+    public void getOutputStringNull() {
+        assertEquals("", DateUtil.getOutputString(null));
+    }
+
+    @Test
+    public void getOutputStringNonNull() {
+        Date date = Date.from(Instant.parse(TEST_DATE_ISO));
+        String result = DateUtil.getOutputString(date);
+        assertTrue(result.matches("\\d{4}-\\d{2}-\\d{2}T\\d{2}:\\d{2}:\\d{2}[+-]\\d{4}"));
+    }
 }

From 4b2d387287a3d49adeef183716fb4ab0d0c1fdf3 Mon Sep 17 00:00:00 2001
From: Ramgopal Nagaboina <ramgopal.nagaboina.dev@gmail.com>
Date: Thu, 1 Oct 2026 10:41:33 -0400
Subject: [PATCH 14/41] server: null-check requested IP in
 assignSourceNatPublicIpAddress (#14025)

---
 .../cloud/network/IpAddressManagerImpl.java   |  2 +-
 .../IpAddressManagerImplSourceNatTest.java    | 58 +++++++++++++++++++
 2 files changed, 59 insertions(+), 1 deletion(-)
 create mode 100644 server/src/test/java/com/cloud/network/IpAddressManagerImplSourceNatTest.java

diff --git a/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java b/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
index 25bc29a35681..d4743a6aec9d 100644
--- a/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
@@ -828,7 +828,7 @@ public PublicIp assignSourceNatPublicIpAddress(long dcId, Long podId, Account ow
         if(networkPublicIp != null)
             return null;
         IPAddressVO ipAddressVO = _ipAddressDao.findByIpAndDcId(dcId, requestedIp);
-        if (ipAddressVO.getState() != State.Free) {
+        if (ipAddressVO == null || ipAddressVO.getState() != State.Free) {
             throw new InsufficientAddressCapacityException("can not assign to this network", Network.class, networkId);
         }
         return fetchNewPublicIp(dcId, podId, null, owner, type, networkId, true, true, requestedIp, null, isSystem, null, null, forSystemVms);
diff --git a/server/src/test/java/com/cloud/network/IpAddressManagerImplSourceNatTest.java b/server/src/test/java/com/cloud/network/IpAddressManagerImplSourceNatTest.java
new file mode 100644
index 000000000000..d5c9eead8609
--- /dev/null
+++ b/server/src/test/java/com/cloud/network/IpAddressManagerImplSourceNatTest.java
@@ -0,0 +1,58 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.network;
+
+import static org.mockito.Mockito.when;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.dc.Vlan.VlanType;
+import com.cloud.exception.InsufficientAddressCapacityException;
+import com.cloud.network.dao.IPAddressDao;
+import com.cloud.user.Account;
+
+@RunWith(MockitoJUnitRunner.class)
+public class IpAddressManagerImplSourceNatTest {
+
+    @Mock
+    private IPAddressDao _ipAddressDao;
+
+    @InjectMocks
+    private IpAddressManagerImpl ipAddressManagerImpl = new IpAddressManagerImpl();
+
+    @Test(expected = InsufficientAddressCapacityException.class)
+    public void assignSourceNatPublicIpAddressThrowsWhenRequestedIpNotFound() throws Exception {
+        // findByIpAndDcId returns null when the requested IP is not a known
+        // public IP in the zone. The method must throw a capacity exception
+        // rather than dereference the null IPAddressVO with getState().
+        long dcId = 1L;
+        long networkId = 2L;
+        String requestedIp = "10.1.1.1";
+        Account owner = Mockito.mock(Account.class);
+
+        when(_ipAddressDao.findByIpAndNetworkIdAndDcId(networkId, dcId, requestedIp)).thenReturn(null);
+        when(_ipAddressDao.findByIpAndDcId(dcId, requestedIp)).thenReturn(null);
+
+        ipAddressManagerImpl.assignSourceNatPublicIpAddress(dcId, null, owner, VlanType.VirtualNetwork,
+                networkId, requestedIp, false, false);
+    }
+}

From 7ed0cec53dc5113a475808d6dbc221491ff4ae4f Mon Sep 17 00:00:00 2001
From: John Bampton <jbampton@users.noreply.github.com>
Date: Mon, 5 Oct 2026 21:11:33 +1000
Subject: [PATCH 15/41] Add pre-commit hook to validate dependabot.yml (#14107)

* Add pre-commit hook to validate dependabot.yml

https://check-jsonschema.readthedocs.io/en/stable/precommit_usage.html#check-dependabot

https://github.com/python-jsonschema/check-jsonschema/commit/12e63946db2c5cfcc9030fac21c3883ba88c6ed8

* Update regex for dependabot config file validation

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Rename hook for validating dependabot config

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 .pre-commit-config.yaml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 391681e88c31..3c573ec8da27 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -216,3 +216,10 @@ repos:
         types: [yaml]
         files: \.ya?ml$
         exclude: ^.*k8s-.*\.ya?ml$|^.github/workflows/.*\.lock\.ya?ml$
+  - repo: https://github.com/python-jsonschema/check-jsonschema
+    rev: 12e63946db2c5cfcc9030fac21c3883ba88c6ed8 # frozen: 0.38.0
+    hooks:
+      - id: check-dependabot
+        name: validate dependabot config
+        description: ensures the dependabot config file is valid
+        files: ^\.github/dependabot\.ya?ml$

From b8a44e949510d8fd76fbfaf9ceea235a548b57d6 Mon Sep 17 00:00:00 2001
From: sb-abhish3k <abhishek.kumar@shapeblue.com>
Date: Wed, 7 Oct 2026 00:39:19 +0530
Subject: [PATCH 16/41] lock only domains that have finite limits for checked
 reservation (#14169)

* lock on only domains that have finite limits for checked reservation

* fix domain lock set to reflect tag->untagged fallback and limit inheritance

listRowsToLockForLimitCheck previously only locked ancestor domains that
owned an explicit finite resource_limit row for the exact tag, so it
missed domains that inherit a finite limit from an ancestor's row, and
domains that fall back to the untagged limit when no tag-specific limit
is configured (per findCorrectResourceLimitForDomain). Either gap let
concurrent reservations bypass domain-level serialization.

Replace the set-based approximation with an in-memory walk of the
account's domain chain that replicates findCorrectResourceLimitForDomain's
nearest-row-with-fallback semantics, using bulk queries (covered by
existing indexes) to fetch the chain's resource_limit rows and to resolve
the final resource_count rows to lock.

---------

Co-authored-by: Mark Armstrong <marms@apple.com>
---
 .../configuration/dao/ResourceLimitDao.java   |  11 +
 .../dao/ResourceLimitDaoImpl.java             |  31 +++
 .../ResourceLimitManagerImpl.java             | 153 ++++++++++-
 .../ResourceLimitManagerImplTest.java         | 256 ++++++++++++++++++
 4 files changed, 450 insertions(+), 1 deletion(-)

diff --git a/engine/schema/src/main/java/com/cloud/configuration/dao/ResourceLimitDao.java b/engine/schema/src/main/java/com/cloud/configuration/dao/ResourceLimitDao.java
index 7cdc2aacc3ba..6cbfadf7ac50 100644
--- a/engine/schema/src/main/java/com/cloud/configuration/dao/ResourceLimitDao.java
+++ b/engine/schema/src/main/java/com/cloud/configuration/dao/ResourceLimitDao.java
@@ -17,6 +17,7 @@
 package com.cloud.configuration.dao;
 
 import java.util.List;
+import java.util.Set;
 
 import com.cloud.configuration.Resource;
 import com.cloud.configuration.Resource.ResourceOwnerType;
@@ -36,4 +37,14 @@ public interface ResourceLimitDao extends GenericDao<ResourceLimitVO, Long> {
 
     long removeEntriesByOwner(Long ownerId, ResourceOwnerType ownerType);
     void removeResourceLimitsForNonMatchingTags(Long ownerId, ResourceOwnerType ownerType, List<Resource.ResourceType> types, List<String> tags);
+
+    /**
+     * Returns the explicit {@code resource_limit} rows owned by any of
+     * {@code domainIds} for the supplied ({@code type}, {@code tag}),
+     * regardless of their {@code max} value. Domains with no matching row
+     * are simply absent from the result — the caller resolves inheritance
+     * (nearest-ancestor lookup) and the tag -&gt; untagged fallback itself,
+     * mirroring {@code ResourceLimitManagerImpl#findCorrectResourceLimitForDomain}.
+     */
+    List<ResourceLimitVO> listByDomainIdsAndTypeAndTag(Set<Long> domainIds, Resource.ResourceType type, String tag);
 }
diff --git a/engine/schema/src/main/java/com/cloud/configuration/dao/ResourceLimitDaoImpl.java b/engine/schema/src/main/java/com/cloud/configuration/dao/ResourceLimitDaoImpl.java
index 96523ba9bea3..c649b038d978 100644
--- a/engine/schema/src/main/java/com/cloud/configuration/dao/ResourceLimitDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/configuration/dao/ResourceLimitDaoImpl.java
@@ -18,6 +18,7 @@
 
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Set;
 
 
 import org.apache.commons.collections.CollectionUtils;
@@ -38,6 +39,8 @@ public class ResourceLimitDaoImpl extends GenericDaoBase<ResourceLimitVO, Long>
     private SearchBuilder<ResourceLimitVO> IdTypeTagSearch;
     private SearchBuilder<ResourceLimitVO> IdTypeNullTagSearch;
     private SearchBuilder<ResourceLimitVO> NonMatchingTagsSearch;
+    private SearchBuilder<ResourceLimitVO> DomainsLimitTagSearch;
+    private SearchBuilder<ResourceLimitVO> DomainsLimitNullTagSearch;
 
     public ResourceLimitDaoImpl() {
         IdTypeTagSearch = createSearchBuilder();
@@ -60,6 +63,18 @@ public ResourceLimitDaoImpl() {
         NonMatchingTagsSearch.and("tagNotNull", NonMatchingTagsSearch.entity().getTag(), SearchCriteria.Op.NNULL);
         NonMatchingTagsSearch.and("tags", NonMatchingTagsSearch.entity().getTag(), SearchCriteria.Op.NIN);
         NonMatchingTagsSearch.done();
+
+        DomainsLimitTagSearch = createSearchBuilder();
+        DomainsLimitTagSearch.and("type", DomainsLimitTagSearch.entity().getType(), SearchCriteria.Op.EQ);
+        DomainsLimitTagSearch.and("domainIds", DomainsLimitTagSearch.entity().getDomainId(), SearchCriteria.Op.IN);
+        DomainsLimitTagSearch.and("tag", DomainsLimitTagSearch.entity().getTag(), SearchCriteria.Op.EQ);
+        DomainsLimitTagSearch.done();
+
+        DomainsLimitNullTagSearch = createSearchBuilder();
+        DomainsLimitNullTagSearch.and("type", DomainsLimitNullTagSearch.entity().getType(), SearchCriteria.Op.EQ);
+        DomainsLimitNullTagSearch.and("domainIds", DomainsLimitNullTagSearch.entity().getDomainId(), SearchCriteria.Op.IN);
+        DomainsLimitNullTagSearch.and("tag", DomainsLimitNullTagSearch.entity().getTag(), SearchCriteria.Op.NULL);
+        DomainsLimitNullTagSearch.done();
     }
 
     @Override
@@ -150,4 +165,20 @@ public void removeResourceLimitsForNonMatchingTags(Long ownerId, ResourceOwnerTy
         }
         remove(sc);
     }
+
+    @Override
+    public List<ResourceLimitVO> listByDomainIdsAndTypeAndTag(Set<Long> domainIds, ResourceType type, String tag) {
+        if (CollectionUtils.isEmpty(domainIds)) {
+            return new ArrayList<>();
+        }
+        SearchCriteria<ResourceLimitVO> sc = (tag != null)
+                ? DomainsLimitTagSearch.create()
+                : DomainsLimitNullTagSearch.create();
+        sc.setParameters("type", type);
+        sc.setParameters("domainIds", domainIds.toArray());
+        if (tag != null) {
+            sc.setParameters("tag", tag);
+        }
+        return listBy(sc);
+    }
 }
diff --git a/server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java b/server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java
index 6d2ec103ca21..210c70e607a6 100644
--- a/server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java
+++ b/server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java
@@ -20,6 +20,7 @@
 
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.Date;
 import java.util.HashMap;
 import java.util.HashSet;
@@ -577,12 +578,162 @@ protected void checkAccountResourceLimit(final Account account, final Project pr
     }
 
     protected List<ResourceCountVO> lockAccountAndOwnerDomainRows(long accountId, final ResourceType type, String tag) {
-        Set<Long> rowIdsToLock = _resourceCountDao.listAllRowsToUpdate(accountId, ResourceOwnerType.Account, type, tag);
+        Set<Long> rowIdsToLock = listRowsToLockForLimitCheck(accountId, type, tag);
+        if (rowIdsToLock.isEmpty()) {
+            return Collections.emptyList();
+        }
         SearchCriteria<ResourceCountVO> sc = ResourceCountSearch.create();
         sc.setParameters("id", rowIdsToLock.toArray());
         return _resourceCountDao.lockRows(sc, null, true);
     }
 
+    /**
+     * Returns the {@code resource_count} row IDs that need {@code FOR UPDATE}
+     * locks for a limit check: always the account row, plus ancestor-domain
+     * rows ONLY when their effective limit for ({@code type}, {@code tag})
+     * is finite. Ancestors with an UNLIMITED (or absent) effective limit are
+     * excluded — locking them would only create cross-tenant InnoDB row-lock
+     * contention with no effect on the check outcome (see
+     * {@link #checkDomainResourceLimit} which short-circuits when the
+     * domain's limit is {@link Resource#RESOURCE_UNLIMITED} and skips the
+     * ROOT domain entirely).
+     *
+     * <p>The account row is always included so two concurrent reservations
+     * against the same account still serialize at the InnoDB level.
+     *
+     * <p>"Effective limit" is resolved exactly like
+     * {@link #findCorrectResourceLimitForDomain}: a bulk query fetches every
+     * explicit tag-specific {@code resource_limit} row owned by any domain
+     * in the chain (a second bulk query for untagged rows only runs if some
+     * domain in the chain turns out to have no tag-specific row of its own
+     * or an ancestor's), then the chain is walked in memory from the
+     * account's domain up to (but excluding) ROOT, taking the nearest
+     * tag-specific row and falling back to the nearest untagged row only
+     * when no tag-specific row exists anywhere in the domain's own upward
+     * path. This correctly locks domains that inherit a finite limit from
+     * an ancestor's row (not just domains that own one), and domains that
+     * fall back to a finite untagged limit because no tag-specific limit is
+     * configured.
+     *
+     * <p>The final domain-row lookup is a single bulk
+     * {@link ResourceCountDao#findByOwnersAndTypeAndTag} call over exactly
+     * the domains found to have a finite effective limit — no more, no
+     * fewer, and no per-domain round trips.
+     *
+     * <p>If the global default for this type is itself finite (only possible
+     * for {@code primary_storage}/{@code secondary_storage} via
+     * {@code domainResourceLimitMap}), every ancestor inherits that finite
+     * default and we fall back to {@link ResourceCountDao#listAllRowsToUpdate}
+     * to lock the full chain. Same fallback applies when a tagged account
+     * row does not yet exist, so the create-on-miss materialization in
+     * {@code listAllRowsToUpdate} still fires.
+     *
+     * <p>This is a READ-PATH helper. The write path
+     * ({@link #updateResourceCountForAccount}) keeps using
+     * {@code listAllRowsToUpdate} directly so counts at unconstrained
+     * ancestors stay accurate for audit/aggregation.
+     */
+    protected Set<Long> listRowsToLockForLimitCheck(long accountId, ResourceType type, String tag) {
+        if (findDefaultResourceLimitForDomain(type) != Resource.RESOURCE_UNLIMITED) {
+            return _resourceCountDao.listAllRowsToUpdate(accountId, ResourceOwnerType.Account, type, tag);
+        }
+
+        Set<Long> rowIds = new HashSet<>();
+
+        ResourceCountVO accountRow = _resourceCountDao.findByOwnerAndTypeAndTag(accountId, ResourceOwnerType.Account, type, tag);
+        if (accountRow != null) {
+            rowIds.add(accountRow.getId());
+        } else if (StringUtils.isNotEmpty(tag)) {
+            // Preserve the tagged-row create-on-miss side effect from
+            // ResourceCountDaoImpl.listAllRowsToUpdate.
+            return _resourceCountDao.listAllRowsToUpdate(accountId, ResourceOwnerType.Account, type, tag);
+        }
+
+        AccountVO account = _accountDao.findByIdIncludingRemoved(accountId);
+        if (account == null) {
+            return rowIds;
+        }
+
+        List<Long> ancestorChain = getOrderedAncestorDomainIds(account.getDomainId());
+        Set<Long> finiteLimitDomainIds = findAncestorDomainsWithFiniteLimit(ancestorChain, type, tag);
+        if (!finiteLimitDomainIds.isEmpty()) {
+            List<ResourceCountVO> domainRows = _resourceCountDao.findByOwnersAndTypeAndTag(
+                    new ArrayList<>(finiteLimitDomainIds), ResourceOwnerType.Domain, type, tag);
+            for (ResourceCountVO row : domainRows) {
+                rowIds.add(row.getId());
+            }
+        }
+
+        return rowIds;
+    }
+
+    /**
+     * Returns the account's domain plus every ancestor up to (but excluding)
+     * ROOT, ordered from the account's own domain outward — the same order
+     * {@link #findCorrectResourceLimitForDomain} and
+     * {@link #checkDomainResourceLimit} walk.
+     */
+    private List<Long> getOrderedAncestorDomainIds(long domainId) {
+        List<Long> chain = new ArrayList<>();
+        Long currentId = domainId;
+        while (currentId != null && currentId != Domain.ROOT_DOMAIN) {
+            chain.add(currentId);
+            DomainVO domain = _domainDao.findById(currentId);
+            currentId = (domain != null) ? domain.getParent() : null;
+        }
+        return chain;
+    }
+
+    /**
+     * Returns the subset of {@code ancestorChain} whose effective limit for
+     * ({@code type}, {@code tag}) is finite, per
+     * {@link #findCorrectResourceLimitForDomain}'s nearest-row-with-fallback
+     * semantics. The untagged fallback query only runs if at least one
+     * domain in the chain actually lacks a tag-specific row.
+     */
+    private Set<Long> findAncestorDomainsWithFiniteLimit(List<Long> ancestorChain, ResourceType type, String tag) {
+        if (ancestorChain.isEmpty()) {
+            return Collections.emptySet();
+        }
+
+        Set<Long> chainSet = new HashSet<>(ancestorChain);
+        Map<Long, ResourceLimitVO> tagRowsByDomain = indexByDomainId(_resourceLimitDao.listByDomainIdsAndTypeAndTag(chainSet, type, tag));
+        Map<Long, ResourceLimitVO> untaggedRowsByDomain = null;
+
+        Set<Long> finiteLimitDomainIds = new HashSet<>();
+        for (int i = 0; i < ancestorChain.size(); i++) {
+            ResourceLimitVO nearestRow = findNearestRowFrom(ancestorChain, i, tagRowsByDomain);
+            if (nearestRow == null && StringUtils.isNotEmpty(tag)) {
+                if (untaggedRowsByDomain == null) {
+                    untaggedRowsByDomain = indexByDomainId(_resourceLimitDao.listByDomainIdsAndTypeAndTag(chainSet, type, null));
+                }
+                nearestRow = findNearestRowFrom(ancestorChain, i, untaggedRowsByDomain);
+            }
+            if (nearestRow != null && nearestRow.getMax().longValue() != Resource.RESOURCE_UNLIMITED) {
+                finiteLimitDomainIds.add(ancestorChain.get(i));
+            }
+        }
+        return finiteLimitDomainIds;
+    }
+
+    private static ResourceLimitVO findNearestRowFrom(List<Long> chain, int startIndex, Map<Long, ResourceLimitVO> rowsByDomain) {
+        for (int i = startIndex; i < chain.size(); i++) {
+            ResourceLimitVO row = rowsByDomain.get(chain.get(i));
+            if (row != null) {
+                return row;
+            }
+        }
+        return null;
+    }
+
+    private static Map<Long, ResourceLimitVO> indexByDomainId(List<ResourceLimitVO> rows) {
+        Map<Long, ResourceLimitVO> map = new HashMap<>();
+        for (ResourceLimitVO row : rows) {
+            map.put(row.getDomainId(), row);
+        }
+        return map;
+    }
+
     @Override
     public long findDefaultResourceLimitForDomain(ResourceType resourceType) {
         Long resourceLimit;
diff --git a/server/src/test/java/com/cloud/resourcelimit/ResourceLimitManagerImplTest.java b/server/src/test/java/com/cloud/resourcelimit/ResourceLimitManagerImplTest.java
index bdc6620c4904..78d69365abbc 100644
--- a/server/src/test/java/com/cloud/resourcelimit/ResourceLimitManagerImplTest.java
+++ b/server/src/test/java/com/cloud/resourcelimit/ResourceLimitManagerImplTest.java
@@ -19,9 +19,12 @@
 import java.lang.reflect.Field;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.HashMap;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
 
 import org.apache.cloudstack.api.response.AccountResponse;
 import org.apache.cloudstack.api.response.DomainResponse;
@@ -574,6 +577,259 @@ public void testCheckResourceLimitWithTagProject() throws ResourceAllocationExce
         }
     }
 
+    private ResourceCountVO mockCountRow(long id) {
+        ResourceCountVO row = Mockito.mock(ResourceCountVO.class);
+        Mockito.when(row.getId()).thenReturn(id);
+        return row;
+    }
+
+    private ResourceLimitVO mockLimitRow(long domainId, long max) {
+        ResourceLimitVO row = Mockito.mock(ResourceLimitVO.class);
+        Mockito.when(row.getDomainId()).thenReturn(domainId);
+        Mockito.when(row.getMax()).thenReturn(max);
+        return row;
+    }
+
+    /**
+     * Mocks domainDao.findById() so that walking getParent() from
+     * chainWithRootLast[0] visits chainWithRootLast in order, ending at
+     * Domain.ROOT_DOMAIN (the last element).
+     */
+    private void mockDomainParentChain(long... chainWithRootLast) {
+        for (int i = 0; i < chainWithRootLast.length - 1; i++) {
+            DomainVO domain = Mockito.mock(DomainVO.class);
+            Mockito.when(domain.getParent()).thenReturn(chainWithRootLast[i + 1]);
+            Mockito.when(domainDao.findById(chainWithRootLast[i])).thenReturn(domain);
+        }
+    }
+
+    @Test
+    public void testListRowsToLockForLimitCheckOnlyAccountDomainHasFiniteLimit() {
+        // Account-domain has a finite limit; zone-domain (parent) has none (unlimited).
+        // Expected lock set = {account row, account-domain row}.
+        long accountId = 1L;
+        long accountDomainId = 7L;
+        long zoneDomainId = 3L;
+        Resource.ResourceType type = Resource.ResourceType.volume;
+        AccountVO account = Mockito.mock(AccountVO.class);
+        Mockito.when(account.getDomainId()).thenReturn(accountDomainId);
+        Mockito.when(accountDao.findByIdIncludingRemoved(accountId)).thenReturn(account);
+        mockDomainParentChain(accountDomainId, zoneDomainId, Domain.ROOT_DOMAIN);
+
+        ResourceCountVO accountRow = mockCountRow(100L);
+        ResourceCountVO accountDomainRow = mockCountRow(200L);
+        Mockito.when(resourceCountDao.findByOwnerAndTypeAndTag(accountId, Resource.ResourceOwnerType.Account, type, null))
+                .thenReturn(accountRow);
+
+        Set<Long> chainSet = new HashSet<>(Arrays.asList(accountDomainId, zoneDomainId));
+        ResourceLimitVO accountDomainLimitRow = mockLimitRow(accountDomainId, 10L);
+        Mockito.when(resourceLimitDao.listByDomainIdsAndTypeAndTag(chainSet, type, null))
+                .thenReturn(Collections.singletonList(accountDomainLimitRow));
+        Mockito.when(resourceCountDao.findByOwnersAndTypeAndTag(Mockito.anyList(), Mockito.eq(Resource.ResourceOwnerType.Domain), Mockito.eq(type), Mockito.isNull()))
+                .thenReturn(Collections.singletonList(accountDomainRow));
+
+        Set<Long> rowIds = resourceLimitManager.listRowsToLockForLimitCheck(accountId, type, null);
+
+        Assert.assertEquals(new HashSet<>(Arrays.asList(100L, 200L)), rowIds);
+        Mockito.verify(resourceCountDao, Mockito.never()).listAllRowsToUpdate(Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.any());
+        Mockito.verify(resourceCountDao, Mockito.times(1))
+                .findByOwnersAndTypeAndTag(Mockito.eq(Collections.singletonList(accountDomainId)), Mockito.eq(Resource.ResourceOwnerType.Domain), Mockito.eq(type), Mockito.isNull());
+    }
+
+    @Test
+    public void testListRowsToLockForLimitCheckMultipleFiniteAncestors() {
+        // Both ancestor-domain rows have finite limits; both must be locked.
+        long accountId = 1L;
+        long accountDomainId = 7L;
+        long zoneDomainId = 3L;
+        Resource.ResourceType type = Resource.ResourceType.cpu;
+        AccountVO account = Mockito.mock(AccountVO.class);
+        Mockito.when(account.getDomainId()).thenReturn(accountDomainId);
+        Mockito.when(accountDao.findByIdIncludingRemoved(accountId)).thenReturn(account);
+        mockDomainParentChain(accountDomainId, zoneDomainId, Domain.ROOT_DOMAIN);
+
+        ResourceCountVO accountRow = mockCountRow(100L);
+        ResourceCountVO accountDomainRow = mockCountRow(200L);
+        ResourceCountVO zoneDomainRow = mockCountRow(300L);
+        Mockito.when(resourceCountDao.findByOwnerAndTypeAndTag(accountId, Resource.ResourceOwnerType.Account, type, null))
+                .thenReturn(accountRow);
+
+        Set<Long> chainSet = new HashSet<>(Arrays.asList(accountDomainId, zoneDomainId));
+        ResourceLimitVO accountDomainLimitRow = mockLimitRow(accountDomainId, 10L);
+        ResourceLimitVO zoneDomainLimitRow = mockLimitRow(zoneDomainId, 20L);
+        Mockito.when(resourceLimitDao.listByDomainIdsAndTypeAndTag(chainSet, type, null))
+                .thenReturn(Arrays.asList(accountDomainLimitRow, zoneDomainLimitRow));
+        Mockito.when(resourceCountDao.findByOwnersAndTypeAndTag(Mockito.anyList(), Mockito.eq(Resource.ResourceOwnerType.Domain), Mockito.eq(type), Mockito.isNull()))
+                .thenReturn(Arrays.asList(accountDomainRow, zoneDomainRow));
+
+        Set<Long> rowIds = resourceLimitManager.listRowsToLockForLimitCheck(accountId, type, null);
+
+        Assert.assertEquals(new HashSet<>(Arrays.asList(100L, 200L, 300L)), rowIds);
+    }
+
+    @Test
+    public void testListRowsToLockForLimitCheckInheritsFiniteLimitFromAncestorRow() {
+        // Account-domain has NO explicit row of its own, but inherits a finite limit from
+        // its parent (zone-domain)'s explicit row. Both must be locked: the zone-domain
+        // because it owns the finite row, and the account-domain because its own effective
+        // limit (via inheritance) is also finite.
+        long accountId = 1L;
+        long accountDomainId = 7L;
+        long zoneDomainId = 3L;
+        Resource.ResourceType type = Resource.ResourceType.cpu;
+        AccountVO account = Mockito.mock(AccountVO.class);
+        Mockito.when(account.getDomainId()).thenReturn(accountDomainId);
+        Mockito.when(accountDao.findByIdIncludingRemoved(accountId)).thenReturn(account);
+        mockDomainParentChain(accountDomainId, zoneDomainId, Domain.ROOT_DOMAIN);
+
+        ResourceCountVO accountRow = mockCountRow(100L);
+        ResourceCountVO accountDomainRow = mockCountRow(200L);
+        ResourceCountVO zoneDomainRow = mockCountRow(300L);
+        Mockito.when(resourceCountDao.findByOwnerAndTypeAndTag(accountId, Resource.ResourceOwnerType.Account, type, null))
+                .thenReturn(accountRow);
+
+        Set<Long> chainSet = new HashSet<>(Arrays.asList(accountDomainId, zoneDomainId));
+        // Only the zone-domain owns an explicit row; the account-domain has none.
+        ResourceLimitVO zoneDomainLimitRow = mockLimitRow(zoneDomainId, 20L);
+        Mockito.when(resourceLimitDao.listByDomainIdsAndTypeAndTag(chainSet, type, null))
+                .thenReturn(Collections.singletonList(zoneDomainLimitRow));
+        Mockito.when(resourceCountDao.findByOwnersAndTypeAndTag(Mockito.anyList(), Mockito.eq(Resource.ResourceOwnerType.Domain), Mockito.eq(type), Mockito.isNull()))
+                .thenReturn(Arrays.asList(accountDomainRow, zoneDomainRow));
+
+        Set<Long> rowIds = resourceLimitManager.listRowsToLockForLimitCheck(accountId, type, null);
+
+        Assert.assertEquals(new HashSet<>(Arrays.asList(100L, 200L, 300L)), rowIds);
+    }
+
+    @Test
+    public void testListRowsToLockForLimitCheckAllUnlimited() {
+        // No ancestor has a finite limit; only the account row is locked.
+        long accountId = 1L;
+        long accountDomainId = 7L;
+        Resource.ResourceType type = Resource.ResourceType.cpu;
+        AccountVO account = Mockito.mock(AccountVO.class);
+        Mockito.when(account.getDomainId()).thenReturn(accountDomainId);
+        Mockito.when(accountDao.findByIdIncludingRemoved(accountId)).thenReturn(account);
+        mockDomainParentChain(accountDomainId, Domain.ROOT_DOMAIN);
+
+        ResourceCountVO accountRow = mockCountRow(100L);
+        Mockito.when(resourceCountDao.findByOwnerAndTypeAndTag(accountId, Resource.ResourceOwnerType.Account, type, null))
+                .thenReturn(accountRow);
+
+        Set<Long> chainSet = Collections.singleton(accountDomainId);
+        Mockito.when(resourceLimitDao.listByDomainIdsAndTypeAndTag(chainSet, type, null))
+                .thenReturn(Collections.emptyList());
+
+        Set<Long> rowIds = resourceLimitManager.listRowsToLockForLimitCheck(accountId, type, null);
+
+        Assert.assertEquals(Collections.singleton(100L), rowIds);
+        Mockito.verify(resourceCountDao, Mockito.never()).findByOwnersAndTypeAndTag(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
+    }
+
+    @Test
+    public void testListRowsToLockForLimitCheckFiniteGlobalDefaultFallsBack() {
+        // primary_storage with a finite global default → fall back to listAllRowsToUpdate
+        // to preserve upstream behavior (every ancestor inherits the finite default).
+        long accountId = 1L;
+        Resource.ResourceType type = Resource.ResourceType.primary_storage;
+        Set<Long> fullChain = new HashSet<>(Arrays.asList(100L, 200L, 300L, 400L));
+
+        Mockito.doReturn(1024L).when(resourceLimitManager).findDefaultResourceLimitForDomain(type);
+        Mockito.when(resourceCountDao.listAllRowsToUpdate(accountId, Resource.ResourceOwnerType.Account, type, null))
+                .thenReturn(fullChain);
+
+        Set<Long> rowIds = resourceLimitManager.listRowsToLockForLimitCheck(accountId, type, null);
+
+        Assert.assertEquals(fullChain, rowIds);
+        Mockito.verify(resourceLimitDao, Mockito.never()).listByDomainIdsAndTypeAndTag(Mockito.anySet(), Mockito.any(), Mockito.any());
+    }
+
+    @Test
+    public void testListRowsToLockForLimitCheckTaggedAccountRowMissingFallsBack() {
+        // Tagged limit, account row not yet materialized → fall back to listAllRowsToUpdate
+        // so the create-on-miss tagged-row materialization still fires.
+        long accountId = 1L;
+        Resource.ResourceType type = Resource.ResourceType.cpu;
+        String tag = hostTags.get(0);
+        Set<Long> fullChain = new HashSet<>(Arrays.asList(101L, 201L));
+
+        Mockito.when(resourceCountDao.findByOwnerAndTypeAndTag(accountId, Resource.ResourceOwnerType.Account, type, tag))
+                .thenReturn(null);
+        Mockito.when(resourceCountDao.listAllRowsToUpdate(accountId, Resource.ResourceOwnerType.Account, type, tag))
+                .thenReturn(fullChain);
+
+        Set<Long> rowIds = resourceLimitManager.listRowsToLockForLimitCheck(accountId, type, tag);
+
+        Assert.assertEquals(fullChain, rowIds);
+        Mockito.verify(resourceCountDao, Mockito.times(1)).listAllRowsToUpdate(accountId, Resource.ResourceOwnerType.Account, type, tag);
+        Mockito.verify(resourceLimitDao, Mockito.never()).listByDomainIdsAndTypeAndTag(Mockito.anySet(), Mockito.any(), Mockito.any());
+    }
+
+    @Test
+    public void testListRowsToLockForLimitCheckTagFallsBackToUntaggedWhenNoTagRowExists() {
+        // No domain in the chain has ANY explicit tag-specific row, but the account-domain
+        // has a finite UNTAGGED limit. findCorrectResourceLimitForDomain falls back to that
+        // untagged limit for this domain, so it must still get its (tagged) resource_count
+        // row locked.
+        long accountId = 1L;
+        long accountDomainId = 7L;
+        Resource.ResourceType type = Resource.ResourceType.cpu;
+        String tag = hostTags.get(0);
+        AccountVO account = Mockito.mock(AccountVO.class);
+        Mockito.when(account.getDomainId()).thenReturn(accountDomainId);
+        Mockito.when(accountDao.findByIdIncludingRemoved(accountId)).thenReturn(account);
+        mockDomainParentChain(accountDomainId, Domain.ROOT_DOMAIN);
+
+        ResourceCountVO accountRow = mockCountRow(100L);
+        ResourceCountVO accountDomainRow = mockCountRow(200L);
+        Mockito.when(resourceCountDao.findByOwnerAndTypeAndTag(accountId, Resource.ResourceOwnerType.Account, type, tag))
+                .thenReturn(accountRow);
+
+        Set<Long> chainSet = Collections.singleton(accountDomainId);
+        Mockito.when(resourceLimitDao.listByDomainIdsAndTypeAndTag(chainSet, type, tag))
+                .thenReturn(Collections.emptyList());
+        ResourceLimitVO accountDomainLimitRow = mockLimitRow(accountDomainId, 10L);
+        Mockito.when(resourceLimitDao.listByDomainIdsAndTypeAndTag(chainSet, type, null))
+                .thenReturn(Collections.singletonList(accountDomainLimitRow));
+        Mockito.when(resourceCountDao.findByOwnersAndTypeAndTag(Mockito.eq(Collections.singletonList(accountDomainId)), Mockito.eq(Resource.ResourceOwnerType.Domain), Mockito.eq(type), Mockito.eq(tag)))
+                .thenReturn(Collections.singletonList(accountDomainRow));
+
+        Set<Long> rowIds = resourceLimitManager.listRowsToLockForLimitCheck(accountId, type, tag);
+
+        Assert.assertEquals(new HashSet<>(Arrays.asList(100L, 200L)), rowIds);
+    }
+
+    @Test
+    public void testListRowsToLockForLimitCheckExplicitUnlimitedTagRowSkipsUntaggedFallback() {
+        // An explicit tag-specific row exists (even though it's UNLIMITED), so
+        // findCorrectResourceLimitForDomain does NOT fall back to the untagged limit for
+        // this domain. The untagged finite-limit lookup must never be consulted, and the
+        // domain must not be locked.
+        long accountId = 1L;
+        long accountDomainId = 7L;
+        Resource.ResourceType type = Resource.ResourceType.cpu;
+        String tag = hostTags.get(0);
+        AccountVO account = Mockito.mock(AccountVO.class);
+        Mockito.when(account.getDomainId()).thenReturn(accountDomainId);
+        Mockito.when(accountDao.findByIdIncludingRemoved(accountId)).thenReturn(account);
+        mockDomainParentChain(accountDomainId, Domain.ROOT_DOMAIN);
+
+        ResourceCountVO accountRow = mockCountRow(100L);
+        Mockito.when(resourceCountDao.findByOwnerAndTypeAndTag(accountId, Resource.ResourceOwnerType.Account, type, tag))
+                .thenReturn(accountRow);
+
+        Set<Long> chainSet = Collections.singleton(accountDomainId);
+        ResourceLimitVO unlimitedTagRow = mockLimitRow(accountDomainId, Resource.RESOURCE_UNLIMITED);
+        Mockito.when(resourceLimitDao.listByDomainIdsAndTypeAndTag(chainSet, type, tag))
+                .thenReturn(Collections.singletonList(unlimitedTagRow));
+
+        Set<Long> rowIds = resourceLimitManager.listRowsToLockForLimitCheck(accountId, type, tag);
+
+        Assert.assertEquals(Collections.singleton(100L), rowIds);
+        Mockito.verify(resourceLimitDao, Mockito.never()).listByDomainIdsAndTypeAndTag(chainSet, type, null);
+        Mockito.verify(resourceCountDao, Mockito.never()).findByOwnersAndTypeAndTag(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
+    }
+
     @Test
     public void testRemoveResourceLimitAndCountForNonMatchingTags() {
         resourceLimitManager.removeResourceLimitAndCountForNonMatchingTags(1L, Resource.ResourceOwnerType.Account, hostTags, storageTags);

From d4f5dff7311bdb6a7fb6174b8eddb705a8e0eac5 Mon Sep 17 00:00:00 2001
From: Vishesh <8760112+vishesh92@users.noreply.github.com>
Date: Wed, 7 Oct 2026 00:41:44 +0530
Subject: [PATCH 17/41] Fix overly broad classpath scanning in
 ReflectUtil.getClassesWithAnnotation() (#13427)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Fix overly broad classpath scanning in ReflectUtil.getClassesWithAnnotation()

Production logs show a recurring WARN at startup:
  "could not get type for name org.conscrypt.AllocatedBuffer"
  (org.reflections.ReflectionsException / ClassNotFoundException)

Root cause: ReflectUtil.getClassesWithAnnotation() uses
ClasspathHelper.forPackage() to collect URLs to scan, but this
returns all classpath entries (JARs/directories), not just those
containing the target package. The Reflections library then scans
every .class file in every JAR — including Netty's
ConscryptAlpnSslEngine$BufferAdapter which references the optional
org.conscrypt.AllocatedBuffer type. During expandSuperTypes(),
Reflections tries Class.forName() on that type and fails because
Conscrypt is not (and need not be) on the classpath.

The fix adds a FilterBuilder that restricts bytecode scanning to
only classes whose fully-qualified names match the requested
packages. This prevents Reflections from processing unrelated
classes (e.g., io.netty.handler.ssl.*), eliminating the warning
and reducing startup time by skipping thousands of irrelevant
class files.

Signed-off-by: Ganesh Maharaj Mahalingam <g.mahalingam@apple.com>

* Add missing API command packages to ApiXmlDocWriter's classpath scan list

---------

Signed-off-by: Ganesh Maharaj Mahalingam <g.mahalingam@apple.com>
Co-authored-by: Ganesh Maharaj Mahalingam <g.mahalingam@apple.com>
---
 server/src/main/java/com/cloud/api/doc/ApiXmlDocWriter.java | 5 ++++-
 utils/src/main/java/com/cloud/utils/ReflectUtil.java        | 4 ++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/server/src/main/java/com/cloud/api/doc/ApiXmlDocWriter.java b/server/src/main/java/com/cloud/api/doc/ApiXmlDocWriter.java
index b1bb316471b0..0495a41e36a2 100644
--- a/server/src/main/java/com/cloud/api/doc/ApiXmlDocWriter.java
+++ b/server/src/main/java/com/cloud/api/doc/ApiXmlDocWriter.java
@@ -92,7 +92,10 @@ private static List<String> setAsyncResponses() {
     public static void main(String[] args) {
         Set<Class<?>> cmdClasses = ReflectUtil.getClassesWithAnnotation(APICommand.class, new String[] {"org.apache.cloudstack.api", "com.cloud.api",
                 "com.cloud.api.commands", "com.globo.globodns.cloudstack.api", "org.apache.cloudstack.network.opendaylight.api",
-                "org.apache.cloudstack.api.command.admin.zone", "org.apache.cloudstack.network.contrail.api.command"});
+                "org.apache.cloudstack.api.command.admin.zone", "org.apache.cloudstack.network.contrail.api.command",
+                "org.apache.cloudstack.cloudian.api", "org.apache.cloudstack.framework.extensions.api",
+                "org.apache.cloudstack.mom.webhook.api.command.user", "org.apache.cloudstack.network.tungsten.api.command",
+                "org.apache.cloudstack.oauth2.api.command", "org.apache.cloudstack.storage.datastore.util"});
 
         for (Class<?> cmdClass : cmdClasses) {
             if(cmdClass.getAnnotation(APICommand.class)==null){
diff --git a/utils/src/main/java/com/cloud/utils/ReflectUtil.java b/utils/src/main/java/com/cloud/utils/ReflectUtil.java
index 5b40d48c20e2..bf11cea22cce 100644
--- a/utils/src/main/java/com/cloud/utils/ReflectUtil.java
+++ b/utils/src/main/java/com/cloud/utils/ReflectUtil.java
@@ -42,6 +42,7 @@
 import org.reflections.scanners.TypeAnnotationsScanner;
 import org.reflections.util.ClasspathHelper;
 import org.reflections.util.ConfigurationBuilder;
+import org.reflections.util.FilterBuilder;
 
 import com.cloud.utils.exception.CloudRuntimeException;
 import com.google.common.collect.ImmutableSet;
@@ -70,9 +71,12 @@ public static Set<Class<?>> getClassesWithAnnotation(Class<? extends Annotation>
         Reflections reflections;
         Set<Class<?>> classes = new HashSet<Class<?>>();
         ConfigurationBuilder builder=new ConfigurationBuilder();
+        FilterBuilder filterBuilder = new FilterBuilder();
         for (String packageName : packageNames) {
              builder.addUrls(ClasspathHelper.forPackage(packageName));
+             filterBuilder.includePackage(packageName);
         }
+        builder.filterInputsBy(filterBuilder);
         builder.setScanners(new SubTypesScanner(),new TypeAnnotationsScanner());
         reflections = new Reflections(builder);
         classes.addAll(reflections.getTypesAnnotatedWith(annotation));

From 4e679ad8778e558952de9b3fe9b7a96d7fdfc144 Mon Sep 17 00:00:00 2001
From: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
Date: Wed, 7 Oct 2026 00:43:34 +0530
Subject: [PATCH 18/41] Ensure the detail value is not null when updating the
 vnc access details of the vms with failed migrations on host maintenance
 (#13492)

- Fixes the Constraint error Column 'value' cannot be null
---
 .../LibvirtGetVncPortCommandWrapper.java      |  1 +
 .../cloud/resource/ResourceManagerImpl.java   | 27 ++++++++++++++++---
 .../resource/ResourceManagerImplTest.java     |  2 ++
 3 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVncPortCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVncPortCommandWrapper.java
index c16c9bcb9a8b..aa628950f925 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVncPortCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVncPortCommandWrapper.java
@@ -41,6 +41,7 @@ public Answer execute(final GetVncPortCommand command, final LibvirtComputingRes
             final Integer vncPort = libvirtComputingResource.getVncPort(conn, command.getName());
             return new GetVncPortAnswer(command, libvirtComputingResource.getPrivateIp(), 5900 + vncPort);
         } catch (final LibvirtException e) {
+            logger.error("Failed to get vnc port for the vm: {} due to {}", command.getName(), e.getMessage());
             return new GetVncPortAnswer(command, e.toString());
         }
     }
diff --git a/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java b/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
index 275658a27e95..02cd4de1e868 100755
--- a/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
+++ b/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
@@ -1829,10 +1829,29 @@ public Host cancelHostAsDegraded(final CancelHostAsDegradedCmd cmd) throws NoTra
     protected void setKVMVncAccess(long hostId, List<VMInstanceVO> vms) {
         for (VMInstanceVO vm : vms) {
             GetVncPortAnswer vmVncPortAnswer = (GetVncPortAnswer) _agentMgr.easySend(hostId, new GetVncPortCommand(vm.getId(), vm.getInstanceName()));
-            if (vmVncPortAnswer != null) {
-                vmInstanceDetailsDao.addDetail(vm.getId(), VmDetailConstants.KVM_VNC_ADDRESS, vmVncPortAnswer.getAddress(), true);
-                vmInstanceDetailsDao.addDetail(vm.getId(), VmDetailConstants.KVM_VNC_PORT, String.valueOf(vmVncPortAnswer.getPort()), true);
-            }
+            updateVncAccessDetailForVM(vm, vmVncPortAnswer, hostId);
+        }
+    }
+
+    private void updateVncAccessDetailForVM(VMInstanceVO vm, GetVncPortAnswer vmVncPortAnswer, long hostId) {
+        if (vm == null || vmVncPortAnswer == null) {
+            logger.warn("VM or VNC port answer is null. Cannot update VNC access details.");
+            return;
+        }
+
+        if (!vmVncPortAnswer.getResult()) {
+            logger.warn("Failed to get VNC port for VM {} on host {}. Details: {}", vm, hostId, vmVncPortAnswer.getDetails());
+            return;
+        }
+
+        String vncAddress = vmVncPortAnswer.getAddress();
+        String vncPort = String.valueOf(vmVncPortAnswer.getPort());
+        if (org.apache.commons.lang3.StringUtils.isNotBlank(vmVncPortAnswer.getAddress()) && org.apache.commons.lang3.StringUtils.isNotBlank(vncPort)) {
+            logger.info("Setting VNC access details for VM {} on host {} to address: {}, port: {}", vm, hostId, vncAddress, vncPort);
+            vmInstanceDetailsDao.addDetail(vm.getId(), VmDetailConstants.KVM_VNC_ADDRESS, vncAddress, true);
+            vmInstanceDetailsDao.addDetail(vm.getId(), VmDetailConstants.KVM_VNC_PORT, vncPort, true);
+        } else {
+            logger.warn("Unable to set VNC access details for VM {} on host {} as the address or port is blank. Address: {}, Port: {}", vm, hostId, vncAddress, vncPort);
         }
     }
 
diff --git a/server/src/test/java/com/cloud/resource/ResourceManagerImplTest.java b/server/src/test/java/com/cloud/resource/ResourceManagerImplTest.java
index 403afcac8a8a..b9da7390566c 100644
--- a/server/src/test/java/com/cloud/resource/ResourceManagerImplTest.java
+++ b/server/src/test/java/com/cloud/resource/ResourceManagerImplTest.java
@@ -211,8 +211,10 @@ public void setup() throws Exception {
         actionEventUtilsMocked = Mockito.mockStatic(ActionEventUtils.class);
         BDDMockito.given(ActionEventUtils.onCompletedActionEvent(anyLong(), anyLong(), anyString(), anyString(), anyString(), anyLong(), anyString(), anyLong()))
                 .willReturn(1L);
+        when(getVncPortAnswerVm1.getResult()).thenReturn(true);
         when(getVncPortAnswerVm1.getAddress()).thenReturn(vm1VncAddress);
         when(getVncPortAnswerVm1.getPort()).thenReturn(vm1VncPort);
+        when(getVncPortAnswerVm2.getResult()).thenReturn(true);
         when(getVncPortAnswerVm2.getAddress()).thenReturn(vm2VncAddress);
         when(getVncPortAnswerVm2.getPort()).thenReturn(vm2VncPort);
         getVncPortCommandMockedConstruction = Mockito.mockConstruction(GetVncPortCommand.class, (mock,context) -> {

From cc2f74f5c5d567ebbc096ad6ba389da4cf78dfca Mon Sep 17 00:00:00 2001
From: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
Date: Wed, 7 Oct 2026 00:47:07 +0530
Subject: [PATCH 19/41] Ensure compliance with storage access groups when
 mounting disabled storage pools (#13990)

- connect to only storage pools with empty tags when access group is empty

Co-authored-by: Sachin R Doddaguni <s_rudrappadoddagu@apple.com>
---
 .../com/cloud/storage/StorageManager.java     |   4 +
 .../datastore/db/PrimaryDataStoreDao.java     |  30 ++++-
 .../datastore/db/PrimaryDataStoreDaoImpl.java |  59 ++++++++-
 .../cloud/resource/ResourceManagerImpl.java   |   8 +-
 .../storage/listener/StoragePoolMonitor.java  |  23 ++--
 .../listener/StoragePoolMonitorTest.java      | 116 +++++++++++++++---
 6 files changed, 205 insertions(+), 35 deletions(-)

diff --git a/engine/components-api/src/main/java/com/cloud/storage/StorageManager.java b/engine/components-api/src/main/java/com/cloud/storage/StorageManager.java
index 5c7348cbe6c3..7a29ce81002b 100644
--- a/engine/components-api/src/main/java/com/cloud/storage/StorageManager.java
+++ b/engine/components-api/src/main/java/com/cloud/storage/StorageManager.java
@@ -432,4 +432,8 @@ void connectHostsToPool(DataStore primaryStore, List<Long> hostIds, Scope scope,
     String[] getStorageAccessGroups(Long zoneId, Long podId, Long clusterId, Long hostId);
 
     CapacityVO getObjectStorageUsedStats(Long zoneId);
+
+    static ConfigKey<Boolean> getMountDisabledStoragePool() {
+        return MountDisabledStoragePool;
+    }
 }
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/PrimaryDataStoreDao.java b/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/PrimaryDataStoreDao.java
index 57b5f6461c6a..fd85dba1efcc 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/PrimaryDataStoreDao.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/PrimaryDataStoreDao.java
@@ -90,6 +90,22 @@ public interface PrimaryDataStoreDao extends GenericDao<StoragePoolVO, Long> {
 
     List<StoragePoolVO> findDisabledPoolsByScope(long dcId, Long podId, Long clusterId, ScopeType scope);
 
+    /**
+     * Finds disabled storage pools within the specified scope that are associated with the given storage access groups.
+     * This method is used to locate storage pools with 'Disabled' status that match specific storage access group
+     * filters.
+     *
+     * @param dcId the data center ID.
+     * @param podId the pod ID.
+     * @param clusterId the cluster ID.
+     * @param scope ZONE, CLUSTER OR HOST type scope
+     * @param storageAccessGroups array of storage access group names to match against.
+     *                           Only pools associated with these access groups will be returned.
+     *                           If null or empty, returns an empty list.
+     * @return a list of {@link StoragePoolVO} objects.
+     */
+    List<StoragePoolVO> findDisabledPoolsByScopeAndAccessGroups(long dcId, Long podId, Long clusterId, ScopeType scope, String[] storageAccessGroups);
+
     /**
      * Find pool by UUID.
      *
@@ -167,7 +183,19 @@ Pair<List<Long>, Integer> searchForIdsAndCount(Long storagePoolId, String storag
 
     List<StoragePoolVO> listByIds(List<Long> ids);
 
-    List<StoragePoolVO> findStoragePoolsByEmptyStorageAccessGroups(Long dcId, Long podId, Long clusterId, ScopeType scope, HypervisorType hypervisorType);
+    /**
+     * Finds storage pools that have no storage access groups associated with them within the specified criteria.
+     * This method identifies storage pools without access group restrictions.
+     *
+     * @param dcId the data center ID. Can be null to include all data centers.
+     * @param podId the pod ID. Can be null to include all pods.
+     * @param clusterId the cluster ID. Can be null to include all clusters.
+     * @param scope ZONE, CLUSTER or HOST type scope
+     * @param hypervisorType the hypervisor type filter. Can be null to include all hypervisor types.
+     * @param status the storage pool status to filter by.
+     * @return a list of {@link StoragePoolVO} objects that have no storage access groups associated.
+     */
+    List<StoragePoolVO> findStoragePoolsByEmptyStorageAccessGroups(Long dcId, Long podId, Long clusterId, ScopeType scope, HypervisorType hypervisorType, StoragePoolStatus status);
 
     List<StoragePoolVO> findPoolsByStorageTypeAndZone(Storage.StoragePoolType storageType, Long zoneId);
 
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/PrimaryDataStoreDaoImpl.java b/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/PrimaryDataStoreDaoImpl.java
index b5d6415e3a1a..4d0e581826f4 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/PrimaryDataStoreDaoImpl.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/PrimaryDataStoreDaoImpl.java
@@ -54,6 +54,7 @@
 import com.cloud.utils.db.SearchCriteria.Op;
 import com.cloud.utils.db.TransactionLegacy;
 import com.cloud.utils.exception.CloudRuntimeException;
+import org.apache.commons.lang3.ArrayUtils;
 
 @DB()
 public class PrimaryDataStoreDaoImpl extends GenericDaoBase<StoragePoolVO, Long> implements PrimaryDataStoreDao {
@@ -86,6 +87,37 @@ public class PrimaryDataStoreDaoImpl extends GenericDaoBase<StoragePoolVO, Long>
     private final String ZoneWideStorageAccessGroupsWithHypervisorTypeSqlPrefix = "SELECT storage_pool.* from storage_pool LEFT JOIN storage_pool_and_access_group_map ON storage_pool.id = storage_pool_and_access_group_map.pool_id WHERE storage_pool.removed is null and storage_pool.status = 'Up' and storage_pool.hypervisor = ? and storage_pool.data_center_id = ? and storage_pool.scope = ? and (";
     private final String ZoneWideStorageAccessGroupsWithHypervisorTypeSqlSuffix = ") GROUP BY storage_pool_and_access_group_map.pool_id";
 
+    /**
+     * SQL query prefix to find zone-wide disabled storage pools that are associated with specific storage access groups.
+     */
+    private final String ZoneWideDisabledStorageAccessGroupsSqlPrefix =
+            "SELECT storage_pool.* FROM storage_pool " +
+                    "LEFT JOIN storage_pool_and_access_group_map ON storage_pool.id = storage_pool_and_access_group_map.pool_id " +
+                    "WHERE storage_pool.removed IS NULL " +
+                    "  AND storage_pool.status = 'Disabled' " +
+                    "  AND storage_pool.data_center_id = ? " +
+                    "  AND storage_pool.scope = ? " +
+                    "  AND (";
+
+    /**
+     * SQL query prefix to find disabled storage pools with specific storage access groups. The query is used at the HOST scope.
+     */
+    private final String DisabledStorageAccessGroupsForHostConnectionSqlPrefix =
+            "SELECT storage_pool.* FROM storage_pool " +
+                    "LEFT JOIN storage_pool_and_access_group_map ON storage_pool.id = storage_pool_and_access_group_map.pool_id " +
+                    "WHERE storage_pool.removed IS NULL " +
+                    "  AND storage_pool.status = 'Disabled' " +
+                    "  AND storage_pool.data_center_id = ? " +
+                    "  AND (storage_pool.pod_id = ? OR storage_pool.pod_id IS NULL) " +
+                    "  AND storage_pool.scope = ? " +
+                    "  AND (";
+
+    /**
+     * SQL query suffix for disabled storage access groups queries. This suffix completes the query by grouping
+     * results by pool_id.
+     */
+    private final String DisabledStorageAccessGroupsSqlSuffix = ") GROUP BY storage_pool_and_access_group_map.pool_id";
+
     // Storage tags are now separate from storage_pool_details, leaving only details on that table
     protected final String TagsSqlPrefix = "SELECT storage_pool.* from storage_pool LEFT JOIN storage_pool_tags ON storage_pool.id = storage_pool_tags.pool_id WHERE storage_pool.removed is null and storage_pool.status = 'Up' AND storage_pool_tags.is_tag_a_rule = 0 and storage_pool.data_center_id = ? and (storage_pool.pod_id = ? or storage_pool.pod_id is null) and storage_pool.scope = ? and (";
     protected final String TagsSqlSuffix = ") GROUP BY storage_pool_tags.pool_id HAVING COUNT(storage_pool_tags.tag) >= ?";
@@ -568,6 +600,26 @@ public List<StoragePoolVO> findDisabledPoolsByScope(long dcId, Long podId, Long
         return storagePools;
     }
 
+    @Override
+    public List<StoragePoolVO> findDisabledPoolsByScopeAndAccessGroups(long dcId, Long podId, Long clusterId, ScopeType scope, String[] storageAccessGroups) {
+        if (ArrayUtils.isEmpty(storageAccessGroups)) {
+            return List.of();
+        }
+
+        List<StoragePoolVO> storagePools = null;
+        String sqlValues = getSqlValuesFromStorageAccessGroups(storageAccessGroups);
+
+        if (scope == ScopeType.ZONE) {
+            String sql = getSqlPreparedStatement(ZoneWideDisabledStorageAccessGroupsSqlPrefix, DisabledStorageAccessGroupsSqlSuffix, sqlValues, null);
+            storagePools = searchStoragePoolsPreparedStatement(sql, dcId, null, null, scope, null);
+        } else if ((scope == ScopeType.CLUSTER || scope == ScopeType.HOST) && podId != null && clusterId != null) {
+            String sql = getSqlPreparedStatement(DisabledStorageAccessGroupsForHostConnectionSqlPrefix, DisabledStorageAccessGroupsSqlSuffix, sqlValues, clusterId);
+            storagePools = searchStoragePoolsPreparedStatement(sql, dcId, podId, clusterId, scope, null);
+        }
+
+        return storagePools;
+    }
+
     @Override
     public List<StoragePoolVO> findLocalStoragePoolsByTags(long dcId, long podId, Long clusterId, String[] tags, boolean validateTagRule) {
         return findLocalStoragePoolsByTags(dcId, podId, clusterId, tags, validateTagRule, null);
@@ -691,7 +743,7 @@ public List<StoragePoolVO> findZoneWideStoragePoolsByAccessGroupsAndHypervisorTy
     }
 
     @Override
-    public List<StoragePoolVO> findStoragePoolsByEmptyStorageAccessGroups(Long dcId, Long podId, Long clusterId, ScopeType scope, HypervisorType hypervisorType) {
+    public List<StoragePoolVO> findStoragePoolsByEmptyStorageAccessGroups(Long dcId, Long podId, Long clusterId, ScopeType scope, HypervisorType hypervisorType, StoragePoolStatus status) {
         SearchBuilder<StoragePoolVO> poolSearch = createSearchBuilder();
         SearchBuilder<StoragePoolAndAccessGroupMapVO> storageAccessGroupsPoolSearch = _storagePoolAccessGroupMapDao.createSearchBuilder();
         // Set criteria for pools
@@ -709,7 +761,6 @@ public List<StoragePoolVO> findStoragePoolsByEmptyStorageAccessGroups(Long dcId,
 
         SearchCriteria<StoragePoolVO> sc = poolSearch.create();
         sc.setParameters("scope", scope.toString());
-        sc.setParameters("status", Status.Up.toString());
 
         if (dcId != null) {
             sc.setParameters("datacenterid", dcId);
@@ -727,6 +778,10 @@ public List<StoragePoolVO> findStoragePoolsByEmptyStorageAccessGroups(Long dcId,
             sc.setParameters("hypervisortype", hypervisorType);
         }
 
+        if (status != null) {
+            sc.setParameters("status", status.toString());
+        }
+
         return listBy(sc);
     }
 
diff --git a/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java b/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
index 02cd4de1e868..f9c06b5409c8 100755
--- a/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
+++ b/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
@@ -2763,8 +2763,8 @@ protected List<StoragePoolVO> getStoragePoolsByAccessGroups(Long dcId, Long podI
         allPoolsByTags.addAll(_storagePoolDao.findPoolsByAccessGroupsForHostConnection(dcId, podId, clusterId, ScopeType.CLUSTER, storageAccessGroups));
         allPoolsByTags.addAll(_storagePoolDao.findZoneWideStoragePoolsByAccessGroupsForHostConnection(dcId, storageAccessGroups));
         if (includeEmptyTags) {
-            allPoolsByTags.addAll(_storagePoolDao.findStoragePoolsByEmptyStorageAccessGroups(dcId, podId, clusterId, ScopeType.CLUSTER, null));
-            allPoolsByTags.addAll(_storagePoolDao.findStoragePoolsByEmptyStorageAccessGroups(dcId, null, null, ScopeType.ZONE, null));
+            allPoolsByTags.addAll(_storagePoolDao.findStoragePoolsByEmptyStorageAccessGroups(dcId, podId, clusterId, ScopeType.CLUSTER, null, StoragePoolStatus.Up));
+            allPoolsByTags.addAll(_storagePoolDao.findStoragePoolsByEmptyStorageAccessGroups(dcId, null, null, ScopeType.ZONE, null, StoragePoolStatus.Up));
         }
 
         return allPoolsByTags;
@@ -2772,8 +2772,8 @@ protected List<StoragePoolVO> getStoragePoolsByAccessGroups(Long dcId, Long podI
 
     private List<StoragePoolVO> getStoragePoolsByEmptyStorageAccessGroups(Long dcId, Long podId, Long clusterId) {
         List<StoragePoolVO> allPoolsByTags = new ArrayList<>();
-        allPoolsByTags.addAll(_storagePoolDao.findStoragePoolsByEmptyStorageAccessGroups(dcId, podId, clusterId, ScopeType.CLUSTER, null));
-        allPoolsByTags.addAll(_storagePoolDao.findStoragePoolsByEmptyStorageAccessGroups(dcId, null, null, ScopeType.ZONE, null));
+        allPoolsByTags.addAll(_storagePoolDao.findStoragePoolsByEmptyStorageAccessGroups(dcId, podId, clusterId, ScopeType.CLUSTER, null, StoragePoolStatus.Up));
+        allPoolsByTags.addAll(_storagePoolDao.findStoragePoolsByEmptyStorageAccessGroups(dcId, null, null, ScopeType.ZONE, null, StoragePoolStatus.Up));
 
         return allPoolsByTags;
     }
diff --git a/server/src/main/java/com/cloud/storage/listener/StoragePoolMonitor.java b/server/src/main/java/com/cloud/storage/listener/StoragePoolMonitor.java
index 2f9750edee2d..d7f20c03671b 100644
--- a/server/src/main/java/com/cloud/storage/listener/StoragePoolMonitor.java
+++ b/server/src/main/java/com/cloud/storage/listener/StoragePoolMonitor.java
@@ -25,6 +25,7 @@
 import com.cloud.dc.dao.HostPodDao;
 import com.cloud.exception.StorageConflictException;
 import com.cloud.storage.StorageManager;
+import com.cloud.storage.StoragePoolStatus;
 import com.cloud.storage.dao.StoragePoolHostDao;
 import com.cloud.utils.exception.CloudRuntimeException;
 import com.cloud.utils.Profiler;
@@ -123,21 +124,21 @@ public void processConnect(Host host, StartupCommand cmd, boolean forRebalance)
             List<StoragePoolVO> pools = new ArrayList<>();
             // SAG -> Storage Access Group
             if (ArrayUtils.isEmpty(sags)) {
-                List<StoragePoolVO> clusterStoragePoolsByEmptySAGs = _poolDao.findStoragePoolsByEmptyStorageAccessGroups(host.getDataCenterId(), host.getPodId(), host.getClusterId(), ScopeType.CLUSTER, null);
-                List<StoragePoolVO> storagePoolsByEmptySAGs = _poolDao.findStoragePoolsByEmptyStorageAccessGroups(host.getDataCenterId(), null, null, ScopeType.ZONE, null);
-                List<StoragePoolVO> zoneStoragePoolsByHypervisor = _poolDao.findStoragePoolsByEmptyStorageAccessGroups(host.getDataCenterId(), null, null, ScopeType.ZONE, scCmd.getHypervisorType());
+                List<StoragePoolVO> clusterStoragePoolsByEmptySAGs = _poolDao.findStoragePoolsByEmptyStorageAccessGroups(host.getDataCenterId(), host.getPodId(), host.getClusterId(), ScopeType.CLUSTER, null, StoragePoolStatus.Up);
+                List<StoragePoolVO> storagePoolsByEmptySAGs = _poolDao.findStoragePoolsByEmptyStorageAccessGroups(host.getDataCenterId(), null, null, ScopeType.ZONE, null, StoragePoolStatus.Up);
+                List<StoragePoolVO> zoneStoragePoolsByHypervisor = _poolDao.findStoragePoolsByEmptyStorageAccessGroups(host.getDataCenterId(), null, null, ScopeType.ZONE, scCmd.getHypervisorType(), StoragePoolStatus.Up);
                 storagePoolsByEmptySAGs.retainAll(zoneStoragePoolsByHypervisor);
                 pools.addAll(storagePoolsByEmptySAGs);
                 pools.addAll(clusterStoragePoolsByEmptySAGs);
-                List<StoragePoolVO> zoneStoragePoolsByAnyHypervisor = _poolDao.findStoragePoolsByEmptyStorageAccessGroups(host.getDataCenterId(), null, null, ScopeType.ZONE, HypervisorType.Any);
+                List<StoragePoolVO> zoneStoragePoolsByAnyHypervisor = _poolDao.findStoragePoolsByEmptyStorageAccessGroups(host.getDataCenterId(), null, null, ScopeType.ZONE, HypervisorType.Any, StoragePoolStatus.Up);
                 pools.addAll(zoneStoragePoolsByAnyHypervisor);
             } else {
                 List<StoragePoolVO> storagePoolsBySAGs = new ArrayList<>();
                 List<StoragePoolVO> clusterStoragePoolsBySAGs = _poolDao.findPoolsByAccessGroupsForHostConnection(host.getDataCenterId(), host.getPodId(), host.getClusterId(), ScopeType.CLUSTER, sags);
-                List<StoragePoolVO> clusterStoragePoolsByEmptySAGs = _poolDao.findStoragePoolsByEmptyStorageAccessGroups(host.getDataCenterId(), host.getPodId(), host.getClusterId(), ScopeType.CLUSTER, null);
+                List<StoragePoolVO> clusterStoragePoolsByEmptySAGs = _poolDao.findStoragePoolsByEmptyStorageAccessGroups(host.getDataCenterId(), host.getPodId(), host.getClusterId(), ScopeType.CLUSTER, null, StoragePoolStatus.Up);
                 List<StoragePoolVO> zoneStoragePoolsBySAGs = _poolDao.findZoneWideStoragePoolsByAccessGroupsAndHypervisorTypeForHostConnection(host.getDataCenterId(), sags, scCmd.getHypervisorType());
                 List<StoragePoolVO> zoneStoragePoolsByHypervisorTypeAny = _poolDao.findZoneWideStoragePoolsByAccessGroupsAndHypervisorTypeForHostConnection(host.getDataCenterId(), sags, HypervisorType.Any);
-                List<StoragePoolVO> zoneStoragePoolsByEmptySAGs = _poolDao.findStoragePoolsByEmptyStorageAccessGroups(host.getDataCenterId(), null, null, ScopeType.ZONE, null);
+                List<StoragePoolVO> zoneStoragePoolsByEmptySAGs = _poolDao.findStoragePoolsByEmptyStorageAccessGroups(host.getDataCenterId(), null, null, ScopeType.ZONE, null, StoragePoolStatus.Up);
 
                 storagePoolsBySAGs.addAll(zoneStoragePoolsBySAGs);
                 storagePoolsBySAGs.addAll(zoneStoragePoolsByEmptySAGs);
@@ -148,13 +149,15 @@ public void processConnect(Host host, StartupCommand cmd, boolean forRebalance)
             }
 
             // get the zone wide disabled pools list if global setting is true.
-            if (StorageManager.MountDisabledStoragePool.value()) {
-                pools.addAll(_poolDao.findDisabledPoolsByScope(host.getDataCenterId(), null, null, ScopeType.ZONE));
+            if (StorageManager.getMountDisabledStoragePool().value()) {
+                pools.addAll(_poolDao.findDisabledPoolsByScopeAndAccessGroups(host.getDataCenterId(), null, null, ScopeType.ZONE, sags));
+                pools.addAll(_poolDao.findStoragePoolsByEmptyStorageAccessGroups(host.getDataCenterId(), null, null, ScopeType.ZONE, null, StoragePoolStatus.Disabled));
             }
 
             // get the cluster wide disabled pool list
-            if (StorageManager.MountDisabledStoragePool.valueIn(host.getClusterId())) {
-                pools.addAll(_poolDao.findDisabledPoolsByScope(host.getDataCenterId(), host.getPodId(), host.getClusterId(), ScopeType.CLUSTER));
+            if (StorageManager.getMountDisabledStoragePool().valueIn(host.getClusterId())) {
+                pools.addAll(_poolDao.findDisabledPoolsByScopeAndAccessGroups(host.getDataCenterId(), host.getPodId(), host.getClusterId(), ScopeType.CLUSTER, sags));
+                pools.addAll(_poolDao.findStoragePoolsByEmptyStorageAccessGroups(host.getDataCenterId(), host.getPodId(), host.getClusterId(), ScopeType.CLUSTER, null, StoragePoolStatus.Disabled));
             }
 
             List<StoragePoolHostVO> previouslyConnectedPools = new ArrayList<>();
diff --git a/server/src/test/java/com/cloud/storage/listener/StoragePoolMonitorTest.java b/server/src/test/java/com/cloud/storage/listener/StoragePoolMonitorTest.java
index 7421eb7ae2d9..0c729b364d19 100644
--- a/server/src/test/java/com/cloud/storage/listener/StoragePoolMonitorTest.java
+++ b/server/src/test/java/com/cloud/storage/listener/StoragePoolMonitorTest.java
@@ -22,17 +22,27 @@
 import com.cloud.hypervisor.Hypervisor;
 import com.cloud.storage.ScopeType;
 import com.cloud.storage.Storage;
+import com.cloud.storage.StorageManager;
 import com.cloud.storage.StorageManagerImpl;
 import com.cloud.storage.StoragePoolStatus;
 import com.cloud.storage.dao.StoragePoolHostDao;
+import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
 import org.junit.Before;
 import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.MockedStatic;
 import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
 
+import java.util.ArrayList;
 import java.util.Collections;
+import java.util.List;
 
+import static org.mockito.Mockito.mock;
+
+@RunWith(MockitoJUnitRunner.class)
 public class StoragePoolMonitorTest {
 
     private StorageManagerImpl storageManager;
@@ -45,9 +55,9 @@ public class StoragePoolMonitorTest {
 
     @Before
     public void setUp() throws Exception {
-        storageManager = Mockito.mock(StorageManagerImpl.class);
-        poolDao = Mockito.mock(PrimaryDataStoreDao.class);
-        storagePoolHostDao = Mockito.mock(StoragePoolHostDao.class);
+        storageManager = mock(StorageManagerImpl.class);
+        poolDao = mock(PrimaryDataStoreDao.class);
+        storagePoolHostDao = mock(StoragePoolHostDao.class);
 
         storagePoolMonitor = new StoragePoolMonitor(storageManager, poolDao, storagePoolHostDao, null);
         host = new HostVO("some-uuid");
@@ -62,21 +72,21 @@ public void setUp() throws Exception {
 
     @Test
     public void testProcessConnectStoragePoolNormal() throws Exception {
-        HostVO hostMock = Mockito.mock(HostVO.class);
-        StartupRoutingCommand startupRoutingCommand = Mockito.mock(StartupRoutingCommand.class);
-        StoragePoolVO poolMock = Mockito.mock(StoragePoolVO.class);
-        Mockito.when(poolMock.getScope()).thenReturn(ScopeType.CLUSTER);
-        Mockito.when(poolMock.getStatus()).thenReturn(StoragePoolStatus.Up);
-        Mockito.when(poolMock.getId()).thenReturn(123L);
-        Mockito.when(poolMock.getPoolType()).thenReturn(Storage.StoragePoolType.Filesystem);
+        HostVO hostMock = mock(HostVO.class);
+        StartupRoutingCommand startupRoutingCommand = mock(StartupRoutingCommand.class);
+        StoragePoolVO poolMock = mock(StoragePoolVO.class);
+        Mockito.lenient().when(poolMock.getScope()).thenReturn(ScopeType.CLUSTER);
+        Mockito.lenient().when(poolMock.getStatus()).thenReturn(StoragePoolStatus.Up);
+        Mockito.lenient().when(poolMock.getId()).thenReturn(123L);
+        Mockito.lenient().when(poolMock.getPoolType()).thenReturn(Storage.StoragePoolType.Filesystem);
         Mockito.when(hostMock.getDataCenterId()).thenReturn(1L);
         Mockito.when(hostMock.getPodId()).thenReturn(1L);
         Mockito.when(hostMock.getClusterId()).thenReturn(1L);
         Mockito.when(startupRoutingCommand.getHypervisorType()).thenReturn(Hypervisor.HypervisorType.KVM);
-        Mockito.when(poolDao.findStoragePoolsByEmptyStorageAccessGroups(1L, 1L, 1L, ScopeType.CLUSTER, null)).thenReturn(Collections.singletonList(pool));
-        Mockito.when(poolDao.findStoragePoolsByEmptyStorageAccessGroups(1L, null, null, ScopeType.ZONE, null)).thenReturn(Collections.<StoragePoolVO>emptyList());
-        Mockito.when(poolDao.findStoragePoolsByEmptyStorageAccessGroups(1L, null, null, ScopeType.ZONE, Hypervisor.HypervisorType.KVM)).thenReturn(Collections.<StoragePoolVO>emptyList());
-        Mockito.when(poolDao.findStoragePoolsByEmptyStorageAccessGroups(1L, null, null, ScopeType.ZONE, Hypervisor.HypervisorType.Any)).thenReturn(Collections.<StoragePoolVO>emptyList());
+        Mockito.when(poolDao.findStoragePoolsByEmptyStorageAccessGroups(1L, 1L, 1L, ScopeType.CLUSTER, null, StoragePoolStatus.Up)).thenReturn(Collections.singletonList(pool));
+        Mockito.when(poolDao.findStoragePoolsByEmptyStorageAccessGroups(1L, null, null, ScopeType.ZONE, null, StoragePoolStatus.Up)).thenReturn(Collections.<StoragePoolVO>emptyList());
+        Mockito.when(poolDao.findStoragePoolsByEmptyStorageAccessGroups(1L, null, null, ScopeType.ZONE, Hypervisor.HypervisorType.KVM, StoragePoolStatus.Up)).thenReturn(Collections.<StoragePoolVO>emptyList());
+        Mockito.when(poolDao.findStoragePoolsByEmptyStorageAccessGroups(1L, null, null, ScopeType.ZONE, Hypervisor.HypervisorType.Any, StoragePoolStatus.Up)).thenReturn(Collections.<StoragePoolVO>emptyList());
         Mockito.doReturn(true).when(storageManager).connectHostToSharedPool(hostMock, 123L);
 
         storagePoolMonitor.processConnect(hostMock, startupRoutingCommand, false);
@@ -87,11 +97,81 @@ public void testProcessConnectStoragePoolNormal() throws Exception {
 
     @Test
     public void testProcessConnectStoragePoolFailureOnHost() throws Exception {
-        Mockito.when(poolDao.listBy(Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.any(ScopeType.class))).thenReturn(Collections.singletonList(pool));
-        Mockito.when(poolDao.findZoneWideStoragePoolsByTags(Mockito.anyLong(), Mockito.any(String[].class), Mockito.anyBoolean())).thenReturn(Collections.<StoragePoolVO>emptyList());
-        Mockito.when(poolDao.findZoneWideStoragePoolsByHypervisor(Mockito.anyLong(), Mockito.any(Hypervisor.HypervisorType.class))).thenReturn(Collections.<StoragePoolVO>emptyList());
-        Mockito.doThrow(new StorageUnavailableException("unable to mount storage", 123L)).when(storageManager).connectHostToSharedPool(Mockito.any(), Mockito.anyLong());
+        Mockito.lenient().when(poolDao.listBy(Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.any(ScopeType.class))).thenReturn(Collections.singletonList(pool));
+        Mockito.lenient().when(poolDao.findZoneWideStoragePoolsByTags(Mockito.anyLong(), Mockito.any(String[].class), Mockito.anyBoolean())).thenReturn(Collections.<StoragePoolVO>emptyList());
+        Mockito.lenient().when(poolDao.findZoneWideStoragePoolsByHypervisor(Mockito.anyLong(), Mockito.any(Hypervisor.HypervisorType.class))).thenReturn(Collections.<StoragePoolVO>emptyList());
+        Mockito.lenient().doThrow(new StorageUnavailableException("unable to mount storage", 123L)).when(storageManager).connectHostToSharedPool(Mockito.any(), Mockito.anyLong());
 
         storagePoolMonitor.processConnect(host, cmd, false);
     }
+
+    @Test
+    public void testProcessConnectWithMountDisabledStoragePoolEnabled() throws Exception {
+        StoragePoolVO disabledZonePool = new StoragePoolVO();
+        disabledZonePool.setId(200L);
+        disabledZonePool.setScope(ScopeType.ZONE);
+        disabledZonePool.setStatus(StoragePoolStatus.Disabled);
+        disabledZonePool.setPoolType(Storage.StoragePoolType.NetworkFilesystem);
+
+        StoragePoolVO disabledClusterPool = new StoragePoolVO();
+        disabledClusterPool.setId(201L);
+        disabledClusterPool.setScope(ScopeType.CLUSTER);
+        disabledClusterPool.setStatus(StoragePoolStatus.Disabled);
+        disabledClusterPool.setPoolType(Storage.StoragePoolType.NetworkFilesystem);
+        HostVO hostMock = mock(HostVO.class);
+        StartupRoutingCommand startupRoutingCommand = mock(StartupRoutingCommand.class);
+        Mockito.when(hostMock.getDataCenterId()).thenReturn(1L);
+        Mockito.when(hostMock.getPodId()).thenReturn(1L);
+        Mockito.when(hostMock.getClusterId()).thenReturn(1L);
+        Mockito.when(hostMock.getId()).thenReturn(1L);
+        Mockito.when(startupRoutingCommand.getHypervisorType()).thenReturn(Hypervisor.HypervisorType.KVM);
+
+        try (MockedStatic<StorageManager> storageManagerMockedStatic = Mockito.mockStatic(StorageManager.class)) {
+            ConfigKey<Boolean> mockConfigKey = mock(ConfigKey.class);
+            Mockito.when(mockConfigKey.value()).thenReturn(true);
+            Mockito.when(mockConfigKey.valueIn(1L)).thenReturn(true);
+
+            storageManagerMockedStatic.when(StorageManager::getMountDisabledStoragePool).thenReturn(mockConfigKey);
+
+            Mockito.when(poolDao.findStoragePoolsByEmptyStorageAccessGroups(1L, 1L, 1L, ScopeType.CLUSTER, null, StoragePoolStatus.Up))
+                    .thenReturn(new ArrayList<>());
+            Mockito.when(poolDao.findStoragePoolsByEmptyStorageAccessGroups(1L, null, null, ScopeType.ZONE, null, StoragePoolStatus.Up))
+                    .thenReturn(new ArrayList<>());
+            Mockito.when(poolDao.findStoragePoolsByEmptyStorageAccessGroups(1L, null, null, ScopeType.ZONE, Hypervisor.HypervisorType.KVM, StoragePoolStatus.Up))
+                    .thenReturn(new ArrayList<>());
+            Mockito.when(poolDao.findStoragePoolsByEmptyStorageAccessGroups(1L, null, null, ScopeType.ZONE, Hypervisor.HypervisorType.Any, StoragePoolStatus.Up))
+                    .thenReturn(new ArrayList<>());
+
+            List<StoragePoolVO> zoneDisabledPoolsBySAG = new ArrayList<>();
+            zoneDisabledPoolsBySAG.add(disabledZonePool);
+            Mockito.when(poolDao.findDisabledPoolsByScopeAndAccessGroups(1L, null, null, ScopeType.ZONE, new String[0]))
+                    .thenReturn(zoneDisabledPoolsBySAG);
+            Mockito.when(poolDao.findStoragePoolsByEmptyStorageAccessGroups(1L, null, null, ScopeType.ZONE, null, StoragePoolStatus.Disabled))
+                    .thenReturn(new ArrayList<>());
+
+            List<StoragePoolVO> clusterDisabledPoolsBySAG = new ArrayList<>();
+            clusterDisabledPoolsBySAG.add(disabledClusterPool);
+            Mockito.when(poolDao.findDisabledPoolsByScopeAndAccessGroups(1L, 1L, 1L, ScopeType.CLUSTER, new String[0]))
+                    .thenReturn(clusterDisabledPoolsBySAG);
+            Mockito.when(poolDao.findStoragePoolsByEmptyStorageAccessGroups(1L, 1L, 1L, ScopeType.CLUSTER, null, StoragePoolStatus.Disabled))
+                    .thenReturn(new ArrayList<>());
+
+            Mockito.when(storageManager.getStorageAccessGroups(null, null, null, 1L)).thenReturn(new String[0]);
+            Mockito.when(storageManager.findStoragePoolsConnectedToHost(1L)).thenReturn(Collections.emptyList());
+            Mockito.doReturn(true).when(storageManager).connectHostToSharedPool(hostMock, 200L);
+            Mockito.doReturn(true).when(storageManager).connectHostToSharedPool(hostMock, 201L);
+
+            storagePoolMonitor.processConnect(hostMock, startupRoutingCommand, false);
+
+            Mockito.verify(poolDao, Mockito.times(1)).findDisabledPoolsByScopeAndAccessGroups(1L, null, null, ScopeType.ZONE, new String[0]);
+            Mockito.verify(poolDao, Mockito.times(1)).findStoragePoolsByEmptyStorageAccessGroups(1L, null, null, ScopeType.ZONE, null, StoragePoolStatus.Disabled);
+            Mockito.verify(poolDao, Mockito.times(1)).findDisabledPoolsByScopeAndAccessGroups(1L, 1L, 1L, ScopeType.CLUSTER, new String[0]);
+            Mockito.verify(poolDao, Mockito.times(1)).findStoragePoolsByEmptyStorageAccessGroups(1L, 1L, 1L, ScopeType.CLUSTER, null, StoragePoolStatus.Disabled);
+
+            Mockito.verify(storageManager, Mockito.times(1)).connectHostToSharedPool(Mockito.eq(hostMock), Mockito.eq(200L));
+            Mockito.verify(storageManager, Mockito.times(1)).connectHostToSharedPool(Mockito.eq(hostMock), Mockito.eq(201L));
+            Mockito.verify(storageManager, Mockito.times(1)).createCapacityEntry(Mockito.eq(200L));
+            Mockito.verify(storageManager, Mockito.times(1)).createCapacityEntry(Mockito.eq(201L));
+        }
+    }
 }

From 2974af84f22a8def8339380628d8653a4f016d3f Mon Sep 17 00:00:00 2001
From: Daman Arora <61474540+Damans227@users.noreply.github.com>
Date: Tue, 6 Oct 2026 15:21:42 -0400
Subject: [PATCH 20/41] Make worker and API thread pool size configurable
 (#13565)

* Make worker and API thread pool size configurable

The AsyncJobManager's API and Worker executor thread pool sizes are
currently derived solely from db.cloud.maxActive (maxActive/2 and
maxActive*2/3 respectively). This coupling doesn't account for
environments with predominantly I/O-bound workers, where threads are
held waiting on external responses for extended periods and higher
pool sizes may be needed independently of the DB connection count.

This adds two global config keys:
- api.job.pool.size (default: 50)
- work.job.pool.size (default: 50)

The actual pool size is Math.max(configured value, db-derived
default), preserving existing behavior by default while allowing
operators to increase pool sizes when workloads require it. Pool
sizes and their derivation are logged at startup for observability.

* Replace synthetic pool size tests with real configure() executor assertions

The previous unit tests for the api.job.pool.size/work.job.pool.size
config keys only re-ran Math.max() on local hardcoded values, or
checked ConfigKey plumbing directly, without ever calling
AsyncJobManagerImpl.configure() itself. That meant a regression in the
actual pool-sizing logic wouldn't have been caught.

These tests now invoke configure() directly and assert on the real
core pool size of the created _apiJobExecutor/_workerJobExecutor via
reflection, with @Before/@After hooks to stub db.properties and reset
config/executor state between tests.

---------

Co-authored-by: Sachin R <32716246+sachindoddaguni@users.noreply.github.com>
Co-authored-by: mprokopchuk <mprokopchuk@apple.com>
---
 .../jobs/impl/AsyncJobManagerImpl.java        |  19 ++-
 .../jobs/impl/AsyncJobManagerImplTest.java    | 146 ++++++++++++++++++
 2 files changed, 160 insertions(+), 5 deletions(-)

diff --git a/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/impl/AsyncJobManagerImpl.java b/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/impl/AsyncJobManagerImpl.java
index 1cb1cb4e309f..1572adc50085 100644
--- a/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/impl/AsyncJobManagerImpl.java
+++ b/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/impl/AsyncJobManagerImpl.java
@@ -125,6 +125,10 @@ public class AsyncJobManagerImpl extends ManagerBase implements AsyncJobManager,
             Integer.class, "vm.job.lock.timeout", "1800",
             "Time in seconds to wait in acquiring lock to submit a vm worker job", false);
     private static final ConfigKey<Boolean> HidePassword = new ConfigKey<Boolean>("Advanced", Boolean.class, "log.hide.password", "true", "If set to true, the password is hidden", true, ConfigKey.Scope.Global);
+    public static final ConfigKey<Integer> ApiJobPoolSize = new ConfigKey<>("Advanced", Integer.class, "api.job.pool.size", "50",
+        "Minimum size of the API job executor thread pool. Actual size is the max of this value and db.cloud.maxActive / 2.", false, ConfigKey.Scope.Global);
+    public static final ConfigKey<Integer> WorkJobPoolSize = new ConfigKey<>("Advanced", Integer.class, "work.job.pool.size", "50",
+        "Minimum size of the Worker job executor thread pool. Actual size is the max of this value and db.cloud.maxActive * 2 / 3.", false, ConfigKey.Scope.Global);
 
 
     private static final int ACQUIRE_GLOBAL_LOCK_TIMEOUT_FOR_COOPERATION = 3;     // 3 seconds
@@ -198,7 +202,7 @@ public String getConfigComponentName() {
 
     @Override
     public ConfigKey<?>[] getConfigKeys() {
-        return new ConfigKey<?>[] {JobExpireMinutes, JobCancelThresholdMinutes, VmJobLockTimeout, HidePassword};
+        return new ConfigKey<?>[] {JobExpireMinutes, JobCancelThresholdMinutes, VmJobLockTimeout, HidePassword, ApiJobPoolSize, WorkJobPoolSize};
     }
 
     @Override
@@ -1100,13 +1104,18 @@ public boolean configure(String name, Map<String, Object> params) throws Configu
             final Properties dbProps = DbProperties.getDbProperties();
             final int cloudMaxActive = Integer.parseInt(dbProps.getProperty("db.cloud.maxActive"));
 
-            int apiPoolSize = cloudMaxActive / 2;
-            int workPoolSize = (cloudMaxActive * 2) / 3;
+            int defaultApiPoolSize = cloudMaxActive / 2;
+            int defaultWorkPoolSize = (cloudMaxActive * 2) / 3;
 
-            logger.info("Start AsyncJobManager API executor thread pool in size " + apiPoolSize);
+            int apiPoolSize = Math.max(ApiJobPoolSize.value(), defaultApiPoolSize);
+            int workPoolSize = Math.max(WorkJobPoolSize.value(), defaultWorkPoolSize);
+
+            logger.info("Start AsyncJobManager API executor thread pool in size " + apiPoolSize +
+                " (configured=" + ApiJobPoolSize.value() + ", db.derived=" + defaultApiPoolSize + ", db.cloud.maxActive=" + cloudMaxActive + ")");
             _apiJobExecutor = Executors.newFixedThreadPool(apiPoolSize, new NamedThreadFactory(AsyncJobManager.API_JOB_POOL_THREAD_PREFIX));
 
-            logger.info("Start AsyncJobManager Work executor thread pool in size " + workPoolSize);
+            logger.info("Start AsyncJobManager Work executor thread pool in size " + workPoolSize +
+                " (configured=" + WorkJobPoolSize.value() + ", db.derived=" + defaultWorkPoolSize + ", db.cloud.maxActive=" + cloudMaxActive + ")");
             _workerJobExecutor = Executors.newFixedThreadPool(workPoolSize, new NamedThreadFactory(AsyncJobManager.WORK_JOB_POOL_THREAD_PREFIX));
         } catch (final Exception e) {
             throw new ConfigurationException("Unable to load db.properties to configure AsyncJobManagerImpl");
diff --git a/framework/jobs/src/test/java/org/apache/cloudstack/framework/jobs/impl/AsyncJobManagerImplTest.java b/framework/jobs/src/test/java/org/apache/cloudstack/framework/jobs/impl/AsyncJobManagerImplTest.java
index 0be5dbc01cbd..08d4c2afd431 100644
--- a/framework/jobs/src/test/java/org/apache/cloudstack/framework/jobs/impl/AsyncJobManagerImplTest.java
+++ b/framework/jobs/src/test/java/org/apache/cloudstack/framework/jobs/impl/AsyncJobManagerImplTest.java
@@ -17,19 +17,30 @@
 
 package org.apache.cloudstack.framework.jobs.impl;
 
+import java.lang.reflect.Field;
+import java.util.Properties;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.ThreadPoolExecutor;
+
 import com.cloud.network.Network;
 import com.cloud.network.dao.NetworkDao;
 import com.cloud.network.dao.NetworkVO;
 import com.cloud.storage.Volume;
+import com.cloud.utils.db.DbProperties;
 import com.cloud.utils.fsm.NoTransitionException;
 import com.cloud.vm.VMInstanceVO;
 import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.VirtualMachineManager;
 import com.cloud.vm.dao.VMInstanceDao;
+
 import org.apache.cloudstack.api.ApiCommandResourceType;
 import org.apache.cloudstack.engine.orchestration.service.NetworkOrchestrationService;
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeDataFactory;
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.mockito.InjectMocks;
@@ -42,6 +53,12 @@
 
 @RunWith(MockitoJUnitRunner.class)
 public class AsyncJobManagerImplTest {
+
+    // db.cloud.maxActive value preloaded into DbProperties for every test in this class.
+    // Chosen so the db-derived defaults (4000/2 = 2000 for api, 4000*2/3 = 2666 for worker)
+    // are non-trivial and easy to reason about vs. the configured minimums under test.
+    private static final int DB_CLOUD_MAX_ACTIVE = 4000;
+
     @Spy
     @InjectMocks
     AsyncJobManagerImpl asyncJobManager;
@@ -56,6 +73,30 @@ public class AsyncJobManagerImplTest {
     @Mock
     NetworkOrchestrationService networkOrchestrationService;
 
+    @Before
+    public void preloadDbProperties() throws Exception {
+        Properties props = new Properties();
+        props.setProperty("db.cloud.maxActive", String.valueOf(DB_CLOUD_MAX_ACTIVE));
+        // Bypass DbProperties' internal "loaded" guard so configure() reads our
+        // properties instead of trying to load a real db.properties file.
+        setDbPropertiesStatics(props, true);
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        try {
+            shutdownIfPresent("_apiJobExecutor");
+            shutdownIfPresent("_workerJobExecutor");
+        } finally {
+            // Reset static state even if executor shutdown throws, so we do not
+            // pollute later test classes with our stubbed ConfigKey values or
+            // preloaded DbProperties.
+            resetConfigValue(AsyncJobManagerImpl.ApiJobPoolSize);
+            resetConfigValue(AsyncJobManagerImpl.WorkJobPoolSize);
+            setDbPropertiesStatics(new Properties(), false);
+        }
+    }
+
     @Test
     public void testCleanupVolumeResource() {
         AsyncJobVO job = new AsyncJobVO();
@@ -93,4 +134,109 @@ public void testCleanupNetworkResource() throws NoTransitionException {
         Mockito.verify(networkOrchestrationService, Mockito.times(1)).stateTransitTo(networkVO,
                 Network.Event.OperationFailed);
     }
+
+    @Test
+    public void configureApiPoolUsesConfiguredValueWhenLargerThanDbDerived() throws Exception {
+        overrideConfigValue(AsyncJobManagerImpl.ApiJobPoolSize, 3000);
+        overrideConfigValue(AsyncJobManagerImpl.WorkJobPoolSize, 50);
+        invokeConfigureAndSwallowPostSetupNpe();
+        // apiPoolSize = max(3000, 4000/2) = 3000 (configured wins)
+        Assert.assertEquals(3000, apiPoolCoreSize());
+    }
+
+    @Test
+    public void configureApiPoolUsesDbDerivedWhenLargerThanConfigured() throws Exception {
+        overrideConfigValue(AsyncJobManagerImpl.ApiJobPoolSize, 50);
+        overrideConfigValue(AsyncJobManagerImpl.WorkJobPoolSize, 50);
+        invokeConfigureAndSwallowPostSetupNpe();
+        // apiPoolSize = max(50, 4000/2) = 2000 (db-derived wins)
+        Assert.assertEquals(DB_CLOUD_MAX_ACTIVE / 2, apiPoolCoreSize());
+    }
+
+    @Test
+    public void configureWorkerPoolUsesTwoThirdsFormula() throws Exception {
+        overrideConfigValue(AsyncJobManagerImpl.ApiJobPoolSize, 50);
+        overrideConfigValue(AsyncJobManagerImpl.WorkJobPoolSize, 50);
+        invokeConfigureAndSwallowPostSetupNpe();
+        // workPoolSize = max(50, 4000*2/3) = 2666 (db-derived wins)
+        Assert.assertEquals((DB_CLOUD_MAX_ACTIVE * 2) / 3, workerPoolCoreSize());
+    }
+
+    @Test
+    public void configureWorkerPoolUsesConfiguredValueWhenLargerThanDbDerived() throws Exception {
+        overrideConfigValue(AsyncJobManagerImpl.ApiJobPoolSize, 50);
+        overrideConfigValue(AsyncJobManagerImpl.WorkJobPoolSize, 5000);
+        invokeConfigureAndSwallowPostSetupNpe();
+        // workPoolSize = max(5000, 4000*2/3) = 5000 (configured wins)
+        Assert.assertEquals(5000, workerPoolCoreSize());
+    }
+
+    /**
+     * Invoke configure() and swallow the NPE it throws when wiring SearchBuilders
+     * on the un-mocked DAOs after the pool-sizing block. The executors are created
+     * inside configure()'s try/catch (before the DAO wiring), so pool sizes can
+     * still be inspected after the failure.
+     */
+    private void invokeConfigureAndSwallowPostSetupNpe() {
+        try {
+            asyncJobManager.configure(null, null);
+        } catch (Exception ignored) {
+            // expected: DAO wiring after pool-sizing NPEs because we intentionally
+            // did not mock the DAOs (they are not part of what we are testing).
+        }
+    }
+
+    private int apiPoolCoreSize() throws Exception {
+        Object executor = readField("_apiJobExecutor");
+        Assert.assertNotNull("configure() did not create _apiJobExecutor - has DAO wiring been moved before pool sizing?", executor);
+        return ((ThreadPoolExecutor) executor).getCorePoolSize();
+    }
+
+    private int workerPoolCoreSize() throws Exception {
+        Object executor = readField("_workerJobExecutor");
+        Assert.assertNotNull("configure() did not create _workerJobExecutor - has DAO wiring been moved before pool sizing?", executor);
+        return ((ThreadPoolExecutor) executor).getCorePoolSize();
+    }
+
+    private Object readField(String name) throws Exception {
+        Field f = AsyncJobManagerImpl.class.getDeclaredField(name);
+        f.setAccessible(true);
+        return f.get(asyncJobManager);
+    }
+
+    private void shutdownIfPresent(String executorFieldName) {
+        try {
+            Object executor = readField(executorFieldName);
+            if (executor instanceof ExecutorService) {
+                ((ExecutorService) executor).shutdownNow();
+            }
+        } catch (Exception ignored) {
+            // never populated by this test - nothing to clean up
+        }
+    }
+
+    private void overrideConfigValue(final ConfigKey<?> configKey, final Object value) {
+        try {
+            Field f = ConfigKey.class.getDeclaredField("_value");
+            f.setAccessible(true);
+            f.set(configKey, value);
+        } catch (IllegalAccessException | NoSuchFieldException e) {
+            Assert.fail(e.getMessage());
+        }
+    }
+
+    private void resetConfigValue(final ConfigKey<?> configKey) throws Exception {
+        Field f = ConfigKey.class.getDeclaredField("_value");
+        f.setAccessible(true);
+        f.set(configKey, null);
+    }
+
+    private void setDbPropertiesStatics(Properties props, boolean loaded) throws Exception {
+        Field propsField = DbProperties.class.getDeclaredField("properties");
+        Field loadedField = DbProperties.class.getDeclaredField("loaded");
+        propsField.setAccessible(true);
+        loadedField.setAccessible(true);
+        propsField.set(null, props);
+        loadedField.set(null, loaded);
+    }
 }

From 5dfe75f77f3dab2271f5a00759148b0643d45b33 Mon Sep 17 00:00:00 2001
From: Manoj Kumar <manojkr.itbhu@gmail.com>
Date: Wed, 7 Oct 2026 00:54:59 +0530
Subject: [PATCH 21/41] Exclude Apache CXF dependency from kvm plugin (#13799)

---
 plugins/hypervisors/kvm/pom.xml | 36 +++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/plugins/hypervisors/kvm/pom.xml b/plugins/hypervisors/kvm/pom.xml
index 0e150398dd83..c72e0c67b4a8 100644
--- a/plugins/hypervisors/kvm/pom.xml
+++ b/plugins/hypervisors/kvm/pom.xml
@@ -41,6 +41,12 @@
             <groupId>org.apache.cloudstack</groupId>
             <artifactId>cloud-agent</artifactId>
             <version>${project.version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.apache.cxf</groupId>
+                    <artifactId>cxf-rt-frontend-jaxrs</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.libvirt</groupId>
@@ -51,11 +57,35 @@
             <groupId>org.apache.cloudstack</groupId>
             <artifactId>cloud-plugin-network-ovs</artifactId>
             <version>${project.version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.apache.cxf</groupId>
+                    <artifactId>cxf-rt-frontend-jaxrs</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
           <groupId>org.apache.cloudstack</groupId>
           <artifactId>cloud-engine-storage-configdrive</artifactId>
           <version>${project.version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.apache.cxf</groupId>
+                    <artifactId>cxf-rt-frontend-jaxrs</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.cloudstack</groupId>
+            <artifactId>cloud-engine-storage</artifactId>
+            <version>${project.version}</version>
+            <scope>compile</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.apache.cxf</groupId>
+                    <artifactId>cxf-rt-frontend-jaxrs</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>com.ceph</groupId>
@@ -107,6 +137,12 @@
             <artifactId>cloud-plugin-storage-volume-scaleio</artifactId>
             <version>${project.version}</version>
             <scope>compile</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.apache.cxf</groupId>
+                    <artifactId>cxf-rt-frontend-jaxrs</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
     </dependencies>
     <build>

From 376c1b40174ab4b8d7f9aced5401143cbc09d587 Mon Sep 17 00:00:00 2001
From: Ramgopal Nagaboina <ramgopal.nagaboina.dev@gmail.com>
Date: Wed, 7 Oct 2026 02:18:41 -0400
Subject: [PATCH 22/41] server: scope IPv6 security group member rules to the
 exact host (#14037)

* server: scope IPv6 security group member rules to the exact host

When a security group rule references another security group, each member VM
should be authorized as an exact host. The IPv4 address is correctly pinned to
a /32, but the IPv6 address was expanded to /64, opening the whole subnet the
member sits in rather than just that member. Pin the IPv6 member to /128 to
match the IPv4 behaviour.

* server: scope the Impl2 IPv6 security group member rule to the exact host
---
 .../security/SecurityGroupManagerImpl.java    |  2 +-
 .../security/SecurityGroupManagerImpl2.java   |  2 +-
 ...SecurityGroupManagerImpl2Ipv6RuleTest.java | 82 +++++++++++++++++
 .../SecurityGroupManagerImplIpv6RuleTest.java | 90 +++++++++++++++++++
 4 files changed, 174 insertions(+), 2 deletions(-)
 create mode 100644 server/src/test/java/com/cloud/network/security/SecurityGroupManagerImpl2Ipv6RuleTest.java
 create mode 100644 server/src/test/java/com/cloud/network/security/SecurityGroupManagerImplIpv6RuleTest.java

diff --git a/server/src/main/java/com/cloud/network/security/SecurityGroupManagerImpl.java b/server/src/main/java/com/cloud/network/security/SecurityGroupManagerImpl.java
index f0e3b32ebaa5..8b9387752658 100644
--- a/server/src/main/java/com/cloud/network/security/SecurityGroupManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/security/SecurityGroupManagerImpl.java
@@ -356,7 +356,7 @@ protected Map<PortAndProto, Set<String>> generateRulesForVM(Long userVmId, Secur
                             cidr = cidr + "/32";
                             cidrs.add(cidr);
                             if (defaultNic.getIPv6Address() != null) {
-                                cidrs.add(defaultNic.getIPv6Address() + "/64");
+                                cidrs.add(defaultNic.getIPv6Address() + "/128");
                             }
                         }
                     }
diff --git a/server/src/main/java/com/cloud/network/security/SecurityGroupManagerImpl2.java b/server/src/main/java/com/cloud/network/security/SecurityGroupManagerImpl2.java
index bd532f8162ff..28ec7c0d384a 100644
--- a/server/src/main/java/com/cloud/network/security/SecurityGroupManagerImpl2.java
+++ b/server/src/main/java/com/cloud/network/security/SecurityGroupManagerImpl2.java
@@ -250,7 +250,7 @@ protected Map<PortAndProto, Set<String>> generateRulesForVM(Long userVmId, Secur
                         String cidr = ngmapVO.getGuestIpAddress() + "/32";
                         cidrs.add(cidr);
                         if (ngmapVO.getGuestIpv6Address() != null) {
-                            cidrs.add(ngmapVO.getGuestIpv6Address() + "/64");
+                            cidrs.add(ngmapVO.getGuestIpv6Address() + "/128");
                         }
                     }
                 } else if (rule.getAllowedSourceIpCidr() != null) {
diff --git a/server/src/test/java/com/cloud/network/security/SecurityGroupManagerImpl2Ipv6RuleTest.java b/server/src/test/java/com/cloud/network/security/SecurityGroupManagerImpl2Ipv6RuleTest.java
new file mode 100644
index 000000000000..b8cbd1534d37
--- /dev/null
+++ b/server/src/test/java/com/cloud/network/security/SecurityGroupManagerImpl2Ipv6RuleTest.java
@@ -0,0 +1,82 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.network.security;
+
+import static org.mockito.Mockito.when;
+
+import java.util.Collections;
+import java.util.Map;
+import java.util.Set;
+
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.network.security.SecurityGroupManagerImpl.PortAndProto;
+import com.cloud.network.security.SecurityRule.SecurityRuleType;
+import com.cloud.network.security.dao.SecurityGroupRuleDao;
+import com.cloud.network.security.dao.SecurityGroupVMMapDao;
+import com.cloud.vm.VirtualMachine.State;
+
+@RunWith(MockitoJUnitRunner.Silent.class)
+public class SecurityGroupManagerImpl2Ipv6RuleTest {
+
+    @Mock
+    SecurityGroupRuleDao _securityGroupRuleDao;
+    @Mock
+    SecurityGroupVMMapDao _securityGroupVMMapDao;
+
+    @InjectMocks
+    SecurityGroupManagerImpl2 manager = new SecurityGroupManagerImpl2();
+
+    @Test
+    public void securityGroupMemberRuleUsesExactIpv6HostCidr() {
+        Long vmId = 1L;
+        SecurityRuleType type = SecurityRuleType.IngressRule;
+
+        // The VM belongs to security group 10, which has one rule referencing another security group (20).
+        SecurityGroupVMMapVO groupMap = Mockito.mock(SecurityGroupVMMapVO.class);
+        when(groupMap.getSecurityGroupId()).thenReturn(10L);
+        when(_securityGroupVMMapDao.listByInstanceId(vmId)).thenReturn(Collections.singletonList(groupMap));
+
+        SecurityGroupRuleVO rule = Mockito.mock(SecurityGroupRuleVO.class);
+        when(rule.getProtocol()).thenReturn("tcp");
+        when(rule.getStartPort()).thenReturn(80);
+        when(rule.getEndPort()).thenReturn(80);
+        when(rule.getAllowedNetworkId()).thenReturn(20L);
+        when(_securityGroupRuleDao.listBySecurityGroupId(10L, type)).thenReturn(Collections.singletonList(rule));
+
+        // Unlike the superclass, Impl2 reads the member addresses straight from the VO join, not the nics table.
+        SecurityGroupVMMapVO memberMap = Mockito.mock(SecurityGroupVMMapVO.class);
+        when(memberMap.getGuestIpAddress()).thenReturn("10.1.1.5");
+        when(memberMap.getGuestIpv6Address()).thenReturn("2001:db8::5");
+        when(_securityGroupVMMapDao.listBySecurityGroup(20L, State.Running)).thenReturn(Collections.singletonList(memberMap));
+
+        Map<PortAndProto, Set<String>> allowed = manager.generateRulesForVM(vmId, type);
+
+        Assert.assertEquals(1, allowed.size());
+        Set<String> cidrs = allowed.values().iterator().next();
+        // The member must be authorized as an exact host, matching the IPv4 /32 behaviour.
+        Assert.assertTrue("IPv4 member should be pinned to /32", cidrs.contains("10.1.1.5/32"));
+        Assert.assertTrue("IPv6 member should be pinned to the exact /128 host", cidrs.contains("2001:db8::5/128"));
+        Assert.assertFalse("IPv6 member must not open the whole /64 subnet", cidrs.contains("2001:db8::5/64"));
+    }
+}
diff --git a/server/src/test/java/com/cloud/network/security/SecurityGroupManagerImplIpv6RuleTest.java b/server/src/test/java/com/cloud/network/security/SecurityGroupManagerImplIpv6RuleTest.java
new file mode 100644
index 000000000000..e2b7e96ff26a
--- /dev/null
+++ b/server/src/test/java/com/cloud/network/security/SecurityGroupManagerImplIpv6RuleTest.java
@@ -0,0 +1,90 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.network.security;
+
+import static org.mockito.Mockito.when;
+
+import java.util.Collections;
+import java.util.Map;
+import java.util.Set;
+
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.network.NetworkModel;
+import com.cloud.network.security.SecurityGroupManagerImpl.PortAndProto;
+import com.cloud.network.security.SecurityRule.SecurityRuleType;
+import com.cloud.network.security.dao.SecurityGroupRuleDao;
+import com.cloud.network.security.dao.SecurityGroupVMMapDao;
+import com.cloud.vm.Nic;
+import com.cloud.vm.VirtualMachine.State;
+
+@RunWith(MockitoJUnitRunner.Silent.class)
+public class SecurityGroupManagerImplIpv6RuleTest {
+
+    @Mock
+    SecurityGroupRuleDao _securityGroupRuleDao;
+    @Mock
+    SecurityGroupVMMapDao _securityGroupVMMapDao;
+    @Mock
+    NetworkModel _networkModel;
+
+    @InjectMocks
+    SecurityGroupManagerImpl manager = new SecurityGroupManagerImpl();
+
+    @Test
+    public void securityGroupMemberRuleUsesExactIpv6HostCidr() {
+        Long vmId = 1L;
+        SecurityRuleType type = SecurityRuleType.IngressRule;
+
+        // The VM belongs to security group 10, which has one rule referencing another security group (20).
+        SecurityGroupVMMapVO groupMap = Mockito.mock(SecurityGroupVMMapVO.class);
+        when(groupMap.getSecurityGroupId()).thenReturn(10L);
+        when(_securityGroupVMMapDao.listByInstanceId(vmId)).thenReturn(Collections.singletonList(groupMap));
+
+        SecurityGroupRuleVO rule = Mockito.mock(SecurityGroupRuleVO.class);
+        when(rule.getProtocol()).thenReturn("tcp");
+        when(rule.getStartPort()).thenReturn(80);
+        when(rule.getEndPort()).thenReturn(80);
+        when(rule.getAllowedNetworkId()).thenReturn(20L);
+        when(_securityGroupRuleDao.listBySecurityGroupId(10L, type)).thenReturn(Collections.singletonList(rule));
+
+        // Group 20 has one running member VM with both an IPv4 and an IPv6 address.
+        SecurityGroupVMMapVO memberMap = Mockito.mock(SecurityGroupVMMapVO.class);
+        when(memberMap.getInstanceId()).thenReturn(2L);
+        when(_securityGroupVMMapDao.listBySecurityGroup(20L, State.Running)).thenReturn(Collections.singletonList(memberMap));
+
+        Nic nic = Mockito.mock(Nic.class);
+        when(nic.getIPv4Address()).thenReturn("10.1.1.5");
+        when(nic.getIPv6Address()).thenReturn("2001:db8::5");
+        when(_networkModel.getDefaultNic(2L)).thenReturn(nic);
+
+        Map<PortAndProto, Set<String>> allowed = manager.generateRulesForVM(vmId, type);
+
+        Assert.assertEquals(1, allowed.size());
+        Set<String> cidrs = allowed.values().iterator().next();
+        // The member must be authorized as an exact host, matching the IPv4 /32 behaviour.
+        Assert.assertTrue("IPv4 member should be pinned to /32", cidrs.contains("10.1.1.5/32"));
+        Assert.assertTrue("IPv6 member should be pinned to the exact /128 host", cidrs.contains("2001:db8::5/128"));
+        Assert.assertFalse("IPv6 member must not open the whole /64 subnet", cidrs.contains("2001:db8::5/64"));
+    }
+}

From e6cd12392577a90e801a44d7823f34737e40574f Mon Sep 17 00:00:00 2001
From: Wido den Hollander <wido@widodh.nl>
Date: Wed, 7 Oct 2026 13:08:27 +0200
Subject: [PATCH 23/41] virtual router: Add route-maps to BGP peers for Routed
 Mode (#9964)

* virtual router: Add route-maps to BGP peers for Routed Mode

It is best practice, and mandatory in newer version of FRR, that route-maps
should be applied to BGP peers. This is to prevent that mistakes can propogate
through a network and cause outages.

This change changes the route-maps where the VR will only accept IPv4 and IPv4
default gateways (0.0.0.0/0 and ::/0) to be sent by the upstream router to the VR.

The other way around this change makes sure that FRR will not allow announcing anything
else than the locally defined subnets to the upstream BGP router.

* systemvm: ignore comment lines in BGP peer test configuration

- Filter comment lines (starting with #) when comparing generated vs expected FRR config
- Apply filtering to both generated config and expected config file
- Allows keeping license headers in test fixtures while ignoring them in tests
- All 11 BGP peer tests pass
---
 pom.xml                                       |   1 +
 .../debian/opt/cloud/bin/cs/CsBgpPeers.py     |  54 ++++-
 systemvm/test/TestCsBgpPeers.py               | 208 ++++++++++++++++++
 systemvm/test/frr-bgppeers-ipv4-ipv6.conf     |  61 +++++
 4 files changed, 323 insertions(+), 1 deletion(-)
 create mode 100644 systemvm/test/TestCsBgpPeers.py
 create mode 100644 systemvm/test/frr-bgppeers-ipv4-ipv6.conf

diff --git a/pom.xml b/pom.xml
index 56d209aba196..80111b26a4ab 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1095,6 +1095,7 @@
                             <exclude>systemvm/agent/noVNC/**</exclude>
                             <exclude>systemvm/agent/packages/**</exclude>
                             <exclude>systemvm/debian/**</exclude>
+                            <exclude>systemvm/test/frr-bgppeers-ipv4-ipv6.conf</exclude>
                             <exclude>test/integration/component/test_host_ha.sh</exclude>
                             <exclude>tools/appliance/*/template.json</exclude>
                             <exclude>tools/cli/cloudmonkey.egg-info/*</exclude>
diff --git a/systemvm/debian/opt/cloud/bin/cs/CsBgpPeers.py b/systemvm/debian/opt/cloud/bin/cs/CsBgpPeers.py
index 137279b74a9e..38d85f4626fc 100755
--- a/systemvm/debian/opt/cloud/bin/cs/CsBgpPeers.py
+++ b/systemvm/debian/opt/cloud/bin/cs/CsBgpPeers.py
@@ -54,7 +54,9 @@ def process(self):
         self.frr_conf = CsFile(FRR_CONFIG)
         self.frr_conf.repopulate()
         self._pre_set()
+        self._access_list_set()
         self._process_peers()
+        self._route_map_set()
         self._post_set()
         if self.frr_conf.commit():
             restart_frr = True
@@ -75,11 +77,31 @@ def _process_dbag_item(self, item):
             self.peers[as_number]['ip6_peers'].append(item)
 
     def _pre_set(self):
-        self.frr_conf.add("frr version 6.0")
         self.frr_conf.add("frr defaults traditional")
         self.frr_conf.add("hostname {}".format(CsHelper.get_hostname()))
         self.frr_conf.add("service integrated-vtysh-config")
         self.frr_conf.add("ip nht resolve-via-default")
+        self.frr_conf.add("ipv6 nht resolve-via-default")
+        return
+
+    def _access_list_set(self):
+        self.frr_conf.add("ip prefix-list all-v4 seq 1 permit any")
+        self.frr_conf.add("ip prefix-list default-v4 seq 1 permit 0.0.0.0/0")
+        self.frr_conf.add("ipv6 prefix-list all-v6 seq 1 permit any")
+        self.frr_conf.add("ipv6 prefix-list default-v6 seq 1 permit ::/0")
+
+        ip4_cidrs = set()
+        ip6_cidrs = set()
+        for as_number in self.peers.keys():
+            ip4_cidrs.update(ip4_peer['guest_ip4_cidr'] for ip4_peer in self.peers[as_number]['ip4_peers'])
+            ip6_cidrs.update(ip6_peer['guest_ip6_cidr'] for ip6_peer in self.peers[as_number]['ip6_peers'])
+
+        for seq, ip4_cidr in enumerate(sorted(ip4_cidrs), start=1):
+            self.frr_conf.add("ip prefix-list local-v4 seq {} permit {}".format(seq, ip4_cidr))
+
+        for seq, ip6_cidr in enumerate(sorted(ip6_cidrs), start=1):
+            self.frr_conf.add("ipv6 prefix-list local-v6 seq {} permit {}".format(seq, ip6_cidr))
+
         return
 
     def _process_peers(self):
@@ -104,16 +126,46 @@ def _process_peers(self):
                         self.frr_conf.add(" neighbor {} ebgp-multihop {}".format(ip6_peer['ip6_address'], ip6_peer['details']['EBGP_MultiHop']))
             if self.peers[as_number]['ip4_peers']:
                 self.frr_conf.add(" address-family ipv4 unicast")
+                for ip4_peer in self.peers[as_number]['ip4_peers']:
+                    self.frr_conf.add("  neighbor {} route-map upstream-v4-in in".format(ip4_peer['ip4_address']))
+                    self.frr_conf.add("  neighbor {} route-map upstream-v4-out out".format(ip4_peer['ip4_address']))
+                    self.frr_conf.add("  neighbor {} soft-reconfiguration inbound".format(ip4_peer['ip4_address']))
                 ip4_cidrs = set({ip4_peer['guest_ip4_cidr'] for ip4_peer in self.peers[as_number]['ip4_peers']})
                 for ip4_cidr in ip4_cidrs:
                     self.frr_conf.add("  network {}".format(ip4_cidr))
                 self.frr_conf.add(" exit-address-family")
             if self.peers[as_number]['ip6_peers']:
                 self.frr_conf.add(" address-family ipv6 unicast")
+                for ip6_peer in self.peers[as_number]['ip6_peers']:
+                    self.frr_conf.add("  neighbor {} route-map upstream-v6-in in".format(ip6_peer['ip6_address']))
+                    self.frr_conf.add("  neighbor {} route-map upstream-v6-out out".format(ip6_peer['ip6_address']))
+                    self.frr_conf.add("  neighbor {} soft-reconfiguration inbound".format(ip6_peer['ip6_address']))
                 ip6_cidrs = set({ip6_peer['guest_ip6_cidr'] for ip6_peer in self.peers[as_number]['ip6_peers']})
                 for ip6_cidr in ip6_cidrs:
                     self.frr_conf.add("  network {}".format(ip6_cidr))
                 self.frr_conf.add(" exit-address-family")
 
+    def _route_map_set(self):
+        self.frr_conf.add("route-map upstream-v4-in permit 10")
+        self.frr_conf.add("  match ip address prefix-list default-v4")
+        self.frr_conf.add("route-map upstream-v4-in deny 1000")
+        self.frr_conf.add("  match ip address prefix-list all-v4")
+
+        self.frr_conf.add("route-map upstream-v4-out permit 10")
+        self.frr_conf.add("  match ip address prefix-list local-v4")
+        self.frr_conf.add("route-map upstream-v4-out deny 1000")
+        self.frr_conf.add("  match ip address prefix-list all-v4")
+
+        self.frr_conf.add("route-map upstream-v6-in permit 10")
+        self.frr_conf.add("  match ipv6 address prefix-list default-v6")
+        self.frr_conf.add("route-map upstream-v6-in deny 1000")
+        self.frr_conf.add("  match ipv6 address prefix-list all-v6")
+
+        self.frr_conf.add("route-map upstream-v6-out permit 10")
+        self.frr_conf.add("  match ipv6 address prefix-list local-v6")
+        self.frr_conf.add("route-map upstream-v6-out deny 1000")
+        self.frr_conf.add("  match ipv6 address prefix-list all-v6")
+        return
+
     def _post_set(self):
         self.frr_conf.add("line vty")
diff --git a/systemvm/test/TestCsBgpPeers.py b/systemvm/test/TestCsBgpPeers.py
new file mode 100644
index 000000000000..f6de192976e4
--- /dev/null
+++ b/systemvm/test/TestCsBgpPeers.py
@@ -0,0 +1,208 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+import os
+import unittest
+try:
+    import mock
+except ImportError:
+    from unittest import mock
+from cs.CsBgpPeers import CsBgpPeers
+from cs.CsFile import CsFile
+import merge
+
+
+class TestCsBgpPeers(unittest.TestCase):
+
+    def setUp(self):
+        merge.DataBag.DPATH = "."
+        self.csbgppeers = CsBgpPeers("bgppeers", {})
+        self.csbgppeers.peers = {}
+        self.csbgppeers.public_ip = "100.64.0.10"
+        self.csbgppeers.frr_conf = CsFile("frr.conf.test")
+        self.csbgppeers.frr_conf.repopulate()
+
+    def _peer(self, **kwargs):
+        peer = {
+            'peer_id': 1,
+            'network_id': 100,
+            'network_as_number': 64512,
+            'peer_as_number': 64496
+        }
+        peer.update(kwargs)
+        return peer
+
+    def _frr_conf(self):
+        return [line.rstrip('\n') for line in self.csbgppeers.frr_conf.new_config if not line.strip().startswith("#")]
+
+    def test_init(self):
+        self.assertTrue(self.csbgppeers is not None)
+
+    def test_process_dbag_item(self):
+        self.csbgppeers._process_dbag_item(self._peer(ip4_address='100.64.0.1',
+                                                      guest_ip4_cidr='10.1.1.0/24'))
+        self.csbgppeers._process_dbag_item(self._peer(ip6_address='2001:db8::1',
+                                                      guest_ip6_cidr='2001:db8:100::/64'))
+        self.csbgppeers._process_dbag_item(self._peer(network_as_number=64513,
+                                                      ip4_address='100.64.1.1',
+                                                      guest_ip4_cidr='10.2.1.0/24'))
+
+        self.assertEqual(sorted(self.csbgppeers.peers.keys()), [64512, 64513])
+        self.assertEqual(len(self.csbgppeers.peers[64512]['ip4_peers']), 1)
+        self.assertEqual(len(self.csbgppeers.peers[64512]['ip6_peers']), 1)
+        self.assertEqual(len(self.csbgppeers.peers[64513]['ip4_peers']), 1)
+        self.assertEqual(len(self.csbgppeers.peers[64513]['ip6_peers']), 0)
+
+    def test_process_dbag_item_dual_stack(self):
+        self.csbgppeers._process_dbag_item(self._peer(ip4_address='100.64.0.1',
+                                                      guest_ip4_cidr='10.1.1.0/24',
+                                                      ip6_address='2001:db8::1',
+                                                      guest_ip6_cidr='2001:db8:100::/64'))
+
+        self.assertEqual(len(self.csbgppeers.peers[64512]['ip4_peers']), 1)
+        self.assertEqual(len(self.csbgppeers.peers[64512]['ip6_peers']), 1)
+
+    def test_access_list_set(self):
+        self.csbgppeers._process_dbag_item(self._peer(ip4_address='100.64.0.1',
+                                                      guest_ip4_cidr='10.1.1.0/24',
+                                                      ip6_address='2001:db8::1',
+                                                      guest_ip6_cidr='2001:db8:100::/64'))
+        self.csbgppeers._access_list_set()
+
+        config = self._frr_conf()
+        self.assertIn("ip prefix-list all-v4 seq 1 permit any", config)
+        self.assertIn("ip prefix-list default-v4 seq 1 permit 0.0.0.0/0", config)
+        self.assertIn("ipv6 prefix-list all-v6 seq 1 permit any", config)
+        self.assertIn("ipv6 prefix-list default-v6 seq 1 permit ::/0", config)
+        self.assertIn("ip prefix-list local-v4 seq 1 permit 10.1.1.0/24", config)
+        self.assertIn("ipv6 prefix-list local-v6 seq 1 permit 2001:db8:100::/64", config)
+
+    def test_access_list_set_deduplicates_cidrs(self):
+        # Two peers announcing the same guest CIDR should only result in a single prefix-list entry
+        self.csbgppeers._process_dbag_item(self._peer(ip4_address='100.64.0.1',
+                                                      guest_ip4_cidr='10.1.1.0/24'))
+        self.csbgppeers._process_dbag_item(self._peer(peer_id=2,
+                                                      ip4_address='100.64.0.2',
+                                                      guest_ip4_cidr='10.1.1.0/24'))
+        self.csbgppeers._access_list_set()
+
+        config = self._frr_conf()
+        local_v4 = [line for line in config if line.startswith("ip prefix-list local-v4")]
+        self.assertEqual(local_v4, ["ip prefix-list local-v4 seq 1 permit 10.1.1.0/24"])
+
+    def test_access_list_set_multiple_as_numbers(self):
+        # Sequence numbers may not collide when there are peers for multiple AS numbers,
+        # otherwise entries overwrite each other in the shared local-v4/local-v6 prefix-lists
+        self.csbgppeers._process_dbag_item(self._peer(ip4_address='100.64.0.1',
+                                                      guest_ip4_cidr='10.1.1.0/24'))
+        self.csbgppeers._process_dbag_item(self._peer(peer_id=2,
+                                                      network_as_number=64513,
+                                                      ip4_address='100.64.1.1',
+                                                      guest_ip4_cidr='10.2.1.0/24'))
+        self.csbgppeers._access_list_set()
+
+        config = self._frr_conf()
+        local_v4 = [line for line in config if line.startswith("ip prefix-list local-v4")]
+        self.assertEqual(local_v4, ["ip prefix-list local-v4 seq 1 permit 10.1.1.0/24",
+                                    "ip prefix-list local-v4 seq 2 permit 10.2.1.0/24"])
+
+    def test_process_peers_ip4(self):
+        self.csbgppeers._process_dbag_item(self._peer(ip4_address='100.64.0.1',
+                                                      guest_ip4_cidr='10.1.1.0/24'))
+        self.csbgppeers._process_peers()
+
+        config = self._frr_conf()
+        self.assertIn("router bgp 64512", config)
+        self.assertIn(" bgp router-id 100.64.0.10", config)
+        self.assertIn(" neighbor 100.64.0.1 remote-as 64496", config)
+        self.assertIn("  neighbor 100.64.0.1 route-map upstream-v4-in in", config)
+        self.assertIn("  neighbor 100.64.0.1 route-map upstream-v4-out out", config)
+        self.assertIn("  neighbor 100.64.0.1 soft-reconfiguration inbound", config)
+        self.assertIn("  network 10.1.1.0/24", config)
+        self.assertNotIn(" bgp default ipv6-unicast", config)
+        self.assertNotIn(" neighbor 100.64.0.1 route-map upstream-v4-in in", config)
+        self.assertNotIn(" neighbor 100.64.0.1 route-map upstream-v4-out out", config)
+
+    def test_process_peers_ip6(self):
+        self.csbgppeers._process_dbag_item(self._peer(ip6_address='2001:db8::1',
+                                                      guest_ip6_cidr='2001:db8:100::/64'))
+        self.csbgppeers._process_peers()
+
+        config = self._frr_conf()
+        self.assertIn(" bgp default ipv6-unicast", config)
+        self.assertIn(" neighbor 2001:db8::1 remote-as 64496", config)
+        self.assertIn("  neighbor 2001:db8::1 route-map upstream-v6-in in", config)
+        self.assertIn("  neighbor 2001:db8::1 route-map upstream-v6-out out", config)
+        self.assertIn("  neighbor 2001:db8::1 soft-reconfiguration inbound", config)
+        self.assertIn("  network 2001:db8:100::/64", config)
+        self.assertNotIn(" neighbor 2001:db8::1 route-map upstream-v6-in in", config)
+        self.assertNotIn(" neighbor 2001:db8::1 route-map upstream-v6-out out", config)
+
+    def test_process_peers_password_and_multihop(self):
+        self.csbgppeers._process_dbag_item(self._peer(ip4_address='100.64.0.1',
+                                                      guest_ip4_cidr='10.1.1.0/24',
+                                                      peer_password='S3cr3t!',
+                                                      details={'EBGP_MultiHop': 2}))
+        self.csbgppeers._process_peers()
+
+        config = self._frr_conf()
+        self.assertIn(" neighbor 100.64.0.1 password S3cr3t!", config)
+        self.assertIn(" neighbor 100.64.0.1 ebgp-multihop 2", config)
+
+    def test_route_map_set(self):
+        self.csbgppeers._route_map_set()
+
+        expected = [
+            "route-map upstream-v4-in permit 10",
+            "  match ip address prefix-list default-v4",
+            "route-map upstream-v4-in deny 1000",
+            "  match ip address prefix-list all-v4",
+            "route-map upstream-v4-out permit 10",
+            "  match ip address prefix-list local-v4",
+            "route-map upstream-v4-out deny 1000",
+            "  match ip address prefix-list all-v4",
+            "route-map upstream-v6-in permit 10",
+            "  match ipv6 address prefix-list default-v6",
+            "route-map upstream-v6-in deny 1000",
+            "  match ipv6 address prefix-list all-v6",
+            "route-map upstream-v6-out permit 10",
+            "  match ipv6 address prefix-list local-v6",
+            "route-map upstream-v6-out deny 1000",
+            "  match ipv6 address prefix-list all-v6"
+        ]
+        self.assertEqual(self._frr_conf(), expected)
+
+    @mock.patch('cs.CsBgpPeers.CsHelper.get_hostname')
+    def test_full_frr_conf(self, mock_hostname):
+        mock_hostname.return_value = "r-1001-VM"
+        self.csbgppeers._process_dbag_item(self._peer(ip4_address='100.64.0.1',
+                                                      guest_ip4_cidr='10.1.1.0/24',
+                                                      ip6_address='2001:db8::1',
+                                                      guest_ip6_cidr='2001:db8:100::/64'))
+        self.csbgppeers._pre_set()
+        self.csbgppeers._access_list_set()
+        self.csbgppeers._process_peers()
+        self.csbgppeers._route_map_set()
+        self.csbgppeers._post_set()
+
+        with open(os.path.join(os.path.dirname(os.path.abspath(__file__)), "frr-bgppeers-ipv4-ipv6.conf")) as f:
+            expected = [line.rstrip('\n') for line in f if not line.strip().startswith("#")]
+        self.assertEqual(self._frr_conf(), expected)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/systemvm/test/frr-bgppeers-ipv4-ipv6.conf b/systemvm/test/frr-bgppeers-ipv4-ipv6.conf
new file mode 100644
index 000000000000..9881e1c87dc1
--- /dev/null
+++ b/systemvm/test/frr-bgppeers-ipv4-ipv6.conf
@@ -0,0 +1,61 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+frr defaults traditional
+hostname r-1001-VM
+service integrated-vtysh-config
+ip nht resolve-via-default
+ipv6 nht resolve-via-default
+ip prefix-list all-v4 seq 1 permit any
+ip prefix-list default-v4 seq 1 permit 0.0.0.0/0
+ipv6 prefix-list all-v6 seq 1 permit any
+ipv6 prefix-list default-v6 seq 1 permit ::/0
+ip prefix-list local-v4 seq 1 permit 10.1.1.0/24
+ipv6 prefix-list local-v6 seq 1 permit 2001:db8:100::/64
+router bgp 64512
+ bgp router-id 100.64.0.10
+ bgp default ipv6-unicast
+ neighbor 100.64.0.1 remote-as 64496
+ neighbor 2001:db8::1 remote-as 64496
+ address-family ipv4 unicast
+  neighbor 100.64.0.1 route-map upstream-v4-in in
+  neighbor 100.64.0.1 route-map upstream-v4-out out
+  neighbor 100.64.0.1 soft-reconfiguration inbound
+  network 10.1.1.0/24
+ exit-address-family
+ address-family ipv6 unicast
+  neighbor 2001:db8::1 route-map upstream-v6-in in
+  neighbor 2001:db8::1 route-map upstream-v6-out out
+  neighbor 2001:db8::1 soft-reconfiguration inbound
+  network 2001:db8:100::/64
+ exit-address-family
+route-map upstream-v4-in permit 10
+  match ip address prefix-list default-v4
+route-map upstream-v4-in deny 1000
+  match ip address prefix-list all-v4
+route-map upstream-v4-out permit 10
+  match ip address prefix-list local-v4
+route-map upstream-v4-out deny 1000
+  match ip address prefix-list all-v4
+route-map upstream-v6-in permit 10
+  match ipv6 address prefix-list default-v6
+route-map upstream-v6-in deny 1000
+  match ipv6 address prefix-list all-v6
+route-map upstream-v6-out permit 10
+  match ipv6 address prefix-list local-v6
+route-map upstream-v6-out deny 1000
+  match ipv6 address prefix-list all-v6
+line vty

From ed1db53815cf243eb87c10d2f135e1f10895f282 Mon Sep 17 00:00:00 2001
From: John Bampton <jbampton@users.noreply.github.com>
Date: Wed, 7 Oct 2026 21:17:31 +1000
Subject: [PATCH 24/41] .github: Upgrade docker/login-action to fix ASF
 Allowlist failure (#14276)

---
 .github/workflows/docker-cloudstack-simulator.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/docker-cloudstack-simulator.yml b/.github/workflows/docker-cloudstack-simulator.yml
index 64b17fca8cca..361f2659c7f1 100644
--- a/.github/workflows/docker-cloudstack-simulator.yml
+++ b/.github/workflows/docker-cloudstack-simulator.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Login to Docker Registry
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ${{ secrets.DOCKER_REGISTRY }}
           username: ${{ secrets.DOCKERHUB_USER }}

From 437adc81dec08b2fbb6a57461126db56d1a20059 Mon Sep 17 00:00:00 2001
From: Syed Talha Ahmed Gardazi <74587660+stag7824@users.noreply.github.com>
Date: Thu, 8 Oct 2026 08:33:04 +0200
Subject: [PATCH 25/41] ui: add the missing label for the backup resource limit
 (#14163)

The Resource Limits tab derives each label from the resource type name
returned by listResourceLimits:

    $t('label.max' + item.resourcetypename.replace('_', ''))

Resource.ResourceType declares backup("backup", 12), so the key looked up
for that row is label.maxbackup, which exists in no locale. en.json has
label.maxbackups, a different string used by the backup schedule form for
how many backups to retain, and label.maxbackupstorage, which is resource
type 13. With fallbackLocale 'en' and silentTranslationWarn enabled, the
miss is silent and vue-i18n renders the key itself, so the row reads
"label.maxbackup".

The same key is used for the tagged-limit validation message, which shows
the raw key for the same reason.

Backup was the only one of the 17 ResourceType values without a label; the
other 16 already resolve.
---
 ui/public/locales/en.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index bf27ec0bb437..382eb785db0a 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -1540,6 +1540,7 @@
 "label.max.primary.storage": "Max. primary (GiB)",
 "label.max.secondary.storage": "Max. secondary (GiB)",
 "label.max.migrations": "Max. migrations",
+"label.maxbackup": "Max. Backups",
 "label.maxbackups": "Max. Backups",
 "label.maxbackupstorage": "Max. Backup Storage (GiB)",
 "label.maxbackups.to.retain": "Max. Backups to retain",

From 17294cac7a6357b8c2c9c8183eee023920e2617a Mon Sep 17 00:00:00 2001
From: Manoj Kumar <manojkr.itbhu@gmail.com>
Date: Thu, 8 Oct 2026 16:23:46 +0530
Subject: [PATCH 26/41] dont show unathorized notification for prelogin
 (#14054)

---
 ui/src/utils/request.js | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/ui/src/utils/request.js b/ui/src/utils/request.js
index 2317aac04465..f76a9e8884e2 100644
--- a/ui/src/utils/request.js
+++ b/ui/src/utils/request.js
@@ -51,7 +51,9 @@ const err = (error) => {
       })
     }
     if (response.status === 401) {
-      if (response.config && response.config.params && ['forgotPassword', 'listIdps', 'cloudianIsEnabled'].includes(response.config.params.command)) {
+      const requestCommand = (response.config && response.config.params && response.config.params.command) ||
+        (response.config && typeof response.config.data === 'string' && new URLSearchParams(response.config.data).get('command'))
+      if (['forgotPassword', 'listIdps', 'cloudianIsEnabled'].includes(requestCommand)) {
         return
       }
       const originalPath = router.currentRoute.value.path
@@ -75,9 +77,9 @@ const err = (error) => {
           }
         }
       }
-      countNotify++
-      store.commit('SET_COUNT_NOTIFY', countNotify)
       if (originalPath === '/verify2FA' || originalPath === '/setup2FA') {
+        countNotify++
+        store.commit('SET_COUNT_NOTIFY', countNotify)
         notification.error({
           top: '65px',
           message: i18n.global.t('label.2FA'),
@@ -90,7 +92,9 @@ const err = (error) => {
             store.commit('SET_COUNT_NOTIFY', countNotify)
           }
         })
-      } else {
+      } else if (originalPath !== '/user/login') {
+        countNotify++
+        store.commit('SET_COUNT_NOTIFY', countNotify)
         notification.error({
           top: '65px',
           message: i18n.global.t('label.unauthorized'),

From f03cffc19e6e055754b1a05e3359c4c75fa6854e Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Thu, 8 Oct 2026 22:12:25 +0530
Subject: [PATCH 27/41] feature: instance boot group and readiness rules
 (#13907)

* feature: instance boot group and readiness rules

Feature to add the concept of instance boot group and readiness rules.
Design spec: https://cwiki.apache.org/confluence/spaces/CLOUDSTACK/pages/449282465/Instance+Boot+Group+and+Readiness+Rules

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* address review comments

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix ui build

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fixes

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix vm action warning

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* minor label fixes

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* add tests

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fixes, address comments

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* remove unused logs

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fixes

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fixes and more tests

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* force stop option and smoke test

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* minor config description

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* address comments

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* address comments; consistent API description

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix failing test

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* address missed Copilot review

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* engine-schema: upgrade path for 4.24.0

Adds a 4.23.0 to 4.24.0 upgrade path.

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* move schema changes to 4.24, update order column name

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* remove unused rule type from presentation

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* test: fix testRestoreVirtualMachineWhenHostRemoved failure

Build was failing with,
18:53:06 [ERROR] Errors:
18:53:06 [ERROR]   UserVmManagerImplTest.testRestoreVirtualMachineWhenHostRemoved:1886 ? NullPointer

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix imports

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* add since version for api commands

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fixes around members and ui

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix ui issue on updating readiness rule

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix wrong reporting of the attempt count

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* address copilot review

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* prevent instancegroup vms delete/remove only for one with rules

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

---------

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
Co-authored-by: dahn <daan@onecht.net>
---
 .../main/java/com/cloud/event/EventTypes.java |   30 +
 .../api/ApiCommandResourceType.java           |    5 +-
 .../apache/cloudstack/api/ApiConstants.java   |   18 +
 .../AddMemberToInstanceBootGroupCmd.java      |  107 ++
 .../bootgroup/CreateInstanceBootGroupCmd.java |  142 ++
 ...eateInstanceBootGroupReadinessRuleCmd.java |  132 ++
 .../bootgroup/DeleteInstanceBootGroupCmd.java |   81 +
 ...leteInstanceBootGroupReadinessRuleCmd.java |   82 ++
 .../ListInstanceBootGroupMembersCmd.java      |   96 ++
 ...istInstanceBootGroupReadinessRulesCmd.java |   91 ++
 .../bootgroup/ListInstanceBootGroupsCmd.java  |   83 ++
 .../bootgroup/RebootInstanceBootGroupCmd.java |  107 ++
 .../RemoveInstanceBootGroupMemberCmd.java     |   81 +
 .../bootgroup/StartInstanceBootGroupCmd.java  |   99 ++
 .../bootgroup/StopInstanceBootGroupCmd.java   |  101 ++
 .../bootgroup/UpdateInstanceBootGroupCmd.java |  127 ++
 .../UpdateInstanceBootGroupMemberCmd.java     |   88 ++
 ...dateInstanceBootGroupReadinessRuleCmd.java |  110 ++
 .../InstanceBootGroupMemberChildResponse.java |   57 +
 .../InstanceBootGroupMemberResponse.java      |  131 ++
 ...nstanceBootGroupReadinessRuleResponse.java |  148 ++
 .../response/InstanceBootGroupResponse.java   |  160 ++
 .../vm/bootgroup/InstanceBootGroup.java       |   33 +
 .../vm/bootgroup/InstanceBootGroupMember.java |   44 +
 .../bootgroup/InstanceBootGroupService.java   |   81 +
 .../InstanceBootGroupReadinessRule.java       |   81 +
 .../bootgroup/readiness/ReadinessChecker.java |   93 ++
 .../AddMemberToInstanceBootGroupCmdTest.java  |   95 ++
 .../user/bootgroup/BaseBootGroupCmdTest.java  |   88 ++
 .../CreateInstanceBootGroupCmdTest.java       |  107 ++
 ...InstanceBootGroupReadinessRuleCmdTest.java |  158 ++
 .../DeleteInstanceBootGroupCmdTest.java       |   83 ++
 ...InstanceBootGroupReadinessRuleCmdTest.java |   83 ++
 .../ListInstanceBootGroupMembersCmdTest.java  |  143 ++
 ...nstanceBootGroupReadinessRulesCmdTest.java |   65 +
 .../ListInstanceBootGroupsCmdTest.java        |   62 +
 .../RebootInstanceBootGroupCmdTest.java       |  118 ++
 .../RemoveInstanceBootGroupMemberCmdTest.java |   85 ++
 .../StartInstanceBootGroupCmdTest.java        |  118 ++
 .../StopInstanceBootGroupCmdTest.java         |  110 ++
 .../UpdateInstanceBootGroupCmdTest.java       |  104 ++
 .../UpdateInstanceBootGroupMemberCmdTest.java |   95 ++
 ...InstanceBootGroupReadinessRuleCmdTest.java |  139 ++
 .../api/CheckGuestAgentLivenessAnswer.java    |   35 +
 .../api/CheckGuestAgentLivenessCommand.java   |   42 +
 .../resource/virtualnetwork/VRScripts.java    |    1 +
 .../VirtualRoutingResource.java               |   13 +
 .../InstanceReadinessCheckAnswer.java         |   57 +
 .../InstanceReadinessCheckCommand.java        |   73 +
 .../spring-core-registry-core-context.xml     |   15 +
 .../InstanceReadinessCheckExecutionTest.java  |  122 ++
 .../InstanceReadinessCheckAnswerTest.java     |  113 ++
 debian/changelog                              |    6 -
 .../cloud/vm/dao/InstanceBootGroupDao.java    |   30 +
 .../vm/dao/InstanceBootGroupDaoImpl.java      |   60 +
 .../vm/dao/InstanceBootGroupDetailsDao.java   |   28 +
 .../dao/InstanceBootGroupDetailsDaoImpl.java  |   71 +
 .../vm/dao/InstanceBootGroupMemberDao.java    |   44 +
 .../dao/InstanceBootGroupMemberDaoImpl.java   |  123 ++
 ...tanceBootGroupReadinessCheckResultDao.java |   41 +
 ...eBootGroupReadinessCheckResultDaoImpl.java |   74 +
 .../InstanceBootGroupReadinessRuleDao.java    |   44 +
 ...InstanceBootGroupReadinessRuleDaoImpl.java |  119 ++
 ...tanceBootGroupReadinessRuleDetailsDao.java |   32 +
 ...eBootGroupReadinessRuleDetailsDaoImpl.java |   69 +
 .../bootgroup/InstanceBootGroupDetailsVO.java |   93 ++
 .../bootgroup/InstanceBootGroupMemberVO.java  |  116 ++
 ...stanceBootGroupReadinessCheckResultVO.java |  113 ++
 ...stanceBootGroupReadinessRuleDetailsVO.java |   99 ++
 .../InstanceBootGroupReadinessRuleVO.java     |  149 ++
 .../vm/bootgroup/InstanceBootGroupVO.java     |  131 ++
 ...spring-engine-schema-core-daos-context.xml |    7 +
 .../META-INF/db/schema-42300to2400.sql        |   82 ++
 .../views/cloud.instance_boot_group_view.sql  |   47 +
 .../vm/dao/InstanceBootGroupDaoImplTest.java  |   99 ++
 .../InstanceBootGroupDetailsDaoImplTest.java  |  143 ++
 .../InstanceBootGroupMemberDaoImplTest.java   |  144 ++
 ...tGroupReadinessCheckResultDaoImplTest.java |  120 ++
 ...anceBootGroupReadinessRuleDaoImplTest.java |  147 ++
 ...tGroupReadinessRuleDetailsDaoImplTest.java |  116 ++
 ...CheckGuestAgentLivenessCommandWrapper.java |   99 ++
 .../cloudstack/utils/qemu/QemuCommand.java    |    1 +
 ...kGuestAgentLivenessCommandWrapperTest.java |  236 +++
 .../java/com/cloud/api/ApiResponseHelper.java |   17 +-
 .../java/com/cloud/vm/UserVmManagerImpl.java  |   10 +
 .../query/dao/InstanceBootGroupJoinDao.java   |   25 +
 .../dao/InstanceBootGroupJoinDaoImpl.java     |   25 +
 .../api/query/vo/InstanceBootGroupJoinVO.java |  190 +++
 .../InstanceBootGroupApiServiceImpl.java      |  939 ++++++++++++
 .../bootgroup/InstanceBootGroupManager.java   |   35 +
 .../InstanceBootGroupManagerImpl.java         |  619 ++++++++
 .../InstanceBootGroupMembershipGuard.java     |  185 +++
 .../InstanceBootGroupVmStateListener.java     |   66 +
 .../readiness/GuestAgentLivenessChecker.java  |  100 ++
 ...anceBootGroupReadinessRuleManagerImpl.java |  624 ++++++++
 ...InstanceBootGroupReadinessRuleService.java |   75 +
 .../bootgroup/readiness/PortCheckChecker.java |  168 +++
 .../vm/bootgroup/readiness/VrPingChecker.java |  149 ++
 .../spring-server-core-managers-context.xml   |   12 +
 .../com/cloud/vm/UserVmManagerImplTest.java   |   61 +
 .../InstanceBootGroupApiServiceImplTest.java  | 1304 +++++++++++++++++
 .../InstanceBootGroupManagerImplTest.java     |  819 +++++++++++
 .../InstanceBootGroupMembershipGuardTest.java |  301 ++++
 .../InstanceBootGroupVmStateListenerTest.java |  106 ++
 .../GuestAgentLivenessCheckerTest.java        |  163 +++
 ...BootGroupReadinessRuleManagerImplTest.java |  981 +++++++++++++
 .../readiness/PortCheckCheckerTest.java       |  245 ++++
 .../readiness/VrPingCheckerTest.java          |  244 +++
 .../opt/cloud/bin/instance_readiness_check.py |   71 +
 .../smoke/test_instance_boot_group.py         |  310 ++++
 tools/apidoc/gen_toc.py                       |    3 +-
 tools/marvin/marvin/lib/base.py               |  164 +++
 ui/public/config.json                         |  150 +-
 ui/public/locales/en.json                     |   53 +
 ui/src/components/view/ListView.vue           |    2 +-
 ui/src/config/section/compute.js              |   93 ++
 ui/src/core/lazy_lib/icons_use.js             |    4 +-
 .../compute/AddInstanceBootGroupMember.vue    |  174 +++
 .../compute/InstanceBootGroupMembersTab.vue   |  352 +++++
 .../InstanceBootGroupReadinessRulesModal.vue  |  413 ++++++
 .../UpdateInstanceBootGroupMemberOrder.vue    |  116 ++
 121 files changed, 16568 insertions(+), 15 deletions(-)
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/AddMemberToInstanceBootGroupCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/CreateInstanceBootGroupCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/CreateInstanceBootGroupReadinessRuleCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/DeleteInstanceBootGroupCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/DeleteInstanceBootGroupReadinessRuleCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupMembersCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupReadinessRulesCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupsCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/RebootInstanceBootGroupCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/RemoveInstanceBootGroupMemberCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/StartInstanceBootGroupCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/StopInstanceBootGroupCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupMemberCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupReadinessRuleCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/response/InstanceBootGroupMemberChildResponse.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/response/InstanceBootGroupMemberResponse.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/response/InstanceBootGroupReadinessRuleResponse.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/response/InstanceBootGroupResponse.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroup.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupMember.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupService.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceBootGroupReadinessRule.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/ReadinessChecker.java
 create mode 100644 api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/AddMemberToInstanceBootGroupCmdTest.java
 create mode 100644 api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/BaseBootGroupCmdTest.java
 create mode 100644 api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/CreateInstanceBootGroupCmdTest.java
 create mode 100644 api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/CreateInstanceBootGroupReadinessRuleCmdTest.java
 create mode 100644 api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/DeleteInstanceBootGroupCmdTest.java
 create mode 100644 api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/DeleteInstanceBootGroupReadinessRuleCmdTest.java
 create mode 100644 api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupMembersCmdTest.java
 create mode 100644 api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupReadinessRulesCmdTest.java
 create mode 100644 api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupsCmdTest.java
 create mode 100644 api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/RebootInstanceBootGroupCmdTest.java
 create mode 100644 api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/RemoveInstanceBootGroupMemberCmdTest.java
 create mode 100644 api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/StartInstanceBootGroupCmdTest.java
 create mode 100644 api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/StopInstanceBootGroupCmdTest.java
 create mode 100644 api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupCmdTest.java
 create mode 100644 api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupMemberCmdTest.java
 create mode 100644 api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupReadinessRuleCmdTest.java
 create mode 100644 core/src/main/java/com/cloud/agent/api/CheckGuestAgentLivenessAnswer.java
 create mode 100644 core/src/main/java/com/cloud/agent/api/CheckGuestAgentLivenessCommand.java
 create mode 100644 core/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceReadinessCheckAnswer.java
 create mode 100644 core/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceReadinessCheckCommand.java
 create mode 100644 core/src/test/java/com/cloud/agent/resource/virtualnetwork/InstanceReadinessCheckExecutionTest.java
 create mode 100644 core/src/test/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceReadinessCheckAnswerTest.java
 create mode 100644 engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupDao.java
 create mode 100644 engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupDaoImpl.java
 create mode 100644 engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupDetailsDao.java
 create mode 100644 engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupDetailsDaoImpl.java
 create mode 100644 engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupMemberDao.java
 create mode 100644 engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupMemberDaoImpl.java
 create mode 100644 engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessCheckResultDao.java
 create mode 100644 engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessCheckResultDaoImpl.java
 create mode 100644 engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDao.java
 create mode 100644 engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDaoImpl.java
 create mode 100644 engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDetailsDao.java
 create mode 100644 engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDetailsDaoImpl.java
 create mode 100644 engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupDetailsVO.java
 create mode 100644 engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupMemberVO.java
 create mode 100644 engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupReadinessCheckResultVO.java
 create mode 100644 engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupReadinessRuleDetailsVO.java
 create mode 100644 engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupReadinessRuleVO.java
 create mode 100644 engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupVO.java
 create mode 100644 engine/schema/src/main/resources/META-INF/db/views/cloud.instance_boot_group_view.sql
 create mode 100644 engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupDaoImplTest.java
 create mode 100644 engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupDetailsDaoImplTest.java
 create mode 100644 engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupMemberDaoImplTest.java
 create mode 100644 engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupReadinessCheckResultDaoImplTest.java
 create mode 100644 engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDaoImplTest.java
 create mode 100644 engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDetailsDaoImplTest.java
 create mode 100644 plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckGuestAgentLivenessCommandWrapper.java
 create mode 100644 plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckGuestAgentLivenessCommandWrapperTest.java
 create mode 100644 server/src/main/java/org/apache/cloudstack/api/query/dao/InstanceBootGroupJoinDao.java
 create mode 100644 server/src/main/java/org/apache/cloudstack/api/query/dao/InstanceBootGroupJoinDaoImpl.java
 create mode 100644 server/src/main/java/org/apache/cloudstack/api/query/vo/InstanceBootGroupJoinVO.java
 create mode 100644 server/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupApiServiceImpl.java
 create mode 100644 server/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupManager.java
 create mode 100644 server/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupManagerImpl.java
 create mode 100644 server/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupMembershipGuard.java
 create mode 100644 server/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupVmStateListener.java
 create mode 100644 server/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/GuestAgentLivenessChecker.java
 create mode 100644 server/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceBootGroupReadinessRuleManagerImpl.java
 create mode 100644 server/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceBootGroupReadinessRuleService.java
 create mode 100644 server/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/PortCheckChecker.java
 create mode 100644 server/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/VrPingChecker.java
 create mode 100644 server/src/test/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupApiServiceImplTest.java
 create mode 100644 server/src/test/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupManagerImplTest.java
 create mode 100644 server/src/test/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupMembershipGuardTest.java
 create mode 100644 server/src/test/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupVmStateListenerTest.java
 create mode 100644 server/src/test/java/org/apache/cloudstack/vm/bootgroup/readiness/GuestAgentLivenessCheckerTest.java
 create mode 100644 server/src/test/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceBootGroupReadinessRuleManagerImplTest.java
 create mode 100644 server/src/test/java/org/apache/cloudstack/vm/bootgroup/readiness/PortCheckCheckerTest.java
 create mode 100644 server/src/test/java/org/apache/cloudstack/vm/bootgroup/readiness/VrPingCheckerTest.java
 create mode 100644 systemvm/debian/opt/cloud/bin/instance_readiness_check.py
 create mode 100644 test/integration/smoke/test_instance_boot_group.py
 create mode 100644 ui/src/views/compute/AddInstanceBootGroupMember.vue
 create mode 100644 ui/src/views/compute/InstanceBootGroupMembersTab.vue
 create mode 100644 ui/src/views/compute/InstanceBootGroupReadinessRulesModal.vue
 create mode 100644 ui/src/views/compute/UpdateInstanceBootGroupMemberOrder.vue

diff --git a/api/src/main/java/com/cloud/event/EventTypes.java b/api/src/main/java/com/cloud/event/EventTypes.java
index f7d13343d469..6dc9be25dbd1 100644
--- a/api/src/main/java/com/cloud/event/EventTypes.java
+++ b/api/src/main/java/com/cloud/event/EventTypes.java
@@ -49,6 +49,8 @@
 import org.apache.cloudstack.storage.sharedfs.SharedFS;
 import org.apache.cloudstack.usage.Usage;
 import org.apache.cloudstack.schedule.ResourceSchedule;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroup;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
 
 import com.cloud.dc.DataCenter;
 import com.cloud.dc.DataCenterGuestIpv6Prefix;
@@ -899,6 +901,21 @@ public class EventTypes {
     public static final String EVENT_DNS_RECORD_DELETE = "DNS.RECORD.DELETE";
     public static final String EVENT_DNS_NAME_COLLISION = "DNS.NAME.COLLISION";
 
+    // Instance Boot Group
+    public static final String EVENT_INSTANCE_BOOT_GROUP_CREATE = "INSTANCE.BOOT.GROUP.CREATE";
+    public static final String EVENT_INSTANCE_BOOT_GROUP_DELETE = "INSTANCE.BOOT.GROUP.DELETE";
+    public static final String EVENT_INSTANCE_BOOT_GROUP_UPDATE = "INSTANCE.BOOT.GROUP.UPDATE";
+    public static final String EVENT_INSTANCE_BOOT_GROUP_START = "INSTANCE.BOOT.GROUP.START";
+    public static final String EVENT_INSTANCE_BOOT_GROUP_STOP = "INSTANCE.BOOT.GROUP.STOP";
+    public static final String EVENT_INSTANCE_BOOT_GROUP_REBOOT = "INSTANCE.BOOT.GROUP.REBOOT";
+    public static final String EVENT_INSTANCE_BOOT_GROUP_MEMBER_ADD = "INSTANCE.BOOT.GROUP.MEMBER.ADD";
+    public static final String EVENT_INSTANCE_BOOT_GROUP_MEMBER_REMOVE = "INSTANCE.BOOT.GROUP.MEMBER.REMOVE";
+    public static final String EVENT_INSTANCE_BOOT_GROUP_MEMBER_REORDER = "INSTANCE.BOOT.GROUP.MEMBER.REORDER";
+    public static final String EVENT_INSTANCE_BOOT_GROUP_READINESS_RULE_CREATE = "INSTANCE.BOOT.GROUP.READINESS.RULE.CREATE";
+    public static final String EVENT_INSTANCE_BOOT_GROUP_READINESS_RULE_UPDATE = "INSTANCE.BOOT.GROUP.READINESS.RULE.UPDATE";
+    public static final String EVENT_INSTANCE_BOOT_GROUP_READINESS_RULE_DELETE = "INSTANCE.BOOT.GROUP.READINESS.RULE.DELETE";
+
+
     static {
 
         // TODO: need a way to force author adding event types to declare the entity details as well, with out braking
@@ -1468,6 +1485,19 @@ public class EventTypes {
         entityEventDetails.put(EVENT_DNS_RECORD_CREATE, DnsRecord.class);
         entityEventDetails.put(EVENT_DNS_RECORD_DELETE, DnsRecord.class);
 
+        // Instance Boot Group
+        entityEventDetails.put(EVENT_INSTANCE_BOOT_GROUP_CREATE, InstanceBootGroup.class);
+        entityEventDetails.put(EVENT_INSTANCE_BOOT_GROUP_DELETE, InstanceBootGroup.class);
+        entityEventDetails.put(EVENT_INSTANCE_BOOT_GROUP_UPDATE, InstanceBootGroup.class);
+        entityEventDetails.put(EVENT_INSTANCE_BOOT_GROUP_START, InstanceBootGroup.class);
+        entityEventDetails.put(EVENT_INSTANCE_BOOT_GROUP_STOP, InstanceBootGroup.class);
+        entityEventDetails.put(EVENT_INSTANCE_BOOT_GROUP_REBOOT, InstanceBootGroup.class);
+        entityEventDetails.put(EVENT_INSTANCE_BOOT_GROUP_MEMBER_ADD, InstanceBootGroup.class);
+        entityEventDetails.put(EVENT_INSTANCE_BOOT_GROUP_MEMBER_REMOVE, InstanceBootGroup.class);
+        entityEventDetails.put(EVENT_INSTANCE_BOOT_GROUP_MEMBER_REORDER, InstanceBootGroup.class);
+        entityEventDetails.put(EVENT_INSTANCE_BOOT_GROUP_READINESS_RULE_CREATE, InstanceBootGroupReadinessRule.class);
+        entityEventDetails.put(EVENT_INSTANCE_BOOT_GROUP_READINESS_RULE_UPDATE, InstanceBootGroupReadinessRule.class);
+        entityEventDetails.put(EVENT_INSTANCE_BOOT_GROUP_READINESS_RULE_DELETE, InstanceBootGroupReadinessRule.class);
     }
 
     public static boolean isNetworkEvent(String eventType) {
diff --git a/api/src/main/java/org/apache/cloudstack/api/ApiCommandResourceType.java b/api/src/main/java/org/apache/cloudstack/api/ApiCommandResourceType.java
index 2aa97b65a3d5..e12a709e6f5c 100644
--- a/api/src/main/java/org/apache/cloudstack/api/ApiCommandResourceType.java
+++ b/api/src/main/java/org/apache/cloudstack/api/ApiCommandResourceType.java
@@ -22,6 +22,7 @@
 import java.util.Map;
 
 import org.apache.cloudstack.region.PortableIp;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
 import org.apache.commons.collections.CollectionUtils;
 import org.apache.commons.lang3.EnumUtils;
 import org.apache.commons.lang3.StringUtils;
@@ -91,7 +92,9 @@ public enum ApiCommandResourceType {
     Extension(org.apache.cloudstack.extension.Extension.class),
     ExtensionCustomAction(org.apache.cloudstack.extension.ExtensionCustomAction.class),
     KmsKey(org.apache.cloudstack.kms.KMSKey.class),
-    HsmProfile(org.apache.cloudstack.kms.HSMProfile.class);
+    HsmProfile(org.apache.cloudstack.kms.HSMProfile.class),
+    InstanceBootGroup(org.apache.cloudstack.vm.bootgroup.InstanceBootGroup.class),
+    InstanceBootGroupReadinessRule(InstanceBootGroupReadinessRule.class);
 
     private final Class<?> clazz;
 
diff --git a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
index f74c46161180..b1fc6246ff9a 100644
--- a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
+++ b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
@@ -93,6 +93,23 @@ public class ApiConstants {
     public static final String CAPACITY = "capacity";
     public static final String CATEGORY = "category";
     public static final String CAN_REVERT = "canrevert";
+    public static final String BOOT_GROUP_ID = "bootgroupid";
+    public static final String BOOT_ORDER = "order";
+    public static final String MEMBER_TYPE = "membertype";
+    public static final String MEMBER_ID = "memberid";
+    public static final String MEMBER_NAME = "membername";
+    public static final String MEMBER_STATE = "memberstate";
+    public static final String CHILDREN = "children";
+    public static final String RULE_TYPE = "ruletype";
+    public static final String INHERITED = "inherited";
+    public static final String READINESS_MODE = "readinessmode";
+    public static final String READINESS_STATUS = "readinessstatus";
+    public static final String READINESS_MESSAGE = "readinessmessage";
+    public static final String READINESS_ATTEMPT_TIMEOUT_SECONDS = "readinessattempttimeoutseconds";
+    public static final String READINESS_MAX_RETRY_ATTEMPTS = "readinessmaxretryattempts";
+    public static final String READINESS_REBOOT_ON_RETRY = "readinessrebootonretry";
+    public static final String READINESS_INITIAL_DELAY_SECONDS = "readinessinitialdelayseconds";
+    public static final String IGNORE_INSTANCE_STATE = "ignoreinstancestate";
     public static final String CA_CERTIFICATES = "cacertificates";
     public static final String CERTIFICATE = "certificate";
     public static final String CERTIFICATE_CHAIN = "certchain";
@@ -322,6 +339,7 @@ public class ApiConstants {
     public static final String INTERNAL_DNS2 = "internaldns2";
     public static final String INTERNET_PROTOCOL = "internetprotocol";
     public static final String INTERVAL_TYPE = "intervaltype";
+    public static final String INSTANCE_GROUP_ID = "instancegroupid";
     public static final String INSTANCE_LEASE_DURATION = "leaseduration";
     public static final String INSTANCE_LEASE_ENABLED = "instanceleaseenabled";
     public static final String INSTANCE_LEASE_EXPIRY_ACTION = "leaseexpiryaction";
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/AddMemberToInstanceBootGroupCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/AddMemberToInstanceBootGroupCmd.java
new file mode 100644
index 000000000000..901ca91ff83c
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/AddMemberToInstanceBootGroupCmd.java
@@ -0,0 +1,107 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.command.user.UserCmd;
+import org.apache.cloudstack.api.response.InstanceBootGroupMemberResponse;
+import org.apache.cloudstack.api.response.InstanceBootGroupResponse;
+import org.apache.cloudstack.api.response.InstanceGroupResponse;
+import org.apache.cloudstack.api.response.UserVmResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMember;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService;
+
+@APICommand(name = "addMemberToInstanceBootGroup",
+        description = "Adds an Instance or instance group to an instance boot group. Exactly one of virtualmachineid or instancegroupid must be specified.",
+        since = "24.0",
+        responseObject = InstanceBootGroupMemberResponse.class,
+        entityType = {InstanceBootGroupMember.class},
+        requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User})
+public class AddMemberToInstanceBootGroupCmd extends BaseCmd implements UserCmd {
+
+    @Inject
+    InstanceBootGroupService instanceBootGroupService;
+
+    @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = InstanceBootGroupResponse.class, required = true, description = "The ID of the instance boot group")
+    private Long id;
+
+    @Parameter(name = ApiConstants.VIRTUAL_MACHINE_ID, type = CommandType.UUID, entityType = UserVmResponse.class, description = "The ID of the Instance to add (exclusive with instancegroupid)")
+    private Long virtualMachineId;
+
+    @Parameter(name = ApiConstants.INSTANCE_GROUP_ID, type = CommandType.UUID, entityType = InstanceGroupResponse.class, description = "The ID of the Instance Group to add (exclusive with virtualmachineid)")
+    private Long instanceGroupId;
+
+    @Parameter(name = ApiConstants.BOOT_ORDER, type = CommandType.INTEGER, required = true,
+            description = "The boot order value for this member (0 or greater; non-contiguous values are allowed). "
+                    + "Any existing member already at or past this value is shifted one slot later to make room")
+    private int order;
+
+    public Long getId() {
+        return id;
+    }
+
+    public Long getVirtualMachineId() {
+        return virtualMachineId;
+    }
+
+    public Long getInstanceGroupId() {
+        return instanceGroupId;
+    }
+
+    public int getOrder() {
+        return order;
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+
+    @Override
+    public Long getApiResourceId() {
+        return id;
+    }
+
+    @Override
+    public ApiCommandResourceType getApiResourceType() {
+        return ApiCommandResourceType.InstanceBootGroup;
+    }
+
+    @Override
+    public void execute() {
+        InstanceBootGroupMember result = instanceBootGroupService.addMemberToInstanceBootGroup(this);
+        if (result == null) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to add member to instance boot group");
+        }
+        InstanceBootGroupMemberResponse response = instanceBootGroupService.createInstanceBootGroupMemberResponse(result);
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/CreateInstanceBootGroupCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/CreateInstanceBootGroupCmd.java
new file mode 100644
index 000000000000..29c0f8a344f1
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/CreateInstanceBootGroupCmd.java
@@ -0,0 +1,142 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.command.user.UserCmd;
+import org.apache.cloudstack.api.response.DomainResponse;
+import org.apache.cloudstack.api.response.InstanceBootGroupResponse;
+import org.apache.cloudstack.api.response.ProjectResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroup;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService;
+
+@APICommand(name = "createInstanceBootGroup",
+        description = "Creates an Instance Boot Group",
+        since = "24.0",
+        responseObject = InstanceBootGroupResponse.class,
+        entityType = {InstanceBootGroup.class},
+        requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User})
+public class CreateInstanceBootGroupCmd extends BaseCmd implements UserCmd {
+
+    @Inject
+    InstanceBootGroupService instanceBootGroupService;
+
+    @Parameter(name = ApiConstants.NAME, type = CommandType.STRING, required = true, description = "The name of the Instance Boot Group")
+    private String name;
+
+    @Parameter(name = ApiConstants.DESCRIPTION, type = CommandType.STRING, description = "The description of the Instance Boot Group")
+    private String description;
+
+    @Parameter(name = ApiConstants.ACCOUNT, type = CommandType.STRING, description = "The account of the Instance Boot Group. Must be used with domainid")
+    private String accountName;
+
+    @Parameter(name = ApiConstants.DOMAIN_ID, type = CommandType.UUID, entityType = DomainResponse.class, description = "The domain ID of the account owning the Instance Boot Group")
+    private Long domainId;
+
+    @Parameter(name = ApiConstants.PROJECT_ID, type = CommandType.UUID, entityType = ProjectResponse.class, description = "The project of the Instance Boot Group")
+    private Long projectId;
+
+    @Parameter(name = ApiConstants.READINESS_ATTEMPT_TIMEOUT_SECONDS, type = CommandType.LONG,
+            description = "Per-boot-group override of the global timeout (seconds) for each readiness retry attempt")
+    private Long readinessAttemptTimeoutSeconds;
+
+    @Parameter(name = ApiConstants.READINESS_MAX_RETRY_ATTEMPTS, type = CommandType.LONG,
+            description = "Per-boot-group override of the global maximum number of readiness retry attempts")
+    private Long readinessMaxRetryAttempts;
+
+    @Parameter(name = ApiConstants.READINESS_REBOOT_ON_RETRY, type = CommandType.BOOLEAN,
+            description = "Per-boot-group override of whether an instance is rebooted between readiness retry attempts")
+    private Boolean readinessRebootOnRetry;
+
+    @Parameter(name = ApiConstants.READINESS_INITIAL_DELAY_SECONDS, type = CommandType.LONG,
+            description = "Per-boot-group override of the global delay (seconds) after starting or rebooting an instance before its first readiness check of that attempt")
+    private Long readinessInitialDelaySeconds;
+
+    public String getName() {
+        return name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public String getAccountName() {
+        return accountName;
+    }
+
+    public Long getDomainId() {
+        return domainId;
+    }
+
+    public Long getProjectId() {
+        return projectId;
+    }
+
+    public Long getReadinessAttemptTimeoutSeconds() {
+        return readinessAttemptTimeoutSeconds;
+    }
+
+    public Long getReadinessMaxRetryAttempts() {
+        return readinessMaxRetryAttempts;
+    }
+
+    public Boolean getReadinessRebootOnRetry() {
+        return readinessRebootOnRetry;
+    }
+
+    public Long getReadinessInitialDelaySeconds() {
+        return readinessInitialDelaySeconds;
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
+        if (accountId == null) {
+            return CallContext.current().getCallingAccount().getId();
+        }
+        return accountId;
+    }
+
+    @Override
+    public ApiCommandResourceType getApiResourceType() {
+        return ApiCommandResourceType.InstanceBootGroup;
+    }
+
+    @Override
+    public void execute() {
+        InstanceBootGroup result = instanceBootGroupService.createInstanceBootGroup(this);
+        if (result == null) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to create instance boot group");
+        }
+        InstanceBootGroupResponse response = instanceBootGroupService.createInstanceBootGroupResponse(result.getId());
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/CreateInstanceBootGroupReadinessRuleCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/CreateInstanceBootGroupReadinessRuleCmd.java
new file mode 100644
index 000000000000..43c5dccc5126
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/CreateInstanceBootGroupReadinessRuleCmd.java
@@ -0,0 +1,132 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import java.util.Collection;
+import java.util.Map;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.command.user.UserCmd;
+import org.apache.cloudstack.api.response.InstanceBootGroupReadinessRuleResponse;
+import org.apache.cloudstack.api.response.InstanceBootGroupResponse;
+import org.apache.cloudstack.api.response.InstanceGroupResponse;
+import org.apache.cloudstack.api.response.UserVmResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService;
+
+@APICommand(name = "createInstanceBootGroupReadinessRule",
+        description = "Creates a readiness rule for an Instance or Instance Group that is a member (directly, or via its instance group) of an Instance Boot Group",
+        since = "24.0",
+        responseObject = InstanceBootGroupReadinessRuleResponse.class,
+        entityType = {InstanceBootGroupReadinessRule.class},
+        requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User})
+public class CreateInstanceBootGroupReadinessRuleCmd extends BaseCmd implements UserCmd {
+
+    @Inject
+    InstanceBootGroupService instanceBootGroupService;
+
+    @Parameter(name = ApiConstants.BOOT_GROUP_ID, type = CommandType.UUID, entityType = InstanceBootGroupResponse.class, required = true,
+            description = "The ID of the Instance Boot Group this rule belongs to")
+    private Long bootGroupId;
+
+    @Parameter(name = ApiConstants.VIRTUAL_MACHINE_ID, type = CommandType.UUID, entityType = UserVmResponse.class,
+            description = "The ID of the Instance this rule applies to (exclusive with instancegroupid)")
+    private Long virtualMachineId;
+
+    @Parameter(name = ApiConstants.INSTANCE_GROUP_ID, type = CommandType.UUID, entityType = InstanceGroupResponse.class,
+            description = "The ID of the Instance Group this rule applies to (exclusive with virtualmachineid)")
+    private Long instanceGroupId;
+
+    @Parameter(name = ApiConstants.RULE_TYPE, type = CommandType.STRING, required = true,
+            description = "The readiness rule type: GuestAgentLiveness, Ping, PortCheck or MemberQuorum")
+    private String ruleType;
+
+    @Parameter(name = ApiConstants.NAME, type = CommandType.STRING, description = "The name of the readiness rule; auto-generated if not provided")
+    private String name;
+
+    @Parameter(name = ApiConstants.ENABLED, type = CommandType.BOOLEAN, description = "Whether the rule is enabled; defaults to true")
+    private Boolean enabled;
+
+    @Parameter(name = ApiConstants.DETAILS, type = CommandType.MAP, description = "Rule-type-specific configuration, e.g. port/protocol, script, threshold_type/threshold_value")
+    private Map details;
+
+    public Long getBootGroupId() {
+        return bootGroupId;
+    }
+
+    public Long getVirtualMachineId() {
+        return virtualMachineId;
+    }
+
+    public Long getInstanceGroupId() {
+        return instanceGroupId;
+    }
+
+    public String getRuleType() {
+        return ruleType;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public boolean isEnabled() {
+        return enabled == null || enabled;
+    }
+
+    public Map<String, String> getDetails() {
+        if (this.details == null || this.details.isEmpty()) {
+            return null;
+        }
+        Collection<String> paramsCollection = this.details.values();
+        return (Map<String, String>) (paramsCollection.toArray())[0];
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+
+    @Override
+    public ApiCommandResourceType getApiResourceType() {
+        return ApiCommandResourceType.InstanceBootGroupReadinessRule;
+    }
+
+    @Override
+    public void execute() {
+        InstanceBootGroupReadinessRule result = instanceBootGroupService.createInstanceBootGroupReadinessRule(this);
+        if (result == null) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to create instance boot group readiness rule");
+        }
+        InstanceBootGroupReadinessRuleResponse response = instanceBootGroupService.createInstanceBootGroupReadinessRuleResponse(result);
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/DeleteInstanceBootGroupCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/DeleteInstanceBootGroupCmd.java
new file mode 100644
index 000000000000..8c6c5d7fa3e4
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/DeleteInstanceBootGroupCmd.java
@@ -0,0 +1,81 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.command.user.UserCmd;
+import org.apache.cloudstack.api.response.InstanceBootGroupResponse;
+import org.apache.cloudstack.api.response.SuccessResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroup;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService;
+
+@APICommand(name = "deleteInstanceBootGroup",
+        description = "Deletes an Instance Boot Group",
+        since = "24.0",
+        responseObject = SuccessResponse.class,
+        entityType = {InstanceBootGroup.class},
+        requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User})
+public class DeleteInstanceBootGroupCmd extends BaseCmd implements UserCmd {
+
+    @Inject
+    InstanceBootGroupService instanceBootGroupService;
+
+    @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = InstanceBootGroupResponse.class, required = true, description = "The ID of the Instance Boot Group")
+    private Long id;
+
+    public Long getId() {
+        return id;
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+
+    @Override
+    public Long getApiResourceId() {
+        return id;
+    }
+
+    @Override
+    public ApiCommandResourceType getApiResourceType() {
+        return ApiCommandResourceType.InstanceBootGroup;
+    }
+
+    @Override
+    public void execute() {
+        boolean result = instanceBootGroupService.deleteInstanceBootGroup(this);
+        if (!result) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to delete instance boot group");
+        }
+        SuccessResponse response = new SuccessResponse(getCommandName());
+        setResponseObject(response);
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/DeleteInstanceBootGroupReadinessRuleCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/DeleteInstanceBootGroupReadinessRuleCmd.java
new file mode 100644
index 000000000000..1a8a1bc79e42
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/DeleteInstanceBootGroupReadinessRuleCmd.java
@@ -0,0 +1,82 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.command.user.UserCmd;
+import org.apache.cloudstack.api.response.InstanceBootGroupReadinessRuleResponse;
+import org.apache.cloudstack.api.response.SuccessResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService;
+
+@APICommand(name = "deleteInstanceBootGroupReadinessRule",
+        description = "Deletes an Instance Boot Group readiness rule",
+        since = "24.0",
+        responseObject = SuccessResponse.class,
+        entityType = {InstanceBootGroupReadinessRule.class},
+        requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User})
+public class DeleteInstanceBootGroupReadinessRuleCmd extends BaseCmd implements UserCmd {
+
+    @Inject
+    InstanceBootGroupService instanceBootGroupService;
+
+    @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = InstanceBootGroupReadinessRuleResponse.class, required = true,
+            description = "The ID of the Instance Boot Group readiness rule")
+    private Long id;
+
+    public Long getId() {
+        return id;
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+
+    @Override
+    public Long getApiResourceId() {
+        return id;
+    }
+
+    @Override
+    public ApiCommandResourceType getApiResourceType() {
+        return ApiCommandResourceType.InstanceBootGroupReadinessRule;
+    }
+
+    @Override
+    public void execute() {
+        boolean result = instanceBootGroupService.deleteInstanceBootGroupReadinessRule(this);
+        if (!result) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to delete instance boot group readiness rule");
+        }
+        SuccessResponse response = new SuccessResponse(getCommandName());
+        setResponseObject(response);
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupMembersCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupMembersCmd.java
new file mode 100644
index 000000000000..e8af5ddf4feb
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupMembersCmd.java
@@ -0,0 +1,96 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import java.util.List;
+
+import javax.inject.Inject;
+
+import org.apache.commons.lang3.BooleanUtils;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseListCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.command.user.UserCmd;
+import org.apache.cloudstack.api.response.InstanceBootGroupMemberResponse;
+import org.apache.cloudstack.api.response.InstanceBootGroupResponse;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMember;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService;
+
+@APICommand(name = "listInstanceBootGroupMembers",
+        description = "Lists members of an Instance Boot Group, sorted by boot order",
+        since = "24.0",
+        responseObject = InstanceBootGroupMemberResponse.class,
+        entityType = {InstanceBootGroupMember.class},
+        requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User})
+public class ListInstanceBootGroupMembersCmd extends BaseListCmd implements UserCmd {
+
+    @Inject
+    InstanceBootGroupService instanceBootGroupService;
+
+    @Parameter(name = ApiConstants.BOOT_GROUP_ID, type = CommandType.UUID, required = true, entityType = InstanceBootGroupResponse.class, description = "The ID of the Instance Boot Group")
+    private Long bootGroupId;
+
+    @Parameter(name = ApiConstants.MEMBER_TYPE, type = CommandType.STRING, description = "Filter by member type: VirtualMachine or InstanceGroup")
+    private String memberType;
+
+    @Parameter(name = ApiConstants.DETAILS,
+               type = CommandType.LIST,
+               collectionType = CommandType.STRING,
+               description = "Comma separated list of additional details requested, value can be a list of [all, readiness, children]. "
+                       + "Readiness fields are computed from cached check results (not a live re-check) and are omitted unless requested, since computing them is not free. "
+                       + "Children returns the member Instances of InstanceGroup-type members (omitted for VirtualMachine-type members); combine with readiness to also include per-child readiness")
+    private List<String> viewDetails;
+
+    @Parameter(name = ApiConstants.IGNORE_INSTANCE_STATE, type = CommandType.BOOLEAN,
+               description = "If true, readiness status/message reflect the last cached rule check regardless of the member's current instance state. "
+                       + "If false (default), an Instance that isn't Running is always reported NotReady, even if its rules were last cached Ready")
+    private Boolean ignoreInstanceState;
+
+    public Long getBootGroupId() {
+        return bootGroupId;
+    }
+
+    public String getMemberType() {
+        return memberType;
+    }
+
+    public boolean isIgnoreInstanceState() {
+        return BooleanUtils.toBoolean(ignoreInstanceState);
+    }
+
+    public boolean isReadinessDetailRequested() {
+        return viewDetails != null && (viewDetails.contains("readiness") || viewDetails.contains("all"));
+    }
+
+    public boolean isChildrenDetailRequested() {
+        return viewDetails != null && (viewDetails.contains("children") || viewDetails.contains("all"));
+    }
+
+    @Override
+    public void execute() {
+        ListResponse<InstanceBootGroupMemberResponse> response = instanceBootGroupService.listInstanceBootGroupMembers(this);
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupReadinessRulesCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupReadinessRulesCmd.java
new file mode 100644
index 000000000000..34db56662efe
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupReadinessRulesCmd.java
@@ -0,0 +1,91 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseListCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.command.user.UserCmd;
+import org.apache.cloudstack.api.response.InstanceBootGroupReadinessRuleResponse;
+import org.apache.cloudstack.api.response.InstanceBootGroupResponse;
+import org.apache.cloudstack.api.response.InstanceGroupResponse;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.api.response.UserVmResponse;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService;
+
+@APICommand(name = "listInstanceBootGroupReadinessRules",
+        description = "Lists readiness rules for an Instance Boot Group",
+        since = "24.0",
+        responseObject = InstanceBootGroupReadinessRuleResponse.class,
+        entityType = {InstanceBootGroupReadinessRule.class},
+        requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User})
+public class ListInstanceBootGroupReadinessRulesCmd extends BaseListCmd implements UserCmd {
+
+    @Inject
+    InstanceBootGroupService instanceBootGroupService;
+
+    @Parameter(name = ApiConstants.BOOT_GROUP_ID, type = CommandType.UUID, entityType = InstanceBootGroupResponse.class, required = true,
+            description = "The ID of the Instance Boot Group; listing is always scoped to one boot group")
+    private Long bootGroupId;
+
+    @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = InstanceBootGroupReadinessRuleResponse.class, description = "List by readiness rule ID")
+    private Long id;
+
+    @Parameter(name = ApiConstants.VIRTUAL_MACHINE_ID, type = CommandType.UUID, entityType = UserVmResponse.class, description = "List rules for the Instance")
+    private Long virtualMachineId;
+
+    @Parameter(name = ApiConstants.INSTANCE_GROUP_ID, type = CommandType.UUID, entityType = InstanceGroupResponse.class, description = "List rules for the Instance Group")
+    private Long instanceGroupId;
+
+    @Parameter(name = ApiConstants.RULE_TYPE, type = CommandType.STRING, description = "Filter by readiness rule type")
+    private String ruleType;
+
+    public Long getBootGroupId() {
+        return bootGroupId;
+    }
+
+    public Long getId() {
+        return id;
+    }
+
+    public Long getVirtualMachineId() {
+        return virtualMachineId;
+    }
+
+    public Long getInstanceGroupId() {
+        return instanceGroupId;
+    }
+
+    public String getRuleType() {
+        return ruleType;
+    }
+
+    @Override
+    public void execute() {
+        ListResponse<InstanceBootGroupReadinessRuleResponse> response = instanceBootGroupService.listInstanceBootGroupReadinessRules(this);
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupsCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupsCmd.java
new file mode 100644
index 000000000000..80bc29482b85
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupsCmd.java
@@ -0,0 +1,83 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseListProjectAndAccountResourcesCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.command.user.UserCmd;
+import org.apache.cloudstack.api.response.InstanceBootGroupResponse;
+import org.apache.cloudstack.api.response.InstanceGroupResponse;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.api.response.UserVmResponse;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroup;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService;
+
+@APICommand(name = "listInstanceBootGroups",
+        description = "Lists Instance Boot Groups",
+        since = "24.0",
+        responseObject = InstanceBootGroupResponse.class,
+        entityType = {InstanceBootGroup.class},
+        requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User})
+public class ListInstanceBootGroupsCmd extends BaseListProjectAndAccountResourcesCmd implements UserCmd {
+
+    @Inject
+    InstanceBootGroupService instanceBootGroupService;
+
+    @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = InstanceBootGroupResponse.class, description = "List Instance Boot Group by ID")
+    private Long id;
+
+    @Parameter(name = ApiConstants.KEYWORD, type = CommandType.STRING, description = "List Instance Boot Groups by name keyword")
+    private String keyword;
+
+    @Parameter(name = ApiConstants.VIRTUAL_MACHINE_ID, type = CommandType.UUID, entityType = UserVmResponse.class, description = "List Instance Boot Groups that contain the Instance")
+    private Long virtualMachineId;
+
+    @Parameter(name = ApiConstants.INSTANCE_GROUP_ID, type = CommandType.UUID, entityType = InstanceGroupResponse.class, description = "List Instance Boot Groups that contain the Instance Group")
+    private Long instanceGroupId;
+
+    public Long getId() {
+        return id;
+    }
+
+    @Override
+    public String getKeyword() {
+        return keyword;
+    }
+
+    public Long getVirtualMachineId() {
+        return virtualMachineId;
+    }
+
+    public Long getInstanceGroupId() {
+        return instanceGroupId;
+    }
+
+    @Override
+    public void execute() {
+        ListResponse<InstanceBootGroupResponse> response = instanceBootGroupService.listInstanceBootGroups(this);
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/RebootInstanceBootGroupCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/RebootInstanceBootGroupCmd.java
new file mode 100644
index 000000000000..624a736bbf8e
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/RebootInstanceBootGroupCmd.java
@@ -0,0 +1,107 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.BaseAsyncCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.command.user.UserCmd;
+import org.apache.cloudstack.api.response.InstanceBootGroupResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroup;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService;
+
+import com.cloud.event.EventTypes;
+import com.cloud.utils.exception.CloudRuntimeException;
+
+@APICommand(name = "rebootInstanceBootGroup",
+        description = "Reboots all VMs in an Instance Boot Group: stops in reverse order then starts in forward order",
+        since = "24.0",
+        responseObject = InstanceBootGroupResponse.class,
+        entityType = {InstanceBootGroup.class},
+        requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User})
+public class RebootInstanceBootGroupCmd extends BaseAsyncCmd implements UserCmd {
+
+    @Inject
+    InstanceBootGroupService instanceBootGroupService;
+
+    @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = InstanceBootGroupResponse.class, required = true, description = "The ID of the Instance Boot Group")
+    private Long id;
+
+    @Parameter(name = ApiConstants.FORCED, type = CommandType.BOOLEAN, required = false,
+            description = "Whether to force stop every Instance in the Instance Boot Group during the stop phase of the reboot (It is force-stopped and then started)")
+    private Boolean forced;
+
+    public Long getId() {
+        return id;
+    }
+
+    public boolean isForced() {
+        return forced != null && forced;
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+
+    @Override
+    public String getEventType() {
+        return EventTypes.EVENT_INSTANCE_BOOT_GROUP_REBOOT;
+    }
+
+    @Override
+    public String getEventDescription() {
+        return "Rebooting Instance Boot Group with ID: " + getResourceUuid(ApiConstants.ID);
+    }
+
+    @Override
+    public Long getApiResourceId() {
+        return id;
+    }
+
+    @Override
+    public ApiCommandResourceType getApiResourceType() {
+        return ApiCommandResourceType.InstanceBootGroup;
+    }
+
+    @Override
+    public void execute() {
+        InstanceBootGroup result;
+        try {
+            result = instanceBootGroupService.rebootInstanceBootGroup(this);
+        } catch (CloudRuntimeException e) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, e.getMessage());
+        }
+        if (result == null) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to reboot instance boot group");
+        }
+        InstanceBootGroupResponse response = instanceBootGroupService.createInstanceBootGroupResponse(result.getId());
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/RemoveInstanceBootGroupMemberCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/RemoveInstanceBootGroupMemberCmd.java
new file mode 100644
index 000000000000..847041742511
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/RemoveInstanceBootGroupMemberCmd.java
@@ -0,0 +1,81 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.command.user.UserCmd;
+import org.apache.cloudstack.api.response.InstanceBootGroupMemberResponse;
+import org.apache.cloudstack.api.response.SuccessResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMember;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService;
+
+@APICommand(name = "removeInstanceBootGroupMember",
+        description = "Removes a member from an Instance Boot Group",
+        since = "24.0",
+        responseObject = SuccessResponse.class,
+        entityType = {InstanceBootGroupMember.class},
+        requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User})
+public class RemoveInstanceBootGroupMemberCmd extends BaseCmd implements UserCmd {
+
+    @Inject
+    InstanceBootGroupService instanceBootGroupService;
+
+    @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = InstanceBootGroupMemberResponse.class, required = true, description = "The ID of the Instance Boot Group member to remove")
+    private Long id;
+
+    public Long getId() {
+        return id;
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+
+    @Override
+    public Long getApiResourceId() {
+        return instanceBootGroupService.getInstanceBootGroupIdForMember(getId());
+    }
+
+    @Override
+    public ApiCommandResourceType getApiResourceType() {
+        return ApiCommandResourceType.InstanceBootGroup;
+    }
+
+    @Override
+    public void execute() {
+        boolean result = instanceBootGroupService.removeInstanceBootGroupMember(this);
+        if (!result) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to remove member from instance boot group");
+        }
+        SuccessResponse response = new SuccessResponse(getCommandName());
+        setResponseObject(response);
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/StartInstanceBootGroupCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/StartInstanceBootGroupCmd.java
new file mode 100644
index 000000000000..9351e4d16d5e
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/StartInstanceBootGroupCmd.java
@@ -0,0 +1,99 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.BaseAsyncCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.command.user.UserCmd;
+import org.apache.cloudstack.api.response.InstanceBootGroupResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroup;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService;
+
+import com.cloud.event.EventTypes;
+import com.cloud.utils.exception.CloudRuntimeException;
+
+@APICommand(name = "startInstanceBootGroup",
+        description = "Starts all Instances in an Instance Boot Group in order (lowest boot order first). Instances within the same order tier start concurrently",
+        since = "24.0",
+        responseObject = InstanceBootGroupResponse.class,
+        entityType = {InstanceBootGroup.class},
+        requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User})
+public class StartInstanceBootGroupCmd extends BaseAsyncCmd implements UserCmd {
+
+    @Inject
+    InstanceBootGroupService instanceBootGroupService;
+
+    @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = InstanceBootGroupResponse.class, required = true, description = "The ID of the Instance Boot Group")
+    private Long id;
+
+    public Long getId() {
+        return id;
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+
+    @Override
+    public String getEventType() {
+        return EventTypes.EVENT_INSTANCE_BOOT_GROUP_START;
+    }
+
+    @Override
+    public String getEventDescription() {
+        return "Starting Instance Boot Group with ID: " + getResourceUuid(ApiConstants.ID);
+    }
+
+    @Override
+    public Long getApiResourceId() {
+        return id;
+    }
+
+    @Override
+    public ApiCommandResourceType getApiResourceType() {
+        return ApiCommandResourceType.InstanceBootGroup;
+    }
+
+    @Override
+    public void execute() {
+        InstanceBootGroup result;
+        try {
+            result = instanceBootGroupService.startInstanceBootGroup(this);
+        } catch (CloudRuntimeException e) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, e.getMessage());
+        }
+        if (result == null) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to start instance boot group");
+        }
+        InstanceBootGroupResponse response = instanceBootGroupService.createInstanceBootGroupResponse(result.getId());
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/StopInstanceBootGroupCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/StopInstanceBootGroupCmd.java
new file mode 100644
index 000000000000..a86a81e0b038
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/StopInstanceBootGroupCmd.java
@@ -0,0 +1,101 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.BaseAsyncCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.command.user.UserCmd;
+import org.apache.cloudstack.api.response.InstanceBootGroupResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroup;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService;
+
+import com.cloud.event.EventTypes;
+
+@APICommand(name = "stopInstanceBootGroup",
+        description = "Stops all Instances in an Instance Boot Group in reverse order (highest boot order first). Continues through all tiers even if some Instances fail to stop",
+        since = "24.0",
+        responseObject = InstanceBootGroupResponse.class,
+        entityType = {InstanceBootGroup.class},
+        requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User})
+public class StopInstanceBootGroupCmd extends BaseAsyncCmd implements UserCmd {
+
+    @Inject
+    InstanceBootGroupService instanceBootGroupService;
+
+    @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = InstanceBootGroupResponse.class, required = true, description = "The ID of the Instance Boot Group")
+    private Long id;
+
+    @Parameter(name = ApiConstants.FORCED, type = CommandType.BOOLEAN, required = false,
+            description = "Force stop every Instance in the Instance Boot Group (marked as Stopped even when the stop command fails to be sent to the backend, otherwise a force poweroff is attempted)")
+    private Boolean forced;
+
+    public Long getId() {
+        return id;
+    }
+
+    public boolean isForced() {
+        return forced != null && forced;
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+
+    @Override
+    public String getEventType() {
+        return EventTypes.EVENT_INSTANCE_BOOT_GROUP_STOP;
+    }
+
+    @Override
+    public String getEventDescription() {
+        return "Stopping Instance Boot Group with ID: " + getResourceUuid(ApiConstants.ID);
+    }
+
+    @Override
+    public Long getApiResourceId() {
+        return id;
+    }
+
+    @Override
+    public ApiCommandResourceType getApiResourceType() {
+        return ApiCommandResourceType.InstanceBootGroup;
+    }
+
+    @Override
+    public void execute() {
+        InstanceBootGroup result = instanceBootGroupService.stopInstanceBootGroup(this);
+        if (result == null) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to stop instance boot group");
+        }
+        InstanceBootGroupResponse response = instanceBootGroupService.createInstanceBootGroupResponse(result.getId());
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupCmd.java
new file mode 100644
index 000000000000..c700053dec0e
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupCmd.java
@@ -0,0 +1,127 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.command.user.UserCmd;
+import org.apache.cloudstack.api.response.InstanceBootGroupResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroup;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService;
+
+@APICommand(name = "updateInstanceBootGroup",
+        description = "Updates an Instance Boot Group",
+        since = "24.0",
+        responseObject = InstanceBootGroupResponse.class,
+        entityType = {InstanceBootGroup.class},
+        requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User})
+public class UpdateInstanceBootGroupCmd extends BaseCmd implements UserCmd {
+
+    @Inject
+    InstanceBootGroupService instanceBootGroupService;
+
+    @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = InstanceBootGroupResponse.class, required = true, description = "The ID of the Instance Boot Group")
+    private Long id;
+
+    @Parameter(name = ApiConstants.NAME, type = CommandType.STRING, description = "New name for the Instance Boot Group")
+    private String name;
+
+    @Parameter(name = ApiConstants.DESCRIPTION, type = CommandType.STRING, description = "New description for the Instance Boot Group")
+    private String description;
+
+    @Parameter(name = ApiConstants.READINESS_ATTEMPT_TIMEOUT_SECONDS, type = CommandType.LONG,
+            description = "Per-boot-group override of the global timeout (seconds) for each readiness retry attempt. Pass -1 to clear the override and fall back to the global setting")
+    private Long readinessAttemptTimeoutSeconds;
+
+    @Parameter(name = ApiConstants.READINESS_MAX_RETRY_ATTEMPTS, type = CommandType.LONG,
+            description = "Per-boot-group override of the global maximum number of readiness retry attempts. Pass -1 to clear the override and fall back to the global setting")
+    private Long readinessMaxRetryAttempts;
+
+    @Parameter(name = ApiConstants.READINESS_REBOOT_ON_RETRY, type = CommandType.BOOLEAN,
+            description = "Per-boot-group override of whether an instance is rebooted between readiness retry attempts")
+    private Boolean readinessRebootOnRetry;
+
+    @Parameter(name = ApiConstants.READINESS_INITIAL_DELAY_SECONDS, type = CommandType.LONG,
+            description = "Per-boot-group override of the global delay (seconds) after starting or rebooting an instance before its first readiness check of that attempt. Pass -1 to clear the override and fall back to the global setting")
+    private Long readinessInitialDelaySeconds;
+
+    public Long getId() {
+        return id;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public Long getReadinessAttemptTimeoutSeconds() {
+        return readinessAttemptTimeoutSeconds;
+    }
+
+    public Long getReadinessMaxRetryAttempts() {
+        return readinessMaxRetryAttempts;
+    }
+
+    public Boolean getReadinessRebootOnRetry() {
+        return readinessRebootOnRetry;
+    }
+
+    public Long getReadinessInitialDelaySeconds() {
+        return readinessInitialDelaySeconds;
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+
+    @Override
+    public Long getApiResourceId() {
+        return id;
+    }
+
+    @Override
+    public ApiCommandResourceType getApiResourceType() {
+        return ApiCommandResourceType.InstanceBootGroup;
+    }
+
+    @Override
+    public void execute() {
+        InstanceBootGroup result = instanceBootGroupService.updateInstanceBootGroup(this);
+        if (result == null) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to update instance boot group");
+        }
+        InstanceBootGroupResponse response = instanceBootGroupService.createInstanceBootGroupResponse(result.getId());
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupMemberCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupMemberCmd.java
new file mode 100644
index 000000000000..8c2316a104b7
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupMemberCmd.java
@@ -0,0 +1,88 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.command.user.UserCmd;
+import org.apache.cloudstack.api.response.InstanceBootGroupMemberResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMember;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService;
+
+@APICommand(name = "updateInstanceBootGroupMember",
+        description = "Updates the boot order of a member in an instance boot group",
+        since = "24.0",
+        responseObject = InstanceBootGroupMemberResponse.class,
+        entityType = {InstanceBootGroupMember.class},
+        requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User})
+public class UpdateInstanceBootGroupMemberCmd extends BaseCmd implements UserCmd {
+
+    @Inject
+    InstanceBootGroupService instanceBootGroupService;
+
+    @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = InstanceBootGroupMemberResponse.class, required = true, description = "The ID of the boot group member entry")
+    private Long id;
+
+    @Parameter(name = ApiConstants.BOOT_ORDER, type = CommandType.INTEGER, required = true, description = "The new boot order value (0 or greater)")
+    private int order;
+
+    public Long getId() {
+        return id;
+    }
+
+    public int getOrder() {
+        return order;
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+
+    @Override
+    public Long getApiResourceId() {
+        return instanceBootGroupService.getInstanceBootGroupIdForMember(getId());
+    }
+
+    @Override
+    public ApiCommandResourceType getApiResourceType() {
+        return ApiCommandResourceType.InstanceBootGroup;
+    }
+
+    @Override
+    public void execute() {
+        InstanceBootGroupMember result = instanceBootGroupService.updateInstanceBootGroupMember(this);
+        if (result == null) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to update instance boot group member");
+        }
+        InstanceBootGroupMemberResponse response = instanceBootGroupService.createInstanceBootGroupMemberResponse(result);
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupReadinessRuleCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupReadinessRuleCmd.java
new file mode 100644
index 000000000000..ea399f085658
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupReadinessRuleCmd.java
@@ -0,0 +1,110 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import java.util.Collection;
+import java.util.Map;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.command.user.UserCmd;
+import org.apache.cloudstack.api.response.InstanceBootGroupReadinessRuleResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService;
+
+@APICommand(name = "updateInstanceBootGroupReadinessRule",
+        description = "Updates an Instance Boot Group readiness rule. The rule type, Instance Boot Group and item are immutable after creation.",
+        since = "24.0",
+        responseObject = InstanceBootGroupReadinessRuleResponse.class,
+        entityType = {InstanceBootGroupReadinessRule.class},
+        requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User})
+public class UpdateInstanceBootGroupReadinessRuleCmd extends BaseCmd implements UserCmd {
+
+    @Inject
+    InstanceBootGroupService instanceBootGroupService;
+
+    @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = InstanceBootGroupReadinessRuleResponse.class, required = true,
+            description = "The ID of the readiness rule")
+    private Long id;
+
+    @Parameter(name = ApiConstants.NAME, type = CommandType.STRING, description = "New name for the readiness rule")
+    private String name;
+
+    @Parameter(name = ApiConstants.ENABLED, type = CommandType.BOOLEAN, description = "Whether the rule is enabled")
+    private Boolean enabled;
+
+    @Parameter(name = ApiConstants.DETAILS, type = CommandType.MAP, description = "Rule-type-specific configuration")
+    private Map details;
+
+    public Long getId() {
+        return id;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public Boolean getEnabled() {
+        return enabled;
+    }
+
+    public Map<String, String> getDetails() {
+        if (this.details == null || this.details.isEmpty()) {
+            return null;
+        }
+        Collection<String> paramsCollection = this.details.values();
+        return (Map<String, String>) (paramsCollection.toArray())[0];
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+
+    @Override
+    public Long getApiResourceId() {
+        return id;
+    }
+
+    @Override
+    public ApiCommandResourceType getApiResourceType() {
+        return ApiCommandResourceType.InstanceBootGroupReadinessRule;
+    }
+
+    @Override
+    public void execute() {
+        InstanceBootGroupReadinessRule result = instanceBootGroupService.updateInstanceBootGroupReadinessRule(this);
+        if (result == null) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to update instance boot group readiness rule");
+        }
+        InstanceBootGroupReadinessRuleResponse response = instanceBootGroupService.createInstanceBootGroupReadinessRuleResponse(result);
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/InstanceBootGroupMemberChildResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/InstanceBootGroupMemberChildResponse.java
new file mode 100644
index 000000000000..d1164209d003
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/response/InstanceBootGroupMemberChildResponse.java
@@ -0,0 +1,57 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.response;
+
+import com.google.gson.annotations.SerializedName;
+
+import org.apache.cloudstack.api.ApiConstants;
+
+import com.cloud.serializer.Param;
+
+/**
+ * Extends {@link UserVmResponse} rather than duplicating id/name/state fields, since this is set
+ * up from a plain {@code UserVmVO} (basic details only, via {@code UserVmDao}) with just a few
+ * boot-group-specific fields of its own — never populated from the join-based VM response builder.
+ */
+@SuppressWarnings("unused")
+public class InstanceBootGroupMemberChildResponse extends UserVmResponse {
+
+    @SerializedName(ApiConstants.READINESS_MODE)
+    @Param(description = "None, ChildDependent or RuleBased, computed from whether readiness rules are attached")
+    private String readinessMode;
+
+    @SerializedName(ApiConstants.READINESS_STATUS)
+    @Param(description = "The last cached readiness evaluation")
+    private String readinessStatus;
+
+    @SerializedName(ApiConstants.READINESS_MESSAGE)
+    @Param(description = "Why readinessstatus is what it is: the failing rule(s)' cached message")
+    private String readinessMessage;
+
+    public void setReadinessMode(String readinessMode) {
+        this.readinessMode = readinessMode;
+    }
+
+    public void setReadinessStatus(String readinessStatus) {
+        this.readinessStatus = readinessStatus;
+    }
+
+    public void setReadinessMessage(String readinessMessage) {
+        this.readinessMessage = readinessMessage;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/InstanceBootGroupMemberResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/InstanceBootGroupMemberResponse.java
new file mode 100644
index 000000000000..4d91714216ce
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/response/InstanceBootGroupMemberResponse.java
@@ -0,0 +1,131 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.response;
+
+import java.util.Date;
+import java.util.List;
+
+import com.google.gson.annotations.SerializedName;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseResponse;
+import org.apache.cloudstack.api.EntityReference;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMember;
+
+import com.cloud.serializer.Param;
+
+@SuppressWarnings("unused")
+@EntityReference(value = InstanceBootGroupMember.class)
+public class InstanceBootGroupMemberResponse extends BaseResponse {
+
+    @SerializedName(ApiConstants.ID)
+    @Param(description = "The UUID of this member entry")
+    private String id;
+
+    @SerializedName(ApiConstants.BOOT_GROUP_ID)
+    @Param(description = "The ID of the boot group this member belongs to")
+    private String bootGroupId;
+
+    @SerializedName(ApiConstants.MEMBER_TYPE)
+    @Param(description = "The type of the member: VirtualMachine or InstanceGroup")
+    private String memberType;
+
+    @SerializedName(ApiConstants.MEMBER_ID)
+    @Param(description = "The ID of the VM or InstanceGroup")
+    private String memberId;
+
+    @SerializedName(ApiConstants.MEMBER_NAME)
+    @Param(description = "The name of the VM or InstanceGroup")
+    private String memberName;
+
+    @SerializedName(ApiConstants.MEMBER_STATE)
+    @Param(description = "The state of the Instance")
+    private String memberState;
+
+    @SerializedName(ApiConstants.BOOT_ORDER)
+    @Param(description = "The boot order value for this member")
+    private int order;
+
+    @SerializedName(ApiConstants.CREATED)
+    @Param(description = "The date the member was added to the boot group")
+    private Date created;
+
+    @SerializedName(ApiConstants.READINESS_MODE)
+    @Param(description = "None, CHILD_DEPENDENT or RULE_BASED, computed from whether readiness rules are attached")
+    private String readinessMode;
+
+    @SerializedName(ApiConstants.READINESS_STATUS)
+    @Param(description = "The last cached readiness evaluation")
+    private String readinessStatus;
+
+    @SerializedName(ApiConstants.READINESS_MESSAGE)
+    @Param(description = "Why readinessstatus is what it is: the failing rule(s)' cached message, and/or a count of not-ready member VMs for InstanceGroup members")
+    private String readinessMessage;
+
+    @SerializedName(ApiConstants.CHILDREN)
+    @Param(description = "For InstanceGroup members, the VMs within the group (only present when requested via details=children)", responseObject = InstanceBootGroupMemberChildResponse.class)
+    private List<InstanceBootGroupMemberChildResponse> children;
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public void setBootGroupId(String bootGroupId) {
+        this.bootGroupId = bootGroupId;
+    }
+
+    public void setMemberType(String memberType) {
+        this.memberType = memberType;
+    }
+
+    public void setMemberId(String memberId) {
+        this.memberId = memberId;
+    }
+
+    public void setMemberName(String memberName) {
+        this.memberName = memberName;
+    }
+
+    public void setMemberState(String memberState) {
+        this.memberState = memberState;
+    }
+
+    public void setOrder(int order) {
+        this.order = order;
+    }
+
+    public void setCreated(Date created) {
+        this.created = created;
+    }
+
+    public void setReadinessMode(String readinessMode) {
+        this.readinessMode = readinessMode;
+    }
+
+    public void setReadinessStatus(String readinessStatus) {
+        this.readinessStatus = readinessStatus;
+    }
+
+    public void setReadinessMessage(String readinessMessage) {
+        this.readinessMessage = readinessMessage;
+    }
+
+    public void setChildren(List<InstanceBootGroupMemberChildResponse> children) {
+        this.children = children;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/InstanceBootGroupReadinessRuleResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/InstanceBootGroupReadinessRuleResponse.java
new file mode 100644
index 000000000000..26228c8e8784
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/response/InstanceBootGroupReadinessRuleResponse.java
@@ -0,0 +1,148 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.response;
+
+import java.util.Date;
+import java.util.Map;
+
+import com.google.gson.annotations.SerializedName;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseResponse;
+import org.apache.cloudstack.api.EntityReference;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
+
+import com.cloud.serializer.Param;
+
+@SuppressWarnings("unused")
+@EntityReference(value = InstanceBootGroupReadinessRule.class)
+public class InstanceBootGroupReadinessRuleResponse extends BaseResponse {
+
+    @SerializedName(ApiConstants.ID)
+    @Param(description = "The ID of the readiness rule")
+    private String id;
+
+    @SerializedName(ApiConstants.NAME)
+    @Param(description = "The name of the readiness rule")
+    private String name;
+
+    @SerializedName(ApiConstants.BOOT_GROUP_ID)
+    @Param(description = "The ID of the boot group this rule belongs to")
+    private String bootGroupId;
+
+    @SerializedName(ApiConstants.MEMBER_TYPE)
+    @Param(description = "The item type this rule applies to: VirtualMachine or InstanceGroup")
+    private String itemType;
+
+    @SerializedName(ApiConstants.MEMBER_ID)
+    @Param(description = "The ID of the item (VM or instance group) this rule applies to")
+    private String itemId;
+
+    @SerializedName(ApiConstants.MEMBER_NAME)
+    @Param(description = "The name of the item (VM or instance group) this rule applies to")
+    private String itemName;
+
+    @SerializedName(ApiConstants.RULE_TYPE)
+    @Param(description = "The readiness rule type")
+    private String ruleType;
+
+    @SerializedName(ApiConstants.ENABLED)
+    @Param(description = "Whether the rule is enabled")
+    private boolean enabled;
+
+    @SerializedName(ApiConstants.INHERITED)
+    @Param(description = "True if this rule is not attached to the queried item directly, but inherited from its owning InstanceGroup "
+            + "(only possible when listing by virtualmachineid; the rule's itemtype/itemid still refer to the InstanceGroup it's actually attached to)")
+    private boolean inherited;
+
+    @SerializedName(ApiConstants.DETAILS)
+    @Param(description = "Rule-type-specific configuration")
+    private Map<String, String> details;
+
+    @SerializedName(ApiConstants.CREATED)
+    @Param(description = "The date the rule was created")
+    private Date created;
+
+    @SerializedName(ApiConstants.READINESS_STATUS)
+    @Param(description = "The last cached evaluation status of this rule: READY, NOT_READY, ERROR or UNKNOWN")
+    private String status;
+
+    @SerializedName("statusmessage")
+    @Param(description = "The message from the last evaluation of this rule")
+    private String statusMessage;
+
+    @SerializedName("checkedon")
+    @Param(description = "When this rule was last evaluated")
+    private Date checkedOn;
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public void setBootGroupId(String bootGroupId) {
+        this.bootGroupId = bootGroupId;
+    }
+
+    public void setItemType(String itemType) {
+        this.itemType = itemType;
+    }
+
+    public void setItemId(String itemId) {
+        this.itemId = itemId;
+    }
+
+    public void setItemName(String itemName) {
+        this.itemName = itemName;
+    }
+
+    public void setRuleType(String ruleType) {
+        this.ruleType = ruleType;
+    }
+
+    public void setEnabled(boolean enabled) {
+        this.enabled = enabled;
+    }
+
+    public void setInherited(boolean inherited) {
+        this.inherited = inherited;
+    }
+
+    public void setDetails(Map<String, String> details) {
+        this.details = details;
+    }
+
+    public void setCreated(Date created) {
+        this.created = created;
+    }
+
+    public void setStatus(String status) {
+        this.status = status;
+    }
+
+    public void setStatusMessage(String statusMessage) {
+        this.statusMessage = statusMessage;
+    }
+
+    public void setCheckedOn(Date checkedOn) {
+        this.checkedOn = checkedOn;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/InstanceBootGroupResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/InstanceBootGroupResponse.java
new file mode 100644
index 000000000000..127eeda17744
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/response/InstanceBootGroupResponse.java
@@ -0,0 +1,160 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.response;
+
+import java.util.Date;
+
+import com.google.gson.annotations.SerializedName;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseResponse;
+import org.apache.cloudstack.api.EntityReference;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroup;
+
+import com.cloud.serializer.Param;
+
+@SuppressWarnings("unused")
+@EntityReference(value = InstanceBootGroup.class)
+public class InstanceBootGroupResponse extends BaseResponse implements ControlledViewEntityResponse {
+
+    @SerializedName(ApiConstants.ID)
+    @Param(description = "The ID of the instance boot group")
+    private String id;
+
+    @SerializedName(ApiConstants.NAME)
+    @Param(description = "The name of the instance boot group")
+    private String name;
+
+    @SerializedName(ApiConstants.DESCRIPTION)
+    @Param(description = "The description of the instance boot group")
+    private String description;
+
+    @SerializedName(ApiConstants.CREATED)
+    @Param(description = "The date the instance boot group was created")
+    private Date created;
+
+    @SerializedName(ApiConstants.ACCOUNT)
+    @Param(description = "The account owning the instance boot group")
+    private String accountName;
+
+    @SerializedName(ApiConstants.ACCOUNT_ID)
+    @Param(description = "The account ID owning the instance boot group")
+    private String accountId;
+
+    @SerializedName(ApiConstants.DOMAIN_ID)
+    @Param(description = "The domain ID of the instance boot group")
+    private String domainId;
+
+    @SerializedName(ApiConstants.DOMAIN)
+    @Param(description = "The domain name of the instance boot group")
+    private String domainName;
+
+    @SerializedName(ApiConstants.DOMAIN_PATH)
+    @Param(description = "The path of the domain the instance boot group belongs to")
+    private String domainPath;
+
+    @SerializedName(ApiConstants.PROJECT_ID)
+    @Param(description = "The project ID of the instance boot group")
+    private String projectId;
+
+    @SerializedName(ApiConstants.PROJECT)
+    @Param(description = "The project name of the instance boot group")
+    private String projectName;
+
+    @SerializedName(ApiConstants.READINESS_ATTEMPT_TIMEOUT_SECONDS)
+    @Param(description = "Effective timeout in seconds for each readiness retry attempt (per-boot-group override if set, else the global default)")
+    private long readinessAttemptTimeoutSeconds;
+
+    @SerializedName(ApiConstants.READINESS_MAX_RETRY_ATTEMPTS)
+    @Param(description = "Effective maximum number of readiness retry attempts (per-boot-group override if set, else the global default)")
+    private long readinessMaxRetryAttempts;
+
+    @SerializedName(ApiConstants.READINESS_REBOOT_ON_RETRY)
+    @Param(description = "Effective setting for whether an instance is rebooted between readiness retry attempts (per-boot-group override if set, else the global default)")
+    private boolean readinessRebootOnRetry;
+
+    @SerializedName(ApiConstants.READINESS_INITIAL_DELAY_SECONDS)
+    @Param(description = "Effective delay in seconds after starting or rebooting an instance before its first readiness check of that attempt (per-boot-group override if set, else the global default)")
+    private long readinessInitialDelaySeconds;
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public void setCreated(Date created) {
+        this.created = created;
+    }
+
+    public void setAccountId(String accountId) {
+        this.accountId = accountId;
+    }
+
+    @Override
+    public void setAccountName(String accountName) {
+        this.accountName = accountName;
+    }
+
+    @Override
+    public void setDomainId(String domainId) {
+        this.domainId = domainId;
+    }
+
+    @Override
+    public void setDomainName(String domainName) {
+        this.domainName = domainName;
+    }
+
+    @Override
+    public void setDomainPath(String domainPath) {
+        this.domainPath = domainPath;
+    }
+
+    @Override
+    public void setProjectId(String projectId) {
+        this.projectId = projectId;
+    }
+
+    @Override
+    public void setProjectName(String projectName) {
+        this.projectName = projectName;
+    }
+
+    public void setReadinessAttemptTimeoutSeconds(long readinessAttemptTimeoutSeconds) {
+        this.readinessAttemptTimeoutSeconds = readinessAttemptTimeoutSeconds;
+    }
+
+    public void setReadinessMaxRetryAttempts(long readinessMaxRetryAttempts) {
+        this.readinessMaxRetryAttempts = readinessMaxRetryAttempts;
+    }
+
+    public void setReadinessRebootOnRetry(boolean readinessRebootOnRetry) {
+        this.readinessRebootOnRetry = readinessRebootOnRetry;
+    }
+
+    public void setReadinessInitialDelaySeconds(long readinessInitialDelaySeconds) {
+        this.readinessInitialDelaySeconds = readinessInitialDelaySeconds;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroup.java b/api/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroup.java
new file mode 100644
index 000000000000..f22a4f4b8e98
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroup.java
@@ -0,0 +1,33 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup;
+
+import java.util.Date;
+
+import org.apache.cloudstack.acl.ControlledEntity;
+import org.apache.cloudstack.api.Identity;
+import org.apache.cloudstack.api.InternalIdentity;
+
+public interface InstanceBootGroup extends ControlledEntity, Identity, InternalIdentity {
+
+    String getName();
+
+    String getDescription();
+
+    Date getCreated();
+}
diff --git a/api/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupMember.java b/api/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupMember.java
new file mode 100644
index 000000000000..8f070634c040
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupMember.java
@@ -0,0 +1,44 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup;
+
+import java.util.Date;
+
+import org.apache.cloudstack.api.Identity;
+import org.apache.cloudstack.api.InternalIdentity;
+
+public interface InstanceBootGroupMember extends Identity, InternalIdentity {
+
+    long getBootGroupId();
+
+    MemberType getMemberType();
+
+    long getMemberId();
+
+    int getBootOrder();
+
+    Date getCreated();
+
+    enum MemberType {
+        VirtualMachine, InstanceGroup
+    }
+
+    enum ReadinessMode {
+        None, RuleBased, ChildDependent
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupService.java b/api/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupService.java
new file mode 100644
index 000000000000..111bf4c50840
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupService.java
@@ -0,0 +1,81 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup;
+
+import org.apache.cloudstack.api.command.user.bootgroup.AddMemberToInstanceBootGroupCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.CreateInstanceBootGroupCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.CreateInstanceBootGroupReadinessRuleCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.DeleteInstanceBootGroupCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.DeleteInstanceBootGroupReadinessRuleCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.ListInstanceBootGroupMembersCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.ListInstanceBootGroupReadinessRulesCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.ListInstanceBootGroupsCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.RebootInstanceBootGroupCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.RemoveInstanceBootGroupMemberCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.StartInstanceBootGroupCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.StopInstanceBootGroupCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.UpdateInstanceBootGroupCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.UpdateInstanceBootGroupMemberCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.UpdateInstanceBootGroupReadinessRuleCmd;
+import org.apache.cloudstack.api.response.InstanceBootGroupMemberResponse;
+import org.apache.cloudstack.api.response.InstanceBootGroupReadinessRuleResponse;
+import org.apache.cloudstack.api.response.InstanceBootGroupResponse;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
+
+public interface InstanceBootGroupService {
+
+    InstanceBootGroup createInstanceBootGroup(CreateInstanceBootGroupCmd cmd);
+
+    boolean deleteInstanceBootGroup(DeleteInstanceBootGroupCmd cmd);
+
+    InstanceBootGroup updateInstanceBootGroup(UpdateInstanceBootGroupCmd cmd);
+
+    ListResponse<InstanceBootGroupResponse> listInstanceBootGroups(ListInstanceBootGroupsCmd cmd);
+
+    InstanceBootGroupMember addMemberToInstanceBootGroup(AddMemberToInstanceBootGroupCmd cmd);
+
+    boolean removeInstanceBootGroupMember(RemoveInstanceBootGroupMemberCmd cmd);
+
+    InstanceBootGroupMember updateInstanceBootGroupMember(UpdateInstanceBootGroupMemberCmd cmd);
+
+    ListResponse<InstanceBootGroupMemberResponse> listInstanceBootGroupMembers(ListInstanceBootGroupMembersCmd cmd);
+
+    InstanceBootGroup startInstanceBootGroup(StartInstanceBootGroupCmd cmd);
+
+    InstanceBootGroup stopInstanceBootGroup(StopInstanceBootGroupCmd cmd);
+
+    InstanceBootGroup rebootInstanceBootGroup(RebootInstanceBootGroupCmd cmd);
+
+    InstanceBootGroupResponse createInstanceBootGroupResponse(long id);
+
+    InstanceBootGroupMemberResponse createInstanceBootGroupMemberResponse(InstanceBootGroupMember member);
+
+    InstanceBootGroupReadinessRule createInstanceBootGroupReadinessRule(CreateInstanceBootGroupReadinessRuleCmd cmd);
+
+    InstanceBootGroupReadinessRule updateInstanceBootGroupReadinessRule(UpdateInstanceBootGroupReadinessRuleCmd cmd);
+
+    boolean deleteInstanceBootGroupReadinessRule(DeleteInstanceBootGroupReadinessRuleCmd cmd);
+
+    ListResponse<InstanceBootGroupReadinessRuleResponse> listInstanceBootGroupReadinessRules(ListInstanceBootGroupReadinessRulesCmd cmd);
+
+    InstanceBootGroupReadinessRuleResponse createInstanceBootGroupReadinessRuleResponse(InstanceBootGroupReadinessRule rule);
+
+    Long getInstanceBootGroupIdForMember(long memberId);
+
+}
diff --git a/api/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceBootGroupReadinessRule.java b/api/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceBootGroupReadinessRule.java
new file mode 100644
index 000000000000..e1933f9c6d12
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceBootGroupReadinessRule.java
@@ -0,0 +1,81 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup.readiness;
+
+import java.util.Date;
+
+import org.apache.cloudstack.api.Identity;
+import org.apache.cloudstack.api.InternalIdentity;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMember;
+
+/**
+ * A readiness rule always belongs to exactly one boot group and references one "item" within it:
+ * a direct {@code VirtualMachine}-type member, a direct {@code InstanceGroup}-type member, or a VM
+ * sitting inside one of the boot group's {@code InstanceGroup}-type members (no member row of its
+ * own, referenced directly by VM id).
+ */
+public interface InstanceBootGroupReadinessRule extends Identity, InternalIdentity {
+
+    long getBootGroupId();
+
+    InstanceBootGroupMember.MemberType getItemType();
+
+    long getItemId();
+
+    RuleType getRuleType();
+
+    String getName();
+
+    boolean isEnabled();
+
+    Date getCreated();
+
+    /**
+     * Which rule types are valid depends on {@link InstanceBootGroupMember.MemberType},
+     * hypervisor-agnostic at the DB/API layer (no qemu/KVM naming stored). Ping/PortCheck/
+     * GuestAgentLiveness apply to VirtualMachine items; MemberQuorum applies to InstanceGroup
+     * items. CustomScript is reserved for a future checker/evaluator implementation and is not
+     * currently accepted by the API for either item type.
+     */
+    enum RuleType {
+        GuestAgentLiveness(true),
+        Ping(true),
+        PortCheck(true),
+        CustomScript(false),
+        MemberQuorum(false);
+
+        private final boolean memberTargeted;
+
+        RuleType(boolean memberTargeted) {
+            this.memberTargeted = memberTargeted;
+        }
+
+        /**
+         * True for a rule type that, when attached to an InstanceGroup, is evaluated against every
+         * current member individually and inherited by each member's own readiness — unlike
+         * MemberQuorum, which only ever operates at group scope.
+         */
+        public boolean isMemberTargeted() {
+            return memberTargeted;
+        }
+    }
+
+    enum Status {
+        Ready, NotReady, Error, Unknown
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/ReadinessChecker.java b/api/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/ReadinessChecker.java
new file mode 100644
index 000000000000..cb66ad2b1d82
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/ReadinessChecker.java
@@ -0,0 +1,93 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup.readiness;
+
+import java.util.Map;
+
+import org.apache.logging.log4j.Level;
+import org.apache.logging.log4j.Logger;
+
+/**
+ * Strategy interface for evaluating one readiness rule type. Implementations are collected by
+ * {@code InstanceBootGroupReadinessRuleManagerImpl} via Spring's {@code List<ReadinessChecker>}
+ * autowiring and dispatched by {@link #getRuleType()} — an internal implementation detail, not
+ * API-facing, so left unprefixed.
+ */
+public interface ReadinessChecker {
+
+    /**
+     * Below this much remaining budget, a checker should not even attempt to dispatch a remote
+     * command — there isn't enough time left for a meaningful wait, and dispatching anyway would
+     * either use an unhelpfully tiny (or, worse, a zero/negative, which some transports treat as "no
+     * override, use the default") wait value.
+     */
+    long MIN_REMAINING_MS_TO_DISPATCH = 2000L;
+
+    InstanceBootGroupReadinessRule.RuleType getRuleType();
+
+    /**
+     * @param remainingMs time budget left for this VM's current attempt; bound any remote dispatch
+     *        to it (e.g. via {@code Command.setWait}) and return {@code Status.Error} directly if
+     *        it's already too small to be worth dispatching.
+     */
+    Result check(InstanceBootGroupReadinessRule rule, Map<String, String> details, long vmId, long remainingMs);
+
+    class Result {
+        private final InstanceBootGroupReadinessRule.Status status;
+        private final String message;
+
+        public Result(InstanceBootGroupReadinessRule.Status status, String message) {
+            this.status = status;
+            this.message = message;
+        }
+
+        public InstanceBootGroupReadinessRule.Status getStatus() {
+            return status;
+        }
+
+        public String getMessage() {
+            return message;
+        }
+    }
+
+    default Logger getLogger() {
+        return null;
+    }
+
+    default Result logAndReturn(InstanceBootGroupReadinessRule rule, Object vmOrId, Result result) {
+        Logger log = getLogger();
+        if (log == null) {
+            return result;
+        }
+        Level level = InstanceBootGroupReadinessRule.Status.Ready.equals(result.getStatus())
+                ? Level.DEBUG
+                : Level.WARN;
+
+        log.log(level, "{} evaluated for {}: status={}, message={}",
+                rule, vmOrId, result.getStatus(), result.getMessage());
+        return result;
+    }
+
+    /**
+     * Halves the remaining budget and floors at 1 second for {@code Command.setWait}, which doubles
+     * whatever value it's given and treats 0 as "use the global default" rather than "no wait".
+     */
+    default int computeWaitSeconds(long remainingMs) {
+        return (int) Math.max(1, remainingMs / 2000);
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/AddMemberToInstanceBootGroupCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/AddMemberToInstanceBootGroupCmdTest.java
new file mode 100644
index 000000000000..45880112bcad
--- /dev/null
+++ b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/AddMemberToInstanceBootGroupCmdTest.java
@@ -0,0 +1,95 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.InstanceBootGroupMemberResponse;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMember;
+import org.junit.Test;
+
+public class AddMemberToInstanceBootGroupCmdTest extends BaseBootGroupCmdTest {
+
+    private AddMemberToInstanceBootGroupCmd createCmd() throws Exception {
+        AddMemberToInstanceBootGroupCmd cmd = new AddMemberToInstanceBootGroupCmd();
+        setField(cmd, "instanceBootGroupService", instanceBootGroupService);
+        setField(cmd, "id", ENTITY_ID);
+        setField(cmd, "virtualMachineId", 500L);
+        setField(cmd, "order", 2);
+        return cmd;
+    }
+
+    @Test
+    public void testAccessors() throws Exception {
+        AddMemberToInstanceBootGroupCmd cmd = createCmd();
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getId());
+        assertEquals(Long.valueOf(500L), cmd.getVirtualMachineId());
+        assertEquals(2, cmd.getOrder());
+    }
+
+    @Test
+    public void testGetEntityOwnerId() throws Exception {
+        AddMemberToInstanceBootGroupCmd cmd = createCmd();
+        assertEquals(ACCOUNT_ID, cmd.getEntityOwnerId());
+    }
+
+    @Test
+    public void testGetApiResourceType() throws Exception {
+        AddMemberToInstanceBootGroupCmd cmd = createCmd();
+        assertEquals(ApiCommandResourceType.InstanceBootGroup, cmd.getApiResourceType());
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getApiResourceId());
+    }
+
+    @Test
+    public void testExecuteSuccess() throws Exception {
+        AddMemberToInstanceBootGroupCmd cmd = createCmd();
+
+        InstanceBootGroupMember member = mock(InstanceBootGroupMember.class);
+        InstanceBootGroupMemberResponse mockResponse = new InstanceBootGroupMemberResponse();
+
+        when(instanceBootGroupService.addMemberToInstanceBootGroup(cmd)).thenReturn(member);
+        when(instanceBootGroupService.createInstanceBootGroupMemberResponse(member)).thenReturn(mockResponse);
+
+        cmd.execute();
+
+        InstanceBootGroupMemberResponse response = (InstanceBootGroupMemberResponse) cmd.getResponseObject();
+        assertNotNull(response);
+        assertEquals("addmembertoinstancebootgroupresponse", response.getResponseName());
+        verify(instanceBootGroupService).addMemberToInstanceBootGroup(cmd);
+        verify(instanceBootGroupService).createInstanceBootGroupMemberResponse(member);
+    }
+
+    @Test(expected = ServerApiException.class)
+    public void testExecuteReturnsNull() throws Exception {
+        AddMemberToInstanceBootGroupCmd cmd = createCmd();
+        when(instanceBootGroupService.addMemberToInstanceBootGroup(cmd)).thenReturn(null);
+        cmd.execute();
+    }
+
+    @Test(expected = RuntimeException.class)
+    public void testExecutePropagatesServiceException() throws Exception {
+        AddMemberToInstanceBootGroupCmd cmd = createCmd();
+        when(instanceBootGroupService.addMemberToInstanceBootGroup(cmd)).thenThrow(new RuntimeException("conflict"));
+        cmd.execute();
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/BaseBootGroupCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/BaseBootGroupCmdTest.java
new file mode 100644
index 000000000000..f3d62d207733
--- /dev/null
+++ b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/BaseBootGroupCmdTest.java
@@ -0,0 +1,88 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.lang.reflect.Field;
+
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupService;
+import org.junit.After;
+import org.junit.Before;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+
+import com.cloud.user.Account;
+import com.cloud.user.AccountService;
+
+/**
+ * Shared setup for all Instance Boot Group command unit tests.
+ */
+public abstract class BaseBootGroupCmdTest {
+
+    protected static final long ACCOUNT_ID = 42L;
+    protected static final long ENTITY_ID = 100L;
+
+    protected InstanceBootGroupService instanceBootGroupService;
+    protected AccountService accountService;
+    protected Account callingAccount;
+
+    private MockedStatic<CallContext> callContextMock;
+
+    @Before
+    public void setUp() {
+        instanceBootGroupService = mock(InstanceBootGroupService.class);
+        accountService = mock(AccountService.class);
+
+        callingAccount = mock(Account.class);
+        when(callingAccount.getId()).thenReturn(ACCOUNT_ID);
+
+        CallContext callContext = mock(CallContext.class);
+        when(callContext.getCallingAccount()).thenReturn(callingAccount);
+
+        callContextMock = Mockito.mockStatic(CallContext.class);
+        callContextMock.when(CallContext::current).thenReturn(callContext);
+    }
+
+    @After
+    public void tearDown() {
+        callContextMock.close();
+    }
+
+    /**
+     * Sets a private/inherited field value via reflection.
+     */
+    protected void setField(Object target, String fieldName, Object value) throws Exception {
+        Field field = null;
+        Class<?> clazz = target.getClass();
+        while (clazz != null) {
+            try {
+                field = clazz.getDeclaredField(fieldName);
+                break;
+            } catch (NoSuchFieldException e) {
+                clazz = clazz.getSuperclass();
+            }
+        }
+        if (field == null) {
+            throw new NoSuchFieldException(fieldName + " not found in hierarchy of " + target.getClass().getName());
+        }
+        field.setAccessible(true);
+        field.set(target, value);
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/CreateInstanceBootGroupCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/CreateInstanceBootGroupCmdTest.java
new file mode 100644
index 000000000000..c6352dcc94ef
--- /dev/null
+++ b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/CreateInstanceBootGroupCmdTest.java
@@ -0,0 +1,107 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.InstanceBootGroupResponse;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroup;
+import org.junit.Test;
+
+public class CreateInstanceBootGroupCmdTest extends BaseBootGroupCmdTest {
+
+    private CreateInstanceBootGroupCmd createCmd() throws Exception {
+        CreateInstanceBootGroupCmd cmd = new CreateInstanceBootGroupCmd();
+        setField(cmd, "instanceBootGroupService", instanceBootGroupService);
+        setField(cmd, "_accountService", accountService);
+        setField(cmd, "name", "web-tier");
+        setField(cmd, "description", "web tier boot group");
+        setField(cmd, "readinessAttemptTimeoutSeconds", 120L);
+        setField(cmd, "readinessMaxRetryAttempts", 3L);
+        setField(cmd, "readinessRebootOnRetry", true);
+        setField(cmd, "readinessInitialDelaySeconds", 15L);
+        return cmd;
+    }
+
+    @Test
+    public void testAccessors() throws Exception {
+        CreateInstanceBootGroupCmd cmd = createCmd();
+        assertEquals("web-tier", cmd.getName());
+        assertEquals("web tier boot group", cmd.getDescription());
+        assertEquals(Long.valueOf(120L), cmd.getReadinessAttemptTimeoutSeconds());
+        assertEquals(Long.valueOf(3L), cmd.getReadinessMaxRetryAttempts());
+        assertEquals(Boolean.TRUE, cmd.getReadinessRebootOnRetry());
+        assertEquals(Long.valueOf(15L), cmd.getReadinessInitialDelaySeconds());
+    }
+
+    @Test
+    public void testGetEntityOwnerIdResolvedFromAccount() throws Exception {
+        CreateInstanceBootGroupCmd cmd = createCmd();
+        setField(cmd, "accountName", "someaccount");
+        setField(cmd, "domainId", 5L);
+        when(accountService.finalizeAccountId("someaccount", 5L, null, true)).thenReturn(200L);
+
+        assertEquals(200L, cmd.getEntityOwnerId());
+    }
+
+    @Test
+    public void testGetEntityOwnerIdFallsBackToCaller() throws Exception {
+        CreateInstanceBootGroupCmd cmd = createCmd();
+        when(accountService.finalizeAccountId(null, null, null, true)).thenReturn(null);
+
+        assertEquals(ACCOUNT_ID, cmd.getEntityOwnerId());
+    }
+
+    @Test
+    public void testExecuteSuccess() throws Exception {
+        CreateInstanceBootGroupCmd cmd = createCmd();
+
+        InstanceBootGroup group = mock(InstanceBootGroup.class);
+        when(group.getId()).thenReturn(ENTITY_ID);
+        InstanceBootGroupResponse mockResponse = new InstanceBootGroupResponse();
+
+        when(instanceBootGroupService.createInstanceBootGroup(cmd)).thenReturn(group);
+        when(instanceBootGroupService.createInstanceBootGroupResponse(ENTITY_ID)).thenReturn(mockResponse);
+
+        cmd.execute();
+
+        InstanceBootGroupResponse response = (InstanceBootGroupResponse) cmd.getResponseObject();
+        assertNotNull(response);
+        assertEquals("createinstancebootgroupresponse", response.getResponseName());
+        verify(instanceBootGroupService).createInstanceBootGroup(cmd);
+        verify(instanceBootGroupService).createInstanceBootGroupResponse(ENTITY_ID);
+    }
+
+    @Test(expected = ServerApiException.class)
+    public void testExecuteReturnsNull() throws Exception {
+        CreateInstanceBootGroupCmd cmd = createCmd();
+        when(instanceBootGroupService.createInstanceBootGroup(cmd)).thenReturn(null);
+        cmd.execute();
+    }
+
+    @Test(expected = RuntimeException.class)
+    public void testExecutePropagatesServiceException() throws Exception {
+        CreateInstanceBootGroupCmd cmd = createCmd();
+        when(instanceBootGroupService.createInstanceBootGroup(cmd)).thenThrow(new RuntimeException("db error"));
+        cmd.execute();
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/CreateInstanceBootGroupReadinessRuleCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/CreateInstanceBootGroupReadinessRuleCmdTest.java
new file mode 100644
index 000000000000..7efb8ec4c797
--- /dev/null
+++ b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/CreateInstanceBootGroupReadinessRuleCmdTest.java
@@ -0,0 +1,158 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.InstanceBootGroupReadinessRuleResponse;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
+import org.junit.Test;
+
+public class CreateInstanceBootGroupReadinessRuleCmdTest extends BaseBootGroupCmdTest {
+
+    private CreateInstanceBootGroupReadinessRuleCmd createCmd() throws Exception {
+        CreateInstanceBootGroupReadinessRuleCmd cmd = new CreateInstanceBootGroupReadinessRuleCmd();
+        setField(cmd, "instanceBootGroupService", instanceBootGroupService);
+        setField(cmd, "bootGroupId", ENTITY_ID);
+        setField(cmd, "virtualMachineId", 500L);
+        setField(cmd, "instanceGroupId", null);
+        setField(cmd, "ruleType", "PortCheck");
+        setField(cmd, "name", "port-check-rule");
+        return cmd;
+    }
+
+    @Test
+    public void testAccessors() throws Exception {
+        CreateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getBootGroupId());
+        assertEquals(Long.valueOf(500L), cmd.getVirtualMachineId());
+        assertNull(cmd.getInstanceGroupId());
+        assertEquals("PortCheck", cmd.getRuleType());
+        assertEquals("port-check-rule", cmd.getName());
+    }
+
+    @Test
+    public void testGetEntityOwnerId() throws Exception {
+        CreateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        assertEquals(ACCOUNT_ID, cmd.getEntityOwnerId());
+    }
+
+    @Test
+    public void testGetApiResourceType() throws Exception {
+        CreateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        assertEquals(ApiCommandResourceType.InstanceBootGroupReadinessRule, cmd.getApiResourceType());
+    }
+
+    @Test
+    public void testIsEnabledDefaultsToTrueWhenNull() throws Exception {
+        CreateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        setField(cmd, "enabled", null);
+        assertTrue(cmd.isEnabled());
+    }
+
+    @Test
+    public void testIsEnabledFalse() throws Exception {
+        CreateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        setField(cmd, "enabled", false);
+        assertFalse(cmd.isEnabled());
+    }
+
+    @Test
+    public void testIsEnabledTrue() throws Exception {
+        CreateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        setField(cmd, "enabled", true);
+        assertTrue(cmd.isEnabled());
+    }
+
+    @Test
+    public void testGetDetailsNull() throws Exception {
+        CreateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        setField(cmd, "details", null);
+        assertNull(cmd.getDetails());
+    }
+
+    @Test
+    public void testGetDetailsEmptyMap() throws Exception {
+        CreateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        setField(cmd, "details", new HashMap<>());
+        assertNull(cmd.getDetails());
+    }
+
+    @Test
+    public void testGetDetailsPopulatedMap() throws Exception {
+        CreateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+
+        Map<String, String> innerMap = new HashMap<>();
+        innerMap.put("port", "8080");
+        innerMap.put("protocol", "tcp");
+
+        Map<String, Map<String, String>> outerMap = new HashMap<>();
+        outerMap.put("0", innerMap);
+
+        setField(cmd, "details", outerMap);
+
+        Map<String, String> details = cmd.getDetails();
+        assertNotNull(details);
+        assertEquals("8080", details.get("port"));
+        assertEquals("tcp", details.get("protocol"));
+    }
+
+    @Test
+    public void testExecuteSuccess() throws Exception {
+        CreateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+
+        InstanceBootGroupReadinessRule rule = mock(InstanceBootGroupReadinessRule.class);
+        InstanceBootGroupReadinessRuleResponse mockResponse = new InstanceBootGroupReadinessRuleResponse();
+
+        when(instanceBootGroupService.createInstanceBootGroupReadinessRule(cmd)).thenReturn(rule);
+        when(instanceBootGroupService.createInstanceBootGroupReadinessRuleResponse(rule)).thenReturn(mockResponse);
+
+        cmd.execute();
+
+        InstanceBootGroupReadinessRuleResponse response = (InstanceBootGroupReadinessRuleResponse) cmd.getResponseObject();
+        assertNotNull(response);
+        assertEquals("createinstancebootgroupreadinessruleresponse", response.getResponseName());
+        verify(instanceBootGroupService).createInstanceBootGroupReadinessRule(cmd);
+        verify(instanceBootGroupService).createInstanceBootGroupReadinessRuleResponse(rule);
+    }
+
+    @Test(expected = ServerApiException.class)
+    public void testExecuteReturnsNull() throws Exception {
+        CreateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        when(instanceBootGroupService.createInstanceBootGroupReadinessRule(cmd)).thenReturn(null);
+        cmd.execute();
+    }
+
+    @Test(expected = RuntimeException.class)
+    public void testExecutePropagatesServiceException() throws Exception {
+        CreateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        when(instanceBootGroupService.createInstanceBootGroupReadinessRule(cmd)).thenThrow(new RuntimeException("db error"));
+        cmd.execute();
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/DeleteInstanceBootGroupCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/DeleteInstanceBootGroupCmdTest.java
new file mode 100644
index 000000000000..503efc5e94b1
--- /dev/null
+++ b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/DeleteInstanceBootGroupCmdTest.java
@@ -0,0 +1,83 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.SuccessResponse;
+import org.junit.Test;
+
+public class DeleteInstanceBootGroupCmdTest extends BaseBootGroupCmdTest {
+
+    private DeleteInstanceBootGroupCmd createCmd() throws Exception {
+        DeleteInstanceBootGroupCmd cmd = new DeleteInstanceBootGroupCmd();
+        setField(cmd, "instanceBootGroupService", instanceBootGroupService);
+        setField(cmd, "id", ENTITY_ID);
+        return cmd;
+    }
+
+    @Test
+    public void testAccessors() throws Exception {
+        DeleteInstanceBootGroupCmd cmd = createCmd();
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getId());
+    }
+
+    @Test
+    public void testGetEntityOwnerId() throws Exception {
+        DeleteInstanceBootGroupCmd cmd = createCmd();
+        assertEquals(ACCOUNT_ID, cmd.getEntityOwnerId());
+    }
+
+    @Test
+    public void testGetApiResourceType() throws Exception {
+        DeleteInstanceBootGroupCmd cmd = createCmd();
+        assertEquals(ApiCommandResourceType.InstanceBootGroup, cmd.getApiResourceType());
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getApiResourceId());
+    }
+
+    @Test
+    public void testExecuteSuccess() throws Exception {
+        DeleteInstanceBootGroupCmd cmd = createCmd();
+        when(instanceBootGroupService.deleteInstanceBootGroup(cmd)).thenReturn(true);
+
+        cmd.execute();
+
+        SuccessResponse response = (SuccessResponse) cmd.getResponseObject();
+        assertNotNull(response);
+        assertEquals("deleteinstancebootgroupresponse", response.getResponseName());
+        verify(instanceBootGroupService).deleteInstanceBootGroup(cmd);
+    }
+
+    @Test(expected = ServerApiException.class)
+    public void testExecuteReturnsFalse() throws Exception {
+        DeleteInstanceBootGroupCmd cmd = createCmd();
+        when(instanceBootGroupService.deleteInstanceBootGroup(cmd)).thenReturn(false);
+        cmd.execute();
+    }
+
+    @Test(expected = RuntimeException.class)
+    public void testExecutePropagatesServiceException() throws Exception {
+        DeleteInstanceBootGroupCmd cmd = createCmd();
+        when(instanceBootGroupService.deleteInstanceBootGroup(cmd)).thenThrow(new RuntimeException("db error"));
+        cmd.execute();
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/DeleteInstanceBootGroupReadinessRuleCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/DeleteInstanceBootGroupReadinessRuleCmdTest.java
new file mode 100644
index 000000000000..d31803703a3e
--- /dev/null
+++ b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/DeleteInstanceBootGroupReadinessRuleCmdTest.java
@@ -0,0 +1,83 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.SuccessResponse;
+import org.junit.Test;
+
+public class DeleteInstanceBootGroupReadinessRuleCmdTest extends BaseBootGroupCmdTest {
+
+    private DeleteInstanceBootGroupReadinessRuleCmd createCmd() throws Exception {
+        DeleteInstanceBootGroupReadinessRuleCmd cmd = new DeleteInstanceBootGroupReadinessRuleCmd();
+        setField(cmd, "instanceBootGroupService", instanceBootGroupService);
+        setField(cmd, "id", ENTITY_ID);
+        return cmd;
+    }
+
+    @Test
+    public void testAccessors() throws Exception {
+        DeleteInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getId());
+    }
+
+    @Test
+    public void testGetEntityOwnerId() throws Exception {
+        DeleteInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        assertEquals(ACCOUNT_ID, cmd.getEntityOwnerId());
+    }
+
+    @Test
+    public void testGetApiResourceType() throws Exception {
+        DeleteInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        assertEquals(ApiCommandResourceType.InstanceBootGroupReadinessRule, cmd.getApiResourceType());
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getApiResourceId());
+    }
+
+    @Test
+    public void testExecuteSuccess() throws Exception {
+        DeleteInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        when(instanceBootGroupService.deleteInstanceBootGroupReadinessRule(cmd)).thenReturn(true);
+
+        cmd.execute();
+
+        SuccessResponse response = (SuccessResponse) cmd.getResponseObject();
+        assertNotNull(response);
+        assertEquals("deleteinstancebootgroupreadinessruleresponse", response.getResponseName());
+        verify(instanceBootGroupService).deleteInstanceBootGroupReadinessRule(cmd);
+    }
+
+    @Test(expected = ServerApiException.class)
+    public void testExecuteReturnsFalse() throws Exception {
+        DeleteInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        when(instanceBootGroupService.deleteInstanceBootGroupReadinessRule(cmd)).thenReturn(false);
+        cmd.execute();
+    }
+
+    @Test(expected = RuntimeException.class)
+    public void testExecutePropagatesServiceException() throws Exception {
+        DeleteInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        when(instanceBootGroupService.deleteInstanceBootGroupReadinessRule(cmd)).thenThrow(new RuntimeException("db error"));
+        cmd.execute();
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupMembersCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupMembersCmdTest.java
new file mode 100644
index 000000000000..3a9f34fef4d6
--- /dev/null
+++ b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupMembersCmdTest.java
@@ -0,0 +1,143 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.when;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+
+import org.apache.cloudstack.api.response.InstanceBootGroupMemberResponse;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.junit.Test;
+
+public class ListInstanceBootGroupMembersCmdTest extends BaseBootGroupCmdTest {
+
+    private ListInstanceBootGroupMembersCmd createCmd() throws Exception {
+        ListInstanceBootGroupMembersCmd cmd = new ListInstanceBootGroupMembersCmd();
+        setField(cmd, "instanceBootGroupService", instanceBootGroupService);
+        setField(cmd, "bootGroupId", ENTITY_ID);
+        setField(cmd, "memberType", "VirtualMachine");
+        return cmd;
+    }
+
+    @Test
+    public void testAccessors() throws Exception {
+        ListInstanceBootGroupMembersCmd cmd = createCmd();
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getBootGroupId());
+        assertEquals("VirtualMachine", cmd.getMemberType());
+    }
+
+    @Test
+    public void testIsIgnoreInstanceStateNull() throws Exception {
+        ListInstanceBootGroupMembersCmd cmd = createCmd();
+        assertFalse(cmd.isIgnoreInstanceState());
+    }
+
+    @Test
+    public void testIsIgnoreInstanceStateFalse() throws Exception {
+        ListInstanceBootGroupMembersCmd cmd = createCmd();
+        setField(cmd, "ignoreInstanceState", false);
+        assertFalse(cmd.isIgnoreInstanceState());
+    }
+
+    @Test
+    public void testIsIgnoreInstanceStateTrue() throws Exception {
+        ListInstanceBootGroupMembersCmd cmd = createCmd();
+        setField(cmd, "ignoreInstanceState", true);
+        assertTrue(cmd.isIgnoreInstanceState());
+    }
+
+    @Test
+    public void testDetailFlagsNullList() throws Exception {
+        ListInstanceBootGroupMembersCmd cmd = createCmd();
+        assertFalse(cmd.isReadinessDetailRequested());
+        assertFalse(cmd.isChildrenDetailRequested());
+    }
+
+    @Test
+    public void testDetailFlagsEmptyList() throws Exception {
+        ListInstanceBootGroupMembersCmd cmd = createCmd();
+        setField(cmd, "viewDetails", Collections.emptyList());
+        assertFalse(cmd.isReadinessDetailRequested());
+        assertFalse(cmd.isChildrenDetailRequested());
+    }
+
+    @Test
+    public void testDetailFlagsListWithoutKeyword() throws Exception {
+        ListInstanceBootGroupMembersCmd cmd = createCmd();
+        setField(cmd, "viewDetails", Collections.singletonList("other"));
+        assertFalse(cmd.isReadinessDetailRequested());
+        assertFalse(cmd.isChildrenDetailRequested());
+    }
+
+    @Test
+    public void testDetailFlagsReadinessOnly() throws Exception {
+        ListInstanceBootGroupMembersCmd cmd = createCmd();
+        List<String> details = Collections.singletonList("readiness");
+        setField(cmd, "viewDetails", details);
+        assertTrue(cmd.isReadinessDetailRequested());
+        assertFalse(cmd.isChildrenDetailRequested());
+    }
+
+    @Test
+    public void testDetailFlagsChildrenOnly() throws Exception {
+        ListInstanceBootGroupMembersCmd cmd = createCmd();
+        List<String> details = Collections.singletonList("children");
+        setField(cmd, "viewDetails", details);
+        assertFalse(cmd.isReadinessDetailRequested());
+        assertTrue(cmd.isChildrenDetailRequested());
+    }
+
+    @Test
+    public void testDetailFlagsAll() throws Exception {
+        ListInstanceBootGroupMembersCmd cmd = createCmd();
+        List<String> details = Collections.singletonList("all");
+        setField(cmd, "viewDetails", details);
+        assertTrue(cmd.isReadinessDetailRequested());
+        assertTrue(cmd.isChildrenDetailRequested());
+    }
+
+    @Test
+    public void testDetailFlagsBothExplicit() throws Exception {
+        ListInstanceBootGroupMembersCmd cmd = createCmd();
+        List<String> details = Arrays.asList("readiness", "children");
+        setField(cmd, "viewDetails", details);
+        assertTrue(cmd.isReadinessDetailRequested());
+        assertTrue(cmd.isChildrenDetailRequested());
+    }
+
+    @Test
+    public void testExecute() throws Exception {
+        ListInstanceBootGroupMembersCmd cmd = createCmd();
+
+        ListResponse<InstanceBootGroupMemberResponse> mockListResponse = new ListResponse<>();
+        when(instanceBootGroupService.listInstanceBootGroupMembers(cmd)).thenReturn(mockListResponse);
+
+        cmd.execute();
+
+        @SuppressWarnings("unchecked")
+        ListResponse<InstanceBootGroupMemberResponse> response = (ListResponse<InstanceBootGroupMemberResponse>) cmd.getResponseObject();
+        assertNotNull(response);
+        assertEquals("listinstancebootgroupmembersresponse", response.getResponseName());
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupReadinessRulesCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupReadinessRulesCmdTest.java
new file mode 100644
index 000000000000..92b6f22110ba
--- /dev/null
+++ b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupReadinessRulesCmdTest.java
@@ -0,0 +1,65 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.mockito.Mockito.when;
+
+import org.apache.cloudstack.api.response.InstanceBootGroupReadinessRuleResponse;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.junit.Test;
+
+public class ListInstanceBootGroupReadinessRulesCmdTest extends BaseBootGroupCmdTest {
+
+    private ListInstanceBootGroupReadinessRulesCmd createCmd() throws Exception {
+        ListInstanceBootGroupReadinessRulesCmd cmd = new ListInstanceBootGroupReadinessRulesCmd();
+        setField(cmd, "instanceBootGroupService", instanceBootGroupService);
+        setField(cmd, "bootGroupId", ENTITY_ID);
+        setField(cmd, "id", 700L);
+        setField(cmd, "virtualMachineId", 500L);
+        setField(cmd, "instanceGroupId", 600L);
+        setField(cmd, "ruleType", "Http");
+        return cmd;
+    }
+
+    @Test
+    public void testAccessors() throws Exception {
+        ListInstanceBootGroupReadinessRulesCmd cmd = createCmd();
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getBootGroupId());
+        assertEquals(Long.valueOf(700L), cmd.getId());
+        assertEquals(Long.valueOf(500L), cmd.getVirtualMachineId());
+        assertEquals(Long.valueOf(600L), cmd.getInstanceGroupId());
+        assertEquals("Http", cmd.getRuleType());
+    }
+
+    @Test
+    public void testExecute() throws Exception {
+        ListInstanceBootGroupReadinessRulesCmd cmd = createCmd();
+
+        ListResponse<InstanceBootGroupReadinessRuleResponse> mockListResponse = new ListResponse<>();
+        when(instanceBootGroupService.listInstanceBootGroupReadinessRules(cmd)).thenReturn(mockListResponse);
+
+        cmd.execute();
+
+        @SuppressWarnings("unchecked")
+        ListResponse<InstanceBootGroupReadinessRuleResponse> response =
+                (ListResponse<InstanceBootGroupReadinessRuleResponse>) cmd.getResponseObject();
+        assertNotNull(response);
+        assertEquals("listinstancebootgroupreadinessrulesresponse", response.getResponseName());
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupsCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupsCmdTest.java
new file mode 100644
index 000000000000..599cb05c3ba7
--- /dev/null
+++ b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/ListInstanceBootGroupsCmdTest.java
@@ -0,0 +1,62 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.mockito.Mockito.when;
+
+import org.apache.cloudstack.api.response.InstanceBootGroupResponse;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.junit.Test;
+
+public class ListInstanceBootGroupsCmdTest extends BaseBootGroupCmdTest {
+
+    private ListInstanceBootGroupsCmd createCmd() throws Exception {
+        ListInstanceBootGroupsCmd cmd = new ListInstanceBootGroupsCmd();
+        setField(cmd, "instanceBootGroupService", instanceBootGroupService);
+        setField(cmd, "id", ENTITY_ID);
+        setField(cmd, "keyword", "web");
+        setField(cmd, "virtualMachineId", 500L);
+        setField(cmd, "instanceGroupId", 600L);
+        return cmd;
+    }
+
+    @Test
+    public void testAccessors() throws Exception {
+        ListInstanceBootGroupsCmd cmd = createCmd();
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getId());
+        assertEquals("web", cmd.getKeyword());
+        assertEquals(Long.valueOf(500L), cmd.getVirtualMachineId());
+        assertEquals(Long.valueOf(600L), cmd.getInstanceGroupId());
+    }
+
+    @Test
+    public void testExecute() throws Exception {
+        ListInstanceBootGroupsCmd cmd = createCmd();
+
+        ListResponse<InstanceBootGroupResponse> mockListResponse = new ListResponse<>();
+        when(instanceBootGroupService.listInstanceBootGroups(cmd)).thenReturn(mockListResponse);
+
+        cmd.execute();
+
+        @SuppressWarnings("unchecked")
+        ListResponse<InstanceBootGroupResponse> response = (ListResponse<InstanceBootGroupResponse>) cmd.getResponseObject();
+        assertNotNull(response);
+        assertEquals("listinstancebootgroupsresponse", response.getResponseName());
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/RebootInstanceBootGroupCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/RebootInstanceBootGroupCmdTest.java
new file mode 100644
index 000000000000..a278d4991a9f
--- /dev/null
+++ b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/RebootInstanceBootGroupCmdTest.java
@@ -0,0 +1,118 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.InstanceBootGroupResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroup;
+import org.junit.Test;
+
+import com.cloud.event.EventTypes;
+import com.cloud.utils.exception.CloudRuntimeException;
+
+public class RebootInstanceBootGroupCmdTest extends BaseBootGroupCmdTest {
+
+    private RebootInstanceBootGroupCmd createCmd() throws Exception {
+        RebootInstanceBootGroupCmd cmd = new RebootInstanceBootGroupCmd();
+        setField(cmd, "instanceBootGroupService", instanceBootGroupService);
+        setField(cmd, "id", ENTITY_ID);
+        return cmd;
+    }
+
+    @Test
+    public void testAccessors() throws Exception {
+        RebootInstanceBootGroupCmd cmd = createCmd();
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getId());
+    }
+
+    @Test
+    public void testGetEntityOwnerId() throws Exception {
+        RebootInstanceBootGroupCmd cmd = createCmd();
+        assertEquals(ACCOUNT_ID, cmd.getEntityOwnerId());
+    }
+
+    @Test
+    public void testGetApiResourceType() throws Exception {
+        RebootInstanceBootGroupCmd cmd = createCmd();
+        assertEquals(ApiCommandResourceType.InstanceBootGroup, cmd.getApiResourceType());
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getApiResourceId());
+    }
+
+    @Test
+    public void testEventType() throws Exception {
+        RebootInstanceBootGroupCmd cmd = createCmd();
+        assertEquals(EventTypes.EVENT_INSTANCE_BOOT_GROUP_REBOOT, cmd.getEventType());
+    }
+
+    @Test
+    public void testEventDescription() throws Exception {
+        RebootInstanceBootGroupCmd cmd = createCmd();
+        when(CallContext.current().getApiResourceUuid(ApiConstants.ID)).thenReturn("group-uuid");
+
+        assertEquals("Rebooting Instance Boot Group with ID: group-uuid", cmd.getEventDescription());
+    }
+
+    @Test
+    public void testExecuteSuccess() throws Exception {
+        RebootInstanceBootGroupCmd cmd = createCmd();
+
+        InstanceBootGroup group = mock(InstanceBootGroup.class);
+        when(group.getId()).thenReturn(ENTITY_ID);
+        InstanceBootGroupResponse mockResponse = new InstanceBootGroupResponse();
+
+        when(instanceBootGroupService.rebootInstanceBootGroup(cmd)).thenReturn(group);
+        when(instanceBootGroupService.createInstanceBootGroupResponse(ENTITY_ID)).thenReturn(mockResponse);
+
+        cmd.execute();
+
+        InstanceBootGroupResponse response = (InstanceBootGroupResponse) cmd.getResponseObject();
+        assertNotNull(response);
+        assertEquals("rebootinstancebootgroupresponse", response.getResponseName());
+        verify(instanceBootGroupService).rebootInstanceBootGroup(cmd);
+        verify(instanceBootGroupService).createInstanceBootGroupResponse(ENTITY_ID);
+    }
+
+    @Test(expected = ServerApiException.class)
+    public void testExecuteReturnsNull() throws Exception {
+        RebootInstanceBootGroupCmd cmd = createCmd();
+        when(instanceBootGroupService.rebootInstanceBootGroup(cmd)).thenReturn(null);
+        cmd.execute();
+    }
+
+    @Test(expected = RuntimeException.class)
+    public void testExecutePropagatesServiceException() throws Exception {
+        RebootInstanceBootGroupCmd cmd = createCmd();
+        when(instanceBootGroupService.rebootInstanceBootGroup(cmd)).thenThrow(new RuntimeException("db error"));
+        cmd.execute();
+    }
+
+    @Test(expected = ServerApiException.class)
+    public void testExecuteWrapsCloudRuntimeException() throws Exception {
+        RebootInstanceBootGroupCmd cmd = createCmd();
+        when(instanceBootGroupService.rebootInstanceBootGroup(cmd)).thenThrow(new CloudRuntimeException("cannot reboot"));
+        cmd.execute();
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/RemoveInstanceBootGroupMemberCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/RemoveInstanceBootGroupMemberCmdTest.java
new file mode 100644
index 000000000000..08ef6c5173cf
--- /dev/null
+++ b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/RemoveInstanceBootGroupMemberCmdTest.java
@@ -0,0 +1,85 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.SuccessResponse;
+import org.junit.Test;
+
+public class RemoveInstanceBootGroupMemberCmdTest extends BaseBootGroupCmdTest {
+
+    private RemoveInstanceBootGroupMemberCmd createCmd() throws Exception {
+        RemoveInstanceBootGroupMemberCmd cmd = new RemoveInstanceBootGroupMemberCmd();
+        setField(cmd, "instanceBootGroupService", instanceBootGroupService);
+        setField(cmd, "id", ENTITY_ID);
+        return cmd;
+    }
+
+    @Test
+    public void testAccessors() throws Exception {
+        RemoveInstanceBootGroupMemberCmd cmd = createCmd();
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getId());
+    }
+
+    @Test
+    public void testGetEntityOwnerId() throws Exception {
+        RemoveInstanceBootGroupMemberCmd cmd = createCmd();
+        assertEquals(ACCOUNT_ID, cmd.getEntityOwnerId());
+    }
+
+    @Test
+    public void testGetApiResourceType() throws Exception {
+        RemoveInstanceBootGroupMemberCmd cmd = createCmd();
+        Long groupId = 101L;
+        when(instanceBootGroupService.getInstanceBootGroupIdForMember(ENTITY_ID)).thenReturn(groupId);
+        assertEquals(ApiCommandResourceType.InstanceBootGroup, cmd.getApiResourceType());
+        assertEquals(groupId, cmd.getApiResourceId());
+    }
+
+    @Test
+    public void testExecuteSuccess() throws Exception {
+        RemoveInstanceBootGroupMemberCmd cmd = createCmd();
+        when(instanceBootGroupService.removeInstanceBootGroupMember(cmd)).thenReturn(true);
+
+        cmd.execute();
+
+        SuccessResponse response = (SuccessResponse) cmd.getResponseObject();
+        assertNotNull(response);
+        assertEquals("removeinstancebootgroupmemberresponse", response.getResponseName());
+        verify(instanceBootGroupService).removeInstanceBootGroupMember(cmd);
+    }
+
+    @Test(expected = ServerApiException.class)
+    public void testExecuteReturnsFalse() throws Exception {
+        RemoveInstanceBootGroupMemberCmd cmd = createCmd();
+        when(instanceBootGroupService.removeInstanceBootGroupMember(cmd)).thenReturn(false);
+        cmd.execute();
+    }
+
+    @Test(expected = RuntimeException.class)
+    public void testExecutePropagatesServiceException() throws Exception {
+        RemoveInstanceBootGroupMemberCmd cmd = createCmd();
+        when(instanceBootGroupService.removeInstanceBootGroupMember(cmd)).thenThrow(new RuntimeException("conflict"));
+        cmd.execute();
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/StartInstanceBootGroupCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/StartInstanceBootGroupCmdTest.java
new file mode 100644
index 000000000000..76689a6205d1
--- /dev/null
+++ b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/StartInstanceBootGroupCmdTest.java
@@ -0,0 +1,118 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.InstanceBootGroupResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroup;
+import org.junit.Test;
+
+import com.cloud.event.EventTypes;
+import com.cloud.utils.exception.CloudRuntimeException;
+
+public class StartInstanceBootGroupCmdTest extends BaseBootGroupCmdTest {
+
+    private StartInstanceBootGroupCmd createCmd() throws Exception {
+        StartInstanceBootGroupCmd cmd = new StartInstanceBootGroupCmd();
+        setField(cmd, "instanceBootGroupService", instanceBootGroupService);
+        setField(cmd, "id", ENTITY_ID);
+        return cmd;
+    }
+
+    @Test
+    public void testAccessors() throws Exception {
+        StartInstanceBootGroupCmd cmd = createCmd();
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getId());
+    }
+
+    @Test
+    public void testGetEntityOwnerId() throws Exception {
+        StartInstanceBootGroupCmd cmd = createCmd();
+        assertEquals(ACCOUNT_ID, cmd.getEntityOwnerId());
+    }
+
+    @Test
+    public void testGetApiResourceType() throws Exception {
+        StartInstanceBootGroupCmd cmd = createCmd();
+        assertEquals(ApiCommandResourceType.InstanceBootGroup, cmd.getApiResourceType());
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getApiResourceId());
+    }
+
+    @Test
+    public void testEventType() throws Exception {
+        StartInstanceBootGroupCmd cmd = createCmd();
+        assertEquals(EventTypes.EVENT_INSTANCE_BOOT_GROUP_START, cmd.getEventType());
+    }
+
+    @Test
+    public void testEventDescription() throws Exception {
+        StartInstanceBootGroupCmd cmd = createCmd();
+        when(CallContext.current().getApiResourceUuid(ApiConstants.ID)).thenReturn("group-uuid");
+
+        assertEquals("Starting Instance Boot Group with ID: group-uuid", cmd.getEventDescription());
+    }
+
+    @Test
+    public void testExecuteSuccess() throws Exception {
+        StartInstanceBootGroupCmd cmd = createCmd();
+
+        InstanceBootGroup group = mock(InstanceBootGroup.class);
+        when(group.getId()).thenReturn(ENTITY_ID);
+        InstanceBootGroupResponse mockResponse = new InstanceBootGroupResponse();
+
+        when(instanceBootGroupService.startInstanceBootGroup(cmd)).thenReturn(group);
+        when(instanceBootGroupService.createInstanceBootGroupResponse(ENTITY_ID)).thenReturn(mockResponse);
+
+        cmd.execute();
+
+        InstanceBootGroupResponse response = (InstanceBootGroupResponse) cmd.getResponseObject();
+        assertNotNull(response);
+        assertEquals("startinstancebootgroupresponse", response.getResponseName());
+        verify(instanceBootGroupService).startInstanceBootGroup(cmd);
+        verify(instanceBootGroupService).createInstanceBootGroupResponse(ENTITY_ID);
+    }
+
+    @Test(expected = ServerApiException.class)
+    public void testExecuteReturnsNull() throws Exception {
+        StartInstanceBootGroupCmd cmd = createCmd();
+        when(instanceBootGroupService.startInstanceBootGroup(cmd)).thenReturn(null);
+        cmd.execute();
+    }
+
+    @Test(expected = RuntimeException.class)
+    public void testExecutePropagatesServiceException() throws Exception {
+        StartInstanceBootGroupCmd cmd = createCmd();
+        when(instanceBootGroupService.startInstanceBootGroup(cmd)).thenThrow(new RuntimeException("db error"));
+        cmd.execute();
+    }
+
+    @Test(expected = ServerApiException.class)
+    public void testExecuteWrapsCloudRuntimeException() throws Exception {
+        StartInstanceBootGroupCmd cmd = createCmd();
+        when(instanceBootGroupService.startInstanceBootGroup(cmd)).thenThrow(new CloudRuntimeException("cannot start"));
+        cmd.execute();
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/StopInstanceBootGroupCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/StopInstanceBootGroupCmdTest.java
new file mode 100644
index 000000000000..6c788f4a2b4d
--- /dev/null
+++ b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/StopInstanceBootGroupCmdTest.java
@@ -0,0 +1,110 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.InstanceBootGroupResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroup;
+import org.junit.Test;
+
+import com.cloud.event.EventTypes;
+
+public class StopInstanceBootGroupCmdTest extends BaseBootGroupCmdTest {
+
+    private StopInstanceBootGroupCmd createCmd() throws Exception {
+        StopInstanceBootGroupCmd cmd = new StopInstanceBootGroupCmd();
+        setField(cmd, "instanceBootGroupService", instanceBootGroupService);
+        setField(cmd, "id", ENTITY_ID);
+        return cmd;
+    }
+
+    @Test
+    public void testAccessors() throws Exception {
+        StopInstanceBootGroupCmd cmd = createCmd();
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getId());
+    }
+
+    @Test
+    public void testGetEntityOwnerId() throws Exception {
+        StopInstanceBootGroupCmd cmd = createCmd();
+        assertEquals(ACCOUNT_ID, cmd.getEntityOwnerId());
+    }
+
+    @Test
+    public void testGetApiResourceType() throws Exception {
+        StopInstanceBootGroupCmd cmd = createCmd();
+        assertEquals(ApiCommandResourceType.InstanceBootGroup, cmd.getApiResourceType());
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getApiResourceId());
+    }
+
+    @Test
+    public void testEventType() throws Exception {
+        StopInstanceBootGroupCmd cmd = createCmd();
+        assertEquals(EventTypes.EVENT_INSTANCE_BOOT_GROUP_STOP, cmd.getEventType());
+    }
+
+    @Test
+    public void testEventDescription() throws Exception {
+        StopInstanceBootGroupCmd cmd = createCmd();
+        when(CallContext.current().getApiResourceUuid(ApiConstants.ID)).thenReturn("group-uuid");
+
+        assertEquals("Stopping Instance Boot Group with ID: group-uuid", cmd.getEventDescription());
+    }
+
+    @Test
+    public void testExecuteSuccess() throws Exception {
+        StopInstanceBootGroupCmd cmd = createCmd();
+
+        InstanceBootGroup group = mock(InstanceBootGroup.class);
+        when(group.getId()).thenReturn(ENTITY_ID);
+        InstanceBootGroupResponse mockResponse = new InstanceBootGroupResponse();
+
+        when(instanceBootGroupService.stopInstanceBootGroup(cmd)).thenReturn(group);
+        when(instanceBootGroupService.createInstanceBootGroupResponse(ENTITY_ID)).thenReturn(mockResponse);
+
+        cmd.execute();
+
+        InstanceBootGroupResponse response = (InstanceBootGroupResponse) cmd.getResponseObject();
+        assertNotNull(response);
+        assertEquals("stopinstancebootgroupresponse", response.getResponseName());
+        verify(instanceBootGroupService).stopInstanceBootGroup(cmd);
+        verify(instanceBootGroupService).createInstanceBootGroupResponse(ENTITY_ID);
+    }
+
+    @Test(expected = ServerApiException.class)
+    public void testExecuteReturnsNull() throws Exception {
+        StopInstanceBootGroupCmd cmd = createCmd();
+        when(instanceBootGroupService.stopInstanceBootGroup(cmd)).thenReturn(null);
+        cmd.execute();
+    }
+
+    @Test(expected = RuntimeException.class)
+    public void testExecutePropagatesServiceException() throws Exception {
+        StopInstanceBootGroupCmd cmd = createCmd();
+        when(instanceBootGroupService.stopInstanceBootGroup(cmd)).thenThrow(new RuntimeException("db error"));
+        cmd.execute();
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupCmdTest.java
new file mode 100644
index 000000000000..f64b1298b2e2
--- /dev/null
+++ b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupCmdTest.java
@@ -0,0 +1,104 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.InstanceBootGroupResponse;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroup;
+import org.junit.Test;
+
+public class UpdateInstanceBootGroupCmdTest extends BaseBootGroupCmdTest {
+
+    private UpdateInstanceBootGroupCmd createCmd() throws Exception {
+        UpdateInstanceBootGroupCmd cmd = new UpdateInstanceBootGroupCmd();
+        setField(cmd, "instanceBootGroupService", instanceBootGroupService);
+        setField(cmd, "id", ENTITY_ID);
+        setField(cmd, "name", "web-tier-renamed");
+        setField(cmd, "description", "updated description");
+        setField(cmd, "readinessAttemptTimeoutSeconds", 180L);
+        setField(cmd, "readinessMaxRetryAttempts", 5L);
+        setField(cmd, "readinessRebootOnRetry", false);
+        setField(cmd, "readinessInitialDelaySeconds", 30L);
+        return cmd;
+    }
+
+    @Test
+    public void testAccessors() throws Exception {
+        UpdateInstanceBootGroupCmd cmd = createCmd();
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getId());
+        assertEquals("web-tier-renamed", cmd.getName());
+        assertEquals("updated description", cmd.getDescription());
+        assertEquals(Long.valueOf(180L), cmd.getReadinessAttemptTimeoutSeconds());
+        assertEquals(Long.valueOf(5L), cmd.getReadinessMaxRetryAttempts());
+        assertEquals(Boolean.FALSE, cmd.getReadinessRebootOnRetry());
+        assertEquals(Long.valueOf(30L), cmd.getReadinessInitialDelaySeconds());
+    }
+
+    @Test
+    public void testGetEntityOwnerId() throws Exception {
+        UpdateInstanceBootGroupCmd cmd = createCmd();
+        assertEquals(ACCOUNT_ID, cmd.getEntityOwnerId());
+    }
+
+    @Test
+    public void testGetApiResourceType() throws Exception {
+        UpdateInstanceBootGroupCmd cmd = createCmd();
+        assertEquals(ApiCommandResourceType.InstanceBootGroup, cmd.getApiResourceType());
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getApiResourceId());
+    }
+
+    @Test
+    public void testExecuteSuccess() throws Exception {
+        UpdateInstanceBootGroupCmd cmd = createCmd();
+
+        InstanceBootGroup group = mock(InstanceBootGroup.class);
+        when(group.getId()).thenReturn(ENTITY_ID);
+        InstanceBootGroupResponse mockResponse = new InstanceBootGroupResponse();
+
+        when(instanceBootGroupService.updateInstanceBootGroup(cmd)).thenReturn(group);
+        when(instanceBootGroupService.createInstanceBootGroupResponse(ENTITY_ID)).thenReturn(mockResponse);
+
+        cmd.execute();
+
+        InstanceBootGroupResponse response = (InstanceBootGroupResponse) cmd.getResponseObject();
+        assertNotNull(response);
+        assertEquals("updateinstancebootgroupresponse", response.getResponseName());
+        verify(instanceBootGroupService).updateInstanceBootGroup(cmd);
+        verify(instanceBootGroupService).createInstanceBootGroupResponse(ENTITY_ID);
+    }
+
+    @Test(expected = ServerApiException.class)
+    public void testExecuteReturnsNull() throws Exception {
+        UpdateInstanceBootGroupCmd cmd = createCmd();
+        when(instanceBootGroupService.updateInstanceBootGroup(cmd)).thenReturn(null);
+        cmd.execute();
+    }
+
+    @Test(expected = RuntimeException.class)
+    public void testExecutePropagatesServiceException() throws Exception {
+        UpdateInstanceBootGroupCmd cmd = createCmd();
+        when(instanceBootGroupService.updateInstanceBootGroup(cmd)).thenThrow(new RuntimeException("db error"));
+        cmd.execute();
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupMemberCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupMemberCmdTest.java
new file mode 100644
index 000000000000..219ae3ce67fb
--- /dev/null
+++ b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupMemberCmdTest.java
@@ -0,0 +1,95 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.InstanceBootGroupMemberResponse;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMember;
+import org.junit.Test;
+
+public class UpdateInstanceBootGroupMemberCmdTest extends BaseBootGroupCmdTest {
+
+    private UpdateInstanceBootGroupMemberCmd createCmd() throws Exception {
+        UpdateInstanceBootGroupMemberCmd cmd = new UpdateInstanceBootGroupMemberCmd();
+        setField(cmd, "instanceBootGroupService", instanceBootGroupService);
+        setField(cmd, "id", ENTITY_ID);
+        setField(cmd, "order", 3);
+        return cmd;
+    }
+
+    @Test
+    public void testAccessors() throws Exception {
+        UpdateInstanceBootGroupMemberCmd cmd = createCmd();
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getId());
+        assertEquals(3, cmd.getOrder());
+    }
+
+    @Test
+    public void testGetEntityOwnerId() throws Exception {
+        UpdateInstanceBootGroupMemberCmd cmd = createCmd();
+        assertEquals(ACCOUNT_ID, cmd.getEntityOwnerId());
+    }
+
+    @Test
+    public void testGetApiResourceType() throws Exception {
+        UpdateInstanceBootGroupMemberCmd cmd = createCmd();
+        Long groupId = 101L;
+        when(instanceBootGroupService.getInstanceBootGroupIdForMember(ENTITY_ID)).thenReturn(groupId);
+        assertEquals(ApiCommandResourceType.InstanceBootGroup, cmd.getApiResourceType());
+        assertEquals(groupId, cmd.getApiResourceId());
+    }
+
+    @Test
+    public void testExecuteSuccess() throws Exception {
+        UpdateInstanceBootGroupMemberCmd cmd = createCmd();
+
+        InstanceBootGroupMember member = mock(InstanceBootGroupMember.class);
+        InstanceBootGroupMemberResponse mockResponse = new InstanceBootGroupMemberResponse();
+
+        when(instanceBootGroupService.updateInstanceBootGroupMember(cmd)).thenReturn(member);
+        when(instanceBootGroupService.createInstanceBootGroupMemberResponse(member)).thenReturn(mockResponse);
+
+        cmd.execute();
+
+        InstanceBootGroupMemberResponse response = (InstanceBootGroupMemberResponse) cmd.getResponseObject();
+        assertNotNull(response);
+        assertEquals("updateinstancebootgroupmemberresponse", response.getResponseName());
+        verify(instanceBootGroupService).updateInstanceBootGroupMember(cmd);
+        verify(instanceBootGroupService).createInstanceBootGroupMemberResponse(member);
+    }
+
+    @Test(expected = ServerApiException.class)
+    public void testExecuteReturnsNull() throws Exception {
+        UpdateInstanceBootGroupMemberCmd cmd = createCmd();
+        when(instanceBootGroupService.updateInstanceBootGroupMember(cmd)).thenReturn(null);
+        cmd.execute();
+    }
+
+    @Test(expected = RuntimeException.class)
+    public void testExecutePropagatesServiceException() throws Exception {
+        UpdateInstanceBootGroupMemberCmd cmd = createCmd();
+        when(instanceBootGroupService.updateInstanceBootGroupMember(cmd)).thenThrow(new RuntimeException("conflict"));
+        cmd.execute();
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupReadinessRuleCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupReadinessRuleCmdTest.java
new file mode 100644
index 000000000000..b4f0e3608287
--- /dev/null
+++ b/api/src/test/java/org/apache/cloudstack/api/command/user/bootgroup/UpdateInstanceBootGroupReadinessRuleCmdTest.java
@@ -0,0 +1,139 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.user.bootgroup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.InstanceBootGroupReadinessRuleResponse;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
+import org.junit.Test;
+
+public class UpdateInstanceBootGroupReadinessRuleCmdTest extends BaseBootGroupCmdTest {
+
+    private UpdateInstanceBootGroupReadinessRuleCmd createCmd() throws Exception {
+        UpdateInstanceBootGroupReadinessRuleCmd cmd = new UpdateInstanceBootGroupReadinessRuleCmd();
+        setField(cmd, "instanceBootGroupService", instanceBootGroupService);
+        setField(cmd, "id", ENTITY_ID);
+        setField(cmd, "name", "renamed-rule");
+        setField(cmd, "enabled", false);
+        return cmd;
+    }
+
+    @Test
+    public void testAccessors() throws Exception {
+        UpdateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getId());
+        assertEquals("renamed-rule", cmd.getName());
+        assertEquals(Boolean.FALSE, cmd.getEnabled());
+    }
+
+    @Test
+    public void testGetEnabledNullWhenNotSet() throws Exception {
+        UpdateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        setField(cmd, "enabled", null);
+        assertNull(cmd.getEnabled());
+    }
+
+    @Test
+    public void testGetEntityOwnerId() throws Exception {
+        UpdateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        assertEquals(ACCOUNT_ID, cmd.getEntityOwnerId());
+    }
+
+    @Test
+    public void testGetApiResourceType() throws Exception {
+        UpdateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        assertEquals(ApiCommandResourceType.InstanceBootGroupReadinessRule, cmd.getApiResourceType());
+        assertEquals(Long.valueOf(ENTITY_ID), cmd.getApiResourceId());
+    }
+
+    @Test
+    public void testGetDetailsNull() throws Exception {
+        UpdateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        setField(cmd, "details", null);
+        assertNull(cmd.getDetails());
+    }
+
+    @Test
+    public void testGetDetailsEmptyMap() throws Exception {
+        UpdateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        setField(cmd, "details", new HashMap<>());
+        assertNull(cmd.getDetails());
+    }
+
+    @Test
+    public void testGetDetailsPopulatedMap() throws Exception {
+        UpdateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+
+        Map<String, String> innerMap = new HashMap<>();
+        innerMap.put("port", "9090");
+        innerMap.put("protocol", "udp");
+
+        Map<String, Map<String, String>> outerMap = new HashMap<>();
+        outerMap.put("0", innerMap);
+
+        setField(cmd, "details", outerMap);
+
+        Map<String, String> details = cmd.getDetails();
+        assertNotNull(details);
+        assertEquals("9090", details.get("port"));
+        assertEquals("udp", details.get("protocol"));
+    }
+
+    @Test
+    public void testExecuteSuccess() throws Exception {
+        UpdateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+
+        InstanceBootGroupReadinessRule rule = mock(InstanceBootGroupReadinessRule.class);
+        InstanceBootGroupReadinessRuleResponse mockResponse = new InstanceBootGroupReadinessRuleResponse();
+
+        when(instanceBootGroupService.updateInstanceBootGroupReadinessRule(cmd)).thenReturn(rule);
+        when(instanceBootGroupService.createInstanceBootGroupReadinessRuleResponse(rule)).thenReturn(mockResponse);
+
+        cmd.execute();
+
+        InstanceBootGroupReadinessRuleResponse response = (InstanceBootGroupReadinessRuleResponse) cmd.getResponseObject();
+        assertNotNull(response);
+        assertEquals("updateinstancebootgroupreadinessruleresponse", response.getResponseName());
+        verify(instanceBootGroupService).updateInstanceBootGroupReadinessRule(cmd);
+        verify(instanceBootGroupService).createInstanceBootGroupReadinessRuleResponse(rule);
+    }
+
+    @Test(expected = ServerApiException.class)
+    public void testExecuteReturnsNull() throws Exception {
+        UpdateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        when(instanceBootGroupService.updateInstanceBootGroupReadinessRule(cmd)).thenReturn(null);
+        cmd.execute();
+    }
+
+    @Test(expected = RuntimeException.class)
+    public void testExecutePropagatesServiceException() throws Exception {
+        UpdateInstanceBootGroupReadinessRuleCmd cmd = createCmd();
+        when(instanceBootGroupService.updateInstanceBootGroupReadinessRule(cmd)).thenThrow(new RuntimeException("db error"));
+        cmd.execute();
+    }
+}
diff --git a/core/src/main/java/com/cloud/agent/api/CheckGuestAgentLivenessAnswer.java b/core/src/main/java/com/cloud/agent/api/CheckGuestAgentLivenessAnswer.java
new file mode 100644
index 000000000000..4019977de810
--- /dev/null
+++ b/core/src/main/java/com/cloud/agent/api/CheckGuestAgentLivenessAnswer.java
@@ -0,0 +1,35 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package com.cloud.agent.api;
+
+public class CheckGuestAgentLivenessAnswer extends Answer {
+
+    public CheckGuestAgentLivenessAnswer() {
+        super();
+    }
+
+    public CheckGuestAgentLivenessAnswer(CheckGuestAgentLivenessCommand command, boolean alive, String details) {
+        super(command, alive, details);
+    }
+
+    public CheckGuestAgentLivenessAnswer(CheckGuestAgentLivenessCommand command, Exception e) {
+        super(command, e);
+    }
+}
diff --git a/core/src/main/java/com/cloud/agent/api/CheckGuestAgentLivenessCommand.java b/core/src/main/java/com/cloud/agent/api/CheckGuestAgentLivenessCommand.java
new file mode 100644
index 000000000000..b608beb156cd
--- /dev/null
+++ b/core/src/main/java/com/cloud/agent/api/CheckGuestAgentLivenessCommand.java
@@ -0,0 +1,42 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package com.cloud.agent.api;
+
+public class CheckGuestAgentLivenessCommand extends Command {
+
+    private String vmName;
+
+    public CheckGuestAgentLivenessCommand(String vmName) {
+        this.vmName = vmName;
+    }
+
+    public String getVmName() {
+        return vmName;
+    }
+
+    public void setVmName(String vmName) {
+        this.vmName = vmName;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return false;
+    }
+}
diff --git a/core/src/main/java/com/cloud/agent/resource/virtualnetwork/VRScripts.java b/core/src/main/java/com/cloud/agent/resource/virtualnetwork/VRScripts.java
index 7bfbf786e9b4..95ac5d10c7bf 100644
--- a/core/src/main/java/com/cloud/agent/resource/virtualnetwork/VRScripts.java
+++ b/core/src/main/java/com/cloud/agent/resource/virtualnetwork/VRScripts.java
@@ -77,6 +77,7 @@ public class VRScripts {
 
     public static final String DIAGNOSTICS = "diagnostics.py";
     public static final String RETRIEVE_DIAGNOSTICS = "get_diagnostics_files.py";
+    public static final String INSTANCE_READINESS_CHECK = "instance_readiness_check.py";
     public static final String VR_FILE_CLEANUP = "cleanup.sh";
 
     public static final String VR_UPDATE_INTERFACE_CONFIG = "update_interface_config.sh";
diff --git a/core/src/main/java/com/cloud/agent/resource/virtualnetwork/VirtualRoutingResource.java b/core/src/main/java/com/cloud/agent/resource/virtualnetwork/VirtualRoutingResource.java
index b9ac455130f3..6d7988c5f6cd 100644
--- a/core/src/main/java/com/cloud/agent/resource/virtualnetwork/VirtualRoutingResource.java
+++ b/core/src/main/java/com/cloud/agent/resource/virtualnetwork/VirtualRoutingResource.java
@@ -50,6 +50,8 @@
 import org.apache.cloudstack.diagnostics.DiagnosticsCommand;
 import org.apache.cloudstack.diagnostics.PrepareFilesAnswer;
 import org.apache.cloudstack.diagnostics.PrepareFilesCommand;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceReadinessCheckAnswer;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceReadinessCheckCommand;
 import org.apache.cloudstack.utils.security.KeyStoreUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.net.util.SubnetUtils;
@@ -231,6 +233,8 @@ private Answer executeQueryCommand(NetworkElementCommand cmd) {
             return execute((GetRouterAlertsCommand)cmd);
         } else if (cmd instanceof DiagnosticsCommand) {
             return execute((DiagnosticsCommand) cmd);
+        } else if (cmd instanceof InstanceReadinessCheckCommand) {
+            return execute((InstanceReadinessCheckCommand) cmd);
         } else if (cmd instanceof PrepareFilesCommand) {
             return execute((PrepareFilesCommand) cmd);
         } else if (cmd instanceof DeleteFileInVrCommand) {
@@ -486,6 +490,15 @@ private Answer execute(DiagnosticsCommand cmd) {
         return new DiagnosticsAnswer(cmd, result.isSuccess(), result.getDetails());
     }
 
+    private Answer execute(InstanceReadinessCheckCommand cmd) {
+        _eachTimeout = Duration.standardSeconds(Math.max(cmd.getWait(), 1));
+        String args = cmd.getPort() == null ?
+                String.format("%s %s", cmd.getCheckType(), cmd.getIpAddress()) :
+                String.format("%s %s %s", cmd.getCheckType(), cmd.getIpAddress(), cmd.getPort());
+        final ExecutionResult result = _vrDeployer.executeInVR(cmd.getRouterAccessIp(), VRScripts.INSTANCE_READINESS_CHECK, args, _eachTimeout);
+        return new InstanceReadinessCheckAnswer(cmd, result.isSuccess(), result.getDetails());
+    }
+
     private Answer execute(PrepareFilesCommand cmd) {
         String fileList = String.join(" ", cmd.getFilesToRetrieveList());
         _eachTimeout = Duration.standardSeconds(cmd.getTimeout());
diff --git a/core/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceReadinessCheckAnswer.java b/core/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceReadinessCheckAnswer.java
new file mode 100644
index 000000000000..733294f2b9ce
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceReadinessCheckAnswer.java
@@ -0,0 +1,57 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup.readiness;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.utils.exception.CloudRuntimeException;
+
+public class InstanceReadinessCheckAnswer extends Answer {
+
+    public static final String STDOUT = "stdout";
+    public static final String STDERR = "stderr";
+    public static final String EXITCODE = "exitcode";
+
+    public InstanceReadinessCheckAnswer(InstanceReadinessCheckCommand cmd, boolean result, String details) {
+        super(cmd, result, details);
+    }
+
+    public Map<String, String> getExecutionDetails() {
+        final Map<String, String> executionDetails = new HashMap<>();
+        final String details = getDetails();
+        if (StringUtils.isNotEmpty(details) && details.contains("&&")) {
+            final String[] parts = details.split("&&");
+            if (parts.length >= 3) {
+                executionDetails.put(STDOUT, parts[0].trim());
+                executionDetails.put(STDERR, parts[1].trim());
+                executionDetails.put(EXITCODE, parts[2].trim());
+            } else {
+                throw new CloudRuntimeException("Unsupported instance boot group readiness check output format");
+            }
+        } else {
+            executionDetails.put(STDOUT, "");
+            executionDetails.put(STDERR, details);
+            executionDetails.put(EXITCODE, "-1");
+        }
+        return executionDetails;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceReadinessCheckCommand.java b/core/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceReadinessCheckCommand.java
new file mode 100644
index 000000000000..8ae58304ae82
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceReadinessCheckCommand.java
@@ -0,0 +1,73 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup.readiness;
+
+import com.cloud.agent.api.routing.NetworkElementCommand;
+
+/**
+ * Dispatched to a VR to run a readiness check (ping or TCP port connect) against a user VM's IP,
+ * on behalf of the instance boot group readiness feature. Deliberately separate from
+ * {@code org.apache.cloudstack.diagnostics.DiagnosticsCommand}, which is a general-purpose admin
+ * tool scoped to system VMs (SSVM/CPVM/VR) — this command runs its own dedicated VR script instead
+ * of sharing that one.
+ */
+public class InstanceReadinessCheckCommand extends NetworkElementCommand {
+
+    public static final String CHECK_TYPE_PING = "ping";
+    public static final String CHECK_TYPE_PORT_CHECK = "portcheck";
+
+    private final String checkType;
+    private final String ipAddress;
+    private Integer port;
+    private final boolean executeInSequence;
+
+    public InstanceReadinessCheckCommand(String ipAddress, boolean executeInSequence) {
+        this.checkType = CHECK_TYPE_PING;
+        this.ipAddress = ipAddress;
+        this.executeInSequence = executeInSequence;
+    }
+
+    public InstanceReadinessCheckCommand(String ipAddress, Integer port, boolean executeInSequence) {
+        this.checkType = CHECK_TYPE_PORT_CHECK;
+        this.ipAddress = ipAddress;
+        this.port = port;
+        this.executeInSequence = executeInSequence;
+    }
+
+    public String getCheckType() {
+        return checkType;
+    }
+
+    public String getIpAddress() {
+        return ipAddress;
+    }
+
+    public Integer getPort() {
+        return port;
+    }
+
+    @Override
+    public boolean isQuery() {
+        return true;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return executeInSequence;
+    }
+}
diff --git a/core/src/main/resources/META-INF/cloudstack/core/spring-core-registry-core-context.xml b/core/src/main/resources/META-INF/cloudstack/core/spring-core-registry-core-context.xml
index cf43b8527a97..6e53ccaf425b 100644
--- a/core/src/main/resources/META-INF/cloudstack/core/spring-core-registry-core-context.xml
+++ b/core/src/main/resources/META-INF/cloudstack/core/spring-core-registry-core-context.xml
@@ -375,4 +375,19 @@
     </bean>
 
     <bean id="dnsProvidersRegistry" class="org.apache.cloudstack.spring.lifecycle.registry.ExtensionRegistry" />
+
+    <bean id="bootGroupReadinessCheckersRegistry" class="org.apache.cloudstack.spring.lifecycle.registry.ExtensionRegistry" />
+
+    <!--
+        Declared directly in this "core" context (not an -inheritable.xml under a descendant module
+        like "api") because the ReadinessChecker beans (VrPingChecker etc.) are themselves declared in
+        "core" (spring-server-core-managers-context.xml). RegistryLifecycle only intercepts beans
+        created within its OWN module context — an inheritable file only propagates to DESCENDANT
+        modules, and "core" is an ancestor of "api", not a descendant, so a RegistryLifecycle declared
+        under "api" would never see beans declared in "core".
+    -->
+    <bean class="org.apache.cloudstack.spring.lifecycle.registry.RegistryLifecycle">
+        <property name="registry" ref="bootGroupReadinessCheckersRegistry" />
+        <property name="typeClass" value="org.apache.cloudstack.vm.bootgroup.readiness.ReadinessChecker" />
+    </bean>
 </beans>
diff --git a/core/src/test/java/com/cloud/agent/resource/virtualnetwork/InstanceReadinessCheckExecutionTest.java b/core/src/test/java/com/cloud/agent/resource/virtualnetwork/InstanceReadinessCheckExecutionTest.java
new file mode 100644
index 000000000000..226bf132d04b
--- /dev/null
+++ b/core/src/test/java/com/cloud/agent/resource/virtualnetwork/InstanceReadinessCheckExecutionTest.java
@@ -0,0 +1,122 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.agent.resource.virtualnetwork;
+
+import static org.junit.Assert.assertEquals;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.HashMap;
+
+import javax.naming.ConfigurationException;
+
+import org.joda.time.Duration;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.routing.NetworkElementCommand;
+import com.cloud.utils.ExecutionResult;
+
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceReadinessCheckAnswer;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceReadinessCheckCommand;
+
+@RunWith(MockitoJUnitRunner.class)
+public class InstanceReadinessCheckExecutionTest {
+
+    private static final String ROUTER_IP = "169.254.3.4";
+
+    VirtualRoutingResource resource;
+    VirtualRouterDeployer deployer;
+
+    @Before
+    public void setUp() throws ConfigurationException {
+        deployer = mock(VirtualRouterDeployer.class);
+        when(deployer.prepareCommand(any(NetworkElementCommand.class))).thenAnswer(invocation -> {
+            NetworkElementCommand cmd = invocation.getArgument(0);
+            cmd.setRouterAccessIp(ROUTER_IP);
+            return new ExecutionResult(true, null);
+        });
+        when(deployer.cleanupCommand(any(NetworkElementCommand.class))).thenReturn(new ExecutionResult(true, null));
+        when(deployer.executeInVR(anyString(), anyString(), anyString(), any(Duration.class))).thenReturn(new ExecutionResult(true, "out&&err&&0"));
+
+        resource = new VirtualRoutingResource(deployer);
+        resource.configure("VRResource", new HashMap<>());
+    }
+
+    @Test
+    public void zeroWaitIsFlooredToOneSecondTimeout() {
+        InstanceReadinessCheckCommand cmd = new InstanceReadinessCheckCommand("10.1.1.5", false);
+        cmd.setWait(0);
+
+        resource.executeRequest(cmd);
+
+        ArgumentCaptor<Duration> captor = ArgumentCaptor.forClass(Duration.class);
+        org.mockito.Mockito.verify(deployer).executeInVR(eq(ROUTER_IP), anyString(), anyString(), captor.capture());
+        assertEquals(1L, captor.getValue().getStandardSeconds());
+    }
+
+    @Test
+    public void positiveWaitIsUsedAsTimeoutSeconds() {
+        InstanceReadinessCheckCommand cmd = new InstanceReadinessCheckCommand("10.1.1.5", false);
+        cmd.setWait(5);
+
+        resource.executeRequest(cmd);
+
+        ArgumentCaptor<Duration> captor = ArgumentCaptor.forClass(Duration.class);
+        org.mockito.Mockito.verify(deployer).executeInVR(eq(ROUTER_IP), anyString(), anyString(), captor.capture());
+        assertEquals(5L, captor.getValue().getStandardSeconds());
+    }
+
+    @Test
+    public void pingCommandOmitsPortFromArgs() {
+        InstanceReadinessCheckCommand cmd = new InstanceReadinessCheckCommand("10.1.1.5", false);
+
+        resource.executeRequest(cmd);
+
+        ArgumentCaptor<String> argsCaptor = ArgumentCaptor.forClass(String.class);
+        org.mockito.Mockito.verify(deployer).executeInVR(eq(ROUTER_IP), anyString(), argsCaptor.capture(), any(Duration.class));
+        assertEquals("ping 10.1.1.5", argsCaptor.getValue());
+    }
+
+    @Test
+    public void portCheckCommandIncludesPortInArgs() {
+        InstanceReadinessCheckCommand cmd = new InstanceReadinessCheckCommand("10.1.1.5", 8080, false);
+
+        resource.executeRequest(cmd);
+
+        ArgumentCaptor<String> argsCaptor = ArgumentCaptor.forClass(String.class);
+        org.mockito.Mockito.verify(deployer).executeInVR(eq(ROUTER_IP), anyString(), argsCaptor.capture(), any(Duration.class));
+        assertEquals("portcheck 10.1.1.5 8080", argsCaptor.getValue());
+    }
+
+    @Test
+    public void resultIsWrappedInInstanceReadinessCheckAnswer() {
+        InstanceReadinessCheckCommand cmd = new InstanceReadinessCheckCommand("10.1.1.5", false);
+
+        Answer answer = resource.executeRequest(cmd);
+
+        org.junit.Assert.assertTrue(answer instanceof InstanceReadinessCheckAnswer);
+        assertEquals("0", ((InstanceReadinessCheckAnswer) answer).getExecutionDetails().get(InstanceReadinessCheckAnswer.EXITCODE));
+    }
+}
diff --git a/core/src/test/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceReadinessCheckAnswerTest.java b/core/src/test/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceReadinessCheckAnswerTest.java
new file mode 100644
index 000000000000..29aea0dcf172
--- /dev/null
+++ b/core/src/test/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceReadinessCheckAnswerTest.java
@@ -0,0 +1,113 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm.bootgroup.readiness;
+
+import java.util.Map;
+
+import org.junit.Assert;
+import org.junit.Test;
+
+import com.cloud.utils.exception.CloudRuntimeException;
+
+public class InstanceReadinessCheckAnswerTest {
+
+    private InstanceReadinessCheckCommand cmd() {
+        return new InstanceReadinessCheckCommand("10.1.1.5", false);
+    }
+
+    @Test
+    public void wellFormedSuccessfulDetailsAreParsed() {
+        InstanceReadinessCheckAnswer answer = new InstanceReadinessCheckAnswer(cmd(), true, " out \n && err && 0 ");
+
+        Map<String, String> details = answer.getExecutionDetails();
+
+        Assert.assertEquals("out", details.get(InstanceReadinessCheckAnswer.STDOUT));
+        Assert.assertEquals("err", details.get(InstanceReadinessCheckAnswer.STDERR));
+        Assert.assertEquals("0", details.get(InstanceReadinessCheckAnswer.EXITCODE));
+    }
+
+    @Test
+    public void extraDelimitedSegmentsAreIgnoredPastTheThird() {
+        InstanceReadinessCheckAnswer answer = new InstanceReadinessCheckAnswer(cmd(), true, "out&&err&&1&&extra");
+
+        Map<String, String> details = answer.getExecutionDetails();
+
+        Assert.assertEquals("out", details.get(InstanceReadinessCheckAnswer.STDOUT));
+        Assert.assertEquals("err", details.get(InstanceReadinessCheckAnswer.STDERR));
+        Assert.assertEquals("1", details.get(InstanceReadinessCheckAnswer.EXITCODE));
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void malformedSuccessfulDetailsThrow() {
+        new InstanceReadinessCheckAnswer(cmd(), true, "out&&err").getExecutionDetails();
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void malformedFailedDetailsThrow() {
+        new InstanceReadinessCheckAnswer(cmd(), false, "out&&err").getExecutionDetails();
+    }
+
+    @Test
+    public void failedResultIsStillParsedWhenWellFormed() {
+        // executeInVR (and the VR script) typically reports result=false whenever the underlying
+        // check (ping unreachable, port closed) exits non-zero, even though it still printed a
+        // well-formed "stdout&&stderr&&exitcode" triple. The non-zero exit code must not be
+        // discarded in favor of a generic -1/raw-blob fallback.
+        InstanceReadinessCheckAnswer answer = new InstanceReadinessCheckAnswer(cmd(), false, "out&&unreachable&&1");
+
+        Map<String, String> details = answer.getExecutionDetails();
+
+        Assert.assertEquals("out", details.get(InstanceReadinessCheckAnswer.STDOUT));
+        Assert.assertEquals("unreachable", details.get(InstanceReadinessCheckAnswer.STDERR));
+        Assert.assertEquals("1", details.get(InstanceReadinessCheckAnswer.EXITCODE));
+    }
+
+    @Test
+    public void failedResultWithoutDelimiterFallsBackToDefaults() {
+        // A dispatch-level failure (e.g. an exception message) never contains the delimiter and
+        // must still fall back to the raw-message/-1 defaults rather than throwing.
+        InstanceReadinessCheckAnswer answer = new InstanceReadinessCheckAnswer(cmd(), false, "agent down");
+
+        Map<String, String> details = answer.getExecutionDetails();
+
+        Assert.assertEquals("", details.get(InstanceReadinessCheckAnswer.STDOUT));
+        Assert.assertEquals("agent down", details.get(InstanceReadinessCheckAnswer.STDERR));
+        Assert.assertEquals("-1", details.get(InstanceReadinessCheckAnswer.EXITCODE));
+    }
+
+    @Test
+    public void blankDetailsWithSuccessfulResultFallsBackToDefaults() {
+        InstanceReadinessCheckAnswer answer = new InstanceReadinessCheckAnswer(cmd(), true, "");
+
+        Map<String, String> details = answer.getExecutionDetails();
+
+        Assert.assertEquals("", details.get(InstanceReadinessCheckAnswer.STDOUT));
+        Assert.assertEquals("", details.get(InstanceReadinessCheckAnswer.STDERR));
+        Assert.assertEquals("-1", details.get(InstanceReadinessCheckAnswer.EXITCODE));
+    }
+
+    @Test
+    public void nullDetailsWithSuccessfulResultFallsBackToDefaults() {
+        InstanceReadinessCheckAnswer answer = new InstanceReadinessCheckAnswer(cmd(), true, null);
+
+        Map<String, String> details = answer.getExecutionDetails();
+
+        Assert.assertEquals("", details.get(InstanceReadinessCheckAnswer.STDOUT));
+        Assert.assertNull(details.get(InstanceReadinessCheckAnswer.STDERR));
+        Assert.assertEquals("-1", details.get(InstanceReadinessCheckAnswer.EXITCODE));
+    }
+}
diff --git a/debian/changelog b/debian/changelog
index 76ac865d9efe..8657d3047701 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -4,12 +4,6 @@ cloudstack (24.0.0-SNAPSHOT) unstable; urgency=low
 
  -- the Apache CloudStack project <dev@cloudstack.apache.org>  Wed, 02 Sep 2026 17:26:10 +0200
 
-cloudstack (4.24.0.0-SNAPSHOT) unstable; urgency=low
-
-  * Update the version to 4.24.0.0-SNAPSHOT
-
- -- the Apache CloudStack project <dev@cloudstack.apache.org>  Tue, 01 Sep 2026 19:10:00 +0200
-
 cloudstack (4.23.0.0-SNAPSHOT) unstable; urgency=low
 
   * Update the version to 4.23.0.0-SNAPSHOT
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupDao.java b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupDao.java
new file mode 100644
index 000000000000..e7ce4deedfcf
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupDao.java
@@ -0,0 +1,30 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.vm.dao;
+
+import java.util.List;
+
+import com.cloud.utils.db.GenericDao;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupVO;
+
+public interface InstanceBootGroupDao extends GenericDao<InstanceBootGroupVO, Long> {
+
+    List<InstanceBootGroupVO> listByAccountId(long accountId);
+
+    boolean isNameInUse(long accountId, String name);
+}
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupDaoImpl.java b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupDaoImpl.java
new file mode 100644
index 000000000000..3a80e7eabeed
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupDaoImpl.java
@@ -0,0 +1,60 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.vm.dao;
+
+import java.util.List;
+
+import org.springframework.stereotype.Component;
+
+import com.cloud.utils.db.GenericDaoBase;
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupVO;
+
+@Component
+public class InstanceBootGroupDaoImpl extends GenericDaoBase<InstanceBootGroupVO, Long> implements InstanceBootGroupDao {
+
+    private final SearchBuilder<InstanceBootGroupVO> accountSearch;
+    private final SearchBuilder<InstanceBootGroupVO> accountNameSearch;
+
+    public InstanceBootGroupDaoImpl() {
+        accountSearch = createSearchBuilder();
+        accountSearch.and("accountId", accountSearch.entity().getAccountId(), SearchCriteria.Op.EQ);
+        accountSearch.done();
+
+        accountNameSearch = createSearchBuilder();
+        accountNameSearch.and("accountId", accountNameSearch.entity().getAccountId(), SearchCriteria.Op.EQ);
+        accountNameSearch.and("name", accountNameSearch.entity().getName(), SearchCriteria.Op.EQ);
+        accountNameSearch.done();
+    }
+
+    @Override
+    public List<InstanceBootGroupVO> listByAccountId(long accountId) {
+        SearchCriteria<InstanceBootGroupVO> sc = accountSearch.create();
+        sc.setParameters("accountId", accountId);
+        return listBy(sc);
+    }
+
+    @Override
+    public boolean isNameInUse(long accountId, String name) {
+        SearchCriteria<InstanceBootGroupVO> sc = accountNameSearch.create();
+        sc.setParameters("accountId", accountId);
+        sc.setParameters("name", name);
+        return !listBy(sc).isEmpty();
+    }
+}
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupDetailsDao.java b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupDetailsDao.java
new file mode 100644
index 000000000000..6b1c241cddb0
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupDetailsDao.java
@@ -0,0 +1,28 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.vm.dao;
+
+import org.apache.cloudstack.resourcedetail.ResourceDetailsDao;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupDetailsVO;
+
+public interface InstanceBootGroupDetailsDao extends ResourceDetailsDao<InstanceBootGroupDetailsVO> {
+
+    String getDetail(long bootGroupId, String name);
+
+    void setDetail(long bootGroupId, String name, String value);
+}
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupDetailsDaoImpl.java b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupDetailsDaoImpl.java
new file mode 100644
index 000000000000..065b09571a96
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupDetailsDaoImpl.java
@@ -0,0 +1,71 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.vm.dao;
+
+import org.apache.cloudstack.resourcedetail.ResourceDetailsDaoBase;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupDetailsVO;
+import org.springframework.stereotype.Component;
+
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
+
+@Component
+public class InstanceBootGroupDetailsDaoImpl extends ResourceDetailsDaoBase<InstanceBootGroupDetailsVO> implements InstanceBootGroupDetailsDao {
+
+    private final SearchBuilder<InstanceBootGroupDetailsVO> bootGroupSearch;
+    private final SearchBuilder<InstanceBootGroupDetailsVO> bootGroupNameSearch;
+
+    public InstanceBootGroupDetailsDaoImpl() {
+        bootGroupSearch = createSearchBuilder();
+        bootGroupSearch.and("bootGroupId", bootGroupSearch.entity().getResourceId(), SearchCriteria.Op.EQ);
+        bootGroupSearch.done();
+
+        bootGroupNameSearch = createSearchBuilder();
+        bootGroupNameSearch.and("bootGroupId", bootGroupNameSearch.entity().getResourceId(), SearchCriteria.Op.EQ);
+        bootGroupNameSearch.and("name", bootGroupNameSearch.entity().getName(), SearchCriteria.Op.EQ);
+        bootGroupNameSearch.done();
+    }
+
+    @Override
+    public void addDetail(long resourceId, String key, String value, boolean display) {
+        super.addDetail(new InstanceBootGroupDetailsVO(resourceId, key, value, display));
+    }
+
+    @Override
+    public String getDetail(long bootGroupId, String name) {
+        SearchCriteria<InstanceBootGroupDetailsVO> sc = bootGroupNameSearch.create();
+        sc.setParameters("bootGroupId", bootGroupId);
+        sc.setParameters("name", name);
+        InstanceBootGroupDetailsVO detail = findOneBy(sc);
+        return detail == null ? null : detail.getValue();
+    }
+
+    @Override
+    public void setDetail(long bootGroupId, String name, String value) {
+        SearchCriteria<InstanceBootGroupDetailsVO> sc = bootGroupNameSearch.create();
+        sc.setParameters("bootGroupId", bootGroupId);
+        sc.setParameters("name", name);
+        InstanceBootGroupDetailsVO existing = findOneBy(sc);
+        if (existing == null) {
+            persist(new InstanceBootGroupDetailsVO(bootGroupId, name, value));
+        } else {
+            existing.setValue(value);
+            update(existing.getId(), existing);
+        }
+    }
+}
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupMemberDao.java b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupMemberDao.java
new file mode 100644
index 000000000000..1a7c67fce061
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupMemberDao.java
@@ -0,0 +1,44 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.vm.dao;
+
+import java.util.List;
+
+import com.cloud.utils.Pair;
+import com.cloud.utils.db.GenericDao;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMemberVO;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMember;
+
+public interface InstanceBootGroupMemberDao extends GenericDao<InstanceBootGroupMemberVO, Long> {
+
+    List<InstanceBootGroupMemberVO> listByBootGroupId(long bootGroupId);
+
+    int countByBootGroupId(long bootGroupId);
+
+    List<InstanceBootGroupMemberVO> listByBootGroupIdAndEqualOrHigherOrder(long bootGroupId, int order);
+
+    List<InstanceBootGroupMemberVO> listByBootGroupIdAndOrderRange(long bootGroupId, int low, int high);
+
+    Pair<List<InstanceBootGroupMemberVO>, Integer> searchAndCountByBootGroupId(long bootGroupId);
+
+    Pair<List<InstanceBootGroupMemberVO>, Integer> searchAndCountByBootGroupIdAndType(long bootGroupId, InstanceBootGroupMember.MemberType memberType);
+
+    InstanceBootGroupMemberVO findByMember(InstanceBootGroupMember.MemberType memberType, long memberId);
+
+    void deleteByBootGroupId(long bootGroupId);
+}
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupMemberDaoImpl.java b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupMemberDaoImpl.java
new file mode 100644
index 000000000000..4529892fee49
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupMemberDaoImpl.java
@@ -0,0 +1,123 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.vm.dao;
+
+import java.util.List;
+
+import org.springframework.stereotype.Component;
+
+import com.cloud.utils.Pair;
+import com.cloud.utils.db.GenericDaoBase;
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMemberVO;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMember;
+
+@Component
+public class InstanceBootGroupMemberDaoImpl extends GenericDaoBase<InstanceBootGroupMemberVO, Long> implements InstanceBootGroupMemberDao {
+
+    private final SearchBuilder<InstanceBootGroupMemberVO> bootGroupSearch;
+    private final SearchBuilder<InstanceBootGroupMemberVO> bootGroupTypeSearch;
+    private final SearchBuilder<InstanceBootGroupMemberVO> memberSearch;
+
+    public InstanceBootGroupMemberDaoImpl() {
+        bootGroupSearch = createSearchBuilder();
+        bootGroupSearch.and("bootGroupId", bootGroupSearch.entity().getBootGroupId(), SearchCriteria.Op.EQ);
+        bootGroupSearch.done();
+
+        bootGroupTypeSearch = createSearchBuilder();
+        bootGroupTypeSearch.and("bootGroupId", bootGroupTypeSearch.entity().getBootGroupId(), SearchCriteria.Op.EQ);
+        bootGroupTypeSearch.and("memberType", bootGroupTypeSearch.entity().getMemberType(), SearchCriteria.Op.EQ);
+        bootGroupTypeSearch.done();
+
+        memberSearch = createSearchBuilder();
+        memberSearch.and("memberType", memberSearch.entity().getMemberType(), SearchCriteria.Op.EQ);
+        memberSearch.and("memberId", memberSearch.entity().getMemberId(), SearchCriteria.Op.EQ);
+        memberSearch.done();
+    }
+
+    @Override
+    public List<InstanceBootGroupMemberVO> listByBootGroupId(long bootGroupId) {
+        SearchCriteria<InstanceBootGroupMemberVO> sc = bootGroupSearch.create();
+        sc.setParameters("bootGroupId", bootGroupId);
+        return listBy(sc, null);
+    }
+
+    @Override
+    public int countByBootGroupId(long bootGroupId) {
+        SearchCriteria<InstanceBootGroupMemberVO> sc = bootGroupSearch.create();
+        sc.setParameters("bootGroupId", bootGroupId);
+        return getCount(sc);
+    }
+
+    @Override
+    public List<InstanceBootGroupMemberVO> listByBootGroupIdAndEqualOrHigherOrder(long bootGroupId, int order) {
+        SearchBuilder<InstanceBootGroupMemberVO> bootGroupOrderSearch = createSearchBuilder();
+        bootGroupOrderSearch.and("bootGroupId", bootGroupOrderSearch.entity().getBootGroupId(), SearchCriteria.Op.EQ);
+        bootGroupOrderSearch.and("bootOrder", bootGroupOrderSearch.entity().getBootOrder(), SearchCriteria.Op.GTEQ);
+        bootGroupOrderSearch.done();
+        SearchCriteria<InstanceBootGroupMemberVO> sc = bootGroupOrderSearch.create();
+        sc.setParameters("bootGroupId", bootGroupId);
+        sc.setParameters("bootOrder", order);
+        return listBy(sc, null);
+    }
+
+    @Override
+    public List<InstanceBootGroupMemberVO> listByBootGroupIdAndOrderRange(long bootGroupId, int low, int high) {
+        SearchBuilder<InstanceBootGroupMemberVO> bootGroupOrderSearch = createSearchBuilder();
+        bootGroupOrderSearch.and("bootGroupId", bootGroupOrderSearch.entity().getBootGroupId(), SearchCriteria.Op.EQ);
+        bootGroupOrderSearch.and("low", bootGroupOrderSearch.entity().getBootOrder(), SearchCriteria.Op.GTEQ);
+        bootGroupOrderSearch.and("high", bootGroupOrderSearch.entity().getBootOrder(), SearchCriteria.Op.LTEQ);
+        bootGroupOrderSearch.done();
+        SearchCriteria<InstanceBootGroupMemberVO> sc = bootGroupOrderSearch.create();
+        sc.setParameters("bootGroupId", bootGroupId);
+        sc.setParameters("low", low);
+        sc.setParameters("high", high);
+        return listBy(sc, null);
+    }
+
+    @Override
+    public Pair<List<InstanceBootGroupMemberVO>, Integer> searchAndCountByBootGroupId(long bootGroupId) {
+        SearchCriteria<InstanceBootGroupMemberVO> sc = bootGroupSearch.create();
+        sc.setParameters("bootGroupId", bootGroupId);
+        return searchAndCount(sc, null);
+    }
+
+    @Override
+    public Pair<List<InstanceBootGroupMemberVO>, Integer> searchAndCountByBootGroupIdAndType(long bootGroupId, InstanceBootGroupMember.MemberType memberType) {
+        SearchCriteria<InstanceBootGroupMemberVO> sc = bootGroupTypeSearch.create();
+        sc.setParameters("bootGroupId", bootGroupId);
+        sc.setParameters("memberType", memberType);
+        return searchAndCount(sc, null);
+    }
+
+    @Override
+    public InstanceBootGroupMemberVO findByMember(InstanceBootGroupMember.MemberType memberType, long memberId) {
+        SearchCriteria<InstanceBootGroupMemberVO> sc = memberSearch.create();
+        sc.setParameters("memberType", memberType);
+        sc.setParameters("memberId", memberId);
+        return findOneBy(sc);
+    }
+
+    @Override
+    public void deleteByBootGroupId(long bootGroupId) {
+        SearchCriteria<InstanceBootGroupMemberVO> sc = bootGroupSearch.create();
+        sc.setParameters("bootGroupId", bootGroupId);
+        expunge(sc);
+    }
+}
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessCheckResultDao.java b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessCheckResultDao.java
new file mode 100644
index 000000000000..2f4fb1185df0
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessCheckResultDao.java
@@ -0,0 +1,41 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.vm.dao;
+
+import java.util.Date;
+
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupReadinessCheckResultVO;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
+
+import com.cloud.utils.db.GenericDao;
+
+public interface InstanceBootGroupReadinessCheckResultDao extends GenericDao<InstanceBootGroupReadinessCheckResultVO, Long> {
+
+    /**
+     * vmId 0 is the rule's own row (a VM-scoped rule's single target, or a group-scoped rule's
+     * all-members aggregate); any other vmId is one inherited member's individual result.
+     */
+    InstanceBootGroupReadinessCheckResultVO findByRuleAndVm(long ruleId, long vmId);
+
+    /**
+     * Inserts or updates the single cached result row for (ruleId, vmId) (no history, by design).
+     */
+    void upsert(long ruleId, long vmId, InstanceBootGroupReadinessRule.Status status, String message, Date checkedOn);
+
+    void deleteByRuleId(long ruleId);
+}
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessCheckResultDaoImpl.java b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessCheckResultDaoImpl.java
new file mode 100644
index 000000000000..56251a31214e
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessCheckResultDaoImpl.java
@@ -0,0 +1,74 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.vm.dao;
+
+import java.util.Date;
+
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupReadinessCheckResultVO;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
+import org.springframework.stereotype.Component;
+
+import com.cloud.utils.db.GenericDaoBase;
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
+
+@Component
+public class InstanceBootGroupReadinessCheckResultDaoImpl extends GenericDaoBase<InstanceBootGroupReadinessCheckResultVO, Long> implements InstanceBootGroupReadinessCheckResultDao {
+
+    private final SearchBuilder<InstanceBootGroupReadinessCheckResultVO> ruleIdSearch;
+    private final SearchBuilder<InstanceBootGroupReadinessCheckResultVO> ruleAndVmSearch;
+
+    public InstanceBootGroupReadinessCheckResultDaoImpl() {
+        ruleIdSearch = createSearchBuilder();
+        ruleIdSearch.and("ruleId", ruleIdSearch.entity().getRuleId(), SearchCriteria.Op.EQ);
+        ruleIdSearch.done();
+
+        ruleAndVmSearch = createSearchBuilder();
+        ruleAndVmSearch.and("ruleId", ruleAndVmSearch.entity().getRuleId(), SearchCriteria.Op.EQ);
+        ruleAndVmSearch.and("vmId", ruleAndVmSearch.entity().getVmId(), SearchCriteria.Op.EQ);
+        ruleAndVmSearch.done();
+    }
+
+    @Override
+    public InstanceBootGroupReadinessCheckResultVO findByRuleAndVm(long ruleId, long vmId) {
+        SearchCriteria<InstanceBootGroupReadinessCheckResultVO> sc = ruleAndVmSearch.create();
+        sc.setParameters("ruleId", ruleId);
+        sc.setParameters("vmId", vmId);
+        return findOneBy(sc);
+    }
+
+    @Override
+    public void upsert(long ruleId, long vmId, InstanceBootGroupReadinessRule.Status status, String message, Date checkedOn) {
+        InstanceBootGroupReadinessCheckResultVO existing = findByRuleAndVm(ruleId, vmId);
+        if (existing == null) {
+            persist(new InstanceBootGroupReadinessCheckResultVO(ruleId, vmId, status, message, checkedOn));
+        } else {
+            existing.setStatus(status);
+            existing.setMessage(message);
+            existing.setCheckedOn(checkedOn);
+            update(existing.getId(), existing);
+        }
+    }
+
+    @Override
+    public void deleteByRuleId(long ruleId) {
+        SearchCriteria<InstanceBootGroupReadinessCheckResultVO> sc = ruleIdSearch.create();
+        sc.setParameters("ruleId", ruleId);
+        expunge(sc);
+    }
+}
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDao.java b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDao.java
new file mode 100644
index 000000000000..c5599346be96
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDao.java
@@ -0,0 +1,44 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.vm.dao;
+
+import java.util.List;
+
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMember;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupReadinessRuleVO;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
+
+import com.cloud.utils.Pair;
+import com.cloud.utils.db.GenericDao;
+
+public interface InstanceBootGroupReadinessRuleDao extends GenericDao<InstanceBootGroupReadinessRuleVO, Long> {
+
+    Pair<List<InstanceBootGroupReadinessRuleVO>, Integer> searchAndCountByBootGroupId(long bootGroupId,
+            Long id,
+            InstanceBootGroupMember.MemberType itemType,
+            Long itemId,
+            InstanceBootGroupReadinessRule.RuleType ruleType,
+            String keyword,
+            Long startIndex,
+            Long pageSize);
+
+    List<InstanceBootGroupReadinessRuleVO> listEnabledByItem(long bootGroupId, InstanceBootGroupMember.MemberType itemType, long itemId);
+
+    List<InstanceBootGroupReadinessRuleVO> listByItem(long bootGroupId, InstanceBootGroupMember.MemberType itemType, long itemId);
+
+}
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDaoImpl.java b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDaoImpl.java
new file mode 100644
index 000000000000..125766a853b1
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDaoImpl.java
@@ -0,0 +1,119 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.vm.dao;
+
+import java.util.List;
+
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMember;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupReadinessRuleVO;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
+import org.springframework.stereotype.Component;
+
+import com.cloud.utils.Pair;
+import com.cloud.utils.db.Filter;
+import com.cloud.utils.db.GenericDaoBase;
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
+
+@Component
+public class InstanceBootGroupReadinessRuleDaoImpl extends GenericDaoBase<InstanceBootGroupReadinessRuleVO, Long> implements InstanceBootGroupReadinessRuleDao {
+
+    private final SearchBuilder<InstanceBootGroupReadinessRuleVO> itemSearch;
+    private final SearchBuilder<InstanceBootGroupReadinessRuleVO> enabledByItemSearch;
+    private final SearchBuilder<InstanceBootGroupReadinessRuleVO> byItemSearch;
+
+    public InstanceBootGroupReadinessRuleDaoImpl() {
+
+        itemSearch = createSearchBuilder();
+        itemSearch.and("itemType", itemSearch.entity().getItemType(), SearchCriteria.Op.EQ);
+        itemSearch.and("itemId", itemSearch.entity().getItemId(), SearchCriteria.Op.EQ);
+        itemSearch.done();
+
+        enabledByItemSearch = createSearchBuilder();
+        enabledByItemSearch.and("bootGroupId", enabledByItemSearch.entity().getBootGroupId(), SearchCriteria.Op.EQ);
+        enabledByItemSearch.and("itemType", enabledByItemSearch.entity().getItemType(), SearchCriteria.Op.EQ);
+        enabledByItemSearch.and("itemId", enabledByItemSearch.entity().getItemId(), SearchCriteria.Op.EQ);
+        enabledByItemSearch.and("enabled", enabledByItemSearch.entity().isEnabled(), SearchCriteria.Op.EQ);
+        enabledByItemSearch.done();
+
+        byItemSearch = createSearchBuilder();
+        byItemSearch.and("bootGroupId", byItemSearch.entity().getBootGroupId(), SearchCriteria.Op.EQ);
+        byItemSearch.and("itemType", byItemSearch.entity().getItemType(), SearchCriteria.Op.EQ);
+        byItemSearch.and("itemId", byItemSearch.entity().getItemId(), SearchCriteria.Op.EQ);
+        byItemSearch.done();
+    }
+
+    @Override
+    public Pair<List<InstanceBootGroupReadinessRuleVO>, Integer> searchAndCountByBootGroupId(long bootGroupId,
+            Long id,
+            InstanceBootGroupMember.MemberType itemType,
+            Long itemId,
+            InstanceBootGroupReadinessRule.RuleType ruleType,
+            String keyword,
+            Long startIndex,
+            Long pageSize) {
+        SearchBuilder<InstanceBootGroupReadinessRuleVO> sb = createSearchBuilder();
+        sb.and("bootGroupId", sb.entity().getBootGroupId(), SearchCriteria.Op.EQ);
+        sb.and("id", sb.entity().getId(), SearchCriteria.Op.EQ);
+        sb.and("itemType", sb.entity().getItemType(), SearchCriteria.Op.EQ);
+        sb.and("itemId", sb.entity().getItemId(), SearchCriteria.Op.EQ);
+        sb.and("ruleType", sb.entity().getRuleType(), SearchCriteria.Op.EQ);
+        sb.and("keyword", sb.entity().getName(), SearchCriteria.Op.LIKE);
+        sb.done();
+
+        SearchCriteria<InstanceBootGroupReadinessRuleVO> sc = sb.create();
+        sc.setParameters("bootGroupId", bootGroupId);
+        if (id != null) {
+            sc.setParameters("id", id);
+        }
+        if (itemType != null) {
+            sc.setParameters("itemType", itemType);
+        }
+        if (itemId != null) {
+            sc.setParameters("itemId", itemId);
+        }
+        if (ruleType != null) {
+            sc.setParameters("ruleType", ruleType);
+        }
+        if (keyword != null) {
+            sc.setParameters("keyword", "%" + keyword + "%");
+        }
+
+        Filter searchFilter = new Filter(InstanceBootGroupReadinessRuleVO.class, "id", true, startIndex, pageSize);
+        return searchAndCount(sc, searchFilter);
+    }
+
+    @Override
+    public List<InstanceBootGroupReadinessRuleVO> listEnabledByItem(long bootGroupId, InstanceBootGroupMember.MemberType itemType, long itemId) {
+        SearchCriteria<InstanceBootGroupReadinessRuleVO> sc = enabledByItemSearch.create();
+        sc.setParameters("bootGroupId", bootGroupId);
+        sc.setParameters("itemType", itemType);
+        sc.setParameters("itemId", itemId);
+        sc.setParameters("enabled", true);
+        return listBy(sc);
+    }
+
+    @Override
+    public List<InstanceBootGroupReadinessRuleVO> listByItem(long bootGroupId, InstanceBootGroupMember.MemberType itemType, long itemId) {
+        SearchCriteria<InstanceBootGroupReadinessRuleVO> sc = byItemSearch.create();
+        sc.setParameters("bootGroupId", bootGroupId);
+        sc.setParameters("itemType", itemType);
+        sc.setParameters("itemId", itemId);
+        return listBy(sc);
+    }
+}
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDetailsDao.java b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDetailsDao.java
new file mode 100644
index 000000000000..eb835f1578bd
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDetailsDao.java
@@ -0,0 +1,32 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.vm.dao;
+
+import java.util.Map;
+
+import org.apache.cloudstack.resourcedetail.ResourceDetailsDao;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupReadinessRuleDetailsVO;
+
+public interface InstanceBootGroupReadinessRuleDetailsDao extends ResourceDetailsDao<InstanceBootGroupReadinessRuleDetailsVO> {
+
+    /**
+     * Like {@link #listDetailsKeyPairs(long)} but transparently decrypts the {@code script} key
+     * (CustomScript rule content is stored encrypted at rest).
+     */
+    Map<String, String> getDetails(long ruleId);
+}
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDetailsDaoImpl.java b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDetailsDaoImpl.java
new file mode 100644
index 000000000000..68e01ad3feac
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDetailsDaoImpl.java
@@ -0,0 +1,69 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.vm.dao;
+
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.resourcedetail.ResourceDetailsDaoBase;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupReadinessRuleDetailsVO;
+import org.springframework.stereotype.Component;
+
+import com.cloud.utils.crypt.DBEncryptionUtil;
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
+
+@Component
+public class InstanceBootGroupReadinessRuleDetailsDaoImpl extends ResourceDetailsDaoBase<InstanceBootGroupReadinessRuleDetailsVO> implements InstanceBootGroupReadinessRuleDetailsDao {
+
+    private static final String ENCRYPTED_KEY = "script";
+
+    private final SearchBuilder<InstanceBootGroupReadinessRuleDetailsVO> ruleSearch;
+
+    public InstanceBootGroupReadinessRuleDetailsDaoImpl() {
+        super();
+        ruleSearch = createSearchBuilder();
+        ruleSearch.and("ruleId", ruleSearch.entity().getResourceId(), SearchCriteria.Op.EQ);
+        ruleSearch.done();
+    }
+
+    @Override
+    public void addDetail(long resourceId, String key, String value, boolean display) {
+        String storedValue = ENCRYPTED_KEY.equals(key) ? DBEncryptionUtil.encrypt(value) : value;
+        super.addDetail(new InstanceBootGroupReadinessRuleDetailsVO(resourceId, key, storedValue, display));
+    }
+
+    @Override
+    public Map<String, String> getDetails(long ruleId) {
+        SearchCriteria<InstanceBootGroupReadinessRuleDetailsVO> sc = ruleSearch.create();
+        sc.setParameters("ruleId", ruleId);
+
+        List<InstanceBootGroupReadinessRuleDetailsVO> details = listBy(sc);
+        Map<String, String> detailsMap = new HashMap<>();
+        for (InstanceBootGroupReadinessRuleDetailsVO detail : details) {
+            String name = detail.getName();
+            String value = detail.getValue();
+            if (ENCRYPTED_KEY.equals(name)) {
+                value = DBEncryptionUtil.decrypt(value);
+            }
+            detailsMap.put(name, value);
+        }
+        return detailsMap;
+    }
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupDetailsVO.java b/engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupDetailsVO.java
new file mode 100644
index 000000000000..14cf82a777eb
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupDetailsVO.java
@@ -0,0 +1,93 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Table;
+
+import org.apache.cloudstack.api.ResourceDetail;
+
+/**
+ * Per-boot-group override of the global readiness ConfigKeys. {@code name} is the exact ConfigKey
+ * key string, so override resolution needs no separate key-mapping.
+ */
+@Entity
+@Table(name = "instance_boot_group_details")
+public class InstanceBootGroupDetailsVO implements ResourceDetail {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "id")
+    private long id;
+
+    @Column(name = "boot_group_id")
+    private long resourceId;
+
+    @Column(name = "name")
+    private String name;
+
+    @Column(name = "value")
+    private String value;
+
+    @Column(name = "display")
+    private boolean display = true;
+
+    protected InstanceBootGroupDetailsVO() {
+    }
+
+    public InstanceBootGroupDetailsVO(long bootGroupId, String name, String value) {
+        this.resourceId = bootGroupId;
+        this.name = name;
+        this.value = value;
+    }
+
+    public InstanceBootGroupDetailsVO(long bootGroupId, String name, String value, boolean display) {
+        this(bootGroupId, name, value);
+        this.display = display;
+    }
+
+    @Override
+    public long getId() {
+        return id;
+    }
+
+    public long getResourceId() {
+        return resourceId;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public String getValue() {
+        return value;
+    }
+
+    public void setValue(String value) {
+        this.value = value;
+    }
+
+    @Override
+    public boolean isDisplay() {
+        return display;
+    }
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupMemberVO.java b/engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupMemberVO.java
new file mode 100644
index 000000000000..c67f63cf719b
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupMemberVO.java
@@ -0,0 +1,116 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup;
+
+import java.util.Date;
+import java.util.UUID;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.EnumType;
+import javax.persistence.Enumerated;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Table;
+
+import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;
+
+@Entity
+@Table(name = "instance_boot_group_member")
+public class InstanceBootGroupMemberVO implements InstanceBootGroupMember {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "id")
+    private long id;
+
+    @Column(name = "uuid")
+    private String uuid;
+
+    @Column(name = "boot_group_id")
+    private long bootGroupId;
+
+    @Column(name = "member_type")
+    @Enumerated(EnumType.STRING)
+    private MemberType memberType;
+
+    @Column(name = "member_id")
+    private long memberId;
+
+    @Column(name = "boot_order")
+    private int bootOrder;
+
+    @Column(name = "created")
+    private Date created;
+
+    protected InstanceBootGroupMemberVO() {
+    }
+
+    public InstanceBootGroupMemberVO(long bootGroupId, MemberType memberType, long memberId, int bootOrder) {
+        this.bootGroupId = bootGroupId;
+        this.memberType = memberType;
+        this.memberId = memberId;
+        this.bootOrder = bootOrder;
+        this.uuid = UUID.randomUUID().toString();
+    }
+
+    @Override
+    public long getId() {
+        return id;
+    }
+
+    @Override
+    public String getUuid() {
+        return uuid;
+    }
+
+    @Override
+    public long getBootGroupId() {
+        return bootGroupId;
+    }
+
+    @Override
+    public MemberType getMemberType() {
+        return memberType;
+    }
+
+    @Override
+    public long getMemberId() {
+        return memberId;
+    }
+
+    @Override
+    public int getBootOrder() {
+        return bootOrder;
+    }
+
+    public void setBootOrder(int bootOrder) {
+        this.bootOrder = bootOrder;
+    }
+
+    @Override
+    public Date getCreated() {
+        return created;
+    }
+
+    @Override
+    public String toString() {
+        return String.format("BootGroupMember %s", ReflectionToStringBuilderUtils.reflectOnlySelectedFields(this, "id", "uuid", "bootGroupId", "memberType", "memberId", "bootOrder"));
+    }
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupReadinessCheckResultVO.java b/engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupReadinessCheckResultVO.java
new file mode 100644
index 000000000000..4863dd7d9199
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupReadinessCheckResultVO.java
@@ -0,0 +1,113 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup;
+
+import java.util.Date;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.EnumType;
+import javax.persistence.Enumerated;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Table;
+import javax.persistence.Temporal;
+import javax.persistence.TemporalType;
+
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
+
+/**
+ * Last cached evaluation result for a readiness rule, upserted in place — no history, by design.
+ * {@code vmId} is 0 for the rule's "own" row (a VM-scoped rule's single target, or a group-scoped
+ * rule's all-members aggregate); a group-scoped rule inherited by its members additionally gets one
+ * row per (ruleId, vmId) for that member's own individual result.
+ */
+@Entity
+@Table(name = "instance_boot_group_readiness_check_result")
+public class InstanceBootGroupReadinessCheckResultVO {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "id")
+    private long id;
+
+    @Column(name = "rule_id")
+    private long ruleId;
+
+    @Column(name = "vm_id")
+    private long vmId;
+
+    @Column(name = "status")
+    @Enumerated(EnumType.STRING)
+    private InstanceBootGroupReadinessRule.Status status;
+
+    @Column(name = "message")
+    private String message;
+
+    @Column(name = "checked_on")
+    @Temporal(TemporalType.TIMESTAMP)
+    private Date checkedOn;
+
+    protected InstanceBootGroupReadinessCheckResultVO() {
+    }
+
+    public InstanceBootGroupReadinessCheckResultVO(long ruleId, long vmId, InstanceBootGroupReadinessRule.Status status, String message, Date checkedOn) {
+        this.ruleId = ruleId;
+        this.vmId = vmId;
+        this.status = status;
+        this.message = message;
+        this.checkedOn = checkedOn;
+    }
+
+    public long getId() {
+        return id;
+    }
+
+    public long getRuleId() {
+        return ruleId;
+    }
+
+    public long getVmId() {
+        return vmId;
+    }
+
+    public InstanceBootGroupReadinessRule.Status getStatus() {
+        return status;
+    }
+
+    public void setStatus(InstanceBootGroupReadinessRule.Status status) {
+        this.status = status;
+    }
+
+    public String getMessage() {
+        return message;
+    }
+
+    public void setMessage(String message) {
+        this.message = message;
+    }
+
+    public Date getCheckedOn() {
+        return checkedOn;
+    }
+
+    public void setCheckedOn(Date checkedOn) {
+        this.checkedOn = checkedOn;
+    }
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupReadinessRuleDetailsVO.java b/engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupReadinessRuleDetailsVO.java
new file mode 100644
index 000000000000..f91bbb99b8c6
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupReadinessRuleDetailsVO.java
@@ -0,0 +1,99 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Table;
+
+import org.apache.cloudstack.api.ResourceDetail;
+
+/**
+ * Generic key/value config for a readiness rule (port/protocol, script content, threshold, ...).
+ * The {@code script} key is encrypted at rest by {@code InstanceBootGroupReadinessRuleDetailsDaoImpl}
+ * for CustomScript rules, the same manual encrypt-by-known-key-name pattern used for S3/Swift
+ * secrets in {@code ImageStoreDetailVO} — there is no boolean "encrypted" flag column convention in
+ * this codebase.
+ */
+@Entity
+@Table(name = "instance_boot_group_readiness_rule_details")
+public class InstanceBootGroupReadinessRuleDetailsVO implements ResourceDetail {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "id")
+    private long id;
+
+    @Column(name = "rule_id")
+    private long resourceId;
+
+    @Column(name = "name")
+    private String name;
+
+    @Column(name = "value")
+    private String value;
+
+    @Column(name = "display")
+    private boolean display = true;
+
+    protected InstanceBootGroupReadinessRuleDetailsVO() {
+    }
+
+    public InstanceBootGroupReadinessRuleDetailsVO(long ruleId, String name, String value) {
+        this.resourceId = ruleId;
+        this.name = name;
+        this.value = value;
+    }
+
+    public InstanceBootGroupReadinessRuleDetailsVO(long ruleId, String name, String value, boolean display) {
+        this(ruleId, name, value);
+        this.display = display;
+    }
+
+    @Override
+    public long getId() {
+        return id;
+    }
+
+    @Override
+    public long getResourceId() {
+        return resourceId;
+    }
+
+    @Override
+    public String getName() {
+        return name;
+    }
+
+    @Override
+    public String getValue() {
+        return value;
+    }
+
+    public void setValue(String value) {
+        this.value = value;
+    }
+
+    @Override
+    public boolean isDisplay() {
+        return display;
+    }
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupReadinessRuleVO.java b/engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupReadinessRuleVO.java
new file mode 100644
index 000000000000..55596b2d580a
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupReadinessRuleVO.java
@@ -0,0 +1,149 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup;
+
+import java.util.Date;
+import java.util.UUID;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.EnumType;
+import javax.persistence.Enumerated;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Table;
+
+import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
+
+import com.cloud.utils.db.GenericDao;
+
+@Entity
+@Table(name = "instance_boot_group_readiness_rule")
+public class InstanceBootGroupReadinessRuleVO implements InstanceBootGroupReadinessRule {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "id")
+    private long id;
+
+    @Column(name = "uuid")
+    private String uuid;
+
+    @Column(name = "name")
+    private String name;
+
+    @Column(name = "boot_group_id")
+    private long bootGroupId;
+
+    @Column(name = "item_type")
+    @Enumerated(EnumType.STRING)
+    private InstanceBootGroupMember.MemberType itemType;
+
+    @Column(name = "item_id")
+    private long itemId;
+
+    @Column(name = "rule_type")
+    @Enumerated(EnumType.STRING)
+    private RuleType ruleType;
+
+    @Column(name = "enabled")
+    private boolean enabled = true;
+
+    @Column(name = GenericDao.CREATED_COLUMN)
+    private Date created;
+
+    @Column(name = GenericDao.REMOVED_COLUMN)
+    private Date removed;
+
+    protected InstanceBootGroupReadinessRuleVO() {
+    }
+
+    public InstanceBootGroupReadinessRuleVO(String name, long bootGroupId, InstanceBootGroupMember.MemberType itemType, long itemId, RuleType ruleType, boolean enabled) {
+        this.name = name;
+        this.bootGroupId = bootGroupId;
+        this.itemType = itemType;
+        this.itemId = itemId;
+        this.ruleType = ruleType;
+        this.enabled = enabled;
+        this.uuid = UUID.randomUUID().toString();
+    }
+
+    @Override
+    public long getId() {
+        return id;
+    }
+
+    @Override
+    public String getUuid() {
+        return uuid;
+    }
+
+    @Override
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    @Override
+    public long getBootGroupId() {
+        return bootGroupId;
+    }
+
+    @Override
+    public InstanceBootGroupMember.MemberType getItemType() {
+        return itemType;
+    }
+
+    @Override
+    public long getItemId() {
+        return itemId;
+    }
+
+    @Override
+    public RuleType getRuleType() {
+        return ruleType;
+    }
+
+    @Override
+    public boolean isEnabled() {
+        return enabled;
+    }
+
+    public void setEnabled(boolean enabled) {
+        this.enabled = enabled;
+    }
+
+    @Override
+    public Date getCreated() {
+        return created;
+    }
+
+    public Date getRemoved() {
+        return removed;
+    }
+
+    @Override
+    public String toString() {
+        return String.format("ReadinessRule %s", ReflectionToStringBuilderUtils.reflectOnlySelectedFields(this, "id", "uuid", "name", "itemType", "itemId", "ruleType", "enabled"));
+    }
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupVO.java b/engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupVO.java
new file mode 100644
index 000000000000..7ac79fda789d
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupVO.java
@@ -0,0 +1,131 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup;
+
+import java.util.Date;
+import java.util.UUID;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Table;
+
+import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;
+
+import com.cloud.utils.db.GenericDao;
+
+@Entity
+@Table(name = "instance_boot_group")
+public class InstanceBootGroupVO implements InstanceBootGroup {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "id")
+    private long id;
+
+    @Column(name = "uuid")
+    private String uuid;
+
+    @Column(name = "name")
+    private String name;
+
+    @Column(name = "description")
+    private String description;
+
+    @Column(name = "account_id")
+    private long accountId;
+
+    @Column(name = "domain_id")
+    private long domainId;
+
+    @Column(name = GenericDao.CREATED_COLUMN)
+    private Date created;
+
+    @Column(name = GenericDao.REMOVED_COLUMN)
+    private Date removed;
+
+    protected InstanceBootGroupVO() {
+    }
+
+    public InstanceBootGroupVO(String name, String description, long accountId, long domainId) {
+        this.name = name;
+        this.description = description;
+        this.accountId = accountId;
+        this.domainId = domainId;
+        this.uuid = UUID.randomUUID().toString();
+    }
+
+    @Override
+    public long getId() {
+        return id;
+    }
+
+    @Override
+    public String getUuid() {
+        return uuid;
+    }
+
+    @Override
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    @Override
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    @Override
+    public long getAccountId() {
+        return accountId;
+    }
+
+    @Override
+    public long getDomainId() {
+        return domainId;
+    }
+
+    @Override
+    public Date getCreated() {
+        return created;
+    }
+
+    public Date getRemoved() {
+        return removed;
+    }
+
+    @Override
+    public Class<?> getEntityType() {
+        return InstanceBootGroup.class;
+    }
+
+    @Override
+    public String toString() {
+        return String.format("BootGroup %s", ReflectionToStringBuilderUtils.reflectOnlySelectedFields(this, "id", "uuid", "name"));
+    }
+}
diff --git a/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-daos-context.xml b/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-daos-context.xml
index 932db538f30b..484bebe22a09 100644
--- a/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-daos-context.xml
+++ b/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-daos-context.xml
@@ -108,6 +108,12 @@
   <bean id="instanceGroupJoinDaoImpl" class="com.cloud.api.query.dao.InstanceGroupJoinDaoImpl" />
   <bean id="managementServerJoinDaoImpl" class="com.cloud.api.query.dao.ManagementServerJoinDaoImpl" />
   <bean id="instanceGroupVMMapDaoImpl" class="com.cloud.vm.dao.InstanceGroupVMMapDaoImpl" />
+  <bean id="instanceBootGroupDaoImpl" class="com.cloud.vm.dao.InstanceBootGroupDaoImpl" />
+  <bean id="instanceBootGroupMemberDaoImpl" class="com.cloud.vm.dao.InstanceBootGroupMemberDaoImpl" />
+  <bean id="instanceBootGroupReadinessRuleDaoImpl" class="com.cloud.vm.dao.InstanceBootGroupReadinessRuleDaoImpl" />
+  <bean id="instanceBootGroupReadinessRuleDetailsDaoImpl" class="com.cloud.vm.dao.InstanceBootGroupReadinessRuleDetailsDaoImpl" />
+  <bean id="instanceBootGroupReadinessCheckResultDaoImpl" class="com.cloud.vm.dao.InstanceBootGroupReadinessCheckResultDaoImpl" />
+  <bean id="instanceBootGroupDetailsDaoImpl" class="com.cloud.vm.dao.InstanceBootGroupDetailsDaoImpl" />
   <bean id="vmIsoMapDaoImpl" class="com.cloud.vm.dao.VmIsoMapDaoImpl" />
   <bean id="itWorkDaoImpl" class="com.cloud.vm.ItWorkDaoImpl" />
   <bean id="lBHealthCheckPolicyDaoImpl" class="com.cloud.network.dao.LBHealthCheckPolicyDaoImpl" />
@@ -329,5 +335,6 @@
   <bean id="dnsZoneJoinDao" class="org.apache.cloudstack.dns.dao.DnsZoneJoinDaoImpl" />
   <bean id="dnsNicJoinDao" class="org.apache.cloudstack.dns.dao.NicDnsJoinDaoImpl" />
   <bean id="dnsServerDetailsDao" class="org.apache.cloudstack.dns.dao.DnsServerDetailsDaoImpl" />
+  <bean id="instanceBootGroupJoinDao" class="org.apache.cloudstack.api.query.dao.InstanceBootGroupJoinDaoImpl" />
 
 </beans>
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42300to2400.sql b/engine/schema/src/main/resources/META-INF/db/schema-42300to2400.sql
index 7c11013a17d2..863ee93bc01a 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-42300to2400.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42300to2400.sql
@@ -18,3 +18,85 @@
 --;
 -- Schema upgrade from 4.23.0.0 to 24.0.0
 --;
+
+-- InstanceBootGroup: ordered boot sequencing for VMs and InstanceGroups
+CREATE TABLE IF NOT EXISTS `cloud`.`instance_boot_group` (
+    `id`          bigint unsigned NOT NULL UNIQUE AUTO_INCREMENT,
+    `uuid`        varchar(40)     NOT NULL,
+    `name`        varchar(255)    NOT NULL,
+    `description` varchar(4096)   DEFAULT NULL,
+    `account_id`  bigint unsigned NOT NULL COMMENT 'owner; foreign key to account table',
+    `domain_id`   bigint unsigned NOT NULL,
+    `created`     datetime        NOT NULL,
+    `removed`     datetime        DEFAULT NULL COMMENT 'date the group was soft-deleted',
+    PRIMARY KEY (`id`),
+    CONSTRAINT `uc_instance_boot_group__uuid`       UNIQUE (`uuid`),
+    CONSTRAINT `fk_instance_boot_group__account_id` FOREIGN KEY (`account_id`) REFERENCES `account` (`id`),
+    CONSTRAINT `fk_instance_boot_group__domain_id`  FOREIGN KEY (`domain_id`)  REFERENCES `domain`  (`id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE IF NOT EXISTS `cloud`.`instance_boot_group_member` (
+    `id`            bigint unsigned NOT NULL AUTO_INCREMENT,
+    `uuid`          varchar(40)     NOT NULL,
+    `boot_group_id` bigint unsigned NOT NULL,
+    `member_type`   varchar(32)     NOT NULL COMMENT 'VirtualMachine or InstanceGroup',
+    `member_id`     bigint unsigned NOT NULL,
+    `boot_order`    int             NOT NULL DEFAULT 0,
+    `created`       datetime        NOT NULL,
+    PRIMARY KEY (`id`),
+    CONSTRAINT `uc_instance_boot_group_member__uuid`    UNIQUE (`uuid`),
+    CONSTRAINT `uq_instance_boot_group_member__member`  UNIQUE (`member_type`, `member_id`),
+    CONSTRAINT `fk_instance_boot_group_member__group_id` FOREIGN KEY (`boot_group_id`) REFERENCES `instance_boot_group` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- InstanceBootGroupReadinessRule: a readiness rule always belongs to exactly one boot group and
+-- references either a VirtualMachine or InstanceGroup item within it
+CREATE TABLE IF NOT EXISTS `cloud`.`instance_boot_group_readiness_rule` (
+    `id`            bigint unsigned NOT NULL UNIQUE AUTO_INCREMENT,
+    `uuid`          varchar(40)     NOT NULL,
+    `name`          varchar(255)    NOT NULL,
+    `boot_group_id` bigint unsigned NOT NULL,
+    `item_type`     varchar(32)     NOT NULL COMMENT 'VirtualMachine or InstanceGroup',
+    `item_id`       bigint unsigned NOT NULL,
+    `rule_type`     varchar(64)     NOT NULL,
+    `enabled`       tinyint(1)      NOT NULL DEFAULT 1,
+    `created`       datetime        NOT NULL,
+    `removed`       datetime        DEFAULT NULL COMMENT 'date the rule was soft-deleted',
+    PRIMARY KEY (`id`),
+    CONSTRAINT `uc_instance_boot_group_readiness_rule__uuid`     UNIQUE (`uuid`),
+    CONSTRAINT `fk_instance_boot_group_readiness_rule__group_id` FOREIGN KEY (`boot_group_id`) REFERENCES `instance_boot_group` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- Generic key/value config for a readiness rule (port/protocol, script content, threshold, ...);
+CREATE TABLE IF NOT EXISTS `cloud`.`instance_boot_group_readiness_rule_details` (
+    `id`      bigint unsigned NOT NULL AUTO_INCREMENT,
+    `rule_id` bigint unsigned NOT NULL,
+    `name`    varchar(255)    NOT NULL,
+    `value`   text            DEFAULT NULL,
+    `display` tinyint(1) NOT NULL DEFAULT 1 COMMENT 'Whether detail be displayed to the end user',
+    PRIMARY KEY (`id`),
+    CONSTRAINT `fk_instance_boot_group_readiness_rule_details__rule_id` FOREIGN KEY (`rule_id`) REFERENCES `instance_boot_group_readiness_rule` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- Last cached evaluation result for a readiness rule, upserted in place (no history, by design).
+CREATE TABLE IF NOT EXISTS `cloud`.`instance_boot_group_readiness_check_result` (
+    `id`         bigint unsigned NOT NULL AUTO_INCREMENT,
+    `rule_id`    bigint unsigned NOT NULL,
+    `vm_id`      bigint unsigned NOT NULL DEFAULT 0,
+    `status`     varchar(32)     NOT NULL DEFAULT 'Unknown',
+    `message`    varchar(4096)   DEFAULT NULL,
+    `checked_on` datetime        DEFAULT NULL,
+    PRIMARY KEY (`id`),
+    UNIQUE KEY `uk_instance_boot_group_readiness_check_result__rule_vm` (`rule_id`, `vm_id`),
+    CONSTRAINT `fk_instance_boot_group_readiness_check_result__rule_id` FOREIGN KEY (`rule_id`) REFERENCES `instance_boot_group_readiness_rule` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+CREATE TABLE IF NOT EXISTS `cloud`.`instance_boot_group_details` (
+    `id`            bigint unsigned NOT NULL AUTO_INCREMENT,
+    `boot_group_id` bigint unsigned NOT NULL,
+    `name`          varchar(255)    NOT NULL,
+    `value`         varchar(255)    DEFAULT NULL,
+    `display` tinyint(1) NOT NULL DEFAULT 1 COMMENT 'Whether detail be displayed to the end user',
+    PRIMARY KEY (`id`),
+    CONSTRAINT `fk_instance_boot_group_details__group_id` FOREIGN KEY (`boot_group_id`) REFERENCES `instance_boot_group` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
diff --git a/engine/schema/src/main/resources/META-INF/db/views/cloud.instance_boot_group_view.sql b/engine/schema/src/main/resources/META-INF/db/views/cloud.instance_boot_group_view.sql
new file mode 100644
index 000000000000..7547354f9034
--- /dev/null
+++ b/engine/schema/src/main/resources/META-INF/db/views/cloud.instance_boot_group_view.sql
@@ -0,0 +1,47 @@
+-- Licensed to the Apache Software Foundation (ASF) under one
+-- or more contributor license agreements.  See the NOTICE file
+-- distributed with this work for additional information
+-- regarding copyright ownership.  The ASF licenses this file
+-- to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance
+-- with the License.  You may obtain a copy of the License at
+--
+--   http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing,
+-- software distributed under the License is distributed on an
+-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+-- KIND, either express or implied.  See the License for the
+-- specific language governing permissions and limitations
+-- under the License.
+
+-- VIEW `cloud`.`instance_boot_group_view`;
+
+DROP VIEW IF EXISTS `cloud`.`instance_boot_group_view`;
+CREATE VIEW `cloud`.`instance_boot_group_view` AS
+SELECT
+    instance_boot_group.id,
+    instance_boot_group.uuid,
+    instance_boot_group.name,
+    instance_boot_group.description,
+    instance_boot_group.created,
+    instance_boot_group.removed,
+    account.id account_id,
+    account.uuid account_uuid,
+    account.account_name account_name,
+    account.type account_type,
+    domain.id domain_id,
+    domain.uuid domain_uuid,
+    domain.name domain_name,
+    domain.path domain_path,
+    projects.id project_id,
+    projects.uuid project_uuid,
+    projects.name project_name
+FROM
+    `cloud`.`instance_boot_group`
+        INNER JOIN
+    `cloud`.`account` ON instance_boot_group.account_id = account.id
+        INNER JOIN
+    `cloud`.`domain` ON instance_boot_group.domain_id = domain.id
+        LEFT JOIN
+    `cloud`.`projects` ON projects.project_account_id = instance_boot_group.account_id;
diff --git a/engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupDaoImplTest.java b/engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupDaoImplTest.java
new file mode 100644
index 000000000000..6aa5f2813c53
--- /dev/null
+++ b/engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupDaoImplTest.java
@@ -0,0 +1,99 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.vm.dao;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupVO;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mockito;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.utils.Pair;
+import com.cloud.utils.db.Attribute;
+import com.cloud.utils.db.SearchCriteria;
+
+@RunWith(MockitoJUnitRunner.class)
+public class InstanceBootGroupDaoImplTest {
+
+    @Spy
+    InstanceBootGroupDaoImpl instanceBootGroupDaoImplSpy;
+
+    private static final long ACCOUNT_ID = 10L;
+    private static final String NAME = "boot-group-1";
+
+    private Map<String, Object> paramMap(SearchCriteria<?> sc) {
+        Map<String, Object> map = new HashMap<>();
+        for (Pair<Attribute, Object> pair : sc.getValues()) {
+            map.put(pair.first().getColumnName(), pair.second());
+        }
+        return map;
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testListByAccountId() {
+        List<InstanceBootGroupVO> expected = new ArrayList<>();
+        expected.add(Mockito.mock(InstanceBootGroupVO.class));
+
+        Mockito.doReturn(expected).when(instanceBootGroupDaoImplSpy).listBy(Mockito.any(SearchCriteria.class));
+
+        List<InstanceBootGroupVO> result = instanceBootGroupDaoImplSpy.listByAccountId(ACCOUNT_ID);
+
+        Assert.assertEquals(expected, result);
+
+        ArgumentCaptor<SearchCriteria> scCaptor = ArgumentCaptor.forClass(SearchCriteria.class);
+        Mockito.verify(instanceBootGroupDaoImplSpy).listBy(scCaptor.capture());
+        Map<String, Object> params = paramMap(scCaptor.getValue());
+        Assert.assertEquals(ACCOUNT_ID, params.get("account_id"));
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testIsNameInUseTrueWhenResultsFound() {
+        List<InstanceBootGroupVO> found = Collections.singletonList(Mockito.mock(InstanceBootGroupVO.class));
+        Mockito.doReturn(found).when(instanceBootGroupDaoImplSpy).listBy(Mockito.any(SearchCriteria.class));
+
+        boolean result = instanceBootGroupDaoImplSpy.isNameInUse(ACCOUNT_ID, NAME);
+
+        Assert.assertTrue(result);
+
+        ArgumentCaptor<SearchCriteria> scCaptor = ArgumentCaptor.forClass(SearchCriteria.class);
+        Mockito.verify(instanceBootGroupDaoImplSpy).listBy(scCaptor.capture());
+        Map<String, Object> params = paramMap(scCaptor.getValue());
+        Assert.assertEquals(ACCOUNT_ID, params.get("account_id"));
+        Assert.assertEquals(NAME, params.get("name"));
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testIsNameInUseFalseWhenNoResults() {
+        Mockito.doReturn(new ArrayList<>()).when(instanceBootGroupDaoImplSpy).listBy(Mockito.any(SearchCriteria.class));
+
+        boolean result = instanceBootGroupDaoImplSpy.isNameInUse(ACCOUNT_ID, NAME);
+
+        Assert.assertFalse(result);
+    }
+}
diff --git a/engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupDetailsDaoImplTest.java b/engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupDetailsDaoImplTest.java
new file mode 100644
index 000000000000..3fe22b5889fe
--- /dev/null
+++ b/engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupDetailsDaoImplTest.java
@@ -0,0 +1,143 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.vm.dao;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupDetailsVO;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mockito;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.utils.Pair;
+import com.cloud.utils.db.Attribute;
+import com.cloud.utils.db.SearchCriteria;
+
+@RunWith(MockitoJUnitRunner.class)
+public class InstanceBootGroupDetailsDaoImplTest {
+
+    @Spy
+    InstanceBootGroupDetailsDaoImpl instanceBootGroupDetailsDaoImplSpy;
+
+    private static final long BOOT_GROUP_ID = 7L;
+    private static final String NAME = "readiness.timeout";
+    private static final String VALUE = "300";
+
+    private Map<String, Object> paramMap(SearchCriteria<?> sc) {
+        Map<String, Object> map = new HashMap<>();
+        for (Pair<Attribute, Object> pair : sc.getValues()) {
+            map.put(pair.first().getColumnName(), pair.second());
+        }
+        return map;
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testGetDetailWhenExists() {
+        InstanceBootGroupDetailsVO detail = Mockito.mock(InstanceBootGroupDetailsVO.class);
+        Mockito.when(detail.getValue()).thenReturn(VALUE);
+        Mockito.doReturn(detail).when(instanceBootGroupDetailsDaoImplSpy).findOneBy(Mockito.any(SearchCriteria.class));
+
+        String result = instanceBootGroupDetailsDaoImplSpy.getDetail(BOOT_GROUP_ID, NAME);
+
+        Assert.assertEquals(VALUE, result);
+
+        ArgumentCaptor<SearchCriteria> scCaptor = ArgumentCaptor.forClass(SearchCriteria.class);
+        Mockito.verify(instanceBootGroupDetailsDaoImplSpy).findOneBy(scCaptor.capture());
+        Map<String, Object> params = paramMap(scCaptor.getValue());
+        Assert.assertEquals(BOOT_GROUP_ID, params.get("boot_group_id"));
+        Assert.assertEquals(NAME, params.get("name"));
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testGetDetailWhenNotExists() {
+        Mockito.doReturn(null).when(instanceBootGroupDetailsDaoImplSpy).findOneBy(Mockito.any(SearchCriteria.class));
+
+        String result = instanceBootGroupDetailsDaoImplSpy.getDetail(BOOT_GROUP_ID, NAME);
+
+        Assert.assertNull(result);
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testSetDetailInsertsWhenNotExisting() {
+        Mockito.doReturn(null).when(instanceBootGroupDetailsDaoImplSpy).findOneBy(Mockito.any(SearchCriteria.class));
+        Mockito.doReturn(null).when(instanceBootGroupDetailsDaoImplSpy).persist(Mockito.any(InstanceBootGroupDetailsVO.class));
+
+        instanceBootGroupDetailsDaoImplSpy.setDetail(BOOT_GROUP_ID, NAME, VALUE);
+
+        ArgumentCaptor<InstanceBootGroupDetailsVO> voCaptor = ArgumentCaptor.forClass(InstanceBootGroupDetailsVO.class);
+        Mockito.verify(instanceBootGroupDetailsDaoImplSpy).persist(voCaptor.capture());
+        Assert.assertEquals(BOOT_GROUP_ID, voCaptor.getValue().getResourceId());
+        Assert.assertEquals(NAME, voCaptor.getValue().getName());
+        Assert.assertEquals(VALUE, voCaptor.getValue().getValue());
+        Mockito.verify(instanceBootGroupDetailsDaoImplSpy, Mockito.never()).update(Mockito.anyLong(), Mockito.any());
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testSetDetailUpdatesWhenExisting() {
+        InstanceBootGroupDetailsVO existing = new InstanceBootGroupDetailsVO(BOOT_GROUP_ID, NAME, "old-value");
+        Mockito.doReturn(existing).when(instanceBootGroupDetailsDaoImplSpy).findOneBy(Mockito.any(SearchCriteria.class));
+        Mockito.doReturn(true).when(instanceBootGroupDetailsDaoImplSpy).update(Mockito.anyLong(), Mockito.any());
+
+        instanceBootGroupDetailsDaoImplSpy.setDetail(BOOT_GROUP_ID, NAME, VALUE);
+
+        Assert.assertEquals(VALUE, existing.getValue());
+        Mockito.verify(instanceBootGroupDetailsDaoImplSpy).update(existing.getId(), existing);
+        Mockito.verify(instanceBootGroupDetailsDaoImplSpy, Mockito.never()).persist(Mockito.any(InstanceBootGroupDetailsVO.class));
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testListDetails() {
+        List<InstanceBootGroupDetailsVO> details = new ArrayList<>();
+        details.add(new InstanceBootGroupDetailsVO(BOOT_GROUP_ID, "key1", "value1"));
+        details.add(new InstanceBootGroupDetailsVO(BOOT_GROUP_ID, "key2", "value2"));
+        Mockito.doReturn(details).when(instanceBootGroupDetailsDaoImplSpy).search(Mockito.any(SearchCriteria.class), Mockito.isNull());
+
+        Map<String, String> result = instanceBootGroupDetailsDaoImplSpy.listDetailsKeyPairs(BOOT_GROUP_ID);
+
+        Assert.assertEquals(2, result.size());
+        Assert.assertEquals("value1", result.get("key1"));
+        Assert.assertEquals("value2", result.get("key2"));
+
+        ArgumentCaptor<SearchCriteria> scCaptor = ArgumentCaptor.forClass(SearchCriteria.class);
+        Mockito.verify(instanceBootGroupDetailsDaoImplSpy).search(scCaptor.capture(), Mockito.isNull());
+        Map<String, Object> params = paramMap(scCaptor.getValue());
+        Assert.assertEquals(BOOT_GROUP_ID, params.get("boot_group_id"));
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testListDetailsEmpty() {
+        Mockito.doReturn(new ArrayList<>()).when(instanceBootGroupDetailsDaoImplSpy).search(Mockito.any(SearchCriteria.class), Mockito.isNull());
+
+        Map<String, String> result = instanceBootGroupDetailsDaoImplSpy.listDetailsKeyPairs(BOOT_GROUP_ID);
+
+        Assert.assertNotNull(result);
+        Assert.assertTrue(result.isEmpty());
+    }
+}
diff --git a/engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupMemberDaoImplTest.java b/engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupMemberDaoImplTest.java
new file mode 100644
index 000000000000..e2719a17a727
--- /dev/null
+++ b/engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupMemberDaoImplTest.java
@@ -0,0 +1,144 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.vm.dao;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMember;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMemberVO;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mockito;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.utils.Pair;
+import com.cloud.utils.db.Attribute;
+import com.cloud.utils.db.SearchCriteria;
+
+@RunWith(MockitoJUnitRunner.class)
+public class InstanceBootGroupMemberDaoImplTest {
+
+    @Spy
+    InstanceBootGroupMemberDaoImpl instanceBootGroupMemberDaoImplSpy;
+
+    private static final long BOOT_GROUP_ID = 5L;
+    private static final long MEMBER_ID = 42L;
+
+    private Map<String, Object> paramMap(SearchCriteria<?> sc) {
+        Map<String, Object> map = new HashMap<>();
+        for (Pair<Attribute, Object> pair : sc.getValues()) {
+            map.put(pair.first().getColumnName(), pair.second());
+        }
+        return map;
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testListByBootGroupId() {
+        List<InstanceBootGroupMemberVO> expected = List.of(Mockito.mock(InstanceBootGroupMemberVO.class));
+        Mockito.doReturn(expected).when(instanceBootGroupMemberDaoImplSpy).listBy(Mockito.any(SearchCriteria.class), Mockito.isNull());
+
+        List<InstanceBootGroupMemberVO> result = instanceBootGroupMemberDaoImplSpy.listByBootGroupId(BOOT_GROUP_ID);
+
+        Assert.assertEquals(expected, result);
+
+        ArgumentCaptor<SearchCriteria> scCaptor = ArgumentCaptor.forClass(SearchCriteria.class);
+        Mockito.verify(instanceBootGroupMemberDaoImplSpy).listBy(scCaptor.capture(), Mockito.isNull());
+        Map<String, Object> params = paramMap(scCaptor.getValue());
+        Assert.assertEquals(BOOT_GROUP_ID, params.get("boot_group_id"));
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testSearchAndCountByBootGroupId() {
+        Pair<List<InstanceBootGroupMemberVO>, Integer> expected = new Pair<>(new ArrayList<>(), 0);
+        Mockito.doReturn(expected).when(instanceBootGroupMemberDaoImplSpy).searchAndCount(Mockito.any(SearchCriteria.class), Mockito.isNull());
+
+        Pair<List<InstanceBootGroupMemberVO>, Integer> result = instanceBootGroupMemberDaoImplSpy.searchAndCountByBootGroupId(BOOT_GROUP_ID);
+
+        Assert.assertEquals(expected, result);
+
+        ArgumentCaptor<SearchCriteria> scCaptor = ArgumentCaptor.forClass(SearchCriteria.class);
+        Mockito.verify(instanceBootGroupMemberDaoImplSpy).searchAndCount(scCaptor.capture(), Mockito.isNull());
+        Map<String, Object> params = paramMap(scCaptor.getValue());
+        Assert.assertEquals(BOOT_GROUP_ID, params.get("boot_group_id"));
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testSearchAndCountByBootGroupIdAndType() {
+        Pair<List<InstanceBootGroupMemberVO>, Integer> expected = new Pair<>(new ArrayList<>(), 0);
+        Mockito.doReturn(expected).when(instanceBootGroupMemberDaoImplSpy).searchAndCount(Mockito.any(SearchCriteria.class), Mockito.isNull());
+
+        Pair<List<InstanceBootGroupMemberVO>, Integer> result = instanceBootGroupMemberDaoImplSpy
+                .searchAndCountByBootGroupIdAndType(BOOT_GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine);
+
+        Assert.assertEquals(expected, result);
+
+        ArgumentCaptor<SearchCriteria> scCaptor = ArgumentCaptor.forClass(SearchCriteria.class);
+        Mockito.verify(instanceBootGroupMemberDaoImplSpy).searchAndCount(scCaptor.capture(), Mockito.isNull());
+        Map<String, Object> params = paramMap(scCaptor.getValue());
+        Assert.assertEquals(BOOT_GROUP_ID, params.get("boot_group_id"));
+        Assert.assertEquals(InstanceBootGroupMember.MemberType.VirtualMachine, params.get("member_type"));
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testFindByMember() {
+        InstanceBootGroupMemberVO expected = Mockito.mock(InstanceBootGroupMemberVO.class);
+        Mockito.doReturn(expected).when(instanceBootGroupMemberDaoImplSpy).findOneBy(Mockito.any(SearchCriteria.class));
+
+        InstanceBootGroupMemberVO result = instanceBootGroupMemberDaoImplSpy.findByMember(InstanceBootGroupMember.MemberType.InstanceGroup, MEMBER_ID);
+
+        Assert.assertEquals(expected, result);
+
+        ArgumentCaptor<SearchCriteria> scCaptor = ArgumentCaptor.forClass(SearchCriteria.class);
+        Mockito.verify(instanceBootGroupMemberDaoImplSpy).findOneBy(scCaptor.capture());
+        Map<String, Object> params = paramMap(scCaptor.getValue());
+        Assert.assertEquals(InstanceBootGroupMember.MemberType.InstanceGroup, params.get("member_type"));
+        Assert.assertEquals(MEMBER_ID, params.get("member_id"));
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testFindByMemberNotFound() {
+        Mockito.doReturn(null).when(instanceBootGroupMemberDaoImplSpy).findOneBy(Mockito.any(SearchCriteria.class));
+
+        InstanceBootGroupMemberVO result = instanceBootGroupMemberDaoImplSpy.findByMember(InstanceBootGroupMember.MemberType.VirtualMachine, MEMBER_ID);
+
+        Assert.assertNull(result);
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testDeleteByBootGroupId() {
+        Mockito.doReturn(1).when(instanceBootGroupMemberDaoImplSpy).expunge(Mockito.any(SearchCriteria.class));
+
+        instanceBootGroupMemberDaoImplSpy.deleteByBootGroupId(BOOT_GROUP_ID);
+
+        ArgumentCaptor<SearchCriteria> scCaptor = ArgumentCaptor.forClass(SearchCriteria.class);
+        Mockito.verify(instanceBootGroupMemberDaoImplSpy).expunge(scCaptor.capture());
+        Map<String, Object> params = paramMap(scCaptor.getValue());
+        Assert.assertEquals(BOOT_GROUP_ID, params.get("boot_group_id"));
+    }
+}
diff --git a/engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupReadinessCheckResultDaoImplTest.java b/engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupReadinessCheckResultDaoImplTest.java
new file mode 100644
index 000000000000..29b76943552e
--- /dev/null
+++ b/engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupReadinessCheckResultDaoImplTest.java
@@ -0,0 +1,120 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.vm.dao;
+
+import java.util.Date;
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupReadinessCheckResultVO;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mockito;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.utils.Pair;
+import com.cloud.utils.db.Attribute;
+import com.cloud.utils.db.SearchCriteria;
+
+@RunWith(MockitoJUnitRunner.class)
+public class InstanceBootGroupReadinessCheckResultDaoImplTest {
+
+    @Spy
+    InstanceBootGroupReadinessCheckResultDaoImpl instanceBootGroupReadinessCheckResultDaoImplSpy;
+
+    private static final long RULE_ID = 21L;
+    private static final long VM_ID = 99L;
+
+    private Map<String, Object> paramMap(SearchCriteria<?> sc) {
+        Map<String, Object> map = new HashMap<>();
+        for (Pair<Attribute, Object> pair : sc.getValues()) {
+            map.put(pair.first().getColumnName(), pair.second());
+        }
+        return map;
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testFindByRuleAndVm() {
+        InstanceBootGroupReadinessCheckResultVO expected = Mockito.mock(InstanceBootGroupReadinessCheckResultVO.class);
+        Mockito.doReturn(expected).when(instanceBootGroupReadinessCheckResultDaoImplSpy).findOneBy(Mockito.any(SearchCriteria.class));
+
+        InstanceBootGroupReadinessCheckResultVO result = instanceBootGroupReadinessCheckResultDaoImplSpy.findByRuleAndVm(RULE_ID, VM_ID);
+
+        Assert.assertEquals(expected, result);
+
+        ArgumentCaptor<SearchCriteria> scCaptor = ArgumentCaptor.forClass(SearchCriteria.class);
+        Mockito.verify(instanceBootGroupReadinessCheckResultDaoImplSpy).findOneBy(scCaptor.capture());
+        Map<String, Object> params = paramMap(scCaptor.getValue());
+        Assert.assertEquals(RULE_ID, params.get("rule_id"));
+        Assert.assertEquals(VM_ID, params.get("vm_id"));
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testUpsertInsertsWhenNoExistingResult() {
+        Mockito.doReturn(null).when(instanceBootGroupReadinessCheckResultDaoImplSpy).findOneBy(Mockito.any(SearchCriteria.class));
+        Mockito.doReturn(null).when(instanceBootGroupReadinessCheckResultDaoImplSpy).persist(Mockito.any(InstanceBootGroupReadinessCheckResultVO.class));
+
+        Date checkedOn = new Date();
+        instanceBootGroupReadinessCheckResultDaoImplSpy.upsert(RULE_ID, VM_ID, InstanceBootGroupReadinessRule.Status.Ready, "all good", checkedOn);
+
+        ArgumentCaptor<InstanceBootGroupReadinessCheckResultVO> voCaptor = ArgumentCaptor.forClass(InstanceBootGroupReadinessCheckResultVO.class);
+        Mockito.verify(instanceBootGroupReadinessCheckResultDaoImplSpy).persist(voCaptor.capture());
+        Assert.assertEquals(RULE_ID, voCaptor.getValue().getRuleId());
+        Assert.assertEquals(VM_ID, voCaptor.getValue().getVmId());
+        Assert.assertEquals(InstanceBootGroupReadinessRule.Status.Ready, voCaptor.getValue().getStatus());
+        Assert.assertEquals("all good", voCaptor.getValue().getMessage());
+        Assert.assertEquals(checkedOn, voCaptor.getValue().getCheckedOn());
+        Mockito.verify(instanceBootGroupReadinessCheckResultDaoImplSpy, Mockito.never()).update(Mockito.anyLong(), Mockito.any());
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testUpsertUpdatesWhenExistingResult() {
+        InstanceBootGroupReadinessCheckResultVO existing = new InstanceBootGroupReadinessCheckResultVO(
+                RULE_ID, VM_ID, InstanceBootGroupReadinessRule.Status.Unknown, "old", new Date(0));
+        Mockito.doReturn(existing).when(instanceBootGroupReadinessCheckResultDaoImplSpy).findOneBy(Mockito.any(SearchCriteria.class));
+        Mockito.doReturn(true).when(instanceBootGroupReadinessCheckResultDaoImplSpy).update(Mockito.anyLong(), Mockito.any());
+
+        Date checkedOn = new Date();
+        instanceBootGroupReadinessCheckResultDaoImplSpy.upsert(RULE_ID, VM_ID, InstanceBootGroupReadinessRule.Status.NotReady, "still booting", checkedOn);
+
+        Assert.assertEquals(InstanceBootGroupReadinessRule.Status.NotReady, existing.getStatus());
+        Assert.assertEquals("still booting", existing.getMessage());
+        Assert.assertEquals(checkedOn, existing.getCheckedOn());
+        Mockito.verify(instanceBootGroupReadinessCheckResultDaoImplSpy).update(existing.getId(), existing);
+        Mockito.verify(instanceBootGroupReadinessCheckResultDaoImplSpy, Mockito.never()).persist(Mockito.any(InstanceBootGroupReadinessCheckResultVO.class));
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testDeleteByRuleId() {
+        Mockito.doReturn(1).when(instanceBootGroupReadinessCheckResultDaoImplSpy).expunge(Mockito.any(SearchCriteria.class));
+
+        instanceBootGroupReadinessCheckResultDaoImplSpy.deleteByRuleId(RULE_ID);
+
+        ArgumentCaptor<SearchCriteria> scCaptor = ArgumentCaptor.forClass(SearchCriteria.class);
+        Mockito.verify(instanceBootGroupReadinessCheckResultDaoImplSpy).expunge(scCaptor.capture());
+        Map<String, Object> params = paramMap(scCaptor.getValue());
+        Assert.assertEquals(RULE_ID, params.get("rule_id"));
+    }
+}
diff --git a/engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDaoImplTest.java b/engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDaoImplTest.java
new file mode 100644
index 000000000000..372ddc536ac2
--- /dev/null
+++ b/engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDaoImplTest.java
@@ -0,0 +1,147 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.vm.dao;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMember;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupReadinessRuleVO;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mockito;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.utils.Pair;
+import com.cloud.utils.db.Attribute;
+import com.cloud.utils.db.Filter;
+import com.cloud.utils.db.SearchCriteria;
+
+@RunWith(MockitoJUnitRunner.class)
+public class InstanceBootGroupReadinessRuleDaoImplTest {
+
+    @Spy
+    InstanceBootGroupReadinessRuleDaoImpl instanceBootGroupReadinessRuleDaoImplSpy;
+
+    private static final long BOOT_GROUP_ID = 3L;
+    private static final long ITEM_ID = 8L;
+
+    private Map<String, Object> paramMap(SearchCriteria<?> sc) {
+        Map<String, Object> map = new HashMap<>();
+        for (Pair<Attribute, Object> pair : sc.getValues()) {
+            map.put(pair.first().getColumnName(), pair.second());
+        }
+        return map;
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testSearchAndCountByBootGroupIdWithAllFiltersSet() {
+        Pair<List<InstanceBootGroupReadinessRuleVO>, Integer> expected = new Pair<>(new ArrayList<>(), 0);
+        Mockito.doReturn(expected).when(instanceBootGroupReadinessRuleDaoImplSpy)
+                .searchAndCount(Mockito.any(SearchCriteria.class), Mockito.any(Filter.class));
+
+        Pair<List<InstanceBootGroupReadinessRuleVO>, Integer> result = instanceBootGroupReadinessRuleDaoImplSpy.searchAndCountByBootGroupId(
+                BOOT_GROUP_ID, 1L, InstanceBootGroupMember.MemberType.VirtualMachine, ITEM_ID,
+                InstanceBootGroupReadinessRule.RuleType.Ping, "healthcheck", 0L, 10L);
+
+        Assert.assertEquals(expected, result);
+
+        ArgumentCaptor<SearchCriteria> scCaptor = ArgumentCaptor.forClass(SearchCriteria.class);
+        ArgumentCaptor<Filter> filterCaptor = ArgumentCaptor.forClass(Filter.class);
+        Mockito.verify(instanceBootGroupReadinessRuleDaoImplSpy).searchAndCount(scCaptor.capture(), filterCaptor.capture());
+
+        Map<String, Object> params = paramMap(scCaptor.getValue());
+        Assert.assertEquals(BOOT_GROUP_ID, params.get("boot_group_id"));
+        Assert.assertEquals(1L, params.get("id"));
+        Assert.assertEquals(InstanceBootGroupMember.MemberType.VirtualMachine, params.get("item_type"));
+        Assert.assertEquals(ITEM_ID, params.get("item_id"));
+        Assert.assertEquals(InstanceBootGroupReadinessRule.RuleType.Ping, params.get("rule_type"));
+        Assert.assertEquals("%healthcheck%", params.get("name"));
+        Assert.assertNotNull(filterCaptor.getValue());
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testSearchAndCountByBootGroupIdWithOnlyMandatoryParams() {
+        Pair<List<InstanceBootGroupReadinessRuleVO>, Integer> expected = new Pair<>(new ArrayList<>(), 0);
+        Mockito.doReturn(expected).when(instanceBootGroupReadinessRuleDaoImplSpy)
+                .searchAndCount(Mockito.any(SearchCriteria.class), Mockito.any(Filter.class));
+
+        Pair<List<InstanceBootGroupReadinessRuleVO>, Integer> result = instanceBootGroupReadinessRuleDaoImplSpy.searchAndCountByBootGroupId(
+                BOOT_GROUP_ID, null, null, null, null, null, null, null);
+
+        Assert.assertEquals(expected, result);
+
+        ArgumentCaptor<SearchCriteria> scCaptor = ArgumentCaptor.forClass(SearchCriteria.class);
+        Mockito.verify(instanceBootGroupReadinessRuleDaoImplSpy).searchAndCount(scCaptor.capture(), Mockito.any(Filter.class));
+
+        Map<String, Object> params = paramMap(scCaptor.getValue());
+        Assert.assertEquals(BOOT_GROUP_ID, params.get("boot_group_id"));
+        Assert.assertFalse(params.containsKey("id"));
+        Assert.assertFalse(params.containsKey("item_type"));
+        Assert.assertFalse(params.containsKey("item_id"));
+        Assert.assertFalse(params.containsKey("rule_type"));
+        Assert.assertFalse(params.containsKey("name"));
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testListEnabledByItem() {
+        List<InstanceBootGroupReadinessRuleVO> expected = List.of(Mockito.mock(InstanceBootGroupReadinessRuleVO.class));
+        Mockito.doReturn(expected).when(instanceBootGroupReadinessRuleDaoImplSpy).listBy(Mockito.any(SearchCriteria.class));
+
+        List<InstanceBootGroupReadinessRuleVO> result = instanceBootGroupReadinessRuleDaoImplSpy.listEnabledByItem(
+                BOOT_GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, ITEM_ID);
+
+        Assert.assertEquals(expected, result);
+
+        ArgumentCaptor<SearchCriteria> scCaptor = ArgumentCaptor.forClass(SearchCriteria.class);
+        Mockito.verify(instanceBootGroupReadinessRuleDaoImplSpy).listBy(scCaptor.capture());
+        Map<String, Object> params = paramMap(scCaptor.getValue());
+        Assert.assertEquals(BOOT_GROUP_ID, params.get("boot_group_id"));
+        Assert.assertEquals(InstanceBootGroupMember.MemberType.InstanceGroup, params.get("item_type"));
+        Assert.assertEquals(ITEM_ID, params.get("item_id"));
+        Assert.assertEquals(Boolean.TRUE, params.get("enabled"));
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testListByItem() {
+        List<InstanceBootGroupReadinessRuleVO> expected = List.of(Mockito.mock(InstanceBootGroupReadinessRuleVO.class));
+        Mockito.doReturn(expected).when(instanceBootGroupReadinessRuleDaoImplSpy).listBy(Mockito.any(SearchCriteria.class));
+
+        List<InstanceBootGroupReadinessRuleVO> result = instanceBootGroupReadinessRuleDaoImplSpy.listByItem(
+                BOOT_GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, ITEM_ID);
+
+        Assert.assertEquals(expected, result);
+
+        ArgumentCaptor<SearchCriteria> scCaptor = ArgumentCaptor.forClass(SearchCriteria.class);
+        Mockito.verify(instanceBootGroupReadinessRuleDaoImplSpy).listBy(scCaptor.capture());
+        Map<String, Object> params = paramMap(scCaptor.getValue());
+        Assert.assertEquals(BOOT_GROUP_ID, params.get("boot_group_id"));
+        Assert.assertEquals(InstanceBootGroupMember.MemberType.VirtualMachine, params.get("item_type"));
+        Assert.assertEquals(ITEM_ID, params.get("item_id"));
+        Assert.assertFalse(params.containsKey("enabled"));
+    }
+}
diff --git a/engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDetailsDaoImplTest.java b/engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDetailsDaoImplTest.java
new file mode 100644
index 000000000000..dcfa00f9f362
--- /dev/null
+++ b/engine/schema/src/test/java/com/cloud/vm/dao/InstanceBootGroupReadinessRuleDetailsDaoImplTest.java
@@ -0,0 +1,116 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.vm.dao;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupReadinessRuleDetailsVO;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mockito;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.utils.crypt.DBEncryptionUtil;
+import com.cloud.utils.db.SearchCriteria;
+
+@RunWith(MockitoJUnitRunner.class)
+public class InstanceBootGroupReadinessRuleDetailsDaoImplTest {
+
+    @Spy
+    InstanceBootGroupReadinessRuleDetailsDaoImpl instanceBootGroupReadinessRuleDetailsDaoImplSpy;
+
+    private static final long RULE_ID = 15L;
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testAddDetailNonScriptKeyStoredAsIs() {
+        Mockito.doReturn(null).when(instanceBootGroupReadinessRuleDetailsDaoImplSpy).findDetail(RULE_ID, "port");
+        Mockito.doReturn(null).when(instanceBootGroupReadinessRuleDetailsDaoImplSpy).persist(Mockito.any(InstanceBootGroupReadinessRuleDetailsVO.class));
+
+        instanceBootGroupReadinessRuleDetailsDaoImplSpy.addDetail(RULE_ID, "port", "8080", true);
+
+        ArgumentCaptor<InstanceBootGroupReadinessRuleDetailsVO> voCaptor = ArgumentCaptor.forClass(InstanceBootGroupReadinessRuleDetailsVO.class);
+        Mockito.verify(instanceBootGroupReadinessRuleDetailsDaoImplSpy).persist(voCaptor.capture());
+        Assert.assertEquals(RULE_ID, voCaptor.getValue().getResourceId());
+        Assert.assertEquals("port", voCaptor.getValue().getName());
+        Assert.assertEquals("8080", voCaptor.getValue().getValue());
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testAddDetailScriptKeyStoredEncrypted() {
+        Mockito.doReturn(null).when(instanceBootGroupReadinessRuleDetailsDaoImplSpy).findDetail(RULE_ID, "script");
+        Mockito.doReturn(null).when(instanceBootGroupReadinessRuleDetailsDaoImplSpy).persist(Mockito.any(InstanceBootGroupReadinessRuleDetailsVO.class));
+
+        String plainScript = "#!/bin/bash\necho ok";
+        instanceBootGroupReadinessRuleDetailsDaoImplSpy.addDetail(RULE_ID, "script", plainScript, true);
+
+        ArgumentCaptor<InstanceBootGroupReadinessRuleDetailsVO> voCaptor = ArgumentCaptor.forClass(InstanceBootGroupReadinessRuleDetailsVO.class);
+        Mockito.verify(instanceBootGroupReadinessRuleDetailsDaoImplSpy).persist(voCaptor.capture());
+        Assert.assertEquals(RULE_ID, voCaptor.getValue().getResourceId());
+        Assert.assertEquals("script", voCaptor.getValue().getName());
+        Assert.assertEquals(DBEncryptionUtil.encrypt(plainScript), voCaptor.getValue().getValue());
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testAddDetailReplacesExistingDetail() {
+        InstanceBootGroupReadinessRuleDetailsVO existing = new InstanceBootGroupReadinessRuleDetailsVO(RULE_ID, "port", "9090");
+        Mockito.doReturn(existing).when(instanceBootGroupReadinessRuleDetailsDaoImplSpy).findDetail(RULE_ID, "port");
+        Mockito.doReturn(true).when(instanceBootGroupReadinessRuleDetailsDaoImplSpy).remove(existing.getId());
+        Mockito.doReturn(null).when(instanceBootGroupReadinessRuleDetailsDaoImplSpy).persist(Mockito.any(InstanceBootGroupReadinessRuleDetailsVO.class));
+
+        instanceBootGroupReadinessRuleDetailsDaoImplSpy.addDetail(RULE_ID, "port", "8080", true);
+
+        Mockito.verify(instanceBootGroupReadinessRuleDetailsDaoImplSpy).remove(existing.getId());
+        ArgumentCaptor<InstanceBootGroupReadinessRuleDetailsVO> voCaptor = ArgumentCaptor.forClass(InstanceBootGroupReadinessRuleDetailsVO.class);
+        Mockito.verify(instanceBootGroupReadinessRuleDetailsDaoImplSpy).persist(voCaptor.capture());
+        Assert.assertEquals("8080", voCaptor.getValue().getValue());
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testGetDetailsDecryptsScriptKeyAndLeavesOthersAsIs() {
+        String encryptedScript = DBEncryptionUtil.encrypt("plain-script-body");
+        List<InstanceBootGroupReadinessRuleDetailsVO> details = new ArrayList<>();
+        details.add(new InstanceBootGroupReadinessRuleDetailsVO(RULE_ID, "script", encryptedScript));
+        details.add(new InstanceBootGroupReadinessRuleDetailsVO(RULE_ID, "port", "8080"));
+        Mockito.doReturn(details).when(instanceBootGroupReadinessRuleDetailsDaoImplSpy).listBy(Mockito.any(SearchCriteria.class));
+
+        Map<String, String> result = instanceBootGroupReadinessRuleDetailsDaoImplSpy.getDetails(RULE_ID);
+
+        Assert.assertEquals(2, result.size());
+        Assert.assertEquals(DBEncryptionUtil.decrypt(encryptedScript), result.get("script"));
+        Assert.assertEquals("8080", result.get("port"));
+    }
+
+    @SuppressWarnings("unchecked")
+    @Test
+    public void testGetDetailsEmpty() {
+        Mockito.doReturn(new ArrayList<>()).when(instanceBootGroupReadinessRuleDetailsDaoImplSpy).listBy(Mockito.any(SearchCriteria.class));
+
+        Map<String, String> result = instanceBootGroupReadinessRuleDetailsDaoImplSpy.getDetails(RULE_ID);
+
+        Assert.assertNotNull(result);
+        Assert.assertTrue(result.isEmpty());
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckGuestAgentLivenessCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckGuestAgentLivenessCommandWrapper.java
new file mode 100644
index 000000000000..2be2426ec28a
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckGuestAgentLivenessCommandWrapper.java
@@ -0,0 +1,99 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import org.apache.cloudstack.utils.qemu.QemuCommand;
+import org.libvirt.Connect;
+import org.libvirt.Domain;
+import org.libvirt.DomainInfo.DomainState;
+import org.libvirt.LibvirtException;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.CheckGuestAgentLivenessAnswer;
+import com.cloud.agent.api.CheckGuestAgentLivenessCommand;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.google.gson.JsonElement;
+import com.google.gson.JsonParseException;
+import com.google.gson.JsonParser;
+
+@ResourceWrapper(handles = CheckGuestAgentLivenessCommand.class)
+public class LibvirtCheckGuestAgentLivenessCommandWrapper extends CommandWrapper<CheckGuestAgentLivenessCommand, Answer, LibvirtComputingResource> {
+
+    private static final int MIN_AGENT_PING_TIMEOUT_SECONDS = 1;
+    private static final int MAX_RESULT_MESSAGE_LENGTH = 256;
+
+    @Override
+    public Answer execute(CheckGuestAgentLivenessCommand command, LibvirtComputingResource serverResource) {
+        String vmName = command.getVmName();
+        Domain domain = null;
+        try {
+            final LibvirtUtilitiesHelper libvirtUtilitiesHelper = serverResource.getLibvirtUtilitiesHelper();
+            Connect connect = libvirtUtilitiesHelper.getConnection();
+            domain = serverResource.getDomain(connect, vmName);
+            if (domain == null) {
+                return new CheckGuestAgentLivenessAnswer(command, false, String.format("VM %s was not found", vmName));
+            }
+
+            DomainState domainState = domain.getInfo().state;
+            if (domainState != DomainState.VIR_DOMAIN_RUNNING) {
+                return new CheckGuestAgentLivenessAnswer(command, false, String.format("VM %s is in %s state", vmName, domainState));
+            }
+
+            int timeoutSeconds = Math.max(command.getWait(), MIN_AGENT_PING_TIMEOUT_SECONDS);
+            String result = domain.qemuAgentCommand(QemuCommand.buildQemuCommand(QemuCommand.AGENT_PING, null), timeoutSeconds, 0);
+            return parseJsonResult(command, result);
+        } catch (LibvirtException e) {
+            return new CheckGuestAgentLivenessAnswer(command, false, "guest agent did not respond: " + e.getMessage());
+        } finally {
+            if (domain != null) {
+                try {
+                    domain.free();
+                } catch (LibvirtException e) {
+                    logger.trace("Ignore error ", e);
+                }
+            }
+        }
+    }
+
+    private CheckGuestAgentLivenessAnswer parseJsonResult(CheckGuestAgentLivenessCommand command, String result) {
+        if (result == null || result.isBlank()) {
+            logger.error("Guest agent returned empty response");
+            return new CheckGuestAgentLivenessAnswer(command, false, "guest agent returned empty response");
+        }
+        try {
+            JsonElement parsedResult = JsonParser.parseString(result);
+            if (parsedResult.isJsonObject() && parsedResult.getAsJsonObject().has("return") && !parsedResult.getAsJsonObject().has("error")) {
+                return new CheckGuestAgentLivenessAnswer(command, true, "guest agent responded");
+            }
+        } catch (JsonParseException e) {
+            return new CheckGuestAgentLivenessAnswer(command, false, "guest agent returned invalid JSON: " + abbreviateResultForMessage(result));
+        }
+        return new CheckGuestAgentLivenessAnswer(command, false, "guest agent did not respond as expected: " + abbreviateResultForMessage(result));
+    }
+
+    private String abbreviateResultForMessage(String result) {
+        if (result.length() <= MAX_RESULT_MESSAGE_LENGTH) {
+            return result;
+        }
+        return result.substring(0, MAX_RESULT_MESSAGE_LENGTH) + "...";
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/utils/qemu/QemuCommand.java b/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/utils/qemu/QemuCommand.java
index 56d44ff51ba8..9e0a6b364fb6 100644
--- a/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/utils/qemu/QemuCommand.java
+++ b/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/utils/qemu/QemuCommand.java
@@ -28,6 +28,7 @@ public class QemuCommand {
     public static final String AGENT_FREEZE = "guest-fsfreeze-freeze";
     public static final String AGENT_THAW = "guest-fsfreeze-thaw";
     public static final String AGENT_FREEZE_STATUS = "guest-fsfreeze-status";
+    public static final String AGENT_PING = "guest-ping";
 
     public static final String QEMU_CMD = "execute";
 
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckGuestAgentLivenessCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckGuestAgentLivenessCommandWrapperTest.java
new file mode 100644
index 000000000000..9d603e0753c2
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckGuestAgentLivenessCommandWrapperTest.java
@@ -0,0 +1,236 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.libvirt.Connect;
+import org.libvirt.Domain;
+import org.libvirt.DomainInfo;
+import org.libvirt.DomainInfo.DomainState;
+import org.libvirt.LibvirtException;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.CheckGuestAgentLivenessAnswer;
+import com.cloud.agent.api.CheckGuestAgentLivenessCommand;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtCheckGuestAgentLivenessCommandWrapperTest {
+
+    private static final String VM_NAME = "i-2-3-VM";
+
+    @Mock
+    private LibvirtComputingResource libvirtComputingResource;
+    @Mock
+    private LibvirtUtilitiesHelper libvirtUtilitiesHelper;
+    @Mock
+    private Connect conn;
+    @Mock
+    private Domain domain;
+
+    private LibvirtCheckGuestAgentLivenessCommandWrapper wrapper;
+    private CheckGuestAgentLivenessCommand command;
+
+    @Before
+    public void setUp() throws LibvirtException {
+        wrapper = new LibvirtCheckGuestAgentLivenessCommandWrapper();
+        command = new CheckGuestAgentLivenessCommand(VM_NAME);
+
+        when(libvirtComputingResource.getLibvirtUtilitiesHelper()).thenReturn(libvirtUtilitiesHelper);
+        when(libvirtUtilitiesHelper.getConnection()).thenReturn(conn);
+    }
+
+    private void mockRunningDomain() throws LibvirtException {
+        when(libvirtComputingResource.getDomain(conn, VM_NAME)).thenReturn(domain);
+        DomainInfo domainInfo = new DomainInfo();
+        domainInfo.state = DomainState.VIR_DOMAIN_RUNNING;
+        when(domain.getInfo()).thenReturn(domainInfo);
+    }
+
+    @Test
+    public void domainNotFoundIsNotAlive() throws LibvirtException {
+        when(libvirtComputingResource.getDomain(conn, VM_NAME)).thenReturn(null);
+
+        CheckGuestAgentLivenessAnswer answer = (CheckGuestAgentLivenessAnswer) wrapper.execute(command, libvirtComputingResource);
+
+        assertFalse(answer.getResult());
+        assertTrue(answer.getDetails().contains("was not found"));
+    }
+
+    @Test
+    public void domainNotRunningIsNotAlive() throws LibvirtException {
+        when(libvirtComputingResource.getDomain(conn, VM_NAME)).thenReturn(domain);
+        DomainInfo domainInfo = new DomainInfo();
+        domainInfo.state = DomainState.VIR_DOMAIN_PAUSED;
+        when(domain.getInfo()).thenReturn(domainInfo);
+
+        CheckGuestAgentLivenessAnswer answer = (CheckGuestAgentLivenessAnswer) wrapper.execute(command, libvirtComputingResource);
+
+        assertFalse(answer.getResult());
+        assertTrue(answer.getDetails().contains("VIR_DOMAIN_PAUSED"));
+        verify(domain, org.mockito.Mockito.never()).qemuAgentCommand(anyString(), anyInt(), anyInt());
+    }
+
+    @Test
+    public void libvirtExceptionOnConnectionIsNotAlive() throws LibvirtException {
+        LibvirtException libvirtException = mock(LibvirtException.class);
+        when(libvirtException.getMessage()).thenReturn("connection refused");
+        when(libvirtUtilitiesHelper.getConnection()).thenThrow(libvirtException);
+
+        CheckGuestAgentLivenessAnswer answer = (CheckGuestAgentLivenessAnswer) wrapper.execute(command, libvirtComputingResource);
+
+        assertFalse(answer.getResult());
+        assertTrue(answer.getDetails().contains("connection refused"));
+    }
+
+    @Test
+    public void positiveJsonReturnIsAlive() throws LibvirtException {
+        mockRunningDomain();
+        when(domain.qemuAgentCommand(anyString(), anyInt(), anyInt())).thenReturn("{\"return\": {}}");
+
+        CheckGuestAgentLivenessAnswer answer = (CheckGuestAgentLivenessAnswer) wrapper.execute(command, libvirtComputingResource);
+
+        assertTrue(answer.getResult());
+    }
+
+    @Test
+    public void errorFieldInJsonReturnIsNotAlive() throws LibvirtException {
+        mockRunningDomain();
+        when(domain.qemuAgentCommand(anyString(), anyInt(), anyInt())).thenReturn("{\"return\": {}, \"error\": {\"desc\": \"timeout\"}}");
+
+        CheckGuestAgentLivenessAnswer answer = (CheckGuestAgentLivenessAnswer) wrapper.execute(command, libvirtComputingResource);
+
+        assertFalse(answer.getResult());
+    }
+
+    @Test
+    public void nonJsonObjectReturnIsNotAlive() throws LibvirtException {
+        mockRunningDomain();
+        when(domain.qemuAgentCommand(anyString(), anyInt(), anyInt())).thenReturn("[]");
+
+        CheckGuestAgentLivenessAnswer answer = (CheckGuestAgentLivenessAnswer) wrapper.execute(command, libvirtComputingResource);
+
+        assertFalse(answer.getResult());
+    }
+
+    @Test
+    public void missingReturnFieldIsNotAlive() throws LibvirtException {
+        mockRunningDomain();
+        when(domain.qemuAgentCommand(anyString(), anyInt(), anyInt())).thenReturn("{\"foo\": \"bar\"}");
+
+        CheckGuestAgentLivenessAnswer answer = (CheckGuestAgentLivenessAnswer) wrapper.execute(command, libvirtComputingResource);
+
+        assertFalse(answer.getResult());
+    }
+
+    @Test
+    public void invalidJsonIsNotAliveAndMessageIsAbbreviated() throws LibvirtException {
+        mockRunningDomain();
+        String garbage = "{\"return\": \"" + "x".repeat(300);
+        when(domain.qemuAgentCommand(anyString(), anyInt(), anyInt())).thenReturn(garbage);
+
+        CheckGuestAgentLivenessAnswer answer = (CheckGuestAgentLivenessAnswer) wrapper.execute(command, libvirtComputingResource);
+
+        assertFalse(answer.getResult());
+        assertTrue(answer.getDetails().contains("invalid JSON"));
+        assertTrue(answer.getDetails().endsWith("..."));
+        assertTrue(answer.getDetails().length() < garbage.length());
+    }
+
+    @Test
+    public void emptyResponseIsNotAlive() throws LibvirtException {
+        mockRunningDomain();
+        when(domain.qemuAgentCommand(anyString(), anyInt(), anyInt())).thenReturn("   ");
+
+        CheckGuestAgentLivenessAnswer answer = (CheckGuestAgentLivenessAnswer) wrapper.execute(command, libvirtComputingResource);
+
+        assertFalse(answer.getResult());
+        assertTrue(answer.getDetails().contains("empty response"));
+    }
+
+    @Test
+    public void nullResponseIsNotAlive() throws LibvirtException {
+        mockRunningDomain();
+        when(domain.qemuAgentCommand(anyString(), anyInt(), anyInt())).thenReturn(null);
+
+        CheckGuestAgentLivenessAnswer answer = (CheckGuestAgentLivenessAnswer) wrapper.execute(command, libvirtComputingResource);
+
+        assertFalse(answer.getResult());
+    }
+
+    @Test
+    public void zeroWaitIsFlooredToMinimumTimeoutSeconds() throws LibvirtException {
+        mockRunningDomain();
+        command.setWait(0);
+        when(domain.qemuAgentCommand(anyString(), anyInt(), anyInt())).thenReturn("{\"return\": {}}");
+
+        wrapper.execute(command, libvirtComputingResource);
+
+        ArgumentCaptor<Integer> timeoutCaptor = ArgumentCaptor.forClass(Integer.class);
+        verify(domain).qemuAgentCommand(anyString(), timeoutCaptor.capture(), anyInt());
+        assertEquals(Integer.valueOf(1), timeoutCaptor.getValue());
+    }
+
+    @Test
+    public void positiveWaitIsUsedAsTimeoutSeconds() throws LibvirtException {
+        mockRunningDomain();
+        command.setWait(10);
+        when(domain.qemuAgentCommand(anyString(), anyInt(), anyInt())).thenReturn("{\"return\": {}}");
+
+        wrapper.execute(command, libvirtComputingResource);
+
+        ArgumentCaptor<Integer> timeoutCaptor = ArgumentCaptor.forClass(Integer.class);
+        verify(domain).qemuAgentCommand(anyString(), timeoutCaptor.capture(), anyInt());
+        assertEquals(Integer.valueOf(10), timeoutCaptor.getValue());
+    }
+
+    @Test
+    public void domainIsFreedAfterExecution() throws LibvirtException {
+        mockRunningDomain();
+        when(domain.qemuAgentCommand(anyString(), anyInt(), anyInt())).thenReturn("{\"return\": {}}");
+
+        wrapper.execute(command, libvirtComputingResource);
+
+        verify(domain).free();
+    }
+
+    @Test
+    public void domainFreeExceptionIsSwallowed() throws LibvirtException {
+        mockRunningDomain();
+        when(domain.qemuAgentCommand(anyString(), anyInt(), anyInt())).thenReturn("{\"return\": {}}");
+        org.mockito.Mockito.doThrow(mock(LibvirtException.class)).when(domain).free();
+
+        CheckGuestAgentLivenessAnswer answer = (CheckGuestAgentLivenessAnswer) wrapper.execute(command, libvirtComputingResource);
+
+        assertTrue(answer.getResult());
+    }
+}
diff --git a/server/src/main/java/com/cloud/api/ApiResponseHelper.java b/server/src/main/java/com/cloud/api/ApiResponseHelper.java
index f56cda6e557a..deba6d43f03d 100644
--- a/server/src/main/java/com/cloud/api/ApiResponseHelper.java
+++ b/server/src/main/java/com/cloud/api/ApiResponseHelper.java
@@ -62,6 +62,7 @@
 import org.apache.cloudstack.api.response.ASNRangeResponse;
 import org.apache.cloudstack.api.response.ASNumberResponse;
 import org.apache.cloudstack.api.response.AccountResponse;
+import org.apache.cloudstack.api.response.ApiKeyPairResponse;
 import org.apache.cloudstack.api.response.ApplicationLoadBalancerInstanceResponse;
 import org.apache.cloudstack.api.response.ApplicationLoadBalancerResponse;
 import org.apache.cloudstack.api.response.ApplicationLoadBalancerRuleResponse;
@@ -120,7 +121,6 @@
 import org.apache.cloudstack.api.response.Ipv4RouteResponse;
 import org.apache.cloudstack.api.response.Ipv6RouteResponse;
 import org.apache.cloudstack.api.response.IsolationMethodResponse;
-import org.apache.cloudstack.api.response.ApiKeyPairResponse;
 import org.apache.cloudstack.api.response.LBHealthCheckPolicyResponse;
 import org.apache.cloudstack.api.response.LBHealthCheckResponse;
 import org.apache.cloudstack.api.response.LBStickinessPolicyResponse;
@@ -247,6 +247,7 @@
 import org.apache.logging.log4j.Logger;
 
 import com.cloud.agent.api.VgpuTypesInfo;
+import com.cloud.api.query.ResourceIdSupport;
 import com.cloud.api.query.ViewResponseHelper;
 import com.cloud.api.query.dao.UserVmJoinDao;
 import com.cloud.api.query.vo.AccountJoinVO;
@@ -263,7 +264,6 @@
 import com.cloud.api.query.vo.ProjectAccountJoinVO;
 import com.cloud.api.query.vo.ProjectInvitationJoinVO;
 import com.cloud.api.query.vo.ProjectJoinVO;
-import com.cloud.api.query.ResourceIdSupport;
 import com.cloud.api.query.vo.ResourceTagJoinVO;
 import com.cloud.api.query.vo.SecurityGroupJoinVO;
 import com.cloud.api.query.vo.ServiceOfferingJoinVO;
@@ -570,6 +570,18 @@ public static String getPrettyDomainPath(String path) {
     @Inject
     private DomainDao domainDao;
 
+    @Inject
+    private com.cloud.vm.dao.InstanceBootGroupDao instanceBootGroupDao;
+
+    @Inject
+    private com.cloud.vm.dao.InstanceBootGroupMemberDao instanceBootGroupMemberDao;
+
+    @Inject
+    private com.cloud.vm.dao.UserVmDao userVmDao;
+
+    @Inject
+    private com.cloud.vm.dao.InstanceGroupDao instanceGroupDao;
+
     @Override
     public UserResponse createUserResponse(User user) {
         UserAccountJoinVO vUser = ApiDBUtils.newUserView(user);
@@ -1567,7 +1579,6 @@ public VolumeResponse createVolumeResponse(ResponseView view, Volume volume) {
     public InstanceGroupResponse createInstanceGroupResponse(InstanceGroup group) {
         InstanceGroupJoinVO vgroup = ApiDBUtils.newInstanceGroupView(group);
         return ApiDBUtils.newInstanceGroupResponse(vgroup);
-
     }
 
     @Override
diff --git a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
index 9bbbdc503508..83a63da529e9 100644
--- a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
+++ b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
@@ -164,6 +164,7 @@
 import org.apache.cloudstack.utils.bytescale.ByteScaleUtils;
 import org.apache.cloudstack.utils.security.ParserUtils;
 import org.apache.cloudstack.vm.UnmanagedVMsManager;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMembershipGuard;
 import org.apache.cloudstack.vm.lease.VMLeaseManager;
 import org.apache.commons.collections.CollectionUtils;
 import org.apache.commons.collections.MapUtils;
@@ -657,6 +658,8 @@ public class UserVmManagerImpl extends ManagerBase implements UserVmManager, Vir
     @Inject
     private AutoScaleManager autoScaleManager;
     @Inject
+    private InstanceBootGroupMembershipGuard instanceBootGroupMembershipGuard;
+    @Inject
     NsxProviderDao nsxProviderDao;
     @Inject
     NetworkService networkService;
@@ -3784,6 +3787,9 @@ private void validateVmDestroyAllowed(UserVmVO vm, boolean forced) {
         // check if vm belongs to AutoScale vm group in Disabled state
         autoScaleManager.checkIfVmActionAllowed(vm.getId());
 
+        // check if vm (directly, or via its instance group) is a member of an instance boot group
+        instanceBootGroupMembershipGuard.validateVmNotInBootGroup(vm);
+
         // check if vm belongs to any plugin resources
         checkPluginsIfVmCanBeDestroyed(vm);
     }
@@ -3879,6 +3885,8 @@ public boolean deleteVmGroup(long groupId) {
             sc.addAnd("instanceId", SearchCriteria.Op.EQ, groupMap.getInstanceId());
             _groupVMMapDao.expunge(sc);
         }
+        // don't leave a stale instance boot group member pointing at a group that no longer exists
+        instanceBootGroupMembershipGuard.removeInstanceGroupBootGroupMembershipIfPresent(groupId);
 
         if (_vmGroupDao.remove(groupId)) {
             return true;
@@ -3892,6 +3900,8 @@ public boolean deleteVmGroup(long groupId) {
     public boolean addInstanceToGroup(final long userVmId, String groupName) {
         UserVmVO vm = _vmDao.findById(userVmId);
 
+        instanceBootGroupMembershipGuard.validateVmEligibleForGroupMembership(userVmId);
+
         InstanceGroupVO group = _vmGroupDao.findByAccountAndName(vm.getAccountId(), groupName);
         // Create vm group if the group doesn't exist for this account
         if (group == null) {
diff --git a/server/src/main/java/org/apache/cloudstack/api/query/dao/InstanceBootGroupJoinDao.java b/server/src/main/java/org/apache/cloudstack/api/query/dao/InstanceBootGroupJoinDao.java
new file mode 100644
index 000000000000..38cc792b5123
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/api/query/dao/InstanceBootGroupJoinDao.java
@@ -0,0 +1,25 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.query.dao;
+
+import org.apache.cloudstack.api.query.vo.InstanceBootGroupJoinVO;
+
+import com.cloud.utils.db.GenericDao;
+
+public interface InstanceBootGroupJoinDao extends GenericDao<InstanceBootGroupJoinVO, Long> {
+}
diff --git a/server/src/main/java/org/apache/cloudstack/api/query/dao/InstanceBootGroupJoinDaoImpl.java b/server/src/main/java/org/apache/cloudstack/api/query/dao/InstanceBootGroupJoinDaoImpl.java
new file mode 100644
index 000000000000..86eb9eb7f554
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/api/query/dao/InstanceBootGroupJoinDaoImpl.java
@@ -0,0 +1,25 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.query.dao;
+
+import org.apache.cloudstack.api.query.vo.InstanceBootGroupJoinVO;
+
+import com.cloud.utils.db.GenericDaoBase;
+
+public class InstanceBootGroupJoinDaoImpl extends GenericDaoBase<InstanceBootGroupJoinVO, Long> implements InstanceBootGroupJoinDao {
+}
diff --git a/server/src/main/java/org/apache/cloudstack/api/query/vo/InstanceBootGroupJoinVO.java b/server/src/main/java/org/apache/cloudstack/api/query/vo/InstanceBootGroupJoinVO.java
new file mode 100644
index 000000000000..91aef4532dfe
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/api/query/vo/InstanceBootGroupJoinVO.java
@@ -0,0 +1,190 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.query.vo;
+
+import java.util.Date;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.EnumType;
+import javax.persistence.Enumerated;
+import javax.persistence.Id;
+import javax.persistence.Table;
+
+import com.cloud.api.query.vo.ControlledViewEntity;
+
+import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;
+
+import com.cloud.user.Account;
+import com.cloud.utils.db.GenericDao;
+
+@Entity
+@Table(name = "instance_boot_group_view")
+public class InstanceBootGroupJoinVO implements ControlledViewEntity {
+
+    @Id
+    @Column(name = "id", updatable = false, nullable = false)
+    private long id;
+
+    @Column(name = "uuid")
+    private String uuid;
+
+    @Column(name = "name")
+    private String name;
+
+    @Column(name = "description", length = 4096)
+    private String description;
+
+    @Column(name = GenericDao.CREATED_COLUMN)
+    private Date created;
+
+    @Column(name = GenericDao.REMOVED_COLUMN)
+    private Date removed;
+
+    @Column(name = "account_id")
+    private long accountId;
+
+    @Column(name = "account_uuid")
+    private String accountUuid;
+
+    @Column(name = "account_name")
+    private String accountName;
+
+    @Column(name = "account_type")
+    @Enumerated(value = EnumType.STRING)
+    private Account.Type accountType;
+
+    @Column(name = "domain_id")
+    private long domainId;
+
+    @Column(name = "domain_uuid")
+    private String domainUuid;
+
+    @Column(name = "domain_name")
+    private String domainName;
+
+    @Column(name = "domain_path")
+    private String domainPath;
+
+    @Column(name = "project_id")
+    private long projectId;
+
+    @Column(name = "project_uuid")
+    private String projectUuid;
+
+    @Column(name = "project_name")
+    private String projectName;
+
+    @Override
+    public long getId() {
+        return id;
+    }
+
+    @Override
+    public String getUuid() {
+        return uuid;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public Date getCreated() {
+        return created;
+    }
+
+    public Date getRemoved() {
+        return removed;
+    }
+
+    @Override
+    public long getDomainId() {
+        return domainId;
+    }
+
+    @Override
+    public String getDomainPath() {
+        return domainPath;
+    }
+
+    @Override
+    public String getDomainUuid() {
+        return domainUuid;
+    }
+
+    @Override
+    public String getDomainName() {
+        return domainName;
+    }
+
+    @Override
+    public Account.Type getAccountType() {
+        return accountType;
+    }
+
+    @Override
+    public long getAccountId() {
+        return accountId;
+    }
+
+    @Override
+    public String getAccountUuid() {
+        return accountUuid;
+    }
+
+    @Override
+    public String getAccountName() {
+        return accountName;
+    }
+
+    @Override
+    public String getProjectUuid() {
+        return projectUuid;
+    }
+
+    @Override
+    public String getProjectName() {
+        return projectName;
+    }
+
+    @Override
+    public Class<?> getEntityType() {
+        return InstanceBootGroupJoinVO.class;
+    }
+
+    @Override
+    public String toString() {
+        return String.format("InstanceBootGroupJoinVO %s", ReflectionToStringBuilderUtils.reflectOnlySelectedFields(
+                this, "id", "uuid", "name"));
+    }
+
+    public InstanceBootGroupJoinVO() {
+    }
+}
diff --git a/server/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupApiServiceImpl.java b/server/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupApiServiceImpl.java
new file mode 100644
index 000000000000..3f9a72667a13
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupApiServiceImpl.java
@@ -0,0 +1,939 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.List;
+import java.util.Objects;
+import java.util.stream.Collectors;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.api.command.user.bootgroup.AddMemberToInstanceBootGroupCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.CreateInstanceBootGroupCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.CreateInstanceBootGroupReadinessRuleCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.DeleteInstanceBootGroupCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.DeleteInstanceBootGroupReadinessRuleCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.ListInstanceBootGroupMembersCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.ListInstanceBootGroupReadinessRulesCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.ListInstanceBootGroupsCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.RebootInstanceBootGroupCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.RemoveInstanceBootGroupMemberCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.StartInstanceBootGroupCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.StopInstanceBootGroupCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.UpdateInstanceBootGroupCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.UpdateInstanceBootGroupMemberCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.UpdateInstanceBootGroupReadinessRuleCmd;
+import org.apache.cloudstack.api.query.dao.InstanceBootGroupJoinDao;
+import org.apache.cloudstack.api.query.vo.InstanceBootGroupJoinVO;
+import org.apache.cloudstack.api.response.InstanceBootGroupMemberChildResponse;
+import org.apache.cloudstack.api.response.InstanceBootGroupMemberResponse;
+import org.apache.cloudstack.api.response.InstanceBootGroupReadinessRuleResponse;
+import org.apache.cloudstack.api.response.InstanceBootGroupResponse;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRuleService;
+import org.apache.cloudstack.vm.bootgroup.readiness.ReadinessChecker;
+import org.apache.commons.lang3.EnumUtils;
+import org.apache.commons.lang3.StringUtils;
+import org.jetbrains.annotations.NotNull;
+import org.springframework.stereotype.Component;
+
+import com.cloud.api.ApiResponseHelper;
+import com.cloud.event.ActionEvent;
+import com.cloud.event.EventTypes;
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.exception.PermissionDeniedException;
+import com.cloud.projects.Project;
+import com.cloud.user.Account;
+import com.cloud.user.AccountManager;
+import com.cloud.uservm.UserVm;
+import com.cloud.utils.Pair;
+import com.cloud.utils.Ternary;
+import com.cloud.utils.component.PluggableService;
+import com.cloud.utils.db.Filter;
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
+import com.cloud.utils.db.Transaction;
+import com.cloud.utils.db.TransactionCallback;
+import com.cloud.vm.InstanceGroupVMMapVO;
+import com.cloud.vm.InstanceGroupVO;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.dao.InstanceBootGroupDao;
+import com.cloud.vm.dao.InstanceBootGroupDetailsDao;
+import com.cloud.vm.dao.InstanceBootGroupMemberDao;
+import com.cloud.vm.dao.InstanceBootGroupReadinessCheckResultDao;
+import com.cloud.vm.dao.InstanceBootGroupReadinessRuleDao;
+import com.cloud.vm.dao.InstanceBootGroupReadinessRuleDetailsDao;
+import com.cloud.vm.dao.InstanceGroupDao;
+import com.cloud.vm.dao.InstanceGroupVMMapDao;
+import com.cloud.vm.dao.UserVmDao;
+
+/**
+ * API-facing half of the Instance Boot Group feature: ACL, param validation, response building,
+ * command registration. Delegates orchestration/hypervisor work to {@link InstanceBootGroupManager}
+ * and membership eligibility checks to {@link InstanceBootGroupMembershipGuard}.
+ */
+@Component
+public class InstanceBootGroupApiServiceImpl implements InstanceBootGroupService, PluggableService {
+
+    @Inject
+    private InstanceBootGroupDao instanceBootGroupDao;
+
+    @Inject
+    private InstanceBootGroupJoinDao instanceBootGroupJoinDao;
+
+    @Inject
+    private InstanceBootGroupMemberDao instanceBootGroupMemberDao;
+
+    @Inject
+    private AccountManager accountManager;
+
+    @Inject
+    private UserVmDao userVmDao;
+
+    @Inject
+    private InstanceGroupDao instanceGroupDao;
+
+    @Inject
+    private InstanceBootGroupManager instanceBootGroupManager;
+
+    @Inject
+    private InstanceBootGroupMembershipGuard instanceBootGroupMembershipGuard;
+
+    @Inject
+    private InstanceBootGroupReadinessRuleService instanceBootGroupReadinessRuleService;
+
+    @Inject
+    private InstanceBootGroupReadinessRuleDao instanceBootGroupReadinessRuleDao;
+
+    @Inject
+    private InstanceBootGroupReadinessRuleDetailsDao instanceBootGroupReadinessRuleDetailsDao;
+
+    @Inject
+    private InstanceBootGroupReadinessCheckResultDao instanceBootGroupReadinessCheckResultDao;
+
+    @Inject
+    private InstanceBootGroupDetailsDao instanceBootGroupDetailsDao;
+
+    @Inject
+    private InstanceGroupVMMapDao instanceGroupVMMapDao;
+
+    @NotNull
+    protected InstanceBootGroupVO getGroupAndCheckAccess(long id) {
+        InstanceBootGroupVO group = instanceBootGroupDao.findById(id);
+        if (group == null) {
+            throw new InvalidParameterValueException("Unable to find instance boot group with ID: " + id);
+        }
+        Account caller = CallContext.current().getCallingAccount();
+        accountManager.checkAccess(caller, null, true, group);
+        return group;
+    }
+
+    protected InstanceBootGroupResponse createInstanceBootGroupResponse(InstanceBootGroupJoinVO bootGroup) {
+        InstanceBootGroupResponse response = new InstanceBootGroupResponse();
+        response.setId(bootGroup.getUuid());
+        response.setName(bootGroup.getName());
+        response.setDescription(bootGroup.getDescription());
+        response.setCreated(bootGroup.getCreated());
+        ApiResponseHelper.populateOwner(response, bootGroup);
+
+        String timeoutOverride = instanceBootGroupDetailsDao.getDetail(bootGroup.getId(), InstanceBootGroupManagerImpl.ReadinessAttemptTimeoutSeconds.key());
+        response.setReadinessAttemptTimeoutSeconds(timeoutOverride != null ? Long.parseLong(timeoutOverride) : InstanceBootGroupManagerImpl.ReadinessAttemptTimeoutSeconds.value());
+        String maxRetryOverride = instanceBootGroupDetailsDao.getDetail(bootGroup.getId(), InstanceBootGroupManagerImpl.ReadinessMaxRetryAttempts.key());
+        response.setReadinessMaxRetryAttempts(maxRetryOverride != null ? Long.parseLong(maxRetryOverride) : InstanceBootGroupManagerImpl.ReadinessMaxRetryAttempts.value());
+        String rebootOnRetryOverride = instanceBootGroupDetailsDao.getDetail(bootGroup.getId(), InstanceBootGroupManagerImpl.ReadinessRebootOnRetry.key());
+        response.setReadinessRebootOnRetry(rebootOnRetryOverride != null ? Boolean.parseBoolean(rebootOnRetryOverride) : InstanceBootGroupManagerImpl.ReadinessRebootOnRetry.value());
+        String initialDelayOverride = instanceBootGroupDetailsDao.getDetail(bootGroup.getId(), InstanceBootGroupManagerImpl.ReadinessInitialDelaySeconds.key());
+        response.setReadinessInitialDelaySeconds(initialDelayOverride != null ? Long.parseLong(initialDelayOverride) : InstanceBootGroupManagerImpl.ReadinessInitialDelaySeconds.value());
+
+        response.setObjectName("instancebootgroup");
+        return response;
+    }
+
+    @Override
+    @ActionEvent(eventType = EventTypes.EVENT_INSTANCE_BOOT_GROUP_CREATE, eventDescription = "creating Instance Boot Group")
+    public InstanceBootGroup createInstanceBootGroup(CreateInstanceBootGroupCmd cmd) {
+        Account caller = CallContext.current().getCallingAccount();
+        Account owner = accountManager.finalizeOwner(caller, cmd.getAccountName(), cmd.getDomainId(), cmd.getProjectId());
+
+        if (instanceBootGroupDao.isNameInUse(owner.getId(), cmd.getName())) {
+            throw new InvalidParameterValueException("An instance boot group with name '" + cmd.getName() + "' already exists in this account");
+        }
+
+        return Transaction.execute((TransactionCallback<InstanceBootGroupVO>) status -> {
+            InstanceBootGroupVO group = new InstanceBootGroupVO(cmd.getName(), cmd.getDescription(), owner.getId(), owner.getDomainId());
+            group = instanceBootGroupDao.persist(group);
+            CallContext.current().setEventResourceId(group.getId());
+
+            if (cmd.getReadinessAttemptTimeoutSeconds() != null) {
+                setOrClearOverride(group.getId(), InstanceBootGroupManagerImpl.ReadinessAttemptTimeoutSeconds.key(), cmd.getReadinessAttemptTimeoutSeconds());
+            }
+            if (cmd.getReadinessMaxRetryAttempts() != null) {
+                setOrClearOverride(group.getId(), InstanceBootGroupManagerImpl.ReadinessMaxRetryAttempts.key(), cmd.getReadinessMaxRetryAttempts());
+            }
+            if (cmd.getReadinessRebootOnRetry() != null) {
+                instanceBootGroupDetailsDao.setDetail(group.getId(), InstanceBootGroupManagerImpl.ReadinessRebootOnRetry.key(), String.valueOf(cmd.getReadinessRebootOnRetry()));
+            }
+            if (cmd.getReadinessInitialDelaySeconds() != null) {
+                setOrClearOverride(group.getId(), InstanceBootGroupManagerImpl.ReadinessInitialDelaySeconds.key(), cmd.getReadinessInitialDelaySeconds());
+            }
+
+            return group;
+        });
+    }
+
+    @Override
+    @ActionEvent(eventType = EventTypes.EVENT_INSTANCE_BOOT_GROUP_DELETE, eventDescription = "deleting Instance Boot Group")
+    public boolean deleteInstanceBootGroup(DeleteInstanceBootGroupCmd cmd) {
+        InstanceBootGroupVO group = getGroupAndCheckAccess(cmd.getId());
+        return Transaction.execute((TransactionCallback<Boolean>) status -> {
+            instanceBootGroupMemberDao.deleteByBootGroupId(group.getId());
+            instanceBootGroupDao.remove(group.getId());
+            return true;
+        });
+    }
+
+    @Override
+    @ActionEvent(eventType = EventTypes.EVENT_INSTANCE_BOOT_GROUP_UPDATE, eventDescription = "updating Instance Boot Group")
+    public InstanceBootGroup updateInstanceBootGroup(UpdateInstanceBootGroupCmd cmd) {
+        InstanceBootGroupVO group = getGroupAndCheckAccess(cmd.getId());
+
+        if (cmd.getName() != null && !Objects.equals(cmd.getName(), group.getName())) {
+            Account owner = accountManager.getAccount(group.getAccountId());
+            if (instanceBootGroupDao.isNameInUse(owner.getId(), cmd.getName())) {
+                throw new InvalidParameterValueException("An instance boot group with name '" + cmd.getName() + "' already exists in this account");
+            }
+            group.setName(cmd.getName());
+        }
+        if (cmd.getDescription() != null) {
+            group.setDescription(cmd.getDescription());
+        }
+
+        return Transaction.execute((TransactionCallback<InstanceBootGroupVO>) status -> {
+            if (cmd.getReadinessAttemptTimeoutSeconds() != null) {
+                setOrClearOverride(group.getId(), InstanceBootGroupManagerImpl.ReadinessAttemptTimeoutSeconds.key(), cmd.getReadinessAttemptTimeoutSeconds());
+            }
+            if (cmd.getReadinessMaxRetryAttempts() != null) {
+                setOrClearOverride(group.getId(), InstanceBootGroupManagerImpl.ReadinessMaxRetryAttempts.key(), cmd.getReadinessMaxRetryAttempts());
+            }
+            if (cmd.getReadinessRebootOnRetry() != null) {
+                instanceBootGroupDetailsDao.setDetail(group.getId(), InstanceBootGroupManagerImpl.ReadinessRebootOnRetry.key(), String.valueOf(cmd.getReadinessRebootOnRetry()));
+            }
+            if (cmd.getReadinessInitialDelaySeconds() != null) {
+                setOrClearOverride(group.getId(), InstanceBootGroupManagerImpl.ReadinessInitialDelaySeconds.key(), cmd.getReadinessInitialDelaySeconds());
+            }
+
+            instanceBootGroupDao.update(group.getId(), group);
+            return instanceBootGroupDao.findById(group.getId());
+        });
+    }
+
+    private void setOrClearOverride(long bootGroupId, String key, long value) {
+        if (value < 0) {
+            instanceBootGroupDetailsDao.setDetail(bootGroupId, key, null);
+        } else {
+            instanceBootGroupDetailsDao.setDetail(bootGroupId, key, String.valueOf(value));
+        }
+    }
+
+    @Override
+    public ListResponse<InstanceBootGroupResponse> listInstanceBootGroups(ListInstanceBootGroupsCmd cmd) {
+        final CallContext ctx = CallContext.current();
+        final Account caller = ctx.getCallingAccount();
+        final Long id = cmd.getId();
+        final String keyword = cmd.getKeyword();
+        final Long virtualMachineId = cmd.getVirtualMachineId();
+        final Long instanceGroupId = cmd.getInstanceGroupId();
+        if (virtualMachineId != null && instanceGroupId != null) {
+            throw new InvalidParameterValueException("Only one of virtualmachineid or instancegroupid may be specified");
+        }
+
+        List<InstanceBootGroupResponse> responsesList = new ArrayList<>();
+        List<Long> permittedAccounts = new ArrayList<>();
+        Ternary<Long, Boolean, Project.ListProjectResourcesCriteria> domainIdRecursiveListProject =
+                new Ternary<>(cmd.getDomainId(), cmd.isRecursive(), null);
+        accountManager.buildACLSearchParameters(caller, id, cmd.getAccountName(), cmd.getProjectId(),
+                permittedAccounts, domainIdRecursiveListProject, cmd.listAll(), false);
+        Long domainId = domainIdRecursiveListProject.first();
+        Boolean isRecursive = domainIdRecursiveListProject.second();
+        Project.ListProjectResourcesCriteria listProjectResourcesCriteria = domainIdRecursiveListProject.third();
+
+        // A VM or Instance Group belongs to at most one boot group (unique per member), so this filter
+        // resolves to either exactly one boot group id, or no results at all.
+        Long memberBootGroupId = null;
+        if (virtualMachineId != null || instanceGroupId != null) {
+            InstanceBootGroupMember.MemberType memberType = virtualMachineId != null
+                    ? InstanceBootGroupMember.MemberType.VirtualMachine
+                    : InstanceBootGroupMember.MemberType.InstanceGroup;
+            long memberId = virtualMachineId != null ? virtualMachineId : instanceGroupId;
+            InstanceBootGroupMemberVO member = instanceBootGroupMemberDao.findByMember(memberType, memberId);
+            if (member == null) {
+                ListResponse<InstanceBootGroupResponse> emptyResponse = new ListResponse<>();
+                emptyResponse.setResponses(new ArrayList<>(), 0);
+                return emptyResponse;
+            }
+            memberBootGroupId = member.getBootGroupId();
+        }
+
+        Filter searchFilter = new Filter(InstanceBootGroupJoinVO.class, "id", true, cmd.getStartIndex(),
+                cmd.getPageSizeVal());
+        SearchBuilder<InstanceBootGroupJoinVO> sb = instanceBootGroupJoinDao.createSearchBuilder();
+        accountManager.buildACLSearchBuilder(sb, domainId, isRecursive, permittedAccounts,
+                listProjectResourcesCriteria);
+        sb.and("id", sb.entity().getId(), SearchCriteria.Op.EQ);
+        sb.and("memberBootGroupId", sb.entity().getId(), SearchCriteria.Op.EQ);
+        sb.and("name", sb.entity().getName(), SearchCriteria.Op.EQ);
+        sb.and("keyword", sb.entity().getName(), SearchCriteria.Op.LIKE);
+        SearchCriteria<InstanceBootGroupJoinVO> sc = sb.create();
+        accountManager.buildACLSearchCriteria(sc, domainId, isRecursive, permittedAccounts,
+                listProjectResourcesCriteria);
+        if (keyword != null) {
+            sc.setParameters("keyword", "%" + keyword + "%");
+        }
+        if (id != null) {
+            sc.setParameters("id", id);
+        }
+        if (memberBootGroupId != null) {
+            sc.setParameters("memberBootGroupId", memberBootGroupId);
+        }
+        Pair<List<InstanceBootGroupJoinVO>, Integer> bootGroupsAndCount = instanceBootGroupJoinDao.searchAndCount(sc, searchFilter);
+        for (InstanceBootGroupJoinVO bootGroup : bootGroupsAndCount.first()) {
+            InstanceBootGroupResponse response = createInstanceBootGroupResponse(bootGroup);
+            responsesList.add(response);
+        }
+        ListResponse<InstanceBootGroupResponse> response = new ListResponse<>();
+        response.setResponses(responsesList, bootGroupsAndCount.second());
+        return response;
+    }
+
+    @Override
+    @ActionEvent(eventType = EventTypes.EVENT_INSTANCE_BOOT_GROUP_MEMBER_ADD, eventDescription = "adding Instance Boot Group member")
+    public InstanceBootGroupMember addMemberToInstanceBootGroup(AddMemberToInstanceBootGroupCmd cmd) {
+        InstanceBootGroupVO group = getGroupAndCheckAccess(cmd.getId());
+
+        if (cmd.getOrder() < 0) {
+            throw new InvalidParameterValueException("Order value must be 0 or greater");
+        }
+
+        InstanceBootGroupMember.MemberType memberType;
+        long memberId;
+
+        validateEitherVirtualMachineIdOrInstanceGroupIdParam(cmd.getVirtualMachineId(), cmd.getInstanceGroupId());
+
+        if (cmd.getVirtualMachineId() != null) {
+            UserVm vm = getValidatedVmForAddMember(group, cmd.getVirtualMachineId());
+            memberType = InstanceBootGroupMember.MemberType.VirtualMachine;
+            memberId = vm.getId();
+        } else {
+            InstanceGroupVO instanceGroup = getValidatedInstanceGroupAddMember(group, cmd.getInstanceGroupId());
+            memberType = InstanceBootGroupMember.MemberType.InstanceGroup;
+            memberId = instanceGroup.getId();
+        }
+
+        if (instanceBootGroupMemberDao.findByMember(memberType, memberId) != null) {
+            throw new InvalidParameterValueException(String.format("This %s already belongs to an instance boot group", memberType.name()));
+        }
+
+        long groupMembersCount = instanceBootGroupMemberDao.countByBootGroupId(group.getId());
+        long maxMembers = InstanceBootGroupManagerImpl.MaxMembersPerBootGroup.valueIn(group.getDomainId());
+        if (groupMembersCount >= maxMembers) {
+            throw new InvalidParameterValueException(String.format(
+                    "Instance boot group %s already has the maximum of %d member(s) allowed", group, maxMembers));
+        }
+
+        return Transaction.execute((TransactionCallback<InstanceBootGroupMemberVO>) status -> {
+            shiftSiblingOrdersForInsert(group.getId(), cmd.getOrder());
+            InstanceBootGroupMemberVO member = new InstanceBootGroupMemberVO(group.getId(), memberType, memberId, cmd.getOrder());
+            return instanceBootGroupMemberDao.persist(member);
+        });
+    }
+
+    /**
+     * Makes room for a new member at {@code order} by bumping every existing member already at or
+     * past it up by one slot, rather than letting the new member silently share that order.
+     */
+    private void shiftSiblingOrdersForInsert(long groupId, int order) {
+        List<InstanceBootGroupMemberVO> siblings =
+                instanceBootGroupMemberDao.listByBootGroupIdAndEqualOrHigherOrder(groupId, order);
+        for (InstanceBootGroupMemberVO sibling : siblings) {
+            sibling.setBootOrder(sibling.getBootOrder() + 1);
+            instanceBootGroupMemberDao.update(sibling.getId(), sibling);
+        }
+    }
+
+    @NotNull
+    private UserVm getValidatedVmForAddMember(InstanceBootGroupVO group, long virtualMachineId) {
+        UserVm vm = userVmDao.findById(virtualMachineId);
+        if (vm == null) {
+            throw new InvalidParameterValueException("Unable to find Instance with the specified ID");
+        }
+        validateMemberAccount(vm.getAccountId(), group.getAccountId());
+        instanceBootGroupMembershipGuard.validateVmEligibleForGroupMembership(vm.getId());
+        instanceBootGroupMembershipGuard.validateVmNotIndirectlyBootGroupManaged(vm.getId());
+        return vm;
+    }
+
+    @NotNull
+    private InstanceGroupVO getValidatedInstanceGroupAddMember(InstanceBootGroupVO group, long instanceGroupId) {
+        InstanceGroupVO instanceGroup = instanceGroupDao.findById(instanceGroupId);
+        if (instanceGroup == null) {
+            throw new InvalidParameterValueException("Unable to find instance group with the specified ID");
+        }
+        validateMemberAccount(instanceGroup.getAccountId(), group.getAccountId());
+        instanceBootGroupMembershipGuard.validateInstanceGroupEligibleForBootGroupMembership(instanceGroup.getId());
+        return instanceGroup;
+    }
+
+    protected static void validateEitherVirtualMachineIdOrInstanceGroupIdParam(Long virtualMachineId, Long instanceGroupId) {
+        if (virtualMachineId != null && instanceGroupId != null) {
+            throw new InvalidParameterValueException("Only one of virtualmachineid or instancegroupid may be specified");
+        }
+        if (virtualMachineId == null && instanceGroupId == null) {
+            throw new InvalidParameterValueException("Either virtualmachineid or instancegroupid must be specified");
+        }
+    }
+
+    @Override
+    @ActionEvent(eventType = EventTypes.EVENT_INSTANCE_BOOT_GROUP_MEMBER_REMOVE, eventDescription = "removing Instance Boot Group member")
+    public boolean removeInstanceBootGroupMember(RemoveInstanceBootGroupMemberCmd cmd) {
+        InstanceBootGroupMemberVO member = instanceBootGroupMemberDao.findById(cmd.getId());
+        if (member == null) {
+            throw new InvalidParameterValueException("Unable to find boot group member with ID: " + cmd.getId());
+        }
+        getGroupAndCheckAccess(member.getBootGroupId());
+        instanceBootGroupMemberDao.expunge(member.getId());
+        return true;
+    }
+
+    @Override
+    @ActionEvent(eventType = EventTypes.EVENT_INSTANCE_BOOT_GROUP_MEMBER_REORDER, eventDescription = "reordering Instance Boot Group member")
+    public InstanceBootGroupMember updateInstanceBootGroupMember(UpdateInstanceBootGroupMemberCmd cmd) {
+        InstanceBootGroupMemberVO member = instanceBootGroupMemberDao.findById(cmd.getId());
+        if (member == null) {
+            throw new InvalidParameterValueException("Unable to find boot group member with ID: " + cmd.getId());
+        }
+        int newOrder = cmd.getOrder();
+        if (newOrder < 0) {
+            throw new InvalidParameterValueException("Order value must be 0 or greater");
+        }
+        getGroupAndCheckAccess(member.getBootGroupId());
+
+        int oldOrder = member.getBootOrder();
+        if (newOrder == oldOrder) {
+            return member;
+        }
+        return Transaction.execute((TransactionCallback<InstanceBootGroupMemberVO>) status -> {
+            shiftSiblingOrders(member, oldOrder, newOrder);
+            member.setBootOrder(newOrder);
+            instanceBootGroupMemberDao.update(member.getId(), member);
+            return instanceBootGroupMemberDao.findById(member.getId());
+        });
+    }
+
+    /**
+     * Shifts every other member between the old and new position by one slot — list-reorder
+     * semantics, not just moving the single member whose order was explicitly given.
+     */
+    private void shiftSiblingOrders(InstanceBootGroupMemberVO member, int oldOrder, int newOrder) {
+        int low = Math.min(oldOrder, newOrder);
+        int high = Math.max(oldOrder, newOrder);
+        int delta = newOrder > oldOrder ? -1 : 1;
+        List<InstanceBootGroupMemberVO> siblings =
+                instanceBootGroupMemberDao.listByBootGroupIdAndOrderRange(member.getBootGroupId(), low, high);
+        for (InstanceBootGroupMemberVO sibling : siblings) {
+            if (sibling.getId() == member.getId()) {
+                continue;
+            }
+            sibling.setBootOrder(sibling.getBootOrder() + delta);
+            instanceBootGroupMemberDao.update(sibling.getId(), sibling);
+        }
+    }
+
+    @Override
+    public ListResponse<InstanceBootGroupMemberResponse> listInstanceBootGroupMembers(ListInstanceBootGroupMembersCmd cmd) {
+        InstanceBootGroupVO group = getGroupAndCheckAccess(cmd.getBootGroupId());
+
+        Pair<List<InstanceBootGroupMemberVO>, Integer> result;
+        if (cmd.getMemberType() != null) {
+            InstanceBootGroupMember.MemberType type = InstanceBootGroupMember.MemberType.valueOf(cmd.getMemberType());
+            result = instanceBootGroupMemberDao.searchAndCountByBootGroupIdAndType(group.getId(), type);
+        } else {
+            result = instanceBootGroupMemberDao.searchAndCountByBootGroupId(group.getId());
+        }
+
+        List<InstanceBootGroupMemberVO> members = result.first();
+        members.sort(Comparator.comparingInt(InstanceBootGroupMemberVO::getBootOrder));
+        boolean includeReadiness = cmd.isReadinessDetailRequested();
+        boolean includeChildren = cmd.isChildrenDetailRequested();
+        boolean ignoreVmState = cmd.isIgnoreInstanceState();
+        ListResponse<InstanceBootGroupMemberResponse> response = new ListResponse<>();
+        response.setResponses(members.stream().map(member -> createInstanceBootGroupMemberResponse(member, includeReadiness, includeChildren, ignoreVmState)).collect(Collectors.toList()), result.second());
+        return response;
+    }
+
+    @Override
+    @ActionEvent(eventType = EventTypes.EVENT_INSTANCE_BOOT_GROUP_START, eventDescription = "starting Instance Boot Group", async = true)
+    public InstanceBootGroup startInstanceBootGroup(final StartInstanceBootGroupCmd cmd) {
+        InstanceBootGroupVO group = getGroupAndCheckAccess(cmd.getId());
+        instanceBootGroupManager.startInstanceBootGroup(group);
+        return group;
+    }
+
+    @Override
+    @ActionEvent(eventType = EventTypes.EVENT_INSTANCE_BOOT_GROUP_STOP, eventDescription = "stopping Instance Boot Group", async = true)
+    public InstanceBootGroup stopInstanceBootGroup(final StopInstanceBootGroupCmd cmd) {
+        InstanceBootGroupVO group = getGroupAndCheckAccess(cmd.getId());
+        instanceBootGroupManager.stopInstanceBootGroup(group, cmd.isForced());
+        return group;
+    }
+
+    @Override
+    @ActionEvent(eventType = EventTypes.EVENT_INSTANCE_BOOT_GROUP_REBOOT, eventDescription = "rebooting Instance Boot Group", async = true)
+    public InstanceBootGroup rebootInstanceBootGroup(final RebootInstanceBootGroupCmd cmd) {
+        InstanceBootGroupVO group = getGroupAndCheckAccess(cmd.getId());
+        instanceBootGroupManager.rebootInstanceBootGroup(group, cmd.isForced());
+        return group;
+    }
+
+    @Override
+    public InstanceBootGroupResponse createInstanceBootGroupResponse(long id) {
+        return createInstanceBootGroupResponse(instanceBootGroupJoinDao.findById(id));
+    }
+
+    @Override
+    public InstanceBootGroupMemberResponse createInstanceBootGroupMemberResponse(InstanceBootGroupMember member) {
+        return createInstanceBootGroupMemberResponse(member, false, false, false);
+    }
+
+    private InstanceBootGroupMemberResponse createInstanceBootGroupMemberResponse(InstanceBootGroupMember member, boolean includeReadiness, boolean includeChildren, boolean ignoreVmState) {
+        InstanceBootGroupMemberResponse response = new InstanceBootGroupMemberResponse();
+        response.setId(member.getUuid());
+        InstanceBootGroupVO group = instanceBootGroupDao.findById(member.getBootGroupId());
+        if (group != null) {
+            response.setBootGroupId(group.getUuid());
+        }
+        response.setMemberType(member.getMemberType().name());
+        response.setOrder(member.getBootOrder());
+        response.setCreated(member.getCreated());
+
+        List<Long> childVmIds = new ArrayList<>();
+        if (member.getMemberType() == InstanceBootGroupMember.MemberType.VirtualMachine) {
+            UserVmVO vm = userVmDao.findById(member.getMemberId());
+            if (vm != null) {
+                response.setMemberId(vm.getUuid());
+                response.setMemberName(StringUtils.defaultIfEmpty(vm.getDisplayName(), vm.getHostName()));
+                response.setMemberState(vm.getState().toString());
+            }
+        } else {
+            InstanceGroupVO instanceGroup = instanceGroupDao.findById(member.getMemberId());
+            if (instanceGroup != null) {
+                response.setMemberId(instanceGroup.getUuid());
+                response.setMemberName(instanceGroup.getName());
+            }
+            if (includeReadiness || includeChildren) {
+                childVmIds = instanceGroupVMMapDao.listByGroupId(member.getMemberId()).stream()
+                        .map(InstanceGroupVMMapVO::getInstanceId)
+                        .collect(Collectors.toList());
+            }
+        }
+
+        if (includeReadiness) {
+            response.setReadinessMode(computeReadinessMode(member.getMemberType(), member.getBootGroupId(), member.getMemberId()));
+            ReadinessChecker.Result readinessResult = member.getMemberType() == InstanceBootGroupMember.MemberType.VirtualMachine
+                    ? computeCachedVmReadinessResult(member.getBootGroupId(), member.getMemberId(), ignoreVmState)
+                    : computeCachedInstanceGroupReadinessResult(member.getBootGroupId(), member.getMemberId(), childVmIds, ignoreVmState);
+            response.setReadinessStatus(readinessResult.getStatus().name());
+            response.setReadinessMessage(readinessResult.getMessage());
+        }
+
+        if (includeChildren && member.getMemberType() == InstanceBootGroupMember.MemberType.InstanceGroup) {
+            response.setChildren(buildChildrenResponses(member.getBootGroupId(), childVmIds, includeReadiness, ignoreVmState));
+        }
+
+        response.setObjectName("instancebootgroupmember");
+        return response;
+    }
+
+    /**
+     * Basic VM fields only (id/name/state, all off UserVmDao) — fetched in a single batch via
+     * listByIds rather than one findById per VM, since an InstanceGroup can hold many VMs.
+     */
+    private List<InstanceBootGroupMemberChildResponse> buildChildrenResponses(long bootGroupId, List<Long> vmIds, boolean includeReadiness, boolean ignoreVmState) {
+        List<InstanceBootGroupMemberChildResponse> children = new ArrayList<>();
+        if (vmIds.isEmpty()) {
+            return children;
+        }
+        for (UserVmVO vm : userVmDao.listByIds(vmIds)) {
+            InstanceBootGroupMemberChildResponse child = new InstanceBootGroupMemberChildResponse();
+            child.setId(vm.getUuid());
+            child.setName(StringUtils.defaultIfEmpty(vm.getDisplayName(), vm.getHostName()));
+            child.setState(vm.getState().toString());
+            if (includeReadiness) {
+                child.setReadinessMode(computeReadinessMode(InstanceBootGroupMember.MemberType.VirtualMachine, bootGroupId, vm.getId()));
+                ReadinessChecker.Result readinessResult = computeCachedVmReadinessResult(bootGroupId, vm.getId(), ignoreVmState);
+                child.setReadinessStatus(readinessResult.getStatus().name());
+                child.setReadinessMessage(readinessResult.getMessage());
+            }
+            children.add(child);
+        }
+        return children;
+    }
+
+    private String computeReadinessMode(InstanceBootGroupMember.MemberType itemType, long bootGroupId, long itemId) {
+        boolean hasRules = !instanceBootGroupReadinessRuleDao.listEnabledByItem(bootGroupId, itemType, itemId).isEmpty();
+        boolean hasInheritedRules = itemType == InstanceBootGroupMember.MemberType.VirtualMachine
+                && !instanceBootGroupReadinessRuleService.findInheritedGroupRules(bootGroupId, itemId).isEmpty();
+        InstanceBootGroupMember.ReadinessMode readinessMode = InstanceBootGroupMember.ReadinessMode.None;
+        if (hasRules || hasInheritedRules) {
+            readinessMode = InstanceBootGroupMember.ReadinessMode.RuleBased;
+        } else if (InstanceBootGroupMember.MemberType.InstanceGroup.equals(itemType)) {
+            readinessMode = InstanceBootGroupMember.ReadinessMode.ChildDependent;
+        }
+        return readinessMode.name();
+    }
+
+    /**
+     * Reads cached results only — viewing/polling the member list must never itself dispatch a remote
+     * check as a side effect. Combines the VM's own direct rules (cached at vmId 0) with any rules it
+     * inherits from its owning InstanceGroup (cached per-member at this VM's own id).
+     * @param ignoreVmState if false (the normal case), a non-Running VM is always NotReady regardless of
+     *        any cached rule result, so a VM that stopped can't keep reporting a stale Ready; pass true
+     *        to see the raw last-cached rule result for diagnosing what happened before it stopped.
+     */
+    private ReadinessChecker.Result computeCachedVmReadinessResult(long bootGroupId, long vmId, boolean ignoreVmState) {
+        List<InstanceBootGroupReadinessRuleVO> directRules = instanceBootGroupReadinessRuleDao.listEnabledByItem(bootGroupId, InstanceBootGroupMember.MemberType.VirtualMachine, vmId);
+        List<InstanceBootGroupReadinessRule> inheritedRules = instanceBootGroupReadinessRuleService.findInheritedGroupRules(bootGroupId, vmId);
+
+        UserVmVO vm = userVmDao.findById(vmId);
+        boolean running = vm != null && vm.getState() == com.cloud.vm.VirtualMachine.State.Running;
+        String vmState = vm != null ? vm.getState().toString() : "unknown";
+
+        if (directRules.isEmpty() && inheritedRules.isEmpty()) {
+            InstanceBootGroupReadinessRule.Status status = running ? InstanceBootGroupReadinessRule.Status.Ready : InstanceBootGroupReadinessRule.Status.NotReady;
+            return new ReadinessChecker.Result(status, "Instance state is " + vmState + ". No readiness rules attached");
+        }
+        if (!running && !ignoreVmState) {
+            return new ReadinessChecker.Result(InstanceBootGroupReadinessRule.Status.NotReady, "Instance state is " + vmState);
+        }
+
+        List<Pair<InstanceBootGroupReadinessRule, Long>> ruleAndCacheVmIds = new ArrayList<>();
+        for (InstanceBootGroupReadinessRuleVO rule : directRules) {
+            ruleAndCacheVmIds.add(new Pair<>(rule, 0L));
+        }
+        for (InstanceBootGroupReadinessRule rule : inheritedRules) {
+            ruleAndCacheVmIds.add(new Pair<>(rule, vmId));
+        }
+        return combineCachedRuleResults(ruleAndCacheVmIds);
+    }
+
+    /**
+     * With a MemberQuorum rule, neither a member's own status nor any other member-targeted group
+     * rule's all-members aggregate gates {@code ownResult} — the quorum rule's own tolerance-aware
+     * verdict is the one that counts. Without one, every member (and every group rule) must be ready.
+     * Unless {@code ignoreVmState}, the group's own rule rows are refreshed first — a group-scope
+     * rule (MemberQuorum in particular) isn't tied to any one VM's state, so nothing else re-derives
+     * it once a member stops outside of active boot-group orchestration.
+     */
+    private ReadinessChecker.Result computeCachedInstanceGroupReadinessResult(long bootGroupId, long instanceGroupId, List<Long> memberVmIds, boolean ignoreVmState) {
+        List<InstanceBootGroupReadinessRuleVO> groupRules = instanceBootGroupReadinessRuleDao.listEnabledByItem(bootGroupId, InstanceBootGroupMember.MemberType.InstanceGroup, instanceGroupId);
+        if (!ignoreVmState && !groupRules.isEmpty()) {
+            instanceBootGroupReadinessRuleService.evaluateInstanceGroupReadiness(bootGroupId, instanceGroupId, Collections.emptySet());
+        }
+        boolean hasMemberQuorumRule = groupRules.stream().anyMatch(rule -> rule.getRuleType() == InstanceBootGroupReadinessRule.RuleType.MemberQuorum);
+        List<Pair<InstanceBootGroupReadinessRule, Long>> ownRuleAndCacheVmIds = new ArrayList<>();
+        for (InstanceBootGroupReadinessRuleVO rule : groupRules) {
+            if (hasMemberQuorumRule && rule.getRuleType().isMemberTargeted()) {
+                continue;
+            }
+            ownRuleAndCacheVmIds.add(new Pair<>(rule, 0L));
+        }
+        ReadinessChecker.Result ownResult = combineCachedRuleResults(ownRuleAndCacheVmIds);
+
+        boolean anyError = ownResult.getStatus() == InstanceBootGroupReadinessRule.Status.Error;
+        boolean anyNotReady = !anyError && ownResult.getStatus() != InstanceBootGroupReadinessRule.Status.Ready;
+
+        int notReadyChildren = 0;
+        for (Long vmId : memberVmIds) {
+            InstanceBootGroupReadinessRule.Status vmStatus = computeCachedVmReadinessResult(bootGroupId, vmId, ignoreVmState).getStatus();
+            if (vmStatus != InstanceBootGroupReadinessRule.Status.Ready) {
+                notReadyChildren++;
+            }
+            if (hasMemberQuorumRule) {
+                continue;
+            }
+            if (vmStatus == InstanceBootGroupReadinessRule.Status.Error) {
+                anyError = true;
+            } else if (vmStatus != InstanceBootGroupReadinessRule.Status.Ready) {
+                anyNotReady = true;
+            }
+        }
+
+        InstanceBootGroupReadinessRule.Status aggregateStatus = anyError ? InstanceBootGroupReadinessRule.Status.Error
+                : (anyNotReady ? InstanceBootGroupReadinessRule.Status.NotReady : InstanceBootGroupReadinessRule.Status.Ready);
+
+        List<String> messageParts = new ArrayList<>();
+        if (!groupRules.isEmpty() && ownResult.getStatus() != InstanceBootGroupReadinessRule.Status.Ready) {
+            messageParts.add(ownResult.getMessage());
+        }
+        if (notReadyChildren > 0) {
+            messageParts.add(String.format("%d of %d member VM(s) not ready", notReadyChildren, memberVmIds.size()));
+        }
+        String message = messageParts.isEmpty() ? "all readiness rules ready" : String.join("; ", messageParts);
+
+        return new ReadinessChecker.Result(aggregateStatus, message);
+    }
+
+    /**
+     * Reduces multiple rules to one status (any Error wins, else any non-Ready means NotReady) plus
+     * the cached message(s) of whichever rule(s) are at that worst severity, rule-type-prefixed.
+     * @param ruleAndCacheVmIds cache-vmId is 0 for the rule's own row, or a member's vmId if inherited.
+     */
+    private ReadinessChecker.Result combineCachedRuleResults(List<Pair<InstanceBootGroupReadinessRule, Long>> ruleAndCacheVmIds) {
+        boolean anyError = false;
+        boolean anyNotReady = false;
+        List<String> errorMessages = new ArrayList<>();
+        List<String> notReadyMessages = new ArrayList<>();
+        for (Pair<InstanceBootGroupReadinessRule, Long> entry : ruleAndCacheVmIds) {
+            InstanceBootGroupReadinessRule rule = entry.first();
+            InstanceBootGroupReadinessCheckResultVO result = instanceBootGroupReadinessCheckResultDao.findByRuleAndVm(rule.getId(), entry.second());
+            InstanceBootGroupReadinessRule.Status status = (result != null && result.getStatus() != null) ? result.getStatus() : InstanceBootGroupReadinessRule.Status.Unknown;
+            String detail = result != null ? result.getMessage() : null;
+            String labeledMessage = rule.getRuleType().name() + (StringUtils.isNotBlank(detail) ? (": " + detail) : "");
+            if (status == InstanceBootGroupReadinessRule.Status.Error) {
+                anyError = true;
+                errorMessages.add(labeledMessage);
+            } else if (status != InstanceBootGroupReadinessRule.Status.Ready) {
+                anyNotReady = true;
+                notReadyMessages.add(labeledMessage);
+            }
+        }
+        if (anyError) {
+            return new ReadinessChecker.Result(InstanceBootGroupReadinessRule.Status.Error, String.join("; ", errorMessages));
+        }
+        if (anyNotReady) {
+            return new ReadinessChecker.Result(InstanceBootGroupReadinessRule.Status.NotReady, String.join("; ", notReadyMessages));
+        }
+        return new ReadinessChecker.Result(InstanceBootGroupReadinessRule.Status.Ready, "All readiness rules ready");
+    }
+
+    private void validateMemberAccount(long memberAccountId, long groupAccountId) {
+        if (memberAccountId != groupAccountId) {
+            throw new PermissionDeniedException("Member must belong to the same account as the boot group");
+        }
+    }
+
+    /**
+     * Resolves the mutually-exclusive virtualmachineid/instancegroupid item params and checks access
+     * on the resolved item (in addition to the boot group, already checked via getGroupAndCheckAccess).
+     */
+    private Pair<InstanceBootGroupMember.MemberType, Long> resolveAndCheckAccessToItem(Long virtualMachineId, Long instanceGroupId) {
+        validateEitherVirtualMachineIdOrInstanceGroupIdParam(virtualMachineId, instanceGroupId);
+
+        Account caller = CallContext.current().getCallingAccount();
+        if (virtualMachineId != null) {
+            UserVmVO vm = userVmDao.findById(virtualMachineId);
+            if (vm == null) {
+                throw new InvalidParameterValueException("Unable to find virtual machine with ID: " + virtualMachineId);
+            }
+            accountManager.checkAccess(caller, null, true, vm);
+            return new Pair<>(InstanceBootGroupMember.MemberType.VirtualMachine, vm.getId());
+        }
+        InstanceGroupVO instanceGroup = instanceGroupDao.findById(instanceGroupId);
+        if (instanceGroup == null || instanceGroup.getRemoved() != null) {
+            throw new InvalidParameterValueException("Unable to find instance group with ID: " + instanceGroupId);
+        }
+        accountManager.checkAccess(caller, null, true, instanceGroup);
+        return new Pair<>(InstanceBootGroupMember.MemberType.InstanceGroup, instanceGroup.getId());
+    }
+
+    @Override
+    @ActionEvent(eventType = EventTypes.EVENT_INSTANCE_BOOT_GROUP_READINESS_RULE_CREATE, eventDescription = "creating Instance Boot Group readiness rule")
+    public InstanceBootGroupReadinessRule createInstanceBootGroupReadinessRule(CreateInstanceBootGroupReadinessRuleCmd cmd) {
+        getGroupAndCheckAccess(cmd.getBootGroupId());
+        Pair<InstanceBootGroupMember.MemberType, Long> item = resolveAndCheckAccessToItem(cmd.getVirtualMachineId(), cmd.getInstanceGroupId());
+
+        InstanceBootGroupReadinessRule.RuleType ruleType = EnumUtils.getEnumIgnoreCase(InstanceBootGroupReadinessRule.RuleType.class, cmd.getRuleType());
+        if (ruleType == null) {
+            throw new InvalidParameterValueException("Invalid rule type: " + cmd.getRuleType());
+        }
+
+        return instanceBootGroupReadinessRuleService.createReadinessRule(cmd.getBootGroupId(), item.first(), item.second(),
+                ruleType, cmd.getName(), cmd.isEnabled(), cmd.getDetails());
+    }
+
+    @Override
+    @ActionEvent(eventType = EventTypes.EVENT_INSTANCE_BOOT_GROUP_READINESS_RULE_UPDATE, eventDescription = "updating Instance Boot Group readiness rule")
+    public InstanceBootGroupReadinessRule updateInstanceBootGroupReadinessRule(UpdateInstanceBootGroupReadinessRuleCmd cmd) {
+        InstanceBootGroupReadinessRule rule = instanceBootGroupReadinessRuleDao.findById(cmd.getId());
+        if (rule == null) {
+            throw new InvalidParameterValueException("Unable to find a readiness rule with ID: " + cmd.getId());
+        }
+        getGroupAndCheckAccess(rule.getBootGroupId());
+
+        return instanceBootGroupReadinessRuleService.updateReadinessRule(cmd.getId(), cmd.getName(), cmd.getEnabled(), cmd.getDetails());
+    }
+
+    @Override
+    @ActionEvent(eventType = EventTypes.EVENT_INSTANCE_BOOT_GROUP_READINESS_RULE_DELETE, eventDescription = "deleting Instance Boot Group readiness rule")
+    public boolean deleteInstanceBootGroupReadinessRule(DeleteInstanceBootGroupReadinessRuleCmd cmd) {
+        InstanceBootGroupReadinessRule rule = instanceBootGroupReadinessRuleDao.findById(cmd.getId());
+        if (rule == null) {
+            throw new InvalidParameterValueException("Unable to find a readiness rule with ID: " + cmd.getId());
+        }
+        getGroupAndCheckAccess(rule.getBootGroupId());
+
+        return instanceBootGroupReadinessRuleService.deleteReadinessRule(cmd.getId());
+    }
+
+    /**
+     * When filtering by VM, also surfaces Ping/PortCheck/GuestAgentLiveness rules the VM inherits from
+     * its owning InstanceGroup (marked {@code inherited=true}), not just its own direct rules.
+     */
+    @Override
+    public ListResponse<InstanceBootGroupReadinessRuleResponse> listInstanceBootGroupReadinessRules(ListInstanceBootGroupReadinessRulesCmd cmd) {
+        getGroupAndCheckAccess(cmd.getBootGroupId());
+
+        if (cmd.getVirtualMachineId() != null && cmd.getInstanceGroupId() != null) {
+            throw new InvalidParameterValueException("Only one of virtualmachineid or instancegroupid may be specified");
+        }
+        InstanceBootGroupReadinessRule.RuleType ruleType = null;
+        if (cmd.getRuleType() != null) {
+            ruleType = EnumUtils.getEnumIgnoreCase(InstanceBootGroupReadinessRule.RuleType.class, cmd.getRuleType());
+            if (ruleType == null) {
+                throw new InvalidParameterValueException("Invalid rule type: " + cmd.getRuleType());
+            }
+        }
+
+        InstanceBootGroupMember.MemberType memberType = null;
+        Long memberId = null;
+        if (cmd.getVirtualMachineId() != null) {
+            memberType = InstanceBootGroupMember.MemberType.VirtualMachine;
+            memberId = cmd.getVirtualMachineId();
+        } else if (cmd.getInstanceGroupId() != null) {
+            memberType = InstanceBootGroupMember.MemberType.InstanceGroup;
+            memberId = cmd.getInstanceGroupId();
+        }
+        Pair<List<InstanceBootGroupReadinessRuleVO>, Integer> rulesAndCount = instanceBootGroupReadinessRuleDao.searchAndCountByBootGroupId(
+                cmd.getBootGroupId(),
+                cmd.getId(),
+                memberType,
+                memberId,
+                ruleType,
+                cmd.getKeyword(),
+                cmd.getStartIndex(),
+                cmd.getPageSizeVal());
+
+        List<InstanceBootGroupReadinessRuleResponse> responsesList = rulesAndCount.first().stream()
+                .map(rule -> createInstanceBootGroupReadinessRuleResponse(rule, false, 0))
+                .collect(Collectors.toList());
+        int totalCount = rulesAndCount.second();
+
+        if (cmd.getId() == null && cmd.getVirtualMachineId() != null) {
+            for (InstanceBootGroupReadinessRule rule : instanceBootGroupReadinessRuleService.findInheritedGroupRules(cmd.getBootGroupId(), cmd.getVirtualMachineId())) {
+                if (ruleType != null && rule.getRuleType() != ruleType) {
+                    continue;
+                }
+                if (cmd.getKeyword() != null && (rule.getName() == null || !rule.getName().toLowerCase().contains(cmd.getKeyword().toLowerCase()))) {
+                    continue;
+                }
+                responsesList.add(createInstanceBootGroupReadinessRuleResponse(rule, true, cmd.getVirtualMachineId()));
+                totalCount++;
+            }
+        }
+
+        ListResponse<InstanceBootGroupReadinessRuleResponse> response = new ListResponse<>();
+        response.setResponses(responsesList, totalCount);
+        return response;
+    }
+
+    @Override
+    public InstanceBootGroupReadinessRuleResponse createInstanceBootGroupReadinessRuleResponse(InstanceBootGroupReadinessRule rule) {
+        return createInstanceBootGroupReadinessRuleResponse(rule, false, 0);
+    }
+
+    @Override
+    public Long getInstanceBootGroupIdForMember(long memberId) {
+        InstanceBootGroupMember member = instanceBootGroupMemberDao.findById(memberId);
+        return member == null ? null : member.getBootGroupId();
+    }
+
+    private InstanceBootGroupReadinessRuleResponse createInstanceBootGroupReadinessRuleResponse(InstanceBootGroupReadinessRule rule, boolean inherited, long statusVmId) {
+        InstanceBootGroupReadinessRuleResponse response = new InstanceBootGroupReadinessRuleResponse();
+        response.setId(rule.getUuid());
+        response.setName(rule.getName());
+        InstanceBootGroupVO group = instanceBootGroupDao.findById(rule.getBootGroupId());
+        if (group != null) {
+            response.setBootGroupId(group.getUuid());
+        }
+        response.setItemType(rule.getItemType().name());
+        response.setEnabled(rule.isEnabled());
+        response.setRuleType(rule.getRuleType().name());
+        response.setCreated(rule.getCreated());
+        response.setDetails(instanceBootGroupReadinessRuleDetailsDao.getDetails(rule.getId()));
+        response.setInherited(inherited);
+
+        if (rule.getItemType() == InstanceBootGroupMember.MemberType.VirtualMachine) {
+            UserVmVO vm = userVmDao.findById(rule.getItemId());
+            if (vm != null) {
+                response.setItemId(vm.getUuid());
+                response.setItemName(StringUtils.defaultIfEmpty(vm.getDisplayName(), vm.getHostName()));
+            }
+        } else {
+            InstanceGroupVO instanceGroup = instanceGroupDao.findById(rule.getItemId());
+            if (instanceGroup != null) {
+                response.setItemId(instanceGroup.getUuid());
+                response.setItemName(instanceGroup.getName());
+            }
+        }
+
+        InstanceBootGroupReadinessCheckResultVO result = instanceBootGroupReadinessCheckResultDao.findByRuleAndVm(rule.getId(), statusVmId);
+        if (result != null) {
+            response.setStatus(result.getStatus() == null ? null : result.getStatus().name());
+            response.setStatusMessage(result.getMessage());
+            response.setCheckedOn(result.getCheckedOn());
+        }
+
+        response.setObjectName("instancebootgroupreadinessrule");
+        return response;
+    }
+
+    @Override
+    public List<Class<?>> getCommands() {
+        return List.of(
+                CreateInstanceBootGroupCmd.class,
+                DeleteInstanceBootGroupCmd.class,
+                UpdateInstanceBootGroupCmd.class,
+                ListInstanceBootGroupsCmd.class,
+                AddMemberToInstanceBootGroupCmd.class,
+                RemoveInstanceBootGroupMemberCmd.class,
+                UpdateInstanceBootGroupMemberCmd.class,
+                ListInstanceBootGroupMembersCmd.class,
+                StartInstanceBootGroupCmd.class,
+                StopInstanceBootGroupCmd.class,
+                RebootInstanceBootGroupCmd.class,
+                CreateInstanceBootGroupReadinessRuleCmd.class,
+                UpdateInstanceBootGroupReadinessRuleCmd.class,
+                DeleteInstanceBootGroupReadinessRuleCmd.class,
+                ListInstanceBootGroupReadinessRulesCmd.class
+        );
+    }
+}
diff --git a/server/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupManager.java b/server/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupManager.java
new file mode 100644
index 000000000000..8e391c776434
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupManager.java
@@ -0,0 +1,35 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup;
+
+import com.cloud.utils.component.Manager;
+
+/**
+ * Backend/orchestration counterpart to {@link InstanceBootGroupService} (the API-facing contract,
+ * implemented by {@code InstanceBootGroupApiServiceImpl}). Deliberately takes domain objects, never
+ * API {@code Cmd} types, so it has no API-layer dependency and can be invoked outside a request
+ * context (e.g. a background job) without fabricating a CallContext.
+ */
+public interface InstanceBootGroupManager extends Manager {
+
+    void startInstanceBootGroup(InstanceBootGroupVO group);
+
+    void stopInstanceBootGroup(InstanceBootGroupVO group, boolean forced);
+
+    void rebootInstanceBootGroup(InstanceBootGroupVO group, boolean forced);
+}
diff --git a/server/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupManagerImpl.java b/server/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupManagerImpl.java
new file mode 100644
index 000000000000..8f0ec7da4cd2
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupManagerImpl.java
@@ -0,0 +1,619 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup;
+
+import java.util.ArrayList;
+import java.util.Collection;
+import java.util.Comparator;
+import java.util.HashMap;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.TreeMap;
+import java.util.concurrent.ConcurrentHashMap;
+import java.util.concurrent.ExecutionException;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.Future;
+import java.util.stream.Collectors;
+
+import javax.inject.Inject;
+import javax.naming.ConfigurationException;
+
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.config.Configurable;
+import org.apache.cloudstack.managed.context.ManagedContextRunnable;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRuleService;
+import org.springframework.stereotype.Component;
+
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.concurrency.NamedThreadFactory;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.vm.InstanceGroup;
+import com.cloud.vm.UserVmService;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.VirtualMachineManager;
+import com.cloud.vm.dao.InstanceBootGroupDetailsDao;
+import com.cloud.vm.dao.InstanceBootGroupMemberDao;
+import com.cloud.vm.dao.InstanceGroupDao;
+import com.cloud.vm.dao.InstanceGroupVMMapDao;
+import com.cloud.vm.dao.UserVmDao;
+
+/**
+ * Backend/orchestration half of the Instance Boot Group feature — tier concurrency, hypervisor
+ * start/stop/reboot calls, and readiness-gated tier progression. API-cmd handling (ACL, validation,
+ * response building, command registration) lives in {@code InstanceBootGroupApiServiceImpl}, which
+ * delegates here with resolved domain objects.
+ *
+ * <p>Per-VM timeout/reboot-attempt bookkeeping during a start is kept purely in-memory, scoped to the
+ * async job thread executing the start — it is not persisted. Surviving a management-server restart
+ * mid-run is explicitly not a goal here; if the process restarts, the job (and this bookkeeping) is
+ * simply lost, same as any other in-flight async job. Current readiness is queryable at any time via
+ * {@code listInstanceBootGroupMembers?details=readiness}, not via a separate run-history API.</p>
+ */
+@Component
+public class InstanceBootGroupManagerImpl extends ManagerBase implements InstanceBootGroupManager, Configurable {
+
+    public static final ConfigKey<Long> ReadinessAttemptTimeoutSeconds = new ConfigKey<>("Advanced", Long.class,
+            "instance.boot.group.readiness.timeout.seconds", "300",
+            "How long to wait (in seconds) for an instance to become ready during boot group orchestration before starting a new readiness retry attempt. Overridable per boot group.", true);
+
+    public static final ConfigKey<Long> ReadinessMaxRetryAttempts = new ConfigKey<>("Advanced", Long.class,
+            "instance.boot.group.readiness.max.retry.attempts", "5",
+            "Maximum number of readiness retry attempts for an instance that fails to become ready during boot group orchestration before the boot group start is halted. Overridable per boot group.", true);
+
+    public static final ConfigKey<Long> ReadinessPollIntervalSeconds = new ConfigKey<>("Advanced", Long.class,
+            "instance.boot.group.readiness.poll.interval.seconds", "10",
+            "How often (in seconds) to re-check instance/instance-group readiness during boot group orchestration, including the minimum pause after a readiness retry attempt that did not reboot the instance before repeating the check that just failed. A very low value can cause rapid repeated (\"hammering\") readiness retries against an instance/VR/host. Global only, not overridable per boot group.", true);
+
+    public static final ConfigKey<Long> ReadinessInitialDelaySeconds = new ConfigKey<>("Advanced", Long.class,
+            "instance.boot.group.readiness.initial.delay.seconds", "30",
+            "How long to wait (in seconds) after starting or rebooting an instance before its first readiness check of that attempt, giving the guest OS/agent/network time to come up. Overridable per boot group.", true);
+
+    public static final ConfigKey<Boolean> ReadinessRebootOnRetry = new ConfigKey<>("Advanced", Boolean.class,
+            "instance.boot.group.readiness.reboot.on.retry", "false",
+            "Whether to reboot an instance between readiness retry attempts during boot group orchestration, instead of just waiting longer. Overridable per boot group.", true);
+
+    public static final ConfigKey<Long> ReadinessCheckConcurrency = new ConfigKey<>("Advanced", Long.class,
+            "instance.boot.group.readiness.check.concurrency", "10",
+            "Maximum number of instances within a single boot-order tier whose readiness is checked concurrently during boot group orchestration, so one slow check cannot delay every other instance's check in the same poll. Global only, not overridable per boot group.", true);
+
+    public static final ConfigKey<Long> MaxMembersPerBootGroup = new ConfigKey<>("Advanced", Long.class,
+            "instance.boot.group.max.members", "10",
+            "Maximum number of members that can be added to a single instance boot group.", true, ConfigKey.Scope.Domain);
+
+    @Inject
+    private InstanceBootGroupMemberDao instanceBootGroupMemberDao;
+
+    @Inject
+    private UserVmService userVmService;
+
+    @Inject
+    private UserVmDao userVmDao;
+
+    @Inject
+    private InstanceGroupDao instanceGroupDao;
+
+    @Inject
+    private InstanceGroupVMMapDao instanceGroupVMMapDao;
+
+    @Inject
+    private VirtualMachineManager virtualMachineManager;
+
+    @Inject
+    private InstanceBootGroupReadinessRuleService instanceBootGroupReadinessRuleService;
+
+    @Inject
+    private InstanceBootGroupDetailsDao instanceBootGroupDetailsDao;
+
+    @Override
+    public boolean configure(String name, Map<String, Object> params) throws ConfigurationException {
+        VirtualMachine.State.getStateMachine().registerListener(new InstanceBootGroupVmStateListener(instanceBootGroupReadinessRuleService));
+        return true;
+    }
+
+    @Override
+    public String getConfigComponentName() {
+        return InstanceBootGroupManagerImpl.class.getSimpleName();
+    }
+
+    @Override
+    public ConfigKey<?>[] getConfigKeys() {
+        return new ConfigKey<?>[]{ReadinessAttemptTimeoutSeconds, ReadinessMaxRetryAttempts, ReadinessPollIntervalSeconds, ReadinessInitialDelaySeconds, ReadinessRebootOnRetry, ReadinessCheckConcurrency,
+                MaxMembersPerBootGroup};
+    }
+
+    /** In-memory-only per-VM progress for a single start attempt — never persisted. Package-visible
+     *  (rather than private) purely so tests can construct one and inspect retry/give-up state
+     *  directly instead of via reflection. */
+    protected static final class VmProgress {
+        private final long vmId;
+        private final Long bootGroupMemberId;
+        private boolean ready;
+        /** Set when this VM has exhausted its retry attempts but belongs to an InstanceGroup
+         *  member, so the group's own readiness rule (e.g. a quorum rule) gets the final say
+         *  instead of this one VM halting the whole boot group. */
+        protected boolean gaveUp;
+        protected int retryAttempts;
+        /** Anchor for the per-attempt timeout window; reset on every retry, rebooted or not. */
+        private long enteredWaitAtMs;
+        /** Anchor for the initial-delay grace period; only reset on the initial start and on an
+         *  actual reboot — a no-op retry (reboot-on-retry disabled) leaves this alone, since there's
+         *  no fresh boot to wait out. */
+        private long lastBootedAtMs;
+
+        protected VmProgress(long vmId, Long bootGroupMemberId) {
+            this.vmId = vmId;
+            this.bootGroupMemberId = bootGroupMemberId;
+        }
+
+        private String getAttemptsLog(long maxAttempts) {
+            return String.format("%d/%d", retryAttempts + 1, maxAttempts);
+        }
+    }
+
+    @Override
+    public void startInstanceBootGroup(InstanceBootGroupVO group) {
+        List<InstanceBootGroupMemberVO> members = instanceBootGroupMemberDao.listByBootGroupId(group.getId());
+        Map<Integer, List<InstanceBootGroupMemberVO>> tiers = groupByOrder(members);
+        logger.info("Starting {}: {} tier(s), {} member(s) total", group, tiers.size(), members.size());
+        long groupStartedAtMs = System.currentTimeMillis();
+
+        for (Map.Entry<Integer, List<InstanceBootGroupMemberVO>> tierEntry : tiers.entrySet()) {
+            int tierOrder = tierEntry.getKey();
+            List<InstanceBootGroupMemberVO> tierMembers = tierEntry.getValue();
+
+            Map<Long, VmProgress> progressByVmId = new LinkedHashMap<>();
+            for (InstanceBootGroupMemberVO member : tierMembers) {
+                for (Long vmId : resolveVmIds(List.of(member))) {
+                    progressByVmId.put(vmId, new VmProgress(vmId, member.getId()));
+                }
+            }
+            List<Long> tierVmIds = new ArrayList<>(progressByVmId.keySet());
+            logger.info("Starting tier {} of {}: {} member(s), {} VM(s)", tierOrder, group, tierMembers.size(), tierVmIds.size());
+            long tierStartedAtMs = System.currentTimeMillis();
+
+            try {
+                runTierConcurrently(tierVmIds, group, "start", vmId -> {
+                    UserVmVO vm = userVmDao.findById(vmId);
+                    boolean alreadyRunning = vm != null && VirtualMachine.State.Running.equals(vm.getState());
+                    if (vm != null && !alreadyRunning) {
+                        userVmService.startVirtualMachine(vm, null);
+                    }
+                    anchorInitialDelay(group, progressByVmId.get(vmId), vm, alreadyRunning);
+                }, true);
+            } catch (CloudRuntimeException e) {
+                halt(group, "Failed to start a VM in tier " + tierOrder + ": " + e.getMessage());
+                throw e;
+            }
+
+            waitForTierReady(group, tierOrder, tierMembers, progressByVmId);
+            logger.info("Tier {} of {} is ready ({}ms)", tierOrder, group, System.currentTimeMillis() - tierStartedAtMs);
+        }
+
+        logger.info("{} start completed ({}ms)", group, System.currentTimeMillis() - groupStartedAtMs);
+    }
+
+    /**
+     * If the VM was already running, anchors the initial-delay grace period to when CloudStack last
+     * confirmed its power state rather than to "now" — so it waits out only what's left of the
+     * delay (or none) instead of a full fresh wait it doesn't need.
+     */
+    private void anchorInitialDelay(InstanceBootGroupVO group, VmProgress progress, UserVmVO vm, boolean alreadyRunning) {
+        long now = System.currentTimeMillis();
+        progress.enteredWaitAtMs = now;
+        if (alreadyRunning && vm.getPowerStateUpdateTime() != null) {
+            progress.lastBootedAtMs = vm.getPowerStateUpdateTime().getTime();
+            logger.debug("{} was already running (power state last confirmed {}); readiness checks begin after any remaining portion of the {}s initial delay",
+                    vm, vm.getPowerStateUpdateTime(), effectiveInitialDelaySeconds(group));
+        } else {
+            progress.lastBootedAtMs = now;
+            logger.debug("{} start action completed; readiness checks begin after the {}s initial delay", vm, effectiveInitialDelaySeconds(group));
+        }
+    }
+
+    /**
+     * Polls every not-yet-settled VM in the tier concurrently (bounded by
+     * {@code ReadinessCheckConcurrency}) until the whole tier — VMs and any InstanceGroup
+     * members — reports ready, or a halt is triggered.
+     */
+    private void waitForTierReady(InstanceBootGroupVO group, int tierOrder, List<InstanceBootGroupMemberVO> tierMembers, Map<Long, VmProgress> progressByVmId) {
+        Map<Long, InstanceBootGroupMemberVO> memberById = new HashMap<>();
+        Map<Long, Boolean> membersReadyStatus = new ConcurrentHashMap<>();
+        for (InstanceBootGroupMemberVO member : tierMembers) {
+            memberById.put(member.getId(), member);
+            membersReadyStatus.put(member.getId(), false);
+        }
+        final long effectiveMaxRetryAttempts = effectiveMaxRetryAttempts(group);
+        final long effectiveTimeoutSeconds = effectiveTimeoutSeconds(group);
+        final long effectivePollIntervalSeconds = effectivePollIntervalSeconds();
+        final long pollIntervalMs = effectivePollIntervalSeconds * 1000L;
+        final boolean effectiveRebootOnRetry = effectiveRebootOnRetry(group);
+        int concurrency = (int) Math.max(1, Math.min(progressByVmId.size(), effectiveReadinessCheckConcurrency()));
+        // Bound the polling loop: initial delay + maxAttempts full timeout windows + inter-poll sleeps between them.
+        // At least one timeout window is always budgeted so a single check is never starved out, even if
+        // maxAttempts is configured to 0.
+        long maxWaitMs = (effectiveInitialDelaySeconds(group) + Math.max(1, effectiveMaxRetryAttempts) * effectiveTimeoutSeconds
+                + Math.max(0, effectiveMaxRetryAttempts - 1) * effectivePollIntervalSeconds) * 1000L;
+        long deadline = System.currentTimeMillis() + maxWaitMs;
+        logger.debug("Waiting for tier {} of {} to become ready: {} VM(s) tracked, timeout={}s, pollInterval={}s, checkConcurrency={}, maxWait={}ms",
+                tierOrder, group, progressByVmId.size(), effectiveTimeoutSeconds, effectivePollIntervalSeconds, concurrency, maxWaitMs);
+
+        CallContext callerContext = CallContext.current();
+        ExecutorService readinessExecutor = Executors.newFixedThreadPool(concurrency, new NamedThreadFactory("InstanceBootGroup-readiness-" + tierOrder));
+        try {
+            while (System.currentTimeMillis() < deadline) {
+                List<Future<Void>> futures = new ArrayList<>();
+                for (VmProgress progress : progressByVmId.values()) {
+                    if (progress.ready || progress.gaveUp) {
+                        continue;
+                    }
+                    futures.add(readinessExecutor.submit(() -> {
+                        CallContext.register(callerContext, ApiCommandResourceType.VirtualMachine);
+                        try {
+                            checkVmReadiness(group, progress, memberById, membersReadyStatus,
+                                    effectiveMaxRetryAttempts, effectiveTimeoutSeconds, effectiveRebootOnRetry);
+                        } finally {
+                            CallContext.unregister();
+                        }
+                        return null;
+                    }));
+                }
+                for (Future<Void> future : futures) {
+                    try {
+                        future.get();
+                    } catch (ExecutionException e) {
+                        Throwable cause = e.getCause() != null ? e.getCause() : e;
+                        if (cause instanceof CloudRuntimeException) {
+                            throw (CloudRuntimeException) cause;
+                        }
+                        throw new CloudRuntimeException("Failed to evaluate readiness for a VM in tier " + tierOrder + " of " + group.getName() + ": " + cause.getMessage(), cause);
+                    } catch (InterruptedException e) {
+                        Thread.currentThread().interrupt();
+                        throw new CloudRuntimeException("Interrupted while evaluating readiness for tier " + tierOrder + " of " + group.getName(), e);
+                    }
+                }
+
+                checkInstanceGroupMembersReady(group, tierMembers, progressByVmId, membersReadyStatus);
+
+                if (membersReadyStatus.values().stream().allMatch(Boolean::booleanValue)) {
+                    return;
+                }
+
+                sleep(pollIntervalMs);
+            }
+            String reason = String.format("Tier %d of boot group '%s' did not become ready within the maximum wait of %dms", tierOrder, group.getName(), maxWaitMs);
+            logger.error(reason);
+            halt(group, reason);
+            throw new CloudRuntimeException(reason);
+        } finally {
+            readinessExecutor.shutdown();
+        }
+    }
+
+    /**
+     * Runs on one of {@code waitForTierReady}'s pooled threads for a single VM: gates on the
+     * initial-delay window, dispatches this poll's check with the remaining time budget, and treats
+     * Error the same as NotReady — both get a retry before anything halts.
+     *
+     * <p>Package-visible (rather than private) so tests can call it directly instead of via
+     * reflection.</p>
+     */
+    protected void checkVmReadiness(InstanceBootGroupVO group, VmProgress progress, Map<Long, InstanceBootGroupMemberVO> memberById,
+            Map<Long, Boolean> membersReadyStatus, long effectiveMaxRetryAttempts, long effectiveTimeoutSeconds,
+            boolean effectiveRebootOnRetry) {
+        UserVmVO vm = userVmDao.findById(progress.vmId);
+        long elapsedMs = System.currentTimeMillis() - progress.enteredWaitAtMs;
+        long elapsedSinceBootMs = System.currentTimeMillis() - progress.lastBootedAtMs;
+        long initialDelayMs = effectiveInitialDelaySeconds(group) * 1000L;
+        if (elapsedSinceBootMs < initialDelayMs) {
+            logger.debug("{} still within the initial delay window ({}ms elapsed of {}ms since last boot) — skipping readiness check this poll. Attempt: {}",
+                    vm, elapsedSinceBootMs, initialDelayMs, progress.getAttemptsLog(effectiveMaxRetryAttempts));
+            return;
+        }
+
+        long remainingMs = Math.max(0, effectiveTimeoutSeconds * 1000L - elapsedMs);
+        String attemptLabel = progress.getAttemptsLog(effectiveMaxRetryAttempts);
+        logger.debug("Evaluating readiness of {} for {} ({}ms since this attempt started, {}ms remaining budget). Attempt: {}",
+                vm, group, elapsedMs, remainingMs, attemptLabel);
+        InstanceBootGroupReadinessRule.Status readiness = instanceBootGroupReadinessRuleService.evaluateVmReadiness(group.getId(), progress.vmId, remainingMs, attemptLabel);
+        if (readiness == InstanceBootGroupReadinessRule.Status.Ready) {
+            progress.ready = true;
+            logger.debug("{} is ready for {}", vm, group);
+            InstanceBootGroupMemberVO member = memberById.get(progress.bootGroupMemberId);
+            if (member != null && InstanceBootGroupMember.MemberType.VirtualMachine.equals(member.getMemberType())) {
+                membersReadyStatus.put(progress.bootGroupMemberId, true);
+            }
+            return;
+        }
+
+        if (progress.retryAttempts < effectiveMaxRetryAttempts - 1) {
+            long now = System.currentTimeMillis();
+            if (effectiveRebootOnRetry) {
+                rebootVm(progress.vmId);
+                progress.lastBootedAtMs = now;
+            }
+            logger.debug("{} readiness retry attempt {} of {} with a reboot={}",
+                    vm, progress.getAttemptsLog(effectiveMaxRetryAttempts), group, effectiveRebootOnRetry);
+            progress.retryAttempts++;
+            progress.enteredWaitAtMs = now;
+        } else {
+            progress.gaveUp = true;
+            InstanceBootGroupMemberVO member = memberById.get(progress.bootGroupMemberId);
+            if (member != null && InstanceBootGroupMember.MemberType.InstanceGroup.equals(member.getMemberType())) {
+                logger.warn("{} failed readiness after {} retry attempts; giving up on it and deferring to {}'s own readiness rule",
+                        vm, progress.getAttemptsLog(effectiveMaxRetryAttempts), member);
+            } else {
+                String reason = String.format("Instance '%s' failed readiness after %s retry attempts",
+                        vm.getName(), progress.getAttemptsLog(effectiveMaxRetryAttempts));
+                logger.warn("{} failed readiness after {} retry attempts; halting {}",
+                        vm, progress.getAttemptsLog(effectiveMaxRetryAttempts), group);
+                halt(group, reason);
+                throw new CloudRuntimeException(reason);
+            }
+        }
+    }
+
+    /**
+     * Sequential pass over the tier's InstanceGroup members, run once all of this poll's per-VM
+     * tasks finish. An empty member list is treated as settled — {@code allMatch()} on an empty
+     * stream is vacuously true either way, so there's nothing left to wait for.
+     */
+    private void checkInstanceGroupMembersReady(InstanceBootGroupVO group, List<InstanceBootGroupMemberVO> tierMembers,
+            Map<Long, VmProgress> progressByVmId, Map<Long, Boolean> membersReadyStatus) {
+        for (InstanceBootGroupMemberVO member : tierMembers) {
+            if (!InstanceBootGroupMember.MemberType.InstanceGroup.equals(member.getMemberType()) || membersReadyStatus.getOrDefault(member.getId(), false)) {
+                continue;
+            }
+            InstanceGroup instanceGroup = instanceGroupDao.findById(member.getMemberId());
+            Collection<VmProgress> memberProgresses = progressByVmId.values().stream()
+                    .filter(p -> member.getId() == (p.bootGroupMemberId == null ? -1 : p.bootGroupMemberId))
+                    .collect(Collectors.toList());
+            if (!memberProgresses.isEmpty() && memberProgresses.stream().allMatch(p -> !p.ready && !p.gaveUp)) {
+                logger.debug("{} part of {} has no VMs that are ready or have exhausted their retries yet", instanceGroup, group);
+                continue;
+            }
+
+            Set<Long> permanentlyFailedVmIds = memberProgresses.stream()
+                    .filter(p -> p.gaveUp)
+                    .map(p -> p.vmId)
+                    .collect(Collectors.toSet());
+            InstanceBootGroupReadinessRule.Status groupStatus =
+                    instanceBootGroupReadinessRuleService.evaluateInstanceGroupReadiness(group.getId(), member.getMemberId(), permanentlyFailedVmIds);
+            if (groupStatus == InstanceBootGroupReadinessRule.Status.Ready) {
+                membersReadyStatus.put(member.getId(), true);
+                logger.info("{} part of {} reached readiness state Ready", instanceGroup, group);
+                continue;
+            }
+            if (InstanceBootGroupReadinessRule.Status.Error.equals(groupStatus) ||
+                    (InstanceBootGroupReadinessRule.Status.NotReady.equals(groupStatus) &&
+                            memberProgresses.stream().allMatch(p -> p.ready || p.gaveUp))) {
+                String reason = String.format("Instance group '%s' failed its own readiness rules", instanceGroup.getName());
+                logger.error("{} failed its own readiness rules; halting {}", instanceGroup, group);
+                halt(group, reason);
+                throw new CloudRuntimeException(reason);
+            }
+        }
+    }
+
+    /**
+     * Only stops the orchestration loop — never stops a VM, since every VM touched by this point may
+     * already be running and tearing it down would be destructive, not recoverable.
+     */
+    private void halt(InstanceBootGroupVO group, String reason) {
+        logger.warn("Halting {} start: {}", group, reason);
+    }
+
+    private void rebootVm(long vmId) {
+        UserVmVO vm = userVmDao.findById(vmId);
+        if (vm == null) {
+            logger.warn("Cannot reboot instance id {} for a boot group readiness retry: VM not found", vmId);
+            return;
+        }
+        logger.debug("Rebooting {} for a boot group readiness retry attempt", vm);
+        try {
+            virtualMachineManager.reboot(vm.getUuid(), null);
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to reboot VM " + vm + " during boot group readiness retry: " + e.getMessage(), e);
+        }
+    }
+
+    private void sleep(long millis) {
+        try {
+            Thread.sleep(millis);
+        } catch (InterruptedException e) {
+            Thread.currentThread().interrupt();
+            throw new CloudRuntimeException("Interrupted while waiting for boot group tier readiness", e);
+        }
+    }
+
+    private long effectiveTimeoutSeconds(InstanceBootGroupVO group) {
+        String override = instanceBootGroupDetailsDao.getDetail(group.getId(), ReadinessAttemptTimeoutSeconds.key());
+        return override != null ? Long.parseLong(override) : ReadinessAttemptTimeoutSeconds.value();
+    }
+
+    private long effectiveMaxRetryAttempts(InstanceBootGroupVO group) {
+        String override = instanceBootGroupDetailsDao.getDetail(group.getId(), ReadinessMaxRetryAttempts.key());
+        return override != null ? Long.parseLong(override) : ReadinessMaxRetryAttempts.value();
+    }
+
+    private long effectivePollIntervalSeconds() {
+        return ReadinessPollIntervalSeconds.value();
+    }
+
+    private long effectiveReadinessCheckConcurrency() {
+        return ReadinessCheckConcurrency.value();
+    }
+
+    private long effectiveInitialDelaySeconds(InstanceBootGroupVO group) {
+        String override = instanceBootGroupDetailsDao.getDetail(group.getId(), ReadinessInitialDelaySeconds.key());
+        return override != null ? Long.parseLong(override) : ReadinessInitialDelaySeconds.value();
+    }
+
+    private boolean effectiveRebootOnRetry(InstanceBootGroupVO group) {
+        String override = instanceBootGroupDetailsDao.getDetail(group.getId(), ReadinessRebootOnRetry.key());
+        return override != null ? Boolean.parseBoolean(override) : ReadinessRebootOnRetry.value();
+    }
+
+    @Override
+    public void stopInstanceBootGroup(InstanceBootGroupVO group, boolean forced) {
+        List<InstanceBootGroupMemberVO> members = instanceBootGroupMemberDao.listByBootGroupId(group.getId());
+        Map<Integer, List<InstanceBootGroupMemberVO>> tiers = groupByOrderDescending(members);
+        logger.info("Stopping {}: {} tier(s), {} member(s) total, forced={}", group, tiers.size(), members.size(), forced);
+        long groupStoppedAtMs = System.currentTimeMillis();
+
+        for (Map.Entry<Integer, List<InstanceBootGroupMemberVO>> tier : tiers.entrySet()) {
+            List<Long> vmIds = resolveVmIds(tier.getValue());
+            runTierConcurrently(vmIds, group, "stop", vmId -> {
+                UserVmVO vm = userVmDao.findById(vmId);
+                if (vm != null && vm.getState() != com.cloud.vm.VirtualMachine.State.Stopped) {
+                    userVmService.stopVirtualMachine(vmId, forced);
+                }
+            }, false);
+        }
+
+        logger.info("{} stop completed ({}ms)", group, System.currentTimeMillis() - groupStoppedAtMs);
+    }
+
+    @Override
+    public void rebootInstanceBootGroup(InstanceBootGroupVO group, boolean forced) {
+        logger.info("Rebooting {}: stopping, then starting", group);
+        stopInstanceBootGroup(group, forced);
+        startInstanceBootGroup(group);
+    }
+
+    /**
+     * Runs {@code action} for every VM in a tier concurrently. Each thread gets a copied
+     * {@link CallContext} — without one, a VM lifecycle action routed through the job-queue path
+     * fails to submit its sub-job ("no lock found").
+     *
+     * @param haltOnFailure when true (start), the first per-VM failure aborts immediately so the
+     *                      caller can halt the whole boot group; when false (stop, which continues
+     *                      through every tier regardless per its own documented contract), every
+     *                      VM's action is still attempted and failures are logged, not thrown.
+     */
+    private void runTierConcurrently(List<Long> vmIds, InstanceBootGroupVO group,
+                                     String actionName, VmAction action, boolean haltOnFailure) {
+        if (vmIds.isEmpty()) {
+            return;
+        }
+
+        logger.debug("Running '{}' action for a tier of {}: {} VM id(s) {}",
+                actionName, group, vmIds.size(), vmIds);
+        long actionStartedAtMs = System.currentTimeMillis();
+        CallContext callerContext = CallContext.current();
+        int threadCount = Math.max(1, Math.min(vmIds.size(), ReadinessCheckConcurrency.value().intValue()));
+        ExecutorService executor = Executors.newFixedThreadPool(
+                threadCount, new NamedThreadFactory("InstanceBootGroup-" + actionName));
+
+        try {
+            List<Future<?>> futures = new ArrayList<>(vmIds.size());
+
+            for (Long vmId : vmIds) {
+                futures.add(executor.submit(new ManagedContextRunnable() {
+                    @Override
+                    protected void runInContext() {
+                        CallContext.register(callerContext, ApiCommandResourceType.VirtualMachine);
+                        CallContext.current().setEventResourceId(vmId);
+                        try {
+                            action.run(vmId);
+                        } catch (Exception e) {
+                            throw new CloudRuntimeException(String.format("Failed to %s VM %d", actionName, vmId), e);
+                        } finally {
+                            CallContext.unregister();
+                        }
+                    }
+                }));
+            }
+
+            List<String> failures = new ArrayList<>();
+            for (Future<?> future : futures) {
+                try {
+                    future.get();
+                } catch (ExecutionException e) {
+                    Throwable cause = e.getCause() != null ? e.getCause() : e;
+                    String message = String.format("Failed to %s a VM in boot group %s: %s",
+                            actionName, group.getName(), cause.getMessage());
+                    if (haltOnFailure) {
+                        throw new CloudRuntimeException(message, cause);
+                    }
+                    logger.warn(message, cause);
+                    failures.add(message);
+                } catch (InterruptedException e) {
+                    Thread.currentThread().interrupt();
+                    String message = String.format("Interrupted while waiting to %s VMs in boot group %s",
+                            actionName, group.getName());
+                    if (haltOnFailure) {
+                        throw new CloudRuntimeException(message, e);
+                    }
+                    logger.warn(message, e);
+                    failures.add(message);
+                }
+            }
+            if (!failures.isEmpty()) {
+                logger.warn("'{}' action for a tier of {} completed with {} failure(s) out of {} VM(s)",
+                        actionName, group, failures.size(), vmIds.size());
+            }
+        } finally {
+            executor.shutdown();
+        }
+
+        logger.debug(
+                "'{}' action for a tier of {} completed for {} VM(s) in {}ms",
+                actionName, group, vmIds.size(), System.currentTimeMillis() - actionStartedAtMs);
+    }
+
+    private Map<Integer, List<InstanceBootGroupMemberVO>> groupByOrder(List<InstanceBootGroupMemberVO> members) {
+        Map<Integer, List<InstanceBootGroupMemberVO>> tiers = new TreeMap<>();
+        for (InstanceBootGroupMemberVO m : members) {
+            tiers.computeIfAbsent(m.getBootOrder(), k -> new ArrayList<>()).add(m);
+        }
+        return tiers;
+    }
+
+    private Map<Integer, List<InstanceBootGroupMemberVO>> groupByOrderDescending(List<InstanceBootGroupMemberVO> members) {
+        Map<Integer, List<InstanceBootGroupMemberVO>> tiers = new TreeMap<>(Comparator.reverseOrder());
+        for (InstanceBootGroupMemberVO m : members) {
+            tiers.computeIfAbsent(m.getBootOrder(), k -> new ArrayList<>()).add(m);
+        }
+        return tiers;
+    }
+
+    private List<Long> resolveVmIds(List<InstanceBootGroupMemberVO> tierMembers) {
+        List<Long> vmIds = new ArrayList<>();
+        for (InstanceBootGroupMemberVO member : tierMembers) {
+            if (member.getMemberType() == InstanceBootGroupMember.MemberType.VirtualMachine) {
+                vmIds.add(member.getMemberId());
+            } else {
+                instanceGroupVMMapDao.listByGroupId(member.getMemberId())
+                        .forEach(map -> vmIds.add(map.getInstanceId()));
+            }
+        }
+        return vmIds;
+    }
+
+    @FunctionalInterface
+    private interface VmAction {
+        void run(long vmId) throws Exception;
+    }
+}
diff --git a/server/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupMembershipGuard.java b/server/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupMembershipGuard.java
new file mode 100644
index 000000000000..af3ae4752b96
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupMembershipGuard.java
@@ -0,0 +1,185 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup;
+
+import java.util.List;
+
+import javax.inject.Inject;
+
+import org.apache.commons.collections.CollectionUtils;
+import org.springframework.stereotype.Component;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.network.as.dao.AutoScaleVmGroupVmMapDao;
+import com.cloud.storage.Storage;
+import com.cloud.storage.VMTemplateVO;
+import com.cloud.storage.dao.VMTemplateDao;
+import com.cloud.vm.InstanceGroupVMMapVO;
+import com.cloud.vm.UserVmManager;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.dao.InstanceBootGroupMemberDao;
+import com.cloud.vm.dao.InstanceBootGroupReadinessRuleDao;
+import com.cloud.vm.dao.InstanceGroupVMMapDao;
+import com.cloud.vm.dao.UserVmDao;
+
+/**
+ * Eligibility guard shared by the two places a VM can end up governed by a boot group: joining a
+ * plain Instance Group ({@code UserVmManagerImpl.addInstanceToGroup}) and being added directly to a
+ * boot group ({@code InstanceBootGroupApiServiceImpl.addMemberToInstanceBootGroup}). Kept as its own
+ * leaf component (no dependency on UserVmService/UserVmManager) so UserVmManagerImpl can depend on it
+ * without a circular Spring bean dependency back through InstanceBootGroupApiServiceImpl/Manager,
+ * which themselves depend on UserVmService.
+ */
+@Component
+public class InstanceBootGroupMembershipGuard {
+
+    @Inject
+    private UserVmDao userVmDao;
+
+    @Inject
+    private VMTemplateDao templateDao;
+
+    @Inject
+    private AutoScaleVmGroupVmMapDao autoScaleVmGroupVmMapDao;
+
+    @Inject
+    private InstanceBootGroupMemberDao instanceBootGroupMemberDao;
+
+    @Inject
+    private InstanceGroupVMMapDao instanceGroupVMMapDao;
+
+    @Inject
+    private InstanceBootGroupReadinessRuleDao instanceBootGroupReadinessRuleDao;
+
+    /**
+     * Rejects a VM that is a VNF appliance, currently in any AutoScale VM group, or already an
+     * independent boot-group member. Used whenever a VM is being assigned to a group — a plain
+     * Instance Group ({@code UserVmManagerImpl.addInstanceToGroup}) or directly to a boot group
+     * ({@code InstanceBootGroupApiServiceImpl.addMemberToInstanceBootGroup}) — regardless of whether
+     * that assignment has anything to do with boot groups. Does NOT look at the VM's current Instance
+     * Group membership: a VM already governed by a boot group via its current group is free to move
+     * to an unrelated plain group (or be removed from its group) without issue, since boot group
+     * orchestration resolves a group's VMs dynamically rather than caching them. Callers that need to
+     * reject a VM becoming a DIRECT boot-group member while still indirectly governed via a group
+     * should additionally call {@link #validateVmNotIndirectlyBootGroupManaged(long)}.
+     */
+    public void validateVmEligibleForGroupMembership(long vmId) {
+        UserVmVO vm = userVmDao.findById(vmId);
+        if (vm == null) {
+            throw new InvalidParameterValueException("Unable to find a VM with ID: " + vmId);
+        }
+
+        VMTemplateVO template = templateDao.findByIdIncludingRemoved(vm.getTemplateId());
+        if (template != null && Storage.TemplateType.VNF.equals(template.getTemplateType())) {
+            throw new InvalidParameterValueException(String.format(
+                    "VM %s is a VNF appliance and cannot be added to an instance group or boot group", vm));
+        }
+
+        if (UserVmManager.CKS_NODE.equals(vm.getUserVmType())) {
+            throw new InvalidParameterValueException(String.format(
+                    "VM %s is a CKS cluster node and cannot be added to an instance group or boot group", vm));
+        }
+
+        if (CollectionUtils.isNotEmpty(autoScaleVmGroupVmMapDao.listByVm(vmId))) {
+            throw new InvalidParameterValueException(String.format(
+                    "VM %s is part of an AutoScale VM group and cannot be added to an instance group or boot group", vm));
+        }
+
+        if (instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.VirtualMachine, vmId) != null) {
+            throw new InvalidParameterValueException(String.format(
+                    "VM %s is already an independent member of an instance boot group", vm));
+        }
+    }
+
+    /**
+     * Rejects a VM that is currently in an Instance Group that is itself already a boot-group
+     * member — called in addition to {@link #validateVmEligibleForGroupMembership(long)} only where
+     * that indirect governance would actually conflict: becoming a second, direct boot-group member,
+     * or an Instance Group's own members being checked before that Instance Group itself becomes a
+     * boot-group member.
+     */
+    public void validateVmNotIndirectlyBootGroupManaged(long vmId) {
+        UserVmVO vm = userVmDao.findById(vmId);
+        if (vm == null) {
+            throw new InvalidParameterValueException("Unable to find a VM with ID: " + vmId);
+        }
+
+        for (InstanceGroupVMMapVO mapping : instanceGroupVMMapDao.listByInstanceId(vmId)) {
+            if (instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.InstanceGroup, mapping.getGroupId()) != null) {
+                throw new InvalidParameterValueException(String.format(
+                        "VM %s is currently in an instance group that is already a member of an instance boot group", vm));
+            }
+        }
+    }
+
+    /**
+     * Rejects destroying a VM that is a direct boot-group member, or that has its own readiness
+     * rule(s) registered in a boot group via an Instance Group it belongs to — either would
+     * otherwise leave boot-group configuration referencing a VM that no longer exists. Being in an
+     * Instance Group that is itself a boot-group member is NOT, on its own, a reason to block: boot
+     * group orchestration resolves an Instance Group's VMs dynamically (via
+     * {@code instanceGroupVMMapDao}) at start/stop time, so a VM leaving the group via destroy is no
+     * different from any other Instance Group membership change.
+     */
+    public void validateVmNotInBootGroup(UserVmVO vm) {
+        if (instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.VirtualMachine, vm.getId()) != null) {
+            throw new InvalidParameterValueException(String.format(
+                    "Instance %s is a member of an Instance Boot Group and cannot be destroyed; " +
+                            "remove it from the boot group first", vm.getDisplayName()));
+        }
+
+        for (InstanceGroupVMMapVO mapping : instanceGroupVMMapDao.listByInstanceId(vm.getId())) {
+            InstanceBootGroupMemberVO groupMember = instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.InstanceGroup, mapping.getGroupId());
+            if (groupMember == null) {
+                continue;
+            }
+            if (!instanceBootGroupReadinessRuleDao.listByItem(groupMember.getBootGroupId(), InstanceBootGroupMember.MemberType.VirtualMachine, vm.getId()).isEmpty()) {
+                throw new InvalidParameterValueException(String.format(
+                        "Instance %s has its own readiness rule(s) in an Instance Boot Group and cannot be destroyed; "
+                                + "remove the readiness rule(s) first", vm.getDisplayName()));
+            }
+        }
+    }
+
+    /**
+     * Rejects an Instance Group for boot-group membership if any VM currently in it fails
+     * {@link #validateVmEligibleForGroupMembership(long)} or is already indirectly governed by
+     * another boot group via some other Instance Group.
+     */
+    public void validateInstanceGroupEligibleForBootGroupMembership(long instanceGroupId) {
+        List<InstanceGroupVMMapVO> members = instanceGroupVMMapDao.listByGroupId(instanceGroupId);
+        for (InstanceGroupVMMapVO member : members) {
+            validateVmEligibleForGroupMembership(member.getInstanceId());
+            validateVmNotIndirectlyBootGroupManaged(member.getInstanceId());
+        }
+    }
+
+    /**
+     * Removes the boot-group membership row for an Instance Group being deleted, if any, so the
+     * delete doesn't leave a stale member pointing at a group that no longer exists. Cascades
+     * silently rather than blocking the delete, since {@code UserVmManagerImpl.deleteVmGroup} is
+     * also invoked during account cleanup, where a hard failure here would be worse than the group
+     * simply dropping out of its boot group.
+     */
+    public void removeInstanceGroupBootGroupMembershipIfPresent(long instanceGroupId) {
+        InstanceBootGroupMemberVO member = instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.InstanceGroup, instanceGroupId);
+        if (member != null) {
+            instanceBootGroupMemberDao.expunge(member.getId());
+        }
+    }
+}
diff --git a/server/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupVmStateListener.java b/server/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupVmStateListener.java
new file mode 100644
index 000000000000..c023a7dddad5
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupVmStateListener.java
@@ -0,0 +1,66 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup;
+
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRuleService;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import com.cloud.utils.fsm.StateListener;
+import com.cloud.utils.fsm.StateMachine2;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.VirtualMachine.Event;
+import com.cloud.vm.VirtualMachine.State;
+
+/**
+ * Invalidates a VM's cached boot-group readiness the moment it actually comes up from a cold start
+ * (Starting -&gt; Running only — not a live-migration landing in Running, nor a same-state
+ * confirmation self-transition), so a VM started outside boot group orchestration can't keep
+ * reporting a stale Ready left over from before it stopped. Deliberately does nothing on the way
+ * down to Stopped — {@code InstanceBootGroupReadinessRuleManagerImpl}'s own state-aware reads already
+ * make a stopped VM report NotReady regardless of cache, and leaving that cache row untouched is what
+ * lets {@code ignoreinstancestate} keep showing the last real check result for diagnosis.
+ */
+public class InstanceBootGroupVmStateListener implements StateListener<State, Event, VirtualMachine> {
+
+    protected Logger logger = LogManager.getLogger(getClass());
+
+    private final InstanceBootGroupReadinessRuleService instanceBootGroupReadinessRuleService;
+
+    public InstanceBootGroupVmStateListener(InstanceBootGroupReadinessRuleService instanceBootGroupReadinessRuleService) {
+        this.instanceBootGroupReadinessRuleService = instanceBootGroupReadinessRuleService;
+    }
+
+    @Override
+    public boolean preStateTransitionEvent(State oldState, Event event, State newState, VirtualMachine vo, boolean status, Object opaque) {
+        return true;
+    }
+
+    @Override
+    public boolean postStateTransitionEvent(StateMachine2.Transition<State, Event> transition, VirtualMachine vo, boolean status, Object opaque) {
+        if (!status || transition.getCurrentState() != State.Starting || transition.getToState() != State.Running) {
+            return true;
+        }
+        try {
+            instanceBootGroupReadinessRuleService.invalidateCachedReadinessOnRestart(vo.getId());
+        } catch (Exception e) {
+            logger.warn("Failed to invalidate instance boot group readiness cache for {} after it started", vo, e);
+        }
+        return true;
+    }
+}
diff --git a/server/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/GuestAgentLivenessChecker.java b/server/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/GuestAgentLivenessChecker.java
new file mode 100644
index 000000000000..c17f4b7a0255
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/GuestAgentLivenessChecker.java
@@ -0,0 +1,100 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup.readiness;
+
+import java.util.Map;
+
+import javax.inject.Inject;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.springframework.stereotype.Component;
+
+import com.cloud.agent.AgentManager;
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.CheckGuestAgentLivenessCommand;
+import com.cloud.hypervisor.Hypervisor.HypervisorType;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.dao.UserVmDao;
+
+/**
+ * GuestAgentLiveness: dispatched directly to the VM's hypervisor host rather than via the VR,
+ * asking libvirt to relay a qemu-guest-agent "guest-ping" over the VM's virtio-serial channel.
+ * Only supported on KVM, since that channel is a KVM/libvirt-specific mechanism.
+ */
+@Component
+public class GuestAgentLivenessChecker implements ReadinessChecker {
+    protected static Logger LOGGER = LogManager.getLogger(GuestAgentLivenessChecker.class);
+
+    @Inject
+    private UserVmDao userVmDao;
+
+    @Inject
+    private AgentManager agentManager;
+
+    @Override
+    public InstanceBootGroupReadinessRule.RuleType getRuleType() {
+        return InstanceBootGroupReadinessRule.RuleType.GuestAgentLiveness;
+    }
+
+    @Override
+    public Logger getLogger() {
+        return LOGGER;
+    }
+
+    @Override
+    public Result check(InstanceBootGroupReadinessRule rule, Map<String, String> details, long vmId, long remainingMs) {
+        UserVmVO vm = userVmDao.findById(vmId);
+        if (vm == null) {
+            return logAndReturn(rule, vmId, new Result(InstanceBootGroupReadinessRule.Status.Error, "Instance not found"));
+        }
+
+        LOGGER.debug("Checking guest agent liveness for {} due to rule {}", vm, rule);
+
+        if (vm.getHypervisorType() != HypervisorType.KVM) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error,
+                    "Guest agent liveness checks are only supported on KVM; Instance's hypervisor is " + vm.getHypervisorType()));
+        }
+        if (!VirtualMachine.State.Running.equals(vm.getState()) || vm.getHostId() == null) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.NotReady, "Instance is not running"));
+        }
+
+        if (remainingMs < MIN_REMAINING_MS_TO_DISPATCH) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error,
+                    "Insufficient time remaining in this attempt's budget (" + remainingMs + "ms) to dispatch a guest agent liveness check"));
+        }
+
+        CheckGuestAgentLivenessCommand command = new CheckGuestAgentLivenessCommand(vm.getInstanceName());
+        command.setWait(computeWaitSeconds(remainingMs));
+        LOGGER.debug("Dispatching guest agent liveness check for {} to host id {} with {}ms remaining budget", vm, vm.getHostId(), remainingMs);
+        Answer answer;
+        try {
+            answer = agentManager.easySend(vm.getHostId(), command);
+        } catch (Exception e) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error, "Failed to dispatch guest agent liveness check: " + e.getMessage()));
+        }
+        if (answer == null) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error, "No answer from the Instance's host"));
+        }
+        if (answer.getResult()) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Ready, "guest agent responded"));
+        }
+        return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.NotReady, "guest agent did not respond: " + answer.getDetails()));
+    }
+}
diff --git a/server/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceBootGroupReadinessRuleManagerImpl.java b/server/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceBootGroupReadinessRuleManagerImpl.java
new file mode 100644
index 000000000000..ed6c25f4db0c
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceBootGroupReadinessRuleManagerImpl.java
@@ -0,0 +1,624 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup.readiness;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Date;
+import java.util.EnumSet;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMember;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMemberVO;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupReadinessCheckResultVO;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupReadinessRuleVO;
+import org.apache.commons.collections.MapUtils;
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.stereotype.Component;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.hypervisor.Hypervisor.HypervisorType;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.db.Transaction;
+import com.cloud.utils.db.TransactionCallback;
+import com.cloud.vm.InstanceGroupVMMapVO;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.dao.InstanceBootGroupMemberDao;
+import com.cloud.vm.dao.InstanceBootGroupReadinessCheckResultDao;
+import com.cloud.vm.dao.InstanceBootGroupReadinessRuleDao;
+import com.cloud.vm.dao.InstanceBootGroupReadinessRuleDetailsDao;
+import com.cloud.vm.dao.InstanceGroupDao;
+import com.cloud.vm.dao.InstanceGroupVMMapDao;
+import com.cloud.vm.dao.UserVmDao;
+
+@Component
+public class InstanceBootGroupReadinessRuleManagerImpl extends ManagerBase implements InstanceBootGroupReadinessRuleService {
+
+    private static final String THRESHOLD_TYPE_KEY = "threshold_type";
+    private static final String THRESHOLD_VALUE_KEY = "threshold_value";
+    private static final String PORT_KEY = "port";
+    private static final String PROTOCOL_KEY = "protocol";
+
+    private static final Map<InstanceBootGroupMember.MemberType, Set<InstanceBootGroupReadinessRule.RuleType>> VALID_RULE_TYPES_BY_ITEM_TYPE = Map.of(
+            InstanceBootGroupMember.MemberType.VirtualMachine, EnumSet.of(
+                    InstanceBootGroupReadinessRule.RuleType.GuestAgentLiveness,
+                    InstanceBootGroupReadinessRule.RuleType.Ping,
+                    InstanceBootGroupReadinessRule.RuleType.PortCheck),
+            InstanceBootGroupMember.MemberType.InstanceGroup, EnumSet.of(
+                    InstanceBootGroupReadinessRule.RuleType.GuestAgentLiveness,
+                    InstanceBootGroupReadinessRule.RuleType.Ping,
+                    InstanceBootGroupReadinessRule.RuleType.PortCheck,
+                    InstanceBootGroupReadinessRule.RuleType.MemberQuorum));
+
+    /**
+     * Rule types an item may have at most one of — Ping/GuestAgentLiveness each check a single fixed
+     * target on the VM, and MemberQuorum aggregates the whole InstanceGroup, so a second one would
+     * just be redundant. PortCheck (different ports) is not a singleton.
+     */
+    private static final Set<InstanceBootGroupReadinessRule.RuleType> SINGLETON_RULE_TYPES = EnumSet.of(
+            InstanceBootGroupReadinessRule.RuleType.Ping,
+            InstanceBootGroupReadinessRule.RuleType.GuestAgentLiveness,
+            InstanceBootGroupReadinessRule.RuleType.MemberQuorum);
+
+    @Inject
+    private InstanceBootGroupReadinessRuleDao instanceBootGroupReadinessRuleDao;
+
+    @Inject
+    private InstanceBootGroupReadinessRuleDetailsDao instanceBootGroupReadinessRuleDetailsDao;
+
+    @Inject
+    private InstanceBootGroupReadinessCheckResultDao instanceBootGroupReadinessCheckResultDao;
+
+    @Inject
+    private InstanceBootGroupMemberDao instanceBootGroupMemberDao;
+
+    @Inject
+    private InstanceGroupVMMapDao instanceGroupVMMapDao;
+
+    @Inject
+    private InstanceGroupDao instanceGroupDao;
+
+    @Inject
+    private UserVmDao userVmDao;
+
+    private List<ReadinessChecker> readinessCheckers;
+
+    private Map<InstanceBootGroupReadinessRule.RuleType, ReadinessChecker> checkersByRuleType;
+
+    protected void updateCheckersByRuleType(boolean forced) {
+        if (MapUtils.isNotEmpty(checkersByRuleType) && !forced) {
+            return;
+        }
+        checkersByRuleType = new HashMap<>();
+        for (ReadinessChecker checker : readinessCheckers) {
+            checkersByRuleType.put(checker.getRuleType(), checker);
+        }
+    }
+
+    protected ReadinessChecker getCheckerByRuleType(InstanceBootGroupReadinessRule.RuleType ruleType) {
+        updateCheckersByRuleType(false);
+        return checkersByRuleType.get(ruleType);
+    }
+
+    public List<ReadinessChecker> getReadinessCheckers() {
+        return readinessCheckers;
+    }
+
+    public void setReadinessCheckers(List<ReadinessChecker> readinessCheckers) {
+        this.readinessCheckers = readinessCheckers;
+        updateCheckersByRuleType(true);
+    }
+
+    @Override
+    public InstanceBootGroupReadinessRule createReadinessRule(long bootGroupId, InstanceBootGroupMember.MemberType itemType, long itemId,
+            InstanceBootGroupReadinessRule.RuleType ruleType, String name, boolean enabled, Map<String, String> details) {
+        validateRuleTypeForItemType(itemType, ruleType);
+        validateItemBelongsToBootGroup(bootGroupId, itemType, itemId);
+        validateSingletonRuleType(bootGroupId, itemType, itemId, ruleType);
+        validateGuestAgentLivenessSupported(itemType, itemId, ruleType);
+        validateRuleTypeSpecificDetails(ruleType, details);
+
+        String effectiveName = StringUtils.isNotBlank(name) ? name : String.format("%s-%s-%d", ruleType.name(), itemType.name(), itemId);
+        InstanceBootGroupReadinessRuleVO rule = new InstanceBootGroupReadinessRuleVO(effectiveName, bootGroupId, itemType, itemId, ruleType, enabled);
+        rule = instanceBootGroupReadinessRuleDao.persist(rule);
+
+        if (details != null) {
+            for (Map.Entry<String, String> entry : details.entrySet()) {
+                instanceBootGroupReadinessRuleDetailsDao.addDetail(rule.getId(), entry.getKey(), entry.getValue(), true);
+            }
+        }
+        return rule;
+    }
+
+    @Override
+    public InstanceBootGroupReadinessRule updateReadinessRule(long ruleId, String name, Boolean enabled, Map<String, String> details) {
+        InstanceBootGroupReadinessRuleVO rule = instanceBootGroupReadinessRuleDao.findById(ruleId);
+        if (rule == null) {
+            throw new InvalidParameterValueException("Unable to find a readiness rule with ID: " + ruleId);
+        }
+
+        if (StringUtils.isNotBlank(name)) {
+            rule.setName(name);
+        }
+        if (enabled != null) {
+            rule.setEnabled(enabled);
+        }
+        if (details != null) {
+            Map<String, String> mergedDetails = new HashMap<>(instanceBootGroupReadinessRuleDetailsDao.getDetails(rule.getId()));
+            mergedDetails.putAll(details);
+            validateRuleTypeSpecificDetails(rule.getRuleType(), mergedDetails);
+        }
+        instanceBootGroupReadinessRuleDao.update(rule.getId(), rule);
+
+        if (details != null) {
+            for (Map.Entry<String, String> entry : details.entrySet()) {
+                instanceBootGroupReadinessRuleDetailsDao.addDetail(rule.getId(), entry.getKey(), entry.getValue(), true);
+            }
+        }
+        return instanceBootGroupReadinessRuleDao.findById(rule.getId());
+    }
+
+    @Override
+    public boolean deleteReadinessRule(long ruleId) {
+        InstanceBootGroupReadinessRuleVO rule = instanceBootGroupReadinessRuleDao.findById(ruleId);
+        if (rule == null) {
+            throw new InvalidParameterValueException("Unable to find a readiness rule with ID: " + ruleId);
+        }
+        return Transaction.execute((TransactionCallback<Boolean>) status -> {
+            instanceBootGroupReadinessRuleDetailsDao.removeDetails(rule.getId());
+            instanceBootGroupReadinessCheckResultDao.deleteByRuleId(rule.getId());
+            instanceBootGroupReadinessRuleDao.remove(rule.getId());
+            return true;
+        });
+    }
+
+    @Override
+    public InstanceBootGroupReadinessRule findById(long ruleId) {
+        return instanceBootGroupReadinessRuleDao.findById(ruleId);
+    }
+
+    @Override
+    public Map<String, String> getRuleDetails(long ruleId) {
+        return instanceBootGroupReadinessRuleDetailsDao.getDetails(ruleId);
+    }
+
+    @Override
+    public InstanceBootGroupReadinessRule.Status evaluateVmReadiness(long bootGroupId, long vmId, long remainingMs, String attemptLabel) {
+        return resolveVmReadiness(bootGroupId, vmId, true, remainingMs, attemptLabel);
+    }
+
+    /**
+     * Same aggregation as {@link #evaluateVmReadiness}, but reads each rule's last-cached result
+     * instead of dispatching a fresh check — for callers that run after the per-VM loop has already
+     * dispatched this poll, so a live re-check would just repeat the same remote command.
+     */
+    private InstanceBootGroupReadinessRule.Status getCachedVmReadiness(long bootGroupId, long vmId) {
+        return resolveVmReadiness(bootGroupId, vmId, false, Long.MAX_VALUE, null);
+    }
+
+    /**
+     * Shared by the dispatching and cache-reading paths. A non-Running VM is always NotReady regardless
+     * of any cached rule result. Direct rules cache at vmId 0, inherited group rules per member vmId;
+     * when dispatching, the remaining budget shrinks across a VM's rules so N slow rules can't each burn
+     * the full per-attempt timeout.
+     */
+    private InstanceBootGroupReadinessRule.Status resolveVmReadiness(long bootGroupId, long vmId, boolean dispatch, long remainingMs, String attemptLabel) {
+        UserVmVO vm = userVmDao.findById(vmId);
+        if (vm == null) {
+            logger.debug("VM id {} not found while evaluating readiness for boot group id {}; treating as NotReady", vmId, bootGroupId);
+            return InstanceBootGroupReadinessRule.Status.NotReady;
+        }
+        if (!VirtualMachine.State.Running.equals(vm.getState())) {
+            logger.debug("{} is not Running (state={}) for boot group id {}; treating as NotReady without evaluating or dispatching its readiness rules", vm, vm.getState(), bootGroupId);
+            return InstanceBootGroupReadinessRule.Status.NotReady;
+        }
+        List<InstanceBootGroupReadinessRuleVO> directRules = instanceBootGroupReadinessRuleDao.listEnabledByItem(bootGroupId, InstanceBootGroupMember.MemberType.VirtualMachine, vmId);
+        List<InstanceBootGroupReadinessRuleVO> inheritedRules = findInheritedGroupRuleVOs(bootGroupId, vmId);
+
+        if (directRules.isEmpty() && inheritedRules.isEmpty()) {
+            logger.debug("{} has no readiness rules for boot group id {}; derived readiness Ready from its current state ({})", vm, bootGroupId, vm.getState());
+            return InstanceBootGroupReadinessRule.Status.Ready;
+        }
+
+        if (dispatch) {
+            logger.debug("Evaluating readiness of {} for boot group id {}: {} direct rule(s), {} inherited rule(s), {}ms remaining budget",
+                    vm, bootGroupId, directRules.size(), inheritedRules.size(), remainingMs);
+        }
+
+        boolean anyError = false;
+        boolean anyNotReady = false;
+        long remainingBudgetMs = remainingMs;
+        for (InstanceBootGroupReadinessRuleVO rule : directRules) {
+            long startedAtMs = System.currentTimeMillis();
+            InstanceBootGroupReadinessRule.Status status = dispatch ? evaluateAndCacheRule(rule, vmId, 0, remainingBudgetMs, attemptLabel) : readCachedRuleStatus(rule.getId(), 0);
+            if (dispatch) {
+                remainingBudgetMs = Math.max(0, remainingBudgetMs - (System.currentTimeMillis() - startedAtMs));
+            }
+            if (status == InstanceBootGroupReadinessRule.Status.Error) {
+                anyError = true;
+            } else if (status != InstanceBootGroupReadinessRule.Status.Ready) {
+                anyNotReady = true;
+            }
+        }
+        for (InstanceBootGroupReadinessRuleVO rule : inheritedRules) {
+            long startedAtMs = System.currentTimeMillis();
+            InstanceBootGroupReadinessRule.Status status = dispatch ? evaluateAndCacheRule(rule, vmId, vmId, remainingBudgetMs, attemptLabel) : readCachedRuleStatus(rule.getId(), vmId);
+            if (dispatch) {
+                remainingBudgetMs = Math.max(0, remainingBudgetMs - (System.currentTimeMillis() - startedAtMs));
+            }
+            if (status == InstanceBootGroupReadinessRule.Status.Error) {
+                anyError = true;
+            } else if (status != InstanceBootGroupReadinessRule.Status.Ready) {
+                anyNotReady = true;
+            }
+        }
+
+        InstanceBootGroupReadinessRule.Status overallStatus = anyError ? InstanceBootGroupReadinessRule.Status.Error
+                : (anyNotReady ? InstanceBootGroupReadinessRule.Status.NotReady : InstanceBootGroupReadinessRule.Status.Ready);
+        if (dispatch) {
+            logger.debug("{} readiness for boot group id {} evaluated as {}", vm, bootGroupId, overallStatus);
+        }
+        return overallStatus;
+    }
+
+    private InstanceBootGroupReadinessRule.Status readCachedRuleStatus(long ruleId, long cacheVmId) {
+        InstanceBootGroupReadinessCheckResultVO cached = instanceBootGroupReadinessCheckResultDao.findByRuleAndVm(ruleId, cacheVmId);
+        return (cached != null && cached.getStatus() != null) ? cached.getStatus() : InstanceBootGroupReadinessRule.Status.Unknown;
+    }
+
+    /**
+     * Dispatches (or, for a missing checker, synthesizes) one rule's check and persists the result —
+     * the single place a check actually happens, so every caller shares this one log/cache path.
+     * @param attemptLabel e.g. {@code "2/5"}, appended to the persisted message; pass {@code null} to skip.
+     */
+    private InstanceBootGroupReadinessRule.Status evaluateAndCacheRule(InstanceBootGroupReadinessRuleVO rule, long vmId, long cacheVmId, long remainingMs, String attemptLabel) {
+        logger.debug("Evaluating rule {} against VM id {} with {}ms remaining budget", () -> rule, () -> userVmDao.findById(vmId), () -> remainingMs);
+        ReadinessChecker checker = getCheckerByRuleType(rule.getRuleType());
+        InstanceBootGroupReadinessRule.Status status;
+        String message;
+        if (checker == null) {
+            status = InstanceBootGroupReadinessRule.Status.Error;
+            message = "No checker implemented yet for rule type " + rule.getRuleType();
+        } else {
+            Map<String, String> details = instanceBootGroupReadinessRuleDetailsDao.getDetails(rule.getId());
+            ReadinessChecker.Result result = checker.check(rule, details, vmId, remainingMs);
+            status = result.getStatus();
+            message = result.getMessage();
+        }
+        String finalMessage = StringUtils.isNotBlank(attemptLabel) ? message + " (attempt " + attemptLabel + ")" : message;
+        logger.debug("Rule {} evaluated against VM id {}: status={}, message={}", () -> rule, () -> userVmDao.findById(vmId), () -> status, () -> finalMessage);
+        instanceBootGroupReadinessCheckResultDao.upsert(rule.getId(), cacheVmId, status, finalMessage, new Date());
+        return status;
+    }
+
+    @Override
+    public List<InstanceBootGroupReadinessRule> findInheritedGroupRules(long bootGroupId, long vmId) {
+        return new ArrayList<>(findInheritedGroupRuleVOs(bootGroupId, vmId));
+    }
+
+    /**
+     * Resets a VM's own cached rule results (direct and inherited) to Unknown when it starts, so a
+     * VM restarted outside boot group orchestration can't keep reporting a stale Ready from before
+     * it stopped. A no-op for a VM with no boot-group involvement at all.
+     */
+    @Override
+    public void invalidateCachedReadinessOnRestart(long vmId) {
+        InstanceBootGroupMemberVO directMember = instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.VirtualMachine, vmId);
+        if (directMember != null) {
+            invalidateRuleResults(instanceBootGroupReadinessRuleDao.listEnabledByItem(directMember.getBootGroupId(), InstanceBootGroupMember.MemberType.VirtualMachine, vmId), 0L);
+        }
+        for (InstanceGroupVMMapVO mapping : instanceGroupVMMapDao.listByInstanceId(vmId)) {
+            InstanceBootGroupMemberVO groupMember = instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.InstanceGroup, mapping.getGroupId());
+            if (groupMember == null) {
+                continue;
+            }
+            List<InstanceBootGroupReadinessRuleVO> memberTargetedRules = instanceBootGroupReadinessRuleDao.listEnabledByItem(groupMember.getBootGroupId(),
+                    InstanceBootGroupMember.MemberType.InstanceGroup, mapping.getGroupId()).stream()
+                    .filter(rule -> rule.getRuleType().isMemberTargeted())
+                    .collect(Collectors.toList());
+            invalidateRuleResults(memberTargetedRules, vmId);
+        }
+    }
+
+    private void invalidateRuleResults(List<InstanceBootGroupReadinessRuleVO> rules, long cacheVmId) {
+        for (InstanceBootGroupReadinessRuleVO rule : rules) {
+            instanceBootGroupReadinessCheckResultDao.upsert(rule.getId(), cacheVmId, InstanceBootGroupReadinessRule.Status.Unknown,
+                    "Instance (re)started; not yet re-verified this session", new Date());
+        }
+    }
+
+    /**
+     * A VM inherits its owning InstanceGroup's Ping/PortCheck/GuestAgentLiveness rules (not
+     * MemberQuorum/CustomScript, which only ever make sense at group scope) — resolved by finding
+     * the InstanceGroup, among any this VM belongs to, that is itself a member of this boot group.
+     */
+    private List<InstanceBootGroupReadinessRuleVO> findInheritedGroupRuleVOs(long bootGroupId, long vmId) {
+        for (InstanceGroupVMMapVO mapping : instanceGroupVMMapDao.listByInstanceId(vmId)) {
+            InstanceBootGroupMemberVO groupMember = instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.InstanceGroup, mapping.getGroupId());
+            if (groupMember != null && groupMember.getBootGroupId() == bootGroupId) {
+                return instanceBootGroupReadinessRuleDao.listEnabledByItem(bootGroupId, InstanceBootGroupMember.MemberType.InstanceGroup, mapping.getGroupId()).stream()
+                        .filter(rule -> rule.getRuleType().isMemberTargeted())
+                        .collect(Collectors.toList());
+            }
+        }
+        return Collections.emptyList();
+    }
+
+    /**
+     * AND of the group's own rules and every member's cached readiness (read-only — the per-VM loop
+     * already dispatched this poll). A MemberQuorum rule's own tolerance-aware verdict decides
+     * Ready/Error on its own; without one, a member still mid-retry only counts as NotReady, never Error.
+     * Once a MemberQuorum rule governs the group, every other member-targeted rule's own all-members
+     * aggregate becomes informational only — it's still evaluated and shown, but no longer gates the
+     * overall verdict, since that's exactly what attaching a quorum rule is meant to relax.
+     */
+    @Override
+    public InstanceBootGroupReadinessRule.Status evaluateInstanceGroupReadiness(long bootGroupId, long instanceGroupId, Set<Long> permanentlyFailedVmIds) {
+        List<InstanceBootGroupReadinessRuleVO> groupRules = instanceBootGroupReadinessRuleDao.listEnabledByItem(bootGroupId, InstanceBootGroupMember.MemberType.InstanceGroup, instanceGroupId);
+        List<InstanceGroupVMMapVO> members = instanceGroupVMMapDao.listByGroupId(instanceGroupId);
+        boolean hasMemberQuorumRule = groupRules.stream().anyMatch(rule -> rule.getRuleType() == InstanceBootGroupReadinessRule.RuleType.MemberQuorum);
+
+        logger.debug("Evaluating readiness of instance group id {} for boot group id {}: {} member VM(s), {} own rule(s), quorum-governed={}",
+                () -> instanceGroupDao.findById(instanceGroupId), () -> bootGroupId, () -> members.size(), () -> groupRules.size(), () -> hasMemberQuorumRule);
+
+        boolean anyError = false;
+        boolean anyNotReady = false;
+
+        for (InstanceGroupVMMapVO member : members) {
+            InstanceBootGroupReadinessRule.Status vmStatus = getCachedVmReadiness(bootGroupId, member.getInstanceId());
+            if (hasMemberQuorumRule || vmStatus == InstanceBootGroupReadinessRule.Status.Ready) {
+                continue;
+            }
+            if (permanentlyFailedVmIds.contains(member.getInstanceId())) {
+                anyError = true;
+            } else {
+                anyNotReady = true;
+            }
+        }
+
+        for (InstanceBootGroupReadinessRuleVO rule : groupRules) {
+            ReadinessChecker.Result result;
+            boolean memberTargeted = rule.getRuleType().isMemberTargeted();
+            if (rule.getRuleType() == InstanceBootGroupReadinessRule.RuleType.MemberQuorum) {
+                logger.debug("Evaluating group-scoped rule {} for instance group id {} via member quorum", rule, instanceGroupId);
+                Map<String, String> details = instanceBootGroupReadinessRuleDetailsDao.getDetails(rule.getId());
+                result = evaluateInstanceQuorum(bootGroupId, instanceGroupId, details, permanentlyFailedVmIds);
+            } else if (memberTargeted) {
+                logger.debug("Evaluating group-scoped rule {} for instance group id {} by aggregating its {} member(s)' own cached results", rule, instanceGroupId, members.size());
+                result = aggregateMemberTargetedGroupRule(rule, members);
+            } else {
+                result = new ReadinessChecker.Result(InstanceBootGroupReadinessRule.Status.Error,
+                        "No evaluator implemented yet for rule type " + rule.getRuleType());
+            }
+            logger.debug("Group-scoped rule {} evaluated for instance group id {}: status={}, message={}", rule, instanceGroupId, result.getStatus(), result.getMessage());
+            instanceBootGroupReadinessCheckResultDao.upsert(rule.getId(), 0, result.getStatus(), result.getMessage(), new Date());
+
+            if (memberTargeted && hasMemberQuorumRule) {
+                continue;
+            }
+            if (result.getStatus() == InstanceBootGroupReadinessRule.Status.Error) {
+                anyError = true;
+            } else if (result.getStatus() != InstanceBootGroupReadinessRule.Status.Ready) {
+                anyNotReady = true;
+            }
+        }
+
+        InstanceBootGroupReadinessRule.Status overallStatus = anyError ? InstanceBootGroupReadinessRule.Status.Error
+                : (anyNotReady ? InstanceBootGroupReadinessRule.Status.NotReady : InstanceBootGroupReadinessRule.Status.Ready);
+        logger.debug("Instance group id {} readiness for boot group id {} evaluated as {}", instanceGroupId, bootGroupId, overallStatus);
+        return overallStatus;
+    }
+
+    /**
+     * Reads the per-member cached results {@link #evaluateVmReadiness} already wrote for this rule,
+     * rather than dispatching it again.
+     */
+    private ReadinessChecker.Result aggregateMemberTargetedGroupRule(InstanceBootGroupReadinessRuleVO rule, List<InstanceGroupVMMapVO> members) {
+        if (members.isEmpty()) {
+            return new ReadinessChecker.Result(InstanceBootGroupReadinessRule.Status.NotReady, "Instance group has no members");
+        }
+        boolean anyError = false;
+        int readyCount = 0;
+        for (InstanceGroupVMMapVO member : members) {
+            InstanceBootGroupReadinessCheckResultVO cached = instanceBootGroupReadinessCheckResultDao.findByRuleAndVm(rule.getId(), member.getInstanceId());
+            InstanceBootGroupReadinessRule.Status status = (cached != null && cached.getStatus() != null) ? cached.getStatus() : InstanceBootGroupReadinessRule.Status.Unknown;
+            if (status == InstanceBootGroupReadinessRule.Status.Ready) {
+                readyCount++;
+            } else if (status == InstanceBootGroupReadinessRule.Status.Error) {
+                anyError = true;
+            }
+        }
+        int total = members.size();
+        String message = String.format("%d of %d member(s) ready via %s", readyCount, total, rule.getRuleType().name());
+        if (anyError) {
+            return new ReadinessChecker.Result(InstanceBootGroupReadinessRule.Status.Error, message);
+        }
+        return new ReadinessChecker.Result(readyCount == total ? InstanceBootGroupReadinessRule.Status.Ready : InstanceBootGroupReadinessRule.Status.NotReady, message);
+    }
+
+    /**
+     * Pure computation, no dispatch: counts members currently READY against the configured threshold.
+     * @param permanentlyFailedVmIds excluded from "achievable" so a hopeless quorum reports Error
+     *        instead of NotReady once it can never be met, even with every remaining member succeeding.
+     */
+    private ReadinessChecker.Result evaluateInstanceQuorum(long bootGroupId, long instanceGroupId, Map<String, String> details, Set<Long> permanentlyFailedVmIds) {
+        List<InstanceGroupVMMapVO> members = instanceGroupVMMapDao.listByGroupId(instanceGroupId);
+        int total = members.size();
+        if (total == 0) {
+            return new ReadinessChecker.Result(InstanceBootGroupReadinessRule.Status.NotReady, "Instance group has no members");
+        }
+
+        long readyCount = members.stream()
+                .filter(member -> getCachedVmReadiness(bootGroupId, member.getInstanceId()) == InstanceBootGroupReadinessRule.Status.Ready)
+                .count();
+        long permanentlyFailedCount = members.stream()
+                .filter(member -> permanentlyFailedVmIds.contains(member.getInstanceId()))
+                .count();
+        long achievableCount = total - permanentlyFailedCount;
+
+        String thresholdType = details == null ? null : details.get(THRESHOLD_TYPE_KEY);
+        String thresholdValue = details == null ? null : details.get(THRESHOLD_VALUE_KEY);
+
+        boolean met;
+        boolean achievable;
+        try {
+            if ("PERCENTAGE".equalsIgnoreCase(thresholdType)) {
+                double thresholdPercentage = Double.parseDouble(thresholdValue);
+                met = (readyCount * 100.0 / total) >= thresholdPercentage;
+                achievable = (achievableCount * 100.0 / total) >= thresholdPercentage;
+            } else {
+                long thresholdCount = Long.parseLong(thresholdValue);
+                met = readyCount >= thresholdCount;
+                achievable = achievableCount >= thresholdCount;
+            }
+        } catch (NumberFormatException e) {
+            return new ReadinessChecker.Result(InstanceBootGroupReadinessRule.Status.Error, "Invalid threshold configuration: " + thresholdType + "=" + thresholdValue);
+        }
+
+        String message = String.format("%d/%d members ready (%s threshold %s)", readyCount, total, thresholdType, thresholdValue);
+        if (!met && !achievable) {
+            String reason = String.format("%s; unreachable — %d/%d member(s) have permanently failed readiness", message, permanentlyFailedCount, total);
+            logger.debug("Instance group id {} quorum check: {}", instanceGroupId, reason);
+            return new ReadinessChecker.Result(InstanceBootGroupReadinessRule.Status.Error, reason);
+        }
+        logger.debug("Instance group id {} quorum check: {}, met={}", instanceGroupId, message, met);
+        return new ReadinessChecker.Result(met ? InstanceBootGroupReadinessRule.Status.Ready : InstanceBootGroupReadinessRule.Status.NotReady, message);
+    }
+
+    private void validateRuleTypeSpecificDetails(InstanceBootGroupReadinessRule.RuleType ruleType, Map<String, String> details) {
+        if (ruleType == InstanceBootGroupReadinessRule.RuleType.MemberQuorum) {
+            validateInstanceQuorumDetails(details);
+        } else if (ruleType == InstanceBootGroupReadinessRule.RuleType.PortCheck) {
+            validatePortCheckDetails(details);
+        }
+    }
+
+    private void validateInstanceQuorumDetails(Map<String, String> details) {
+        String thresholdType = details == null ? null : details.get(THRESHOLD_TYPE_KEY);
+        String thresholdValue = details == null ? null : details.get(THRESHOLD_VALUE_KEY);
+        if (StringUtils.isBlank(thresholdType) || StringUtils.isBlank(thresholdValue)) {
+            throw new InvalidParameterValueException(String.format("%s rules require '%s' (COUNT or PERCENTAGE) and '%s' details", InstanceBootGroupReadinessRule.RuleType.MemberQuorum.name(), THRESHOLD_TYPE_KEY, THRESHOLD_VALUE_KEY));
+        }
+        if (!"COUNT".equalsIgnoreCase(thresholdType) && !"PERCENTAGE".equalsIgnoreCase(thresholdType)) {
+            throw new InvalidParameterValueException(THRESHOLD_TYPE_KEY + " must be COUNT or PERCENTAGE");
+        }
+        try {
+            if ("PERCENTAGE".equalsIgnoreCase(thresholdType)) {
+                double percentage = Double.parseDouble(thresholdValue);
+                if (percentage < 0) {
+                    throw new InvalidParameterValueException(THRESHOLD_VALUE_KEY + " must not be negative: " + thresholdValue);
+                }
+            } else {
+                long count = Long.parseLong(thresholdValue);
+                if (count < 0) {
+                    throw new InvalidParameterValueException(THRESHOLD_VALUE_KEY + " must not be negative: " + thresholdValue);
+                }
+            }
+        } catch (NumberFormatException e) {
+            throw new InvalidParameterValueException("Invalid " + THRESHOLD_VALUE_KEY + ": " + thresholdValue);
+        }
+    }
+
+    private void validatePortCheckDetails(Map<String, String> details) {
+        String protocol = details == null ? null : details.get(PROTOCOL_KEY);
+        if (StringUtils.isNotBlank(protocol) && !"tcp".equalsIgnoreCase(protocol)) {
+            throw new InvalidParameterValueException(InstanceBootGroupReadinessRule.RuleType.PortCheck.name() + " rules only support the tcp protocol currently");
+        }
+        String port = details == null ? null : details.get(PORT_KEY);
+        if (StringUtils.isBlank(port)) {
+            throw new InvalidParameterValueException(InstanceBootGroupReadinessRule.RuleType.PortCheck.name() + " rules require a '" + PORT_KEY + "' detail");
+        }
+        try {
+            int portValue = Integer.parseInt(port);
+            if (portValue < 1 || portValue > 65535) {
+                throw new NumberFormatException();
+            }
+        } catch (NumberFormatException e) {
+            throw new InvalidParameterValueException("Invalid " + PORT_KEY + ": " + port);
+        }
+    }
+
+    private void validateSingletonRuleType(long bootGroupId, InstanceBootGroupMember.MemberType itemType, long itemId, InstanceBootGroupReadinessRule.RuleType ruleType) {
+        if (!SINGLETON_RULE_TYPES.contains(ruleType)) {
+            return;
+        }
+        boolean alreadyExists = instanceBootGroupReadinessRuleDao.listByItem(bootGroupId, itemType, itemId).stream()
+                .anyMatch(rule -> rule.getRuleType() == ruleType);
+        if (alreadyExists) {
+            throw new InvalidParameterValueException(String.format("A %s rule already exists for this %s", ruleType.name(), itemType.name()));
+        }
+    }
+
+    /**
+     * GuestAgentLiveness is KVM/libvirt-specific — reject it up front on other hypervisors. Only
+     * checked for a direct VM-scoped rule; a group-scoped rule can't be validated once at creation
+     * since membership is dynamic, so a non-KVM member just evaluates to Error per-member instead.
+     */
+    private void validateGuestAgentLivenessSupported(InstanceBootGroupMember.MemberType itemType, long vmId, InstanceBootGroupReadinessRule.RuleType ruleType) {
+        if (ruleType != InstanceBootGroupReadinessRule.RuleType.GuestAgentLiveness || itemType != InstanceBootGroupMember.MemberType.VirtualMachine) {
+            return;
+        }
+        UserVmVO vm = userVmDao.findById(vmId);
+        if (vm == null) {
+            throw new InvalidParameterValueException("Unable to find an Instance with ID: " + vmId);
+        }
+        if (vm.getHypervisorType() != HypervisorType.KVM) {
+            throw new InvalidParameterValueException(String.format(
+                    "%s rules are only supported on KVM Instances; this Instance's hypervisor is %s", ruleType.name(), vm.getHypervisorType()));
+        }
+    }
+
+    private void validateRuleTypeForItemType(InstanceBootGroupMember.MemberType itemType, InstanceBootGroupReadinessRule.RuleType ruleType) {
+        if (!VALID_RULE_TYPES_BY_ITEM_TYPE.getOrDefault(itemType, Collections.emptySet()).contains(ruleType)) {
+            throw new InvalidParameterValueException(String.format("Rule type %s is not valid for item type %s", ruleType, itemType));
+        }
+    }
+
+    private void validateItemBelongsToBootGroup(long bootGroupId, InstanceBootGroupMember.MemberType itemType, long itemId) {
+        if (itemType == InstanceBootGroupMember.MemberType.InstanceGroup) {
+            InstanceBootGroupMemberVO member = instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.InstanceGroup, itemId);
+            if (member == null || member.getBootGroupId() != bootGroupId) {
+                throw new InvalidParameterValueException(String.format("Instance group %d is not a member of boot group %d", itemId, bootGroupId));
+            }
+            return;
+        }
+
+        InstanceBootGroupMemberVO directMember = instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.VirtualMachine, itemId);
+        if (directMember != null && directMember.getBootGroupId() == bootGroupId) {
+            return;
+        }
+
+        List<InstanceGroupVMMapVO> mappings = instanceGroupVMMapDao.listByInstanceId(itemId);
+        for (InstanceGroupVMMapVO mapping : mappings) {
+            InstanceBootGroupMemberVO groupMember = instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.InstanceGroup, mapping.getGroupId());
+            if (groupMember != null && groupMember.getBootGroupId() == bootGroupId) {
+                return;
+            }
+        }
+
+        throw new InvalidParameterValueException(String.format(
+                "VM %d is not part of boot group %d, neither directly nor via its instance group", itemId, bootGroupId));
+    }
+}
diff --git a/server/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceBootGroupReadinessRuleService.java b/server/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceBootGroupReadinessRuleService.java
new file mode 100644
index 000000000000..8314b9a7eb1e
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceBootGroupReadinessRuleService.java
@@ -0,0 +1,75 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup.readiness;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMember;
+
+/**
+ * Backend counterpart consumed by {@code InstanceBootGroupApiServiceImpl} for mutating readiness-rule
+ * operations and evaluation. Listing goes straight through the DAO from the API layer, same as
+ * {@code InstanceBootGroupMember} listing does — this interface only covers create/update/delete and
+ * evaluation, which need the domain validation in {@code InstanceBootGroupReadinessRuleManagerImpl}.
+ */
+public interface InstanceBootGroupReadinessRuleService {
+
+    InstanceBootGroupReadinessRule createReadinessRule(long bootGroupId, InstanceBootGroupMember.MemberType itemType, long itemId,
+                                                       InstanceBootGroupReadinessRule.RuleType ruleType, String name, boolean enabled, Map<String, String> details);
+
+    InstanceBootGroupReadinessRule updateReadinessRule(long ruleId, String name, Boolean enabled, Map<String, String> details);
+
+    boolean deleteReadinessRule(long ruleId);
+
+    InstanceBootGroupReadinessRule findById(long ruleId);
+
+    Map<String, String> getRuleDetails(long ruleId);
+
+    /**
+     * AND across all enabled rules for this VM within the boot group; Ready if none are attached
+     * and the VM is Running.
+     * @param remainingMs dispatch time budget left for this VM's current attempt; pass a generous
+     *        value (e.g. {@code Long.MAX_VALUE}) outside budget-tracking contexts.
+     * @param attemptLabel appended to each persisted rule message (e.g. {@code "2/5"}); pass
+     *        {@code null} to skip.
+     */
+    InstanceBootGroupReadinessRule.Status evaluateVmReadiness(long bootGroupId, long vmId, long remainingMs, String attemptLabel);
+
+    /**
+     * AND of the group's own enabled rules (e.g. MemberQuorum) and every member VM's own readiness.
+     * @param permanentlyFailedVmIds members the caller has given up retrying — lets a MemberQuorum
+     *        rule distinguish "not met yet" from "mathematically impossible"; pass an empty set
+     *        outside that orchestration context.
+     */
+    InstanceBootGroupReadinessRule.Status evaluateInstanceGroupReadiness(long bootGroupId, long instanceGroupId, Set<Long> permanentlyFailedVmIds);
+
+    /**
+     * The Ping/PortCheck/GuestAgentLiveness rules {@code vmId} inherits from its owning
+     * InstanceGroup, if any — empty if none apply.
+     */
+    List<InstanceBootGroupReadinessRule> findInheritedGroupRules(long bootGroupId, long vmId);
+
+    /**
+     * Resets {@code vmId}'s own cached rule results (direct and inherited) to Unknown — called when
+     * the VM starts, so a restart outside boot group orchestration can't keep reporting a stale Ready
+     * from before it stopped. A no-op if the VM has no boot-group involvement.
+     */
+    void invalidateCachedReadinessOnRestart(long vmId);
+}
diff --git a/server/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/PortCheckChecker.java b/server/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/PortCheckChecker.java
new file mode 100644
index 000000000000..ddedcec9ccd5
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/PortCheckChecker.java
@@ -0,0 +1,168 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup.readiness;
+
+import java.util.List;
+import java.util.Map;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.engine.orchestration.service.NetworkOrchestrationService;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.springframework.stereotype.Component;
+
+import com.cloud.agent.AgentManager;
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.routing.NetworkElementCommand;
+import com.cloud.network.Network;
+import com.cloud.network.dao.NetworkDao;
+import com.cloud.network.dao.NetworkVO;
+import com.cloud.network.router.VirtualRouter;
+import com.cloud.network.router.VpcVirtualNetworkApplianceManager;
+import com.cloud.vm.NicVO;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.VirtualMachineManager;
+import com.cloud.vm.dao.NicDao;
+import com.cloud.vm.dao.UserVmDao;
+
+/**
+ * PortCheck: dispatches a dedicated {@link InstanceReadinessCheckCommand} to the VR of
+ * the VM's default network (same transport {@link VrPingChecker} uses), asking it to attempt a TCP
+ * connect to the VM's default IP on the configured port. Only TCP is currently supported.
+ */
+@Component
+public class PortCheckChecker implements ReadinessChecker {
+    protected static Logger LOGGER = LogManager.getLogger(PortCheckChecker.class);
+
+    private static final String PORT_KEY = "port";
+    private static final String PROTOCOL_KEY = "protocol";
+
+    @Inject
+    private UserVmDao userVmDao;
+
+    @Inject
+    private NicDao nicDao;
+
+    @Inject
+    private NetworkDao networkDao;
+
+    // VirtualNetworkApplianceManager itself is ambiguous (VirtualNetworkApplianceManagerImpl and
+    // VpcVirtualNetworkApplianceManagerImpl both implement it) — inject the more specific
+    // sub-interface, matching the convention used by VirtualRouterElement/VpcVirtualRouterElement.
+    @Inject
+    private VpcVirtualNetworkApplianceManager virtualNetworkApplianceManager;
+
+    @Inject
+    private VirtualMachineManager virtualMachineManager;
+
+    @Inject
+    private NetworkOrchestrationService networkOrchestrationService;
+
+    @Inject
+    private AgentManager agentManager;
+
+    @Override
+    public InstanceBootGroupReadinessRule.RuleType getRuleType() {
+        return InstanceBootGroupReadinessRule.RuleType.PortCheck;
+    }
+
+    @Override
+    public Logger getLogger() {
+        return LOGGER;
+    }
+
+    @Override
+    public Result check(InstanceBootGroupReadinessRule rule, Map<String, String> details, long vmId, long remainingMs) {
+        UserVmVO vm = userVmDao.findById(vmId);
+        if (vm == null) {
+            return logAndReturn(rule, vmId, new Result(InstanceBootGroupReadinessRule.Status.Error, "VM not found"));
+        }
+
+        LOGGER.debug("Checking port readiness for {} due to rule {}", vm, rule);
+
+        String protocol = details == null ? null : details.get(PROTOCOL_KEY);
+        if (StringUtils.isNotBlank(protocol) && !"tcp".equalsIgnoreCase(protocol)) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error, "Only tcp port checks are supported, got: " + protocol));
+        }
+
+        String portValue = details == null ? null : details.get(PORT_KEY);
+        int port;
+        try {
+            port = Integer.parseInt(portValue);
+            if (port < 1 || port > 65535) {
+                throw new NumberFormatException();
+            }
+        } catch (NumberFormatException e) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error, "Invalid or missing port detail: " + portValue));
+        }
+
+        NicVO nic = nicDao.findDefaultNicForVM(vmId);
+        if (nic == null || StringUtils.isEmpty(nic.getIPv4Address())) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error, "VM has no default NIC/IPv4 address yet"));
+        }
+
+        NetworkVO network = networkDao.findById(nic.getNetworkId());
+        if (network != null && Network.GuestType.L2.equals(network.getGuestType())) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error, "The VM's default network is an L2 network; there is no VR to check the port from"));
+        }
+
+        List<VirtualRouter> routers = virtualNetworkApplianceManager.getRoutersForNetwork(nic.getNetworkId());
+        VirtualRouter router = routers.stream()
+                .filter(r -> r.getState() == VirtualMachine.State.Running)
+                .findFirst()
+                .orElse(null);
+        if (router == null || router.getHostId() == null) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error, "No running VR found for the VM's default network"));
+        }
+
+        InstanceReadinessCheckCommand command = new InstanceReadinessCheckCommand(nic.getIPv4Address(), port,
+                virtualMachineManager.getExecuteInSequence(router.getHypervisorType()));
+        Map<String, String> accessDetails = networkOrchestrationService.getSystemVMAccessDetails(router);
+        if (StringUtils.isEmpty(accessDetails.get(NetworkElementCommand.ROUTER_IP))) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error, "Unable to determine the VR's control IP"));
+        }
+        command.setAccessDetail(accessDetails);
+
+        if (remainingMs < MIN_REMAINING_MS_TO_DISPATCH) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error,
+                    "Insufficient time remaining in this attempt's budget (" + remainingMs + "ms) to dispatch a port check"));
+        }
+        command.setWait(computeWaitSeconds(remainingMs));
+
+        LOGGER.debug("Dispatching port check of {}:{} via {} with {}ms remaining budget", nic.getIPv4Address(), port, router, remainingMs);
+        Answer answer;
+        try {
+            answer = agentManager.easySend(router.getHostId(), command);
+        } catch (Exception e) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error, "Failed to dispatch port check via VR: " + e.getMessage()));
+        }
+        if (answer == null) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error, "No answer from the VR's host"));
+        }
+
+        Map<String, String> executionDetails = ((InstanceReadinessCheckAnswer) answer).getExecutionDetails();
+        String exitCode = executionDetails.get(InstanceReadinessCheckAnswer.EXITCODE);
+        if ("0".equals(exitCode)) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Ready, "port " + port + "/tcp is open"));
+        }
+        return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error, "port " + port + "/tcp check failed: " + executionDetails.get(InstanceReadinessCheckAnswer.STDERR)));
+    }
+}
diff --git a/server/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/VrPingChecker.java b/server/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/VrPingChecker.java
new file mode 100644
index 000000000000..9d4c4da48a55
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/vm/bootgroup/readiness/VrPingChecker.java
@@ -0,0 +1,149 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup.readiness;
+
+import java.util.List;
+import java.util.Map;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.engine.orchestration.service.NetworkOrchestrationService;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.springframework.stereotype.Component;
+
+import com.cloud.agent.AgentManager;
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.routing.NetworkElementCommand;
+import com.cloud.network.Network;
+import com.cloud.network.dao.NetworkDao;
+import com.cloud.network.dao.NetworkVO;
+import com.cloud.network.router.VirtualRouter;
+import com.cloud.network.router.VpcVirtualNetworkApplianceManager;
+import com.cloud.vm.NicVO;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.VirtualMachineManager;
+import com.cloud.vm.dao.NicDao;
+import com.cloud.vm.dao.UserVmDao;
+
+/**
+ * PING: dispatches a dedicated {@link InstanceReadinessCheckCommand} to the VR of the VM's
+ * default network. Deliberately does not reuse {@code DiagnosticsCommand}/{@code DiagnosticsType} —
+ * that plumbing is a general-purpose admin tool scoped to system VMs, not user instances.
+ */
+@Component
+public class VrPingChecker implements ReadinessChecker {
+    protected static Logger LOGGER = LogManager.getLogger(VrPingChecker.class);
+
+    @Inject
+    private UserVmDao userVmDao;
+
+    @Inject
+    private NicDao nicDao;
+
+    @Inject
+    private NetworkDao networkDao;
+
+    // VirtualNetworkApplianceManager itself is ambiguous (VirtualNetworkApplianceManagerImpl and
+    // VpcVirtualNetworkApplianceManagerImpl both implement it) — inject the more specific
+    // sub-interface, matching the convention used by VirtualRouterElement/VpcVirtualRouterElement.
+    @Inject
+    private VpcVirtualNetworkApplianceManager virtualNetworkApplianceManager;
+
+    @Inject
+    private VirtualMachineManager virtualMachineManager;
+
+    @Inject
+    private NetworkOrchestrationService networkOrchestrationService;
+
+    @Inject
+    private AgentManager agentManager;
+
+    @Override
+    public InstanceBootGroupReadinessRule.RuleType getRuleType() {
+        return InstanceBootGroupReadinessRule.RuleType.Ping;
+    }
+
+    @Override
+    public Logger getLogger() {
+        return LOGGER;
+    }
+
+    @Override
+    public Result check(InstanceBootGroupReadinessRule rule, Map<String, String> details, long vmId, long remainingMs) {
+        UserVmVO vm = userVmDao.findById(vmId);
+        if (vm == null) {
+            return logAndReturn(rule, vmId, new Result(InstanceBootGroupReadinessRule.Status.Error, "VM not found"));
+        }
+
+        LOGGER.debug("Checking ping readiness for {} due to rule {}", vm, rule);
+
+        NicVO nic = nicDao.findDefaultNicForVM(vmId);
+        if (nic == null || StringUtils.isEmpty(nic.getIPv4Address())) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error, "VM has no default NIC/IPv4 address yet"));
+        }
+
+        NetworkVO network = networkDao.findById(nic.getNetworkId());
+        if (network != null && Network.GuestType.L2.equals(network.getGuestType())) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error, "The VM's default network is an L2 network; there is no VR to ping from"));
+        }
+
+        List<VirtualRouter> routers = virtualNetworkApplianceManager.getRoutersForNetwork(nic.getNetworkId());
+        VirtualRouter router = routers.stream()
+                .filter(r -> r.getState() == VirtualMachine.State.Running)
+                .findFirst()
+                .orElse(null);
+        if (router == null || router.getHostId() == null) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error, "No running VR found for the VM's default network"));
+        }
+
+        InstanceReadinessCheckCommand command = new InstanceReadinessCheckCommand(nic.getIPv4Address(),
+                virtualMachineManager.getExecuteInSequence(router.getHypervisorType()));
+        Map<String, String> accessDetails = networkOrchestrationService.getSystemVMAccessDetails(router);
+        if (StringUtils.isEmpty(accessDetails.get(NetworkElementCommand.ROUTER_IP))) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error, "Unable to determine the VR's control IP"));
+        }
+        command.setAccessDetail(accessDetails);
+
+        if (remainingMs < MIN_REMAINING_MS_TO_DISPATCH) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error,
+                    "Insufficient time remaining in this attempt's budget (" + remainingMs + "ms) to dispatch a ping check"));
+        }
+        command.setWait(computeWaitSeconds(remainingMs));
+
+        LOGGER.debug("Dispatching ping of {} to {} via {} with {}ms remaining budget", nic.getIPv4Address(), router, router.getHostId(), remainingMs);
+        Answer answer;
+        try {
+            answer = agentManager.easySend(router.getHostId(), command);
+        } catch (Exception e) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error, "Failed to dispatch ping via VR: " + e.getMessage()));
+        }
+        if (answer == null) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error, "No answer from the VR's host"));
+        }
+
+        Map<String, String> executionDetails = ((InstanceReadinessCheckAnswer) answer).getExecutionDetails();
+        String exitCode = executionDetails.get(InstanceReadinessCheckAnswer.EXITCODE);
+        if ("0".equals(exitCode)) {
+            return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Ready, "ping succeeded"));
+        }
+        return logAndReturn(rule, vm, new Result(InstanceBootGroupReadinessRule.Status.Error, "ping failed: " + executionDetails.get(InstanceReadinessCheckAnswer.STDERR)));
+    }
+}
diff --git a/server/src/main/resources/META-INF/cloudstack/core/spring-server-core-managers-context.xml b/server/src/main/resources/META-INF/cloudstack/core/spring-server-core-managers-context.xml
index c0bcba44c642..61b5b541bc75 100644
--- a/server/src/main/resources/META-INF/cloudstack/core/spring-server-core-managers-context.xml
+++ b/server/src/main/resources/META-INF/cloudstack/core/spring-server-core-managers-context.xml
@@ -423,4 +423,16 @@
     <bean id="dnsProviderManager" class="org.apache.cloudstack.dns.DnsProviderManagerImpl" >
         <property name="dnsProviders" value="#{dnsProvidersRegistry.registered}" />
     </bean>
+
+    <bean id="instanceBootGroupManagerImpl" class="org.apache.cloudstack.vm.bootgroup.InstanceBootGroupManagerImpl" />
+    <bean id="instanceBootGroupApiServiceImpl" class="org.apache.cloudstack.vm.bootgroup.InstanceBootGroupApiServiceImpl" />
+    <bean id="instanceBootGroupMembershipGuard" class="org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMembershipGuard" />
+
+    <bean id="vrPingChecker" class="org.apache.cloudstack.vm.bootgroup.readiness.VrPingChecker" />
+    <bean id="portCheckChecker" class="org.apache.cloudstack.vm.bootgroup.readiness.PortCheckChecker" />
+    <bean id="guestAgentLivenessChecker" class="org.apache.cloudstack.vm.bootgroup.readiness.GuestAgentLivenessChecker" />
+
+    <bean id="instanceBootGroupReadinessRuleManagerImpl" class="org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRuleManagerImpl">
+        <property name="readinessCheckers" value="#{bootGroupReadinessCheckersRegistry.registered}" />
+    </bean>
 </beans>
diff --git a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
index 4d631b293c17..1712e62b5f44 100644
--- a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
+++ b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
@@ -100,6 +100,9 @@
 import org.apache.cloudstack.storage.template.VnfTemplateManager;
 import org.apache.cloudstack.userdata.UserDataManager;
 import org.apache.cloudstack.vm.UnmanagedVMsManager;
+import org.apache.cloudstack.annotation.AnnotationService;
+import org.apache.cloudstack.annotation.dao.AnnotationDao;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMembershipGuard;
 import org.apache.cloudstack.vm.lease.VMLeaseManager;
 import org.junit.After;
 import org.junit.Assert;
@@ -208,6 +211,8 @@
 import com.cloud.utils.exception.CloudRuntimeException;
 import com.cloud.utils.exception.ExceptionProxyObject;
 import com.cloud.utils.fsm.NoTransitionException;
+import com.cloud.vm.dao.InstanceGroupDao;
+import com.cloud.vm.dao.InstanceGroupVMMapDao;
 import com.cloud.vm.dao.NicDao;
 import com.cloud.vm.dao.UserVmDao;
 import com.cloud.vm.dao.VMInstanceDetailsDao;
@@ -470,6 +475,18 @@ public class UserVmManagerImplTest {
     @Mock
     private AutoScaleManager autoScaleManager;
 
+    @Mock
+    private InstanceBootGroupMembershipGuard instanceBootGroupMembershipGuard;
+
+    @Mock
+    private InstanceGroupDao _vmGroupDao;
+
+    @Mock
+    private InstanceGroupVMMapDao _groupVMMapDao;
+
+    @Mock
+    private AnnotationDao annotationDao;
+
     @Mock
     private UUIDManager uuidMgr;
 
@@ -3876,6 +3893,50 @@ public void testDestroyVm() throws ResourceUnavailableException {
         }
     }
 
+    @Test
+    public void testDestroyVmBlockedWhenPartOfBootGroup() {
+        Long vmId = 3L;
+
+        ReflectionTestUtils.setField(userVmManagerImpl, "_uuidMgr", uuidMgr);
+        CallContext callContext = mock(CallContext.class);
+        try (MockedStatic<CallContext> mockedCallContext = mockStatic(CallContext.class)) {
+            mockedCallContext.when(CallContext::current).thenReturn(callContext);
+
+            DestroyVMCmd cmd = mock(DestroyVMCmd.class);
+            when(cmd.getId()).thenReturn(vmId);
+
+            UserVmVO vm = mock(UserVmVO.class);
+            when(vm.getId()).thenReturn(vmId);
+            when(vm.getState()).thenReturn(VirtualMachine.State.Running);
+            when(vm.getUserVmType()).thenReturn("User");
+            when(userVmDao.findById(vmId)).thenReturn(vm);
+
+            Mockito.doThrow(new InvalidParameterValueException("VM is a member of an instance boot group"))
+                    .when(instanceBootGroupMembershipGuard).validateVmNotInBootGroup(vm);
+
+            assertThrows(InvalidParameterValueException.class, () -> userVmManagerImpl.destroyVm(cmd, false));
+
+            Mockito.verify(userVmManagerImpl, never()).stopVirtualMachine(anyLong(), anyBoolean());
+        }
+    }
+
+    @Test
+    public void testDeleteVmGroupCascadesBootGroupMembershipCleanup() {
+        long groupId = 55L;
+        InstanceGroupVO group = mock(InstanceGroupVO.class);
+        when(group.getUuid()).thenReturn("group-uuid");
+        when(_vmGroupDao.findById(groupId)).thenReturn(group);
+        when(_groupVMMapDao.listByGroupId(groupId)).thenReturn(new ArrayList<>());
+        when(_vmGroupDao.remove(groupId)).thenReturn(true);
+
+        boolean result = userVmManagerImpl.deleteVmGroup(groupId);
+
+        assertTrue(result);
+        Mockito.verify(instanceBootGroupMembershipGuard).removeInstanceGroupBootGroupMembershipIfPresent(groupId);
+        Mockito.verify(annotationDao).removeByEntityType(AnnotationService.EntityType.INSTANCE_GROUP.name(), "group-uuid");
+        Mockito.verify(_vmGroupDao).remove(groupId);
+    }
+
     @Test(expected = InvalidParameterValueException.class)
     public void testValidateLeasePropertiesInvalidDuration() {
         userVmManagerImpl.validateLeaseProperties(-2, VMLeaseManager.ExpiryAction.STOP);
diff --git a/server/src/test/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupApiServiceImplTest.java b/server/src/test/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupApiServiceImplTest.java
new file mode 100644
index 000000000000..0ee66421ad63
--- /dev/null
+++ b/server/src/test/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupApiServiceImplTest.java
@@ -0,0 +1,1304 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.Date;
+import java.util.List;
+
+import org.apache.cloudstack.api.command.user.bootgroup.AddMemberToInstanceBootGroupCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.CreateInstanceBootGroupCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.CreateInstanceBootGroupReadinessRuleCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.DeleteInstanceBootGroupCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.DeleteInstanceBootGroupReadinessRuleCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.ListInstanceBootGroupMembersCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.ListInstanceBootGroupReadinessRulesCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.ListInstanceBootGroupsCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.RebootInstanceBootGroupCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.RemoveInstanceBootGroupMemberCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.StartInstanceBootGroupCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.StopInstanceBootGroupCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.UpdateInstanceBootGroupCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.UpdateInstanceBootGroupMemberCmd;
+import org.apache.cloudstack.api.command.user.bootgroup.UpdateInstanceBootGroupReadinessRuleCmd;
+import org.apache.cloudstack.api.query.dao.InstanceBootGroupJoinDao;
+import org.apache.cloudstack.api.query.vo.InstanceBootGroupJoinVO;
+import org.apache.cloudstack.api.response.InstanceBootGroupMemberChildResponse;
+import org.apache.cloudstack.api.response.InstanceBootGroupMemberResponse;
+import org.apache.cloudstack.api.response.InstanceBootGroupReadinessRuleResponse;
+import org.apache.cloudstack.api.response.InstanceBootGroupResponse;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRuleService;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.exception.PermissionDeniedException;
+import com.cloud.hypervisor.Hypervisor.HypervisorType;
+import com.cloud.user.Account;
+import com.cloud.user.AccountManager;
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
+import com.cloud.utils.db.Transaction;
+import com.cloud.utils.db.TransactionCallback;
+import com.cloud.vm.InstanceGroupVMMapVO;
+import com.cloud.vm.InstanceGroupVO;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.dao.InstanceBootGroupDao;
+import com.cloud.vm.dao.InstanceBootGroupDetailsDao;
+import com.cloud.vm.dao.InstanceBootGroupMemberDao;
+import com.cloud.vm.dao.InstanceBootGroupReadinessCheckResultDao;
+import com.cloud.vm.dao.InstanceBootGroupReadinessRuleDao;
+import com.cloud.vm.dao.InstanceBootGroupReadinessRuleDetailsDao;
+import com.cloud.vm.dao.InstanceGroupDao;
+import com.cloud.vm.dao.InstanceGroupVMMapDao;
+import com.cloud.vm.dao.UserVmDao;
+
+@RunWith(MockitoJUnitRunner.class)
+public class InstanceBootGroupApiServiceImplTest {
+
+    private static final long ACCOUNT_ID = 1L;
+    private static final long DOMAIN_ID = 10L;
+    private static final long GROUP_ID = 100L;
+    private static final long VM_ID = 200L;
+    private static final long VM2_ID = 201L;
+    private static final long INSTANCE_GROUP_ID = 300L;
+    private static final long MEMBER_ID = 400L;
+    private static final long RULE_ID = 500L;
+
+    @InjectMocks
+    InstanceBootGroupApiServiceImpl service;
+
+    @Mock
+    InstanceBootGroupDao instanceBootGroupDao;
+    @Mock
+    InstanceBootGroupJoinDao instanceBootGroupJoinDao;
+    @Mock
+    InstanceBootGroupMemberDao instanceBootGroupMemberDao;
+    @Mock
+    AccountManager accountManager;
+    @Mock
+    UserVmDao userVmDao;
+    @Mock
+    InstanceGroupDao instanceGroupDao;
+    @Mock
+    InstanceBootGroupManager instanceBootGroupManager;
+    @Mock
+    InstanceBootGroupMembershipGuard instanceBootGroupMembershipGuard;
+    @Mock
+    InstanceBootGroupReadinessRuleService instanceBootGroupReadinessRuleService;
+    @Mock
+    InstanceBootGroupReadinessRuleDao instanceBootGroupReadinessRuleDao;
+    @Mock
+    InstanceBootGroupReadinessRuleDetailsDao instanceBootGroupReadinessRuleDetailsDao;
+    @Mock
+    InstanceBootGroupReadinessCheckResultDao instanceBootGroupReadinessCheckResultDao;
+    @Mock
+    InstanceBootGroupDetailsDao instanceBootGroupDetailsDao;
+    @Mock
+    InstanceGroupVMMapDao instanceGroupVMMapDao;
+
+    @Mock
+    Account callerMock;
+
+    private MockedStatic<CallContext> callContextMocked;
+    private CallContext callContextMock;
+
+    @Before
+    public void setUp() {
+        callContextMocked = Mockito.mockStatic(CallContext.class);
+        callContextMock = mock(CallContext.class);
+        callContextMocked.when(CallContext::current).thenReturn(callContextMock);
+        when(callContextMock.getCallingAccount()).thenReturn(callerMock);
+        Mockito.lenient().when(callerMock.getId()).thenReturn(ACCOUNT_ID);
+        Mockito.lenient().when(callerMock.getDomainId()).thenReturn(DOMAIN_ID);
+
+        doNothing().when(accountManager).checkAccess(any(Account.class), any(), eq(true), any());
+    }
+
+    @After
+    public void tearDown() {
+        callContextMocked.close();
+    }
+
+    // ---------------------------------------------------------------- helpers
+
+    private InstanceBootGroupVO newGroup(long id, String name, long accountId) {
+        InstanceBootGroupVO group = new InstanceBootGroupVO(name, "desc", accountId, DOMAIN_ID);
+        ReflectionTestUtils.setField(group, "id", id);
+        return group;
+    }
+
+    private InstanceGroupVO newInstanceGroup(long id, String name, long accountId) {
+        InstanceGroupVO group = new InstanceGroupVO(name, accountId);
+        ReflectionTestUtils.setField(group, "id", id);
+        return group;
+    }
+
+    private UserVmVO newVm(long id, String displayName, String hostName, long accountId, VirtualMachine.State state) {
+        UserVmVO vm = new UserVmVO(id, "i-1-" + id + "-VM", displayName, 1L, HypervisorType.KVM, 1L, false, false,
+                DOMAIN_ID, accountId, 1L, 1L, null, null, null, "i-1-" + id + "-VM");
+        vm.setHostName(hostName);
+        vm.setState(state);
+        return vm;
+    }
+
+    private InstanceBootGroupMemberVO newMember(long id, long bootGroupId, InstanceBootGroupMember.MemberType type, long memberId, int order) {
+        InstanceBootGroupMemberVO member = new InstanceBootGroupMemberVO(bootGroupId, type, memberId, order);
+        ReflectionTestUtils.setField(member, "id", id);
+        return member;
+    }
+
+    private InstanceBootGroupReadinessRuleVO newRule(long id, long bootGroupId, InstanceBootGroupMember.MemberType itemType, long itemId,
+            InstanceBootGroupReadinessRule.RuleType ruleType, boolean enabled, String name) {
+        InstanceBootGroupReadinessRuleVO rule = new InstanceBootGroupReadinessRuleVO(name, bootGroupId, itemType, itemId, ruleType, enabled);
+        ReflectionTestUtils.setField(rule, "id", id);
+        return rule;
+    }
+
+    private String field(Object response, String name) {
+        Object value = ReflectionTestUtils.getField(response, name);
+        return value == null ? null : value.toString();
+    }
+
+    // ---------------------------------------------------------------- createInstanceBootGroup
+
+    @Test
+    public void testCreateInstanceBootGroupSuccessWithOverrides() {
+        CreateInstanceBootGroupCmd cmd = mock(CreateInstanceBootGroupCmd.class);
+        when(cmd.getName()).thenReturn("group1");
+        when(cmd.getDescription()).thenReturn("desc");
+        when(cmd.getAccountName()).thenReturn("acct");
+        when(cmd.getDomainId()).thenReturn(DOMAIN_ID);
+        when(cmd.getProjectId()).thenReturn(null);
+        when(cmd.getReadinessAttemptTimeoutSeconds()).thenReturn(100L);
+        when(cmd.getReadinessMaxRetryAttempts()).thenReturn(-1L);
+        when(cmd.getReadinessRebootOnRetry()).thenReturn(true);
+        when(cmd.getReadinessInitialDelaySeconds()).thenReturn(null);
+
+        Account owner = mock(Account.class);
+        when(owner.getId()).thenReturn(ACCOUNT_ID);
+        when(owner.getDomainId()).thenReturn(DOMAIN_ID);
+        when(accountManager.finalizeOwner(callerMock, "acct", DOMAIN_ID, null)).thenReturn(owner);
+        when(instanceBootGroupDao.isNameInUse(ACCOUNT_ID, "group1")).thenReturn(false);
+        when(instanceBootGroupDao.persist(any(InstanceBootGroupVO.class))).thenAnswer(inv -> {
+            InstanceBootGroupVO vo = inv.getArgument(0);
+            ReflectionTestUtils.setField(vo, "id", GROUP_ID);
+            return vo;
+        });
+
+        InstanceBootGroup result = service.createInstanceBootGroup(cmd);
+
+        assertNotNull(result);
+        assertEquals(GROUP_ID, result.getId());
+        verify(callContextMock).setEventResourceId(GROUP_ID);
+        verify(instanceBootGroupDetailsDao).setDetail(GROUP_ID, InstanceBootGroupManagerImpl.ReadinessAttemptTimeoutSeconds.key(), "100");
+        verify(instanceBootGroupDetailsDao).setDetail(GROUP_ID, InstanceBootGroupManagerImpl.ReadinessMaxRetryAttempts.key(), null);
+        verify(instanceBootGroupDetailsDao).setDetail(GROUP_ID, InstanceBootGroupManagerImpl.ReadinessRebootOnRetry.key(), "true");
+        verify(instanceBootGroupDetailsDao, never()).setDetail(eq(GROUP_ID), eq(InstanceBootGroupManagerImpl.ReadinessInitialDelaySeconds.key()), any());
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testCreateInstanceBootGroupNameInUseThrows() {
+        CreateInstanceBootGroupCmd cmd = mock(CreateInstanceBootGroupCmd.class);
+        when(cmd.getName()).thenReturn("group1");
+        Account owner = mock(Account.class);
+        when(owner.getId()).thenReturn(ACCOUNT_ID);
+        when(accountManager.finalizeOwner(any(), any(), any(), any())).thenReturn(owner);
+        when(instanceBootGroupDao.isNameInUse(ACCOUNT_ID, "group1")).thenReturn(true);
+
+        service.createInstanceBootGroup(cmd);
+    }
+
+    // ---------------------------------------------------------------- deleteInstanceBootGroup
+
+    @Test
+    public void testDeleteInstanceBootGroupSuccess() {
+        DeleteInstanceBootGroupCmd cmd = mock(DeleteInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+
+        try (MockedStatic<Transaction> transactionMock = Mockito.mockStatic(Transaction.class)) {
+            transactionMock.when(() -> Transaction.execute(any(TransactionCallback.class))).thenAnswer(invocation -> {
+                TransactionCallback<Boolean> callback = invocation.getArgument(0);
+                return callback.doInTransaction(null);
+            });
+
+            boolean result = service.deleteInstanceBootGroup(cmd);
+
+            assertTrue(result);
+            verify(instanceBootGroupMemberDao).deleteByBootGroupId(GROUP_ID);
+            verify(instanceBootGroupDao).remove(GROUP_ID);
+        }
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testDeleteInstanceBootGroupNotFound() {
+        DeleteInstanceBootGroupCmd cmd = mock(DeleteInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(null);
+
+        service.deleteInstanceBootGroup(cmd);
+    }
+
+    // ---------------------------------------------------------------- updateInstanceBootGroup
+
+    @Test
+    public void testUpdateInstanceBootGroupChangeNameSuccess() {
+        UpdateInstanceBootGroupCmd cmd = mock(UpdateInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        when(cmd.getName()).thenReturn("newname");
+        when(cmd.getDescription()).thenReturn("newdesc");
+        when(cmd.getReadinessAttemptTimeoutSeconds()).thenReturn(null);
+        when(cmd.getReadinessMaxRetryAttempts()).thenReturn(null);
+        when(cmd.getReadinessRebootOnRetry()).thenReturn(null);
+        when(cmd.getReadinessInitialDelaySeconds()).thenReturn(null);
+
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "oldname", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        Account owner = mock(Account.class);
+        when(owner.getId()).thenReturn(ACCOUNT_ID);
+        when(accountManager.getAccount(ACCOUNT_ID)).thenReturn(owner);
+        when(instanceBootGroupDao.isNameInUse(ACCOUNT_ID, "newname")).thenReturn(false);
+
+        InstanceBootGroup result = service.updateInstanceBootGroup(cmd);
+
+        assertNotNull(result);
+        assertEquals("newname", group.getName());
+        assertEquals("newdesc", group.getDescription());
+        verify(instanceBootGroupDao).update(GROUP_ID, group);
+    }
+
+    @Test
+    public void testUpdateInstanceBootGroupSameNameSkipsUniquenessCheck() {
+        UpdateInstanceBootGroupCmd cmd = mock(UpdateInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        when(cmd.getName()).thenReturn("samename");
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "samename", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+
+        service.updateInstanceBootGroup(cmd);
+
+        verify(instanceBootGroupDao, never()).isNameInUse(anyLong(), any());
+        verify(accountManager, never()).getAccount(anyLong());
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testUpdateInstanceBootGroupNameInUseThrows() {
+        UpdateInstanceBootGroupCmd cmd = mock(UpdateInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        when(cmd.getName()).thenReturn("newname");
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "oldname", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        Account owner = mock(Account.class);
+        when(owner.getId()).thenReturn(ACCOUNT_ID);
+        when(accountManager.getAccount(ACCOUNT_ID)).thenReturn(owner);
+        when(instanceBootGroupDao.isNameInUse(ACCOUNT_ID, "newname")).thenReturn(true);
+
+        service.updateInstanceBootGroup(cmd);
+    }
+
+    @Test
+    public void testUpdateInstanceBootGroupOverridesSetAndCleared() {
+        UpdateInstanceBootGroupCmd cmd = mock(UpdateInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        when(cmd.getReadinessAttemptTimeoutSeconds()).thenReturn(-1L);
+        when(cmd.getReadinessMaxRetryAttempts()).thenReturn(7L);
+        when(cmd.getReadinessRebootOnRetry()).thenReturn(false);
+        when(cmd.getReadinessInitialDelaySeconds()).thenReturn(15L);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+
+        service.updateInstanceBootGroup(cmd);
+
+        verify(instanceBootGroupDetailsDao).setDetail(GROUP_ID, InstanceBootGroupManagerImpl.ReadinessAttemptTimeoutSeconds.key(), null);
+        verify(instanceBootGroupDetailsDao).setDetail(GROUP_ID, InstanceBootGroupManagerImpl.ReadinessMaxRetryAttempts.key(), "7");
+        verify(instanceBootGroupDetailsDao).setDetail(GROUP_ID, InstanceBootGroupManagerImpl.ReadinessRebootOnRetry.key(), "false");
+        verify(instanceBootGroupDetailsDao).setDetail(GROUP_ID, InstanceBootGroupManagerImpl.ReadinessInitialDelaySeconds.key(), "15");
+    }
+
+    // ---------------------------------------------------------------- getGroupAndCheckAccess
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetGroupAndCheckAccessNotFoundThrows() {
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(null);
+        service.getGroupAndCheckAccess(GROUP_ID);
+    }
+
+    @Test
+    public void testGetGroupAndCheckAccessSuccessDelegatesToAccountManager() {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+
+        InstanceBootGroupVO result = service.getGroupAndCheckAccess(GROUP_ID);
+
+        assertEquals(group, result);
+        verify(accountManager).checkAccess(callerMock, null, true, group);
+    }
+
+    // ---------------------------------------------------------------- listInstanceBootGroups
+
+    private ListInstanceBootGroupsCmd baseListGroupsCmd(Long virtualMachineId, Long instanceGroupId) {
+        ListInstanceBootGroupsCmd cmd = mock(ListInstanceBootGroupsCmd.class);
+        when(cmd.getVirtualMachineId()).thenReturn(virtualMachineId);
+        when(cmd.getInstanceGroupId()).thenReturn(instanceGroupId);
+        return cmd;
+    }
+
+    private SearchBuilder<InstanceBootGroupJoinVO> mockSearchBuilder() {
+        @SuppressWarnings("unchecked")
+        SearchBuilder<InstanceBootGroupJoinVO> sb = mock(SearchBuilder.class);
+        @SuppressWarnings("unchecked")
+        SearchCriteria<InstanceBootGroupJoinVO> sc = mock(SearchCriteria.class);
+        when(sb.entity()).thenReturn(new InstanceBootGroupJoinVO());
+        when(sb.create()).thenReturn(sc);
+        when(instanceBootGroupJoinDao.createSearchBuilder()).thenReturn(sb);
+        return sb;
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListInstanceBootGroupsBothVmAndInstanceGroupIdThrows() {
+        ListInstanceBootGroupsCmd cmd = baseListGroupsCmd(VM_ID, INSTANCE_GROUP_ID);
+        service.listInstanceBootGroups(cmd);
+    }
+
+    @Test
+    public void testListInstanceBootGroupsByVirtualMachineIdNotAMemberReturnsEmpty() {
+        ListInstanceBootGroupsCmd cmd = baseListGroupsCmd(VM_ID, null);
+        when(instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID)).thenReturn(null);
+
+        ListResponse<InstanceBootGroupResponse> response = service.listInstanceBootGroups(cmd);
+
+        assertEquals(0, response.getCount().intValue());
+        assertTrue(response.getResponses().isEmpty());
+        verify(instanceBootGroupJoinDao, never()).createSearchBuilder();
+    }
+
+    @Test
+    public void testListInstanceBootGroupsByVirtualMachineIdFiltersToMemberBootGroup() {
+        ListInstanceBootGroupsCmd cmd = baseListGroupsCmd(VM_ID, null);
+        InstanceBootGroupMemberVO member = newMember(MEMBER_ID, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID, 0);
+        when(instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID)).thenReturn(member);
+
+        SearchBuilder<InstanceBootGroupJoinVO> sb = mockSearchBuilder();
+        InstanceBootGroupJoinVO joinVO = new InstanceBootGroupJoinVO();
+        ReflectionTestUtils.setField(joinVO, "id", GROUP_ID);
+        ReflectionTestUtils.setField(joinVO, "name", "group1");
+        when(instanceBootGroupJoinDao.searchAndCount(any(), any()))
+                .thenReturn(new com.cloud.utils.Pair<>(Collections.singletonList(joinVO), 1));
+
+        ListResponse<InstanceBootGroupResponse> response = service.listInstanceBootGroups(cmd);
+
+        assertEquals(1, response.getResponses().size());
+        verify(sb.create()).setParameters("memberBootGroupId", GROUP_ID);
+    }
+
+    @Test
+    public void testListInstanceBootGroupsByInstanceGroupIdNotAMemberReturnsEmpty() {
+        ListInstanceBootGroupsCmd cmd = baseListGroupsCmd(null, INSTANCE_GROUP_ID);
+        when(instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID)).thenReturn(null);
+
+        ListResponse<InstanceBootGroupResponse> response = service.listInstanceBootGroups(cmd);
+
+        assertEquals(0, response.getCount().intValue());
+        verify(instanceBootGroupJoinDao, never()).createSearchBuilder();
+    }
+
+    // ---------------------------------------------------------------- addMemberToInstanceBootGroup
+
+    @Test
+    public void testAddMemberToInstanceBootGroupVirtualMachineSuccess() {
+        AddMemberToInstanceBootGroupCmd cmd = mock(AddMemberToInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        when(cmd.getOrder()).thenReturn(0);
+        when(cmd.getVirtualMachineId()).thenReturn(VM_ID);
+        when(cmd.getInstanceGroupId()).thenReturn(null);
+
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        UserVmVO vm = newVm(VM_ID, "vm1", "vm1host", ACCOUNT_ID, VirtualMachine.State.Running);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm);
+        when(instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID)).thenReturn(null);
+        when(instanceBootGroupMemberDao.countByBootGroupId(GROUP_ID)).thenReturn(0);
+        when(instanceBootGroupMemberDao.listByBootGroupIdAndEqualOrHigherOrder(GROUP_ID, 0)).thenReturn(new ArrayList<>());
+        when(instanceBootGroupMemberDao.persist(any(InstanceBootGroupMemberVO.class))).thenAnswer(inv -> inv.getArgument(0));
+
+        InstanceBootGroupMember result = service.addMemberToInstanceBootGroup(cmd);
+
+        assertNotNull(result);
+        assertEquals(InstanceBootGroupMember.MemberType.VirtualMachine, result.getMemberType());
+        assertEquals(VM_ID, result.getMemberId());
+        verify(instanceBootGroupMembershipGuard).validateVmEligibleForGroupMembership(VM_ID);
+        verify(instanceBootGroupMembershipGuard).validateVmNotIndirectlyBootGroupManaged(VM_ID);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testAddMemberToInstanceBootGroupVirtualMachineIndirectlyManagedThrows() {
+        AddMemberToInstanceBootGroupCmd cmd = mock(AddMemberToInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        when(cmd.getOrder()).thenReturn(0);
+        when(cmd.getVirtualMachineId()).thenReturn(VM_ID);
+        when(cmd.getInstanceGroupId()).thenReturn(null);
+
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        UserVmVO vm = newVm(VM_ID, "vm1", "vm1host", ACCOUNT_ID, VirtualMachine.State.Running);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm);
+        org.mockito.Mockito.doThrow(new InvalidParameterValueException("already indirectly managed"))
+                .when(instanceBootGroupMembershipGuard).validateVmNotIndirectlyBootGroupManaged(VM_ID);
+
+        service.addMemberToInstanceBootGroup(cmd);
+    }
+
+    @Test
+    public void testAddMemberToInstanceBootGroupInstanceGroupSuccess() {
+        AddMemberToInstanceBootGroupCmd cmd = mock(AddMemberToInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        when(cmd.getOrder()).thenReturn(0);
+        when(cmd.getVirtualMachineId()).thenReturn(null);
+        when(cmd.getInstanceGroupId()).thenReturn(INSTANCE_GROUP_ID);
+
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        InstanceGroupVO instanceGroup = newInstanceGroup(INSTANCE_GROUP_ID, "ig1", ACCOUNT_ID);
+        when(instanceGroupDao.findById(INSTANCE_GROUP_ID)).thenReturn(instanceGroup);
+        when(instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID)).thenReturn(null);
+        when(instanceBootGroupMemberDao.countByBootGroupId(GROUP_ID)).thenReturn(0);
+        when(instanceBootGroupMemberDao.listByBootGroupIdAndEqualOrHigherOrder(GROUP_ID, 0)).thenReturn(new ArrayList<>());
+        when(instanceBootGroupMemberDao.persist(any(InstanceBootGroupMemberVO.class))).thenAnswer(inv -> inv.getArgument(0));
+
+        InstanceBootGroupMember result = service.addMemberToInstanceBootGroup(cmd);
+
+        assertNotNull(result);
+        assertEquals(InstanceBootGroupMember.MemberType.InstanceGroup, result.getMemberType());
+        assertEquals(INSTANCE_GROUP_ID, result.getMemberId());
+        verify(instanceBootGroupMembershipGuard).validateInstanceGroupEligibleForBootGroupMembership(INSTANCE_GROUP_ID);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testAddMemberToInstanceBootGroupNegativeOrderThrows() {
+        AddMemberToInstanceBootGroupCmd cmd = mock(AddMemberToInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        when(cmd.getOrder()).thenReturn(-1);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+
+        service.addMemberToInstanceBootGroup(cmd);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testAddMemberToInstanceBootGroupBothIdsSpecifiedThrows() {
+        AddMemberToInstanceBootGroupCmd cmd = mock(AddMemberToInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        when(cmd.getOrder()).thenReturn(0);
+        when(cmd.getVirtualMachineId()).thenReturn(VM_ID);
+        when(cmd.getInstanceGroupId()).thenReturn(INSTANCE_GROUP_ID);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+
+        service.addMemberToInstanceBootGroup(cmd);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testAddMemberToInstanceBootGroupNeitherIdSpecifiedThrows() {
+        AddMemberToInstanceBootGroupCmd cmd = mock(AddMemberToInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        when(cmd.getOrder()).thenReturn(0);
+        when(cmd.getVirtualMachineId()).thenReturn(null);
+        when(cmd.getInstanceGroupId()).thenReturn(null);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+
+        service.addMemberToInstanceBootGroup(cmd);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testAddMemberToInstanceBootGroupAlreadyMemberThrows() {
+        AddMemberToInstanceBootGroupCmd cmd = mock(AddMemberToInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        when(cmd.getOrder()).thenReturn(0);
+        when(cmd.getVirtualMachineId()).thenReturn(VM_ID);
+        when(cmd.getInstanceGroupId()).thenReturn(null);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        UserVmVO vm = newVm(VM_ID, "vm1", "vm1host", ACCOUNT_ID, VirtualMachine.State.Running);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm);
+        InstanceBootGroupMemberVO existing = newMember(999L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID, 0);
+        when(instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID)).thenReturn(existing);
+
+        service.addMemberToInstanceBootGroup(cmd);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testAddMemberToInstanceBootGroupAtMaxMembersThrows() {
+        AddMemberToInstanceBootGroupCmd cmd = mock(AddMemberToInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        when(cmd.getOrder()).thenReturn(0);
+        when(cmd.getVirtualMachineId()).thenReturn(VM_ID);
+        when(cmd.getInstanceGroupId()).thenReturn(null);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        UserVmVO vm = newVm(VM_ID, "vm1", "vm1host", ACCOUNT_ID, VirtualMachine.State.Running);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm);
+        when(instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID)).thenReturn(null);
+
+        long maxMembers = InstanceBootGroupManagerImpl.MaxMembersPerBootGroup.value();
+        when(instanceBootGroupMemberDao.countByBootGroupId(GROUP_ID)).thenReturn((int) maxMembers);
+
+        service.addMemberToInstanceBootGroup(cmd);
+    }
+
+    @Test(expected = PermissionDeniedException.class)
+    public void testAddMemberToInstanceBootGroupDifferentAccountThrows() {
+        AddMemberToInstanceBootGroupCmd cmd = mock(AddMemberToInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        when(cmd.getOrder()).thenReturn(0);
+        when(cmd.getVirtualMachineId()).thenReturn(VM_ID);
+        when(cmd.getInstanceGroupId()).thenReturn(null);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        UserVmVO vm = newVm(VM_ID, "vm1", "vm1host", ACCOUNT_ID + 1, VirtualMachine.State.Running);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm);
+
+        service.addMemberToInstanceBootGroup(cmd);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testAddMemberToInstanceBootGroupInstanceGroupNotFoundThrows() {
+        AddMemberToInstanceBootGroupCmd cmd = mock(AddMemberToInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        when(cmd.getOrder()).thenReturn(0);
+        when(cmd.getVirtualMachineId()).thenReturn(null);
+        when(cmd.getInstanceGroupId()).thenReturn(INSTANCE_GROUP_ID);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        when(instanceGroupDao.findById(INSTANCE_GROUP_ID)).thenReturn(null);
+
+        service.addMemberToInstanceBootGroup(cmd);
+    }
+
+    @Test
+    public void testAddMemberToInstanceBootGroupShiftsCollidingSiblingsUp() {
+        AddMemberToInstanceBootGroupCmd cmd = mock(AddMemberToInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        when(cmd.getOrder()).thenReturn(2);
+        when(cmd.getVirtualMachineId()).thenReturn(VM_ID);
+        when(cmd.getInstanceGroupId()).thenReturn(null);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        UserVmVO vm = newVm(VM_ID, "vm1", "vm1host", ACCOUNT_ID, VirtualMachine.State.Running);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm);
+        when(instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID)).thenReturn(null);
+
+        InstanceBootGroupMemberVO siblingBelow = newMember(1L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, 11L, 1);
+        InstanceBootGroupMemberVO siblingAtOrder = newMember(2L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, 12L, 2);
+        InstanceBootGroupMemberVO siblingAbove = newMember(3L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, 13L, 5);
+        when(instanceBootGroupMemberDao.countByBootGroupId(GROUP_ID)).thenReturn(3);
+        when(instanceBootGroupMemberDao.listByBootGroupIdAndEqualOrHigherOrder(GROUP_ID, 2)).thenReturn(Arrays.asList(siblingAtOrder, siblingAbove));
+        when(instanceBootGroupMemberDao.persist(any(InstanceBootGroupMemberVO.class))).thenAnswer(inv -> inv.getArgument(0));
+
+        service.addMemberToInstanceBootGroup(cmd);
+
+        verify(instanceBootGroupMemberDao, never()).update(eq(1L), any());
+        ArgumentCaptor<InstanceBootGroupMemberVO> captor = ArgumentCaptor.forClass(InstanceBootGroupMemberVO.class);
+        verify(instanceBootGroupMemberDao).update(eq(2L), captor.capture());
+        assertEquals(3, captor.getValue().getBootOrder());
+        verify(instanceBootGroupMemberDao).update(eq(3L), captor.capture());
+        assertEquals(6, captor.getValue().getBootOrder());
+    }
+
+    // ---------------------------------------------------------------- removeInstanceBootGroupMember
+
+    @Test
+    public void testRemoveInstanceBootGroupMemberSuccess() {
+        RemoveInstanceBootGroupMemberCmd cmd = mock(RemoveInstanceBootGroupMemberCmd.class);
+        when(cmd.getId()).thenReturn(MEMBER_ID);
+        InstanceBootGroupMemberVO member = newMember(MEMBER_ID, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID, 0);
+        when(instanceBootGroupMemberDao.findById(MEMBER_ID)).thenReturn(member);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+
+        boolean result = service.removeInstanceBootGroupMember(cmd);
+
+        assertTrue(result);
+        verify(instanceBootGroupMemberDao).expunge(MEMBER_ID);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testRemoveInstanceBootGroupMemberNotFoundThrows() {
+        RemoveInstanceBootGroupMemberCmd cmd = mock(RemoveInstanceBootGroupMemberCmd.class);
+        when(cmd.getId()).thenReturn(MEMBER_ID);
+        when(instanceBootGroupMemberDao.findById(MEMBER_ID)).thenReturn(null);
+
+        service.removeInstanceBootGroupMember(cmd);
+    }
+
+    // ---------------------------------------------------------------- updateInstanceBootGroupMember (reorder)
+
+    @Test
+    public void testUpdateInstanceBootGroupMemberNotFoundThrows() {
+        UpdateInstanceBootGroupMemberCmd cmd = mock(UpdateInstanceBootGroupMemberCmd.class);
+        when(cmd.getId()).thenReturn(MEMBER_ID);
+        when(instanceBootGroupMemberDao.findById(MEMBER_ID)).thenReturn(null);
+        try {
+            service.updateInstanceBootGroupMember(cmd);
+            org.junit.Assert.fail("expected InvalidParameterValueException");
+        } catch (InvalidParameterValueException expected) {
+            // expected
+        }
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testUpdateInstanceBootGroupMemberNegativeOrderThrows() {
+        UpdateInstanceBootGroupMemberCmd cmd = mock(UpdateInstanceBootGroupMemberCmd.class);
+        when(cmd.getId()).thenReturn(MEMBER_ID);
+        when(cmd.getOrder()).thenReturn(-1);
+        InstanceBootGroupMemberVO member = newMember(MEMBER_ID, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID, 2);
+        when(instanceBootGroupMemberDao.findById(MEMBER_ID)).thenReturn(member);
+
+        service.updateInstanceBootGroupMember(cmd);
+    }
+
+    @Test
+    public void testUpdateInstanceBootGroupMemberNoChangeDoesNotShiftOrPersist() {
+        UpdateInstanceBootGroupMemberCmd cmd = mock(UpdateInstanceBootGroupMemberCmd.class);
+        when(cmd.getId()).thenReturn(MEMBER_ID);
+        when(cmd.getOrder()).thenReturn(2);
+        InstanceBootGroupMemberVO member = newMember(MEMBER_ID, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID, 2);
+        when(instanceBootGroupMemberDao.findById(MEMBER_ID)).thenReturn(member);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+
+        service.updateInstanceBootGroupMember(cmd);
+
+        verify(instanceBootGroupMemberDao, never()).update(anyLong(), any());
+        verify(instanceBootGroupMemberDao, never()).listByBootGroupIdAndOrderRange(anyLong(), anyInt(), anyInt());
+    }
+
+    @Test
+    public void testUpdateInstanceBootGroupMemberMoveDownShiftsBetweenSiblingsDown() {
+        UpdateInstanceBootGroupMemberCmd cmd = mock(UpdateInstanceBootGroupMemberCmd.class);
+        when(cmd.getId()).thenReturn(MEMBER_ID);
+        when(cmd.getOrder()).thenReturn(3);
+        InstanceBootGroupMemberVO member = newMember(MEMBER_ID, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID, 1);
+        when(instanceBootGroupMemberDao.findById(MEMBER_ID)).thenReturn(member);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+
+        InstanceBootGroupMemberVO siblingUnaffectedLow = newMember(11L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, 1L, 0);
+        InstanceBootGroupMemberVO siblingB = newMember(12L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, 2L, 2);
+        InstanceBootGroupMemberVO siblingC = newMember(13L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, 3L, 3);
+        InstanceBootGroupMemberVO siblingUnaffectedHigh = newMember(14L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, 4L, 5);
+        when(instanceBootGroupMemberDao.listByBootGroupIdAndOrderRange(GROUP_ID, 1, 3))
+                .thenReturn(Arrays.asList(member, siblingB, siblingC));
+
+        service.updateInstanceBootGroupMember(cmd);
+
+        verify(instanceBootGroupMemberDao, never()).update(eq(11L), any());
+        verify(instanceBootGroupMemberDao, never()).update(eq(14L), any());
+        ArgumentCaptor<InstanceBootGroupMemberVO> captor = ArgumentCaptor.forClass(InstanceBootGroupMemberVO.class);
+        verify(instanceBootGroupMemberDao).update(eq(12L), captor.capture());
+        assertEquals(1, captor.getValue().getBootOrder());
+        verify(instanceBootGroupMemberDao).update(eq(13L), captor.capture());
+        assertEquals(2, captor.getValue().getBootOrder());
+        verify(instanceBootGroupMemberDao).update(eq(MEMBER_ID), captor.capture());
+        assertEquals(3, captor.getValue().getBootOrder());
+    }
+
+    @Test
+    public void testUpdateInstanceBootGroupMemberMoveUpShiftsBetweenSiblingsUp() {
+        UpdateInstanceBootGroupMemberCmd cmd = mock(UpdateInstanceBootGroupMemberCmd.class);
+        when(cmd.getId()).thenReturn(MEMBER_ID);
+        when(cmd.getOrder()).thenReturn(1);
+        InstanceBootGroupMemberVO member = newMember(MEMBER_ID, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID, 3);
+        when(instanceBootGroupMemberDao.findById(MEMBER_ID)).thenReturn(member);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+
+        InstanceBootGroupMemberVO siblingUnaffectedLow = newMember(11L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, 1L, 0);
+        InstanceBootGroupMemberVO siblingB = newMember(12L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, 2L, 1);
+        InstanceBootGroupMemberVO siblingC = newMember(13L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, 3L, 2);
+        InstanceBootGroupMemberVO siblingUnaffectedHigh = newMember(14L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, 4L, 4);
+        when(instanceBootGroupMemberDao.listByBootGroupIdAndOrderRange(GROUP_ID, 1, 3))
+                .thenReturn(Arrays.asList(member, siblingB, siblingC));
+
+        service.updateInstanceBootGroupMember(cmd);
+
+        verify(instanceBootGroupMemberDao, never()).update(eq(11L), any());
+        verify(instanceBootGroupMemberDao, never()).update(eq(14L), any());
+        ArgumentCaptor<InstanceBootGroupMemberVO> captor = ArgumentCaptor.forClass(InstanceBootGroupMemberVO.class);
+        verify(instanceBootGroupMemberDao).update(eq(12L), captor.capture());
+        assertEquals(2, captor.getValue().getBootOrder());
+        verify(instanceBootGroupMemberDao).update(eq(13L), captor.capture());
+        assertEquals(3, captor.getValue().getBootOrder());
+        verify(instanceBootGroupMemberDao).update(eq(MEMBER_ID), captor.capture());
+        assertEquals(1, captor.getValue().getBootOrder());
+    }
+
+    // ---------------------------------------------------------------- listInstanceBootGroupMembers / readiness
+
+    private ListInstanceBootGroupMembersCmd baseListMembersCmd(boolean readiness, boolean children, boolean ignoreState) {
+        ListInstanceBootGroupMembersCmd cmd = mock(ListInstanceBootGroupMembersCmd.class);
+        when(cmd.getBootGroupId()).thenReturn(GROUP_ID);
+        when(cmd.getMemberType()).thenReturn(null);
+        when(cmd.isReadinessDetailRequested()).thenReturn(readiness);
+        when(cmd.isChildrenDetailRequested()).thenReturn(children);
+        when(cmd.isIgnoreInstanceState()).thenReturn(ignoreState);
+        return cmd;
+    }
+
+    @Test
+    public void testListInstanceBootGroupMembersSortedByOrder() {
+        ListInstanceBootGroupMembersCmd cmd = baseListMembersCmd(false, false, false);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+
+        InstanceBootGroupMemberVO memberHighOrder = newMember(1L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID, 5);
+        InstanceBootGroupMemberVO memberLowOrder = newMember(2L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM2_ID, 1);
+        ReflectionTestUtils.setField(memberHighOrder, "uuid", "uuid-high-order");
+        ReflectionTestUtils.setField(memberLowOrder, "uuid", "uuid-low-order");
+        when(instanceBootGroupMemberDao.searchAndCountByBootGroupId(GROUP_ID))
+                .thenReturn(new com.cloud.utils.Pair<>(new ArrayList<>(Arrays.asList(memberHighOrder, memberLowOrder)), 2));
+        when(userVmDao.findById(VM_ID)).thenReturn(newVm(VM_ID, "vm1", "vm1host", ACCOUNT_ID, VirtualMachine.State.Running));
+        when(userVmDao.findById(VM2_ID)).thenReturn(newVm(VM2_ID, "vm2", "vm2host", ACCOUNT_ID, VirtualMachine.State.Running));
+
+        ListResponse<InstanceBootGroupMemberResponse> response = service.listInstanceBootGroupMembers(cmd);
+
+        assertEquals(2, response.getResponses().size());
+        assertEquals("uuid-low-order", field(response.getResponses().get(0), "id"));
+        assertEquals("uuid-high-order", field(response.getResponses().get(1), "id"));
+    }
+
+    @Test
+    public void testListInstanceBootGroupMembersNoRulesRunningVmIsReady() {
+        ListInstanceBootGroupMembersCmd cmd = baseListMembersCmd(true, false, false);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        InstanceBootGroupMemberVO member = newMember(1L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID, 0);
+        when(instanceBootGroupMemberDao.searchAndCountByBootGroupId(GROUP_ID))
+                .thenReturn(new com.cloud.utils.Pair<>(new ArrayList<>(Collections.singletonList(member)), 1));
+        when(userVmDao.findById(VM_ID)).thenReturn(newVm(VM_ID, "vm1", "vm1host", ACCOUNT_ID, VirtualMachine.State.Running));
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID))
+                .thenReturn(Collections.emptyList());
+        when(instanceBootGroupReadinessRuleService.findInheritedGroupRules(GROUP_ID, VM_ID)).thenReturn(Collections.emptyList());
+
+        ListResponse<InstanceBootGroupMemberResponse> response = service.listInstanceBootGroupMembers(cmd);
+
+        InstanceBootGroupMemberResponse memberResponse = response.getResponses().get(0);
+        assertEquals("Ready", field(memberResponse, "readinessStatus"));
+        assertEquals("None", field(memberResponse, "readinessMode"));
+        assertTrue(field(memberResponse, "readinessMessage").contains("No readiness rules attached"));
+    }
+
+    @Test
+    public void testListInstanceBootGroupMembersNoRulesStoppedVmIsNotReady() {
+        ListInstanceBootGroupMembersCmd cmd = baseListMembersCmd(true, false, false);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        InstanceBootGroupMemberVO member = newMember(1L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID, 0);
+        when(instanceBootGroupMemberDao.searchAndCountByBootGroupId(GROUP_ID))
+                .thenReturn(new com.cloud.utils.Pair<>(new ArrayList<>(Collections.singletonList(member)), 1));
+        when(userVmDao.findById(VM_ID)).thenReturn(newVm(VM_ID, "vm1", "vm1host", ACCOUNT_ID, VirtualMachine.State.Stopped));
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID))
+                .thenReturn(Collections.emptyList());
+        when(instanceBootGroupReadinessRuleService.findInheritedGroupRules(GROUP_ID, VM_ID)).thenReturn(Collections.emptyList());
+
+        ListResponse<InstanceBootGroupMemberResponse> response = service.listInstanceBootGroupMembers(cmd);
+
+        InstanceBootGroupMemberResponse memberResponse = response.getResponses().get(0);
+        assertEquals("NotReady", field(memberResponse, "readinessStatus"));
+    }
+
+    @Test
+    public void testListInstanceBootGroupMembersWithRulesStoppedVmForcedNotReadyRegardlessOfCache() {
+        ListInstanceBootGroupMembersCmd cmd = baseListMembersCmd(true, false, false);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        InstanceBootGroupMemberVO member = newMember(1L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID, 0);
+        when(instanceBootGroupMemberDao.searchAndCountByBootGroupId(GROUP_ID))
+                .thenReturn(new com.cloud.utils.Pair<>(new ArrayList<>(Collections.singletonList(member)), 1));
+        when(userVmDao.findById(VM_ID)).thenReturn(newVm(VM_ID, "vm1", "vm1host", ACCOUNT_ID, VirtualMachine.State.Stopped));
+        InstanceBootGroupReadinessRuleVO rule = newRule(RULE_ID, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID,
+                InstanceBootGroupReadinessRule.RuleType.Ping, true, "ping-rule");
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID))
+                .thenReturn(Collections.singletonList(rule));
+        when(instanceBootGroupReadinessRuleService.findInheritedGroupRules(GROUP_ID, VM_ID)).thenReturn(Collections.emptyList());
+
+        ListResponse<InstanceBootGroupMemberResponse> response = service.listInstanceBootGroupMembers(cmd);
+
+        InstanceBootGroupMemberResponse memberResponse = response.getResponses().get(0);
+        assertEquals("NotReady", field(memberResponse, "readinessStatus"));
+        assertTrue(field(memberResponse, "readinessMessage").contains("Instance state is Stopped"));
+        verify(instanceBootGroupReadinessCheckResultDao, never()).findByRuleAndVm(RULE_ID, 0L);
+    }
+
+    @Test
+    public void testListInstanceBootGroupMembersIgnoreVmStateUsesCachedRuleResult() {
+        ListInstanceBootGroupMembersCmd cmd = baseListMembersCmd(true, false, true);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        InstanceBootGroupMemberVO member = newMember(1L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID, 0);
+        when(instanceBootGroupMemberDao.searchAndCountByBootGroupId(GROUP_ID))
+                .thenReturn(new com.cloud.utils.Pair<>(new ArrayList<>(Collections.singletonList(member)), 1));
+        when(userVmDao.findById(VM_ID)).thenReturn(newVm(VM_ID, "vm1", "vm1host", ACCOUNT_ID, VirtualMachine.State.Stopped));
+        InstanceBootGroupReadinessRuleVO rule = newRule(RULE_ID, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID,
+                InstanceBootGroupReadinessRule.RuleType.Ping, true, "ping-rule");
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID))
+                .thenReturn(Collections.singletonList(rule));
+        when(instanceBootGroupReadinessRuleService.findInheritedGroupRules(GROUP_ID, VM_ID)).thenReturn(Collections.emptyList());
+        when(instanceBootGroupReadinessCheckResultDao.findByRuleAndVm(RULE_ID, 0L))
+                .thenReturn(new InstanceBootGroupReadinessCheckResultVO(RULE_ID, 0L, InstanceBootGroupReadinessRule.Status.NotReady, "timeout", new Date()));
+
+        ListResponse<InstanceBootGroupMemberResponse> response = service.listInstanceBootGroupMembers(cmd);
+
+        InstanceBootGroupMemberResponse memberResponse = response.getResponses().get(0);
+        assertEquals("NotReady", field(memberResponse, "readinessStatus"));
+        assertEquals("Ping: timeout", field(memberResponse, "readinessMessage"));
+        assertEquals("RuleBased", field(memberResponse, "readinessMode"));
+    }
+
+    @Test
+    public void testListInstanceBootGroupMembersInstanceGroupMemberQuorumExcludesOwnStatusFromAggregate() {
+        ListInstanceBootGroupMembersCmd cmd = baseListMembersCmd(true, true, false);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        InstanceBootGroupMemberVO member = newMember(1L, GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID, 0);
+        when(instanceBootGroupMemberDao.searchAndCountByBootGroupId(GROUP_ID))
+                .thenReturn(new com.cloud.utils.Pair<>(new ArrayList<>(Collections.singletonList(member)), 1));
+        InstanceGroupVO instanceGroup = newInstanceGroup(INSTANCE_GROUP_ID, "ig1", ACCOUNT_ID);
+        when(instanceGroupDao.findById(INSTANCE_GROUP_ID)).thenReturn(instanceGroup);
+
+        InstanceGroupVMMapVO map1 = new InstanceGroupVMMapVO(INSTANCE_GROUP_ID, VM_ID);
+        InstanceGroupVMMapVO map2 = new InstanceGroupVMMapVO(INSTANCE_GROUP_ID, VM2_ID);
+        when(instanceGroupVMMapDao.listByGroupId(INSTANCE_GROUP_ID)).thenReturn(Arrays.asList(map1, map2));
+        when(userVmDao.listByIds(any())).thenReturn(Arrays.asList(
+                newVm(VM_ID, "vm1", "vm1host", ACCOUNT_ID, VirtualMachine.State.Running),
+                newVm(VM2_ID, "vm2", "vm2host", ACCOUNT_ID, VirtualMachine.State.Stopped)));
+        when(userVmDao.findById(VM_ID)).thenReturn(newVm(VM_ID, "vm1", "vm1host", ACCOUNT_ID, VirtualMachine.State.Running));
+        when(userVmDao.findById(VM2_ID)).thenReturn(newVm(VM2_ID, "vm2", "vm2host", ACCOUNT_ID, VirtualMachine.State.Stopped));
+
+        InstanceBootGroupReadinessRuleVO quorumRule = newRule(RULE_ID, GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID,
+                InstanceBootGroupReadinessRule.RuleType.MemberQuorum, true, "quorum-rule");
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID))
+                .thenReturn(Collections.singletonList(quorumRule));
+        when(instanceBootGroupReadinessCheckResultDao.findByRuleAndVm(RULE_ID, 0L))
+                .thenReturn(new InstanceBootGroupReadinessCheckResultVO(RULE_ID, 0L, InstanceBootGroupReadinessRule.Status.Ready, "quorum met", new Date()));
+        // VM children have no direct rules of their own
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID))
+                .thenReturn(Collections.emptyList());
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM2_ID))
+                .thenReturn(Collections.emptyList());
+        when(instanceBootGroupReadinessRuleService.findInheritedGroupRules(eq(GROUP_ID), anyLong())).thenReturn(Collections.emptyList());
+
+        ListResponse<InstanceBootGroupMemberResponse> response = service.listInstanceBootGroupMembers(cmd);
+
+        InstanceBootGroupMemberResponse memberResponse = response.getResponses().get(0);
+        // Own MemberQuorum result is Ready, so the group is Ready even though one child VM is NotReady.
+        assertEquals("Ready", field(memberResponse, "readinessStatus"));
+        assertEquals("1 of 2 member VM(s) not ready", field(memberResponse, "readinessMessage"));
+        assertEquals("RuleBased", field(memberResponse, "readinessMode"));
+    }
+
+    @Test
+    public void testListInstanceBootGroupMembersInstanceGroupMemberQuorumOverridesFailingMemberTargetedRule() {
+        ListInstanceBootGroupMembersCmd cmd = baseListMembersCmd(true, true, false);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        InstanceBootGroupMemberVO member = newMember(1L, GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID, 0);
+        when(instanceBootGroupMemberDao.searchAndCountByBootGroupId(GROUP_ID))
+                .thenReturn(new com.cloud.utils.Pair<>(new ArrayList<>(Collections.singletonList(member)), 1));
+        InstanceGroupVO instanceGroup = newInstanceGroup(INSTANCE_GROUP_ID, "ig1", ACCOUNT_ID);
+        when(instanceGroupDao.findById(INSTANCE_GROUP_ID)).thenReturn(instanceGroup);
+
+        InstanceGroupVMMapVO map1 = new InstanceGroupVMMapVO(INSTANCE_GROUP_ID, VM_ID);
+        InstanceGroupVMMapVO map2 = new InstanceGroupVMMapVO(INSTANCE_GROUP_ID, VM2_ID);
+        when(instanceGroupVMMapDao.listByGroupId(INSTANCE_GROUP_ID)).thenReturn(Arrays.asList(map1, map2));
+        when(userVmDao.listByIds(any())).thenReturn(Arrays.asList(
+                newVm(VM_ID, "vm1", "vm1host", ACCOUNT_ID, VirtualMachine.State.Running),
+                newVm(VM2_ID, "vm2", "vm2host", ACCOUNT_ID, VirtualMachine.State.Running)));
+        when(userVmDao.findById(VM_ID)).thenReturn(newVm(VM_ID, "vm1", "vm1host", ACCOUNT_ID, VirtualMachine.State.Running));
+        when(userVmDao.findById(VM2_ID)).thenReturn(newVm(VM2_ID, "vm2", "vm2host", ACCOUNT_ID, VirtualMachine.State.Running));
+
+        InstanceBootGroupReadinessRuleVO guestAgentRule = newRule(RULE_ID, GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID,
+                InstanceBootGroupReadinessRule.RuleType.GuestAgentLiveness, true, "guest-agent-rule");
+        InstanceBootGroupReadinessRuleVO quorumRule = newRule(501L, GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID,
+                InstanceBootGroupReadinessRule.RuleType.MemberQuorum, true, "quorum-rule");
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID))
+                .thenReturn(Arrays.asList(guestAgentRule, quorumRule));
+        when(instanceBootGroupReadinessCheckResultDao.findByRuleAndVm(501L, 0L))
+                .thenReturn(new InstanceBootGroupReadinessCheckResultVO(501L, 0L, InstanceBootGroupReadinessRule.Status.Ready, "quorum met", new Date()));
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID))
+                .thenReturn(Collections.emptyList());
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM2_ID))
+                .thenReturn(Collections.emptyList());
+        when(instanceBootGroupReadinessRuleService.findInheritedGroupRules(eq(GROUP_ID), anyLong())).thenReturn(Collections.emptyList());
+
+        ListResponse<InstanceBootGroupMemberResponse> response = service.listInstanceBootGroupMembers(cmd);
+
+        InstanceBootGroupMemberResponse memberResponse = response.getResponses().get(0);
+        // The failing GuestAgentLiveness aggregate must not veto the group once MemberQuorum is met —
+        // its cached row isn't even consulted for the overall verdict.
+        assertEquals("Ready", field(memberResponse, "readinessStatus"));
+        verify(instanceBootGroupReadinessCheckResultDao, never()).findByRuleAndVm(RULE_ID, 0L);
+    }
+
+    /**
+     * A group-scope rule (MemberQuorum in particular) isn't tied to any one VM, so nothing else
+     * re-derives it once a member stops outside of active orchestration — reading the member list
+     * must refresh it first, or it can keep reporting a stale Ready from the last successful start.
+     */
+    @Test
+    public void testListInstanceBootGroupMembersRefreshesGroupOwnRulesBeforeReadingCache() {
+        ListInstanceBootGroupMembersCmd cmd = baseListMembersCmd(true, false, false);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        InstanceBootGroupMemberVO member = newMember(1L, GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID, 0);
+        when(instanceBootGroupMemberDao.searchAndCountByBootGroupId(GROUP_ID))
+                .thenReturn(new com.cloud.utils.Pair<>(new ArrayList<>(Collections.singletonList(member)), 1));
+        InstanceGroupVO instanceGroup = newInstanceGroup(INSTANCE_GROUP_ID, "ig1", ACCOUNT_ID);
+        when(instanceGroupDao.findById(INSTANCE_GROUP_ID)).thenReturn(instanceGroup);
+        when(instanceGroupVMMapDao.listByGroupId(INSTANCE_GROUP_ID)).thenReturn(Collections.emptyList());
+
+        InstanceBootGroupReadinessRuleVO quorumRule = newRule(RULE_ID, GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID,
+                InstanceBootGroupReadinessRule.RuleType.MemberQuorum, true, "quorum-rule");
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID))
+                .thenReturn(Collections.singletonList(quorumRule));
+        when(instanceBootGroupReadinessCheckResultDao.findByRuleAndVm(RULE_ID, 0L))
+                .thenReturn(new InstanceBootGroupReadinessCheckResultVO(RULE_ID, 0L, InstanceBootGroupReadinessRule.Status.Ready, "stale", new Date()));
+
+        service.listInstanceBootGroupMembers(cmd);
+
+        verify(instanceBootGroupReadinessRuleService).evaluateInstanceGroupReadiness(GROUP_ID, INSTANCE_GROUP_ID, Collections.emptySet());
+    }
+
+    @Test
+    public void testListInstanceBootGroupMembersIgnoreVmStateSkipsGroupOwnRuleRefresh() {
+        ListInstanceBootGroupMembersCmd cmd = baseListMembersCmd(true, false, true);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        InstanceBootGroupMemberVO member = newMember(1L, GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID, 0);
+        when(instanceBootGroupMemberDao.searchAndCountByBootGroupId(GROUP_ID))
+                .thenReturn(new com.cloud.utils.Pair<>(new ArrayList<>(Collections.singletonList(member)), 1));
+        InstanceGroupVO instanceGroup = newInstanceGroup(INSTANCE_GROUP_ID, "ig1", ACCOUNT_ID);
+        when(instanceGroupDao.findById(INSTANCE_GROUP_ID)).thenReturn(instanceGroup);
+        when(instanceGroupVMMapDao.listByGroupId(INSTANCE_GROUP_ID)).thenReturn(Collections.emptyList());
+
+        InstanceBootGroupReadinessRuleVO quorumRule = newRule(RULE_ID, GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID,
+                InstanceBootGroupReadinessRule.RuleType.MemberQuorum, true, "quorum-rule");
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID))
+                .thenReturn(Collections.singletonList(quorumRule));
+        when(instanceBootGroupReadinessCheckResultDao.findByRuleAndVm(RULE_ID, 0L))
+                .thenReturn(new InstanceBootGroupReadinessCheckResultVO(RULE_ID, 0L, InstanceBootGroupReadinessRule.Status.Ready, "last known", new Date()));
+
+        service.listInstanceBootGroupMembers(cmd);
+
+        verify(instanceBootGroupReadinessRuleService, never()).evaluateInstanceGroupReadiness(anyLong(), anyLong(), any());
+    }
+
+    @Test
+    public void testListInstanceBootGroupMembersInstanceGroupWithoutQuorumRequiresAllChildrenReady() {
+        ListInstanceBootGroupMembersCmd cmd = baseListMembersCmd(true, true, false);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        InstanceBootGroupMemberVO member = newMember(1L, GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID, 0);
+        when(instanceBootGroupMemberDao.searchAndCountByBootGroupId(GROUP_ID))
+                .thenReturn(new com.cloud.utils.Pair<>(new ArrayList<>(Collections.singletonList(member)), 1));
+        InstanceGroupVO instanceGroup = newInstanceGroup(INSTANCE_GROUP_ID, "ig1", ACCOUNT_ID);
+        when(instanceGroupDao.findById(INSTANCE_GROUP_ID)).thenReturn(instanceGroup);
+
+        InstanceGroupVMMapVO map1 = new InstanceGroupVMMapVO(INSTANCE_GROUP_ID, VM_ID);
+        InstanceGroupVMMapVO map2 = new InstanceGroupVMMapVO(INSTANCE_GROUP_ID, VM2_ID);
+        when(instanceGroupVMMapDao.listByGroupId(INSTANCE_GROUP_ID)).thenReturn(Arrays.asList(map1, map2));
+        UserVmVO runningVm = newVm(VM_ID, "vm1", "vm1host", ACCOUNT_ID, VirtualMachine.State.Running);
+        UserVmVO stoppedVm = newVm(VM2_ID, "vm2", "vm2host", ACCOUNT_ID, VirtualMachine.State.Stopped);
+        when(userVmDao.listByIds(any())).thenReturn(Arrays.asList(runningVm, stoppedVm));
+        when(userVmDao.findById(VM_ID)).thenReturn(runningVm);
+        when(userVmDao.findById(VM2_ID)).thenReturn(stoppedVm);
+
+        // No group-scope rules attached -> ChildDependent mode, all children must be Ready.
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID))
+                .thenReturn(Collections.emptyList());
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID))
+                .thenReturn(Collections.emptyList());
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM2_ID))
+                .thenReturn(Collections.emptyList());
+        when(instanceBootGroupReadinessRuleService.findInheritedGroupRules(eq(GROUP_ID), anyLong())).thenReturn(Collections.emptyList());
+
+        ListResponse<InstanceBootGroupMemberResponse> response = service.listInstanceBootGroupMembers(cmd);
+
+        InstanceBootGroupMemberResponse memberResponse = response.getResponses().get(0);
+        assertEquals("NotReady", field(memberResponse, "readinessStatus"));
+        assertEquals("1 of 2 member VM(s) not ready", field(memberResponse, "readinessMessage"));
+        assertEquals("ChildDependent", field(memberResponse, "readinessMode"));
+
+        @SuppressWarnings("unchecked")
+        List<InstanceBootGroupMemberChildResponse> children =
+                (List<InstanceBootGroupMemberChildResponse>) ReflectionTestUtils.getField(memberResponse, "children");
+        assertNotNull(children);
+        assertEquals(2, children.size());
+    }
+
+    // ---------------------------------------------------------------- start/stop/reboot
+
+    @Test
+    public void testStartInstanceBootGroupDelegatesToManager() {
+        StartInstanceBootGroupCmd cmd = mock(StartInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+
+        InstanceBootGroup result = service.startInstanceBootGroup(cmd);
+
+        assertEquals(group, result);
+        verify(instanceBootGroupManager).startInstanceBootGroup(group);
+    }
+
+    @Test
+    public void testStopInstanceBootGroupDelegatesToManager() {
+        StopInstanceBootGroupCmd cmd = mock(StopInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+
+        InstanceBootGroup result = service.stopInstanceBootGroup(cmd);
+
+        assertEquals(group, result);
+        verify(instanceBootGroupManager).stopInstanceBootGroup(group, false);
+    }
+
+    @Test
+    public void testStopInstanceBootGroupDelegatesForcedFlagToManager() {
+        StopInstanceBootGroupCmd cmd = mock(StopInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        when(cmd.isForced()).thenReturn(true);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+
+        service.stopInstanceBootGroup(cmd);
+
+        verify(instanceBootGroupManager).stopInstanceBootGroup(group, true);
+    }
+
+    @Test
+    public void testRebootInstanceBootGroupDelegatesToManager() {
+        RebootInstanceBootGroupCmd cmd = mock(RebootInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+
+        InstanceBootGroup result = service.rebootInstanceBootGroup(cmd);
+
+        assertEquals(group, result);
+        verify(instanceBootGroupManager).rebootInstanceBootGroup(group, false);
+    }
+
+    @Test
+    public void testRebootInstanceBootGroupDelegatesForcedFlagToManager() {
+        RebootInstanceBootGroupCmd cmd = mock(RebootInstanceBootGroupCmd.class);
+        when(cmd.getId()).thenReturn(GROUP_ID);
+        when(cmd.isForced()).thenReturn(true);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+
+        service.rebootInstanceBootGroup(cmd);
+
+        verify(instanceBootGroupManager).rebootInstanceBootGroup(group, true);
+    }
+
+    // ---------------------------------------------------------------- readiness rule create/update/delete
+
+    @Test
+    public void testCreateInstanceBootGroupReadinessRuleSuccess() {
+        CreateInstanceBootGroupReadinessRuleCmd cmd = mock(CreateInstanceBootGroupReadinessRuleCmd.class);
+        when(cmd.getBootGroupId()).thenReturn(GROUP_ID);
+        when(cmd.getVirtualMachineId()).thenReturn(VM_ID);
+        when(cmd.getInstanceGroupId()).thenReturn(null);
+        when(cmd.getRuleType()).thenReturn("Ping");
+        when(cmd.getName()).thenReturn("rule1");
+        when(cmd.isEnabled()).thenReturn(true);
+        when(cmd.getDetails()).thenReturn(null);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        UserVmVO vm = newVm(VM_ID, "vm1", "vm1host", ACCOUNT_ID, VirtualMachine.State.Running);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm);
+        InstanceBootGroupReadinessRule created = mock(InstanceBootGroupReadinessRule.class);
+        when(instanceBootGroupReadinessRuleService.createReadinessRule(GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID,
+                InstanceBootGroupReadinessRule.RuleType.Ping, "rule1", true, null)).thenReturn(created);
+
+        InstanceBootGroupReadinessRule result = service.createInstanceBootGroupReadinessRule(cmd);
+
+        assertEquals(created, result);
+        verify(accountManager).checkAccess(callerMock, null, true, vm);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testCreateInstanceBootGroupReadinessRuleInvalidRuleTypeThrows() {
+        CreateInstanceBootGroupReadinessRuleCmd cmd = mock(CreateInstanceBootGroupReadinessRuleCmd.class);
+        when(cmd.getBootGroupId()).thenReturn(GROUP_ID);
+        when(cmd.getVirtualMachineId()).thenReturn(VM_ID);
+        when(cmd.getInstanceGroupId()).thenReturn(null);
+        when(cmd.getRuleType()).thenReturn("NotARealType");
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        UserVmVO vm = newVm(VM_ID, "vm1", "vm1host", ACCOUNT_ID, VirtualMachine.State.Running);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm);
+
+        service.createInstanceBootGroupReadinessRule(cmd);
+    }
+
+    @Test
+    public void testUpdateInstanceBootGroupReadinessRuleSuccess() {
+        UpdateInstanceBootGroupReadinessRuleCmd cmd = mock(UpdateInstanceBootGroupReadinessRuleCmd.class);
+        when(cmd.getId()).thenReturn(RULE_ID);
+        when(cmd.getName()).thenReturn("newname");
+        when(cmd.getEnabled()).thenReturn(false);
+        when(cmd.getDetails()).thenReturn(null);
+        InstanceBootGroupReadinessRuleVO rule = newRule(RULE_ID, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID,
+                InstanceBootGroupReadinessRule.RuleType.Ping, true, "oldname");
+        when(instanceBootGroupReadinessRuleDao.findById(RULE_ID)).thenReturn(rule);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        InstanceBootGroupReadinessRule updated = mock(InstanceBootGroupReadinessRule.class);
+        when(instanceBootGroupReadinessRuleService.updateReadinessRule(RULE_ID, "newname", false, null)).thenReturn(updated);
+
+        InstanceBootGroupReadinessRule result = service.updateInstanceBootGroupReadinessRule(cmd);
+
+        assertEquals(updated, result);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testUpdateInstanceBootGroupReadinessRuleNotFoundThrows() {
+        UpdateInstanceBootGroupReadinessRuleCmd cmd = mock(UpdateInstanceBootGroupReadinessRuleCmd.class);
+        when(cmd.getId()).thenReturn(RULE_ID);
+        when(instanceBootGroupReadinessRuleDao.findById(RULE_ID)).thenReturn(null);
+
+        service.updateInstanceBootGroupReadinessRule(cmd);
+    }
+
+    @Test
+    public void testDeleteInstanceBootGroupReadinessRuleSuccess() {
+        DeleteInstanceBootGroupReadinessRuleCmd cmd = mock(DeleteInstanceBootGroupReadinessRuleCmd.class);
+        when(cmd.getId()).thenReturn(RULE_ID);
+        InstanceBootGroupReadinessRuleVO rule = newRule(RULE_ID, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID,
+                InstanceBootGroupReadinessRule.RuleType.Ping, true, "rule1");
+        when(instanceBootGroupReadinessRuleDao.findById(RULE_ID)).thenReturn(rule);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+        when(instanceBootGroupReadinessRuleService.deleteReadinessRule(RULE_ID)).thenReturn(true);
+
+        boolean result = service.deleteInstanceBootGroupReadinessRule(cmd);
+
+        assertTrue(result);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testDeleteInstanceBootGroupReadinessRuleNotFoundThrows() {
+        DeleteInstanceBootGroupReadinessRuleCmd cmd = mock(DeleteInstanceBootGroupReadinessRuleCmd.class);
+        when(cmd.getId()).thenReturn(RULE_ID);
+        when(instanceBootGroupReadinessRuleDao.findById(RULE_ID)).thenReturn(null);
+
+        service.deleteInstanceBootGroupReadinessRule(cmd);
+    }
+
+    // ---------------------------------------------------------------- listInstanceBootGroupReadinessRules
+
+    @Test
+    public void testListInstanceBootGroupReadinessRulesSurfacesInheritedRulesForVm() {
+        ListInstanceBootGroupReadinessRulesCmd cmd = mock(ListInstanceBootGroupReadinessRulesCmd.class);
+        when(cmd.getBootGroupId()).thenReturn(GROUP_ID);
+        when(cmd.getId()).thenReturn(null);
+        when(cmd.getVirtualMachineId()).thenReturn(VM_ID);
+        when(cmd.getInstanceGroupId()).thenReturn(null);
+        when(cmd.getRuleType()).thenReturn(null);
+        when(cmd.getKeyword()).thenReturn(null);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+
+        InstanceBootGroupReadinessRuleVO directRule = newRule(RULE_ID, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID,
+                InstanceBootGroupReadinessRule.RuleType.GuestAgentLiveness, true, "direct-rule");
+        when(instanceBootGroupReadinessRuleDao.searchAndCountByBootGroupId(eq(GROUP_ID), eq((Long) null),
+                eq(InstanceBootGroupMember.MemberType.VirtualMachine), eq(VM_ID), eq((InstanceBootGroupReadinessRule.RuleType) null),
+                any(), any(), any()))
+                .thenReturn(new com.cloud.utils.Pair<>(Collections.singletonList(directRule), 1));
+
+        InstanceBootGroupReadinessRuleVO inheritedRule = newRule(RULE_ID + 1, GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID,
+                InstanceBootGroupReadinessRule.RuleType.Ping, true, "inherited-rule");
+        when(instanceBootGroupReadinessRuleService.findInheritedGroupRules(GROUP_ID, VM_ID)).thenReturn(Collections.singletonList(inheritedRule));
+
+        ListResponse<InstanceBootGroupReadinessRuleResponse> response = service.listInstanceBootGroupReadinessRules(cmd);
+
+        assertEquals(2, response.getResponses().size());
+        assertEquals(Integer.valueOf(2), response.getCount());
+        InstanceBootGroupReadinessRuleResponse directResponse = response.getResponses().get(0);
+        InstanceBootGroupReadinessRuleResponse inheritedResponse = response.getResponses().get(1);
+        assertEquals("false", field(directResponse, "inherited"));
+        assertEquals("true", field(inheritedResponse, "inherited"));
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListInstanceBootGroupReadinessRulesBothIdsSpecifiedThrows() {
+        ListInstanceBootGroupReadinessRulesCmd cmd = mock(ListInstanceBootGroupReadinessRulesCmd.class);
+        when(cmd.getBootGroupId()).thenReturn(GROUP_ID);
+        when(cmd.getVirtualMachineId()).thenReturn(VM_ID);
+        when(cmd.getInstanceGroupId()).thenReturn(INSTANCE_GROUP_ID);
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+
+        service.listInstanceBootGroupReadinessRules(cmd);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListInstanceBootGroupReadinessRulesInvalidRuleTypeThrows() {
+        ListInstanceBootGroupReadinessRulesCmd cmd = mock(ListInstanceBootGroupReadinessRulesCmd.class);
+        when(cmd.getBootGroupId()).thenReturn(GROUP_ID);
+        when(cmd.getVirtualMachineId()).thenReturn(null);
+        when(cmd.getRuleType()).thenReturn("Bogus");
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1", ACCOUNT_ID);
+        when(instanceBootGroupDao.findById(GROUP_ID)).thenReturn(group);
+
+        service.listInstanceBootGroupReadinessRules(cmd);
+    }
+}
diff --git a/server/src/test/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupManagerImplTest.java b/server/src/test/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupManagerImplTest.java
new file mode 100644
index 000000000000..ab9b3346abea
--- /dev/null
+++ b/server/src/test/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupManagerImplTest.java
@@ -0,0 +1,819 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.when;
+
+import java.lang.reflect.Constructor;
+import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRuleService;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InOrder;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import com.cloud.user.Account;
+import com.cloud.user.User;
+import com.cloud.utils.db.EntityManager;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.vm.InstanceGroupVMMapVO;
+import com.cloud.vm.InstanceGroupVO;
+import com.cloud.vm.UserVmService;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.VirtualMachineManager;
+import com.cloud.vm.dao.InstanceBootGroupDetailsDao;
+import com.cloud.vm.dao.InstanceBootGroupMemberDao;
+import com.cloud.vm.dao.InstanceGroupDao;
+import com.cloud.vm.dao.InstanceGroupVMMapDao;
+import com.cloud.vm.dao.UserVmDao;
+
+@RunWith(MockitoJUnitRunner.class)
+public class InstanceBootGroupManagerImplTest {
+
+    private static final long ACCOUNT_ID = 1L;
+    private static final long DOMAIN_ID = 1L;
+    private static final long GROUP_ID = 500L;
+    private static final long MEMBER_ID_1 = 601L;
+    private static final long MEMBER_ID_2 = 602L;
+    private static final long VM_ID_1 = 701L;
+    private static final long VM_ID_2 = 702L;
+    private static final long INSTANCE_GROUP_ID = 801L;
+
+    @InjectMocks
+    InstanceBootGroupManagerImpl manager;
+
+    @Mock
+    InstanceBootGroupMemberDao instanceBootGroupMemberDao;
+    @Mock
+    UserVmService userVmService;
+    @Mock
+    UserVmDao userVmDao;
+    @Mock
+    InstanceGroupDao instanceGroupDao;
+    @Mock
+    InstanceGroupVMMapDao instanceGroupVMMapDao;
+    @Mock
+    VirtualMachineManager virtualMachineManager;
+    @Mock
+    InstanceBootGroupReadinessRuleService instanceBootGroupReadinessRuleService;
+    @Mock
+    InstanceBootGroupDetailsDao instanceBootGroupDetailsDao;
+
+    private static final long CALLER_USER_ID = 2L;
+    private static final long CALLER_ACCOUNT_ID = 3L;
+
+    private static final Class<?> VM_PROGRESS_CLASS;
+
+    static {
+        try {
+            VM_PROGRESS_CLASS = Class.forName(InstanceBootGroupManagerImpl.class.getName() + "$VmProgress");
+        } catch (ClassNotFoundException e) {
+            throw new ExceptionInInitializerError(e);
+        }
+    }
+
+    // CallContext orchestration (runTierConcurrently / waitForTierReady) runs its per-VM actions on
+    // real pooled threads, so a MockedStatic<CallContext> (thread-confined) can't be used here — the
+    // worker threads would fall through to the real static methods and NPE on the uninitialized
+    // entity manager. Instead we back CallContext with a minimal real registration, resolvable from
+    // any thread via its normal ThreadLocal-based mechanism.
+    @Before
+    public void setUp() {
+        EntityManager entityManager = mock(EntityManager.class);
+        Account callerAccount = mock(Account.class);
+        when(callerAccount.getId()).thenReturn(CALLER_ACCOUNT_ID);
+        User callerUser = mock(User.class);
+        when(callerUser.getId()).thenReturn(CALLER_USER_ID);
+        when(entityManager.findById(eq(Account.class), any(Long.class))).thenReturn(callerAccount);
+        when(entityManager.findById(eq(User.class), any(Long.class))).thenReturn(callerUser);
+        CallContext.init(entityManager);
+        CallContext.register(callerUser, callerAccount);
+    }
+
+    @After
+    public void tearDown() {
+        CallContext.unregisterAll();
+    }
+
+    //
+    // Helpers
+    //
+
+    private InstanceBootGroupVO newGroup(long id, String name) {
+        InstanceBootGroupVO group = Mockito.spy(new InstanceBootGroupVO(name, "desc", ACCOUNT_ID, DOMAIN_ID));
+        Mockito.lenient().doReturn(id).when(group).getId();
+        return group;
+    }
+
+    private InstanceBootGroupMemberVO newMember(long id, long bootGroupId, InstanceBootGroupMember.MemberType type, long memberId, int order) {
+        InstanceBootGroupMemberVO member = Mockito.spy(new InstanceBootGroupMemberVO(bootGroupId, type, memberId, order));
+        Mockito.lenient().doReturn(id).when(member).getId();
+        return member;
+    }
+
+    private Object invokePrivate(String name, Class<?>[] paramTypes, Object... args) throws Exception {
+        Method m = InstanceBootGroupManagerImpl.class.getDeclaredMethod(name, paramTypes);
+        m.setAccessible(true);
+        try {
+            return m.invoke(manager, args);
+        } catch (InvocationTargetException e) {
+            if (e.getCause() instanceof Exception) {
+                throw (Exception) e.getCause();
+            }
+            throw e;
+        }
+    }
+
+    private Object newVmProgress(long vmId, Long memberId) throws Exception {
+        Constructor<?> ctor = VM_PROGRESS_CLASS.getDeclaredConstructor(long.class, Long.class);
+        ctor.setAccessible(true);
+        return ctor.newInstance(vmId, memberId);
+    }
+
+    private void setProgressField(Object progress, String field, Object value) throws Exception {
+        Field f = VM_PROGRESS_CLASS.getDeclaredField(field);
+        f.setAccessible(true);
+        f.set(progress, value);
+    }
+
+    private Object getProgressField(Object progress, String field) throws Exception {
+        Field f = VM_PROGRESS_CLASS.getDeclaredField(field);
+        f.setAccessible(true);
+        return f.get(progress);
+    }
+
+    //
+    // effective* config-override resolution
+    //
+
+    @Test
+    public void testEffectiveTimeoutSecondsUsesOverrideWhenPresent() throws Exception {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        when(instanceBootGroupDetailsDao.getDetail(GROUP_ID, InstanceBootGroupManagerImpl.ReadinessAttemptTimeoutSeconds.key()))
+                .thenReturn("120");
+        long result = (Long) invokePrivate("effectiveTimeoutSeconds", new Class<?>[]{InstanceBootGroupVO.class}, group);
+        assertEquals(120L, result);
+    }
+
+    @Test
+    public void testEffectiveTimeoutSecondsFallsBackToConfigDefault() throws Exception {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        when(instanceBootGroupDetailsDao.getDetail(GROUP_ID, InstanceBootGroupManagerImpl.ReadinessAttemptTimeoutSeconds.key()))
+                .thenReturn(null);
+        long result = (Long) invokePrivate("effectiveTimeoutSeconds", new Class<?>[]{InstanceBootGroupVO.class}, group);
+        assertEquals(300L, result);
+    }
+
+    @Test
+    public void testEffectiveMaxRetryAttemptsUsesOverrideWhenPresent() throws Exception {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        when(instanceBootGroupDetailsDao.getDetail(GROUP_ID, InstanceBootGroupManagerImpl.ReadinessMaxRetryAttempts.key()))
+                .thenReturn("2");
+        long result = (Long) invokePrivate("effectiveMaxRetryAttempts", new Class<?>[]{InstanceBootGroupVO.class}, group);
+        assertEquals(2L, result);
+    }
+
+    @Test
+    public void testEffectiveMaxRetryAttemptsFallsBackToConfigDefault() throws Exception {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        long result = (Long) invokePrivate("effectiveMaxRetryAttempts", new Class<?>[]{InstanceBootGroupVO.class}, group);
+        assertEquals(5L, result);
+    }
+
+    @Test
+    public void testEffectiveInitialDelaySecondsUsesOverrideWhenPresent() throws Exception {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        when(instanceBootGroupDetailsDao.getDetail(GROUP_ID, InstanceBootGroupManagerImpl.ReadinessInitialDelaySeconds.key()))
+                .thenReturn("5");
+        long result = (Long) invokePrivate("effectiveInitialDelaySeconds", new Class<?>[]{InstanceBootGroupVO.class}, group);
+        assertEquals(5L, result);
+    }
+
+    @Test
+    public void testEffectiveInitialDelaySecondsFallsBackToConfigDefault() throws Exception {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        long result = (Long) invokePrivate("effectiveInitialDelaySeconds", new Class<?>[]{InstanceBootGroupVO.class}, group);
+        assertEquals(30L, result);
+    }
+
+    @Test
+    public void testEffectiveRebootOnRetryUsesOverrideWhenPresent() throws Exception {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        when(instanceBootGroupDetailsDao.getDetail(GROUP_ID, InstanceBootGroupManagerImpl.ReadinessRebootOnRetry.key()))
+                .thenReturn("true");
+        boolean result = (Boolean) invokePrivate("effectiveRebootOnRetry", new Class<?>[]{InstanceBootGroupVO.class}, group);
+        assertTrue(result);
+    }
+
+    @Test
+    public void testEffectiveRebootOnRetryFallsBackToConfigDefault() throws Exception {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        boolean result = (Boolean) invokePrivate("effectiveRebootOnRetry", new Class<?>[]{InstanceBootGroupVO.class}, group);
+        assertFalse(result);
+    }
+
+    @Test
+    public void testEffectivePollIntervalSecondsIsGlobalOnly() throws Exception {
+        long result = (Long) invokePrivate("effectivePollIntervalSeconds", new Class<?>[]{});
+        assertEquals(10L, result);
+        verifyNoInteractions(instanceBootGroupDetailsDao);
+    }
+
+    @Test
+    public void testEffectiveReadinessCheckConcurrencyIsGlobalOnly() throws Exception {
+        long result = (Long) invokePrivate("effectiveReadinessCheckConcurrency", new Class<?>[]{});
+        assertEquals(10L, result);
+        verifyNoInteractions(instanceBootGroupDetailsDao);
+    }
+
+    //
+    // Tier grouping
+    //
+
+    @Test
+    @SuppressWarnings("unchecked")
+    public void testGroupByOrderGroupsAndSortsAscending() throws Exception {
+        InstanceBootGroupMemberVO m3 = newMember(1L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, 901L, 3);
+        InstanceBootGroupMemberVO m1a = newMember(2L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, 902L, 1);
+        InstanceBootGroupMemberVO m2 = newMember(3L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, 903L, 2);
+        InstanceBootGroupMemberVO m1b = newMember(4L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, 904L, 1);
+        List<InstanceBootGroupMemberVO> members = List.of(m3, m1a, m2, m1b);
+
+        Map<Integer, List<InstanceBootGroupMemberVO>> tiers = (Map<Integer, List<InstanceBootGroupMemberVO>>)
+                invokePrivate("groupByOrder", new Class<?>[]{List.class}, members);
+
+        assertEquals(List.of(1, 2, 3), new ArrayList<>(tiers.keySet()));
+        assertEquals(2, tiers.get(1).size());
+        assertEquals(1, tiers.get(2).size());
+        assertEquals(1, tiers.get(3).size());
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    public void testGroupByOrderDescendingSortsDescending() throws Exception {
+        InstanceBootGroupMemberVO m3 = newMember(1L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, 901L, 3);
+        InstanceBootGroupMemberVO m1 = newMember(2L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, 902L, 1);
+        InstanceBootGroupMemberVO m2 = newMember(3L, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, 903L, 2);
+        List<InstanceBootGroupMemberVO> members = List.of(m3, m1, m2);
+
+        Map<Integer, List<InstanceBootGroupMemberVO>> tiers = (Map<Integer, List<InstanceBootGroupMemberVO>>)
+                invokePrivate("groupByOrderDescending", new Class<?>[]{List.class}, members);
+
+        assertEquals(List.of(3, 2, 1), new ArrayList<>(tiers.keySet()));
+    }
+
+    //
+    // resolveVmIds
+    //
+
+    @Test
+    @SuppressWarnings("unchecked")
+    public void testResolveVmIdsDirectVmMember() throws Exception {
+        InstanceBootGroupMemberVO member = newMember(MEMBER_ID_1, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID_1, 1);
+        List<Long> ids = (List<Long>) invokePrivate("resolveVmIds", new Class<?>[]{List.class}, List.of(member));
+        assertEquals(List.of(VM_ID_1), ids);
+        verifyNoInteractions(instanceGroupVMMapDao);
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    public void testResolveVmIdsInstanceGroupMemberExpandsToGroupVms() throws Exception {
+        InstanceBootGroupMemberVO member = newMember(MEMBER_ID_1, GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID, 1);
+        InstanceGroupVMMapVO map1 = new InstanceGroupVMMapVO(INSTANCE_GROUP_ID, VM_ID_1);
+        InstanceGroupVMMapVO map2 = new InstanceGroupVMMapVO(INSTANCE_GROUP_ID, VM_ID_2);
+        when(instanceGroupVMMapDao.listByGroupId(INSTANCE_GROUP_ID)).thenReturn(List.of(map1, map2));
+
+        List<Long> ids = (List<Long>) invokePrivate("resolveVmIds", new Class<?>[]{List.class}, List.of(member));
+        assertEquals(List.of(VM_ID_1, VM_ID_2), ids);
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    public void testResolveVmIdsMixedMembers() throws Exception {
+        InstanceBootGroupMemberVO vmMember = newMember(MEMBER_ID_1, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID_1, 1);
+        InstanceBootGroupMemberVO groupMember = newMember(MEMBER_ID_2, GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID, 2);
+        InstanceGroupVMMapVO map1 = new InstanceGroupVMMapVO(INSTANCE_GROUP_ID, VM_ID_2);
+        when(instanceGroupVMMapDao.listByGroupId(INSTANCE_GROUP_ID)).thenReturn(List.of(map1));
+
+        List<Long> ids = (List<Long>) invokePrivate("resolveVmIds", new Class<?>[]{List.class}, List.of(vmMember, groupMember));
+        assertEquals(List.of(VM_ID_1, VM_ID_2), ids);
+    }
+
+    //
+    // anchorInitialDelay
+    //
+
+    @Test
+    public void testAnchorInitialDelayNotAlreadyRunningAnchorsToNow() throws Exception {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        Object progress = newVmProgress(VM_ID_1, MEMBER_ID_1);
+        UserVmVO vm = mock(UserVmVO.class);
+
+        long before = System.currentTimeMillis();
+        invokePrivate("anchorInitialDelay", new Class<?>[]{InstanceBootGroupVO.class, VM_PROGRESS_CLASS, UserVmVO.class, boolean.class},
+                group, progress, vm, false);
+        long after = System.currentTimeMillis();
+
+        long entered = (Long) getProgressField(progress, "enteredWaitAtMs");
+        long lastBooted = (Long) getProgressField(progress, "lastBootedAtMs");
+        assertTrue(entered >= before && entered <= after);
+        assertEquals(entered, lastBooted);
+    }
+
+    @Test
+    public void testAnchorInitialDelayAlreadyRunningUsesPowerStateUpdateTime() throws Exception {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        Object progress = newVmProgress(VM_ID_1, MEMBER_ID_1);
+        UserVmVO vm = mock(UserVmVO.class);
+        Date powerStateTime = new Date(System.currentTimeMillis() - 5000);
+        when(vm.getPowerStateUpdateTime()).thenReturn(powerStateTime);
+
+        invokePrivate("anchorInitialDelay", new Class<?>[]{InstanceBootGroupVO.class, VM_PROGRESS_CLASS, UserVmVO.class, boolean.class},
+                group, progress, vm, true);
+
+        long lastBooted = (Long) getProgressField(progress, "lastBootedAtMs");
+        assertEquals(powerStateTime.getTime(), lastBooted);
+    }
+
+    @Test
+    public void testAnchorInitialDelayAlreadyRunningWithNullPowerStateFallsBackToNow() throws Exception {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        Object progress = newVmProgress(VM_ID_1, MEMBER_ID_1);
+        UserVmVO vm = mock(UserVmVO.class);
+        when(vm.getPowerStateUpdateTime()).thenReturn(null);
+
+        long before = System.currentTimeMillis();
+        invokePrivate("anchorInitialDelay", new Class<?>[]{InstanceBootGroupVO.class, VM_PROGRESS_CLASS, UserVmVO.class, boolean.class},
+                group, progress, vm, true);
+        long after = System.currentTimeMillis();
+
+        long lastBooted = (Long) getProgressField(progress, "lastBootedAtMs");
+        assertTrue(lastBooted >= before && lastBooted <= after);
+    }
+
+    //
+    // halt
+    //
+
+    @Test
+    public void testHaltDoesNotThrow() throws Exception {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        invokePrivate("halt", new Class<?>[]{InstanceBootGroupVO.class, String.class}, group, "some reason");
+    }
+
+    //
+    // checkVmReadiness
+    //
+
+    /**
+     * Regression test: with maxAttempts retry attempts configured, a permanently-failing check must
+     * be evaluated exactly maxAttempts times and halt on that Nth attempt — not on an (N+1)th call,
+     * and the halt message must report "N/N", not "(N+1)/N".
+     */
+    @Test
+    public void testCheckVmReadinessGivesUpAfterExactlyMaxAttemptsNotOneMore() {
+        final long maxAttempts = 3L;
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        InstanceBootGroupManagerImpl.VmProgress progress = new InstanceBootGroupManagerImpl.VmProgress(VM_ID_1, MEMBER_ID_1);
+
+        UserVmVO vm = mock(UserVmVO.class);
+        when(vm.getName()).thenReturn("vm1");
+        when(userVmDao.findById(VM_ID_1)).thenReturn(vm);
+        when(instanceBootGroupReadinessRuleService.evaluateVmReadiness(eq(GROUP_ID), eq(VM_ID_1), anyLong(), anyString()))
+                .thenReturn(InstanceBootGroupReadinessRule.Status.NotReady);
+
+        Map<Long, InstanceBootGroupMemberVO> memberById = new HashMap<>();
+        Map<Long, Boolean> membersReadyStatus = new HashMap<>();
+
+        CloudRuntimeException thrown = null;
+        for (int call = 1; call <= maxAttempts; call++) {
+            try {
+                manager.checkVmReadiness(group, progress, memberById, membersReadyStatus, maxAttempts, 60L, false);
+            } catch (CloudRuntimeException e) {
+                thrown = e;
+            }
+            if (call < maxAttempts) {
+                assertFalse("must not give up before the final allowed attempt", progress.gaveUp);
+            }
+        }
+
+        assertTrue("must give up on the final allowed attempt", progress.gaveUp);
+        assertTrue("the final attempt must halt with an exception", thrown != null);
+        assertTrue("halt message must report the capped attempt count (3/3), not 4/3: " + thrown.getMessage(),
+                thrown.getMessage().contains("failed readiness after 3/3 retry attempts"));
+        verify(instanceBootGroupReadinessRuleService, Mockito.times((int) maxAttempts))
+                .evaluateVmReadiness(eq(GROUP_ID), eq(VM_ID_1), anyLong(), anyString());
+    }
+
+    //
+    // checkInstanceGroupMembersReady
+    //
+
+    private static final Class<?>[] CHECK_GROUP_MEMBERS_READY_PARAMS =
+            new Class<?>[]{InstanceBootGroupVO.class, List.class, Map.class, Map.class};
+
+    @Test
+    public void testCheckInstanceGroupMembersReadyEmptyTierMembersIsVacuouslySettled() throws Exception {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        Map<Long, Object> progressByVmId = new HashMap<>();
+        Map<Long, Boolean> membersReadyStatus = new HashMap<>();
+
+        invokePrivate("checkInstanceGroupMembersReady", CHECK_GROUP_MEMBERS_READY_PARAMS,
+                group, Collections.emptyList(), progressByVmId, membersReadyStatus);
+
+        verifyNoInteractions(instanceGroupDao);
+        verifyNoInteractions(instanceBootGroupReadinessRuleService);
+        assertTrue(membersReadyStatus.isEmpty());
+    }
+
+    @Test
+    public void testCheckInstanceGroupMembersReadySkipsAlreadyReadyMember() throws Exception {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        InstanceBootGroupMemberVO groupMember = newMember(MEMBER_ID_1, GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID, 1);
+        Map<Long, Object> progressByVmId = new HashMap<>();
+        Map<Long, Boolean> membersReadyStatus = new HashMap<>();
+        membersReadyStatus.put(MEMBER_ID_1, true);
+
+        invokePrivate("checkInstanceGroupMembersReady", CHECK_GROUP_MEMBERS_READY_PARAMS,
+                group, List.of(groupMember), progressByVmId, membersReadyStatus);
+
+        verifyNoInteractions(instanceGroupDao);
+        verifyNoInteractions(instanceBootGroupReadinessRuleService);
+    }
+
+    @Test
+    public void testCheckInstanceGroupMembersReadySkipsWhenMembersNotSettledYet() throws Exception {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        InstanceBootGroupMemberVO groupMember = newMember(MEMBER_ID_1, GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID, 1);
+        Object progress = newVmProgress(VM_ID_1, MEMBER_ID_1); // ready=false, gaveUp=false
+
+        Map<Long, Object> progressByVmId = new HashMap<>();
+        progressByVmId.put(VM_ID_1, progress);
+        Map<Long, Boolean> membersReadyStatus = new HashMap<>();
+        membersReadyStatus.put(MEMBER_ID_1, false);
+        when(instanceGroupDao.findById(INSTANCE_GROUP_ID)).thenReturn(mock(InstanceGroupVO.class));
+
+        invokePrivate("checkInstanceGroupMembersReady", CHECK_GROUP_MEMBERS_READY_PARAMS,
+                group, List.of(groupMember), progressByVmId, membersReadyStatus);
+
+        verifyNoInteractions(instanceBootGroupReadinessRuleService);
+        assertFalse(membersReadyStatus.get(MEMBER_ID_1));
+    }
+
+    @Test
+    public void testCheckInstanceGroupMembersReadyEvaluatesImmediatelyWhenNoMatchingVmProgress() throws Exception {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        InstanceBootGroupMemberVO groupMember = newMember(MEMBER_ID_1, GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID, 1);
+        when(instanceGroupDao.findById(INSTANCE_GROUP_ID)).thenReturn(mock(InstanceGroupVO.class));
+        when(instanceBootGroupReadinessRuleService.evaluateInstanceGroupReadiness(GROUP_ID, INSTANCE_GROUP_ID, Collections.emptySet()))
+                .thenReturn(InstanceBootGroupReadinessRule.Status.Ready);
+
+        Map<Long, Object> progressByVmId = new HashMap<>(); // empty: no progress references this member
+        Map<Long, Boolean> membersReadyStatus = new HashMap<>();
+        membersReadyStatus.put(MEMBER_ID_1, false);
+
+        invokePrivate("checkInstanceGroupMembersReady", CHECK_GROUP_MEMBERS_READY_PARAMS,
+                group, List.of(groupMember), progressByVmId, membersReadyStatus);
+
+        assertTrue(membersReadyStatus.get(MEMBER_ID_1));
+        verify(instanceBootGroupReadinessRuleService).evaluateInstanceGroupReadiness(GROUP_ID, INSTANCE_GROUP_ID, Collections.emptySet());
+    }
+
+    @Test
+    public void testCheckInstanceGroupMembersReadyPassesGaveUpVmIdsAsPermanentlyFailedAndMarksReady() throws Exception {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        InstanceBootGroupMemberVO groupMember = newMember(MEMBER_ID_1, GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID, 1);
+        when(instanceGroupDao.findById(INSTANCE_GROUP_ID)).thenReturn(mock(InstanceGroupVO.class));
+
+        Object progress1 = newVmProgress(VM_ID_1, MEMBER_ID_1);
+        setProgressField(progress1, "gaveUp", true);
+        Object progress2 = newVmProgress(VM_ID_2, MEMBER_ID_1);
+        setProgressField(progress2, "ready", true);
+
+        Map<Long, Object> progressByVmId = new HashMap<>();
+        progressByVmId.put(VM_ID_1, progress1);
+        progressByVmId.put(VM_ID_2, progress2);
+        Map<Long, Boolean> membersReadyStatus = new HashMap<>();
+        membersReadyStatus.put(MEMBER_ID_1, false);
+
+        when(instanceBootGroupReadinessRuleService.evaluateInstanceGroupReadiness(GROUP_ID, INSTANCE_GROUP_ID, Set.of(VM_ID_1)))
+                .thenReturn(InstanceBootGroupReadinessRule.Status.Ready);
+
+        invokePrivate("checkInstanceGroupMembersReady", CHECK_GROUP_MEMBERS_READY_PARAMS,
+                group, List.of(groupMember), progressByVmId, membersReadyStatus);
+
+        assertTrue(membersReadyStatus.get(MEMBER_ID_1));
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testCheckInstanceGroupMembersReadyHaltsAndThrowsOnErrorStatus() throws Exception {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        InstanceBootGroupMemberVO groupMember = newMember(MEMBER_ID_1, GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID, 1);
+        InstanceGroupVO ig = mock(InstanceGroupVO.class);
+        when(ig.getName()).thenReturn("grp");
+        when(instanceGroupDao.findById(INSTANCE_GROUP_ID)).thenReturn(ig);
+        when(instanceBootGroupReadinessRuleService.evaluateInstanceGroupReadiness(eq(GROUP_ID), eq(INSTANCE_GROUP_ID), any()))
+                .thenReturn(InstanceBootGroupReadinessRule.Status.Error);
+
+        Map<Long, Object> progressByVmId = new HashMap<>();
+        Map<Long, Boolean> membersReadyStatus = new HashMap<>();
+        membersReadyStatus.put(MEMBER_ID_1, false);
+
+        invokePrivate("checkInstanceGroupMembersReady", CHECK_GROUP_MEMBERS_READY_PARAMS,
+                group, List.of(groupMember), progressByVmId, membersReadyStatus);
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testCheckInstanceGroupMembersReadyHaltsAndThrowsWhenNotReadyAndAllMembersSettled() throws Exception {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        InstanceBootGroupMemberVO groupMember = newMember(MEMBER_ID_1, GROUP_ID, InstanceBootGroupMember.MemberType.InstanceGroup, INSTANCE_GROUP_ID, 1);
+        InstanceGroupVO ig = mock(InstanceGroupVO.class);
+        when(ig.getName()).thenReturn("grp");
+        when(instanceGroupDao.findById(INSTANCE_GROUP_ID)).thenReturn(ig);
+
+        Object progress1 = newVmProgress(VM_ID_1, MEMBER_ID_1);
+        setProgressField(progress1, "ready", true);
+        Map<Long, Object> progressByVmId = new HashMap<>();
+        progressByVmId.put(VM_ID_1, progress1);
+        Map<Long, Boolean> membersReadyStatus = new HashMap<>();
+        membersReadyStatus.put(MEMBER_ID_1, false);
+
+        when(instanceBootGroupReadinessRuleService.evaluateInstanceGroupReadiness(eq(GROUP_ID), eq(INSTANCE_GROUP_ID), any()))
+                .thenReturn(InstanceBootGroupReadinessRule.Status.NotReady);
+
+        invokePrivate("checkInstanceGroupMembersReady", CHECK_GROUP_MEMBERS_READY_PARAMS,
+                group, List.of(groupMember), progressByVmId, membersReadyStatus);
+    }
+
+    //
+    // startInstanceBootGroup / stopInstanceBootGroup / rebootInstanceBootGroup — small fast end-to-end flows
+    //
+
+    @Test
+    public void testStartInstanceBootGroupSingleTierSingleVmReadyImmediately() throws Exception {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        InstanceBootGroupMemberVO member = newMember(MEMBER_ID_1, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID_1, 1);
+        when(instanceBootGroupMemberDao.listByBootGroupId(GROUP_ID)).thenReturn(List.of(member));
+
+        UserVmVO vm = mock(UserVmVO.class);
+        when(vm.getState()).thenReturn(VirtualMachine.State.Stopped);
+        when(userVmDao.findById(VM_ID_1)).thenReturn(vm);
+
+        when(instanceBootGroupDetailsDao.getDetail(eq(GROUP_ID), eq(InstanceBootGroupManagerImpl.ReadinessInitialDelaySeconds.key())))
+                .thenReturn("0");
+        when(instanceBootGroupReadinessRuleService.evaluateVmReadiness(eq(GROUP_ID), eq(VM_ID_1), anyLong(), anyString()))
+                .thenReturn(InstanceBootGroupReadinessRule.Status.Ready);
+
+        manager.startInstanceBootGroup(group);
+
+        verify(userVmService).startVirtualMachine(vm, null);
+        verify(instanceBootGroupReadinessRuleService, Mockito.atLeastOnce())
+                .evaluateVmReadiness(eq(GROUP_ID), eq(VM_ID_1), anyLong(), anyString());
+    }
+
+    @Test
+    public void testStartInstanceBootGroupAlreadyRunningVmSkipsStartCall() throws Exception {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        InstanceBootGroupMemberVO member = newMember(MEMBER_ID_1, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID_1, 1);
+        when(instanceBootGroupMemberDao.listByBootGroupId(GROUP_ID)).thenReturn(List.of(member));
+
+        UserVmVO vm = mock(UserVmVO.class);
+        when(vm.getState()).thenReturn(VirtualMachine.State.Running);
+        when(vm.getPowerStateUpdateTime()).thenReturn(new Date(System.currentTimeMillis() - 1000));
+        when(userVmDao.findById(VM_ID_1)).thenReturn(vm);
+
+        when(instanceBootGroupDetailsDao.getDetail(eq(GROUP_ID), eq(InstanceBootGroupManagerImpl.ReadinessInitialDelaySeconds.key())))
+                .thenReturn("0");
+        when(instanceBootGroupReadinessRuleService.evaluateVmReadiness(eq(GROUP_ID), eq(VM_ID_1), anyLong(), anyString()))
+                .thenReturn(InstanceBootGroupReadinessRule.Status.Ready);
+
+        manager.startInstanceBootGroup(group);
+
+        verify(userVmService, never()).startVirtualMachine(any(), any());
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testStartInstanceBootGroupHaltsOnExhaustedRetriesAndSkipsLaterTiers() throws Throwable {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        InstanceBootGroupMemberVO member1 = newMember(MEMBER_ID_1, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID_1, 1);
+        InstanceBootGroupMemberVO member2 = newMember(MEMBER_ID_2, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID_2, 2);
+        when(instanceBootGroupMemberDao.listByBootGroupId(GROUP_ID)).thenReturn(List.of(member1, member2));
+
+        UserVmVO vm1 = mock(UserVmVO.class);
+        when(vm1.getState()).thenReturn(VirtualMachine.State.Stopped);
+        when(vm1.getName()).thenReturn("vm1");
+        when(userVmDao.findById(VM_ID_1)).thenReturn(vm1);
+
+        when(instanceBootGroupDetailsDao.getDetail(eq(GROUP_ID), eq(InstanceBootGroupManagerImpl.ReadinessInitialDelaySeconds.key())))
+                .thenReturn("0");
+        when(instanceBootGroupDetailsDao.getDetail(eq(GROUP_ID), eq(InstanceBootGroupManagerImpl.ReadinessMaxRetryAttempts.key())))
+                .thenReturn("0");
+        when(instanceBootGroupReadinessRuleService.evaluateVmReadiness(eq(GROUP_ID), eq(VM_ID_1), anyLong(), anyString()))
+                .thenReturn(InstanceBootGroupReadinessRule.Status.NotReady);
+
+        try {
+            manager.startInstanceBootGroup(group);
+        } finally {
+            // Only vm1 (tier 1) is ever started; tier 2 (vm2) is never reached because tier 1 halts.
+            verify(userVmService, Mockito.times(1)).startVirtualMachine(any(), any());
+            verify(userVmService).startVirtualMachine(vm1, null);
+            verify(userVmDao, never()).findById(VM_ID_2);
+        }
+    }
+
+    @Test
+    public void testStopInstanceBootGroupStopsTiersInReverseOrder() {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        InstanceBootGroupMemberVO member1 = newMember(MEMBER_ID_1, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID_1, 1);
+        InstanceBootGroupMemberVO member2 = newMember(MEMBER_ID_2, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID_2, 2);
+        when(instanceBootGroupMemberDao.listByBootGroupId(GROUP_ID)).thenReturn(List.of(member1, member2));
+
+        UserVmVO vm1 = mock(UserVmVO.class);
+        when(vm1.getState()).thenReturn(VirtualMachine.State.Running);
+        when(userVmDao.findById(VM_ID_1)).thenReturn(vm1);
+
+        UserVmVO vm2 = mock(UserVmVO.class);
+        when(vm2.getState()).thenReturn(VirtualMachine.State.Running);
+        when(userVmDao.findById(VM_ID_2)).thenReturn(vm2);
+
+        manager.stopInstanceBootGroup(group, false);
+
+        InOrder inOrder = Mockito.inOrder(userVmService);
+        inOrder.verify(userVmService).stopVirtualMachine(VM_ID_2, false);
+        inOrder.verify(userVmService).stopVirtualMachine(VM_ID_1, false);
+    }
+
+    @Test
+    public void testStopInstanceBootGroupSkipsAlreadyStoppedVm() {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        InstanceBootGroupMemberVO member = newMember(MEMBER_ID_1, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID_1, 1);
+        when(instanceBootGroupMemberDao.listByBootGroupId(GROUP_ID)).thenReturn(List.of(member));
+
+        UserVmVO vm = mock(UserVmVO.class);
+        when(vm.getState()).thenReturn(VirtualMachine.State.Stopped);
+        when(userVmDao.findById(VM_ID_1)).thenReturn(vm);
+
+        manager.stopInstanceBootGroup(group, false);
+
+        verify(userVmService, never()).stopVirtualMachine(anyLong(), any(Boolean.class));
+    }
+
+    @Test
+    public void testStopInstanceBootGroupContinuesToNextTierAfterAFailure() {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        InstanceBootGroupMemberVO member1 = newMember(MEMBER_ID_1, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID_1, 1);
+        InstanceBootGroupMemberVO member2 = newMember(MEMBER_ID_2, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID_2, 2);
+        when(instanceBootGroupMemberDao.listByBootGroupId(GROUP_ID)).thenReturn(List.of(member1, member2));
+
+        UserVmVO vm1 = mock(UserVmVO.class);
+        when(vm1.getState()).thenReturn(VirtualMachine.State.Running);
+        when(userVmDao.findById(VM_ID_1)).thenReturn(vm1);
+
+        UserVmVO vm2 = mock(UserVmVO.class);
+        when(vm2.getState()).thenReturn(VirtualMachine.State.Running);
+        when(userVmDao.findById(VM_ID_2)).thenReturn(vm2);
+        Mockito.doThrow(new CloudRuntimeException("stop failed")).when(userVmService).stopVirtualMachine(VM_ID_2, false);
+
+        // Tier 2 (vm2) is stopped first (reverse order) and fails; tier 1 (vm1) must still be attempted
+        // rather than the whole operation aborting, per stopInstanceBootGroup's documented contract.
+        manager.stopInstanceBootGroup(group, false);
+
+        verify(userVmService).stopVirtualMachine(VM_ID_2, false);
+        verify(userVmService).stopVirtualMachine(VM_ID_1, false);
+    }
+
+    @Test
+    public void testStopInstanceBootGroupToleratesNonPositiveConcurrency() {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        InstanceBootGroupMemberVO member1 = newMember(MEMBER_ID_1, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID_1, 1);
+        InstanceBootGroupMemberVO member2 = newMember(MEMBER_ID_2, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID_2, 1);
+        when(instanceBootGroupMemberDao.listByBootGroupId(GROUP_ID)).thenReturn(List.of(member1, member2));
+
+        UserVmVO vm1 = mock(UserVmVO.class);
+        when(vm1.getState()).thenReturn(VirtualMachine.State.Running);
+        when(userVmDao.findById(VM_ID_1)).thenReturn(vm1);
+        UserVmVO vm2 = mock(UserVmVO.class);
+        when(vm2.getState()).thenReturn(VirtualMachine.State.Running);
+        when(userVmDao.findById(VM_ID_2)).thenReturn(vm2);
+
+        ReflectionTestUtils.setField(InstanceBootGroupManagerImpl.ReadinessCheckConcurrency, "_value", 0L);
+        try {
+            // Executors.newFixedThreadPool throws IllegalArgumentException for a non-positive pool
+            // size; a misconfigured (<=0) concurrency setting must not be able to take down a stop.
+            manager.stopInstanceBootGroup(group, false);
+        } finally {
+            ReflectionTestUtils.setField(InstanceBootGroupManagerImpl.ReadinessCheckConcurrency, "_value", null);
+        }
+
+        verify(userVmService).stopVirtualMachine(VM_ID_1, false);
+        verify(userVmService).stopVirtualMachine(VM_ID_2, false);
+    }
+
+    @Test
+    public void testStopInstanceBootGroupPropagatesForcedFlag() {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        InstanceBootGroupMemberVO member = newMember(MEMBER_ID_1, GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID_1, 1);
+        when(instanceBootGroupMemberDao.listByBootGroupId(GROUP_ID)).thenReturn(List.of(member));
+
+        UserVmVO vm = mock(UserVmVO.class);
+        when(vm.getState()).thenReturn(VirtualMachine.State.Running);
+        when(userVmDao.findById(VM_ID_1)).thenReturn(vm);
+
+        manager.stopInstanceBootGroup(group, true);
+
+        verify(userVmService).stopVirtualMachine(VM_ID_1, true);
+    }
+
+    @Test
+    public void testRebootInstanceBootGroupCallsStopThenStart() {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        InstanceBootGroupManagerImpl spyManager = Mockito.spy(manager);
+        Mockito.doNothing().when(spyManager).stopInstanceBootGroup(group, false);
+        Mockito.doNothing().when(spyManager).startInstanceBootGroup(group);
+
+        spyManager.rebootInstanceBootGroup(group, false);
+
+        InOrder inOrder = Mockito.inOrder(spyManager);
+        inOrder.verify(spyManager).stopInstanceBootGroup(group, false);
+        inOrder.verify(spyManager).startInstanceBootGroup(group);
+    }
+
+    @Test
+    public void testRebootInstanceBootGroupPropagatesForcedFlagToStop() {
+        InstanceBootGroupVO group = newGroup(GROUP_ID, "group1");
+        InstanceBootGroupManagerImpl spyManager = Mockito.spy(manager);
+        Mockito.doNothing().when(spyManager).stopInstanceBootGroup(group, true);
+        Mockito.doNothing().when(spyManager).startInstanceBootGroup(group);
+
+        spyManager.rebootInstanceBootGroup(group, true);
+
+        verify(spyManager).stopInstanceBootGroup(group, true);
+        verify(spyManager, never()).stopInstanceBootGroup(group, false);
+    }
+
+    //
+    // Configurable / ManagerBase plumbing
+    //
+
+    @Test
+    public void testGetConfigKeysReturnsAllKeys() {
+        ConfigKey<?>[] keys = manager.getConfigKeys();
+        assertEquals(7, keys.length);
+    }
+
+    @Test
+    public void testGetConfigComponentName() {
+        assertEquals("InstanceBootGroupManagerImpl", manager.getConfigComponentName());
+    }
+
+    @Test
+    public void testConfigureReturnsTrue() throws Exception {
+        assertTrue(manager.configure("InstanceBootGroupManagerImpl", Collections.emptyMap()));
+    }
+}
diff --git a/server/src/test/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupMembershipGuardTest.java b/server/src/test/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupMembershipGuardTest.java
new file mode 100644
index 000000000000..7855659a90e5
--- /dev/null
+++ b/server/src/test/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupMembershipGuardTest.java
@@ -0,0 +1,301 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm.bootgroup;
+
+import static org.junit.Assert.assertThrows;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.Arrays;
+import java.util.Collections;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.network.as.dao.AutoScaleVmGroupVmMapDao;
+import com.cloud.storage.Storage;
+import com.cloud.storage.VMTemplateVO;
+import com.cloud.storage.dao.VMTemplateDao;
+import com.cloud.vm.InstanceGroupVMMapVO;
+import com.cloud.vm.UserVmManager;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.dao.InstanceBootGroupMemberDao;
+import com.cloud.vm.dao.InstanceBootGroupReadinessRuleDao;
+import com.cloud.vm.dao.InstanceGroupVMMapDao;
+import com.cloud.vm.dao.UserVmDao;
+
+@RunWith(MockitoJUnitRunner.class)
+public class InstanceBootGroupMembershipGuardTest {
+
+    private static final long VM_ID = 100L;
+    private static final long TEMPLATE_ID = 200L;
+    private static final long FIRST_GROUP_ID = 10L;
+    private static final long SECOND_GROUP_ID = 20L;
+    private static final long BOOT_GROUP_ID = 1000L;
+
+    @InjectMocks
+    InstanceBootGroupMembershipGuard guard;
+
+    @Mock
+    UserVmDao userVmDao;
+
+    @Mock
+    VMTemplateDao templateDao;
+
+    @Mock
+    AutoScaleVmGroupVmMapDao autoScaleVmGroupVmMapDao;
+
+    @Mock
+    InstanceBootGroupMemberDao instanceBootGroupMemberDao;
+
+    @Mock
+    InstanceGroupVMMapDao instanceGroupVMMapDao;
+
+    @Mock
+    InstanceBootGroupReadinessRuleDao instanceBootGroupReadinessRuleDao;
+
+    @Mock
+    UserVmVO vm;
+
+    @Before
+    public void setUp() {
+        when(userVmDao.findById(VM_ID)).thenReturn(vm);
+        when(vm.getTemplateId()).thenReturn(TEMPLATE_ID);
+        when(templateDao.findByIdIncludingRemoved(TEMPLATE_ID)).thenReturn(null);
+        when(autoScaleVmGroupVmMapDao.listByVm(VM_ID)).thenReturn(Collections.emptyList());
+        when(instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID)).thenReturn(null);
+    }
+
+    @Test
+    public void testVmNotFoundThrows() {
+        when(userVmDao.findById(VM_ID)).thenReturn(null);
+        assertThrows(InvalidParameterValueException.class, () -> guard.validateVmEligibleForGroupMembership(VM_ID));
+    }
+
+    @Test
+    public void testVnfTemplateThrows() {
+        VMTemplateVO template = mock(VMTemplateVO.class);
+        when(template.getTemplateType()).thenReturn(Storage.TemplateType.VNF);
+        when(templateDao.findByIdIncludingRemoved(TEMPLATE_ID)).thenReturn(template);
+
+        assertThrows(InvalidParameterValueException.class, () -> guard.validateVmEligibleForGroupMembership(VM_ID));
+    }
+
+    @Test
+    public void testCksNodeThrows() {
+        when(vm.getUserVmType()).thenReturn(UserVmManager.CKS_NODE);
+        assertThrows(InvalidParameterValueException.class, () -> guard.validateVmEligibleForGroupMembership(VM_ID));
+    }
+
+    @Test
+    public void testInAutoScaleGroupThrows() {
+        when(autoScaleVmGroupVmMapDao.listByVm(VM_ID)).thenReturn(Collections.singletonList(mock(com.cloud.network.as.AutoScaleVmGroupVmMapVO.class)));
+        assertThrows(InvalidParameterValueException.class, () -> guard.validateVmEligibleForGroupMembership(VM_ID));
+    }
+
+    @Test
+    public void testAlreadyIndependentBootGroupMemberThrows() {
+        when(instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID))
+                .thenReturn(mock(InstanceBootGroupMemberVO.class));
+        assertThrows(InvalidParameterValueException.class, () -> guard.validateVmEligibleForGroupMembership(VM_ID));
+    }
+
+    @Test
+    public void testEligibleForGroupMembershipIgnoresCurrentInstanceGroupBootGroupStatus() {
+        // validateVmEligibleForGroupMembership no longer looks at the VM's CURRENT instance group
+        // membership at all (that's validateVmNotIndirectlyBootGroupManaged's job), so it must pass
+        // even when instanceGroupVMMapDao/instanceBootGroupMemberDao are never stubbed to return
+        // anything for the VM's groups.
+        guard.validateVmEligibleForGroupMembership(VM_ID);
+        org.mockito.Mockito.verifyNoInteractions(instanceGroupVMMapDao);
+    }
+
+    // ---------------------------------------------------------------- validateVmNotIndirectlyBootGroupManaged
+
+    @Test
+    public void testIndirectlyManagedVmNotFoundThrows() {
+        when(userVmDao.findById(VM_ID)).thenReturn(null);
+        assertThrows(InvalidParameterValueException.class, () -> guard.validateVmNotIndirectlyBootGroupManaged(VM_ID));
+    }
+
+    @Test
+    public void testNoInstanceGroupMappingsPasses() {
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.emptyList());
+        guard.validateVmNotIndirectlyBootGroupManaged(VM_ID);
+    }
+
+    @Test
+    public void testFirstInstanceGroupIsBootGroupMemberThrows() {
+        InstanceGroupVMMapVO firstMapping = mock(InstanceGroupVMMapVO.class);
+        when(firstMapping.getGroupId()).thenReturn(FIRST_GROUP_ID);
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.singletonList(firstMapping));
+        when(instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.InstanceGroup, FIRST_GROUP_ID))
+                .thenReturn(mock(InstanceBootGroupMemberVO.class));
+
+        assertThrows(InvalidParameterValueException.class, () -> guard.validateVmNotIndirectlyBootGroupManaged(VM_ID));
+    }
+
+    /**
+     * Regression test: a VM can belong to more than one Instance Group (instance_group_vm_map has no
+     * one-group-per-VM constraint), so a disqualifying group must not be missed just because it isn't
+     * the first mapping returned.
+     */
+    @Test
+    public void testSecondInstanceGroupIsBootGroupMemberThrows() {
+        InstanceGroupVMMapVO firstMapping = mock(InstanceGroupVMMapVO.class);
+        when(firstMapping.getGroupId()).thenReturn(FIRST_GROUP_ID);
+        InstanceGroupVMMapVO secondMapping = mock(InstanceGroupVMMapVO.class);
+        when(secondMapping.getGroupId()).thenReturn(SECOND_GROUP_ID);
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Arrays.asList(firstMapping, secondMapping));
+
+        when(instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.InstanceGroup, FIRST_GROUP_ID)).thenReturn(null);
+        when(instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.InstanceGroup, SECOND_GROUP_ID))
+                .thenReturn(mock(InstanceBootGroupMemberVO.class));
+
+        assertThrows(InvalidParameterValueException.class, () -> guard.validateVmNotIndirectlyBootGroupManaged(VM_ID));
+    }
+
+    @Test
+    public void testMultipleInstanceGroupsNoneDisqualifyingPasses() {
+        InstanceGroupVMMapVO firstMapping = mock(InstanceGroupVMMapVO.class);
+        when(firstMapping.getGroupId()).thenReturn(FIRST_GROUP_ID);
+        InstanceGroupVMMapVO secondMapping = mock(InstanceGroupVMMapVO.class);
+        when(secondMapping.getGroupId()).thenReturn(SECOND_GROUP_ID);
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Arrays.asList(firstMapping, secondMapping));
+
+        when(instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.InstanceGroup, FIRST_GROUP_ID)).thenReturn(null);
+        when(instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.InstanceGroup, SECOND_GROUP_ID)).thenReturn(null);
+
+        guard.validateVmNotIndirectlyBootGroupManaged(VM_ID);
+    }
+
+    // ---------------------------------------------------------------- validateInstanceGroupEligibleForBootGroupMembership
+
+    @Test
+    public void testInstanceGroupEligibleWhenNoMembersDisqualified() {
+        InstanceGroupVMMapVO member = mock(InstanceGroupVMMapVO.class);
+        when(member.getInstanceId()).thenReturn(VM_ID);
+        when(instanceGroupVMMapDao.listByGroupId(FIRST_GROUP_ID)).thenReturn(Collections.singletonList(member));
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.emptyList());
+
+        guard.validateInstanceGroupEligibleForBootGroupMembership(FIRST_GROUP_ID);
+    }
+
+    /**
+     * A member VM already indirectly governed via some OTHER Instance Group (one that's already a
+     * boot-group member) must disqualify the whole group, not just the VNF/CKS/AutoScale checks.
+     */
+    @Test
+    public void testInstanceGroupNotEligibleWhenMemberAlreadyIndirectlyManaged() {
+        InstanceGroupVMMapVO member = mock(InstanceGroupVMMapVO.class);
+        when(member.getInstanceId()).thenReturn(VM_ID);
+        when(instanceGroupVMMapDao.listByGroupId(FIRST_GROUP_ID)).thenReturn(Collections.singletonList(member));
+
+        InstanceGroupVMMapVO otherMapping = mock(InstanceGroupVMMapVO.class);
+        when(otherMapping.getGroupId()).thenReturn(SECOND_GROUP_ID);
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.singletonList(otherMapping));
+        when(instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.InstanceGroup, SECOND_GROUP_ID))
+                .thenReturn(mock(InstanceBootGroupMemberVO.class));
+
+        assertThrows(InvalidParameterValueException.class, () -> guard.validateInstanceGroupEligibleForBootGroupMembership(FIRST_GROUP_ID));
+    }
+
+    // ---------------------------------------------------------------- validateVmNotInBootGroup
+
+    @Test
+    public void testValidateVmNotInBootGroupDirectMemberThrows() {
+        when(vm.getId()).thenReturn(VM_ID);
+        when(instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID))
+                .thenReturn(mock(InstanceBootGroupMemberVO.class));
+
+        assertThrows(InvalidParameterValueException.class, () -> guard.validateVmNotInBootGroup(vm));
+    }
+
+    @Test
+    public void testValidateVmNotInBootGroupInInstanceGroupMemberWithOwnRuleThrows() {
+        when(vm.getId()).thenReturn(VM_ID);
+        InstanceGroupVMMapVO mapping = mock(InstanceGroupVMMapVO.class);
+        when(mapping.getGroupId()).thenReturn(FIRST_GROUP_ID);
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.singletonList(mapping));
+        InstanceBootGroupMemberVO groupMember = mock(InstanceBootGroupMemberVO.class);
+        when(groupMember.getBootGroupId()).thenReturn(BOOT_GROUP_ID);
+        when(instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.InstanceGroup, FIRST_GROUP_ID))
+                .thenReturn(groupMember);
+        when(instanceBootGroupReadinessRuleDao.listByItem(BOOT_GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID))
+                .thenReturn(Collections.singletonList(mock(InstanceBootGroupReadinessRuleVO.class)));
+
+        assertThrows(InvalidParameterValueException.class, () -> guard.validateVmNotInBootGroup(vm));
+    }
+
+    /**
+     * Being in an Instance Group that is itself a boot-group member is NOT, on its own, a reason to
+     * block destroy — boot group orchestration resolves the group's VMs dynamically, so only a VM
+     * with its own readiness rule(s) registered in the boot group is actually at risk of going stale.
+     */
+    @Test
+    public void testValidateVmNotInBootGroupInInstanceGroupMemberWithoutOwnRulePasses() {
+        when(vm.getId()).thenReturn(VM_ID);
+        InstanceGroupVMMapVO mapping = mock(InstanceGroupVMMapVO.class);
+        when(mapping.getGroupId()).thenReturn(FIRST_GROUP_ID);
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.singletonList(mapping));
+        InstanceBootGroupMemberVO groupMember = mock(InstanceBootGroupMemberVO.class);
+        when(groupMember.getBootGroupId()).thenReturn(BOOT_GROUP_ID);
+        when(instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.InstanceGroup, FIRST_GROUP_ID))
+                .thenReturn(groupMember);
+        when(instanceBootGroupReadinessRuleDao.listByItem(BOOT_GROUP_ID, InstanceBootGroupMember.MemberType.VirtualMachine, VM_ID))
+                .thenReturn(Collections.emptyList());
+
+        guard.validateVmNotInBootGroup(vm);
+    }
+
+    @Test
+    public void testValidateVmNotInBootGroupNotAMemberPasses() {
+        when(vm.getId()).thenReturn(VM_ID);
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.emptyList());
+
+        guard.validateVmNotInBootGroup(vm);
+    }
+
+    // ---------------------------------------------------------------- removeInstanceGroupBootGroupMembershipIfPresent
+
+    @Test
+    public void testRemoveInstanceGroupBootGroupMembershipIfPresentExpungesExistingMember() {
+        InstanceBootGroupMemberVO member = mock(InstanceBootGroupMemberVO.class);
+        when(member.getId()).thenReturn(999L);
+        when(instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.InstanceGroup, FIRST_GROUP_ID))
+                .thenReturn(member);
+
+        guard.removeInstanceGroupBootGroupMembershipIfPresent(FIRST_GROUP_ID);
+
+        org.mockito.Mockito.verify(instanceBootGroupMemberDao).expunge(999L);
+    }
+
+    @Test
+    public void testRemoveInstanceGroupBootGroupMembershipIfPresentNoOpWhenNotAMember() {
+        when(instanceBootGroupMemberDao.findByMember(InstanceBootGroupMember.MemberType.InstanceGroup, FIRST_GROUP_ID))
+                .thenReturn(null);
+
+        guard.removeInstanceGroupBootGroupMembershipIfPresent(FIRST_GROUP_ID);
+
+        org.mockito.Mockito.verify(instanceBootGroupMemberDao, org.mockito.Mockito.never()).expunge(org.mockito.ArgumentMatchers.anyLong());
+    }
+}
diff --git a/server/src/test/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupVmStateListenerTest.java b/server/src/test/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupVmStateListenerTest.java
new file mode 100644
index 000000000000..02abd35f3177
--- /dev/null
+++ b/server/src/test/java/org/apache/cloudstack/vm/bootgroup/InstanceBootGroupVmStateListenerTest.java
@@ -0,0 +1,106 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm.bootgroup;
+
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRuleService;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.utils.fsm.StateMachine2;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.VirtualMachine.Event;
+import com.cloud.vm.VirtualMachine.State;
+
+@RunWith(MockitoJUnitRunner.class)
+public class InstanceBootGroupVmStateListenerTest {
+
+    private static final long VM_ID = 100L;
+
+    private InstanceBootGroupReadinessRuleService instanceBootGroupReadinessRuleService;
+    private InstanceBootGroupVmStateListener listener;
+    private VirtualMachine vm;
+
+    @Before
+    public void setUp() {
+        instanceBootGroupReadinessRuleService = mock(InstanceBootGroupReadinessRuleService.class);
+        listener = new InstanceBootGroupVmStateListener(instanceBootGroupReadinessRuleService);
+        vm = mock(VirtualMachine.class);
+        when(vm.getId()).thenReturn(VM_ID);
+    }
+
+    private StateMachine2.Transition<State, Event> transition(State from, Event event, State to) {
+        return new StateMachine2.Transition<>(from, event, to, null);
+    }
+
+    @Test
+    public void preStateTransitionEventAlwaysAllowsTheTransition() {
+        assertTrue(listener.preStateTransitionEvent(State.Starting, Event.OperationSucceeded, State.Running, vm, true, null));
+    }
+
+    @Test
+    public void invalidatesOnColdStart() {
+        listener.postStateTransitionEvent(transition(State.Starting, Event.OperationSucceeded, State.Running), vm, true, null);
+        verify(instanceBootGroupReadinessRuleService).invalidateCachedReadinessOnRestart(VM_ID);
+    }
+
+    @Test
+    public void invalidatesOnColdStartConfirmedByAgentReport() {
+        listener.postStateTransitionEvent(transition(State.Starting, Event.AgentReportRunning, State.Running), vm, true, null);
+        verify(instanceBootGroupReadinessRuleService).invalidateCachedReadinessOnRestart(VM_ID);
+    }
+
+    @Test
+    public void ignoresFailedTransitions() {
+        listener.postStateTransitionEvent(transition(State.Starting, Event.OperationSucceeded, State.Running), vm, false, null);
+        verify(instanceBootGroupReadinessRuleService, never()).invalidateCachedReadinessOnRestart(anyLong());
+    }
+
+    @Test
+    public void ignoresSameStateConfirmation() {
+        listener.postStateTransitionEvent(transition(State.Running, Event.AgentReportRunning, State.Running), vm, true, null);
+        verify(instanceBootGroupReadinessRuleService, never()).invalidateCachedReadinessOnRestart(anyLong());
+    }
+
+    @Test
+    public void ignoresMigrationLandingInRunning() {
+        listener.postStateTransitionEvent(transition(State.Migrating, Event.OperationSucceeded, State.Running), vm, true, null);
+        verify(instanceBootGroupReadinessRuleService, never()).invalidateCachedReadinessOnRestart(anyLong());
+    }
+
+    @Test
+    public void ignoresTransitionsNotLandingInRunning() {
+        listener.postStateTransitionEvent(transition(State.Running, Event.StopRequested, State.Stopping), vm, true, null);
+        verify(instanceBootGroupReadinessRuleService, never()).invalidateCachedReadinessOnRestart(anyLong());
+    }
+
+    @Test
+    public void exceptionFromServiceDoesNotPropagate() {
+        doThrow(new RuntimeException("db down")).when(instanceBootGroupReadinessRuleService).invalidateCachedReadinessOnRestart(VM_ID);
+        boolean result = listener.postStateTransitionEvent(transition(State.Starting, Event.OperationSucceeded, State.Running), vm, true, null);
+        assertTrue(result);
+    }
+}
diff --git a/server/src/test/java/org/apache/cloudstack/vm/bootgroup/readiness/GuestAgentLivenessCheckerTest.java b/server/src/test/java/org/apache/cloudstack/vm/bootgroup/readiness/GuestAgentLivenessCheckerTest.java
new file mode 100644
index 000000000000..ba7d7185889d
--- /dev/null
+++ b/server/src/test/java/org/apache/cloudstack/vm/bootgroup/readiness/GuestAgentLivenessCheckerTest.java
@@ -0,0 +1,163 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm.bootgroup.readiness;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.AgentManager;
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.CheckGuestAgentLivenessAnswer;
+import com.cloud.agent.api.CheckGuestAgentLivenessCommand;
+import com.cloud.hypervisor.Hypervisor.HypervisorType;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.dao.UserVmDao;
+
+@RunWith(MockitoJUnitRunner.class)
+public class GuestAgentLivenessCheckerTest {
+
+    private static final long VM_ID = 100L;
+    private static final long HOST_ID = 300L;
+
+    @InjectMocks
+    GuestAgentLivenessChecker checker;
+
+    @Mock
+    UserVmDao userVmDao;
+    @Mock
+    AgentManager agentManager;
+
+    private UserVmVO vm;
+
+    @Before
+    public void setUp() {
+        vm = mock(UserVmVO.class);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm);
+        when(vm.getHypervisorType()).thenReturn(HypervisorType.KVM);
+        when(vm.getState()).thenReturn(VirtualMachine.State.Running);
+        when(vm.getHostId()).thenReturn(HOST_ID);
+    }
+
+    private InstanceBootGroupReadinessRule rule() {
+        return mock(InstanceBootGroupReadinessRule.class);
+    }
+
+    @Test
+    public void getRuleTypeIsGuestAgentLiveness() {
+        assertEquals(InstanceBootGroupReadinessRule.RuleType.GuestAgentLiveness, checker.getRuleType());
+    }
+
+    @Test
+    public void vmNotFoundIsError() {
+        when(userVmDao.findById(VM_ID)).thenReturn(null);
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+    }
+
+    @Test
+    public void nonKvmHypervisorIsError() {
+        when(vm.getHypervisorType()).thenReturn(HypervisorType.VMware);
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+        assertTrue(result.getMessage().contains("only supported on KVM"));
+    }
+
+    @Test
+    public void notRunningIsNotReady() {
+        when(vm.getState()).thenReturn(VirtualMachine.State.Stopped);
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.NotReady, result.getStatus());
+    }
+
+    @Test
+    public void nullHostIdIsNotReady() {
+        when(vm.getHostId()).thenReturn(null);
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.NotReady, result.getStatus());
+    }
+
+    @Test
+    public void insufficientBudgetIsError() {
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 500);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+    }
+
+    @Test
+    public void dispatchExceptionIsError() {
+        when(agentManager.easySend(eq(HOST_ID), any())).thenThrow(new RuntimeException("agent down"));
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+        assertTrue(result.getMessage().contains("agent down"));
+    }
+
+    @Test
+    public void nullAnswerIsError() {
+        when(agentManager.easySend(eq(HOST_ID), any())).thenReturn(null);
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+    }
+
+    @Test
+    public void positiveAnswerIsReady() {
+        Answer answer = mock(CheckGuestAgentLivenessAnswer.class);
+        when(answer.getResult()).thenReturn(true);
+        when(agentManager.easySend(eq(HOST_ID), any())).thenReturn(answer);
+
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Ready, result.getStatus());
+        assertEquals("guest agent responded", result.getMessage());
+    }
+
+    @Test
+    public void negativeAnswerIsNotReady() {
+        Answer answer = mock(CheckGuestAgentLivenessAnswer.class);
+        when(answer.getResult()).thenReturn(false);
+        when(answer.getDetails()).thenReturn("agent not connected");
+        when(agentManager.easySend(eq(HOST_ID), any())).thenReturn(answer);
+
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.NotReady, result.getStatus());
+        assertTrue(result.getMessage().contains("agent not connected"));
+    }
+
+    @Test
+    public void waitIsHalvedRemainingBudgetFlooredAtOne() {
+        Answer answer = mock(CheckGuestAgentLivenessAnswer.class);
+        when(answer.getResult()).thenReturn(true);
+        when(agentManager.easySend(eq(HOST_ID), any())).thenReturn(answer);
+        ArgumentCaptor<CheckGuestAgentLivenessCommand> captor = ArgumentCaptor.forClass(CheckGuestAgentLivenessCommand.class);
+
+        checker.check(rule(), null, VM_ID, 2500);
+
+        verify(agentManager).easySend(eq(HOST_ID), captor.capture());
+        assertEquals(1, captor.getValue().getWait());
+    }
+}
diff --git a/server/src/test/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceBootGroupReadinessRuleManagerImplTest.java b/server/src/test/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceBootGroupReadinessRuleManagerImplTest.java
new file mode 100644
index 000000000000..85a91a68753f
--- /dev/null
+++ b/server/src/test/java/org/apache/cloudstack/vm/bootgroup/readiness/InstanceBootGroupReadinessRuleManagerImplTest.java
@@ -0,0 +1,981 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.vm.bootgroup.readiness;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMember.MemberType;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupMemberVO;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupReadinessCheckResultVO;
+import org.apache.cloudstack.vm.bootgroup.InstanceBootGroupReadinessRuleVO;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule.RuleType;
+import org.apache.cloudstack.vm.bootgroup.readiness.InstanceBootGroupReadinessRule.Status;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.hypervisor.Hypervisor.HypervisorType;
+import com.cloud.vm.InstanceGroupVMMapVO;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.dao.InstanceBootGroupMemberDao;
+import com.cloud.vm.dao.InstanceBootGroupReadinessCheckResultDao;
+import com.cloud.vm.dao.InstanceBootGroupReadinessRuleDao;
+import com.cloud.vm.dao.InstanceBootGroupReadinessRuleDetailsDao;
+import com.cloud.vm.dao.InstanceGroupDao;
+import com.cloud.vm.dao.InstanceGroupVMMapDao;
+import com.cloud.vm.dao.UserVmDao;
+
+@RunWith(MockitoJUnitRunner.class)
+public class InstanceBootGroupReadinessRuleManagerImplTest {
+
+    private static final long BOOT_GROUP_ID = 1L;
+    private static final long VM_ID = 100L;
+    private static final long VM_ID_2 = 101L;
+    private static final long GROUP_ID = 200L;
+    private static final long RULE_ID = 10L;
+
+    @InjectMocks
+    InstanceBootGroupReadinessRuleManagerImpl manager;
+
+    @Mock
+    InstanceBootGroupReadinessRuleDao instanceBootGroupReadinessRuleDao;
+    @Mock
+    InstanceBootGroupReadinessRuleDetailsDao instanceBootGroupReadinessRuleDetailsDao;
+    @Mock
+    InstanceBootGroupReadinessCheckResultDao instanceBootGroupReadinessCheckResultDao;
+    @Mock
+    InstanceBootGroupMemberDao instanceBootGroupMemberDao;
+    @Mock
+    InstanceGroupVMMapDao instanceGroupVMMapDao;
+    @Mock
+    InstanceGroupDao instanceGroupDao;
+    @Mock
+    UserVmDao userVmDao;
+
+    @Before
+    public void setUp() {
+        manager.setReadinessCheckers(Collections.emptyList());
+    }
+
+    // ------------------------------------------------------------------
+    // helpers
+    // ------------------------------------------------------------------
+
+    private InstanceBootGroupReadinessRuleVO ruleVO(long id, long bootGroupId, MemberType itemType, long itemId, RuleType ruleType, boolean enabled) {
+        InstanceBootGroupReadinessRuleVO vo = new InstanceBootGroupReadinessRuleVO("rule-" + id, bootGroupId, itemType, itemId, ruleType, enabled);
+        ReflectionTestUtils.setField(vo, "id", id);
+        return vo;
+    }
+
+    private InstanceBootGroupMemberVO memberVO(long bootGroupId, MemberType memberType, long memberId) {
+        return new InstanceBootGroupMemberVO(bootGroupId, memberType, memberId, 0);
+    }
+
+    private UserVmVO mockVm(long id, VirtualMachine.State state, HypervisorType hypervisorType) {
+        UserVmVO vm = mock(UserVmVO.class);
+        Mockito.lenient().when(vm.getId()).thenReturn(id);
+        Mockito.lenient().when(vm.getState()).thenReturn(state);
+        Mockito.lenient().when(vm.getHypervisorType()).thenReturn(hypervisorType);
+        return vm;
+    }
+
+    private ReadinessChecker mockChecker(RuleType type, Status status, String message) {
+        ReadinessChecker checker = mock(ReadinessChecker.class);
+        when(checker.getRuleType()).thenReturn(type);
+        when(checker.check(any(), any(), anyLong(), anyLong())).thenReturn(new ReadinessChecker.Result(status, message));
+        return checker;
+    }
+
+    /** Satisfies validateItemBelongsToBootGroup for a direct VirtualMachine-type item. */
+    private void stubVmDirectMember(long itemId) {
+        when(instanceBootGroupMemberDao.findByMember(MemberType.VirtualMachine, itemId)).thenReturn(memberVO(BOOT_GROUP_ID, MemberType.VirtualMachine, itemId));
+    }
+
+    /** Satisfies validateItemBelongsToBootGroup for a direct InstanceGroup-type item. */
+    private void stubGroupDirectMember(long itemId) {
+        when(instanceBootGroupMemberDao.findByMember(MemberType.InstanceGroup, itemId)).thenReturn(memberVO(BOOT_GROUP_ID, MemberType.InstanceGroup, itemId));
+    }
+
+    // ==================================================================
+    // createReadinessRule
+    // ==================================================================
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void createReadinessRuleRejectsInvalidRuleTypeForVm() {
+        manager.createReadinessRule(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.MemberQuorum, null, true, null);
+    }
+
+    @Test
+    public void createReadinessRuleAcceptsMemberQuorumForInstanceGroup() {
+        stubGroupDirectMember(GROUP_ID);
+        Map<String, String> details = new HashMap<>();
+        details.put("threshold_type", "COUNT");
+        details.put("threshold_value", "2");
+        when(instanceBootGroupReadinessRuleDao.persist(any())).thenReturn(ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.MemberQuorum, true));
+
+        InstanceBootGroupReadinessRule result = manager.createReadinessRule(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.MemberQuorum, null, true, details);
+
+        assertEquals(RULE_ID, result.getId());
+        verify(instanceBootGroupReadinessRuleDetailsDao).addDetail(RULE_ID, "threshold_type", "COUNT", true);
+        verify(instanceBootGroupReadinessRuleDetailsDao).addDetail(RULE_ID, "threshold_value", "2", true);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void createReadinessRuleRejectsItemNotInBootGroup() {
+        when(instanceBootGroupMemberDao.findByMember(MemberType.VirtualMachine, VM_ID)).thenReturn(null);
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.emptyList());
+        manager.createReadinessRule(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.Ping, null, true, null);
+    }
+
+    @Test
+    public void createReadinessRuleAllowsItemViaInstanceGroupMembership() {
+        when(instanceBootGroupMemberDao.findByMember(MemberType.VirtualMachine, VM_ID)).thenReturn(null);
+        InstanceGroupVMMapVO mapping = new InstanceGroupVMMapVO(GROUP_ID, VM_ID);
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.singletonList(mapping));
+        when(instanceBootGroupMemberDao.findByMember(MemberType.InstanceGroup, GROUP_ID)).thenReturn(memberVO(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID));
+        when(instanceBootGroupReadinessRuleDao.persist(any())).thenReturn(ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.Ping, true));
+
+        InstanceBootGroupReadinessRule result = manager.createReadinessRule(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.Ping, null, true, null);
+        assertEquals(RULE_ID, result.getId());
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void createReadinessRuleRejectsSecondSingletonRuleType() {
+        stubVmDirectMember(VM_ID);
+        when(instanceBootGroupReadinessRuleDao.listByItem(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID))
+                .thenReturn(Collections.singletonList(ruleVO(5L, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.Ping, true)));
+        manager.createReadinessRule(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.Ping, null, true, null);
+    }
+
+    @Test
+    public void createReadinessRuleAllowsSecondPortCheckRule() {
+        // PortCheck is not a singleton rule type, so validateSingletonRuleType never even
+        // consults the existing-rules DAO for it — no need to stub listByItem here.
+        stubVmDirectMember(VM_ID);
+        Map<String, String> details = new HashMap<>();
+        details.put("port", "22");
+        when(instanceBootGroupReadinessRuleDao.persist(any())).thenReturn(ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.PortCheck, true));
+
+        InstanceBootGroupReadinessRule result = manager.createReadinessRule(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.PortCheck, null, true, details);
+        assertEquals(RULE_ID, result.getId());
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void createReadinessRuleRejectsGuestAgentLivenessOnNonKvm() {
+        stubVmDirectMember(VM_ID);
+        when(instanceBootGroupReadinessRuleDao.listByItem(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID)).thenReturn(Collections.emptyList());
+        UserVmVO vm22141 = mockVm(VM_ID, VirtualMachine.State.Running, HypervisorType.VMware);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm22141);
+        manager.createReadinessRule(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.GuestAgentLiveness, null, true, null);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void createReadinessRuleRejectsGuestAgentLivenessVmNotFound() {
+        stubVmDirectMember(VM_ID);
+        when(instanceBootGroupReadinessRuleDao.listByItem(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID)).thenReturn(Collections.emptyList());
+        when(userVmDao.findById(VM_ID)).thenReturn(null);
+        manager.createReadinessRule(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.GuestAgentLiveness, null, true, null);
+    }
+
+    @Test
+    public void createReadinessRuleAllowsGuestAgentLivenessOnKvm() {
+        stubVmDirectMember(VM_ID);
+        when(instanceBootGroupReadinessRuleDao.listByItem(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID)).thenReturn(Collections.emptyList());
+        UserVmVO vm85153 = mockVm(VM_ID, VirtualMachine.State.Running, HypervisorType.KVM);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm85153);
+        when(instanceBootGroupReadinessRuleDao.persist(any())).thenReturn(ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.GuestAgentLiveness, true));
+
+        InstanceBootGroupReadinessRule result = manager.createReadinessRule(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.GuestAgentLiveness, null, true, null);
+        assertEquals(RULE_ID, result.getId());
+    }
+
+    @Test
+    public void createReadinessRuleDoesNotValidateGuestAgentLivenessForGroupScope() {
+        stubGroupDirectMember(GROUP_ID);
+        when(instanceBootGroupReadinessRuleDao.listByItem(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID)).thenReturn(Collections.emptyList());
+        when(instanceBootGroupReadinessRuleDao.persist(any())).thenReturn(ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.GuestAgentLiveness, true));
+
+        InstanceBootGroupReadinessRule result = manager.createReadinessRule(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.GuestAgentLiveness, null, true, null);
+
+        assertEquals(RULE_ID, result.getId());
+        verify(userVmDao, never()).findById(anyLong());
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void createReadinessRuleRejectsInvalidPortCheckDetails() {
+        stubVmDirectMember(VM_ID);
+        Map<String, String> details = new HashMap<>();
+        details.put("port", "70000");
+        manager.createReadinessRule(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.PortCheck, null, true, details);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void createReadinessRuleRejectsMissingPortCheckPort() {
+        stubVmDirectMember(VM_ID);
+        manager.createReadinessRule(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.PortCheck, null, true, new HashMap<>());
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void createReadinessRuleRejectsNonTcpProtocol() {
+        stubVmDirectMember(VM_ID);
+        Map<String, String> details = new HashMap<>();
+        details.put("port", "22");
+        details.put("protocol", "udp");
+        manager.createReadinessRule(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.PortCheck, null, true, details);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void createReadinessRuleRejectsMissingMemberQuorumDetails() {
+        stubGroupDirectMember(GROUP_ID);
+        manager.createReadinessRule(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.MemberQuorum, null, true, new HashMap<>());
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void createReadinessRuleRejectsInvalidMemberQuorumThresholdType() {
+        stubGroupDirectMember(GROUP_ID);
+        Map<String, String> details = new HashMap<>();
+        details.put("threshold_type", "BOGUS");
+        details.put("threshold_value", "2");
+        manager.createReadinessRule(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.MemberQuorum, null, true, details);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void createReadinessRuleRejectsNonNumericMemberQuorumThreshold() {
+        stubGroupDirectMember(GROUP_ID);
+        Map<String, String> details = new HashMap<>();
+        details.put("threshold_type", "PERCENTAGE");
+        details.put("threshold_value", "abc");
+        manager.createReadinessRule(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.MemberQuorum, null, true, details);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void createReadinessRuleRejectsNegativeCountMemberQuorumThreshold() {
+        stubGroupDirectMember(GROUP_ID);
+        Map<String, String> details = new HashMap<>();
+        details.put("threshold_type", "COUNT");
+        details.put("threshold_value", "-1");
+        manager.createReadinessRule(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.MemberQuorum, null, true, details);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void createReadinessRuleRejectsNegativePercentageMemberQuorumThreshold() {
+        stubGroupDirectMember(GROUP_ID);
+        Map<String, String> details = new HashMap<>();
+        details.put("threshold_type", "PERCENTAGE");
+        details.put("threshold_value", "-5.5");
+        manager.createReadinessRule(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.MemberQuorum, null, true, details);
+    }
+
+    @Test
+    public void createReadinessRuleGeneratesDefaultNameWhenBlank() {
+        stubVmDirectMember(VM_ID);
+        when(instanceBootGroupReadinessRuleDao.listByItem(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID)).thenReturn(Collections.emptyList());
+        ArgumentCaptor<InstanceBootGroupReadinessRuleVO> captor = ArgumentCaptor.forClass(InstanceBootGroupReadinessRuleVO.class);
+        when(instanceBootGroupReadinessRuleDao.persist(captor.capture())).thenReturn(ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.Ping, true));
+
+        manager.createReadinessRule(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.Ping, "  ", true, null);
+
+        assertEquals(String.format("%s-%s-%d", RuleType.Ping.name(), MemberType.VirtualMachine.name(), VM_ID), captor.getValue().getName());
+    }
+
+    @Test
+    public void createReadinessRuleUsesGivenName() {
+        stubVmDirectMember(VM_ID);
+        when(instanceBootGroupReadinessRuleDao.listByItem(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID)).thenReturn(Collections.emptyList());
+        ArgumentCaptor<InstanceBootGroupReadinessRuleVO> captor = ArgumentCaptor.forClass(InstanceBootGroupReadinessRuleVO.class);
+        when(instanceBootGroupReadinessRuleDao.persist(captor.capture())).thenReturn(ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.Ping, true));
+
+        manager.createReadinessRule(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.Ping, "my-rule", true, null);
+
+        assertEquals("my-rule", captor.getValue().getName());
+    }
+
+    // ==================================================================
+    // updateReadinessRule
+    // ==================================================================
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void updateReadinessRuleNotFoundThrows() {
+        when(instanceBootGroupReadinessRuleDao.findById(RULE_ID)).thenReturn(null);
+        manager.updateReadinessRule(RULE_ID, "name", true, null);
+    }
+
+    @Test
+    public void updateReadinessRuleNoChanges() {
+        InstanceBootGroupReadinessRuleVO rule = ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.Ping, true);
+        when(instanceBootGroupReadinessRuleDao.findById(RULE_ID)).thenReturn(rule);
+
+        manager.updateReadinessRule(RULE_ID, null, null, null);
+
+        verify(instanceBootGroupReadinessRuleDao).update(eq(RULE_ID), any());
+        verify(instanceBootGroupReadinessRuleDetailsDao, never()).addDetail(anyLong(), any(), any(), Mockito.anyBoolean());
+    }
+
+    @Test
+    public void updateReadinessRuleNameAndEnabled() {
+        InstanceBootGroupReadinessRuleVO rule = ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.Ping, true);
+        when(instanceBootGroupReadinessRuleDao.findById(RULE_ID)).thenReturn(rule);
+
+        manager.updateReadinessRule(RULE_ID, "new-name", false, null);
+
+        assertEquals("new-name", rule.getName());
+        assertEquals(false, rule.isEnabled());
+        verify(instanceBootGroupReadinessRuleDao).update(RULE_ID, rule);
+    }
+
+    @Test
+    public void updateReadinessRuleMergesAndValidatesDetails() {
+        InstanceBootGroupReadinessRuleVO rule = ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.PortCheck, true);
+        when(instanceBootGroupReadinessRuleDao.findById(RULE_ID)).thenReturn(rule);
+        Map<String, String> existing = new HashMap<>();
+        existing.put("port", "8080");
+        existing.put("protocol", "tcp");
+        when(instanceBootGroupReadinessRuleDetailsDao.getDetails(RULE_ID)).thenReturn(existing);
+
+        Map<String, String> update = new HashMap<>();
+        update.put("port", "9090");
+        manager.updateReadinessRule(RULE_ID, null, null, update);
+
+        verify(instanceBootGroupReadinessRuleDetailsDao).addDetail(RULE_ID, "port", "9090", true);
+        verify(instanceBootGroupReadinessRuleDao).update(RULE_ID, rule);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void updateReadinessRuleRejectsInvalidMergedDetails() {
+        InstanceBootGroupReadinessRuleVO rule = ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.PortCheck, true);
+        when(instanceBootGroupReadinessRuleDao.findById(RULE_ID)).thenReturn(rule);
+        when(instanceBootGroupReadinessRuleDetailsDao.getDetails(RULE_ID)).thenReturn(new HashMap<>());
+
+        Map<String, String> update = new HashMap<>();
+        update.put("port", "invalid");
+        try {
+            manager.updateReadinessRule(RULE_ID, null, null, update);
+        } finally {
+            verify(instanceBootGroupReadinessRuleDao, never()).update(anyLong(), any());
+        }
+    }
+
+    // ==================================================================
+    // deleteReadinessRule
+    // ==================================================================
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void deleteReadinessRuleNotFoundThrows() {
+        when(instanceBootGroupReadinessRuleDao.findById(RULE_ID)).thenReturn(null);
+        manager.deleteReadinessRule(RULE_ID);
+    }
+
+    @Test
+    public void deleteReadinessRuleSuccess() {
+        InstanceBootGroupReadinessRuleVO rule = ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.Ping, true);
+        when(instanceBootGroupReadinessRuleDao.findById(RULE_ID)).thenReturn(rule);
+
+        boolean result = manager.deleteReadinessRule(RULE_ID);
+
+        assertTrue(result);
+        verify(instanceBootGroupReadinessRuleDetailsDao).removeDetails(RULE_ID);
+        verify(instanceBootGroupReadinessCheckResultDao).deleteByRuleId(RULE_ID);
+        verify(instanceBootGroupReadinessRuleDao).remove(RULE_ID);
+    }
+
+    // ==================================================================
+    // findById / getRuleDetails
+    // ==================================================================
+
+    @Test
+    public void findByIdDelegatesToDao() {
+        InstanceBootGroupReadinessRuleVO rule = ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.Ping, true);
+        when(instanceBootGroupReadinessRuleDao.findById(RULE_ID)).thenReturn(rule);
+        assertEquals(rule, manager.findById(RULE_ID));
+    }
+
+    @Test
+    public void getRuleDetailsDelegatesToDetailsDao() {
+        Map<String, String> details = Collections.singletonMap("k", "v");
+        when(instanceBootGroupReadinessRuleDetailsDao.getDetails(RULE_ID)).thenReturn(details);
+        assertEquals(details, manager.getRuleDetails(RULE_ID));
+    }
+
+    // ==================================================================
+    // evaluateVmReadiness / resolveVmReadiness (dispatch path)
+    // ==================================================================
+
+    @Test
+    public void evaluateVmReadinessVmNotFoundIsNotReady() {
+        when(userVmDao.findById(VM_ID)).thenReturn(null);
+        Status status = manager.evaluateVmReadiness(BOOT_GROUP_ID, VM_ID, 10000L, null);
+        assertEquals(Status.NotReady, status);
+    }
+
+    @Test
+    public void evaluateVmReadinessNonRunningVmIsNotReadyWithoutDispatch() {
+        UserVmVO vm70096 = mockVm(VM_ID, VirtualMachine.State.Stopped, HypervisorType.KVM);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm70096);
+        Status status = manager.evaluateVmReadiness(BOOT_GROUP_ID, VM_ID, 10000L, null);
+        assertEquals(Status.NotReady, status);
+        verify(instanceBootGroupReadinessRuleDao, never()).listEnabledByItem(anyLong(), any(), anyLong());
+        verify(instanceBootGroupReadinessCheckResultDao, never()).upsert(anyLong(), anyLong(), any(), any(), any());
+    }
+
+    @Test
+    public void evaluateVmReadinessNoRulesIsReady() {
+        UserVmVO vm85153 = mockVm(VM_ID, VirtualMachine.State.Running, HypervisorType.KVM);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm85153);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID)).thenReturn(Collections.emptyList());
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.emptyList());
+
+        Status status = manager.evaluateVmReadiness(BOOT_GROUP_ID, VM_ID, 10000L, null);
+        assertEquals(Status.Ready, status);
+    }
+
+    @Test
+    public void evaluateVmReadinessDispatchesDirectRuleAndCaches() {
+        UserVmVO vm85153 = mockVm(VM_ID, VirtualMachine.State.Running, HypervisorType.KVM);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm85153);
+        InstanceBootGroupReadinessRuleVO rule = ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.Ping, true);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID)).thenReturn(Collections.singletonList(rule));
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.emptyList());
+        manager.setReadinessCheckers(Collections.singletonList(mockChecker(RuleType.Ping, Status.Ready, "pong")));
+
+        Status status = manager.evaluateVmReadiness(BOOT_GROUP_ID, VM_ID, 10000L, null);
+
+        assertEquals(Status.Ready, status);
+        verify(instanceBootGroupReadinessCheckResultDao).upsert(eq(RULE_ID), eq(0L), eq(Status.Ready), eq("pong"), any(Date.class));
+    }
+
+    @Test
+    public void evaluateVmReadinessAppendsAttemptLabelToMessage() {
+        UserVmVO vm85153 = mockVm(VM_ID, VirtualMachine.State.Running, HypervisorType.KVM);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm85153);
+        InstanceBootGroupReadinessRuleVO rule = ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.Ping, true);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID)).thenReturn(Collections.singletonList(rule));
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.emptyList());
+        manager.setReadinessCheckers(Collections.singletonList(mockChecker(RuleType.Ping, Status.NotReady, "no reply")));
+
+        manager.evaluateVmReadiness(BOOT_GROUP_ID, VM_ID, 10000L, "2/5");
+
+        verify(instanceBootGroupReadinessCheckResultDao).upsert(eq(RULE_ID), eq(0L), eq(Status.NotReady), eq("no reply (attempt 2/5)"), any(Date.class));
+    }
+
+    @Test
+    public void evaluateVmReadinessSkipsAttemptLabelWhenBlank() {
+        UserVmVO vm85153 = mockVm(VM_ID, VirtualMachine.State.Running, HypervisorType.KVM);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm85153);
+        InstanceBootGroupReadinessRuleVO rule = ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.Ping, true);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID)).thenReturn(Collections.singletonList(rule));
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.emptyList());
+        manager.setReadinessCheckers(Collections.singletonList(mockChecker(RuleType.Ping, Status.Ready, "pong")));
+
+        manager.evaluateVmReadiness(BOOT_GROUP_ID, VM_ID, 10000L, null);
+
+        verify(instanceBootGroupReadinessCheckResultDao).upsert(eq(RULE_ID), eq(0L), eq(Status.Ready), eq("pong"), any(Date.class));
+    }
+
+    @Test
+    public void evaluateVmReadinessNoCheckerRegisteredSynthesizesError() {
+        UserVmVO vm85153 = mockVm(VM_ID, VirtualMachine.State.Running, HypervisorType.KVM);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm85153);
+        InstanceBootGroupReadinessRuleVO rule = ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.CustomScript, true);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID)).thenReturn(Collections.singletonList(rule));
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.emptyList());
+        // no checkers registered at all (set in @Before)
+
+        Status status = manager.evaluateVmReadiness(BOOT_GROUP_ID, VM_ID, 10000L, "1/3");
+
+        assertEquals(Status.Error, status);
+        verify(instanceBootGroupReadinessCheckResultDao).upsert(eq(RULE_ID), eq(0L), eq(Status.Error),
+                eq("No checker implemented yet for rule type CustomScript (attempt 1/3)"), any(Date.class));
+    }
+
+    @Test
+    public void evaluateVmReadinessErrorTakesPrecedenceOverNotReady() {
+        UserVmVO vm85153 = mockVm(VM_ID, VirtualMachine.State.Running, HypervisorType.KVM);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm85153);
+        InstanceBootGroupReadinessRuleVO pingRule = ruleVO(11L, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.Ping, true);
+        InstanceBootGroupReadinessRuleVO portRule = ruleVO(12L, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.PortCheck, true);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID)).thenReturn(Arrays.asList(pingRule, portRule));
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.emptyList());
+        List<ReadinessChecker> checkers = Arrays.asList(
+                mockChecker(RuleType.Ping, Status.NotReady, "not yet"),
+                mockChecker(RuleType.PortCheck, Status.Error, "boom"));
+        manager.setReadinessCheckers(checkers);
+
+        Status status = manager.evaluateVmReadiness(BOOT_GROUP_ID, VM_ID, 10000L, null);
+        assertEquals(Status.Error, status);
+    }
+
+    @Test
+    public void evaluateVmReadinessAllReadyIsReady() {
+        UserVmVO vm85153 = mockVm(VM_ID, VirtualMachine.State.Running, HypervisorType.KVM);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm85153);
+        InstanceBootGroupReadinessRuleVO pingRule = ruleVO(11L, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.Ping, true);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID)).thenReturn(Collections.singletonList(pingRule));
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.emptyList());
+        manager.setReadinessCheckers(Collections.singletonList(mockChecker(RuleType.Ping, Status.Ready, "pong")));
+
+        assertEquals(Status.Ready, manager.evaluateVmReadiness(BOOT_GROUP_ID, VM_ID, 10000L, null));
+    }
+
+    @Test
+    public void evaluateVmReadinessDispatchesInheritedGroupRuleAtMemberVmId() {
+        UserVmVO vm85153 = mockVm(VM_ID, VirtualMachine.State.Running, HypervisorType.KVM);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm85153);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID)).thenReturn(Collections.emptyList());
+
+        InstanceGroupVMMapVO mapping = new InstanceGroupVMMapVO(GROUP_ID, VM_ID);
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.singletonList(mapping));
+        when(instanceBootGroupMemberDao.findByMember(MemberType.InstanceGroup, GROUP_ID)).thenReturn(memberVO(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID));
+        InstanceBootGroupReadinessRuleVO groupPingRule = ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.Ping, true);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID)).thenReturn(Collections.singletonList(groupPingRule));
+        manager.setReadinessCheckers(Collections.singletonList(mockChecker(RuleType.Ping, Status.Ready, "pong")));
+
+        Status status = manager.evaluateVmReadiness(BOOT_GROUP_ID, VM_ID, 10000L, null);
+
+        assertEquals(Status.Ready, status);
+        verify(instanceBootGroupReadinessCheckResultDao).upsert(eq(RULE_ID), eq(VM_ID), eq(Status.Ready), eq("pong"), any(Date.class));
+    }
+
+    @Test
+    public void evaluateVmReadinessBudgetDoesNotIncreaseAcrossRules() {
+        UserVmVO vm85153 = mockVm(VM_ID, VirtualMachine.State.Running, HypervisorType.KVM);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm85153);
+        InstanceBootGroupReadinessRuleVO rule1 = ruleVO(11L, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.PortCheck, true);
+        InstanceBootGroupReadinessRuleVO rule2 = ruleVO(12L, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.PortCheck, true);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID)).thenReturn(Arrays.asList(rule1, rule2));
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.emptyList());
+
+        ReadinessChecker checker = mock(ReadinessChecker.class);
+        when(checker.getRuleType()).thenReturn(RuleType.PortCheck);
+        ArgumentCaptor<Long> remainingCaptor = ArgumentCaptor.forClass(Long.class);
+        when(checker.check(any(), any(), anyLong(), remainingCaptor.capture())).thenReturn(new ReadinessChecker.Result(Status.Ready, "ok"));
+        manager.setReadinessCheckers(Collections.singletonList(checker));
+
+        manager.evaluateVmReadiness(BOOT_GROUP_ID, VM_ID, 10000L, null);
+
+        List<Long> remaining = remainingCaptor.getAllValues();
+        assertEquals(2, remaining.size());
+        assertTrue("budget for first rule should be at most the initial budget", remaining.get(0) <= 10000L);
+        assertTrue("budget must not increase across rules", remaining.get(1) <= remaining.get(0));
+    }
+
+    // ==================================================================
+    // findInheritedGroupRules
+    // ==================================================================
+
+    @Test
+    public void findInheritedGroupRulesEmptyWhenVmNotInAnyGroup() {
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.emptyList());
+        assertTrue(manager.findInheritedGroupRules(BOOT_GROUP_ID, VM_ID).isEmpty());
+    }
+
+    @Test
+    public void findInheritedGroupRulesEmptyWhenGroupNotABootGroupMember() {
+        InstanceGroupVMMapVO mapping = new InstanceGroupVMMapVO(GROUP_ID, VM_ID);
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.singletonList(mapping));
+        when(instanceBootGroupMemberDao.findByMember(MemberType.InstanceGroup, GROUP_ID)).thenReturn(null);
+        assertTrue(manager.findInheritedGroupRules(BOOT_GROUP_ID, VM_ID).isEmpty());
+    }
+
+    @Test
+    public void findInheritedGroupRulesEmptyWhenGroupBelongsToDifferentBootGroup() {
+        InstanceGroupVMMapVO mapping = new InstanceGroupVMMapVO(GROUP_ID, VM_ID);
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.singletonList(mapping));
+        when(instanceBootGroupMemberDao.findByMember(MemberType.InstanceGroup, GROUP_ID)).thenReturn(memberVO(999L, MemberType.InstanceGroup, GROUP_ID));
+        assertTrue(manager.findInheritedGroupRules(BOOT_GROUP_ID, VM_ID).isEmpty());
+    }
+
+    @Test
+    public void findInheritedGroupRulesFiltersToMemberTargetedTypes() {
+        InstanceGroupVMMapVO mapping = new InstanceGroupVMMapVO(GROUP_ID, VM_ID);
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.singletonList(mapping));
+        when(instanceBootGroupMemberDao.findByMember(MemberType.InstanceGroup, GROUP_ID)).thenReturn(memberVO(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID));
+
+        InstanceBootGroupReadinessRuleVO pingRule = ruleVO(11L, BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.Ping, true);
+        InstanceBootGroupReadinessRuleVO quorumRule = ruleVO(12L, BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.MemberQuorum, true);
+        InstanceBootGroupReadinessRuleVO scriptRule = ruleVO(13L, BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.CustomScript, true);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID))
+                .thenReturn(Arrays.asList(pingRule, quorumRule, scriptRule));
+
+        List<InstanceBootGroupReadinessRule> result = manager.findInheritedGroupRules(BOOT_GROUP_ID, VM_ID);
+
+        assertEquals(1, result.size());
+        assertEquals(RuleType.Ping, result.get(0).getRuleType());
+    }
+
+    @Test
+    public void findInheritedGroupRulesSkipsNonMatchingMappingThenMatches() {
+        InstanceGroupVMMapVO mapping1 = new InstanceGroupVMMapVO(GROUP_ID, VM_ID);
+        InstanceGroupVMMapVO mapping2 = new InstanceGroupVMMapVO(GROUP_ID + 1, VM_ID);
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Arrays.asList(mapping1, mapping2));
+        when(instanceBootGroupMemberDao.findByMember(MemberType.InstanceGroup, GROUP_ID)).thenReturn(null);
+        when(instanceBootGroupMemberDao.findByMember(MemberType.InstanceGroup, GROUP_ID + 1)).thenReturn(memberVO(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID + 1));
+        InstanceBootGroupReadinessRuleVO pingRule = ruleVO(11L, BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID + 1, RuleType.Ping, true);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID + 1)).thenReturn(Collections.singletonList(pingRule));
+
+        List<InstanceBootGroupReadinessRule> result = manager.findInheritedGroupRules(BOOT_GROUP_ID, VM_ID);
+        assertEquals(1, result.size());
+    }
+
+    // ==================================================================
+    // invalidateCachedReadinessOnRestart
+    // ==================================================================
+
+    @Test
+    public void invalidateCachedReadinessOnRestartNoBootGroupInvolvementIsNoOp() {
+        when(instanceBootGroupMemberDao.findByMember(MemberType.VirtualMachine, VM_ID)).thenReturn(null);
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.emptyList());
+
+        manager.invalidateCachedReadinessOnRestart(VM_ID);
+
+        verify(instanceBootGroupReadinessCheckResultDao, never()).upsert(anyLong(), anyLong(), any(), any(), any());
+    }
+
+    @Test
+    public void invalidateCachedReadinessOnRestartDirectMemberInvalidatesOwnRules() {
+        when(instanceBootGroupMemberDao.findByMember(MemberType.VirtualMachine, VM_ID)).thenReturn(memberVO(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID));
+        InstanceBootGroupReadinessRuleVO pingRule = ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.Ping, true);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID)).thenReturn(Collections.singletonList(pingRule));
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.emptyList());
+
+        manager.invalidateCachedReadinessOnRestart(VM_ID);
+
+        verify(instanceBootGroupReadinessCheckResultDao).upsert(eq(RULE_ID), eq(0L), eq(Status.Unknown), any(), any(Date.class));
+    }
+
+    @Test
+    public void invalidateCachedReadinessOnRestartInheritedGroupRulesInvalidateOnlyMemberTargetedTypes() {
+        when(instanceBootGroupMemberDao.findByMember(MemberType.VirtualMachine, VM_ID)).thenReturn(null);
+        InstanceGroupVMMapVO mapping = new InstanceGroupVMMapVO(GROUP_ID, VM_ID);
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.singletonList(mapping));
+        when(instanceBootGroupMemberDao.findByMember(MemberType.InstanceGroup, GROUP_ID)).thenReturn(memberVO(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID));
+
+        InstanceBootGroupReadinessRuleVO pingRule = ruleVO(11L, BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.Ping, true);
+        InstanceBootGroupReadinessRuleVO quorumRule = ruleVO(12L, BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.MemberQuorum, true);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID))
+                .thenReturn(Arrays.asList(pingRule, quorumRule));
+
+        manager.invalidateCachedReadinessOnRestart(VM_ID);
+
+        verify(instanceBootGroupReadinessCheckResultDao).upsert(eq(11L), eq(VM_ID), eq(Status.Unknown), any(), any(Date.class));
+        verify(instanceBootGroupReadinessCheckResultDao, never()).upsert(eq(12L), anyLong(), any(), any(), any());
+    }
+
+    @Test
+    public void invalidateCachedReadinessOnRestartGroupNotABootGroupMemberIsNoOp() {
+        when(instanceBootGroupMemberDao.findByMember(MemberType.VirtualMachine, VM_ID)).thenReturn(null);
+        InstanceGroupVMMapVO mapping = new InstanceGroupVMMapVO(GROUP_ID, VM_ID);
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.singletonList(mapping));
+        when(instanceBootGroupMemberDao.findByMember(MemberType.InstanceGroup, GROUP_ID)).thenReturn(null);
+
+        manager.invalidateCachedReadinessOnRestart(VM_ID);
+
+        verify(instanceBootGroupReadinessCheckResultDao, never()).upsert(anyLong(), anyLong(), any(), any(), any());
+    }
+
+    @Test
+    public void invalidateCachedReadinessOnRestartInvalidatesBothDirectAndInheritedRules() {
+        when(instanceBootGroupMemberDao.findByMember(MemberType.VirtualMachine, VM_ID)).thenReturn(memberVO(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID));
+        InstanceBootGroupReadinessRuleVO directRule = ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID, RuleType.PortCheck, true);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.VirtualMachine, VM_ID)).thenReturn(Collections.singletonList(directRule));
+
+        InstanceGroupVMMapVO mapping = new InstanceGroupVMMapVO(GROUP_ID, VM_ID);
+        when(instanceGroupVMMapDao.listByInstanceId(VM_ID)).thenReturn(Collections.singletonList(mapping));
+        when(instanceBootGroupMemberDao.findByMember(MemberType.InstanceGroup, GROUP_ID)).thenReturn(memberVO(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID));
+        InstanceBootGroupReadinessRuleVO groupRule = ruleVO(11L, BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.GuestAgentLiveness, true);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID)).thenReturn(Collections.singletonList(groupRule));
+
+        manager.invalidateCachedReadinessOnRestart(VM_ID);
+
+        verify(instanceBootGroupReadinessCheckResultDao).upsert(eq(RULE_ID), eq(0L), eq(Status.Unknown), any(), any(Date.class));
+        verify(instanceBootGroupReadinessCheckResultDao).upsert(eq(11L), eq(VM_ID), eq(Status.Unknown), any(), any(Date.class));
+    }
+
+    // ==================================================================
+    // evaluateInstanceGroupReadiness
+    // ==================================================================
+
+    private void stubNoRuleVm(long vmId, VirtualMachine.State state) {
+        UserVmVO vm56538 = mockVm(vmId, state, HypervisorType.KVM);
+        when(userVmDao.findById(vmId)).thenReturn(vm56538);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.VirtualMachine, vmId)).thenReturn(Collections.emptyList());
+        when(instanceGroupVMMapDao.listByInstanceId(vmId)).thenReturn(Collections.emptyList());
+    }
+
+    @Test
+    public void evaluateInstanceGroupReadinessAllMembersReadyNoRules() {
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID)).thenReturn(Collections.emptyList());
+        InstanceGroupVMMapVO m1 = new InstanceGroupVMMapVO(GROUP_ID, VM_ID);
+        InstanceGroupVMMapVO m2 = new InstanceGroupVMMapVO(GROUP_ID, VM_ID_2);
+        when(instanceGroupVMMapDao.listByGroupId(GROUP_ID)).thenReturn(Arrays.asList(m1, m2));
+        stubNoRuleVm(VM_ID, VirtualMachine.State.Running);
+        stubNoRuleVm(VM_ID_2, VirtualMachine.State.Running);
+
+        Status status = manager.evaluateInstanceGroupReadiness(BOOT_GROUP_ID, GROUP_ID, Collections.emptySet());
+        assertEquals(Status.Ready, status);
+    }
+
+    @Test
+    public void evaluateInstanceGroupReadinessMidRetryMemberIsNotReadyNotError() {
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID)).thenReturn(Collections.emptyList());
+        InstanceGroupVMMapVO m1 = new InstanceGroupVMMapVO(GROUP_ID, VM_ID);
+        InstanceGroupVMMapVO m2 = new InstanceGroupVMMapVO(GROUP_ID, VM_ID_2);
+        when(instanceGroupVMMapDao.listByGroupId(GROUP_ID)).thenReturn(Arrays.asList(m1, m2));
+        stubNoRuleVm(VM_ID, VirtualMachine.State.Running);
+        stubNoRuleVm(VM_ID_2, VirtualMachine.State.Starting);
+
+        Status status = manager.evaluateInstanceGroupReadiness(BOOT_GROUP_ID, GROUP_ID, Collections.emptySet());
+        assertEquals(Status.NotReady, status);
+    }
+
+    @Test
+    public void evaluateInstanceGroupReadinessPermanentlyFailedMemberIsError() {
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID)).thenReturn(Collections.emptyList());
+        InstanceGroupVMMapVO m1 = new InstanceGroupVMMapVO(GROUP_ID, VM_ID);
+        InstanceGroupVMMapVO m2 = new InstanceGroupVMMapVO(GROUP_ID, VM_ID_2);
+        when(instanceGroupVMMapDao.listByGroupId(GROUP_ID)).thenReturn(Arrays.asList(m1, m2));
+        stubNoRuleVm(VM_ID, VirtualMachine.State.Running);
+        stubNoRuleVm(VM_ID_2, VirtualMachine.State.Starting);
+
+        Set<Long> permanentlyFailed = new HashSet<>(Collections.singletonList(VM_ID_2));
+        Status status = manager.evaluateInstanceGroupReadiness(BOOT_GROUP_ID, GROUP_ID, permanentlyFailed);
+        assertEquals(Status.Error, status);
+    }
+
+    @Test
+    public void evaluateInstanceGroupReadinessQuorumExcludesOwnMemberStatuses() {
+        InstanceBootGroupReadinessRuleVO quorumRule = ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.MemberQuorum, true);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID)).thenReturn(Collections.singletonList(quorumRule));
+        Map<String, String> details = new HashMap<>();
+        details.put("threshold_type", "COUNT");
+        details.put("threshold_value", "1");
+        when(instanceBootGroupReadinessRuleDetailsDao.getDetails(RULE_ID)).thenReturn(details);
+
+        InstanceGroupVMMapVO m1 = new InstanceGroupVMMapVO(GROUP_ID, VM_ID);
+        InstanceGroupVMMapVO m2 = new InstanceGroupVMMapVO(GROUP_ID, VM_ID_2);
+        when(instanceGroupVMMapDao.listByGroupId(GROUP_ID)).thenReturn(Arrays.asList(m1, m2));
+        stubNoRuleVm(VM_ID, VirtualMachine.State.Running);
+        stubNoRuleVm(VM_ID_2, VirtualMachine.State.Stopped); // NotReady, but must not affect result since quorum-governed
+
+        Status status = manager.evaluateInstanceGroupReadiness(BOOT_GROUP_ID, GROUP_ID, Collections.emptySet());
+
+        assertEquals(Status.Ready, status);
+        verify(instanceBootGroupReadinessCheckResultDao).upsert(eq(RULE_ID), eq(0L), eq(Status.Ready), any(), any(Date.class));
+    }
+
+    @Test
+    public void evaluateInstanceGroupReadinessQuorumMetOverridesFailingMemberTargetedRule() {
+        InstanceBootGroupReadinessRuleVO guestAgentRule = ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.GuestAgentLiveness, true);
+        InstanceBootGroupReadinessRuleVO quorumRule = ruleVO(20L, BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.MemberQuorum, true);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID))
+                .thenReturn(Arrays.asList(guestAgentRule, quorumRule));
+        when(instanceBootGroupReadinessRuleDetailsDao.getDetails(20L)).thenReturn(thresholdDetails("COUNT", "1"));
+
+        InstanceGroupVMMapVO m1 = new InstanceGroupVMMapVO(GROUP_ID, VM_ID);
+        InstanceGroupVMMapVO m2 = new InstanceGroupVMMapVO(GROUP_ID, VM_ID_2);
+        when(instanceGroupVMMapDao.listByGroupId(GROUP_ID)).thenReturn(Arrays.asList(m1, m2));
+        stubNoRuleVm(VM_ID, VirtualMachine.State.Running);
+        stubNoRuleVm(VM_ID_2, VirtualMachine.State.Running);
+
+        InstanceBootGroupReadinessCheckResultVO ready = new InstanceBootGroupReadinessCheckResultVO(RULE_ID, VM_ID, Status.Ready, "ok", new Date());
+        InstanceBootGroupReadinessCheckResultVO notReady = new InstanceBootGroupReadinessCheckResultVO(RULE_ID, VM_ID_2, Status.NotReady, "no agent", new Date());
+        when(instanceBootGroupReadinessCheckResultDao.findByRuleAndVm(RULE_ID, VM_ID)).thenReturn(ready);
+        when(instanceBootGroupReadinessCheckResultDao.findByRuleAndVm(RULE_ID, VM_ID_2)).thenReturn(notReady);
+
+        Status status = manager.evaluateInstanceGroupReadiness(BOOT_GROUP_ID, GROUP_ID, Collections.emptySet());
+
+        assertEquals(Status.Ready, status);
+        verify(instanceBootGroupReadinessCheckResultDao).upsert(eq(RULE_ID), eq(0L), eq(Status.NotReady), any(), any(Date.class));
+        verify(instanceBootGroupReadinessCheckResultDao).upsert(eq(20L), eq(0L), eq(Status.Ready), any(), any(Date.class));
+    }
+
+    @Test
+    public void evaluateInstanceGroupReadinessMemberTargetedRuleAggregatesCachedResults() {
+        InstanceBootGroupReadinessRuleVO pingRule = ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.Ping, true);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID)).thenReturn(Collections.singletonList(pingRule));
+
+        InstanceGroupVMMapVO m1 = new InstanceGroupVMMapVO(GROUP_ID, VM_ID);
+        InstanceGroupVMMapVO m2 = new InstanceGroupVMMapVO(GROUP_ID, VM_ID_2);
+        when(instanceGroupVMMapDao.listByGroupId(GROUP_ID)).thenReturn(Arrays.asList(m1, m2));
+        stubNoRuleVm(VM_ID, VirtualMachine.State.Running);
+        stubNoRuleVm(VM_ID_2, VirtualMachine.State.Running);
+
+        InstanceBootGroupReadinessCheckResultVO cached1 = new InstanceBootGroupReadinessCheckResultVO(RULE_ID, VM_ID, Status.Ready, "ok", new Date());
+        InstanceBootGroupReadinessCheckResultVO cached2 = new InstanceBootGroupReadinessCheckResultVO(RULE_ID, VM_ID_2, Status.Ready, "ok", new Date());
+        when(instanceBootGroupReadinessCheckResultDao.findByRuleAndVm(RULE_ID, VM_ID)).thenReturn(cached1);
+        when(instanceBootGroupReadinessCheckResultDao.findByRuleAndVm(RULE_ID, VM_ID_2)).thenReturn(cached2);
+
+        Status status = manager.evaluateInstanceGroupReadiness(BOOT_GROUP_ID, GROUP_ID, Collections.emptySet());
+
+        assertEquals(Status.Ready, status);
+        verify(instanceBootGroupReadinessCheckResultDao).upsert(eq(RULE_ID), eq(0L), eq(Status.Ready), eq("2 of 2 member(s) ready via Ping"), any(Date.class));
+    }
+
+    @Test
+    public void evaluateInstanceGroupReadinessMemberTargetedRuleNoMembersIsNotReady() {
+        InstanceBootGroupReadinessRuleVO pingRule = ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.Ping, true);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID)).thenReturn(Collections.singletonList(pingRule));
+        when(instanceGroupVMMapDao.listByGroupId(GROUP_ID)).thenReturn(Collections.emptyList());
+
+        Status status = manager.evaluateInstanceGroupReadiness(BOOT_GROUP_ID, GROUP_ID, Collections.emptySet());
+
+        assertEquals(Status.NotReady, status);
+        verify(instanceBootGroupReadinessCheckResultDao).upsert(eq(RULE_ID), eq(0L), eq(Status.NotReady), eq("Instance group has no members"), any(Date.class));
+    }
+
+    @Test
+    public void evaluateInstanceGroupReadinessMemberTargetedRuleAnyErrorIsError() {
+        InstanceBootGroupReadinessRuleVO pingRule = ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.Ping, true);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID)).thenReturn(Collections.singletonList(pingRule));
+
+        InstanceGroupVMMapVO m1 = new InstanceGroupVMMapVO(GROUP_ID, VM_ID);
+        when(instanceGroupVMMapDao.listByGroupId(GROUP_ID)).thenReturn(Collections.singletonList(m1));
+        stubNoRuleVm(VM_ID, VirtualMachine.State.Running);
+        InstanceBootGroupReadinessCheckResultVO cached = new InstanceBootGroupReadinessCheckResultVO(RULE_ID, VM_ID, Status.Error, "unreachable", new Date());
+        when(instanceBootGroupReadinessCheckResultDao.findByRuleAndVm(RULE_ID, VM_ID)).thenReturn(cached);
+
+        Status status = manager.evaluateInstanceGroupReadiness(BOOT_GROUP_ID, GROUP_ID, Collections.emptySet());
+        assertEquals(Status.Error, status);
+    }
+
+    @Test
+    public void evaluateInstanceGroupReadinessUnimplementedGroupRuleTypeIsError() {
+        InstanceBootGroupReadinessRuleVO scriptRule = ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.CustomScript, true);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID)).thenReturn(Collections.singletonList(scriptRule));
+        when(instanceGroupVMMapDao.listByGroupId(GROUP_ID)).thenReturn(Collections.emptyList());
+
+        Status status = manager.evaluateInstanceGroupReadiness(BOOT_GROUP_ID, GROUP_ID, Collections.emptySet());
+
+        assertEquals(Status.Error, status);
+        verify(instanceBootGroupReadinessCheckResultDao).upsert(eq(RULE_ID), eq(0L), eq(Status.Error),
+                eq("No evaluator implemented yet for rule type CustomScript"), any(Date.class));
+    }
+
+    // ==================================================================
+    // evaluateInstanceQuorum (via evaluateInstanceGroupReadiness + MemberQuorum rule)
+    // ==================================================================
+
+    private Status evaluateQuorum(Map<String, String> details, List<InstanceGroupVMMapVO> members, Set<Long> permanentlyFailed) {
+        InstanceBootGroupReadinessRuleVO quorumRule = ruleVO(RULE_ID, BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID, RuleType.MemberQuorum, true);
+        when(instanceBootGroupReadinessRuleDao.listEnabledByItem(BOOT_GROUP_ID, MemberType.InstanceGroup, GROUP_ID)).thenReturn(Collections.singletonList(quorumRule));
+        when(instanceBootGroupReadinessRuleDetailsDao.getDetails(RULE_ID)).thenReturn(details);
+        when(instanceGroupVMMapDao.listByGroupId(GROUP_ID)).thenReturn(members);
+        return manager.evaluateInstanceGroupReadiness(BOOT_GROUP_ID, GROUP_ID, permanentlyFailed);
+    }
+
+    private Map<String, String> thresholdDetails(String type, String value) {
+        Map<String, String> details = new HashMap<>();
+        details.put("threshold_type", type);
+        details.put("threshold_value", value);
+        return details;
+    }
+
+    @Test
+    public void evaluateInstanceQuorumNoMembersIsNotReady() {
+        Status status = evaluateQuorum(thresholdDetails("COUNT", "1"), Collections.emptyList(), Collections.emptySet());
+        assertEquals(Status.NotReady, status);
+        verify(instanceBootGroupReadinessCheckResultDao).upsert(eq(RULE_ID), eq(0L), eq(Status.NotReady), eq("Instance group has no members"), any(Date.class));
+    }
+
+    @Test
+    public void evaluateInstanceQuorumPercentageThresholdMet() {
+        List<InstanceGroupVMMapVO> members = new ArrayList<>();
+        for (long i = 0; i < 4; i++) {
+            members.add(new InstanceGroupVMMapVO(GROUP_ID, VM_ID + i));
+            stubNoRuleVm(VM_ID + i, i < 3 ? VirtualMachine.State.Running : VirtualMachine.State.Stopped);
+        }
+        Status status = evaluateQuorum(thresholdDetails("PERCENTAGE", "50"), members, Collections.emptySet());
+        assertEquals(Status.Ready, status);
+    }
+
+    @Test
+    public void evaluateInstanceQuorumPercentageThresholdNotMetButAchievable() {
+        List<InstanceGroupVMMapVO> members = new ArrayList<>();
+        for (long i = 0; i < 4; i++) {
+            members.add(new InstanceGroupVMMapVO(GROUP_ID, VM_ID + i));
+            stubNoRuleVm(VM_ID + i, i < 1 ? VirtualMachine.State.Running : VirtualMachine.State.Stopped);
+        }
+        Status status = evaluateQuorum(thresholdDetails("PERCENTAGE", "50"), members, Collections.emptySet());
+        assertEquals(Status.NotReady, status);
+    }
+
+    @Test
+    public void evaluateInstanceQuorumPercentageThresholdUnreachableIsError() {
+        List<InstanceGroupVMMapVO> members = new ArrayList<>();
+        Set<Long> permanentlyFailed = new HashSet<>();
+        for (long i = 0; i < 4; i++) {
+            long vmId = VM_ID + i;
+            members.add(new InstanceGroupVMMapVO(GROUP_ID, vmId));
+            if (i < 1) {
+                stubNoRuleVm(vmId, VirtualMachine.State.Running);
+            } else {
+                stubNoRuleVm(vmId, VirtualMachine.State.Stopped);
+                permanentlyFailed.add(vmId);
+            }
+        }
+        // 1 ready, achievableCount = 4 - 3 = 1, 25% < 90% -> unreachable
+        Status status = evaluateQuorum(thresholdDetails("PERCENTAGE", "90"), members, permanentlyFailed);
+        assertEquals(Status.Error, status);
+    }
+
+    @Test
+    public void evaluateInstanceQuorumCountThresholdMet() {
+        List<InstanceGroupVMMapVO> members = new ArrayList<>();
+        for (long i = 0; i < 3; i++) {
+            members.add(new InstanceGroupVMMapVO(GROUP_ID, VM_ID + i));
+            stubNoRuleVm(VM_ID + i, i < 2 ? VirtualMachine.State.Running : VirtualMachine.State.Stopped);
+        }
+        Status status = evaluateQuorum(thresholdDetails("COUNT", "2"), members, Collections.emptySet());
+        assertEquals(Status.Ready, status);
+    }
+
+    @Test
+    public void evaluateInstanceQuorumInvalidThresholdValueIsError() {
+        List<InstanceGroupVMMapVO> members = Collections.singletonList(new InstanceGroupVMMapVO(GROUP_ID, VM_ID));
+        stubNoRuleVm(VM_ID, VirtualMachine.State.Running);
+        Status status = evaluateQuorum(thresholdDetails("COUNT", "abc"), members, Collections.emptySet());
+        assertEquals(Status.Error, status);
+        verify(instanceBootGroupReadinessCheckResultDao).upsert(eq(RULE_ID), eq(0L), eq(Status.Error),
+                eq("Invalid threshold configuration: COUNT=abc"), any(Date.class));
+    }
+}
diff --git a/server/src/test/java/org/apache/cloudstack/vm/bootgroup/readiness/PortCheckCheckerTest.java b/server/src/test/java/org/apache/cloudstack/vm/bootgroup/readiness/PortCheckCheckerTest.java
new file mode 100644
index 000000000000..f64ffb4dfd9b
--- /dev/null
+++ b/server/src/test/java/org/apache/cloudstack/vm/bootgroup/readiness/PortCheckCheckerTest.java
@@ -0,0 +1,245 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm.bootgroup.readiness;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.cloudstack.engine.orchestration.service.NetworkOrchestrationService;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.AgentManager;
+import com.cloud.agent.api.routing.NetworkElementCommand;
+import com.cloud.hypervisor.Hypervisor.HypervisorType;
+import com.cloud.network.Network;
+import com.cloud.network.dao.NetworkDao;
+import com.cloud.network.dao.NetworkVO;
+import com.cloud.network.router.VirtualRouter;
+import com.cloud.network.router.VpcVirtualNetworkApplianceManager;
+import com.cloud.vm.NicVO;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.VirtualMachineManager;
+import com.cloud.vm.dao.NicDao;
+import com.cloud.vm.dao.UserVmDao;
+
+@RunWith(MockitoJUnitRunner.class)
+public class PortCheckCheckerTest {
+
+    private static final long VM_ID = 100L;
+    private static final long NETWORK_ID = 200L;
+    private static final long HOST_ID = 300L;
+    private static final String IP = "10.1.1.5";
+
+    @InjectMocks
+    PortCheckChecker checker;
+
+    @Mock
+    UserVmDao userVmDao;
+    @Mock
+    NicDao nicDao;
+    @Mock
+    NetworkDao networkDao;
+    @Mock
+    VpcVirtualNetworkApplianceManager virtualNetworkApplianceManager;
+    @Mock
+    VirtualMachineManager virtualMachineManager;
+    @Mock
+    NetworkOrchestrationService networkOrchestrationService;
+    @Mock
+    AgentManager agentManager;
+
+    private UserVmVO vm;
+    private VirtualRouter router;
+    private Map<String, String> details;
+
+    @Before
+    public void setUp() {
+        vm = mock(UserVmVO.class);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm);
+
+        details = new HashMap<>();
+        details.put("port", "80");
+        details.put("protocol", "tcp");
+
+        NicVO nic = mock(NicVO.class);
+        when(nic.getIPv4Address()).thenReturn(IP);
+        when(nic.getNetworkId()).thenReturn(NETWORK_ID);
+        when(nicDao.findDefaultNicForVM(VM_ID)).thenReturn(nic);
+
+        NetworkVO network = mock(NetworkVO.class);
+        when(network.getGuestType()).thenReturn(Network.GuestType.Isolated);
+        when(networkDao.findById(NETWORK_ID)).thenReturn(network);
+
+        router = mock(VirtualRouter.class);
+        when(router.getState()).thenReturn(VirtualMachine.State.Running);
+        when(router.getHostId()).thenReturn(HOST_ID);
+        when(router.getHypervisorType()).thenReturn(HypervisorType.KVM);
+        when(virtualNetworkApplianceManager.getRoutersForNetwork(NETWORK_ID)).thenReturn(Collections.singletonList(router));
+
+        when(virtualMachineManager.getExecuteInSequence(HypervisorType.KVM)).thenReturn(false);
+
+        Map<String, String> accessDetails = new HashMap<>();
+        accessDetails.put(NetworkElementCommand.ROUTER_IP, "10.1.1.1");
+        when(networkOrchestrationService.getSystemVMAccessDetails(router)).thenReturn(accessDetails);
+    }
+
+    private InstanceBootGroupReadinessRule rule() {
+        return mock(InstanceBootGroupReadinessRule.class);
+    }
+
+    @Test
+    public void getRuleTypeIsPortCheck() {
+        assertEquals(InstanceBootGroupReadinessRule.RuleType.PortCheck, checker.getRuleType());
+    }
+
+    @Test
+    public void vmNotFoundIsError() {
+        when(userVmDao.findById(VM_ID)).thenReturn(null);
+        ReadinessChecker.Result result = checker.check(rule(), details, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+    }
+
+    @Test
+    public void nonTcpProtocolIsError() {
+        details.put("protocol", "udp");
+        ReadinessChecker.Result result = checker.check(rule(), details, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+        assertTrue(result.getMessage().contains("Only tcp"));
+    }
+
+    @Test
+    public void blankProtocolDefaultsToTcp() {
+        details.remove("protocol");
+        when(agentManager.easySend(eq(HOST_ID), any())).thenReturn(readinessAnswer(true, "out&&err&&0"));
+        ReadinessChecker.Result result = checker.check(rule(), details, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Ready, result.getStatus());
+    }
+
+    @Test
+    public void missingPortIsError() {
+        details.remove("port");
+        ReadinessChecker.Result result = checker.check(rule(), details, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+        assertTrue(result.getMessage().contains("Invalid or missing port"));
+    }
+
+    @Test
+    public void nonNumericPortIsError() {
+        details.put("port", "not-a-number");
+        ReadinessChecker.Result result = checker.check(rule(), details, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+    }
+
+    @Test
+    public void portOutOfRangeIsError() {
+        details.put("port", "70000");
+        ReadinessChecker.Result result = checker.check(rule(), details, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+    }
+
+    @Test
+    public void zeroPortIsError() {
+        details.put("port", "0");
+        ReadinessChecker.Result result = checker.check(rule(), details, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+    }
+
+    @Test
+    public void noDefaultNicIsError() {
+        when(nicDao.findDefaultNicForVM(VM_ID)).thenReturn(null);
+        ReadinessChecker.Result result = checker.check(rule(), details, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+    }
+
+    @Test
+    public void l2NetworkIsError() {
+        NetworkVO l2Network = mock(NetworkVO.class);
+        when(l2Network.getGuestType()).thenReturn(Network.GuestType.L2);
+        when(networkDao.findById(NETWORK_ID)).thenReturn(l2Network);
+        ReadinessChecker.Result result = checker.check(rule(), details, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+    }
+
+    @Test
+    public void noRunningRouterIsError() {
+        when(virtualNetworkApplianceManager.getRoutersForNetwork(NETWORK_ID)).thenReturn(Collections.emptyList());
+        ReadinessChecker.Result result = checker.check(rule(), details, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+    }
+
+    @Test
+    public void missingRouterControlIpIsError() {
+        when(networkOrchestrationService.getSystemVMAccessDetails(router)).thenReturn(new HashMap<>());
+        ReadinessChecker.Result result = checker.check(rule(), details, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+    }
+
+    @Test
+    public void insufficientBudgetIsError() {
+        ReadinessChecker.Result result = checker.check(rule(), details, VM_ID, 500);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+    }
+
+    @Test
+    public void dispatchExceptionIsError() {
+        when(agentManager.easySend(eq(HOST_ID), any())).thenThrow(new RuntimeException("agent down"));
+        ReadinessChecker.Result result = checker.check(rule(), details, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+    }
+
+    @Test
+    public void nullAnswerIsError() {
+        when(agentManager.easySend(eq(HOST_ID), any())).thenReturn(null);
+        ReadinessChecker.Result result = checker.check(rule(), details, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+    }
+
+    @Test
+    public void exitCodeZeroIsReady() {
+        when(agentManager.easySend(eq(HOST_ID), any())).thenReturn(readinessAnswer(true, "out&&err&&0"));
+        ReadinessChecker.Result result = checker.check(rule(), details, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Ready, result.getStatus());
+        assertEquals("port 80/tcp is open", result.getMessage());
+    }
+
+    @Test
+    public void nonZeroExitCodeIsError() {
+        when(agentManager.easySend(eq(HOST_ID), any())).thenReturn(readinessAnswer(true, "out&&connection refused&&1"));
+        ReadinessChecker.Result result = checker.check(rule(), details, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+        assertTrue(result.getMessage().contains("connection refused"));
+    }
+
+    private InstanceReadinessCheckAnswer readinessAnswer(boolean result, String rawDetails) {
+        InstanceReadinessCheckCommand cmd = new InstanceReadinessCheckCommand(IP, 80, false);
+        return new InstanceReadinessCheckAnswer(cmd, result, rawDetails);
+    }
+}
diff --git a/server/src/test/java/org/apache/cloudstack/vm/bootgroup/readiness/VrPingCheckerTest.java b/server/src/test/java/org/apache/cloudstack/vm/bootgroup/readiness/VrPingCheckerTest.java
new file mode 100644
index 000000000000..4536c1662391
--- /dev/null
+++ b/server/src/test/java/org/apache/cloudstack/vm/bootgroup/readiness/VrPingCheckerTest.java
@@ -0,0 +1,244 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm.bootgroup.readiness;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.engine.orchestration.service.NetworkOrchestrationService;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.AgentManager;
+import com.cloud.agent.api.routing.NetworkElementCommand;
+import com.cloud.hypervisor.Hypervisor.HypervisorType;
+import com.cloud.network.Network;
+import com.cloud.network.dao.NetworkDao;
+import com.cloud.network.dao.NetworkVO;
+import com.cloud.network.router.VirtualRouter;
+import com.cloud.network.router.VpcVirtualNetworkApplianceManager;
+import com.cloud.vm.NicVO;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.VirtualMachineManager;
+import com.cloud.vm.dao.NicDao;
+import com.cloud.vm.dao.UserVmDao;
+
+@RunWith(MockitoJUnitRunner.class)
+public class VrPingCheckerTest {
+
+    private static final long VM_ID = 100L;
+    private static final long NETWORK_ID = 200L;
+    private static final long HOST_ID = 300L;
+    private static final String IP = "10.1.1.5";
+
+    @InjectMocks
+    VrPingChecker checker;
+
+    @Mock
+    UserVmDao userVmDao;
+    @Mock
+    NicDao nicDao;
+    @Mock
+    NetworkDao networkDao;
+    @Mock
+    VpcVirtualNetworkApplianceManager virtualNetworkApplianceManager;
+    @Mock
+    VirtualMachineManager virtualMachineManager;
+    @Mock
+    NetworkOrchestrationService networkOrchestrationService;
+    @Mock
+    AgentManager agentManager;
+
+    private UserVmVO vm;
+    private NicVO nic;
+    private VirtualRouter router;
+
+    @Before
+    public void setUp() {
+        vm = mock(UserVmVO.class);
+        when(userVmDao.findById(VM_ID)).thenReturn(vm);
+
+        nic = mock(NicVO.class);
+        when(nic.getIPv4Address()).thenReturn(IP);
+        when(nic.getNetworkId()).thenReturn(NETWORK_ID);
+        when(nicDao.findDefaultNicForVM(VM_ID)).thenReturn(nic);
+
+        NetworkVO network = mock(NetworkVO.class);
+        when(network.getGuestType()).thenReturn(Network.GuestType.Isolated);
+        when(networkDao.findById(NETWORK_ID)).thenReturn(network);
+
+        router = mock(VirtualRouter.class);
+        when(router.getState()).thenReturn(VirtualMachine.State.Running);
+        when(router.getHostId()).thenReturn(HOST_ID);
+        when(router.getHypervisorType()).thenReturn(HypervisorType.KVM);
+        when(virtualNetworkApplianceManager.getRoutersForNetwork(NETWORK_ID)).thenReturn(Collections.singletonList(router));
+
+        when(virtualMachineManager.getExecuteInSequence(HypervisorType.KVM)).thenReturn(false);
+
+        Map<String, String> accessDetails = new HashMap<>();
+        accessDetails.put(NetworkElementCommand.ROUTER_IP, "10.1.1.1");
+        when(networkOrchestrationService.getSystemVMAccessDetails(router)).thenReturn(accessDetails);
+    }
+
+    private InstanceBootGroupReadinessRule rule() {
+        return mock(InstanceBootGroupReadinessRule.class);
+    }
+
+    @Test
+    public void getRuleTypeIsPing() {
+        assertEquals(InstanceBootGroupReadinessRule.RuleType.Ping, checker.getRuleType());
+    }
+
+    @Test
+    public void vmNotFoundIsError() {
+        when(userVmDao.findById(VM_ID)).thenReturn(null);
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+        assertEquals("VM not found", result.getMessage());
+    }
+
+    @Test
+    public void noDefaultNicIsError() {
+        when(nicDao.findDefaultNicForVM(VM_ID)).thenReturn(null);
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+        assertTrue(result.getMessage().contains("no default NIC"));
+    }
+
+    @Test
+    public void blankIpv4AddressIsError() {
+        when(nic.getIPv4Address()).thenReturn("");
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+    }
+
+    @Test
+    public void l2NetworkIsError() {
+        NetworkVO l2Network = mock(NetworkVO.class);
+        when(l2Network.getGuestType()).thenReturn(Network.GuestType.L2);
+        when(networkDao.findById(NETWORK_ID)).thenReturn(l2Network);
+
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+        assertTrue(result.getMessage().contains("L2 network"));
+    }
+
+    @Test
+    public void noRunningRouterIsError() {
+        when(virtualNetworkApplianceManager.getRoutersForNetwork(NETWORK_ID)).thenReturn(Collections.emptyList());
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+        assertTrue(result.getMessage().contains("No running VR found"));
+    }
+
+    @Test
+    public void routerWithoutHostIdIsError() {
+        when(router.getHostId()).thenReturn(null);
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+        assertTrue(result.getMessage().contains("No running VR found"));
+    }
+
+    @Test
+    public void nonRunningRouterIsSkippedForRunningOne() {
+        VirtualRouter stoppedRouter = mock(VirtualRouter.class);
+        when(stoppedRouter.getState()).thenReturn(VirtualMachine.State.Stopped);
+        when(virtualNetworkApplianceManager.getRoutersForNetwork(NETWORK_ID)).thenReturn(List.of(stoppedRouter, router));
+        when(agentManager.easySend(eq(HOST_ID), any())).thenReturn(readinessAnswer(true, "out&&err&&0"));
+
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Ready, result.getStatus());
+    }
+
+    @Test
+    public void missingRouterControlIpIsError() {
+        when(networkOrchestrationService.getSystemVMAccessDetails(router)).thenReturn(new HashMap<>());
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+        assertTrue(result.getMessage().contains("control IP"));
+    }
+
+    @Test
+    public void insufficientBudgetIsError() {
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 500);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+        assertTrue(result.getMessage().contains("Insufficient time remaining"));
+    }
+
+    @Test
+    public void dispatchExceptionIsError() {
+        when(agentManager.easySend(eq(HOST_ID), any())).thenThrow(new RuntimeException("agent down"));
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+        assertTrue(result.getMessage().contains("agent down"));
+    }
+
+    @Test
+    public void nullAnswerIsError() {
+        when(agentManager.easySend(eq(HOST_ID), any())).thenReturn(null);
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+        assertTrue(result.getMessage().contains("No answer"));
+    }
+
+    @Test
+    public void exitCodeZeroIsReady() {
+        when(agentManager.easySend(eq(HOST_ID), any())).thenReturn(readinessAnswer(true, "out&&err&&0"));
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Ready, result.getStatus());
+        assertEquals("ping succeeded", result.getMessage());
+    }
+
+    @Test
+    public void nonZeroExitCodeIsError() {
+        when(agentManager.easySend(eq(HOST_ID), any())).thenReturn(readinessAnswer(true, "out&&unreachable&&1"));
+        ReadinessChecker.Result result = checker.check(rule(), null, VM_ID, 60000);
+        assertEquals(InstanceBootGroupReadinessRule.Status.Error, result.getStatus());
+        assertTrue(result.getMessage().contains("unreachable"));
+    }
+
+    @Test
+    public void waitIsHalvedRemainingBudgetFlooredAtOne() {
+        when(agentManager.easySend(eq(HOST_ID), any())).thenReturn(readinessAnswer(true, "out&&err&&0"));
+        ArgumentCaptor<InstanceReadinessCheckCommand> captor = ArgumentCaptor.forClass(InstanceReadinessCheckCommand.class);
+
+        checker.check(rule(), null, VM_ID, 2500);
+
+        org.mockito.Mockito.verify(agentManager).easySend(eq(HOST_ID), captor.capture());
+        assertEquals(1, captor.getValue().getWait());
+    }
+
+    private InstanceReadinessCheckAnswer readinessAnswer(boolean result, String details) {
+        InstanceReadinessCheckCommand cmd = new InstanceReadinessCheckCommand(IP, false);
+        return new InstanceReadinessCheckAnswer(cmd, result, details);
+    }
+}
diff --git a/systemvm/debian/opt/cloud/bin/instance_readiness_check.py b/systemvm/debian/opt/cloud/bin/instance_readiness_check.py
new file mode 100644
index 000000000000..2d68ccc513f7
--- /dev/null
+++ b/systemvm/debian/opt/cloud/bin/instance_readiness_check.py
@@ -0,0 +1,71 @@
+#!/usr/bin/env python
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# Standalone readiness-check helper for the instance boot group feature. Kept separate from
+# diagnostics.py, which is a general-purpose admin tool for system VMs: this script is invoked
+# on behalf of user instance readiness rules and should not share code/behaviour with that tool.
+
+import socket
+import subprocess
+import sys
+
+
+def emit(stdout, stderr, exit_code):
+    print('%s&&' % stdout)
+    print('%s&&' % stderr)
+    print('%s' % exit_code)
+
+
+def check_ping(host, count=4):
+    try:
+        p = subprocess.Popen(['ping', '-c', str(count), host], stdout=subprocess.PIPE, stderr=subprocess.PIPE)
+        stdout, stderr = p.communicate()
+        emit(stdout.decode().strip(), stderr.decode().strip(), p.returncode)
+    except OSError as e:
+        emit('', 'Exception occurred: %s' % e, 1)
+
+
+def check_port(host, port, timeout=3):
+    try:
+        with socket.create_connection((host, int(port)), timeout=timeout):
+            emit('connected', '', 0)
+    except Exception as e:
+        emit('', str(e), 1)
+
+
+def main():
+    if len(sys.argv) < 3:
+        emit('', 'Usage: instance_readiness_check.py <ping|portcheck> <host> [port]', 1)
+        return
+
+    check_type = sys.argv[1]
+    host = sys.argv[2]
+
+    if check_type == 'ping':
+        check_ping(host)
+    elif check_type == 'portcheck':
+        if len(sys.argv) < 4:
+            emit('', 'portcheck requires a port argument', 1)
+            return
+        check_port(host, sys.argv[3])
+    else:
+        emit('', 'Unknown check type: %s' % check_type, 1)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/test/integration/smoke/test_instance_boot_group.py b/test/integration/smoke/test_instance_boot_group.py
new file mode 100644
index 000000000000..69c0e333637e
--- /dev/null
+++ b/test/integration/smoke/test_instance_boot_group.py
@@ -0,0 +1,310 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+""" BVT tests for Instance Boot Group and readiness rules lifecycle
+"""
+# Import Local Modules
+from marvin.cloudstackTestCase import cloudstackTestCase
+from marvin.lib.base import (Account,
+                             ServiceOffering,
+                             VirtualMachine,
+                             InstanceGroup,
+                             InstanceBootGroup,
+                             InstanceBootGroupReadinessRule)
+from marvin.lib.common import (get_domain,
+                               get_zone,
+                               get_template)
+from marvin.lib.utils import (random_gen)
+from marvin.cloudstackException import CloudstackAPIException
+from marvin.codes import FAILED
+from nose.plugins.attrib import attr
+import logging
+import time
+
+_multiprocess_shared_ = True
+
+
+class TestInstanceBootGroup(cloudstackTestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        testClient = super(TestInstanceBootGroup, cls).getClsTestClient()
+        cls.apiclient = testClient.getApiClient()
+        cls.services = testClient.getParsedTestDataConfig()
+        cls.logger = logging.getLogger('TestInstanceBootGroup')
+        cls.logger.setLevel(logging.DEBUG)
+
+        cls.domain = get_domain(cls.apiclient)
+        cls.zone = get_zone(cls.apiclient, testClient.getZoneForTests())
+        cls.hypervisor = testClient.getHypervisorInfo()
+
+        cls.template = get_template(
+            cls.apiclient,
+            zone_id=cls.zone.id,
+            hypervisor=cls.hypervisor
+        )
+        if cls.template == FAILED:
+            assert False, "get_template() failed to return template"
+
+        cls._cleanup = []
+        cls.account = Account.create(
+            cls.apiclient,
+            cls.services["account"],
+            domainid=cls.domain.id
+        )
+        cls._cleanup.append(cls.account)
+
+        cls.service_offering = ServiceOffering.create(
+            cls.apiclient,
+            cls.services["service_offerings"]["tiny"]
+        )
+        cls._cleanup.append(cls.service_offering)
+
+    @classmethod
+    def tearDownClass(cls):
+        super(TestInstanceBootGroup, cls).tearDownClass()
+
+    def setUp(self):
+        self.apiclient = self.testClient.getApiClient()
+        self.cleanup = []
+
+    def tearDown(self):
+        super(TestInstanceBootGroup, self).tearDown()
+
+    def deployTestVm(self, name_hint, group=None):
+        """Deploys a small VM under the shared test account, tracked for cleanup"""
+        vm = VirtualMachine.create(
+            self.apiclient,
+            self.services["virtual_machine"],
+            templateid=self.template.id,
+            zoneid=self.zone.id,
+            accountid=self.account.name,
+            domainid=self.account.domainid,
+            serviceofferingid=self.service_offering.id,
+            group=group
+        )
+        self.cleanup.append(vm)
+        return vm
+
+    def createTestBootGroup(self, name_hint):
+        boot_group = InstanceBootGroup.create(
+            self.apiclient,
+            name="-".join([name_hint, random_gen()]),
+            description="smoke test boot group",
+            account=self.account.name,
+            domainid=self.account.domainid
+        )
+        self.cleanup.append(boot_group)
+        return boot_group
+
+    def waitForMemberReadinessStatus(self, boot_group, expected_status, timeout=180, interval=5, ignoreinstancestate=None):
+        """Polls listInstanceBootGroupMembers (with readiness details requested) until every
+        member reaches expected_status, or timeout"""
+        members = []
+        waited = 0
+        while waited <= timeout:
+            kwargs = {"details": ["readiness"]}
+            if ignoreinstancestate is not None:
+                kwargs["ignoreinstancestate"] = ignoreinstancestate
+            members = InstanceBootGroup.listMembers(self.apiclient, bootgroupid=boot_group.id, **kwargs)
+            if members and all(m.readinessstatus == expected_status for m in members):
+                return members
+            time.sleep(interval)
+            waited += interval
+        return members
+
+    @attr(tags=["advanced", "advancedns", "smoke", "basic"], required_hardware="false")
+    def test_01_boot_group_and_member_lifecycle(self):
+        """Create a boot group, add a VM member and an InstanceGroup member with
+        distinct boot order tiers, verify listing, update a member's order, remove a
+        member, then delete the boot group and confirm its members are cleaned up"""
+
+        vm1 = self.deployTestVm("smoke-boot-db")
+
+        group = InstanceGroup.create(
+            self.apiclient,
+            name="smoke-boot-web-grp",
+            account=self.account.name,
+            domainid=self.account.domainid
+        )
+        self.cleanup.append(group)
+        vm2 = self.deployTestVm("smoke-boot-web", group=group.name)
+
+        boot_group = self.createTestBootGroup("smoke-boot-group")
+        self.assertEqual(boot_group.name.startswith("smoke-boot-group"), True, "Check boot group name")
+
+        member_vm = boot_group.addMember(self.apiclient, order=0, virtualmachineid=vm1.id)
+        self.assertEqual(member_vm.membertype, "VirtualMachine", "Check VM member type")
+        self.assertEqual(member_vm.memberid, vm1.id, "Check VM member id")
+        self.assertEqual(member_vm.order, 0, "Check VM member boot order")
+
+        member_group = boot_group.addMember(self.apiclient, order=1, instancegroupid=group.id)
+        self.assertEqual(member_group.membertype, "InstanceGroup", "Check instance group member type")
+        self.assertEqual(member_group.memberid, group.id, "Check instance group member id")
+        self.assertEqual(member_group.order, 1, "Check instance group member boot order")
+
+        members = InstanceBootGroup.listMembers(self.apiclient, bootgroupid=boot_group.id)
+        self.assertEqual(len(members), 2, "Check both members are listed")
+
+        member_vm.update(self.apiclient, order=5)
+        members = InstanceBootGroup.listMembers(self.apiclient, bootgroupid=boot_group.id)
+        updated_member_vm = next(m for m in members if m.id == member_vm.id)
+        self.assertEqual(updated_member_vm.order, 5, "Check member boot order was updated")
+
+        member_group.delete(self.apiclient)
+        members = InstanceBootGroup.listMembers(self.apiclient, bootgroupid=boot_group.id)
+        self.assertEqual(len(members), 1, "Check member was removed")
+        self.assertEqual(members[0].id, member_vm.id, "Check remaining member is the VM member")
+
+        boot_group_id = boot_group.id
+        boot_group.delete(self.apiclient)
+        self.cleanup.remove(boot_group)
+        boot_groups = InstanceBootGroup.list(self.apiclient, id=boot_group_id)
+        self.assertTrue(
+            boot_groups is None or len(boot_groups) == 0,
+            "Check boot group no longer listed after delete"
+        )
+        # The parent boot group is gone, so listing its members is itself an invalid request
+        # (bootgroupid must reference an existing group), not an empty-result query.
+        with self.assertRaises(CloudstackAPIException):
+            InstanceBootGroup.listMembers(self.apiclient, bootgroupid=boot_group_id)
+
+    @attr(tags=["advanced", "advancedns", "smoke", "basic"], required_hardware="false")
+    def test_02_readiness_rule_lifecycle(self):
+        """Create, list, update and delete a readiness rule on a boot group member"""
+
+        vm = self.deployTestVm("smoke-boot-rule-vm")
+        boot_group = self.createTestBootGroup("smoke-boot-rule-group")
+        boot_group.addMember(self.apiclient, order=0, virtualmachineid=vm.id)
+
+        rule = InstanceBootGroupReadinessRule.create(
+            self.apiclient,
+            bootgroupid=boot_group.id,
+            ruletype="Ping",
+            virtualmachineid=vm.id
+        )
+        self.assertEqual(rule.ruletype, "Ping", "Check readiness rule type")
+        self.assertEqual(rule.enabled, True, "Check readiness rule is enabled by default")
+
+        rules = InstanceBootGroupReadinessRule.list(self.apiclient, bootgroupid=boot_group.id)
+        self.assertEqual(len(rules), 1, "Check readiness rule is listed")
+
+        rule.update(self.apiclient, enabled=False)
+        rules = InstanceBootGroupReadinessRule.list(self.apiclient, bootgroupid=boot_group.id, id=rule.id)
+        self.assertEqual(rules[0].enabled, False, "Check readiness rule was disabled")
+
+        rule.delete(self.apiclient)
+        rules = InstanceBootGroupReadinessRule.list(self.apiclient, bootgroupid=boot_group.id)
+        self.assertTrue(
+            rules is None or len(rules) == 0,
+            "Check readiness rule no longer listed after delete"
+        )
+
+    @attr(tags=["advanced", "advancedns", "smoke", "basic"], required_hardware="false")
+    def test_03_start_stop_reboot_orchestration(self):
+        """Deploy a two-tier boot group with no readiness rules attached (pure boot-order
+        semantics), then exercise startInstanceBootGroup / rebootInstanceBootGroup /
+        stopInstanceBootGroup and confirm all members end each phase in the right state"""
+
+        vm1 = self.deployTestVm("smoke-boot-tier0")
+        vm2 = self.deployTestVm("smoke-boot-tier1")
+        boot_group = self.createTestBootGroup("smoke-boot-orch-group")
+        boot_group.addMember(self.apiclient, order=0, virtualmachineid=vm1.id)
+        boot_group.addMember(self.apiclient, order=1, virtualmachineid=vm2.id)
+
+        vm1.stop(self.apiclient, forced=True)
+        vm2.stop(self.apiclient, forced=True)
+
+        boot_group.start(self.apiclient)
+        vm1 = VirtualMachine.list(self.apiclient, id=vm1.id)[0]
+        vm2 = VirtualMachine.list(self.apiclient, id=vm2.id)[0]
+        self.assertEqual(vm1.state, 'Running', "Check tier0 VM is Running after boot group start")
+        self.assertEqual(vm2.state, 'Running', "Check tier1 VM is Running after boot group start")
+
+        boot_group.reboot(self.apiclient, forced=True)
+        vm1 = VirtualMachine.list(self.apiclient, id=vm1.id)[0]
+        vm2 = VirtualMachine.list(self.apiclient, id=vm2.id)[0]
+        self.assertEqual(vm1.state, 'Running', "Check tier0 VM is Running after boot group reboot")
+        self.assertEqual(vm2.state, 'Running', "Check tier1 VM is Running after boot group reboot")
+
+        boot_group.stop(self.apiclient, forced=True)
+        vm1 = VirtualMachine.list(self.apiclient, id=vm1.id)[0]
+        vm2 = VirtualMachine.list(self.apiclient, id=vm2.id)[0]
+        self.assertEqual(vm1.state, 'Stopped', "Check tier0 VM is Stopped after boot group stop")
+        self.assertEqual(vm2.state, 'Stopped', "Check tier1 VM is Stopped after boot group stop")
+
+    @attr(tags=["advanced", "advancedns"], required_hardware="false")
+    def test_04_readiness_cache_invalidated_on_out_of_band_restart(self):
+        """Regression test for InstanceBootGroupVmStateListener: once a member is Ready,
+        restarting its VM directly (outside boot group orchestration) must invalidate the
+        cached rule result (internally Unknown, surfaced as a NotReady aggregate) rather
+        than leaving a stale Ready behind"""
+
+        if self.zone.networktype.lower() != 'advanced':
+            self.skipTest("Ping readiness rule requires an advanced zone with a virtual router")
+
+        vm = self.deployTestVm("smoke-boot-cache-vm")
+        boot_group = self.createTestBootGroup("smoke-boot-cache-group")
+        boot_group.addMember(self.apiclient, order=0, virtualmachineid=vm.id)
+        InstanceBootGroupReadinessRule.create(
+            self.apiclient,
+            bootgroupid=boot_group.id,
+            ruletype="Ping",
+            virtualmachineid=vm.id
+        )
+
+        vm.stop(self.apiclient, forced=True)
+        boot_group.start(self.apiclient)
+
+        members = self.waitForMemberReadinessStatus(boot_group, "Ready")
+        self.assertTrue(len(members) > 0, "Check member list is not empty")
+        self.assertEqual(members[0].readinessstatus, "Ready", "Check member is Ready after boot group start")
+
+        # Restart the VM directly, bypassing boot group orchestration entirely.
+        vm.reboot(self.apiclient, forced=True)
+
+        members = InstanceBootGroup.listMembers(
+            self.apiclient,
+            bootgroupid=boot_group.id,
+            details=["readiness"],
+            ignoreinstancestate=True
+        )
+        # The per-rule cache is invalidated to Unknown, but the member-level aggregate treats
+        # any non-Ready rule status (Unknown included) as NotReady - Unknown never surfaces as
+        # the aggregate readinessstatus itself. The listener's message is what distinguishes
+        # this from a genuine failed check, so assert on that instead.
+        self.assertEqual(
+            members[0].readinessstatus,
+            "NotReady",
+            "Cached readiness must be invalidated (no longer a stale Ready) after an out-of-band VM restart"
+        )
+        self.assertTrue(
+            "not yet re-verified" in members[0].readinessmessage,
+            "Check the NotReady status is specifically due to cache invalidation on restart, not some other failure"
+        )
+
+    @attr(tags=["advanced", "advancedns", "smoke", "basic"], required_hardware="false")
+    def test_05_membership_guard_rejects_duplicate_membership(self):
+        """A VM already a member of one boot group cannot be added as a member of another"""
+
+        vm = self.deployTestVm("smoke-boot-guard-vm")
+        boot_group1 = self.createTestBootGroup("smoke-boot-guard-group1")
+        boot_group2 = self.createTestBootGroup("smoke-boot-guard-group2")
+
+        boot_group1.addMember(self.apiclient, order=0, virtualmachineid=vm.id)
+
+        with self.assertRaises(CloudstackAPIException):
+            boot_group2.addMember(self.apiclient, order=0, virtualmachineid=vm.id)
diff --git a/tools/apidoc/gen_toc.py b/tools/apidoc/gen_toc.py
index c99328fff9ff..30b97bedabd1 100644
--- a/tools/apidoc/gen_toc.py
+++ b/tools/apidoc/gen_toc.py
@@ -283,7 +283,8 @@
     'CustomActions' : 'Extension',
     'ImportVmTask': 'Import VM Task',
     'Dns': 'DNS',
-    'downloadValidationScreenshot': 'Backup and Recovery'
+    'downloadValidationScreenshot': 'Backup and Recovery',
+    'InstanceBootGroup': 'Instance Boot Group'
 }
 
 
diff --git a/tools/marvin/marvin/lib/base.py b/tools/marvin/marvin/lib/base.py
index e7fa2f763db5..b95a710db989 100755
--- a/tools/marvin/marvin/lib/base.py
+++ b/tools/marvin/marvin/lib/base.py
@@ -5701,6 +5701,170 @@ def recoverInstances(self, apiclient):
         apiclient.recoverVirtualMachine(cmd)
 
 
+class InstanceBootGroup:
+    """Manage Instance Boot Group lifecycle"""
+
+    def __init__(self, items):
+        self.__dict__.update(items)
+
+    @classmethod
+    def create(cls, apiclient, name, description=None, account=None,
+               domainid=None, projectid=None, readinessattempttimeoutseconds=None,
+               readinessmaxretryattempts=None, readinessrebootonretry=None,
+               readinessinitialdelayseconds=None):
+        """Creates an instance boot group"""
+
+        cmd = createInstanceBootGroup.createInstanceBootGroupCmd()
+        cmd.name = name
+        if description is not None:
+            cmd.description = description
+        if account is not None:
+            cmd.account = account
+        if domainid is not None:
+            cmd.domainid = domainid
+        if projectid is not None:
+            cmd.projectid = projectid
+        if readinessattempttimeoutseconds is not None:
+            cmd.readinessattempttimeoutseconds = readinessattempttimeoutseconds
+        if readinessmaxretryattempts is not None:
+            cmd.readinessmaxretryattempts = readinessmaxretryattempts
+        if readinessrebootonretry is not None:
+            cmd.readinessrebootonretry = readinessrebootonretry
+        if readinessinitialdelayseconds is not None:
+            cmd.readinessinitialdelayseconds = readinessinitialdelayseconds
+        return InstanceBootGroup(apiclient.createInstanceBootGroup(cmd).__dict__)
+
+    def update(self, apiclient, **kwargs):
+        """Updates the instance boot group"""
+        cmd = updateInstanceBootGroup.updateInstanceBootGroupCmd()
+        cmd.id = self.id
+        [setattr(cmd, k, v) for k, v in list(kwargs.items())]
+        return apiclient.updateInstanceBootGroup(cmd)
+
+    def delete(self, apiclient):
+        """Delete the instance boot group"""
+        cmd = deleteInstanceBootGroup.deleteInstanceBootGroupCmd()
+        cmd.id = self.id
+        return apiclient.deleteInstanceBootGroup(cmd)
+
+    @classmethod
+    def list(cls, apiclient, **kwargs):
+        """List all instance boot groups"""
+        cmd = listInstanceBootGroups.listInstanceBootGroupsCmd()
+        [setattr(cmd, k, v) for k, v in list(kwargs.items())]
+        if 'account' in list(kwargs.keys()) and 'domainid' in list(kwargs.keys()):
+            cmd.listall = True
+        return apiclient.listInstanceBootGroups(cmd)
+
+    def start(self, apiclient):
+        """Starts all members of the instance boot group in boot order"""
+        cmd = startInstanceBootGroup.startInstanceBootGroupCmd()
+        cmd.id = self.id
+        return apiclient.startInstanceBootGroup(cmd)
+
+    def stop(self, apiclient, forced=None):
+        """Stops all members of the instance boot group in reverse boot order"""
+        cmd = stopInstanceBootGroup.stopInstanceBootGroupCmd()
+        cmd.id = self.id
+        if forced is not None:
+            cmd.forced = forced
+        return apiclient.stopInstanceBootGroup(cmd)
+
+    def reboot(self, apiclient, forced=None):
+        """Reboots the instance boot group (stop then start, with readiness gating)"""
+        cmd = rebootInstanceBootGroup.rebootInstanceBootGroupCmd()
+        cmd.id = self.id
+        if forced is not None:
+            cmd.forced = forced
+        return apiclient.rebootInstanceBootGroup(cmd)
+
+    def addMember(self, apiclient, order, virtualmachineid=None, instancegroupid=None):
+        """Adds a VM or instance group member to the instance boot group"""
+        cmd = addMemberToInstanceBootGroup.addMemberToInstanceBootGroupCmd()
+        cmd.id = self.id
+        cmd.order = order
+        if virtualmachineid is not None:
+            cmd.virtualmachineid = virtualmachineid
+        if instancegroupid is not None:
+            cmd.instancegroupid = instancegroupid
+        return InstanceBootGroupMember(apiclient.addMemberToInstanceBootGroup(cmd).__dict__)
+
+    @classmethod
+    def listMembers(cls, apiclient, bootgroupid, **kwargs):
+        """List members of an instance boot group"""
+        cmd = listInstanceBootGroupMembers.listInstanceBootGroupMembersCmd()
+        cmd.bootgroupid = bootgroupid
+        [setattr(cmd, k, v) for k, v in list(kwargs.items())]
+        return apiclient.listInstanceBootGroupMembers(cmd)
+
+
+class InstanceBootGroupMember:
+    """Manage an individual instance boot group member entry"""
+
+    def __init__(self, items):
+        self.__dict__.update(items)
+
+    def update(self, apiclient, order):
+        """Updates the boot order of this member"""
+        cmd = updateInstanceBootGroupMember.updateInstanceBootGroupMemberCmd()
+        cmd.id = self.id
+        cmd.order = order
+        return apiclient.updateInstanceBootGroupMember(cmd)
+
+    def delete(self, apiclient):
+        """Removes this member from its instance boot group"""
+        cmd = removeInstanceBootGroupMember.removeInstanceBootGroupMemberCmd()
+        cmd.id = self.id
+        return apiclient.removeInstanceBootGroupMember(cmd)
+
+
+class InstanceBootGroupReadinessRule:
+    """Manage Instance Boot Group readiness rules"""
+
+    def __init__(self, items):
+        self.__dict__.update(items)
+
+    @classmethod
+    def create(cls, apiclient, bootgroupid, ruletype, virtualmachineid=None,
+               instancegroupid=None, name=None, enabled=None, details=None):
+        """Creates a readiness rule for a boot group member"""
+        cmd = createInstanceBootGroupReadinessRule.createInstanceBootGroupReadinessRuleCmd()
+        cmd.bootgroupid = bootgroupid
+        cmd.ruletype = ruletype
+        if virtualmachineid is not None:
+            cmd.virtualmachineid = virtualmachineid
+        if instancegroupid is not None:
+            cmd.instancegroupid = instancegroupid
+        if name is not None:
+            cmd.name = name
+        if enabled is not None:
+            cmd.enabled = enabled
+        if details is not None:
+            cmd.details = details
+        return InstanceBootGroupReadinessRule(apiclient.createInstanceBootGroupReadinessRule(cmd).__dict__)
+
+    def update(self, apiclient, **kwargs):
+        """Updates the readiness rule"""
+        cmd = updateInstanceBootGroupReadinessRule.updateInstanceBootGroupReadinessRuleCmd()
+        cmd.id = self.id
+        [setattr(cmd, k, v) for k, v in list(kwargs.items())]
+        return apiclient.updateInstanceBootGroupReadinessRule(cmd)
+
+    def delete(self, apiclient):
+        """Deletes the readiness rule"""
+        cmd = deleteInstanceBootGroupReadinessRule.deleteInstanceBootGroupReadinessRuleCmd()
+        cmd.id = self.id
+        return apiclient.deleteInstanceBootGroupReadinessRule(cmd)
+
+    @classmethod
+    def list(cls, apiclient, bootgroupid, **kwargs):
+        """List readiness rules for an instance boot group"""
+        cmd = listInstanceBootGroupReadinessRules.listInstanceBootGroupReadinessRulesCmd()
+        cmd.bootgroupid = bootgroupid
+        [setattr(cmd, k, v) for k, v in list(kwargs.items())]
+        return apiclient.listInstanceBootGroupReadinessRules(cmd)
+
+
 class ASA1000V:
     """Manage ASA 1000v lifecycle"""
 
diff --git a/ui/public/config.json b/ui/public/config.json
index 81d3938a5dee..1ca42f04b67c 100644
--- a/ui/public/config.json
+++ b/ui/public/config.json
@@ -105,7 +105,155 @@
   "imageSelectionInterface": "modern",
   "showUserCategoryForModernImageSelection": true,
   "showAllCategoryForModernImageSelection": false,
-  "docHelpMappings": {},
+  "docHelpMappings": {
+    "adminguide/accounts.html": "adminguide/accounts.html",
+    "adminguide/accounts.html#domains": "adminguide/accounts.html#domains",
+    "adminguide/accounts.html#keypairs": "adminguide/accounts.html#keypairs",
+    "adminguide/accounts.html#roles": "adminguide/accounts.html#roles",
+    "adminguide/accounts.html#users": "adminguide/accounts.html#users",
+    "adminguide/accounts.html#using-an-ldap-server-for-user-authentication": "adminguide/accounts.html#using-an-ldap-server-for-user-authentication",
+    "adminguide/autoscale_with_virtual_router.html": "adminguide/autoscale_with_virtual_router.html",
+    "adminguide/events.html": "adminguide/events.html",
+    "adminguide/events.html#creating-webhooks": "adminguide/events.html#creating-webhooks",
+    "adminguide/events.html#deleting-and-archiving-events-and-alerts": "adminguide/events.html#deleting-and-archiving-events-and-alerts",
+    "adminguide/extensions.html": "adminguide/extensions.html",
+    "adminguide/extensions.html#custom-actions": "adminguide/extensions.html#custom-actions",
+    "adminguide/guest_os.html#guest-os": "adminguide/guest_os.html#guest-os",
+    "adminguide/guest_os.html#guest-os-categories": "adminguide/guest_os.html#guest-os-categories",
+    "adminguide/guest_os.html#guest-os-hypervisor-mapping": "adminguide/guest_os.html#guest-os-hypervisor-mapping",
+    "adminguide/hosts.html#disabling-and-enabling-zones-pods-and-clusters": "adminguide/hosts.html#disabling-and-enabling-zones-pods-and-clusters",
+    "adminguide/hosts.html?highlight=Hypervisor%20capabilities#hypervisor-capabilities": "adminguide/hosts.html?highlight=Hypervisor%20capabilities#hypervisor-capabilities",
+    "adminguide/hosts.html#kvm-rolling-maintenance": "adminguide/hosts.html#kvm-rolling-maintenance",
+    "adminguide/hosts.html#maintaining-hypervisors-on-hosts": "adminguide/hosts.html#maintaining-hypervisors-on-hosts",
+    "adminguide/hosts.html#out-of-band-management": "adminguide/hosts.html#out-of-band-management",
+    "adminguide/hosts.html#removing-hosts": "adminguide/hosts.html#removing-hosts",
+    "adminguide/index.html#tuning": "adminguide/index.html#tuning",
+    "adminguide/kms.html#adding-an-hsm-profile": "adminguide/kms.html#adding-an-hsm-profile",
+    "adminguide/kms.html#creating-a-kms-key": "adminguide/kms.html#creating-a-kms-key",
+    "adminguide/kms.html#migrating-existing-volumes-to-kms": "adminguide/kms.html#migrating-existing-volumes-to-kms",
+    "adminguide/kms.html#rotating-a-kms-key": "adminguide/kms.html#rotating-a-kms-key",
+    "adminguide/management.html#administrator-alerts": "adminguide/management.html#administrator-alerts",
+    "adminguide/management.html#metrics": "adminguide/management.html#metrics",
+    "adminguide/management.html#reporting-cpu-sockets": "adminguide/management.html#reporting-cpu-sockets",
+    "adminguide/nas_plugin.html": "adminguide/nas_plugin.html",
+    "adminguide/networking_and_traffic.html#acl-on-private-gateway": "adminguide/networking_and_traffic.html#acl-on-private-gateway",
+    "adminguide/networking_and_traffic.html#adding-an-additional-guest-network": "adminguide/networking_and_traffic.html#adding-an-additional-guest-network",
+    "adminguide/networking_and_traffic.html#adding-a-private-gateway-to-a-vpc": "adminguide/networking_and_traffic.html#adding-a-private-gateway-to-a-vpc",
+    "adminguide/networking_and_traffic.html#adding-a-security-group": "adminguide/networking_and_traffic.html#adding-a-security-group",
+    "adminguide/networking_and_traffic.html#adding-a-virtual-private-cloud": "adminguide/networking_and_traffic.html#adding-a-virtual-private-cloud",
+    "adminguide/networking_and_traffic.html#advanced-zone-physical-network-configuration": "adminguide/networking_and_traffic.html#advanced-zone-physical-network-configuration",
+    "adminguide/networking_and_traffic.html#basic-zone-physical-network-configuration": "adminguide/networking_and_traffic.html#basic-zone-physical-network-configuration",
+    "adminguide/networking_and_traffic.html#configure-guest-traffic-in-an-advanced-zone": "adminguide/networking_and_traffic.html#configure-guest-traffic-in-an-advanced-zone",
+    "adminguide/networking_and_traffic.html#configuring-a-virtual-private-cloud": "adminguide/networking_and_traffic.html#configuring-a-virtual-private-cloud",
+    "adminguide/networking_and_traffic.html#configuring-network-access-control-list": "adminguide/networking_and_traffic.html#configuring-network-access-control-list",
+    "adminguide/networking_and_traffic.html#creating-acl-lists": "adminguide/networking_and_traffic.html#creating-acl-lists",
+    "adminguide/networking_and_traffic.html#creating-and-updating-a-vpn-customer-gateway": "adminguide/networking_and_traffic.html#creating-and-updating-a-vpn-customer-gateway",
+    "adminguide/networking_and_traffic.html#creating-an-internal-lb-rule": "adminguide/networking_and_traffic.html#creating-an-internal-lb-rule",
+    "adminguide/networking_and_traffic.html#creating-a-vpn-connection": "adminguide/networking_and_traffic.html#creating-a-vpn-connection",
+    "adminguide/networking_and_traffic.html#creating-a-vpn-gateway-for-the-vpc": "adminguide/networking_and_traffic.html#creating-a-vpn-gateway-for-the-vpc",
+    "adminguide/networking_and_traffic.html#enabling-or-disabling-static-nat": "adminguide/networking_and_traffic.html#enabling-or-disabling-static-nat",
+    "adminguide/networking_and_traffic.html#load-balancing-across-tiers": "adminguide/networking_and_traffic.html#load-balancing-across-tiers",
+    "adminguide/networking_and_traffic.html#releasing-an-ip-address-alloted-to-a-vpc": "adminguide/networking_and_traffic.html#releasing-an-ip-address-alloted-to-a-vpc",
+    "adminguide/networking_and_traffic.html#reserving-public-ip-addresses-and-vlans-for-accounts": "adminguide/networking_and_traffic.html#reserving-public-ip-addresses-and-vlans-for-accounts",
+    "adminguide/networking_and_traffic.html#restarting-and-removing-a-vpn-connection": "adminguide/networking_and_traffic.html#restarting-and-removing-a-vpn-connection",
+    "adminguide/networking_and_traffic.html#security-groups": "adminguide/networking_and_traffic.html#security-groups",
+    "adminguide/networking_and_traffic.html#setting-up-a-site-to-site-vpn-connection": "adminguide/networking_and_traffic.html#setting-up-a-site-to-site-vpn-connection",
+    "adminguide/networking_and_traffic.html#updating-and-removing-a-vpn-customer-gateway": "adminguide/networking_and_traffic.html#updating-and-removing-a-vpn-customer-gateway",
+    "adminguide/networking.html#creating-a-new-network-offering": "adminguide/networking.html#creating-a-new-network-offering",
+    "adminguide/networking.html#network-offerings": "adminguide/networking.html#network-offerings",
+    "adminguide/networking.html#network-service-providers": "adminguide/networking.html#network-service-providers",
+    "adminguide/networking/vnf_templates_appliances.html#deploying-vnf-appliances": "adminguide/networking/vnf_templates_appliances.html#deploying-vnf-appliances",
+    "adminguide/object_storage.html#update-bucket": "adminguide/object_storage.html#update-bucket",
+    "adminguide/projects.html": "adminguide/projects.html",
+    "adminguide/projects.html#accepting-a-membership-invitation": "adminguide/projects.html#accepting-a-membership-invitation",
+    "adminguide/projects.html#adding-project-members-from-the-ui": "adminguide/projects.html#adding-project-members-from-the-ui",
+    "adminguide/projects.html#creating-a-new-project": "adminguide/projects.html#creating-a-new-project",
+    "adminguide/projects.html#sending-project-membership-invitations": "adminguide/projects.html#sending-project-membership-invitations",
+    "adminguide/projects.html#suspending-or-deleting-a-project": "adminguide/projects.html#suspending-or-deleting-a-project",
+    "adminguide/reliability.html#ha-for-hosts": "adminguide/reliability.html#ha-for-hosts",
+    "adminguide/service_offerings.html#compute-and-disk-service-offerings": "adminguide/service_offerings.html#compute-and-disk-service-offerings",
+    "adminguide/service_offerings.html#creating-a-new-compute-offering": "adminguide/service_offerings.html#creating-a-new-compute-offering",
+    "adminguide/service_offerings.html#creating-a-new-disk-offering": "adminguide/service_offerings.html#creating-a-new-disk-offering",
+    "adminguide/service_offerings.html#creating-a-new-system-service-offering": "adminguide/service_offerings.html#creating-a-new-system-service-offering",
+    "adminguide/service_offerings.html#modifying-or-deleting-a-service-offering": "adminguide/service_offerings.html#modifying-or-deleting-a-service-offering",
+    "adminguide/service_offerings.html#system-service-offerings": "adminguide/service_offerings.html#system-service-offerings",
+    "adminguide/storage.html#creating-a-new-file-share": "adminguide/storage.html#creating-a-new-file-share",
+    "adminguide/storage.html#creating-a-new-volume": "adminguide/storage.html#creating-a-new-volume",
+    "adminguide/storage.html#id2": "adminguide/storage.html#id2",
+    "adminguide/storage.html#lifecycle-operations": "adminguide/storage.html#lifecycle-operations",
+    "adminguide/storage.html#object-storage": "adminguide/storage.html#object-storage",
+    "adminguide/storage.html#primary-storage": "adminguide/storage.html#primary-storage",
+    "adminguide/storage.html#resizing-volumes": "adminguide/storage.html#resizing-volumes",
+    "adminguide/storage.html#secondary-storage": "adminguide/storage.html#secondary-storage",
+    "adminguide/storage.html#uploading-an-existing-volume-to-a-virtual-machine": "adminguide/storage.html#uploading-an-existing-volume-to-a-virtual-machine",
+    "adminguide/storage.html#working-with-volumes": "adminguide/storage.html#working-with-volumes",
+    "adminguide/storage.html#working-with-volume-snapshots": "adminguide/storage.html#working-with-volume-snapshots",
+    "adminguide/systemvm.html": "adminguide/systemvm.html",
+    "adminguide/systemvm.html#upgrading-virtual-routers": "adminguide/systemvm.html#upgrading-virtual-routers",
+    "adminguide/systemvm.html#virtual-router": "adminguide/systemvm.html#virtual-router",
+    "adminguide/templates.html": "adminguide/templates.html",
+    "adminguide/templates.html#attaching-an-iso-to-a-vm": "adminguide/templates.html#attaching-an-iso-to-a-vm",
+    "adminguide/templates.html#exporting-templates": "adminguide/templates.html#exporting-templates",
+    "adminguide/templates.html#id10": "adminguide/templates.html#id10",
+    "adminguide/templates.html#sharing-templates-with-other-accounts-projects": "adminguide/templates.html#sharing-templates-with-other-accounts-projects",
+    "adminguide/templates.html#uploading-templates-and-isos-from-a-local-computer": "adminguide/templates.html#uploading-templates-and-isos-from-a-local-computer",
+    "adminguide/templates.html#uploading-templates-from-a-remote-http-server": "adminguide/templates.html#uploading-templates-from-a-remote-http-server",
+    "adminguide/templates.html#working-with-isos": "adminguide/templates.html#working-with-isos",
+    "adminguide/virtual_machines.html": "adminguide/virtual_machines.html",
+    "adminguide/virtual_machines.html#affinity-groups": "adminguide/virtual_machines.html#affinity-groups",
+    "adminguide/virtual_machines.html#backup-offerings": "adminguide/virtual_machines.html#backup-offerings",
+    "adminguide/virtual_machines.html#change-affinity-group-for-an-existing-vm": "adminguide/virtual_machines.html#change-affinity-group-for-an-existing-vm",
+    "adminguide/virtual_machines.html#changing-the-vm-name-os-or-group": "adminguide/virtual_machines.html#changing-the-vm-name-os-or-group",
+    "adminguide/virtual_machines.html#creating-a-new-affinity-group": "adminguide/virtual_machines.html#creating-a-new-affinity-group",
+    "adminguide/virtual_machines.html#creating-a-new-instance-from-backup": "adminguide/virtual_machines.html#creating-a-new-instance-from-backup",
+    "adminguide/virtual_machines.html#creating-the-ssh-keypair": "adminguide/virtual_machines.html#creating-the-ssh-keypair",
+    "adminguide/virtual_machines.html#creating-vm-backups": "adminguide/virtual_machines.html#creating-vm-backups",
+    "adminguide/virtual_machines.html#creating-vms": "adminguide/virtual_machines.html#creating-vms",
+    "adminguide/virtual_machines.html#delete-an-affinity-group": "adminguide/virtual_machines.html#delete-an-affinity-group",
+    "adminguide/virtual_machines.html#deleting-vms": "adminguide/virtual_machines.html#deleting-vms",
+    "adminguide/virtual_machines.html#how-to-dynamically-scale-cpu-and-ram": "adminguide/virtual_machines.html#how-to-dynamically-scale-cpu-and-ram",
+    "adminguide/virtual_machines.html#importing-and-unmanaging-virtual-machine": "adminguide/virtual_machines.html#importing-and-unmanaging-virtual-machine",
+    "adminguide/virtual_machines.html#importing-and-unmanaging-volume": "adminguide/virtual_machines.html#importing-and-unmanaging-volume",
+    "adminguide/virtual_machines.html#importing-backup-offerings": "adminguide/virtual_machines.html#importing-backup-offerings",
+    "adminguide/virtual_machines.html#moving-vms-between-hosts-manual-live-migration": "adminguide/virtual_machines.html#moving-vms-between-hosts-manual-live-migration",
+    "adminguide/virtual_machines.html#resetting-ssh-keys": "adminguide/virtual_machines.html#resetting-ssh-keys",
+    "adminguide/virtual_machines.html#resetting-userdata": "adminguide/virtual_machines.html#resetting-userdata",
+    "adminguide/virtual_machines.html#restoring-instance-backups": "adminguide/virtual_machines.html#restoring-instance-backups",
+    "adminguide/virtual_machines.html#restoring-vm-backups": "adminguide/virtual_machines.html#restoring-vm-backups",
+    "adminguide/virtual_machines.html#stopping-and-starting-vms": "adminguide/virtual_machines.html#stopping-and-starting-vms",
+    "adminguide/virtual_machines.html#user-data-and-meta-data": "adminguide/virtual_machines.html#user-data-and-meta-data",
+    "adminguide/virtual_machines.html#using-ssh-keys-for-authentication": "adminguide/virtual_machines.html#using-ssh-keys-for-authentication",
+    "adminguide/virtual_machines.html#virtual-machine-snapshots": "adminguide/virtual_machines.html#virtual-machine-snapshots",
+    "adminguide/webhooks.html": "adminguide/webhooks.html",
+    "conceptsandterminology/concepts.html#about-clusters": "conceptsandterminology/concepts.html#about-clusters",
+    "conceptsandterminology/concepts.html#about-hosts": "conceptsandterminology/concepts.html#about-hosts",
+    "conceptsandterminology/concepts.html#about-pods": "conceptsandterminology/concepts.html#about-pods",
+    "conceptsandterminology/concepts.html#about-zones": "conceptsandterminology/concepts.html#about-zones",
+    "conceptsandterminology/concepts.html#management-server-overview": "conceptsandterminology/concepts.html#management-server-overview",
+    "conceptsandterminology/network_setup.html#vlan-allocation-example": "conceptsandterminology/network_setup.html#vlan-allocation-example",
+    "installguide/configuration.html#adding-a-cluster": "installguide/configuration.html#adding-a-cluster",
+    "installguide/configuration.html#adding-a-host": "installguide/configuration.html#adding-a-host",
+    "installguide/configuration.html#adding-a-pod": "installguide/configuration.html#adding-a-pod",
+    "installguide/configuration.html#adding-a-zone": "installguide/configuration.html#adding-a-zone",
+    "installguide/configuration.html#add-object-storage": "installguide/configuration.html#add-object-storage",
+    "installguide/configuration.html#add-primary-storage": "installguide/configuration.html#add-primary-storage",
+    "installguide/configuration.html#add-secondary-storage": "installguide/configuration.html#add-secondary-storage",
+    "installguide/configuration.html#create-bucket": "installguide/configuration.html#create-bucket",
+    "plugins/cloudian-connector.html": "plugins/cloudian-connector.html",
+    "plugins/cloudstack-kubernetes-service.html": "plugins/cloudstack-kubernetes-service.html",
+    "plugins/cloudstack-kubernetes-service.html#creating-a-new-kubernetes-cluster": "plugins/cloudstack-kubernetes-service.html#creating-a-new-kubernetes-cluster",
+    "plugins/cloudstack-kubernetes-service.html#deleting-kubernetes-cluster": "plugins/cloudstack-kubernetes-service.html#deleting-kubernetes-cluster",
+    "plugins/cloudstack-kubernetes-service.html#kubernetes-supported-versions": "plugins/cloudstack-kubernetes-service.html#kubernetes-supported-versions",
+    "plugins/cloudstack-kubernetes-service.html#scaling-kubernetes-cluster": "plugins/cloudstack-kubernetes-service.html#scaling-kubernetes-cluster",
+    "plugins/cloudstack-kubernetes-service.html#starting-a-stopped-kubernetes-cluster": "plugins/cloudstack-kubernetes-service.html#starting-a-stopped-kubernetes-cluster",
+    "plugins/cloudstack-kubernetes-service.html#stopping-kubernetes-cluster": "plugins/cloudstack-kubernetes-service.html#stopping-kubernetes-cluster",
+    "plugins/cloudstack-kubernetes-service.html#upgrading-kubernetes-cluster": "plugins/cloudstack-kubernetes-service.html#upgrading-kubernetes-cluster",
+    "plugins/nuage-plugin.html?#optional-create-and-enable-vpc-offering": "plugins/nuage-plugin.html?#optional-create-and-enable-vpc-offering",
+    "plugins/nuage-plugin.html?#vpc-offerings": "plugins/nuage-plugin.html?#vpc-offerings",
+    "plugins/quota.html": "plugins/quota.html",
+    "plugins/quota.html#quota-credits": "plugins/quota.html#quota-credits",
+    "plugins/quota.html#quota-tariff": "plugins/quota.html#quota-tariff"
+  },
   "notifyLatestCSVersion": true,
   "showSearchFilters": true,
   "announcementBanner": {
diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index 99bf2cf7aef9..f51f6f56126b 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -195,6 +195,7 @@
 "label.action.quota.tariff.edit": "Edit Quota Tariff",
 "label.action.quota.tariff.remove": "Remove Quota Tariff",
 "label.action.reboot.instance": "Reboot Instance",
+"label.action.reboot.instance.boot.group": "Reboot Instance Boot Group",
 "label.action.reboot.router": "Reboot Router",
 "label.action.reboot.systemvm": "Reboot System VM",
 "label.action.recover.volume": "Recover Volume",
@@ -225,10 +226,12 @@
 "label.action.setup.2FA.user.auth": "Setup User Two Factor Authentication",
 "label.action.start.sharedfs": "Start Shared FileSystem",
 "label.action.start.instance": "Start Instance",
+"label.action.start.instance.boot.group": "Start Instance Boot Group",
 "label.action.start.router": "Start Router",
 "label.action.start.systemvm": "Start System VM",
 "label.action.stop.sharedfs": "Stop Shared FileSystem",
 "label.action.stop.instance": "Stop Instance",
+"label.action.stop.instance.boot.group": "Stop Instance Boot Group",
 "label.action.stop.router": "Stop Router",
 "label.action.stop.systemvm": "Stop System VM",
 "label.action.take.snapshot": "Take Snapshot",
@@ -294,6 +297,7 @@
 "label.add.guest.os.hypervisor.mapping": "Add guest os hypervisor mapping",
 "label.add.host": "Add Host",
 "label.add.ingress.rule": "Add Ingress Rule",
+"label.add.instance.boot.group": "Add Instance Boot Group",
 "label.add.intermediate.certificate": "Add intermediate certificate",
 "label.add.internal.lb": "Add internal LB",
 "label.add.ip.range": "Add IP Range",
@@ -305,6 +309,7 @@
 "label.add.latest.kubernetes.iso": "Add latest Kubernetes ISO",
 "label.add.ldap.account": "Add LDAP Account",
 "label.add.logical.router": "Add Logical Router to this Network",
+"label.add.member": "Add Member",
 "label.add.minimum.required.compute.offering": "Add minimum required Compute Offering",
 "label.add.more": "Add more",
 "label.add.nodes": "Add Nodes to Kubernetes Cluster",
@@ -326,6 +331,7 @@
 "label.add.policy": "Add policy",
 "label.add.primary.storage": "Add Primary Storage",
 "label.add.private.gateway": "Add Private Gateway",
+"label.add.readiness.rule": "Add Readiness Rule",
 "label.add.resources": "Add Resources",
 "label.add.role": "Add Role",
 "label.add.route": "Add Route",
@@ -515,6 +521,7 @@
 "label.bigswitch.controller.address": "BigSwitch BCF controller address",
 "label.bladeid": "Blade ID",
 "label.blades": "Blades",
+"label.boot.order": "Boot Order",
 "label.bootable": "Bootable",
 "label.bootintosetup": "Boot into hardware setup",
 "label.bootmode": "Boot mode",
@@ -836,6 +843,7 @@
 "label.delete.f5": "Delete F5",
 "label.delete.gateway": "Delete gateway",
 "label.delete.icon": "Delete icon",
+"label.delete.instance.boot.group": "Delete Instance Boot Group",
 "label.delete.instance.group": "Delete Instance group",
 "label.delete.internal.lb": "Delete internal LB",
 "label.delete.ipv4.subnet": "Delete IPv4 subnet",
@@ -1060,6 +1068,7 @@
 "label.edit.nic": "Edit NIC",
 "label.edit.project.details": "Edit project details",
 "label.edit.project.role": "Edit project role",
+"label.edit.readiness.rule": "Edit Readiness Rule",
 "label.edit.role": "Edit Role",
 "label.edit.rule": "Edit Rule",
 "label.edit.secondary.ips": "Edit secondary IPs",
@@ -1263,6 +1272,7 @@
 "label.gslbproviderprivateip": "GSLB service private IP",
 "label.gslbproviderpublicip": "GSLB service public IP",
 "label.guest": "Guest",
+"label.guestagentliveness": "Guest Agent Liveness",
 "label.guest.cidr": "Guest CIDR",
 "label.guest.end.ip": "Guest end IP",
 "label.guest.gateway": "Guest gateway",
@@ -1376,13 +1386,17 @@
 "label.ingress": "Ingress",
 "label.ingress.rule": "Ingress Rule",
 "label.initial": "Initial",
+"label.inherited": "Inherited",
 "label.initialized": "Initialized",
 "label.insideportprofile": "Inside port profile",
 "label.installwizard.addzoneintro.title": "Let's add a Zone",
 "label.installwizard.subtitle": "This guide will aid you in setting up your CloudStack™ installation",
 "label.installwizard.title": "Hello and welcome to CloudStack™",
 "label.instance": "Instance",
+"label.instance.boot.group": "Instance Boot Group",
+"label.instance.boot.groups": "Instance Boot Groups",
 "label.instance.conversion.support": "Instance Conversion Supported",
+"label.instance.group": "Instance Group",
 "label.instance.groups": "Instance Groups",
 "label.instance.metadata": "Instance metadata",
 "label.instance.name": "Instance name",
@@ -1557,6 +1571,7 @@
 "label.l2gatewayserviceuuid": "L2 Gateway Service UUID",
 "label.l3gatewayserviceuuid": "L3 Gateway Service UUID",
 "label.label": "Label",
+"label.last.checked": "Last checked",
 "label.last.updated": "Last update",
 "label.lastupdated": "Last update",
 "label.lastannotated": "Last annotation date",
@@ -1643,6 +1658,7 @@
 "label.make.user.project.owner": "Make User project owner",
 "label.makeredundant": "Make redundant",
 "label.manage": "Manage",
+"label.manage.readiness.rules": "Manage Readiness Rules",
 "label.manage.ssl.cert": "Manage SSL certificate",
 "label.manage.vpn.user": "Manage VPN Users",
 "label.managed.instances": "Managed Instances",
@@ -1697,6 +1713,10 @@
 "label.maxvpc": "Max. VPCs",
 "label.may.continue": "You may now continue.",
 "label.mb.memory": "MB memory",
+"label.memberquorum": "Member Quorum",
+"label.member.type": "Member Type",
+"label.message": "Message",
+"label.members": "Members",
 "label.memory": "Memory",
 "label.memory.free": "Memory free",
 "label.memory.maximum.mb": "Max memory (in MB)",
@@ -2011,6 +2031,7 @@
 "label.physicalnetworkname": "Physical Network name",
 "label.physicalsize": "Physical size",
 "label.pin": "PIN",
+"label.ping": "Ping",
 "label.ping.path": "Ping path",
 "label.pkcs.private.certificate": "PKCS#8 private certificate",
 "label.plannermode": "Planner mode",
@@ -2026,6 +2047,7 @@
 "label.policy": "Policy",
 "label.policyuuid": "Network Policy",
 "label.port": "Port",
+"label.portcheck": "Port Check",
 "label.port.range": "Port range",
 "label.portforwarding": "Port forwarding",
 "label.portforwarding.rule": "Port forwarding rule",
@@ -2179,6 +2201,15 @@
 "label.readonly": "Read-Only",
 "label.reason": "Reason",
 "label.rebalance": "Rebalance",
+"label.readiness": "Readiness",
+"label.readiness.mode.child.dependent": "Depends on children",
+"label.readiness.mode.no.readiness": "No Readiness",
+"label.readiness.mode.rule.based": "Rule-based",
+"label.readiness.rules": "Readiness Rules",
+"label.readinessattempttimeoutseconds": "Readiness retry timeout (seconds)",
+"label.readinessinitialdelayseconds": "Readiness initial delay (seconds)",
+"label.readinessmaxretryattempts": "Max readiness retry attempts",
+"label.readinessrebootonretry": "Reboot instance on readiness retry",
 "label.reboot": "Reboot",
 "label.recent.deliveries": "Recent deliveries",
 "label.receivedbytes": "Bytes received",
@@ -2321,6 +2352,7 @@
 "label.routing.policy.terms": "Routing policy terms",
 "label.routing.policy.terms.then": "Routing policy terms then",
 "label.rule": "Rule",
+"label.rule.type": "Rule Type",
 "label.rule.number": "Rule number",
 "label.rules": "Rules",
 "label.rules.file": "Rules file",
@@ -2696,6 +2728,8 @@
 "label.threadstotalcount": "Total Thread count",
 "label.threadswaitingcount": "Waiting Threads",
 "label.threshold": "Threshold",
+"label.threshold.type": "Threshold Type",
+"label.threshold.value": "Threshold Value",
 "label.threshold.description": "Value for which the Counter will be evaluated with the Operator selected",
 "label.thursday": "Thursday",
 "label.tier0gateway": "Tier-0 Gateway",
@@ -2786,6 +2820,7 @@
 "label.update.custom.action": "Update Custom Action",
 "label.update.extension": "Update Extension",
 "label.update.sharedfs": "Update Shared FileSystem",
+"label.update.instance.boot.group": "Update Instance Boot Group",
 "label.update.instance.group": "Update Instance group",
 "label.update.ip.range": "Update IP range",
 "label.update.ipv4.subnet": "Update IPv4 subnet",
@@ -2880,6 +2915,7 @@
 "label.view": "View",
 "label.view.all": "View all",
 "label.view.console": "View console",
+"label.view.failing.readiness.rules": "View failing readiness rules",
 "label.viewing": "Viewing",
 "label.virtualmachine": "Instance",
 "label.virtualmachinecount": "Instances Count",
@@ -3073,6 +3109,8 @@
 "label.lease.enable.tooltip": "The Instance Lease feature allows to set a lease duration (in days) for instances, after which they automatically expire. Upon expiry, the instance can either be stopped (powered off) or destroyed, based on the configured policy",
 "label.instance.lease": "Instance lease",
 "label.instance.lease.placeholder": "Lease duration in days ( > 0)",
+"label.instance.not.running.view.last.readiness.results": "Instance is not in Running state. View last readiness results",
+"label.instancegroup.instances.not.running.view.last.readiness.results": "Instance(s) of the group are not in Running state. View last readiness results",
 "label.leaseduration": "Lease duration (in days)",
 "label.leaseexpiry.date.and.time": "Lease expiry date",
 "label.leaseexpiryaction": "Lease expiry action",
@@ -3122,6 +3160,7 @@
 "message.action.delete.guest.os.category": "Please confirm that you want to delete this guest os category.",
 "message.action.delete.guest.os.hypervisor.mapping": "Please confirm that you want to delete this guest os hypervisor mapping. System defined entry cannot be deleted.",
 "message.action.delete.hsm.profile": "Please confirm that you want to delete this HSM profile.",
+"message.action.delete.instance.boot.group": "Please confirm that you want to delete this Instance Boot Group.",
 "message.action.delete.instance.group": "Please confirm that you want to delete the Instance group.",
 "message.action.delete.interface.static.route": "Please confirm that you want to remove this interface Static Route?",
 "message.action.delete.iso": "Please confirm that you want to delete this ISO.",
@@ -3191,6 +3230,7 @@
 "message.action.quota.tariff.create.error.valuerequired": "Please, inform a value for the quota tariff.",
 "message.action.quota.tariff.remove": "Please confirm that you want to remove this Quota Tariff.",
 "message.action.reboot.instance": "Please confirm that you want to reboot this Instance.",
+"message.action.reboot.instance.boot.group": "Please confirm that you want to reboot this Instance Boot Group. Members will be stopped highest-order first, then started lowest-order first.",
 "message.action.reboot.router": "All services provided by this virtual router will be interrupted. Please confirm that you want to reboot this router.",
 "message.action.reboot.systemvm": "Please confirm that you want to reboot this system VM.",
 "message.action.recover.sharedfs": "Please confirm that you would like to recover this Shared FileSystem.",
@@ -3214,10 +3254,12 @@
 "message.action.settings.warning.vm.running": "Please stop the Instance to access settings.",
 "message.action.start.sharedfs": "Please confirm that you want to start this Shared FileSystem.",
 "message.action.start.instance": "Please confirm that you want to start this Instance.",
+"message.action.start.instance.boot.group": "Please confirm that you want to start this Instance Boot Group. Members will be started in ascending boot order.",
 "message.action.start.router": "Please confirm that you want to start this router.",
 "message.action.start.systemvm": "Please confirm that you want to start this system VM.",
 "message.action.stop.sharedfs": "Please confirm that you want to stop this Shared FileSystem.",
 "message.action.stop.instance": "Please confirm that you want to stop this Instance.",
+"message.action.stop.instance.boot.group": "Please confirm that you want to stop this Instance Boot Group. Members will be stopped in descending boot order.",
 "message.action.stop.router": "All services provided by this virtual router will be interrupted. Please confirm that you want to stop this router.",
 "message.action.stop.systemvm": "Please confirm that you want to stop this system VM.",
 "message.action.unmanage.cluster": "Please confirm that you want to unmanage the Cluster.",
@@ -3414,6 +3456,8 @@
 "message.confirm.manage.gpu.devices": "Please confirm that you want to manage the selected GPU devices?",
 "message.confirm.remove.firewall.rule": "Please confirm that you want to delete this Firewall Rule?",
 "message.confirm.remove.ip.range": "Please confirm that you would like to remove this IP range.",
+"message.confirm.delete.readiness.rule": "Are you sure you want to delete this readiness rule?",
+"message.confirm.remove.member": "Please confirm that you want to remove this member from the Instance Boot Group.",
 "message.confirm.remove.network.offering": "Are you sure you want to remove this Network offering?",
 "message.confirm.remove.network.policy": "Please confirm that you want to remove this Network Policy?",
 "message.confirm.remove.routing.policy": "Please confirm that you want to delete this Routing Policy?",
@@ -3775,6 +3819,7 @@
 "message.import.running.instance.warning": "The selected VM is powered-on on the VMware Datacenter. The recommended state to convert a VMware VM into KVM is powered-off after a graceful shutdown of the guest OS.",
 "message.import.vm.tasks": "Import from VMware to KVM tasks",
 "message.import.volume": "Please specify the domain, account or project name. <br>If not set, the volume will be imported for the caller.",
+"message.inherited.readiness.rule": "This rule is inherited from the instance group; delete it from the group's readiness rules instead.",
 "message.info.cloudian.console": "Cloudian Management Console should open in another window.",
 "message.installwizard.cloudstack.helptext.website": " * Project website:\t ",
 "message.infra.setup.netris.description": "This zone must contain a Netris provider because the isolation method is Netris",
@@ -3907,6 +3952,7 @@
 "message.new.version.available": "A new version of CloudStack is available. Click here to check the details",
 "message.no.data.to.show.for.period": "No data to show for the selected period.",
 "message.no.description": "No description entered.",
+"message.no.more.readiness.rule.types": "All applicable readiness rule types have already been added.",
 "message.note.about.keypair.permissions.title": "Note about API key pair rule permissions",
 "message.note.about.keypair.permissions.body": "During the creation of API key pairs, it is possible to define a corresponding set of rule permissions. If a rule set is defined, the API key pair will only have access to APIs for which access has been explicitly granted (i.e., APIs whose corresponding rules are marked as allowed). On the other hand, if no rule set is specified, the API key pair permissions will follow and adapt to the permission set of the user's account role.",
 "message.offering.internet.protocol.warning": "WARNING: IPv6 supported Networks use static routing and will require upstream routes to be configured manually.",
@@ -3939,6 +3985,7 @@
 "message.quota.usage.resource.warn": "Resources that are tagged as <untraceable> do not have constant metadata (if removed, the data is deleted) and cannot be retrieved.",
 "message.read.accept.license.agreements": "Please read and accept the terms for the license agreements.",
 "message.read.admin.guide.scaling.up": "Please read the dynamic scaling section in the admin guide before scaling up.",
+"message.readiness.guest.liveness.warning": "Please ensure that the guest agent is running and responsive for the instance(s).",
 "message.recover.vm": "Please confirm that you would like to recover this Instance.",
 "message.reinstall.vm": "NOTE: Proceed with caution. This will cause the Instance to be reinstalled from the Template; data on the root disk will be lost. Extra data volumes, if any, will not be touched.",
 "message.related.settings.changed": "'%x' has been changed. Would you like to review or update any related settings below?",
@@ -4064,6 +4111,9 @@
 "message.success.add.ip.v6.prefix": "Successfully added IPv6 Prefix",
 "message.success.add.kuberversion": "Successfully added Kubernetes version",
 "message.success.add.logical.router": "Successfully added Logical Router",
+"message.success.add.member": "Successfully added member to Instance Boot Group",
+"message.success.add.readiness.rule": "Successfully added readiness rule",
+"message.success.delete.readiness.rule": "Successfully deleted readiness rule",
 "message.success.add.network": "Successfully added Network",
 "message.success.add.network.acl": "Successfully added Network ACL",
 "message.success.add.network.static.route": "Successfully added Network Static Route",
@@ -4149,6 +4199,7 @@
 "message.success.discover.gpu.devices": "Successfully discovered GPU devices",
 "message.success.edit.acl": "Successfully edited ACL rule",
 "message.success.edit.primary.storage": "Successfully edited Primary Storage",
+"message.success.edit.readiness.rule": "Successfully edited readiness rule",
 "message.success.edit.rule": "Successfully edited rule",
 "message.success.enable.saml.auth": "Successfully enabled SAML Authorization",
 "message.success.import.instance": "Successfully imported Instance",
@@ -4177,6 +4228,7 @@
 "message.success.remove.ip": "Successfully removed IP",
 "message.success.remove.iprange": "Successfully removed IP Range",
 "message.success.remove.logical.router": "Successfully removed Logical Router",
+"message.success.remove.member": "Successfully removed member from Instance Boot Group",
 "message.success.remove.network.policy": "Successfully removed Network Policy",
 "message.success.remove.network.permissions": "Successfully removed Network Permissions",
 "message.success.remove.nic": "Successfully removed",
@@ -4197,6 +4249,7 @@
 "message.success.update.bgp.peer": "Successfully updated BGP peer",
 "message.success.update.bucket": "Successfully updated bucket",
 "message.success.update.condition": "Successfully updated condition",
+"message.success.update.member.order": "Successfully updated boot order",
 "message.success.update.gpu.device": "Successfully updated GPU device",
 "message.success.create.vgpu.profile": "Successfully created vGPU profile",
 "message.success.update.vgpu.profile": "Successfully updated vGPU profile",
diff --git a/ui/src/components/view/ListView.vue b/ui/src/components/view/ListView.vue
index 9a7d874fef3e..a585c5c449ae 100644
--- a/ui/src/components/view/ListView.vue
+++ b/ui/src/components/view/ListView.vue
@@ -1213,7 +1213,7 @@ export default {
     quickViewEnabled (actions, columns, key) {
       return actions.length > 0 &&
         (columns && key === columns[0].dataIndex) &&
-        new RegExp(['/vm', '/kubernetes', '/ssh', '/userdata', '/vmgroup', '/affinitygroup', '/autoscalevmgroup',
+        new RegExp(['/vm', '/kubernetes', '/ssh', '/userdata', '/vmgroup', '/instancebootgroup', '/affinitygroup', '/autoscalevmgroup',
           '/volume', '/snapshot', '/vmsnapshot', '/backup',
           '/guestnetwork', '/vpc', '/vpncustomergateway', '/vnfapp',
           '/template', '/iso',
diff --git a/ui/src/config/section/compute.js b/ui/src/config/section/compute.js
index 830997835800..7c2c9f09eae4 100644
--- a/ui/src/config/section/compute.js
+++ b/ui/src/config/section/compute.js
@@ -1065,6 +1065,99 @@ export default {
         }
       ]
     },
+    {
+      name: 'instancebootgroup',
+      title: 'label.instance.boot.groups',
+      icon: 'ordered-list-outlined',
+      resourceType: 'InstanceBootGroup',
+      permission: ['listInstanceBootGroups'],
+      searchFilters: ['name', 'domainid', 'account'],
+      columns: (store) => {
+        var fields = ['name', 'description', 'account']
+        if (store.listAllProjects) {
+          fields.push('project')
+        }
+        fields.push('domain')
+        fields.push('created')
+        return fields
+      },
+      details: ['name', 'id', 'description', 'account', 'domain', 'created'],
+      tabs: [
+        {
+          name: 'details',
+          component: shallowRef(defineAsyncComponent(() => import('@/components/view/DetailsTab.vue')))
+        },
+        {
+          name: 'members',
+          component: shallowRef(defineAsyncComponent(() => import('@/views/compute/InstanceBootGroupMembersTab.vue')))
+        },
+        {
+          name: 'events',
+          resourceType: 'InstanceBootGroup',
+          component: shallowRef(defineAsyncComponent(() => import('@/components/view/EventsTab.vue')))
+        }
+      ],
+      actions: [
+        {
+          api: 'createInstanceBootGroup',
+          icon: 'plus-outlined',
+          label: 'label.add.instance.boot.group',
+          listView: true,
+          args: (record, store) => {
+            var fields = ['name', 'description']
+            if (['Admin', 'DomainAdmin'].includes(store.userInfo.roletype)) {
+              fields.push('domainid')
+              fields.push('account')
+            }
+            fields.push('readinessattempttimeoutseconds', 'readinessmaxretryattempts', 'readinessrebootonretry', 'readinessinitialdelayseconds')
+            return fields
+          }
+        },
+        {
+          api: 'updateInstanceBootGroup',
+          icon: 'edit-outlined',
+          label: 'label.update.instance.boot.group',
+          dataView: true,
+          args: ['name', 'description', 'readinessattempttimeoutseconds', 'readinessmaxretryattempts', 'readinessrebootonretry', 'readinessinitialdelayseconds']
+        },
+        {
+          api: 'startInstanceBootGroup',
+          icon: 'caret-right-outlined',
+          label: 'label.action.start.instance.boot.group',
+          message: 'message.action.start.instance.boot.group',
+          dataView: true,
+          popup: true
+        },
+        {
+          api: 'stopInstanceBootGroup',
+          icon: 'poweroff-outlined',
+          label: 'label.action.stop.instance.boot.group',
+          message: 'message.action.stop.instance.boot.group',
+          dataView: true,
+          popup: true,
+          args: ['forced']
+        },
+        {
+          api: 'rebootInstanceBootGroup',
+          icon: 'reload-outlined',
+          label: 'label.action.reboot.instance.boot.group',
+          message: 'message.action.reboot.instance.boot.group',
+          dataView: true,
+          popup: true,
+          args: ['forced']
+        },
+        {
+          api: 'deleteInstanceBootGroup',
+          icon: 'delete-outlined',
+          label: 'label.delete.instance.boot.group',
+          message: 'message.action.delete.instance.boot.group',
+          dataView: true,
+          groupAction: true,
+          popup: true,
+          groupMap: (selection) => { return selection.map(x => { return { id: x } }) }
+        }
+      ]
+    },
     {
       name: 'ssh',
       title: 'label.ssh.key.pairs',
diff --git a/ui/src/core/lazy_lib/icons_use.js b/ui/src/core/lazy_lib/icons_use.js
index 43c6f822de31..ed7b883ddbb7 100644
--- a/ui/src/core/lazy_lib/icons_use.js
+++ b/ui/src/core/lazy_lib/icons_use.js
@@ -182,8 +182,8 @@ import {
   UserSwitchOutlined,
   UploadOutlined,
   VerticalAlignBottomOutlined,
-  VerticalAlignTopOutlined,
   VerticalAlignMiddleOutlined,
+  VerticalAlignTopOutlined,
   WarningOutlined,
   WifiOutlined,
   SolutionOutlined
@@ -358,8 +358,8 @@ export default {
     app.component('UserSwitchOutlined', UserSwitchOutlined)
     app.component('UploadOutlined', UploadOutlined)
     app.component('VerticalAlignBottomOutlined', VerticalAlignBottomOutlined)
-    app.component('VerticalAlignTopOutlined', VerticalAlignTopOutlined)
     app.component('VerticalAlignMiddleOutlined', VerticalAlignMiddleOutlined)
+    app.component('VerticalAlignTopOutlined', VerticalAlignTopOutlined)
     app.component('WarningOutlined', WarningOutlined)
     app.component('WifiOutlined', WifiOutlined)
     app.component('renderIcon', renderIcon)
diff --git a/ui/src/views/compute/AddInstanceBootGroupMember.vue b/ui/src/views/compute/AddInstanceBootGroupMember.vue
new file mode 100644
index 000000000000..64a9e32249f2
--- /dev/null
+++ b/ui/src/views/compute/AddInstanceBootGroupMember.vue
@@ -0,0 +1,174 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+<template>
+  <div class="form-layout" v-ctrl-enter="handleSubmit">
+    <a-form
+      :ref="formRef"
+      :model="form"
+      :rules="rules"
+      :loading="loading"
+      layout="vertical"
+      @finish="handleSubmit">
+      <a-form-item name="membertype" ref="membertype">
+        <template #label>
+          <tooltip-label :title="$t('label.member.type')" />
+        </template>
+        <a-radio-group
+          v-model:value="form.membertype"
+          @change="onMemberTypeChange">
+          <a-radio value="VirtualMachine">{{ $t('label.instance') }}</a-radio>
+          <a-radio value="InstanceGroup">{{ $t('label.instance.group') }}</a-radio>
+        </a-radio-group>
+      </a-form-item>
+      <a-form-item name="virtualmachineid" ref="virtualmachineid" v-if="form.membertype === 'VirtualMachine'">
+        <template #label>
+          <tooltip-label :title="$t('label.instance')" />
+        </template>
+        <infinite-scroll-select
+          api="listVirtualMachines"
+          :apiParams="{ listall: true }"
+          resourceType="virtualmachine"
+          defaultIcon="desktop-outlined"
+          @change-option-value="onMemberSelected" />
+      </a-form-item>
+      <a-form-item name="instancegroupid" ref="memberid" v-else>
+        <template #label>
+          <tooltip-label :title="$t('label.instance.group')" />
+        </template>
+        <infinite-scroll-select
+          api="listInstanceGroups"
+          :apiParams="{ listall: true }"
+          resourceType="instancegroup"
+          defaultIcon="gold-outlined"
+          @change-option-value="onMemberSelected" />
+      </a-form-item>
+      <a-form-item name="order" ref="order">
+        <template #label>
+          <tooltip-label :title="$t('label.boot.order')" :tooltip="apiParams.order.description" />
+        </template>
+        <a-input-number
+          v-model:value="form.order"
+          style="width: 100%"
+          :min="0" />
+      </a-form-item>
+      <div :span="24" class="action-button">
+        <a-button @click="closeAction">{{ $t('label.cancel') }}</a-button>
+        <a-button :loading="loading" ref="submit" type="primary" @click="handleSubmit">{{ $t('label.ok') }}</a-button>
+      </div>
+    </a-form>
+  </div>
+</template>
+
+<script>
+import { ref, reactive, toRaw } from 'vue'
+import { postAPI } from '@/api'
+import TooltipLabel from '@/components/widgets/TooltipLabel'
+import InfiniteScrollSelect from '@/components/widgets/InfiniteScrollSelect'
+
+export default {
+  name: 'AddInstanceBootGroupMember',
+  components: {
+    TooltipLabel,
+    InfiniteScrollSelect
+  },
+  props: {
+    resource: {
+      type: Object,
+      required: true
+    },
+    memberCount: {
+      type: Number,
+      default: 0
+    }
+  },
+  inject: ['parentFetchData'],
+  data () {
+    return {
+      loading: false
+    }
+  },
+  beforeCreate () {
+    this.apiParams = this.$getApiParams('addMemberToInstanceBootGroup')
+  },
+  created () {
+    this.initForm()
+  },
+  methods: {
+    initForm () {
+      this.formRef = ref()
+      this.form = reactive({
+        membertype: 'VirtualMachine',
+        order: this.memberCount
+      })
+      this.rules = reactive({
+        order: [{ required: true, type: 'number', message: `${this.$t('message.error.required.input')}` }],
+        virtualmachineid: [{ required: true, message: this.$t('message.error.select') }],
+        instancegroupid: [{ required: true, message: this.$t('message.error.select') }]
+      })
+    },
+    onMemberTypeChange () {
+      this.form.virtualmachineid = undefined
+      this.form.instancegroupid = undefined
+    },
+    onMemberSelected (value) {
+      if (this.form.membertype === 'VirtualMachine') {
+        this.form.virtualmachineid = value
+      } else {
+        this.form.instancegroupid = value
+      }
+    },
+    handleSubmit (e) {
+      e.preventDefault()
+      if (this.loading) return
+      this.formRef.value.validate().then(() => {
+        const values = toRaw(this.form)
+        this.loading = true
+        const params = {
+          id: this.resource.id,
+          order: values.order
+        }
+        if (values.membertype === 'VirtualMachine') {
+          params.virtualmachineid = values.virtualmachineid
+        } else {
+          params.instancegroupid = values.instancegroupid
+        }
+        postAPI('addMemberToInstanceBootGroup', params).then(() => {
+          this.$notification.success({
+            message: this.$t('label.add.member'),
+            description: this.$t('message.success.add.member')
+          })
+          this.closeAction()
+          this.parentFetchData()
+        }).catch(error => {
+          this.$notifyError(error)
+        }).finally(() => {
+          this.loading = false
+        })
+      }).catch(error => {
+        this.$notifyError(error)
+      })
+    },
+    closeAction () {
+      this.$emit('close-action')
+    }
+  }
+}
+</script>
+
+<style lang="scss" scoped>
+</style>
diff --git a/ui/src/views/compute/InstanceBootGroupMembersTab.vue b/ui/src/views/compute/InstanceBootGroupMembersTab.vue
new file mode 100644
index 000000000000..d4253c6033a6
--- /dev/null
+++ b/ui/src/views/compute/InstanceBootGroupMembersTab.vue
@@ -0,0 +1,352 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+<template>
+  <div>
+    <a-button
+      type="primary"
+      style="width: 100%; margin-bottom: 10px"
+      @click="showAddMemberModal"
+      :loading="tabLoading"
+      :disabled="!('addMemberToInstanceBootGroup' in $store.getters.apis)">
+      <template #icon><plus-outlined /></template> {{ $t('label.add.member') }}
+    </a-button>
+    <a-table
+      size="small"
+      :columns="columns"
+      :dataSource="members"
+      :rowKey="item => item.id"
+      :pagination="false"
+      :loading="tabLoading"
+      :rowExpandable="record => record.membertype === 'InstanceGroup'"
+      childrenColumnName="__unused_disables_antd_auto_tree_rows">
+      <template #bodyCell="{ column, text, record }">
+        <template v-if="column.key === 'membertype'">
+          <span>
+            <desktop-outlined v-if="text === 'VirtualMachine'" />
+            <gold-outlined v-else />
+            {{ text === 'VirtualMachine' ? $t('label.virtual.machine') : $t('label.instance.group') }}
+            <status v-if="record.memberstate" :text="record.memberstate" style="margin-left: 8px" />
+          </span>
+        </template>
+        <template v-if="column.key === 'membername'">
+          <router-link :to="{ path: memberLinkPath(record) }">{{ text }}</router-link>
+        </template>
+        <template v-if="column.key === 'readiness'">
+          <a-tooltip :title="record.readinessmessage">
+            <a-tag :color="readinessStatusColor(record.readinessstatus)">{{ record.readinessstatus || 'UNKNOWN' }}</a-tag>
+          </a-tooltip>
+          <tooltip-button
+            v-if="record.readinessmode == 'RuleBased' && isReadinessFailing(record.readinessstatus)"
+            :tooltip="computedReadinessStateTooltip(record)"
+            size="small"
+            icon="exclamation-circle-outlined"
+            @click="openReadinessRulesModal(record.membertype, record.memberid, record.membername, true)" />
+          <div style="font-size: 11px; color: rgba(0, 0, 0, 0.45)">{{ readinessModeLabel(record.readinessmode) }}</div>
+        </template>
+        <template v-if="column.key === 'actions'">
+          <span style="margin-right: 5px">
+            <tooltip-button
+              :tooltip="$t('label.manage.readiness.rules')"
+              icon="check-square-outlined"
+              @click="openReadinessRulesModal(record.membertype, record.memberid, record.membername)" />
+          </span>
+          <span style="margin-right: 5px">
+            <tooltip-button
+              v-if="'updateInstanceBootGroupMember' in $store.getters.apis"
+              :tooltip="$t('label.boot.order')"
+              icon="vertical-align-middle-outlined"
+              @click="openUpdateOrderModal(record)" />
+          </span>
+          <span style="margin-right: 5px">
+            <a-popconfirm
+              v-if="'removeInstanceBootGroupMember' in $store.getters.apis"
+              placement="topRight"
+              :title="$t('message.confirm.remove.member')"
+              :ok-text="$t('label.yes')"
+              :cancel-text="$t('label.no')"
+              :loading="removeLoading"
+              @confirm="removeMember(record)">
+              <tooltip-button
+                :tooltip="$t('label.remove')"
+                type="primary"
+                :danger="true"
+                icon="delete-outlined" />
+            </a-popconfirm>
+          </span>
+        </template>
+      </template>
+      <template #expandedRowRender="{ record }">
+        <a-table
+          size="small"
+          style="margin-top: 8px"
+          :columns="vmColumns"
+          :dataSource="record.children || []"
+          :rowKey="item => item.id"
+          :pagination="childrenPagination">
+          <template #bodyCell="{ column, text, record: vmRecord }">
+            <template v-if="column.key === 'name'">
+              <router-link :to="{ path: '/vm/' + vmRecord.id }">{{ text }}</router-link>
+            </template>
+            <template v-if="column.key === 'state'">
+              <status :text="text" displayText />
+            </template>
+            <template v-if="column.key === 'readiness'">
+              <a-tooltip :title="vmRecord.readinessmessage">
+                <a-tag :color="readinessStatusColor(vmRecord.readinessstatus)">{{ vmRecord.readinessstatus || 'UNKNOWN' }}</a-tag>
+              </a-tooltip>
+              <tooltip-button
+                v-if="vmRecord.readinessmode == 'RuleBased' && isReadinessFailing(vmRecord.readinessstatus)"
+                :tooltip="vmRecord.state == 'Running' ? $t('label.view.failing.readiness.rules') : $t('label.instance.not.running.view.last.readiness.results')"
+                size="small"
+                icon="exclamation-circle-outlined"
+                @click="openReadinessRulesModal('VirtualMachine', vmRecord.id, vmRecord.name, true)" />
+              <div style="font-size: 11px; color: rgba(0, 0, 0, 0.45)">{{ readinessModeLabel(vmRecord.readinessmode) }}</div>
+            </template>
+            <template v-if="column.key === 'vmactions'">
+              <tooltip-button
+                :tooltip="$t('label.manage.readiness.rules')"
+                icon="check-square-outlined"
+                @click="openReadinessRulesModal('VirtualMachine', vmRecord.id, vmRecord.name)" />
+            </template>
+          </template>
+        </a-table>
+      </template>
+    </a-table>
+
+    <a-modal
+      :visible="showAddMember"
+      :title="$t('label.add.member')"
+      :maskClosable="false"
+      :closable="true"
+      :footer="null"
+      :width="600"
+      @cancel="closeModals">
+      <add-instance-boot-group-member
+        :resource="resource"
+        :memberCount="members.length"
+        @close-action="closeModals" />
+    </a-modal>
+
+    <a-modal
+      :visible="showUpdateOrder"
+      :title="$t('label.boot.order')"
+      :maskClosable="false"
+      :closable="true"
+      :footer="null"
+      :width="500"
+      @cancel="closeModals">
+      <update-instance-boot-group-member-order
+        :key="memberForUpdate.id"
+        :resource="memberForUpdate"
+        @close-action="closeModals" />
+    </a-modal>
+
+    <a-modal
+      :visible="showReadinessRules"
+      :title="$t('label.readiness.rules') + (readinessRulesItemName ? (' - ' + readinessRulesItemName) : '')"
+      :maskClosable="false"
+      :closable="true"
+      :footer="null"
+      :width="800"
+      @cancel="closeModals">
+      <instance-boot-group-readiness-rules-modal
+        v-if="showReadinessRules"
+        :bootGroupId="resource.id"
+        :itemType="readinessRulesItemType"
+        :itemId="readinessRulesItemId"
+        :readOnly="readinessRulesForcedReadOnly || !('createInstanceBootGroupReadinessRule' in $store.getters.apis)" />
+    </a-modal>
+  </div>
+</template>
+
+<script>
+import { getAPI, postAPI } from '@/api'
+import TooltipButton from '@/components/widgets/TooltipButton'
+import Status from '@/components/widgets/Status'
+import AddInstanceBootGroupMember from '@/views/compute/AddInstanceBootGroupMember.vue'
+import UpdateInstanceBootGroupMemberOrder from '@/views/compute/UpdateInstanceBootGroupMemberOrder.vue'
+import InstanceBootGroupReadinessRulesModal from '@/views/compute/InstanceBootGroupReadinessRulesModal.vue'
+
+export default {
+  name: 'InstanceBootGroupMembersTab',
+  components: {
+    TooltipButton,
+    Status,
+    AddInstanceBootGroupMember,
+    UpdateInstanceBootGroupMemberOrder,
+    InstanceBootGroupReadinessRulesModal
+  },
+  props: {
+    resource: {
+      type: Object,
+      required: true
+    }
+  },
+  data () {
+    return {
+      tabLoading: false,
+      removeLoading: false,
+      members: [],
+      showAddMember: false,
+      showUpdateOrder: false,
+      memberForUpdate: {},
+      showReadinessRules: false,
+      readinessRulesItemType: 'VirtualMachine',
+      readinessRulesItemId: null,
+      readinessRulesItemName: '',
+      readinessRulesForcedReadOnly: false,
+      columns: [
+        { key: 'order', title: this.$t('label.boot.order'), dataIndex: 'order' },
+        { key: 'membername', title: this.$t('label.name'), dataIndex: 'membername' },
+        { key: 'membertype', title: this.$t('label.member.type'), dataIndex: 'membertype', width: 200 },
+        { key: 'readiness', title: this.$t('label.readiness'), dataIndex: 'readinessstatus' },
+        { key: 'actions', title: this.$t('label.actions') }
+      ],
+      vmColumns: [
+        { key: 'name', title: this.$t('label.name'), dataIndex: 'name' },
+        { key: 'state', title: this.$t('label.state'), dataIndex: 'state' },
+        { key: 'readiness', title: this.$t('label.readiness'), dataIndex: 'readinessstatus' },
+        { key: 'vmactions', title: this.$t('label.actions') }
+      ]
+    }
+  },
+  computed: {
+    childrenPagination () {
+      var sizes = [10, 20, 40, 80, this.$store.getters.defaultListViewPageSize]
+      var pageSizeOptions = [...new Set(sizes)].sort((a, b) => a - b).map(String)
+      return {
+        size: 'small',
+        pageSize: pageSizeOptions[0] * 1,
+        pageSizeOptions: pageSizeOptions,
+        showSizeChanger: true
+      }
+    }
+  },
+  created () {
+    this.fetchData()
+  },
+  watch: {
+    resource: {
+      handler (newItem) {
+        if (!newItem || !newItem.id) {
+          return
+        }
+        this.fetchData()
+      }
+    }
+  },
+  methods: {
+    fetchData () {
+      this.fetchMembers()
+    },
+    fetchMembers () {
+      this.members = []
+      if (!this.resource.id) {
+        return
+      }
+      this.tabLoading = true
+      // readiness/children are opt-in: computing readiness is not free, and children (the VMs of an
+      // InstanceGroup member) are only needed for the expandable rows, so listInstanceBootGroupMembers
+      // only includes them when explicitly requested
+      getAPI('listInstanceBootGroupMembers', { bootgroupid: this.resource.id, listall: true, details: 'readiness,children' }).then(json => {
+        const members = json?.listinstancebootgroupmembersresponse?.instancebootgroupmember || []
+        this.members = members.slice().sort((a, b) => a.order - b.order)
+      }).catch(error => {
+        this.$notifyError(error)
+      }).finally(() => {
+        this.tabLoading = false
+      })
+    },
+    readinessStatusColor (status) {
+      switch (status) {
+        case 'Ready': return 'success'
+        case 'NotReady': return 'warning'
+        case 'Error': return 'error'
+        default: return 'default'
+      }
+    },
+    isReadinessFailing (status) {
+      return status === 'Error' || status === 'NotReady'
+    },
+    readinessModeLabel (mode) {
+      switch (mode) {
+        case 'None': return this.$t('label.readiness.mode.no.readiness')
+        case 'ChildDependent': return this.$t('label.readiness.mode.child.dependent')
+        case 'RuleBased': return this.$t('label.readiness.mode.rule.based')
+        default: return ''
+      }
+    },
+    memberLinkPath (record) {
+      return record.membertype === 'VirtualMachine' ? ('/vm/' + record.memberid) : ('/vmgroup/' + record.memberid)
+    },
+    showAddMemberModal () {
+      this.showAddMember = true
+    },
+    openUpdateOrderModal (record) {
+      this.memberForUpdate = record
+      this.showUpdateOrder = true
+    },
+    // forceReadOnly is set when opened from the failing-readiness shortcut in the readiness column —
+    // that entry point is for checking why a rule is failing, not for managing rules, regardless of
+    // whether the caller otherwise has permission to add/delete them.
+    openReadinessRulesModal (itemType, itemId, itemName, forceReadOnly = false) {
+      this.readinessRulesItemType = itemType
+      this.readinessRulesItemId = itemId
+      this.readinessRulesItemName = itemName
+      this.readinessRulesForcedReadOnly = forceReadOnly
+      this.showReadinessRules = true
+    },
+    closeModals () {
+      this.showAddMember = false
+      this.showUpdateOrder = false
+      this.showReadinessRules = false
+      this.memberForUpdate = {}
+      this.readinessRulesForcedReadOnly = false
+      this.fetchMembers()
+    },
+    removeMember (record) {
+      this.removeLoading = true
+      postAPI('removeInstanceBootGroupMember', { id: record.id }).then(() => {
+        this.$notification.success({
+          message: this.$t('label.remove'),
+          description: this.$t('message.success.remove.member')
+        })
+        this.fetchMembers()
+      }).catch(error => {
+        this.$notifyError(error)
+      }).finally(() => {
+        this.removeLoading = false
+      })
+    },
+    computedReadinessStateTooltip (record) {
+      if (record.readinessmode !== 'RuleBased' || !this.isReadinessFailing(record.readinessstatus)) {
+        return ''
+      }
+      if (record.membertype === 'VirtualMachine') {
+        return record.memberstate === 'Running'
+          ? this.$t('label.view.failing.readiness.rules')
+          : this.$t('label.instance.not.running.view.last.readiness.results')
+      }
+      if (record.children.filter(c => c.state === 'Running').length === 0) {
+        return this.$t('label.instancegroup.instances.not.running.view.last.readiness.results')
+      }
+      return this.$t('label.view.failing.readiness.rules')
+    }
+  }
+}
+</script>
diff --git a/ui/src/views/compute/InstanceBootGroupReadinessRulesModal.vue b/ui/src/views/compute/InstanceBootGroupReadinessRulesModal.vue
new file mode 100644
index 000000000000..de40fc9908dc
--- /dev/null
+++ b/ui/src/views/compute/InstanceBootGroupReadinessRulesModal.vue
@@ -0,0 +1,413 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+<template>
+  <div>
+    <a-table
+      size="small"
+      :columns="columns"
+      :dataSource="rules"
+      :rowKey="item => item.id"
+      :pagination="false"
+      :loading="tabLoading"
+      :scroll="{ x: readOnly ? 700 : 950 }">
+      <template #bodyCell="{ column, text, record }">
+        <template v-if="column.key === 'ruletype'">
+          {{ $t('label.' + text.toLowerCase()) }}
+          <a-tag v-if="record.inherited" color="blue">{{ $t('label.inherited') }}</a-tag>
+        </template>
+        <template v-if="column.key === 'name'">
+          <a-input v-if="editingRuleId === record.id" v-model:value="editForm.name" size="small" />
+          <span v-else>{{ text }}</span>
+        </template>
+        <template v-if="column.key === 'details'">
+          <template v-if="detailEntries(record).length">
+            <a-tag v-for="entry in detailEntries(record)" :key="entry.key">{{ entry.key }}: {{ entry.value }}</a-tag>
+          </template>
+          <span v-else>-</span>
+        </template>
+        <template v-if="column.key === 'status'">
+          <a-tag :color="statusColor(text)">{{ text || 'UNKNOWN' }}</a-tag>
+        </template>
+        <template v-if="column.key === 'enabled'">
+          <a-switch v-if="editingRuleId === record.id" v-model:checked="editForm.enabled" size="small" />
+          <status v-else :text="text ? 'true' : 'false'" displayText />
+        </template>
+        <template v-if="column.key === 'statusmessage'">
+          <a-tooltip :title="text">
+            <div class="readiness-rule-message">{{ text }}</div>
+          </a-tooltip>
+          <div v-if="record.checkedon" class="readiness-rule-checkedon">{{ $t('label.last.checked') }}: {{ $toLocaleDate(record.checkedon) }}</div>
+        </template>
+        <template v-if="column.key === 'actions'">
+          <template v-if="editingRuleId === record.id">
+            <tooltip-button
+              key="save"
+              :tooltip="$t('label.save')"
+              type="primary"
+              icon="check-outlined"
+              style="margin-right: 5px"
+              :loading="editSubmitLoading"
+              @click="saveEditRule(record)" />
+            <tooltip-button
+              key="cancel"
+              :tooltip="$t('label.cancel')"
+              icon="close-outlined"
+              @click="cancelEditRule" />
+          </template>
+          <template v-else-if="record.inherited">
+            <tooltip-button
+              key="inherited"
+              :tooltip="$t('message.inherited.readiness.rule')"
+              :disabled="true"
+              icon="delete-outlined" />
+          </template>
+          <template v-else>
+            <tooltip-button
+              key="edit"
+              :tooltip="$t('label.edit.readiness.rule')"
+              icon="edit-outlined"
+              style="margin-right: 5px"
+              :disabled="editingRuleId !== null"
+              @click="startEditRule(record)" />
+            <a-popconfirm
+              key="delete"
+              placement="topRight"
+              :title="$t('message.confirm.delete.readiness.rule')"
+              :ok-text="$t('label.yes')"
+              :cancel-text="$t('label.no')"
+              @confirm="deleteRule(record)">
+              <tooltip-button
+                :tooltip="$t('label.delete')"
+                type="primary"
+                :danger="true"
+                :disabled="editingRuleId !== null"
+                icon="delete-outlined" />
+            </a-popconfirm>
+          </template>
+        </template>
+      </template>
+    </a-table>
+
+    <template v-if="!readOnly">
+      <a-divider />
+
+      <a-form
+        v-if="availableRuleTypes.length"
+        :ref="formRef"
+        :model="form"
+        :rules="formRules"
+        layout="vertical"
+        @finish="handleSubmit">
+        <a-form-item name="ruletype" ref="ruletype">
+          <template #label>
+            <tooltip-label :title="$t('label.rule.type')" :tooltip="apiParams.ruletype.description"/>
+          </template>
+          <span v-if="isGuestLivenessSelected">
+            <a-alert type="warning">
+              <template #message>
+                <span v-html="$t('message.readiness.guest.liveness.warning')" />
+              </template>
+            </a-alert>
+            <br/>
+          </span>
+          <a-select v-model:value="form.ruletype" @change="onRuleTypeChange">
+            <a-select-option v-for="type in availableRuleTypes" :key="type" :value="type">{{ $t('label.' + type.toLowerCase()) }}</a-select-option>
+          </a-select>
+        </a-form-item>
+        <a-form-item name="name" ref="name">
+          <template #label>
+            <tooltip-label :title="$t('label.name')" :tooltip="apiParams.name.description"/>
+          </template>
+          <a-input v-model:value="form.name" :placeholder="apiParams.name.description" />
+        </a-form-item>
+        <template v-if="form.ruletype === 'PortCheck'">
+          <a-form-item name="port" ref="port" :label="$t('label.port')">
+            <a-input-number v-model:value="form.port" style="width: 100%" :min="1" :max="65535" />
+          </a-form-item>
+          <a-form-item name="protocol" ref="protocol" :label="$t('label.protocol')">
+            <a-select v-model:value="form.protocol">
+              <a-select-option value="tcp">tcp</a-select-option>
+            </a-select>
+          </a-form-item>
+        </template>
+        <template v-if="form.ruletype === 'MemberQuorum'">
+          <a-form-item name="thresholdtype" ref="thresholdtype" :label="$t('label.threshold.type')">
+            <a-select v-model:value="form.thresholdtype">
+              <a-select-option value="COUNT">COUNT</a-select-option>
+              <a-select-option value="PERCENTAGE">PERCENTAGE</a-select-option>
+            </a-select>
+          </a-form-item>
+          <a-form-item name="thresholdvalue" ref="thresholdvalue" :label="$t('label.threshold.value')">
+            <a-input-number v-model:value="form.thresholdvalue" style="width: 100%" :min="0" />
+          </a-form-item>
+        </template>
+        <div :span="24" class="action-button">
+          <a-button :loading="submitLoading" type="primary" @click="handleSubmit">{{ $t('label.add.readiness.rule') }}</a-button>
+        </div>
+      </a-form>
+      <a-alert v-else type="info" :message="$t('message.no.more.readiness.rule.types')" show-icon />
+    </template>
+  </div>
+</template>
+
+<script>
+import { ref, reactive } from 'vue'
+import { getAPI, postAPI } from '@/api'
+import TooltipButton from '@/components/widgets/TooltipButton'
+import TooltipLabel from '@/components/widgets/TooltipLabel'
+import Status from '@/components/widgets/Status'
+
+export default {
+  name: 'InstanceBootGroupReadinessRulesModal',
+  components: {
+    TooltipButton,
+    TooltipLabel,
+    Status
+  },
+  props: {
+    bootGroupId: {
+      type: String,
+      required: true
+    },
+    itemType: {
+      type: String,
+      required: true
+    },
+    itemId: {
+      type: String,
+      required: true
+    },
+    /** Drops the delete action and add-rule form, leaving just the rule/status table. */
+    readOnly: {
+      type: Boolean,
+      default: false
+    }
+  },
+  data () {
+    return {
+      tabLoading: false,
+      submitLoading: false,
+      rules: [],
+      editingRuleId: null,
+      editForm: { name: '', enabled: true },
+      editSubmitLoading: false
+    }
+  },
+  computed: {
+    columns () {
+      const columns = [
+        { key: 'ruletype', title: this.$t('label.rule.type'), dataIndex: 'ruletype', width: 140 },
+        { key: 'name', title: this.$t('label.name'), dataIndex: 'name', width: 120 },
+        { key: 'details', title: this.$t('label.details'), dataIndex: 'details', width: 180 },
+        { key: 'enabled', title: this.$t('label.enabled'), dataIndex: 'enabled', width: 90 },
+        { key: 'status', title: this.$t('label.status'), dataIndex: 'readinessstatus', width: 100 },
+        { key: 'statusmessage', title: this.$t('label.message'), dataIndex: 'statusmessage', width: 220 }
+      ]
+      if (!this.readOnly) {
+        columns.push({ key: 'actions', title: this.$t('label.actions'), width: 130 })
+      }
+      return columns
+    },
+    /**
+     * Ping/GuestAgentLiveness are singleton regardless of item type; MemberQuorum is singleton but
+     * only applies to an InstanceGroup. PortCheck allows multiple (different ports).
+     */
+    singletonRuleTypes () {
+      return this.itemType === 'VirtualMachine' ? ['Ping', 'GuestAgentLiveness'] : ['Ping', 'GuestAgentLiveness', 'MemberQuorum']
+    },
+    availableRuleTypes () {
+      const allRuleTypes = this.itemType === 'VirtualMachine'
+        ? ['Ping', 'GuestAgentLiveness', 'PortCheck']
+        : ['Ping', 'GuestAgentLiveness', 'PortCheck', 'MemberQuorum']
+      const existingRuleTypes = this.rules.map(rule => rule.ruletype)
+      return allRuleTypes.filter(type => !this.singletonRuleTypes.includes(type) || !existingRuleTypes.includes(type))
+    },
+    isGuestLivenessSelected () {
+      return this.form.ruletype === 'GuestAgentLiveness'
+    }
+  },
+  beforeCreate () {
+    this.apiParams = this.$getApiParams('createInstanceBootGroupReadinessRule')
+  },
+  created () {
+    this.initForm()
+    this.fetchRules()
+  },
+  methods: {
+    initForm () {
+      this.formRef = ref()
+      this.form = reactive({
+        ruletype: this.availableRuleTypes[0],
+        name: undefined,
+        port: 80,
+        protocol: 'tcp',
+        thresholdtype: 'PERCENTAGE',
+        thresholdvalue: 100
+      })
+      this.formRules = reactive({
+        ruletype: [{ required: true, message: this.$t('message.error.select') }]
+      })
+    },
+    /** No-op: the conditional fields are driven directly off form.ruletype. */
+    onRuleTypeChange () {
+    },
+    fetchRules () {
+      this.tabLoading = true
+      const params = { bootgroupid: this.bootGroupId }
+      if (this.itemType === 'VirtualMachine') {
+        params.virtualmachineid = this.itemId
+      } else {
+        params.instancegroupid = this.itemId
+      }
+      getAPI('listInstanceBootGroupReadinessRules', params).then(json => {
+        this.rules = json?.listinstancebootgroupreadinessrulesresponse?.instancebootgroupreadinessrule || []
+        if (!this.availableRuleTypes.includes(this.form.ruletype)) {
+          this.form.ruletype = this.availableRuleTypes[0]
+        }
+      }).catch(error => {
+        this.$notifyError(error)
+      }).finally(() => {
+        this.tabLoading = false
+      })
+    },
+    /**
+     * Collapses MemberQuorum's threshold pair and PortCheck's port/protocol into a single tag each;
+     * anything else falls back to one tag per raw detail key.
+     */
+    detailEntries (record) {
+      const details = record.details || {}
+      if (record.ruletype === 'MemberQuorum' && details.threshold_type) {
+        return [{ key: details.threshold_type.toUpperCase(), value: details.threshold_value }]
+      }
+      if (record.ruletype === 'PortCheck' && details.port) {
+        return [{ key: 'PORT', value: `${details.port}/${(details.protocol || 'tcp').toUpperCase()}` }]
+      }
+      return Object.keys(details).map(key => ({ key: key.toUpperCase(), value: details[key] }))
+    },
+    statusColor (status) {
+      switch (status) {
+        case 'Ready': return 'success'
+        case 'NotReady': return 'warning'
+        case 'Error': return 'error'
+        default: return 'default'
+      }
+    },
+    handleSubmit (e) {
+      if (e && e.preventDefault) e.preventDefault()
+      if (this.submitLoading) return
+      this.formRef.value.validate().then(() => {
+        this.submitLoading = true
+        const params = {
+          bootgroupid: this.bootGroupId,
+          ruletype: this.form.ruletype
+        }
+        if (this.itemType === 'VirtualMachine') {
+          params.virtualmachineid = this.itemId
+        } else {
+          params.instancegroupid = this.itemId
+        }
+        if (this.form.name) {
+          params.name = this.form.name
+        }
+        const details = {}
+        if (this.form.ruletype === 'PortCheck') {
+          details.port = this.form.port
+          details.protocol = this.form.protocol
+        } else if (this.form.ruletype === 'MemberQuorum') {
+          details.threshold_type = this.form.thresholdtype
+          details.threshold_value = this.form.thresholdvalue
+        }
+        Object.keys(details).forEach((key) => {
+          params[`details[0].${key}`] = String(details[key])
+        })
+        postAPI('createInstanceBootGroupReadinessRule', params).then(() => {
+          this.$notification.success({
+            message: this.$t('label.add.readiness.rule'),
+            description: this.$t('message.success.add.readiness.rule')
+          })
+          this.fetchRules()
+        }).catch(error => {
+          this.$notifyError(error)
+        }).finally(() => {
+          this.submitLoading = false
+        })
+      }).catch(error => {
+        this.$notifyError(error)
+      })
+    },
+    deleteRule (record) {
+      postAPI('deleteInstanceBootGroupReadinessRule', { id: record.id }).then(() => {
+        this.$notification.success({
+          message: this.$t('label.delete'),
+          description: this.$t('message.success.delete.readiness.rule')
+        })
+        this.fetchRules()
+      }).catch(error => {
+        this.$notifyError(error)
+      })
+    },
+    /**
+     * Only name/enabled are editable — rule type and details are immutable after creation and are
+     * instead changed by removing and re-adding the rule. Edited in place in the table row.
+     */
+    startEditRule (record) {
+      this.editingRuleId = record.id
+      this.editForm.name = record.name
+      this.editForm.enabled = record.enabled
+    },
+    cancelEditRule () {
+      this.editingRuleId = null
+    },
+    saveEditRule (record) {
+      if (this.editSubmitLoading) return
+      this.editSubmitLoading = true
+      postAPI('updateInstanceBootGroupReadinessRule', {
+        id: record.id,
+        name: this.editForm.name,
+        enabled: this.editForm.enabled
+      }).then(() => {
+        this.$notification.success({
+          message: this.$t('label.edit.readiness.rule'),
+          description: this.$t('message.success.edit.readiness.rule')
+        })
+        this.editingRuleId = null
+        this.fetchRules()
+      }).catch(error => {
+        this.$notifyError(error)
+      }).finally(() => {
+        this.editSubmitLoading = false
+      })
+    }
+  }
+}
+</script>
+
+<style lang="scss" scoped>
+  .readiness-rule-message {
+    max-width: 220px;
+    overflow: hidden;
+    text-overflow: ellipsis;
+    white-space: nowrap;
+  }
+
+  .readiness-rule-checkedon {
+    font-size: 11px;
+    color: rgba(0, 0, 0, 0.45);
+    white-space: nowrap;
+  }
+</style>
diff --git a/ui/src/views/compute/UpdateInstanceBootGroupMemberOrder.vue b/ui/src/views/compute/UpdateInstanceBootGroupMemberOrder.vue
new file mode 100644
index 000000000000..ff9d7d09d6b7
--- /dev/null
+++ b/ui/src/views/compute/UpdateInstanceBootGroupMemberOrder.vue
@@ -0,0 +1,116 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+<template>
+  <div class="form-layout" v-ctrl-enter="handleSubmit">
+    <a-form
+      :ref="formRef"
+      :model="form"
+      :rules="rules"
+      :loading="loading"
+      layout="vertical"
+      @finish="handleSubmit">
+      <a-form-item name="order" ref="order">
+        <template #label>
+          <tooltip-label :title="$t('label.boot.order')" :tooltip="apiParams.order.description" />
+        </template>
+        <a-input-number
+          v-model:value="form.order"
+          style="width: 100%"
+          :min="0"
+          v-focus="true" />
+      </a-form-item>
+      <div :span="24" class="action-button">
+        <a-button @click="closeAction">{{ $t('label.cancel') }}</a-button>
+        <a-button :loading="loading" ref="submit" type="primary" @click="handleSubmit">{{ $t('label.ok') }}</a-button>
+      </div>
+    </a-form>
+  </div>
+</template>
+
+<script>
+import { ref, reactive, toRaw } from 'vue'
+import { postAPI } from '@/api'
+import TooltipLabel from '@/components/widgets/TooltipLabel'
+
+export default {
+  name: 'UpdateInstanceBootGroupMemberOrder',
+  components: {
+    TooltipLabel
+  },
+  props: {
+    resource: {
+      type: Object,
+      required: true
+    }
+  },
+  inject: ['parentFetchData'],
+  data () {
+    return {
+      loading: false
+    }
+  },
+  beforeCreate () {
+    this.apiParams = this.$getApiParams('updateInstanceBootGroupMember')
+  },
+  created () {
+    this.initForm()
+  },
+  methods: {
+    initForm () {
+      this.formRef = ref()
+      this.form = reactive({
+        order: this.resource.order
+      })
+      this.rules = reactive({
+        order: [{ required: true, type: 'number', message: `${this.$t('message.error.required.input')}` }]
+      })
+    },
+    handleSubmit (e) {
+      e.preventDefault()
+      if (this.loading) return
+      this.formRef.value.validate().then(() => {
+        const values = toRaw(this.form)
+        this.loading = true
+        postAPI('updateInstanceBootGroupMember', {
+          id: this.resource.id,
+          order: values.order
+        }).then(() => {
+          this.$notification.success({
+            message: this.$t('label.boot.order'),
+            description: this.$t('message.success.update.member.order')
+          })
+          this.closeAction()
+          this.parentFetchData()
+        }).catch(error => {
+          this.$notifyError(error)
+        }).finally(() => {
+          this.loading = false
+        })
+      }).catch(error => {
+        this.$notifyError(error)
+      })
+    },
+    closeAction () {
+      this.$emit('close-action')
+    }
+  }
+}
+</script>
+
+<style scoped lang="less">
+</style>

From 68cff975cebe11bbe47c85623a0dd356cea4b079 Mon Sep 17 00:00:00 2001
From: Nicolas Vazquez <nicovazquez90@gmail.com>
Date: Fri, 9 Oct 2026 07:31:36 -0300
Subject: [PATCH 28/41] Upgrade Netris SDK version to 1.1.0 since 24.0 (#14365)

---
 plugins/network-elements/netris/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/network-elements/netris/pom.xml b/plugins/network-elements/netris/pom.xml
index f98bb8a30638..6e9b103e9822 100644
--- a/plugins/network-elements/netris/pom.xml
+++ b/plugins/network-elements/netris/pom.xml
@@ -33,7 +33,7 @@
         <dependency>
             <groupId>io.netris</groupId>
             <artifactId>netris-java-sdk</artifactId>
-            <version>1.0.0</version>
+            <version>1.1.0</version>
         </dependency>
         <dependency>
             <groupId>com.github.seancfoley</groupId>

From 1805dde42af4c6800b3a682d81c0d81d747aa775 Mon Sep 17 00:00:00 2001
From: Brad House - Nexthop <bhouse@nexthop.ai>
Date: Fri, 9 Oct 2026 09:07:56 -0400
Subject: [PATCH 29/41] kvm: look RBD volumes up through librbd instead of
 refreshing the pool (#14188)

getPhysicalDisk() asks libvirt for the volume. A volume that was just
created by the management server is not in this host's libvirt pool
cache, so the lookup misses and getVolume() falls back to refreshing the
whole pool. Refreshing an RBD pool opens and stats every image in it, so
the cost grows with the number of volumes in the pool and is paid on
every VM start. On a pool holding 950 images that is 11.7 seconds added
to each start, against 0.005 seconds to list the image names.

Look RBD volumes up directly through librbd instead. Creating, cloning,
resizing, copying and deleting RBD volumes in this class already use
librbd directly; only the lookup went through libvirt.

Because this runs on every VM start, the connection is handled more
carefully than at the existing call sites:

 - the rados connection is shut down in a finally, so a client is not
   left for the finalizer. KVMStoragePoolManager.getPhysicalDisk retries
   a missing volume 100 times, so leaking here would mean 101 live
   librados clients for one absent volume.
 - the image is opened read only, since it is only stat'ed, and so
   cannot take the exclusive lock.
 - the image is closed through a helper that does not throw, so a failed
   close cannot discard a successful lookup or hide the original error.
 - the cephx key is only set when the pool has a user. librados aborts
   the process if it is handed a null value.
---
 .../kvm/storage/LibvirtStorageAdaptor.java    | 81 +++++++++++++++++++
 1 file changed, 81 insertions(+)

diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptor.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptor.java
index 059f4f8b67af..c949d0882479 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptor.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptor.java
@@ -659,6 +659,19 @@ public KVMStoragePool getStoragePool(String uuid, boolean refreshInfo) {
     public KVMPhysicalDisk getPhysicalDisk(String volumeUuid, KVMStoragePool pool) {
         LibvirtStoragePool libvirtPool = (LibvirtStoragePool)pool;
 
+        /*
+         * An RBD volume is looked up through librbd rather than through libvirt.
+         * A volume that was created by another host is not in the libvirt pool
+         * cache, so looking it up through libvirt misses and forces a refresh of
+         * the whole pool. Refreshing an RBD pool stats every image in it, so that
+         * cost grows with the number of volumes in the pool and is paid on every
+         * VM start. Every other RBD operation in this class already uses librbd
+         * directly.
+         */
+        if (pool.getType() == StoragePoolType.RBD) {
+            return getRbdPhysicalDisk(volumeUuid, libvirtPool);
+        }
+
         try {
             StorageVol vol = getVolume(libvirtPool.getPool(), volumeUuid);
             KVMPhysicalDisk disk;
@@ -696,6 +709,74 @@ public KVMPhysicalDisk getPhysicalDisk(String volumeUuid, KVMStoragePool pool) {
         }
     }
 
+    /**
+     * Looks an RBD volume up directly through librbd.
+     *
+     * The size reported by librbd is used for both the size and the virtual size of
+     * the disk, matching what this class already does after converting an image into
+     * an RBD volume.
+     */
+    private KVMPhysicalDisk getRbdPhysicalDisk(String volumeUuid, LibvirtStoragePool pool) {
+        Rados r = new Rados(pool.getAuthUserName());
+        try {
+            r.confSet("mon_host", pool.getSourceHost() + ":" + pool.getSourcePort());
+            /*
+             * The secret is null when the pool has no cephx user, and librados
+             * aborts the process rather than returning an error if it is handed a
+             * null value here.
+             */
+            if (pool.getAuthUserName() != null) {
+                r.confSet("key", pool.getAuthSecret());
+            } else {
+                r.confSet("auth_client_required", "none");
+            }
+            r.confSet("client_mount_timeout", "30");
+            r.connect();
+
+            IoCTX io = r.ioCtxCreate(pool.getSourceDir());
+            try {
+                Rbd rbd = new Rbd(io);
+                // The image is only stat'ed, so it is opened read only and cannot take the exclusive lock.
+                RbdImage image = rbd.openReadOnly(volumeUuid);
+                try {
+                    RbdImageInfo rbdInfo = image.stat();
+                    KVMPhysicalDisk disk = new KVMPhysicalDisk(pool.getSourceDir() + "/" + volumeUuid, volumeUuid, pool);
+                    disk.setFormat(PhysicalDiskFormat.RAW);
+                    disk.setSize(rbdInfo.size);
+                    disk.setVirtualSize(rbdInfo.size);
+                    return disk;
+                } finally {
+                    closeRbdImage(rbd, image, volumeUuid);
+                }
+            } finally {
+                r.ioCtxDestroy(io);
+            }
+        } catch (RadosException e) {
+            logger.error("A Ceph RADOS operation failed (" + e.getReturnValue() + "). The error was: " + e.getMessage()
+                    + " - " + ErrorCode.getErrorMessage(e.getReturnValue()));
+            throw new CloudRuntimeException(e.toString(), e);
+        } catch (RbdException e) {
+            logger.error("A Ceph RBD operation failed (" + e.getReturnValue() + "). The error was: " + e.getMessage()
+                    + " - " + ErrorCode.getErrorMessage(e.getReturnValue()));
+            throw new CloudRuntimeException(e.toString(), e);
+        } finally {
+            r.shutDown();
+        }
+    }
+
+    /**
+     * Closes an RBD image without throwing, so that a failure to close cannot discard a
+     * successful result or hide the exception that is already on its way out.
+     */
+    private void closeRbdImage(Rbd rbd, RbdImage image, String volumeUuid) {
+        try {
+            rbd.close(image);
+        } catch (RbdException e) {
+            logger.warn("Failed to close RBD image " + volumeUuid + " (" + e.getReturnValue() + "): "
+                    + e.getMessage() + " - " + ErrorCode.getErrorMessage(e.getReturnValue()));
+        }
+    }
+
     /**
      * adjust refcount
      */

From 0931cf818e6b1e620e158a97164bafbc8e31e0c8 Mon Sep 17 00:00:00 2001
From: David Taylor <880024+Alpha162@users.noreply.github.com>
Date: Fri, 9 Oct 2026 15:00:22 +0100
Subject: [PATCH 30/41] usage: widen usage_volume unique key to include vm_id
 (#13933)

Backport of #13909 to 4.22, targeting 4.22.2.

This also creates the 4.22.1.0 to 4.22.2.0 upgrade path, which didn't
exist yet: schema-42210to42220.sql, its cleanup companion, the
Upgrade42210to42220 class, and the registration in DatabaseUpgradeChecker.

The CALLs can't go into schema-42200to42210.sql instead, because every
4.22.1.0 install has already run that file and those are the affected
clusters.

Co-authored-by: Abhisar Sinha <63767682+abh1sar@users.noreply.github.com>
---
 .../main/java/com/cloud/upgrade/DatabaseUpgradeChecker.java  | 2 ++
 .../src/main/resources/META-INF/db/schema-42210to42220.sql   | 5 +++++
 2 files changed, 7 insertions(+)

diff --git a/engine/schema/src/main/java/com/cloud/upgrade/DatabaseUpgradeChecker.java b/engine/schema/src/main/java/com/cloud/upgrade/DatabaseUpgradeChecker.java
index 3868ca960e06..92de79b83ece 100644
--- a/engine/schema/src/main/java/com/cloud/upgrade/DatabaseUpgradeChecker.java
+++ b/engine/schema/src/main/java/com/cloud/upgrade/DatabaseUpgradeChecker.java
@@ -94,6 +94,7 @@
 import com.cloud.upgrade.dao.Upgrade42040to42100;
 import com.cloud.upgrade.dao.Upgrade42100to42200;
 import com.cloud.upgrade.dao.Upgrade42200to42210;
+import com.cloud.upgrade.dao.Upgrade42210to42220;
 import com.cloud.upgrade.dao.Upgrade420to421;
 import com.cloud.upgrade.dao.Upgrade421to430;
 import com.cloud.upgrade.dao.Upgrade430to440;
@@ -246,6 +247,7 @@ public DatabaseUpgradeChecker() {
                 .next("4.20.4.0", new Upgrade42040to42100())
                 .next("4.21.0.0", new Upgrade42100to42200())
                 .next("4.22.0.0", new Upgrade42200to42210())
+                .next("4.22.1.0", new Upgrade42210to42220())
                 .build();
     }
 
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42210to42220.sql b/engine/schema/src/main/resources/META-INF/db/schema-42210to42220.sql
index f6d73def74fd..7fefed18fd7e 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-42210to42220.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42210to42220.sql
@@ -18,3 +18,8 @@
 --;
 -- Schema upgrade from 4.22.1.0 to 4.22.2.0
 --;
+
+-- Widen the unique key on cloud_usage.usage_volume to include vm_id, so the cumulative and
+-- per-VM volume usage records introduced in 4.22.1 can coexist. See #13399.
+CALL `cloud_usage`.`IDEMPOTENT_DROP_INDEX`('id', 'cloud_usage.usage_volume');
+CALL `cloud_usage`.`IDEMPOTENT_ADD_UNIQUE_INDEX`('cloud_usage.usage_volume', 'id', '(volume_id ASC, created ASC, vm_id ASC)');

From 088318594973ce2283a3f2171d6ce207899515fb Mon Sep 17 00:00:00 2001
From: MitchDrage <25337396+MitchDrage@users.noreply.github.com>
Date: Mon, 12 Oct 2026 21:55:00 +1100
Subject: [PATCH 31/41] Nasbackup quiesce fixes (#14305)

* NAS backup: keep the schedule id on a failed backup left in Error state

* NAS backup: add nas.backup.quiesce.agent.timeout for guest agent freeze and thaw

* nasbackup.sh: abort the backup job before cleanup removes its destination

* nasbackup.sh: always thaw after a freeze attempt and log freeze failures

* nasbackup.sh: confirm a failed thaw against guest-fsfreeze-status before continuing

* nasbackup.sh: only end the abort wait on a successful domjobinfo query

* nasbackup.sh: retry failed job queries in the backup polling loop

* NAS backup: count a backup kept in Error state in the account resource count

* NAS backup: alert when cleanup fails after a failed backup
---
 .../cloudstack/backup/TakeBackupCommand.java  |   9 ++
 .../cloudstack/backup/NASBackupProvider.java  |  37 +++++-
 .../backup/NASBackupProviderTest.java         |  79 ++++++++++--
 .../LibvirtTakeBackupCommandWrapper.java      |   8 +-
 .../LibvirtTakeBackupCommandWrapperTest.java  | 102 +++++++++++++++
 scripts/vm/hypervisor/kvm/nasbackup.sh        | 122 ++++++++++++++++--
 .../cloudstack/backup/BackupManagerImpl.java  |  30 +++--
 .../cloudstack/backup/BackupManagerTest.java  |  55 ++++++++
 8 files changed, 406 insertions(+), 36 deletions(-)
 create mode 100644 plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtTakeBackupCommandWrapperTest.java

diff --git a/core/src/main/java/org/apache/cloudstack/backup/TakeBackupCommand.java b/core/src/main/java/org/apache/cloudstack/backup/TakeBackupCommand.java
index 34f8d7b8bcdd..7c2d3fc76fc1 100644
--- a/core/src/main/java/org/apache/cloudstack/backup/TakeBackupCommand.java
+++ b/core/src/main/java/org/apache/cloudstack/backup/TakeBackupCommand.java
@@ -33,6 +33,7 @@ public class TakeBackupCommand extends Command {
     private List<PrimaryDataStoreTO> volumePools;
     private List<String> volumePaths;
     private Boolean quiesce;
+    private Integer quiesceTimeout;
     @LogLevel(LogLevel.Log4jLevel.Off)
     private String mountOptions;
 
@@ -117,6 +118,14 @@ public void setQuiesce(Boolean quiesce) {
         this.quiesce = quiesce;
     }
 
+    public Integer getQuiesceTimeout() {
+        return quiesceTimeout;
+    }
+
+    public void setQuiesceTimeout(Integer quiesceTimeout) {
+        this.quiesceTimeout = quiesceTimeout;
+    }
+
     public String getMode() {
         return mode;
     }
diff --git a/plugins/backup/nas/src/main/java/org/apache/cloudstack/backup/NASBackupProvider.java b/plugins/backup/nas/src/main/java/org/apache/cloudstack/backup/NASBackupProvider.java
index 08c54100bc22..a72920fbae88 100644
--- a/plugins/backup/nas/src/main/java/org/apache/cloudstack/backup/NASBackupProvider.java
+++ b/plugins/backup/nas/src/main/java/org/apache/cloudstack/backup/NASBackupProvider.java
@@ -17,6 +17,7 @@
 package org.apache.cloudstack.backup;
 
 import com.cloud.agent.AgentManager;
+import com.cloud.alert.AlertManager;
 import com.cloud.exception.AgentUnavailableException;
 import com.cloud.exception.OperationTimedoutException;
 import com.cloud.configuration.Resource;
@@ -117,6 +118,15 @@ public class NASBackupProvider extends AdapterBase implements BackupProvider, Co
             ConfigKey.Scope.Zone,
             NASBackupIncrementalEnabled.key());
 
+    ConfigKey<Integer> NASBackupQuiesceAgentTimeout = new ConfigKey<>("Advanced", Integer.class,
+            "nas.backup.quiesce.agent.timeout",
+            "30",
+            "Timeout in seconds for the guest agent filesystem freeze and thaw commands of a quiesced NAS backup. " +
+                    "Set to 0 to use the libvirt default (5 seconds unless changed on the host).",
+            true,
+            ConfigKey.Scope.Zone,
+            BackupFrameworkEnabled.key());
+
     @Inject
     private BackupDao backupDao;
 
@@ -171,6 +181,9 @@ public class NASBackupProvider extends AdapterBase implements BackupProvider, Co
     @Inject
     private BackupDetailsDao backupDetailsDao;
 
+    @Inject
+    private AlertManager alertManager;
+
     private Long getClusterIdFromRootVolume(VirtualMachine vm) {
         VolumeVO rootVolume = volumeDao.getInstanceRootVolume(vm.getId());
         StoragePoolVO rootDiskPool = primaryDataStoreDao.findById(rootVolume.getPoolId());
@@ -578,6 +591,7 @@ public Pair<Boolean, Backup> takeBackup(final VirtualMachine vm, Boolean quiesce
         command.setBackupRepoAddress(backupRepository.getAddress());
         command.setMountOptions(backupRepository.getMountOptions());
         command.setQuiesce(quiesceVM);
+        command.setQuiesceTimeout(NASBackupQuiesceAgentTimeout.valueIn(vm.getDataCenterId()));
         command.setMode(decision.mode);
         command.setBitmapNew(decision.bitmapNew);
         command.setBitmapParent(decision.bitmapParent);
@@ -643,16 +657,30 @@ public Pair<Boolean, Backup> takeBackup(final VirtualMachine vm, Boolean quiesce
             logger.error("Failed to take backup for VM {}: {}", vm.getInstanceName(), answer != null ? answer.getDetails() : "No answer received");
             if (answer != null && answer.getNeedsCleanup()) {
                 logger.error("Backup cleanup failed for VM {}. Leaving the backup in Error state. Backup should be manually deleted to free up the space", vm.getInstanceName());
+                sendBackupCleanupFailedAlert(vm, host, answer.getDetails());
                 backupVO.setStatus(Backup.Status.Error);
                 backupDao.update(backupVO.getId(), backupVO);
-            } else {
-                backupVO.setStatus(Backup.Status.Failed);
-                backupDao.remove(backupVO.getId());
+                // Return the row to the caller to record its schedule - e.g. Scheduled or Manual.
+                return new Pair<>(false, backupVO);
             }
+            backupVO.setStatus(Backup.Status.Failed);
+            backupDao.remove(backupVO.getId());
             return new Pair<>(false, null);
         }
     }
 
+    /**
+     * Alerts when nasbackup.sh could not clean up after a failed backup. The script's output
+     * names the backup repository mount point it left on the host.
+     */
+    private void sendBackupCleanupFailedAlert(VirtualMachine vm, Host host, String details) {
+        String subject = String.format("NAS backup cleanup failed for VM %s on host %s", vm.getInstanceName(), host.getName());
+        String body = String.format("A failed backup of VM %s could not be cleaned up on host %s (%s). " +
+                "The backup repository may still be mounted on that host. Script output: %s",
+                vm.getInstanceName(), host.getName(), host.getPrivateIpAddress(), details);
+        alertManager.sendAlert(AlertManager.AlertType.ALERT_TYPE_BACKUP_STORAGE, vm.getDataCenterId(), host.getPodId(), subject, body);
+    }
+
     private BackupVO createBackupObject(VirtualMachine vm, String backupPath, String type) {
         BackupVO backup = new BackupVO();
         backup.setVmId(vm.getId());
@@ -1254,7 +1282,8 @@ public ConfigKey<?>[] getConfigKeys() {
         return new ConfigKey[]{
                 NASBackupRestoreMountTimeout,
                 NASBackupFullEvery,
-                NASBackupIncrementalEnabled
+                NASBackupIncrementalEnabled,
+                NASBackupQuiesceAgentTimeout
         };
     }
 
diff --git a/plugins/backup/nas/src/test/java/org/apache/cloudstack/backup/NASBackupProviderTest.java b/plugins/backup/nas/src/test/java/org/apache/cloudstack/backup/NASBackupProviderTest.java
index 7c5edba1e2b6..787d3ff94567 100644
--- a/plugins/backup/nas/src/test/java/org/apache/cloudstack/backup/NASBackupProviderTest.java
+++ b/plugins/backup/nas/src/test/java/org/apache/cloudstack/backup/NASBackupProviderTest.java
@@ -36,6 +36,7 @@
 import org.springframework.test.util.ReflectionTestUtils;
 
 import com.cloud.agent.AgentManager;
+import com.cloud.alert.AlertManager;
 import com.cloud.exception.AgentUnavailableException;
 import com.cloud.exception.OperationTimedoutException;
 import com.cloud.configuration.Resource;
@@ -125,6 +126,9 @@ public class NASBackupProviderTest {
     @Mock
     private DataStoreManager dataStoreMgr;
 
+    @Mock
+    private AlertManager alertManager;
+
     @Test
     public void testDeleteBackup() throws OperationTimedoutException, AgentUnavailableException {
         Long hostId = 1L;
@@ -202,16 +206,7 @@ public void testGetBackupStorageStats() {
         Assert.assertEquals(Long.valueOf(3000L), result.second());
     }
 
-    @Test
-    public void takeBackupSuccessfully() throws AgentUnavailableException, OperationTimedoutException {
-        Long vmId = 1L;
-        Long hostId = 2L;
-        Long backupOfferingId = 3L;
-        Long accountId = 4L;
-        Long domainId = 5L;
-        Long zoneId = 6L;
-        Long backupId = 7L;
-
+    private VMInstanceVO mockRunningVmForBackup(Long vmId, Long hostId, Long backupOfferingId, Long accountId, Long domainId, Long zoneId) {
         VMInstanceVO vm = mock(VMInstanceVO.class);
         Mockito.when(vm.getId()).thenReturn(vmId);
         Mockito.when(vm.getHostId()).thenReturn(hostId);
@@ -241,6 +236,16 @@ public void takeBackupSuccessfully() throws AgentUnavailableException, Operation
         Mockito.when(volume2.getState()).thenReturn(Volume.State.Ready);
         Mockito.when(volume2.getSize()).thenReturn(200L);
         Mockito.when(volumeDao.findByInstance(vmId)).thenReturn(List.of(volume1, volume2));
+        return vm;
+    }
+
+    @Test
+    public void takeBackupSuccessfully() throws AgentUnavailableException, OperationTimedoutException {
+        Long backupOfferingId = 3L;
+        Long accountId = 4L;
+        Long domainId = 5L;
+        Long zoneId = 6L;
+        VMInstanceVO vm = mockRunningVmForBackup(1L, 2L, backupOfferingId, accountId, domainId, zoneId);
 
         BackupAnswer answer = mock(BackupAnswer.class);
         Mockito.when(answer.getResult()).thenReturn(true);
@@ -269,6 +274,60 @@ public void takeBackupSuccessfully() throws AgentUnavailableException, Operation
         Mockito.verify(agentManager).send(anyLong(), Mockito.any(TakeBackupCommand.class));
     }
 
+    @Test
+    public void takeBackupFailureNeedingCleanupReturnsErrorBackup() throws AgentUnavailableException, OperationTimedoutException {
+        VMInstanceVO vm = mockRunningVmForBackup(1L, 2L, 3L, 4L, 5L, 6L);
+        HostVO host = hostDao.findById(2L);
+        Mockito.when(host.getName()).thenReturn("kvm01");
+        Mockito.when(host.getPodId()).thenReturn(7L);
+
+        BackupAnswer answer = mock(BackupAnswer.class);
+        Mockito.when(answer.getResult()).thenReturn(false);
+        Mockito.when(answer.getNeedsCleanup()).thenReturn(true);
+        Mockito.when(answer.getDetails()).thenReturn("leaving /tmp/csbackup.abcde/i-2-3-VM mounted at /tmp/csbackup.abcde");
+        ArgumentCaptor<TakeBackupCommand> commandCaptor = ArgumentCaptor.forClass(TakeBackupCommand.class);
+        Mockito.when(agentManager.send(anyLong(), commandCaptor.capture())).thenReturn(answer);
+
+        Mockito.when(backupDao.persist(Mockito.any(BackupVO.class))).thenAnswer(invocation -> invocation.getArgument(0));
+
+        Pair<Boolean, Backup> result = nasBackupProvider.takeBackup(vm, true);
+
+        Assert.assertFalse(result.first());
+        Assert.assertNotNull(result.second());
+        Assert.assertEquals(Backup.Status.Error, result.second().getStatus());
+        Mockito.verify(backupDao, Mockito.never()).remove(Mockito.anyLong());
+
+        TakeBackupCommand command = commandCaptor.getValue();
+        Assert.assertTrue(command.getQuiesce());
+        Assert.assertEquals(Integer.valueOf(30), command.getQuiesceTimeout());
+
+        ArgumentCaptor<String> subjectCaptor = ArgumentCaptor.forClass(String.class);
+        ArgumentCaptor<String> bodyCaptor = ArgumentCaptor.forClass(String.class);
+        Mockito.verify(alertManager).sendAlert(Mockito.eq(AlertManager.AlertType.ALERT_TYPE_BACKUP_STORAGE), Mockito.eq(6L), Mockito.eq(7L),
+                subjectCaptor.capture(), bodyCaptor.capture());
+        Assert.assertTrue(subjectCaptor.getValue().contains("kvm01"));
+        Assert.assertTrue(bodyCaptor.getValue().contains("/tmp/csbackup.abcde"));
+    }
+
+    @Test
+    public void takeBackupFailureWithoutCleanupRemovesBackup() throws AgentUnavailableException, OperationTimedoutException {
+        VMInstanceVO vm = mockRunningVmForBackup(1L, 2L, 3L, 4L, 5L, 6L);
+
+        BackupAnswer answer = mock(BackupAnswer.class);
+        Mockito.when(answer.getResult()).thenReturn(false);
+        Mockito.when(answer.getNeedsCleanup()).thenReturn(false);
+        Mockito.when(agentManager.send(anyLong(), Mockito.any(TakeBackupCommand.class))).thenReturn(answer);
+
+        Mockito.when(backupDao.persist(Mockito.any(BackupVO.class))).thenAnswer(invocation -> invocation.getArgument(0));
+
+        Pair<Boolean, Backup> result = nasBackupProvider.takeBackup(vm, false);
+
+        Assert.assertFalse(result.first());
+        Assert.assertNull(result.second());
+        Mockito.verify(backupDao).remove(Mockito.anyLong());
+        Mockito.verifyNoInteractions(alertManager);
+    }
+
     @Test
     public void testGetVMHypervisorHost() {
         Long hostId = 1L;
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtTakeBackupCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtTakeBackupCommandWrapper.java
index e76c9a2a3871..b7e609587650 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtTakeBackupCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtTakeBackupCommandWrapper.java
@@ -143,6 +143,7 @@ private Pair<Integer, String> runBackupScript(LibvirtComputingResource libvirtCo
             TakeBackupCommand command, String vmName, String backupRepoType, String backupRepoAddress,
             String mountOptions, String backupPath, List<String> diskPaths, String mode,
             String bitmapNew, String bitmapParent, List<String> parentPaths, int timeout) {
+        boolean quiesce = command.getQuiesce() != null && command.getQuiesce();
         List<String> argv = new ArrayList<>(Arrays.asList(
                 libvirtComputingResource.getNasBackupPath(),
                 "-o", "backup",
@@ -151,9 +152,14 @@ private Pair<Integer, String> runBackupScript(LibvirtComputingResource libvirtCo
                 "-s", backupRepoAddress,
                 "-m", Objects.nonNull(mountOptions) ? mountOptions : "",
                 "-p", backupPath,
-                "-q", command.getQuiesce() != null && command.getQuiesce() ? "true" : "false",
+                "-q", quiesce ? "true" : "false",
                 "-d", CollectionUtils.isEmpty(diskPaths) ? "" : String.join(",", diskPaths)
         ));
+        Integer quiesceTimeout = command.getQuiesceTimeout();
+        if (quiesce && quiesceTimeout != null && quiesceTimeout > 0) {
+            argv.add("--quiesce-timeout");
+            argv.add(String.valueOf(quiesceTimeout));
+        }
         if (StringUtils.isNotBlank(mode)) {
             argv.add("-M");
             argv.add(mode);
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtTakeBackupCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtTakeBackupCommandWrapperTest.java
new file mode 100644
index 000000000000..7ef64fd53b50
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtTakeBackupCommandWrapperTest.java
@@ -0,0 +1,102 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import static org.mockito.ArgumentMatchers.anyList;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.Mockito.mockStatic;
+import static org.mockito.Mockito.when;
+
+import java.util.Arrays;
+import java.util.List;
+
+import org.apache.cloudstack.backup.BackupAnswer;
+import org.apache.cloudstack.backup.TakeBackupCommand;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.utils.Pair;
+import com.cloud.utils.script.Script;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtTakeBackupCommandWrapperTest {
+
+    private LibvirtTakeBackupCommandWrapper wrapper;
+    private LibvirtComputingResource libvirtComputingResource;
+    private TakeBackupCommand command;
+
+    @Before
+    public void setUp() {
+        wrapper = new LibvirtTakeBackupCommandWrapper();
+        libvirtComputingResource = Mockito.mock(LibvirtComputingResource.class);
+        when(libvirtComputingResource.getNasBackupPath()).thenReturn("nasbackup.sh");
+        command = new TakeBackupCommand("i-2-3-VM", "i-2-3-VM/2026.10.04.00.00.00");
+        command.setBackupRepoType("nfs");
+        command.setBackupRepoAddress("10.0.0.1:/backup");
+        command.setWait(60);
+    }
+
+    @SuppressWarnings("unchecked")
+    private List<String> runAndCaptureArgv() {
+        try (MockedStatic<Script> scriptMock = mockStatic(Script.class)) {
+            scriptMock.when(() -> Script.executePipedCommands(anyList(), anyLong())).thenReturn(new Pair<>(0, "1024"));
+
+            BackupAnswer answer = (BackupAnswer) wrapper.execute(command, libvirtComputingResource);
+            Assert.assertTrue(answer.getResult());
+
+            ArgumentCaptor<List<String[]>> captor = ArgumentCaptor.forClass(List.class);
+            scriptMock.verify(() -> Script.executePipedCommands(captor.capture(), anyLong()));
+            return Arrays.asList(captor.getValue().get(0));
+        }
+    }
+
+    @Test
+    public void executePassesQuiesceTimeoutWhenQuiescing() {
+        command.setQuiesce(true);
+        command.setQuiesceTimeout(30);
+
+        List<String> argv = runAndCaptureArgv();
+
+        int idx = argv.indexOf("--quiesce-timeout");
+        Assert.assertTrue(idx > 0);
+        Assert.assertEquals("30", argv.get(idx + 1));
+        Assert.assertEquals("true", argv.get(argv.indexOf("-q") + 1));
+    }
+
+    @Test
+    public void executeOmitsQuiesceTimeoutWithoutQuiesce() {
+        command.setQuiesce(false);
+        command.setQuiesceTimeout(30);
+
+        Assert.assertFalse(runAndCaptureArgv().contains("--quiesce-timeout"));
+    }
+
+    @Test
+    public void executeOmitsQuiesceTimeoutWhenNotPositive() {
+        command.setQuiesce(true);
+        command.setQuiesceTimeout(0);
+
+        Assert.assertFalse(runAndCaptureArgv().contains("--quiesce-timeout"));
+    }
+}
diff --git a/scripts/vm/hypervisor/kvm/nasbackup.sh b/scripts/vm/hypervisor/kvm/nasbackup.sh
index ee044459a1b5..04cc7cd86f25 100755
--- a/scripts/vm/hypervisor/kvm/nasbackup.sh
+++ b/scripts/vm/hypervisor/kvm/nasbackup.sh
@@ -32,6 +32,7 @@ MOUNT_OPTS=""
 BACKUP_DIR=""
 DISK_PATHS=""
 QUIESCE=""
+QUIESCE_TIMEOUT=""    # Seconds to wait for the guest agent freeze/thaw; empty => libvirt default
 # Incremental backup parameters (all optional; legacy callers omit them)
 MODE=""               # "full" or "incremental"; empty => legacy full-only behavior (no checkpoint created)
 BITMAP_NEW=""         # Bitmap/checkpoint name to create with this backup (e.g. "backup-1711586400")
@@ -44,6 +45,7 @@ PARENT_PATHS=""       # For incremental: comma-separated list of parent backup f
 logFile="/var/log/cloudstack/agent/agent.log"
 
 EXIT_CLEANUP_FAILED=20
+BACKUP_JOB_ACTIVE=0
 
 log() {
   [[ "$verb" -eq 1 ]] && builtin echo "$@"
@@ -134,6 +136,53 @@ get_linstor_uuid_from_device() {
   return 1
 }
 
+qemu_agent_command() {
+  local timeout_args=()
+  if [[ -n "$QUIESCE_TIMEOUT" ]]; then
+    timeout_args=(--timeout "$QUIESCE_TIMEOUT")
+  fi
+  virsh -c qemu:///system qemu-agent-command "$VM" "${timeout_args[@]}" "$1"
+}
+
+guest_fsfreeze_status() {
+  local response
+  response=$(qemu_agent_command '{"execute":"guest-fsfreeze-status"}' 2>>"$logFile") || return 1
+  grep -oE 'thawed|frozen' <<< "$response" | head -n 1
+}
+
+guest_agent_connected() {
+  local xml
+  xml=$(virsh -c qemu:///system dumpxml "$VM" 2>/dev/null) || return 1
+  grep -q "name='org.qemu.guest_agent.0' state='connected'" <<< "$xml"
+}
+
+# Thaws the guest filesystems. A thaw that times out on the host can still complete in the
+# guest, so each failure is checked against guest-fsfreeze-status before retrying. Succeeds
+# once the guest reports thawed, or when the freeze failed and the guest agent is not
+# connected, which means the freeze never reached the guest.
+thaw_guest() {
+  local freeze_ok=$1
+  local attempt response state
+  for ((attempt = 1; attempt <= 3; attempt++)); do
+    if response=$(qemu_agent_command '{"execute":"guest-fsfreeze-thaw"}' 2>&1); then
+      return 0
+    fi
+    log -e "Thaw attempt $attempt for vm $VM failed: $response"
+    state=$(guest_fsfreeze_status || true)
+    if [[ "$state" == "thawed" ]]; then
+      log -e "Guest filesystem of vm $VM reports thawed after the failed thaw"
+      return 0
+    fi
+    if [[ -z "$state" && $freeze_ok -eq 0 ]] && ! guest_agent_connected; then
+      log -e "Guest agent of vm $VM is not connected, so the failed freeze never reached the guest"
+      return 0
+    fi
+    sleep 5
+  done
+  echo "Failed to thaw the filesystem for vm $VM, guest filesystem state: ${state:-unknown}: $response"
+  return 1
+}
+
 backup_running_vm() {
   mount_operation
   mkdir -p "$dest" || { echo "Failed to create backup directory $dest"; exit 1; }
@@ -257,9 +306,15 @@ print(len(files))
   fi
 
   local thaw=0
+  local freeze_ok=0
   if [[ ${QUIESCE} == "true" ]]; then
-    if virsh -c qemu:///system qemu-agent-command "$VM" '{"execute":"guest-fsfreeze-freeze"}' > /dev/null 2>/dev/null; then
-      thaw=1
+    # Always thaw after a freeze attempt: a freeze that times out on the host can still
+    # complete inside the guest, and nothing else would unfreeze it.
+    thaw=1
+    if freeze_err=$(qemu_agent_command '{"execute":"guest-fsfreeze-freeze"}' 2>&1 > /dev/null); then
+      freeze_ok=1
+    else
+      log -e "Failed to freeze the filesystem for vm $VM, continuing without quiescing: $freeze_err"
     fi
   fi
 
@@ -276,13 +331,13 @@ print(len(files))
       backup_begin=1;
     fi
   fi
+  if [[ $backup_begin -eq 1 ]]; then
+    BACKUP_JOB_ACTIVE=1
+  fi
 
-  if [[ $thaw -eq 1 ]]; then
-    if ! response=$(virsh -c qemu:///system qemu-agent-command "$VM" '{"execute":"guest-fsfreeze-thaw"}' 2>&1); then
-      echo "Failed to thaw the filesystem for vm $VM: $response"
-      cleanup
-      exit 1
-    fi
+  if [[ $thaw -eq 1 ]] && ! thaw_guest "$freeze_ok"; then
+    cleanup
+    exit 1
   fi
 
   if [[ $backup_begin -ne 1 ]]; then
@@ -296,14 +351,30 @@ print(len(files))
   virsh -c qemu:///system domiflist $VM > $dest/domiflist.xml 2>/dev/null
   virsh -c qemu:///system domblklist $VM > $dest/domblklist.xml 2>/dev/null
 
+  local info query_failures=0
   while true; do
-    status=$(virsh -c qemu:///system domjobinfo $VM --completed --keep-completed | awk '/Job type:/ {print $3}')
+    # A failed query says nothing about the job, so retry before giving up on it.
+    if ! info=$(virsh -c qemu:///system domjobinfo $VM --completed --keep-completed 2>&1); then
+      log -e "Backup job query $((query_failures + 1)) for vm $VM failed: $info"
+      if (( ++query_failures >= 12 )); then
+        echo "Unable to query the backup job for vm $VM"
+        cleanup
+        exit 1
+      fi
+      sleep 5
+      continue
+    fi
+    query_failures=0
+    status=$(awk '/Job type:/ {print $3}' <<< "$info")
     case "$status" in
       Completed)
+        BACKUP_JOB_ACTIVE=0
         break ;;
       Failed)
+        BACKUP_JOB_ACTIVE=0
         echo "Virsh backup job failed"
-        cleanup ;;
+        cleanup
+        exit 1 ;;
     esac
     sleep 5
   done
@@ -503,9 +574,34 @@ mount_operation() {
   fi
 }
 
+abort_backup_job() {
+  [[ $BACKUP_JOB_ACTIVE -eq 1 ]] || return 0
+
+  # The push backup job writes into $dest until it ends, so it must be gone before the
+  # destination is removed or unmounted.
+  virsh -c qemu:///system domjobabort "$VM" > /dev/null 2>>"$logFile" || true
+  local i info
+  for ((i = 0; i < 60; i++)); do
+    # Only a successful query reporting no job proves the job has ended.
+    if info=$(virsh -c qemu:///system domjobinfo "$VM" 2>>"$logFile") \
+        && [[ "$(awk '/Job type:/ {print $3}' <<< "$info")" == "None" ]]; then
+      BACKUP_JOB_ACTIVE=0
+      return 0
+    fi
+    sleep 1
+  done
+  return 1
+}
+
 cleanup() {
   local status=0
 
+  if ! abort_backup_job; then
+    echo "Backup job for vm $VM is still running after abort, leaving $dest mounted at $mount_point"
+    echo "Backup cleanup failed"
+    exit $EXIT_CLEANUP_FAILED
+  fi
+
   rm -rf "$dest" || { echo "Failed to delete $dest"; status=1; }
   umount "$mount_point" || { echo "Failed to unmount $mount_point"; status=1; }
   rmdir "$mount_point" || { echo "Failed to remove mount point $mount_point"; status=1; }
@@ -519,6 +615,7 @@ cleanup() {
 function usage {
   echo ""
   echo "Usage: $0 -o <operation> -v|--vm <domain name> -t <storage type> -s <storage address> -m <mount options> -p <backup path> -d <disks path> -q|--quiesce <true|false>"
+  echo "         [--quiesce-timeout <seconds>]"
   echo "         [-M|--mode <full|incremental>] [--bitmap-new <name>] [--bitmap-parent <name>] [--parent-paths <p1,p2,...>]"
   echo ""
   echo "Incremental backup options (running VMs only; requires QEMU >= 4.2 and libvirt >= 7.2):"
@@ -569,6 +666,11 @@ while [[ $# -gt 0 ]]; do
       shift
       shift
       ;;
+    --quiesce-timeout)
+      QUIESCE_TIMEOUT="$2"
+      shift
+      shift
+      ;;
     -d|--diskpaths)
       DISK_PATHS="$2"
       shift
diff --git a/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java b/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
index 867f4111b66a..1f42bc413eb7 100644
--- a/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
@@ -826,20 +826,18 @@ private void createCheckedBackup(CreateBackupCmd cmd, Account owner, boolean isS
                     true, 0);
 
             Pair<Boolean, Backup> result = backupProvider.takeBackup(vm, cmd.getQuiesceVM());
-            if (!result.first()) {
-                throw new CloudRuntimeException("Failed to create VM backup");
-            }
             Backup backup = result.second();
             if (backup != null) {
-                BackupVO vmBackup = backupDao.findById(result.second().getId());
-                vmBackup.setBackupScheduleId(backupScheduleId);
-                if (cmd.getName() != null) {
-                    vmBackup.setName(cmd.getName());
-                }
-                vmBackup.setDescription(cmd.getDescription());
-                backupDao.update(vmBackup.getId(), vmBackup);
+                updateBackupFromCmd(backup.getId(), cmd, backupScheduleId);
+                // A failed backup returned here is kept in Error state and still holds space on
+                // the repository. The account's backup resource count recalculation includes such
+                // rows and deleting one decrements it, so add it to that count here as well.
                 resourceLimitMgr.incrementResourceCount(vm.getAccountId(), Resource.ResourceType.backup);
-                resourceLimitMgr.incrementResourceCount(vm.getAccountId(), Resource.ResourceType.backup_storage, backup.getSize());
+                resourceLimitMgr.incrementResourceCount(vm.getAccountId(), Resource.ResourceType.backup_storage,
+                        backup.getSize() != null ? backup.getSize() : 0L);
+            }
+            if (!result.first()) {
+                throw new CloudRuntimeException("Failed to create VM backup");
             }
         } catch (ResourceAllocationException e) {
             if (isScheduledBackup && (Resource.ResourceType.backup.equals(e.getResourceType()) ||
@@ -850,6 +848,16 @@ private void createCheckedBackup(CreateBackupCmd cmd, Account owner, boolean isS
         }
     }
 
+    private void updateBackupFromCmd(long backupId, CreateBackupCmd cmd, Long backupScheduleId) {
+        BackupVO vmBackup = backupDao.findById(backupId);
+        vmBackup.setBackupScheduleId(backupScheduleId);
+        if (cmd.getName() != null) {
+            vmBackup.setName(cmd.getName());
+        }
+        vmBackup.setDescription(cmd.getDescription());
+        backupDao.update(vmBackup.getId(), vmBackup);
+    }
+
     /**
      * Sends an alert when the backup limit has been exceeded for a given account.
      *
diff --git a/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java b/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java
index db75602b600d..67e263a32676 100644
--- a/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java
+++ b/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java
@@ -733,6 +733,61 @@ public void createBackupTestCreateScheduledBackup() throws ResourceAllocationExc
         }
     }
 
+    @Test
+    public void createBackupTestFailedScheduledBackupKeepsSchedule() throws ResourceAllocationException {
+        Long vmId = 1L;
+        Long zoneId = 2L;
+        Long scheduleId = 3L;
+        Long backupOfferingId = 4L;
+        Long accountId = 5L;
+        Long backupId = 6L;
+        long domainId = 101L;
+
+        when(vmInstanceDao.findById(vmId)).thenReturn(vmInstanceVOMock);
+        when(vmInstanceVOMock.getDataCenterId()).thenReturn(zoneId);
+        when(vmInstanceVOMock.getBackupOfferingId()).thenReturn(backupOfferingId);
+        when(vmInstanceVOMock.getAccountId()).thenReturn(accountId);
+
+        overrideBackupFrameworkConfigValue();
+        when(backupOfferingDao.findById(backupOfferingId)).thenReturn(backupOfferingVOMock);
+        when(backupOfferingVOMock.isUserDrivenBackupAllowed()).thenReturn(true);
+        when(backupOfferingVOMock.getProvider()).thenReturn("testbackupprovider");
+
+        Mockito.doReturn(scheduleId).when(backupManager).getBackupScheduleId(asyncJobVOMock);
+
+        when(accountManager.getAccount(accountId)).thenReturn(accountVOMock);
+        when(accountVOMock.getDomainId()).thenReturn(domainId);
+
+        when(volumeDao.findByInstance(vmId)).thenReturn(List.of());
+
+        BackupProvider backupProvider = mock(BackupProvider.class);
+        Backup backup = mock(Backup.class);
+        when(backup.getId()).thenReturn(backupId);
+        when(backupProvider.getName()).thenReturn("testbackupprovider");
+        when(backupProvider.takeBackup(vmInstanceVOMock, null)).thenReturn(new Pair<>(false, backup));
+        Map<String, BackupProvider> backupProvidersMap = new HashMap<>();
+        backupProvidersMap.put(backupProvider.getName().toLowerCase(), backupProvider);
+        ReflectionTestUtils.setField(backupManager, "backupProvidersMap", backupProvidersMap);
+
+        BackupVO backupVO = mock(BackupVO.class);
+        when(backupVO.getId()).thenReturn(backupId);
+        when(backupDao.findById(backupId)).thenReturn(backupVO);
+
+        CreateBackupCmd cmd = Mockito.mock(CreateBackupCmd.class);
+        when(cmd.getVmId()).thenReturn(vmId);
+        when(cmd.getQuiesceVM()).thenReturn(null);
+
+        try (MockedStatic<ActionEventUtils> ignored = Mockito.mockStatic(ActionEventUtils.class)) {
+            Assert.assertThrows(CloudRuntimeException.class, () -> backupManager.createBackup(cmd, asyncJobVOMock));
+
+            Mockito.verify(backupVO, times(1)).setBackupScheduleId(scheduleId);
+            Mockito.verify(backupDao, times(1)).update(backupId, backupVO);
+            Mockito.verify(resourceLimitMgr, times(1)).incrementResourceCount(accountId, Resource.ResourceType.backup);
+            Mockito.verify(resourceLimitMgr, times(1)).incrementResourceCount(accountId, Resource.ResourceType.backup_storage, 0L);
+            Mockito.verify(backupManager, Mockito.never()).deleteOldestBackupFromScheduleIfRequired(vmId, scheduleId);
+        }
+    }
+
     @Test(expected = ResourceAllocationException.class)
     public void createBackupTestResourceLimitReached() throws ResourceAllocationException {
         Long vmId = 1L;

From dfff32edecfad2df9de8f3c9c606d436253c4128 Mon Sep 17 00:00:00 2001
From: Pearl Dsilva <pearl1594@gmail.com>
Date: Mon, 12 Oct 2026 12:48:56 -0400
Subject: [PATCH 32/41] Netris: Improvements and fixes to the Netris plugin
 (#13591)

* Netris CloudStack Integration Enhancements

* Netris - Support NAT, PF for Secondary IP

* Allow PF rules to be correctly created on secondary IP of a VM on netris

* unique static nat names on netris by adding public IP - handle backward compatibility

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

* Netris - Support for L2 networks

* Add support for L2 networks in Netris

* remove the need to add connectivity to identify netris provider, remove changes to ui and create net offering

* create vpc network and use it for l2 networks

* dont fail if deletion on netris doesnt succeed

* remove connectivity capability

* update vpc name when l2 name is updated

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

* Netris - CKS support

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

* Netris - Enable Global Routing Flag for NATTED Dual-Stack VPCs

* Set globalRouting = true, when network offering is NATTED, dual-stack

* update global routing based on routing mode and ip protocol type

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>
Co-authored-by: nvazquez <nicovazquez90@gmail.com>

* Netris - Fix allocate vnets with the correct account ID so that release succeeds on network deletion

* Fix allocate vnets with the correct account ID so that release succeeds on network deletion

* add fix for vpc tiers as well

* move entire vnet cleanup logic to trash from shutdown, so that it works for all network types for netris

* cleanup vnets when reservation id is null

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

* Netris - Add support to include VPN service for NATTED Netris offerings

* Add support to include VPN service for NATTED Netris offerings

* missing changes of global routing

* Remove extra space

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>
Co-authored-by: nvazquez <nicovazquez90@gmail.com>

* Netris - Support Redundant Virtual Routers for Netris VPC networks

* Add support for redundant routers for Netris VPC networks

* address comment

* default null network mode to natted for netris

* preventing vpc and ipam creation if already exists

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

* Netris - Enable autoscaling groups for Netris network offerings

* Enable autoscaling groups for Netris network offerings

* Fix UI loading for services when network mode changes for external providers and show vm autoscaling always set to true / non-editable for netris when LB is selected i.e, natted mode

* Revert removed comment

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>
Co-authored-by: nvazquez <nicovazquez90@gmail.com>

* merge conflict

* systemvm: fix VPC VPN issue when network id is bigger than 1000 on Netris

* show networks for vnf nic mappings

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>
Co-authored-by: nvazquez <nicovazquez90@gmail.com>
Co-authored-by: Wei Zhou <weizhou@apache.org>

* Add a check to prevent re-adding existing ACLs

* Netris - Support NAT, PF for Secondary IP

* Allow PF rules to be correctly created on secondary IP of a VM on netris

* unique static nat names on netris by adding public IP - handle backward compatibility

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

* Netris - Support for L2 networks

* Add support for L2 networks in Netris

* remove the need to add connectivity to identify netris provider, remove changes to ui and create net offering

* create vpc network and use it for l2 networks

* dont fail if deletion on netris doesnt succeed

* remove connectivity capability

* update vpc name when l2 name is updated

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

* Netris - CKS support

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

* Netris - Enable Global Routing Flag for NATTED Dual-Stack VPCs

* Set globalRouting = true, when network offering is NATTED, dual-stack

* update global routing based on routing mode and ip protocol type

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>
Co-authored-by: nvazquez <nicovazquez90@gmail.com>

* Netris - Fix allocate vnets with the correct account ID so that release succeeds on network deletion

* Fix allocate vnets with the correct account ID so that release succeeds on network deletion

* add fix for vpc tiers as well

* move entire vnet cleanup logic to trash from shutdown, so that it works for all network types for netris

* cleanup vnets when reservation id is null

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

* Netris - Add support to include VPN service for NATTED Netris offerings

* Add support to include VPN service for NATTED Netris offerings

* missing changes of global routing

* Remove extra space

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>
Co-authored-by: nvazquez <nicovazquez90@gmail.com>

* Netris - Support Redundant Virtual Routers for Netris VPC networks

* Add support for redundant routers for Netris VPC networks

* address comment

* default null network mode to natted for netris

* preventing vpc and ipam creation if already exists

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

* Netris - Enable autoscaling groups for Netris network offerings

* Enable autoscaling groups for Netris network offerings

* Fix UI loading for services when network mode changes for external providers and show vm autoscaling always set to true / non-editable for netris when LB is selected i.e, natted mode

* Revert removed comment

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>
Co-authored-by: nvazquez <nicovazquez90@gmail.com>

* merge conflict

* systemvm: fix VPC VPN issue when network id is bigger than 1000 on Netris

* show networks for vnf nic mappings

* Add a check to prevent re-adding existing ACLs

* Add a check to prevent re-adding existing ACLs

* change message compare statement

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>
Co-authored-by: nvazquez <nicovazquez90@gmail.com>
Co-authored-by: Wei Zhou <weizhou@apache.org>

* Add check for vnet name length and cleanup vpc and vnet resources on failure of creation of allocation

* Netris - Support NAT, PF for Secondary IP

* Allow PF rules to be correctly created on secondary IP of a VM on netris

* unique static nat names on netris by adding public IP - handle backward compatibility

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

* Netris - Support for L2 networks

* Add support for L2 networks in Netris

* remove the need to add connectivity to identify netris provider, remove changes to ui and create net offering

* create vpc network and use it for l2 networks

* dont fail if deletion on netris doesnt succeed

* remove connectivity capability

* update vpc name when l2 name is updated

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

* Netris - CKS support

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

* Netris - Enable Global Routing Flag for NATTED Dual-Stack VPCs

* Set globalRouting = true, when network offering is NATTED, dual-stack

* update global routing based on routing mode and ip protocol type

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>
Co-authored-by: nvazquez <nicovazquez90@gmail.com>

* Netris - Fix allocate vnets with the correct account ID so that release succeeds on network deletion

* Fix allocate vnets with the correct account ID so that release succeeds on network deletion

* add fix for vpc tiers as well

* move entire vnet cleanup logic to trash from shutdown, so that it works for all network types for netris

* cleanup vnets when reservation id is null

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

* Netris - Add support to include VPN service for NATTED Netris offerings

* Add support to include VPN service for NATTED Netris offerings

* missing changes of global routing

* Remove extra space

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>
Co-authored-by: nvazquez <nicovazquez90@gmail.com>

* Netris - Support Redundant Virtual Routers for Netris VPC networks

* Add support for redundant routers for Netris VPC networks

* address comment

* default null network mode to natted for netris

* preventing vpc and ipam creation if already exists

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

* Netris - Enable autoscaling groups for Netris network offerings

* Enable autoscaling groups for Netris network offerings

* Fix UI loading for services when network mode changes for external providers and show vm autoscaling always set to true / non-editable for netris when LB is selected i.e, natted mode

* Revert removed comment

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>
Co-authored-by: nvazquez <nicovazquez90@gmail.com>

* merge conflict

* systemvm: fix VPC VPN issue when network id is bigger than 1000 on Netris

* show networks for vnf nic mappings

* Add a check to prevent re-adding existing ACLs

* Add a check to prevent re-adding existing ACLs

* change message compare statement

* Add check for vnet name length and cleanup vpc and vnet resources on failure of creation of allocation

* add name length validation to update path

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>
Co-authored-by: nvazquez <nicovazquez90@gmail.com>
Co-authored-by: Wei Zhou <weizhou@apache.org>

* Add support to the VPC response to display if redundant routers are supported

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

* Hide VPN sections and prevent enabling it when service isn't enabled in the vpc offering

* Hide VPN sections and prevent enabling it when service isn't enabled in the vpc offering

* update

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

* Fix issue with adding external node to a CKS cluster with Netris offering

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

* Update upgrade path to reclaim vnets of deleted netris networks, improve log and hide add upstream route for Netris routed networks

* Update upgrade path to reclaim vnets of deleted netris networks, improve log and hide add upstream route for Netris routed networks

* Apply suggestions from code review

* hide upstream route banner for netris networks altogether

* fix migration of netris VRs and fix reclaim vnet query

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>
Co-authored-by: Nicolas Vazquez <nicovazquez90@gmail.com>

* Allocate IP from Netris (Provider) range when IP is not specified during associate

* Allocate IP from Netris (Provider) range when IP is not specified during associate

* update javadoc and method name

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

* Fix VRRP gateway IP conflict on redundant VPC routers with external network providers (Netris/NSX)

Co-authored-by: Pearl Dsilva <pearl1594@gmail.com>

* VPN: Reconfigure static nat and static route on fail over to backup VR - for redundant VPC VRs

* VPN: Reconfigure static nat and static route on fail over to backup VR - for redundant VPC VRs

* address comment

* add stacktrace to the log

---------

* Fix issue with deletion of vpn connection for DualStack redundant VPCs

* fix precommit ci issue

* Add Netris to the range limit check (#129)

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

* Netris: address review comments on static NAT, L2 and offering form

- Match the legacy static NAT rule only when it was created for the
  requested public IP, on both create and delete
- Roll back the dedicated L2 VPC if vNet creation fails
- Hide the L2 guest type for Netris in the add offering form
- Add VPN to the external provider service map for Netris only
- Fix the L2 offering services javadoc

* Update Netris SDK version to 1.0.1

* Move to the correct schema file

* systemvm: bind dnsmasq and password server to router IP when external provider owns the gateway

---------

Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>
Co-authored-by: nvazquez <nicovazquez90@gmail.com>
Co-authored-by: Wei Zhou <weizhou@apache.org>
---
 .../cloud/network/netris/NetrisService.java   |  30 +-
 .../apache/cloudstack/api/ApiConstants.java   |   1 +
 .../network/CreateNetworkOfferingCmd.java     |   8 +
 .../admin/vpc/CreateVPCOfferingCmd.java       |  28 +-
 .../api/command/utils/OfferingUtils.java      |   8 +-
 .../api/response/VpcOfferingResponse.java     |   8 +
 .../orchestration/NetworkOrchestrator.java    |  11 +-
 .../main/java/com/cloud/vm/dao/NicDao.java    |   2 +-
 .../java/com/cloud/vm/dao/NicDaoImpl.java     |   3 +-
 .../META-INF/db/schema-42210to42220.sql       |   8 +
 .../cluster/KubernetesClusterManagerImpl.java |  49 +-
 .../KubernetesClusterActionWorker.java        | 101 ++++-
 .../KubernetesClusterDestroyWorker.java       |  43 +-
 ...esClusterResourceModifierActionWorker.java |  23 +
 .../KubernetesClusterScaleWorker.java         |  26 +-
 .../KubernetesClusterStartWorker.java         |  61 ++-
 plugins/network-elements/netris/pom.xml       |   2 +-
 .../agent/api/CreateNetrisVnetCommand.java    |  22 +-
 .../cloudstack/agent/api/NetrisCommand.java   |   9 +
 .../resource/NetrisResourceObjectUtils.java   |  19 +-
 .../service/NetrisApiClientImpl.java          | 426 ++++++++++++++----
 .../cloudstack/service/NetrisElement.java     |  16 +-
 .../service/NetrisGuestNetworkGuru.java       | 146 ++++--
 .../service/NetrisPublicNetworkGuru.java      |   9 +-
 .../cloudstack/service/NetrisServiceImpl.java |  26 +-
 .../api/CreateNetrisVnetCommandTest.java      |  11 +-
 .../NetrisResourceObjectUtilsTest.java        |   6 +-
 .../cloudstack/service/NetrisElementTest.java |   2 +-
 .../service/NetrisGuestNetworkGuruTest.java   |  42 +-
 .../api/query/dao/VpcOfferingJoinDaoImpl.java |   1 +
 .../cloud/network/IpAddressManagerImpl.java   |  35 +-
 .../com/cloud/network/NetworkModelImpl.java   |   6 +-
 .../cloud/network/guru/GuestNetworkGuru.java  |  16 +-
 .../VirtualNetworkApplianceManagerImpl.java   |   9 +
 .../com/cloud/network/vpc/VpcManagerImpl.java |  47 +-
 .../vpn/RemoteAccessVpnManagerImpl.java       |   6 +
 .../network/vpn/Site2SiteVpnManagerImpl.java  |   3 +
 .../service/NetrisServiceMockTest.java        |   8 +-
 systemvm/debian/opt/cloud/bin/configure.py    |   5 +-
 systemvm/debian/opt/cloud/bin/cs/CsAddress.py |  35 +-
 systemvm/debian/opt/cloud/bin/cs/CsDhcp.py    |   2 +-
 .../debian/opt/cloud/bin/cs/CsGuestNetwork.py |   3 +
 ui/src/components/view/DetailsTab.vue         |  13 +
 ui/src/config/section/network.js              |   1 +
 ui/src/config/section/offering.js             |   2 +-
 .../infra/zone/AdvancedGuestTrafficForm.vue   |   4 +
 ui/src/views/network/VpcTab.vue               |   4 +-
 ui/src/views/network/VpnDetails.vue           |  28 +-
 ui/src/views/offering/AddNetworkOffering.vue  | 185 ++++----
 ui/src/views/offering/AddVpcOffering.vue      |  26 +-
 50 files changed, 1236 insertions(+), 349 deletions(-)

diff --git a/api/src/main/java/com/cloud/network/netris/NetrisService.java b/api/src/main/java/com/cloud/network/netris/NetrisService.java
index 110e9f07105a..1e7c7d66399a 100644
--- a/api/src/main/java/com/cloud/network/netris/NetrisService.java
+++ b/api/src/main/java/com/cloud/network/netris/NetrisService.java
@@ -21,6 +21,8 @@
 import com.cloud.network.SDNProviderNetworkRule;
 import com.cloud.network.vpc.StaticRoute;
 import com.cloud.network.vpc.Vpc;
+import com.cloud.offering.NetworkOffering;
+import com.cloud.utils.net.NetUtils;
 
 import java.util.List;
 
@@ -81,18 +83,20 @@ public interface NetrisService {
     /**
      * Creates a virtual network (vNet) resource.
      *
-     * @param zoneId           the ID of the zone
-     * @param accountId        the ID of the account
-     * @param domainId         the ID of the domain
-     * @param vpcName          the name of the VPC
-     * @param vpcId            the ID of the VPC
-     * @param networkName      the name of the network
-     * @param networkId        the ID of the network
-     * @param cidr             the CIDR of the network
-     * @param globalRouting    true if global routing is enabled
+     * @param zoneId            the ID of the zone
+     * @param accountId         the ID of the account
+     * @param domainId          the ID of the domain
+     * @param vpcName           the name of the VPC
+     * @param vpcId             the ID of the VPC
+     * @param networkName       the name of the network
+     * @param networkId         the ID of the network
+     * @param cidr              the CIDR of the network
+     * @param networkMode       the network mode
+     * @param internetProtocol  the internet protocol
+     * @param isL2              true if it is an L2 network
      * @return true if the operation is successful, false otherwise
      */
-    boolean createVnetResource(Long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String cidr, Boolean globalRouting);
+    boolean createVnetResource(Long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String cidr, NetworkOffering.NetworkMode networkMode, NetUtils.InternetProtocol internetProtocol, boolean isL2);
 
     /**
      * Updates an existing vNet resource.
@@ -105,9 +109,10 @@ public interface NetrisService {
      * @param networkName     the new name of the network
      * @param networkId       the ID of the network
      * @param prevNetworkName the previous name of the network
+     * @param isL2            true if it is an L2 network
      * @return true if the operation is successful, false otherwise
      */
-    boolean updateVnetResource(Long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String prevNetworkName);
+    boolean updateVnetResource(Long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String prevNetworkName, boolean isL2);
 
     /**
      * Deletes an existing vNet resource.
@@ -120,9 +125,10 @@ public interface NetrisService {
      * @param networkName  the name of the network
      * @param networkId    the ID of the network
      * @param cidr         the CIDR of the network
+     * @param isL2         true if it is an L2 network
      * @return true if the operation is successful, false otherwise
      */
-    boolean deleteVnetResource(long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String cidr);
+    boolean deleteVnetResource(long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String cidr, boolean isL2);
 
     /**
      * Creates a source NAT rule for a VPC or network.
diff --git a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
index 91beefde509b..c4de8bfcba22 100644
--- a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
+++ b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
@@ -1289,6 +1289,7 @@ public class ApiConstants {
     public static final String HAS_RULES = "hasrules";
     public static final String NSX_DETAIL_KEY = "forNsx";
     public static final String NETRIS_DETAIL_KEY = "forNetris";
+    public static final String NETRIS_NAT_PUBLIC_IP_ID = "netrisnatpublicipid";
     public static final String NETRIS_TAG = "netristag";
     public static final String NETRIS_VXLAN_ID = "netrisvxlanid";
     public static final String NETRIS_URL = "netrisurl";
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/network/CreateNetworkOfferingCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/network/CreateNetworkOfferingCmd.java
index a0559f57dab0..da71b6596c09 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/network/CreateNetworkOfferingCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/network/CreateNetworkOfferingCmd.java
@@ -60,6 +60,7 @@
 import static com.cloud.network.Network.Service.NetworkACL;
 import static com.cloud.network.Network.Service.UserData;
 import static com.cloud.network.Network.Service.Firewall;
+import static com.cloud.network.Network.Service.Vpn;
 
 import static org.apache.cloudstack.api.command.utils.OfferingUtils.isNetrisNatted;
 import static org.apache.cloudstack.api.command.utils.OfferingUtils.isNetrisRouted;
@@ -309,6 +310,10 @@ public List<String> getSupportedServices() {
             } else {
                 services.add(Firewall.getName());
             }
+
+            if (isNetrisNatted(getProvider(), getNetworkMode())) {
+                services.add(Vpn.getName());
+            }
             return services;
         }
     }
@@ -418,6 +423,9 @@ else if (NetworkOffering.NetworkMode.NATTED.name().equalsIgnoreCase(getNetworkMo
                 serviceProviderMap.remove(Lb.getName());
             }
         }
+        if (isNetrisNatted(getProvider(), getNetworkMode())) {
+            serviceProviderMap.put(Vpn.getName(), List.of(routerProvider));
+        }
     }
 
     public Map<Capability, String> getServiceCapabilities(Service service) {
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/vpc/CreateVPCOfferingCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/vpc/CreateVPCOfferingCmd.java
index 608794842ed4..0897a2b1b428 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/vpc/CreateVPCOfferingCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/vpc/CreateVPCOfferingCmd.java
@@ -24,6 +24,7 @@
 import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.Set;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
@@ -61,7 +62,9 @@
 import static com.cloud.network.Network.Service.NetworkACL;
 import static com.cloud.network.Network.Service.UserData;
 import static com.cloud.network.Network.Service.Gateway;
+import static com.cloud.network.Network.Service.Vpn;
 
+import static org.apache.cloudstack.api.command.utils.OfferingUtils.isNetris;
 import static org.apache.cloudstack.api.command.utils.OfferingUtils.isNetrisNatted;
 import static org.apache.cloudstack.api.command.utils.OfferingUtils.isNetrisRouted;
 import static org.apache.cloudstack.api.command.utils.OfferingUtils.isNsxWithoutLb;
@@ -189,7 +192,7 @@ public List<String> getSupportedServices() {
                     NetworkACL.getName(),
                     UserData.getName()
                     ));
-            if (NetworkOffering.NetworkMode.NATTED.name().equalsIgnoreCase(getNetworkMode())) {
+            if (isNetrisNatted(getProvider(), getNetworkMode())) {
                 supportedServices.addAll(Arrays.asList(
                         StaticNat.getName(),
                         SourceNat.getName(),
@@ -198,9 +201,13 @@ public List<String> getSupportedServices() {
             if (NetworkOffering.NetworkMode.ROUTED.name().equalsIgnoreCase(getNetworkMode())) {
                 supportedServices.add(Gateway.getName());
             }
+
             if (getNsxSupportsLbService() || isNetrisNatted(getProvider(), getNetworkMode())) {
                 supportedServices.add(Lb.getName());
             }
+            if (isNetrisNatted(getProvider(), getNetworkMode())) {
+                supportedServices.add(Vpn.getName());
+            }
         }
         return supportedServices;
     }
@@ -210,7 +217,7 @@ public String getProvider() {
     }
 
     public String getNetworkMode() {
-        return networkMode;
+        return isNetris(getProvider()) && Objects.isNull(networkMode) ? NetworkOffering.NetworkMode.NATTED.name() : networkMode;
     }
 
     public boolean getNsxSupportsLbService() {
@@ -248,7 +255,7 @@ public Map<String, List<String>> getServiceProviders() {
 
     private void getServiceProviderMapForExternalProvider(Map<String, List<String>> serviceProviderMap, String provider) {
         List<String> unsupportedServices = new ArrayList<>(List.of("Vpn", "BaremetalPxeService", "SecurityGroup", "Connectivity", "Firewall"));
-        if (NetworkOffering.NetworkMode.NATTED.name().equalsIgnoreCase(getNetworkMode())) {
+        if (isNetrisNatted(getProvider(), getNetworkMode())) {
             unsupportedServices.add("Gateway");
         }
         List<String> routerSupported = List.of("Dhcp", "Dns", "UserData");
@@ -258,7 +265,7 @@ private void getServiceProviderMapForExternalProvider(Map<String, List<String>>
                 continue;
             if (routerSupported.contains(service))
                 serviceProviderMap.put(service, List.of(VirtualRouterProvider.Type.VPCVirtualRouter.name()));
-            else if (NetworkOffering.NetworkMode.NATTED.name().equalsIgnoreCase(getNetworkMode()) ||
+            else if (isNetrisNatted(getProvider(), getNetworkMode()) ||
                     Stream.of(NetworkACL.getName(), Gateway.getName()).anyMatch(s -> s.equalsIgnoreCase(service))) {
                 serviceProviderMap.put(service, List.of(provider));
             }
@@ -268,7 +275,20 @@ else if (NetworkOffering.NetworkMode.NATTED.name().equalsIgnoreCase(getNetworkMo
         }
     }
 
+    @SuppressWarnings("unchecked")
     public Map<String, List<String>> getServiceCapabilityList() {
+        // For Netris NATTED, Gateway service is excluded so the redundant-router capability
+        // must reference SourceNat (not Gateway).
+        if (serviceCapabilityList != null
+                && isNetrisNatted(getProvider(), getNetworkMode())) {
+            for (Object capEntry : serviceCapabilityList.values()) {
+                Map<String, String> cap = (Map<String, String>) capEntry;
+                if (Network.Capability.RedundantRouter.getName().equalsIgnoreCase(cap.get("capabilitytype"))
+                        && Gateway.getName().equalsIgnoreCase(cap.get("service"))) {
+                    cap.put("service", SourceNat.getName());
+                }
+            }
+        }
         return serviceCapabilityList;
     }
 
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/utils/OfferingUtils.java b/api/src/main/java/org/apache/cloudstack/api/command/utils/OfferingUtils.java
index 433a37c07cde..3885c30f0af4 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/utils/OfferingUtils.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/utils/OfferingUtils.java
@@ -23,8 +23,12 @@ public class OfferingUtils {
     private OfferingUtils() {
     }
 
+    public static boolean isNetris(String provider) {
+        return "Netris".equalsIgnoreCase(provider);
+    }
+
     public static boolean isNetrisNatted(String provider, String networkMode) {
-        return "Netris".equalsIgnoreCase(provider) &&
+        return isNetris(provider) &&
                NetworkOffering.NetworkMode.NATTED.name().equalsIgnoreCase(networkMode);
     }
 
@@ -33,6 +37,6 @@ public static boolean isNsxWithoutLb(String provider, boolean nsxSupportsLbServi
     }
 
     public static boolean isNetrisRouted(String provider, String networkMode) {
-        return "Netris".equalsIgnoreCase(provider) && NetworkOffering.NetworkMode.ROUTED.name().equalsIgnoreCase(networkMode);
+        return isNetris(provider) && NetworkOffering.NetworkMode.ROUTED.name().equalsIgnoreCase(networkMode);
     }
 }
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/VpcOfferingResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/VpcOfferingResponse.java
index a0516e660e48..6c26a45b4826 100644
--- a/api/src/main/java/org/apache/cloudstack/api/response/VpcOfferingResponse.java
+++ b/api/src/main/java/org/apache/cloudstack/api/response/VpcOfferingResponse.java
@@ -62,6 +62,10 @@ public class VpcOfferingResponse extends BaseResponse {
     @Param(description = "Indicates if the VPC offering supports distributed router for one-hop forwarding", since = "4.4")
     private Boolean supportsDistributedRouter;
 
+    @SerializedName(ApiConstants.REDUNDANT_ROUTER)
+    @Param(description = "Indicates if the VPC offering supports redundant routers")
+    private Boolean redundantRouter;
+
     @SerializedName((ApiConstants.SUPPORTS_REGION_LEVEL_VPC))
     @Param(description = "Indicated if the offering can support region level VPC", since = "4.4")
     private Boolean supportsRegionLevelVpc;
@@ -201,4 +205,8 @@ public String getRoutingMode() {
     public void setRoutingMode(String routingMode) {
         this.routingMode = routingMode;
     }
+
+    public void setRedundantRouter(Boolean redundantRouter) {
+        this.redundantRouter = redundantRouter;
+    }
 }
diff --git a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java
index c6968cddd2f5..20b9bf125a4d 100644
--- a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java
+++ b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java
@@ -2302,6 +2302,11 @@ public void prepareNicForMigration(final VirtualMachineProfile vm, final DeployD
         }
     }
 
+    private boolean isReservedForExternalProvider(Long vlanId) {
+        VlanDetailsVO vlanDetail = vlanDetailsDao.findDetail(vlanId, ApiConstants.NETRIS_DETAIL_KEY);
+        return vlanDetail != null && BooleanUtils.toBoolean(vlanDetail.getValue());
+    }
+
     /*
     Prepare All Nics for migration including the nics dynamically created and not stored in DB
     This is a temporary workaround work KVM migration
@@ -2350,6 +2355,10 @@ public void prepareAllNicsForMigration(final VirtualMachineProfile vm, final Dep
             final List<IPAddressVO> publicIps = _ipAddressDao.listByAssociatedNetwork(guestNetworkId, null);
             for (final IPAddressVO userIp : publicIps) {
                 final PublicIp publicIp = PublicIp.createFromAddrAndVlan(userIp, _vlanDao.findById(userIp.getVlanId()));
+                if (isReservedForExternalProvider(publicIp.getVlanId())) {
+                    logger.debug("Skipping public IP {} for migration NIC profile: managed by external network provider", publicIp.getAddress());
+                    continue;
+                }
                 final URI broadcastUri = BroadcastDomainType.Vlan.toUri(publicIp.getVlanTag());
                 final long ntwkId = publicIp.getNetworkId();
                 final Nic nic = _nicDao.findByNetworkIdInstanceIdAndBroadcastUri(ntwkId, vm.getId(),
@@ -3175,7 +3184,7 @@ private boolean hasGuestBypassVlanOverlapCheck(final boolean bypassVlanOverlapCh
     /**
      * Checks for L2 network offering services. Only 2 cases allowed:
      * - No services
-     * - User Data service only, provided by ConfigDrive
+     * - UserData service only, provided by ConfigDrive
      *
      * @param ntwkOff network offering
      */
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/NicDao.java b/engine/schema/src/main/java/com/cloud/vm/dao/NicDao.java
index 2718127d648a..b140f6b8d02b 100644
--- a/engine/schema/src/main/java/com/cloud/vm/dao/NicDao.java
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/NicDao.java
@@ -105,6 +105,6 @@ public interface NicDao extends GenericDao<NicVO, Long> {
 
     NicVO findByIpAddressAndVmType(String ip, VirtualMachine.Type vmType);
 
-    List<NicVO> listByNetworkIdAndType(long networkId, VirtualMachine.Type vmType);
+    List<NicVO> listNonPlaceholderNicsByNetworkIdAndType(long networkId, VirtualMachine.Type vmType);
     List<NicVO> searchRemovedByVms(List<Long> vmIds, Long batchSize);
 }
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/NicDaoImpl.java b/engine/schema/src/main/java/com/cloud/vm/dao/NicDaoImpl.java
index f4f3b0d6ad60..84b6ec4f2044 100644
--- a/engine/schema/src/main/java/com/cloud/vm/dao/NicDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/NicDaoImpl.java
@@ -456,10 +456,11 @@ public NicVO findByIpAddressAndVmType(String ip, VirtualMachine.Type vmType) {
     }
 
     @Override
-    public List<NicVO> listByNetworkIdAndType(long networkId, VirtualMachine.Type vmType) {
+    public List<NicVO> listNonPlaceholderNicsByNetworkIdAndType(long networkId, VirtualMachine.Type vmType) {
         SearchCriteria<NicVO> sc = AllFieldsSearch.create();
         sc.setParameters("network", networkId);
         sc.setParameters("vmType", vmType);
+        sc.setParameters("strategyNEQ", Nic.ReservationStrategy.PlaceHolder.toString());
         return listBy(sc);
     }
 
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42210to42220.sql b/engine/schema/src/main/resources/META-INF/db/schema-42210to42220.sql
index 7fefed18fd7e..7a8ee864eac3 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-42210to42220.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42210to42220.sql
@@ -23,3 +23,11 @@
 -- per-VM volume usage records introduced in 4.22.1 can coexist. See #13399.
 CALL `cloud_usage`.`IDEMPOTENT_DROP_INDEX`('id', 'cloud_usage.usage_volume');
 CALL `cloud_usage`.`IDEMPOTENT_ADD_UNIQUE_INDEX`('cloud_usage.usage_volume', 'id', '(volume_id ASC, created ASC, vm_id ASC)');
+
+-- Reclaim VNETs belonging to Netris deleted networks
+UPDATE op_dc_vnet_alloc a
+    JOIN networks n ON n.broadcast_uri = CONCAT('netris://', a.vnet)
+    SET a.account_id = NULL,
+        a.reservation_id = NULL,
+        a.taken = NULL
+WHERE n.removed IS NOT NULL;
diff --git a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java
index 061f6264d66c..035554e38237 100644
--- a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java
+++ b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java
@@ -300,6 +300,8 @@ public class KubernetesClusterManagerImpl extends ManagerBase implements Kuberne
     private static final String DEFAULT_NSX_VPC_TIER_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_NAME = "DefaultNSXVPCNetworkOfferingforKubernetesService";
     private static final String DEFAULT_NSX_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_DISPLAY_TEXT = "Network Offering for NSX CloudStack Kubernetes Service";
     private static final String DEFAULT_NSX_VPC_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_DISPLAY_TEXT = "Network Offering for NSX CloudStack Kubernetes service on VPC";
+    private static final String DEFAULT_NETRIS_VPC_TIER_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_NAME = "DefaultNetrisVPCNetworkOfferingforKubernetesService";
+    private static final String DEFAULT_NETRIS_VPC_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_DISPLAY_TEXT = "Network Offering for Netris CloudStack Kubernetes Service on VPC";
 
     protected StateMachine2<KubernetesCluster.State, KubernetesCluster.Event, KubernetesCluster> _stateMachine = KubernetesCluster.State.getStateMachine();
 
@@ -598,6 +600,21 @@ private void validateIsolatedNetwork(Network network, int clusterTotalNodeCount)
         validateIsolatedNetworkIpRules(sourceNatIp.getId(), FirewallRule.Purpose.PortForwarding, network, clusterTotalNodeCount);
     }
 
+    public boolean isNetrisNetwork(Network network) {
+        return networkModel.isProviderSupportServiceInNetwork(
+                network.getId(), Service.Lb, Network.Provider.Netris);
+    }
+
+    protected void validateNetrisNetwork(Network network) {
+        if (network.getVpcId() == null) {
+            throw new InvalidParameterValueException(String.format(
+                    "Netris Kubernetes provider supports only VPC networks / tiers. " +
+                            "Network '%s' (id: %s) is not part of a VPC. " +
+                            "Please create the cluster within a VPC tier.",
+                    network.getName(), network.getUuid()));
+        }
+    }
+
     protected void validateVpcTier(Network network) {
         if (Network.State.Allocated.equals(network.getState())) { // Allocated networks won't have IP and rules
             return;
@@ -1146,6 +1163,9 @@ private Network getKubernetesClusterNetworkIfMissing(final String clusterName, f
         Network network = null;
         if (networkId != null) {
             network = networkDao.findById(networkId);
+            if (isNetrisNetwork(network)) {
+                validateNetrisNetwork(network);
+            }
             if (Network.GuestType.Isolated.equals(network.getGuestType())) {
                 if (kubernetesClusterDao.listByNetworkId(network.getId()).isEmpty()) {
                     validateNetwork(network, controlNodesCount + nodesCount);
@@ -2695,13 +2715,16 @@ private boolean isClusterVMsInDesiredState(KubernetesCluster kubernetesCluster,
     @Override
     public boolean start() {
         createNetworkOfferingForKubernetes(DEFAULT_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_NAME,
-                DEFAULT_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_DISPLAY_TEXT, false, false);
+                DEFAULT_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_DISPLAY_TEXT, null, false);
 
         createNetworkOfferingForKubernetes(DEFAULT_NSX_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_NAME,
-                DEFAULT_NSX_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_DISPLAY_TEXT, true, false);
+                DEFAULT_NSX_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_DISPLAY_TEXT, Network.Provider.Nsx, false);
 
         createNetworkOfferingForKubernetes(DEFAULT_NSX_VPC_TIER_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_NAME,
-                DEFAULT_NSX_VPC_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_DISPLAY_TEXT , true, true);
+                DEFAULT_NSX_VPC_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_DISPLAY_TEXT , Network.Provider.Nsx, true);
+
+        createNetworkOfferingForKubernetes(DEFAULT_NETRIS_VPC_TIER_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_NAME,
+                DEFAULT_NETRIS_VPC_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_DISPLAY_TEXT , Network.Provider.Netris, true);
 
         getProjectKubernetesAccountRole();
 
@@ -2711,23 +2734,23 @@ public boolean start() {
         return true;
     }
 
-    private void createNetworkOfferingForKubernetes(String offeringName, String offeringDesc, boolean forNsx, boolean forVpc) {
+    private void createNetworkOfferingForKubernetes(String offeringName, String offeringDesc, Network.Provider extNetProvider, boolean forVpc) {
         final Map<Network.Service, Network.Provider> defaultKubernetesServiceNetworkOfferingProviders = new HashMap<Service, Network.Provider>();
         Network.Provider provider = forVpc ? Network.Provider.VPCVirtualRouter : Network.Provider.VirtualRouter;
         defaultKubernetesServiceNetworkOfferingProviders.put(Service.Dhcp, provider);
         defaultKubernetesServiceNetworkOfferingProviders.put(Service.Dns, provider);
         defaultKubernetesServiceNetworkOfferingProviders.put(Service.UserData, provider);
         if (forVpc) {
-            defaultKubernetesServiceNetworkOfferingProviders.put(Service.NetworkACL, forNsx ? Network.Provider.Nsx : provider);
+            defaultKubernetesServiceNetworkOfferingProviders.put(Service.NetworkACL, Objects.requireNonNullElse(extNetProvider, provider));
         } else {
-            defaultKubernetesServiceNetworkOfferingProviders.put(Service.Firewall, forNsx ? Network.Provider.Nsx : provider);
+            defaultKubernetesServiceNetworkOfferingProviders.put(Service.Firewall, Objects.requireNonNullElse(extNetProvider, provider));
         }
-        defaultKubernetesServiceNetworkOfferingProviders.put(Service.Lb, forNsx ? Network.Provider.Nsx : provider);
-        defaultKubernetesServiceNetworkOfferingProviders.put(Service.SourceNat, forNsx ? Network.Provider.Nsx : provider);
-        defaultKubernetesServiceNetworkOfferingProviders.put(Service.StaticNat, forNsx ? Network.Provider.Nsx : provider);
-        defaultKubernetesServiceNetworkOfferingProviders.put(Service.PortForwarding, forNsx ? Network.Provider.Nsx : provider);
+        defaultKubernetesServiceNetworkOfferingProviders.put(Service.Lb, Objects.requireNonNullElse(extNetProvider, provider));
+        defaultKubernetesServiceNetworkOfferingProviders.put(Service.SourceNat, Objects.requireNonNullElse(extNetProvider, provider));
+        defaultKubernetesServiceNetworkOfferingProviders.put(Service.StaticNat, Objects.requireNonNullElse(extNetProvider, provider));
+        defaultKubernetesServiceNetworkOfferingProviders.put(Service.PortForwarding, Objects.requireNonNullElse(extNetProvider, provider));
 
-        if (!forNsx) {
+        if (Objects.isNull(extNetProvider)) {
             defaultKubernetesServiceNetworkOfferingProviders.put(Service.Gateway, Network.Provider.VirtualRouter);
             defaultKubernetesServiceNetworkOfferingProviders.put(Service.Vpn, Network.Provider.VirtualRouter);
         }
@@ -2740,7 +2763,7 @@ private void createNetworkOfferingForKubernetes(String offeringName, String offe
                         true, false, false, false, false,
                         false, false, false, true, true, false,
                         forVpc, true, false, false);
-        if (forNsx) {
+        if (Objects.nonNull(extNetProvider)) {
             defaultKubernetesServiceNetworkOffering.setNetworkMode(NetworkOffering.NetworkMode.NATTED);
         }
         defaultKubernetesServiceNetworkOffering.setSupportsVmAutoScaling(true);
@@ -2752,7 +2775,7 @@ private void createNetworkOfferingForKubernetes(String offeringName, String offe
                     new NetworkOfferingServiceMapVO(defaultKubernetesServiceNetworkOffering.getId(), service,
                             defaultKubernetesServiceNetworkOfferingProviders.get(service));
             networkOfferingServiceMapDao.persist(offService);
-            logger.trace("Added service for the network offering: " + offService);
+            logger.trace("Added service for the network offering: {}", offService);
         }
     }
 
diff --git a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterActionWorker.java b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterActionWorker.java
index 1d4b6e8d0a84..7a06b11e3bf4 100644
--- a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterActionWorker.java
+++ b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterActionWorker.java
@@ -79,6 +79,8 @@
 import org.apache.commons.lang3.StringUtils;
 
 import com.cloud.dc.DataCenterVO;
+import com.cloud.dc.Vlan.VlanType;
+import com.cloud.dc.VlanVO;
 import com.cloud.dc.dao.DataCenterDao;
 import com.cloud.dc.dao.VlanDao;
 import com.cloud.exception.InsufficientAddressCapacityException;
@@ -101,6 +103,7 @@
 import com.cloud.network.NetworkModel;
 import com.cloud.network.NetworkService;
 import com.cloud.network.dao.IPAddressDao;
+import com.cloud.network.dao.IPAddressVO;
 import com.cloud.network.dao.NetworkDao;
 import com.cloud.network.vpc.VpcService;
 import com.cloud.projects.ProjectService;
@@ -227,8 +230,27 @@ public class KubernetesClusterActionWorker {
     protected VirtualMachineTemplate etcdTemplate;
     protected File sshKeyFile;
     protected String publicIpAddress;
+    /** For Netris VPC-tier clusters the Kubernetes API is exposed via the L4 LB rule on the LB IP.
+     *  For all other clusters: same value as {@link #publicIpAddress}. */
+    protected String apiPublicIpAddress;
     protected int sshPort;
 
+    /**
+     * Returns the public IP that Kubernetes nodes should use as the API server cluster endpoint.
+     * For Netris VPC-tier clusters this is the LB IP (stored under {@code PUBLIC_IP_ID}); for all
+     * other clusters it falls back to {@link #publicIpAddress}.
+     * {@link #publicIpAddress} must be set before calling this method.
+     */
+    protected String resolveApiPublicIpAddress(Network network) {
+        if (network != null && network.getVpcId() != null && manager.isNetrisNetwork(network)) {
+            IpAddress lbIp = getVpcTierKubernetesPublicIp(network);
+            if (lbIp != null) {
+                return lbIp.getAddress().addr();
+            }
+        }
+        return publicIpAddress;
+    }
+
 
     protected final String deploySecretsScriptFilename = "deploy-cloudstack-secret";
     protected final String deployProviderScriptFilename = "deploy-provider";
@@ -439,7 +461,11 @@ protected IpAddress getNetworkSourceNatIp(Network network) {
     }
 
     protected IpAddress getVpcTierKubernetesPublicIp(Network network) {
-        KubernetesClusterDetailsVO detailsVO = kubernetesClusterDetailsDao.findDetail(kubernetesCluster.getId(), ApiConstants.PUBLIC_IP_ID);
+        return getVpcTierKubernetesPublicIp(network, ApiConstants.PUBLIC_IP_ID);
+    }
+
+    protected IpAddress getVpcTierKubernetesPublicIp(Network network, String detailKey) {
+        KubernetesClusterDetailsVO detailsVO = kubernetesClusterDetailsDao.findDetail(kubernetesCluster.getId(), detailKey);
         if (detailsVO == null || StringUtils.isEmpty(detailsVO.getValue())) {
             return null;
         }
@@ -458,7 +484,8 @@ protected IpAddress getVpcTierKubernetesPublicIp(Network network) {
 
     protected IpAddress getPublicIp(Network network) throws ManagementServerException {
         if (network.getVpcId() != null) {
-            IpAddress publicIp = getVpcTierKubernetesPublicIp(network);
+            String detailKey = manager.isNetrisNetwork(network) ? ApiConstants.NETRIS_NAT_PUBLIC_IP_ID : ApiConstants.PUBLIC_IP_ID;
+            IpAddress publicIp = getVpcTierKubernetesPublicIp(network, detailKey);
             if (publicIp == null) {
                 throw new ManagementServerException(String.format("No public IP addresses found for VPC tier : %s, Kubernetes cluster : %s", network.getName(), kubernetesCluster.getName()));
             }
@@ -474,14 +501,24 @@ protected IpAddress getPublicIp(Network network) throws ManagementServerExceptio
 
     protected IpAddress acquireVpcTierKubernetesPublicIp(Network network, boolean forEtcd) throws
             InsufficientAddressCapacityException, ResourceAllocationException, ResourceUnavailableException {
-        IpAddress ip = networkService.allocateIP(owner, kubernetesCluster.getZoneId(), network.getId(), null, null);
+        return acquireVpcTierKubernetesPublicIp(network, forEtcd ? null : ApiConstants.PUBLIC_IP_ID);
+    }
+
+    protected IpAddress acquireVpcTierKubernetesPublicIp(Network network, String detailKey) throws
+            InsufficientAddressCapacityException, ResourceAllocationException, ResourceUnavailableException {
+        IpAddress ip;
+        if (manager.isNetrisNetwork(network)) {
+            ip = allocateIpFromNetrisRange(network);
+        } else {
+            ip = networkService.allocateIP(owner, kubernetesCluster.getZoneId(), network.getId(), null, null);
+        }
         if (ip == null) {
             return null;
         }
         ip = vpcService.associateIPToVpc(ip.getId(), network.getVpcId());
         ip = ipAddressManager.associateIPToGuestNetwork(ip.getId(), network.getId(), false);
-        if (!forEtcd) {
-            kubernetesClusterDetailsDao.addDetail(kubernetesCluster.getId(), ApiConstants.PUBLIC_IP_ID, ip.getUuid(), false);
+        if (detailKey != null) {
+            kubernetesClusterDetailsDao.addDetail(kubernetesCluster.getId(), detailKey, ip.getUuid(), false);
         }
         return ip;
     }
@@ -496,6 +533,39 @@ protected IpAddress acquirePublicIpForIsolatedNetwork(Network network) throws
         return ip;
     }
 
+    /**
+     * Finds and allocates a free public IP from the Netris-reserved VLAN range in the cluster's
+     * zone. Used for both the LB IP ({@code PUBLIC_IP_ID}) and the NAT IP
+     * ({@code NETRIS_NAT_PUBLIC_IP_ID}): all IPs acquired for a Netris cluster must come from
+     * VLANs tagged {@code forNetris=true} in {@code vlan_details}. The actual allocation is
+     * delegated to {@link NetworkService#allocateIP} with the discovered address so that the
+     * normal account-lock / state-transition path is preserved.
+     *
+     * @return the allocated {@link IpAddress}, or {@code null} if the Netris range is exhausted
+     */
+    private IpAddress allocateIpFromNetrisRange(Network network) throws
+            InsufficientAddressCapacityException, ResourceAllocationException, ResourceUnavailableException {
+        long dcId = kubernetesCluster.getZoneId();
+        List<Long> netrisVlanIds = vlanDao.listVlansForExternalNetworkProvider(dcId, ApiConstants.NETRIS_DETAIL_KEY)
+                .stream().map(VlanVO::getId).collect(Collectors.toList());
+        if (netrisVlanIds.isEmpty()) {
+            throw new CloudRuntimeException(String.format(
+                    "Cannot allocate Netris LB IP for Kubernetes cluster %s: no VLANs tagged " +
+                    "'forNetris=true' found in zone %d", kubernetesCluster.getName(), dcId));
+        }
+        List<IPAddressVO> available = ipAddressManager.listAvailablePublicIps(
+                dcId, null, netrisVlanIds, owner, VlanType.VirtualNetwork,
+                network.getId(), false, false, false, null, null, false,
+                null, null, false, false);
+        if (available.isEmpty()) {
+            logger.warn(String.format("No available IPs in the Netris range for zone %d, " +
+                    "Kubernetes cluster %s", dcId, kubernetesCluster.getName()));
+            return null;
+        }
+        String requestedIp = available.get(0).getAddress().addr();
+        return networkService.allocateIP(owner, dcId, network.getId(), null, requestedIp);
+    }
+
     protected Pair<String, Integer> getKubernetesClusterServerIpSshPortForIsolatedNetwork(Network network) {
         String ip = null;
         IpAddress address = getNetworkSourceNatIp(network);
@@ -519,6 +589,27 @@ protected Pair<String, Integer> getKubernetesClusterServerIpSshPortForVpcTier(Ne
                                                                                   boolean acquireNewPublicIpForVpcTierIfNeeded) throws
             InsufficientAddressCapacityException, ResourceAllocationException, ResourceUnavailableException {
         int port = CLUSTER_NODES_DEFAULT_START_SSH_PORT;
+        if (manager.isNetrisNetwork(network)) {
+            // For Netris:
+            // NAT IP is the SSH/API/port-forwarding endpoint.
+            // LB IP (PUBLIC_IP_ID) is reserved for Kubernetes LoadBalancer
+            IpAddress natIp = getVpcTierKubernetesPublicIp(network, ApiConstants.NETRIS_NAT_PUBLIC_IP_ID);
+            if (natIp != null) {
+                return new Pair<>(natIp.getAddress().addr(), port);
+            }
+            if (acquireNewPublicIpForVpcTierIfNeeded) {
+                // Acquire LB IP first so it is stored under PUBLIC_IP_ID for Netris
+                if (getVpcTierKubernetesPublicIp(network) == null) {
+                    acquireVpcTierKubernetesPublicIp(network, false);
+                }
+                natIp = acquireVpcTierKubernetesPublicIp(network, ApiConstants.NETRIS_NAT_PUBLIC_IP_ID);
+                if (natIp != null) {
+                    return new Pair<>(natIp.getAddress().addr(), port);
+                }
+            }
+            logger.warn(String.format("No NAT public IP found for Netris VPC tier: %s, Kubernetes cluster: %s", network, kubernetesCluster.getName()));
+            return new Pair<>(null, port);
+        }
         IpAddress address = getVpcTierKubernetesPublicIp(network);
         if (address != null) {
             return new Pair<>(address.getAddress().addr(), port);
diff --git a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterDestroyWorker.java b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterDestroyWorker.java
index 62bd8b4576a4..bdf515a9bf40 100644
--- a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterDestroyWorker.java
+++ b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterDestroyWorker.java
@@ -189,12 +189,27 @@ protected void deleteKubernetesClusterIsolatedNetworkRules(Network network, List
         }
     }
 
-    protected void deleteKubernetesClusterVpcTierRules(Network network, List<Long> removedVmIds) throws ManagementServerException {
+    protected void deleteKubernetesClusterVpcTierRules(Network network, List<Long> removedVmIds) throws ManagementServerException, ResourceUnavailableException {
+        removeVpcTierAclRules(network);
+        if (manager.isNetrisNetwork(network)) {
+            IpAddress lbIp = getVpcTierKubernetesPublicIp(network);
+            if (lbIp != null) {
+                removeLoadBalancingRule(lbIp, network, owner);
+            }
+            IpAddress natIp = getVpcTierKubernetesPublicIp(network, ApiConstants.NETRIS_NAT_PUBLIC_IP_ID);
+            if (natIp != null) {
+                try {
+                    removePortForwardingRules(natIp, network, owner, removedVmIds);
+                } catch (ResourceUnavailableException e) {
+                    throw new ManagementServerException(String.format("Failed to remove Kubernetes cluster port forwarding rules for network : %s", network.getName()), e);
+                }
+            }
+            return;
+        }
         IpAddress publicIp = getVpcTierKubernetesPublicIp(network);
         if (publicIp == null) {
             return;
         }
-        removeVpcTierAclRules(network);
         try {
             removePortForwardingRules(publicIp, network, owner, removedVmIds);
         } catch (ResourceUnavailableException e) {
@@ -202,7 +217,7 @@ protected void deleteKubernetesClusterVpcTierRules(Network network, List<Long> r
         }
     }
 
-    private void deleteKubernetesClusterNetworkRules() throws ManagementServerException {
+    private void deleteKubernetesClusterNetworkRules() throws ManagementServerException, ResourceUnavailableException {
         NetworkVO network = networkDao.findById(kubernetesCluster.getNetworkId());
         if (network == null) {
             return;
@@ -242,7 +257,7 @@ private void validateClusterVMsDestroyed() {
         }
     }
 
-    private void checkForRulesToDelete() throws ManagementServerException {
+    private void checkForRulesToDelete() throws ManagementServerException, ResourceUnavailableException {
         NetworkVO kubernetesClusterNetwork = networkDao.findById(kubernetesCluster.getNetworkId());
         if (kubernetesClusterNetwork != null && !manager.isDirectAccess(kubernetesClusterNetwork)) {
             deleteKubernetesClusterNetworkRules();
@@ -254,12 +269,18 @@ private void releaseVpcTierPublicIpIfNeeded() throws InsufficientAddressCapacity
         if (networkVO == null || networkVO.getVpcId() == null) {
             return;
         }
-        IpAddress address = getVpcTierKubernetesPublicIp(networkVO);
-        if (address == null) {
-            return;
+        IpAddress lbIp = getVpcTierKubernetesPublicIp(networkVO);
+        if (lbIp != null) {
+            networkService.releaseIpAddress(lbIp.getId());
+            kubernetesClusterDetailsDao.removeDetail(kubernetesCluster.getId(), ApiConstants.PUBLIC_IP_ID);
+        }
+        if (manager.isNetrisNetwork(networkVO)) {
+            IpAddress natIp = getVpcTierKubernetesPublicIp(networkVO, ApiConstants.NETRIS_NAT_PUBLIC_IP_ID);
+            if (natIp != null) {
+                networkService.releaseIpAddress(natIp.getId());
+                kubernetesClusterDetailsDao.removeDetail(kubernetesCluster.getId(), ApiConstants.NETRIS_NAT_PUBLIC_IP_ID);
+            }
         }
-        networkService.releaseIpAddress(address.getId());
-        kubernetesClusterDetailsDao.removeDetail(kubernetesCluster.getId(), ApiConstants.PUBLIC_IP_ID);
     }
 
     public boolean destroy() throws CloudRuntimeException {
@@ -324,8 +345,8 @@ public boolean destroy() throws CloudRuntimeException {
             } else {
                 try {
                     checkForRulesToDelete();
-                } catch (ManagementServerException e) {
-                    String msg = String.format("Failed to remove network rules of Kubernetes cluster: %s", kubernetesCluster);
+                } catch (ManagementServerException | ResourceUnavailableException e) {
+                    String msg = String.format("Failed to remove network rules of Kubernetes cluster : %s", kubernetesCluster.getName());
                     logger.warn(msg, e);
                     updateKubernetesClusterEntryForGC();
                     throw new CloudRuntimeException(msg, e);
diff --git a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterResourceModifierActionWorker.java b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterResourceModifierActionWorker.java
index 55924cb32e8a..573e752ce125 100644
--- a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterResourceModifierActionWorker.java
+++ b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterResourceModifierActionWorker.java
@@ -799,6 +799,29 @@ protected void setupKubernetesClusterVpcTierRules(IpAddress publicIp, Network ne
         }
     }
 
+
+    /**
+     *
+     * Netris-specific VPC tier rule setup. The two IPs serve distinct roles in Netris:
+     *   lbIp  (PUBLIC_IP_ID)            — Kubernetes API (port 6443) via Netris L4 Load Balancer rule.
+     *   natIp (NETRIS_NAT_PUBLIC_IP_ID) — SSH node access (ports 22001+) via Netris DNAT / port-forwarding.
+     */
+    protected void setupKubernetesClusterVpcTierRulesForNetris(IpAddress lbIp, IpAddress natIp,
+            Network network, List<Long> clusterVMIds) throws ManagementServerException {
+        createVpcTierAclRules(network);
+        try {
+            provisionLoadBalancerRule(lbIp, network, owner, clusterVMIds, CLUSTER_API_PORT);
+        } catch (InsufficientAddressCapacityException | NetworkRuleConflictException e) {
+            throw new ManagementServerException(String.format("Failed to activate API load balancing rules for Netris Kubernetes cluster : %s", kubernetesCluster.getName()), e);
+        }
+        try {
+            Map<Long, Integer> vmIdPortMap = getVmPortMap();
+            provisionSshPortForwardingRules(natIp, network, owner, clusterVMIds, vmIdPortMap);
+        } catch (ResourceUnavailableException | NetworkRuleConflictException e) {
+            throw new ManagementServerException(String.format("Failed to activate SSH port forwarding rules for Netris Kubernetes cluster : %s", kubernetesCluster.getName()), e);
+        }
+    }
+
     /**
      * Generates a valid name prefix for Kubernetes cluster nodes.
      *
diff --git a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterScaleWorker.java b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterScaleWorker.java
index 0ca27c29d8df..8f8d3aff87eb 100644
--- a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterScaleWorker.java
+++ b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterScaleWorker.java
@@ -32,6 +32,7 @@
 import com.cloud.service.ServiceOfferingVO;
 import com.cloud.storage.VMTemplateVO;
 import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.InternalIdentity;
 import org.apache.cloudstack.context.CallContext;
 import org.apache.commons.collections.CollectionUtils;
@@ -156,6 +157,25 @@ private void scaleKubernetesClusterIsolatedNetworkRules(final List<Long> cluster
     }
 
     private void scaleKubernetesClusterVpcTierRules(final List<Long> clusterVMIds) throws ManagementServerException {
+        if (manager.isNetrisNetwork(network)) {
+            // For Netris: SSH port-forwarding is on NAT IP; the LB rule on LB IP for 6443 is fixed and never re-provisioned during scale
+            IpAddress natIp = getVpcTierKubernetesPublicIp(network, ApiConstants.NETRIS_NAT_PUBLIC_IP_ID);
+            if (natIp == null) {
+                throw new ManagementServerException(String.format("No NAT IP found for Netris VPC tier : %s, Kubernetes cluster : %s", network.getName(), kubernetesCluster.getName()));
+            }
+            try {
+                removePortForwardingRules(natIp, network, owner, CLUSTER_NODES_DEFAULT_START_SSH_PORT, CLUSTER_NODES_DEFAULT_START_SSH_PORT + clusterVMIds.size() - 1);
+            } catch (ResourceUnavailableException e) {
+                throw new ManagementServerException(String.format("Failed to remove SSH port forwarding rules for the Kubernetes cluster : %s", kubernetesCluster.getName()), e);
+            }
+            try {
+                Map<Long, Integer> vmIdPortMap = getVmPortMap();
+                provisionSshPortForwardingRules(natIp, network, owner, clusterVMIds, vmIdPortMap);
+            } catch (ResourceUnavailableException | NetworkRuleConflictException e) {
+                throw new ManagementServerException(String.format("Failed to activate SSH port forwarding rules for the Kubernetes cluster : %s", kubernetesCluster.getName()), e);
+            }
+            return;
+        }
         IpAddress publicIp = getVpcTierKubernetesPublicIp(network);
         if (publicIp == null) {
             throw new ManagementServerException(String.format("No public IP addresses found for VPC tier : %s, Kubernetes cluster : %s", network.getName(), kubernetesCluster.getName()));
@@ -165,7 +185,6 @@ private void scaleKubernetesClusterVpcTierRules(final List<Long> clusterVMIds) t
         } catch (ResourceUnavailableException e) {
             throw new ManagementServerException(String.format("Failed to remove SSH port forwarding rules for removed VMs for the Kubernetes cluster : %s", kubernetesCluster.getName()), e);
         }
-        // Add port forwarding rule for SSH access on each node VM
         try {
            Map<Long, Integer> vmIdPortMap = getVmPortMap();
             provisionSshPortForwardingRules(publicIp, network, owner, clusterVMIds, vmIdPortMap);
@@ -479,7 +498,7 @@ private void scaleUpKubernetesClusterSize(final long newVmCount) throws CloudRun
             launchPermissionDao.persist(launchPermission);
         }
         try {
-            clusterVMs = provisionKubernetesClusterNodeVms((int)(newVmCount + kubernetesCluster.getNodeCount()), (int)kubernetesCluster.getNodeCount(), publicIpAddress, kubernetesCluster.getDomainId(), kubernetesCluster.getAccountId());
+            clusterVMs = provisionKubernetesClusterNodeVms((int)(newVmCount + kubernetesCluster.getNodeCount()), (int)kubernetesCluster.getNodeCount(), apiPublicIpAddress, kubernetesCluster.getDomainId(), kubernetesCluster.getAccountId());
             updateLoginUserDetails(clusterVMs.stream().map(InternalIdentity::getId).collect(Collectors.toList()));
         } catch (CloudRuntimeException | ManagementServerException | ResourceUnavailableException | InsufficientCapacityException e) {
             logTransitStateToFailedIfNeededAndThrow(Level.ERROR, String.format("Scaling failed for Kubernetes cluster : %s, unable to provision node VM in the cluster", kubernetesCluster.getName()), e);
@@ -518,6 +537,9 @@ private void scaleKubernetesClusterSize(KubernetesClusterNodeType nodeType) thro
         Pair<String, Integer> publicIpSshPort = getKubernetesClusterServerIpSshPort(null);
         publicIpAddress = publicIpSshPort.first();
         sshPort = publicIpSshPort.second();
+        // For Netris VPC-tier: apiPublicIpAddress = LB IP (kubeadm join target for new nodes).
+        // For all others: same as publicIpAddress.
+        apiPublicIpAddress = resolveApiPublicIpAddress(network);
         if (StringUtils.isEmpty(publicIpAddress)) {
             logTransitStateToFailedIfNeededAndThrow(Level.ERROR, String.format("Scaling failed for Kubernetes cluster : %s, unable to retrieve associated public IP", kubernetesCluster.getName()));
         }
diff --git a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterStartWorker.java b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterStartWorker.java
index aa9317e619b0..4b7f3c672258 100644
--- a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterStartWorker.java
+++ b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/actionworkers/KubernetesClusterStartWorker.java
@@ -38,6 +38,7 @@
 import com.cloud.network.vpc.NetworkACL;
 import com.cloud.storage.VMTemplateVO;
 import com.cloud.user.UserDataVO;
+import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.BaseCmd;
 import org.apache.cloudstack.api.InternalIdentity;
 import org.apache.cloudstack.framework.ca.Certificate;
@@ -103,6 +104,31 @@ public KubernetesSupportedVersion getKubernetesClusterVersion() {
         return kubernetesClusterVersion;
     }
 
+    /**
+     * Returns the VPC-tier public IP stored under {@code detailKey} for this cluster,
+     * acquiring a new one if absent. Throws {@link ManagementServerException} when
+     * neither the lookup nor the allocation succeeds.
+     */
+    private IpAddress resolveOrAcquireVpcTierIp(Network network, String detailKey, String role)
+            throws ManagementServerException, InsufficientAddressCapacityException, ResourceUnavailableException {
+        IpAddress ip = getVpcTierKubernetesPublicIp(network, detailKey);
+        if (ip == null) {
+            try {
+                ip = acquireVpcTierKubernetesPublicIp(network, detailKey);
+            } catch (ResourceAllocationException e) {
+                throw new ManagementServerException(String.format(
+                        "Failed to acquire %s IP for VPC tier : %s, Kubernetes cluster : %s",
+                        role, network.getName(), kubernetesCluster.getName()), e);
+            }
+        }
+        if (ip == null) {
+            throw new ManagementServerException(String.format(
+                    "Failed to acquire %s IP for VPC tier : %s, Kubernetes cluster : %s",
+                    role, network.getName(), kubernetesCluster.getName()));
+        }
+        return ip;
+    }
+
     private Pair<String, Map<Long, Network.IpAddresses>> getKubernetesControlNodeIpAddresses(final DataCenter zone, final Network network, final Account account) throws InsufficientAddressCapacityException {
         String controlNodeIp = null;
         Map<Long, Network.IpAddresses> requestedIps = null;
@@ -608,7 +634,7 @@ private Network startKubernetesClusterNetwork(final DeployDestination destinatio
         return network;
     }
 
-    protected void setupKubernetesClusterNetworkRules(Network network, List<UserVm> clusterVMs) throws ManagementServerException {
+    protected void setupKubernetesClusterNetworkRules(Network network, List<UserVm> clusterVMs) throws ManagementServerException, InsufficientAddressCapacityException, ResourceUnavailableException {
         if (manager.isDirectAccess(network)) {
             if (logger.isDebugEnabled()) {
                 logger.debug("Network: {} for Kubernetes cluster: {} is not an isolated network or ROUTED network, therefore, no need for network rules", network, kubernetesCluster);
@@ -617,11 +643,14 @@ protected void setupKubernetesClusterNetworkRules(Network network, List<UserVm>
         }
         List<Long> clusterVMIds = clusterVMs.stream().map(UserVm::getId).collect(Collectors.toList());
         if (network.getVpcId() != null) {
-            IpAddress publicIp = getVpcTierKubernetesPublicIp(network);
-            if (publicIp == null) {
-                throw new ManagementServerException(String.format("No public IP addresses found for VPC tier : %s, Kubernetes cluster : %s", network.getName(), kubernetesCluster.getName()));
+            if (manager.isNetrisNetwork(network)) {
+                IpAddress natIp = resolveOrAcquireVpcTierIp(network, ApiConstants.NETRIS_NAT_PUBLIC_IP_ID, "NAT");
+                IpAddress lbIp = resolveOrAcquireVpcTierIp(network, ApiConstants.PUBLIC_IP_ID, "LB");
+                setupKubernetesClusterVpcTierRulesForNetris(lbIp, natIp, network, clusterVMIds);
+            } else {
+                IpAddress lbIp = resolveOrAcquireVpcTierIp(network, ApiConstants.PUBLIC_IP_ID, "public");
+                setupKubernetesClusterVpcTierRules(lbIp, network, clusterVMIds);
             }
-            setupKubernetesClusterVpcTierRules(publicIp, network, clusterVMIds);
             return;
         }
         IpAddress publicIp = getNetworkSourceNatIp(network);
@@ -711,7 +740,7 @@ private boolean isKubernetesClusterKubeConfigAvailable(final long timeoutTime) {
             final String controlVMPrivateIpAddress = getControlVmPrivateIp();
             if (StringUtils.isNotEmpty(controlVMPrivateIpAddress)) {
                 kubeConfig = kubeConfig.replace(String.format("server: https://%s:%d", controlVMPrivateIpAddress, CLUSTER_API_PORT),
-                        String.format("server: https://%s:%d", publicIpAddress, CLUSTER_API_PORT));
+                        String.format("server: https://%s:%d", apiPublicIpAddress, CLUSTER_API_PORT));
             }
             kubernetesClusterDetailsDao.addDetail(kubernetesCluster.getId(), "kubeConfigData", Base64.encodeBase64String(kubeConfig.getBytes(com.cloud.utils.StringUtils.getPreferredCharset())), false);
             return true;
@@ -735,7 +764,7 @@ private boolean isKubernetesClusterDashboardServiceRunning(final boolean onCreat
 
     private void updateKubernetesClusterEntryEndpoint() {
         KubernetesClusterVO kubernetesClusterVO = kubernetesClusterDao.findById(kubernetesCluster.getId());
-        kubernetesClusterVO.setEndpoint(String.format("https://%s:%d/", publicIpAddress, CLUSTER_API_PORT));
+        kubernetesClusterVO.setEndpoint(String.format("https://%s:%d/", apiPublicIpAddress, CLUSTER_API_PORT));
         kubernetesClusterDao.update(kubernetesCluster.getId(), kubernetesClusterVO);
     }
 
@@ -767,6 +796,7 @@ public boolean startKubernetesClusterOnCreate(Long domainId, Long accountId, Lon
             logTransitStateAndThrow(Level.ERROR, String.format("Failed to start Kubernetes cluster : %s as failed to acquire public IP" , kubernetesCluster.getName()), kubernetesCluster.getId(), KubernetesCluster.Event.CreateFailed);
         }
         publicIpAddress = publicIpSshPort.first();
+        apiPublicIpAddress = resolveApiPublicIpAddress(network);
         if (StringUtils.isEmpty(publicIpAddress) &&
                 (!manager.isDirectAccess(network) || kubernetesCluster.getControlNodeCount() > 1)) { // Shared network, single-control node cluster won't have an IP yet
             logTransitStateAndThrow(Level.ERROR, String.format("Failed to start Kubernetes cluster : %s as no public IP found for the cluster" , kubernetesCluster.getName()), kubernetesCluster.getId(), KubernetesCluster.Event.CreateFailed);
@@ -789,7 +819,7 @@ public boolean startKubernetesClusterOnCreate(Long domainId, Long accountId, Lon
         Pair<UserVm, String> k8sControlVMAndIp = new Pair<>(null, null);
         UserVm k8sControlVM = null;
         try {
-            k8sControlVMAndIp = provisionKubernetesClusterControlVm(network, publicIpAddress, etcdGuestNodeIps, domainId, accountId, asNumber);
+            k8sControlVMAndIp = provisionKubernetesClusterControlVm(network, apiPublicIpAddress, etcdGuestNodeIps, domainId, accountId, asNumber);
         } catch (CloudRuntimeException | ManagementServerException | ResourceUnavailableException | InsufficientCapacityException e) {
             logTransitStateAndThrow(Level.ERROR, String.format("Provisioning the control VM failed in the Kubernetes cluster : %s", kubernetesCluster.getName()), kubernetesCluster.getId(), KubernetesCluster.Event.CreateFailed, e);
         }
@@ -798,6 +828,7 @@ public boolean startKubernetesClusterOnCreate(Long domainId, Long accountId, Lon
         if (StringUtils.isEmpty(publicIpAddress)) {
             publicIpSshPort = getKubernetesClusterServerIpSshPort(k8sControlVM);
             publicIpAddress = publicIpSshPort.first();
+            apiPublicIpAddress = resolveApiPublicIpAddress(network);
             if (StringUtils.isEmpty(publicIpAddress)) {
                 logTransitStateAndThrow(Level.WARN, String.format("Failed to start Kubernetes cluster : %s as no public IP found for the cluster", kubernetesCluster.getName()), kubernetesCluster.getId(), KubernetesCluster.Event.CreateFailed);
             }
@@ -819,7 +850,7 @@ public boolean startKubernetesClusterOnCreate(Long domainId, Long accountId, Lon
         }
         try {
             setupKubernetesClusterNetworkRules(network, clusterVMs);
-        } catch (ManagementServerException e) {
+        } catch (ManagementServerException | InsufficientAddressCapacityException | ResourceUnavailableException e) {
             logTransitStateAndThrow(Level.ERROR, String.format("Failed to setup Kubernetes cluster : %s, unable to setup network rules", kubernetesCluster.getName()), kubernetesCluster.getId(), KubernetesCluster.Event.CreateFailed, e);
         }
         try {
@@ -840,7 +871,7 @@ public boolean startKubernetesClusterOnCreate(Long domainId, Long accountId, Lon
             }
             logTransitStateDetachIsoAndThrow(Level.ERROR, msg, kubernetesCluster, clusterVMs, KubernetesCluster.Event.CreateFailed, null);
         }
-        boolean k8sApiServerSetup = KubernetesClusterUtil.isKubernetesClusterServerRunning(kubernetesCluster, publicIpAddress, CLUSTER_API_PORT, startTimeoutTime, 15000);
+        boolean k8sApiServerSetup = KubernetesClusterUtil.isKubernetesClusterServerRunning(kubernetesCluster, apiPublicIpAddress, CLUSTER_API_PORT, startTimeoutTime, 15000);
         if (!k8sApiServerSetup) {
             logTransitStateDetachIsoAndThrow(Level.ERROR, String.format("Failed to setup Kubernetes cluster : %s in usable state as unable to provision API endpoint for the cluster", kubernetesCluster.getName()), kubernetesCluster, clusterVMs, KubernetesCluster.Event.CreateFailed, null);
         }
@@ -886,10 +917,13 @@ public boolean startStoppedKubernetesCluster(Long domainId, Long accountId) thro
         Pair<String, Integer> sshIpPort =  getKubernetesClusterServerIpSshPort(null);
         publicIpAddress = sshIpPort.first();
         sshPort = sshIpPort.second();
+        Network network = networkDao.findById(kubernetesCluster.getNetworkId());
+        apiPublicIpAddress = resolveApiPublicIpAddress(network);
         if (StringUtils.isEmpty(publicIpAddress)) {
             logTransitStateAndThrow(Level.ERROR, String.format("Failed to start Kubernetes cluster : %s as no public IP found for the cluster" , kubernetesCluster.getName()), kubernetesCluster.getId(), KubernetesCluster.Event.OperationFailed);
         }
-        if (!KubernetesClusterUtil.isKubernetesClusterServerRunning(kubernetesCluster, publicIpAddress, CLUSTER_API_PORT, startTimeoutTime, 15000)) {
+        // API check uses apiPublicIpAddress (LB IP for Netris)
+        if (!KubernetesClusterUtil.isKubernetesClusterServerRunning(kubernetesCluster, apiPublicIpAddress, CLUSTER_API_PORT, startTimeoutTime, 15000)) {
             logTransitStateAndThrow(Level.ERROR, String.format("Failed to start Kubernetes cluster : %s in usable state", kubernetesCluster.getName()), kubernetesCluster.getId(), KubernetesCluster.Event.OperationFailed);
         }
         if (!isKubernetesClusterKubeConfigAvailable(startTimeoutTime)) {
@@ -915,6 +949,8 @@ public boolean reconcileAlertCluster() {
         Pair<String, Integer> sshIpPort =  getKubernetesClusterServerIpSshPort(null);
         publicIpAddress = sshIpPort.first();
         sshPort = sshIpPort.second();
+        Network network = networkDao.findById(kubernetesCluster.getNetworkId());
+        apiPublicIpAddress = resolveApiPublicIpAddress(network);
         if (StringUtils.isEmpty(publicIpAddress)) {
             return false;
         }
@@ -930,7 +966,8 @@ public boolean reconcileAlertCluster() {
         if (StringUtils.isEmpty(sshIpPort.first())) {
             return false;
         }
-        if (!KubernetesClusterUtil.isKubernetesClusterServerRunning(kubernetesCluster, sshIpPort.first(),
+        // API server check uses apiPublicIpAddress (LB IP for Netris)
+        if (!KubernetesClusterUtil.isKubernetesClusterServerRunning(kubernetesCluster, apiPublicIpAddress,
                 KubernetesClusterActionWorker.CLUSTER_API_PORT, startTimeoutTime, 0)) {
             return false;
         }
diff --git a/plugins/network-elements/netris/pom.xml b/plugins/network-elements/netris/pom.xml
index 8ec221ffa3a9..4a3c5f780e04 100644
--- a/plugins/network-elements/netris/pom.xml
+++ b/plugins/network-elements/netris/pom.xml
@@ -33,7 +33,7 @@
         <dependency>
             <groupId>io.netris</groupId>
             <artifactId>netris-java-sdk</artifactId>
-            <version>1.0.0</version>
+            <version>1.0.1</version>
         </dependency>
         <dependency>
             <groupId>com.github.seancfoley</groupId>
diff --git a/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/agent/api/CreateNetrisVnetCommand.java b/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/agent/api/CreateNetrisVnetCommand.java
index e700b3b9d2d1..dfca9bade7d5 100644
--- a/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/agent/api/CreateNetrisVnetCommand.java
+++ b/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/agent/api/CreateNetrisVnetCommand.java
@@ -16,6 +16,9 @@
 // under the License.
 package org.apache.cloudstack.agent.api;
 
+import com.cloud.offering.NetworkOffering;
+import com.cloud.utils.net.NetUtils;
+
 public class CreateNetrisVnetCommand extends NetrisCommand {
     private String vpcName;
     private Long vpcId;
@@ -24,7 +27,8 @@ public class CreateNetrisVnetCommand extends NetrisCommand {
     private String gateway;
     private String netrisTag;
     private String ipv6Cidr;
-    private Boolean globalRouting;
+    private NetworkOffering.NetworkMode networkMode;
+    private NetUtils.InternetProtocol internetProtocol;
 
     public CreateNetrisVnetCommand(Long zoneId, Long accountId, Long domainId, String vpcName, Long vpcId, String vNetName, Long networkId, String cidr, String gateway, boolean isVpc) {
         super(zoneId, accountId, domainId, vNetName, networkId, isVpc);
@@ -74,11 +78,19 @@ public void setIpv6Cidr(String ipv6Cidr) {
         this.ipv6Cidr = ipv6Cidr;
     }
 
-    public Boolean isGlobalRouting() {
-        return globalRouting;
+    public NetworkOffering.NetworkMode getNetworkMode() {
+        return networkMode;
+    }
+
+    public void setNetworkMode(NetworkOffering.NetworkMode networkMode) {
+        this.networkMode = networkMode;
+    }
+
+    public NetUtils.InternetProtocol getInternetProtocol() {
+        return internetProtocol;
     }
 
-    public void setGlobalRouting(Boolean globalRouting) {
-        this.globalRouting = globalRouting;
+    public void setInternetProtocol(NetUtils.InternetProtocol internetProtocol) {
+        this.internetProtocol = internetProtocol;
     }
 }
diff --git a/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/agent/api/NetrisCommand.java b/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/agent/api/NetrisCommand.java
index 280c7de32d1e..3c14ed764f17 100644
--- a/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/agent/api/NetrisCommand.java
+++ b/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/agent/api/NetrisCommand.java
@@ -25,6 +25,7 @@ public class NetrisCommand extends Command {
     private String name;
     private final Long id;
     private final boolean isVpc;
+    private boolean isL2;
 
     public NetrisCommand(long zoneId, Long accountId, Long domainId, String name, Long id, boolean isVpc) {
         this.zoneId = zoneId;
@@ -63,6 +64,14 @@ public boolean isVpc() {
         return isVpc;
     }
 
+    public boolean isL2() {
+        return isL2;
+    }
+
+    public void setL2(boolean l2) {
+        isL2 = l2;
+    }
+
     @Override
     public boolean executeInSequence() {
         return false;
diff --git a/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/resource/NetrisResourceObjectUtils.java b/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/resource/NetrisResourceObjectUtils.java
index 164c56cd763b..5b7b9d8973dd 100644
--- a/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/resource/NetrisResourceObjectUtils.java
+++ b/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/resource/NetrisResourceObjectUtils.java
@@ -16,6 +16,8 @@
 // under the License.
 package org.apache.cloudstack.resource;
 
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.offering.NetworkOffering;
 import org.apache.cloudstack.agent.api.NetrisCommand;
 import org.apache.commons.lang3.ArrayUtils;
 
@@ -23,6 +25,8 @@
 
 public class NetrisResourceObjectUtils {
 
+    public static final int NETRIS_VNET_NAME_MAX_LENGTH = 50;
+
     public enum NetrisObjectType {
         VPC, IPAM_ALLOCATION, IPAM_SUBNET, VNET, SNAT, STATICNAT, DNAT, STATICROUTE, ACL, LB
     }
@@ -73,7 +77,7 @@ public static String retrieveNetrisResourceObjectName(NetrisCommand cmd, NetrisO
                 break;
             case STATICNAT:
                 stringBuilder.append(String.format("%s%s-VM%s-%s", prefix, suffixes[0], suffixes[1], "STATICNAT"));
-                suffixes = new String[0];
+                suffixes = ArrayUtils.subarray(suffixes, 2, suffixes.length);
                 break;
             case DNAT:
                 stringBuilder.append(String.format("%s%s-%s", prefix, suffixes[0], "DNAT"));
@@ -100,4 +104,17 @@ public static String retrieveNetrisResourceObjectName(NetrisCommand cmd, NetrisO
         }
         return stringBuilder.toString();
     }
+
+    public static void validateNetrisVnetNameLength(String netrisVnetName, String networkName) {
+        if (netrisVnetName.length() > NETRIS_VNET_NAME_MAX_LENGTH) {
+            throw new InvalidParameterValueException(
+                    String.format("The resulting Netris vNet name '%s' exceeds the maximum allowed length of %d characters (actual: %d). " +
+                            "Please use a shorter network name (current: '%s')",
+                            netrisVnetName, NETRIS_VNET_NAME_MAX_LENGTH, netrisVnetName.length(), networkName));
+        }
+    }
+
+    public static NetworkOffering.NetworkMode getNetworkMode(NetworkOffering.NetworkMode mode) {
+        return Objects.isNull(mode) ? NetworkOffering.NetworkMode.NATTED : mode;
+    }
 }
diff --git a/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisApiClientImpl.java b/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisApiClientImpl.java
index 9d3ff953ee15..34aa5fc0ec60 100644
--- a/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisApiClientImpl.java
+++ b/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisApiClientImpl.java
@@ -21,6 +21,7 @@
 import com.cloud.network.netris.NetrisNetworkRule;
 import com.cloud.network.vpc.StaticRoute;
 import com.cloud.network.vpc.StaticRouteVO;
+import com.cloud.offering.NetworkOffering;
 import com.cloud.user.Account;
 import com.cloud.utils.Pair;
 import com.cloud.utils.exception.CloudRuntimeException;
@@ -108,6 +109,7 @@
 import io.netris.model.VnetResDeleteBody;
 import io.netris.model.VnetResListBody;
 import io.netris.model.VnetsBody;
+import io.netris.model.VnetsBodyGateways;
 import io.netris.model.VpcEditResponseOK;
 import io.netris.model.VpcVpcIdBody;
 import io.netris.model.response.AuthResponse;
@@ -329,6 +331,11 @@ private InlineResponse2004Data createIpamAllocationInternal(String ipamName, Str
     @Override
     public boolean createVpc(CreateNetrisVpcCommand cmd) {
         String netrisVpcName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.VPC);
+        VPCListing existingNetrisVpc = getVpcByNameAndTenant(netrisVpcName);
+        if (existingNetrisVpc != null) {
+            logger.info("Netris VPC {} already exists, skipping creation", netrisVpcName);
+            return true;
+        }
         VPCResponseObjectOK createdVpc = createVpcInternal(netrisVpcName, tenantId, tenantName);
         if (createdVpc == null || !createdVpc.isIsSuccess()) {
             String reason = createdVpc == null ? "Empty response" : "Operation failed on Netris";
@@ -338,8 +345,19 @@ public boolean createVpc(CreateNetrisVpcCommand cmd) {
 
         String netrisIpamAllocationName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.IPAM_ALLOCATION, cmd.getCidr());
         String vpcCidr = cmd.getCidr();
-        InlineResponse2004Data createdIpamAllocation = createIpamAllocationInternal(netrisIpamAllocationName, vpcCidr, createdVpc.getData());
-        return createdIpamAllocation != null;
+        VPCListing vpcListing = createdVpc.getData();
+        InlineResponse2004Data createdIpamAllocation = createIpamAllocationInternal(netrisIpamAllocationName, vpcCidr, vpcListing);
+        if (createdIpamAllocation == null) {
+            logger.warn("IPAM Allocation creation failed for VPC {}, rolling back VPC", netrisVpcName);
+            try {
+                deleteVpcInternal(vpcListing);
+            } catch (Exception e) {
+                logger.error("Failed to rollback VPC {} after IPAM Allocation failure - manual cleanup may be required: {}",
+                        netrisVpcName, e.getMessage());
+            }
+            return false;
+        }
+        return true;
     }
 
     @Override
@@ -352,9 +370,13 @@ public boolean updateVpc(UpdateNetrisVpcCommand cmd) {
         String netrisVpcName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.VPC);
         String netrisPrevVpcName = String.format("D%s-A%s-Z%s-V%s-%s", domainId, accountId, zoneId, vpcId, prevVpcName);
         VpcEditResponseOK updatedVpc = updateVpcInternal(netrisVpcName, netrisPrevVpcName, tenantId, tenantName);
+        return validateNetrisVpcUpdateResponse(updatedVpc, prevVpcName);
+    }
+
+    private boolean validateNetrisVpcUpdateResponse(VpcEditResponseOK updatedVpc, String previousVpcName) {
         if (updatedVpc == null || !updatedVpc.isIsSuccess()) {
             String reason = updatedVpc == null ? "Empty response" : "Operation failed on Netris";
-            logger.debug("The update of Netris VPC {} failed: {}", cmd.getPreviousVpcName(), reason);
+            logger.debug("The update of Netris VPC {} failed: {}", previousVpcName, reason);
             return false;
         }
         return true;
@@ -372,6 +394,13 @@ public boolean deleteNatRule(DeleteNetrisNatRuleCommand cmd) {
             }
             String natRuleName = cmd.getNatRuleName();
             NatGetBody existingNatRule = netrisNatRuleExists(natRuleName);
+            // Backward compatibility: rules created before the public-IP suffix was added use the legacy name
+            if (existingNatRule == null && "STATICNAT".equals(cmd.getNatRuleType())) {
+                existingNatRule = findLegacyStaticNatRule(natRuleName, cmd.getNatIp());
+                if (existingNatRule != null) {
+                    natRuleName = existingNatRule.getName();
+                }
+            }
             boolean ruleExists = Objects.nonNull(existingNatRule);
             if (ruleExists) {
                 deleteNatRule(natRuleName, existingNatRule.getId(), vpcResource.getName());
@@ -416,7 +445,7 @@ public boolean addOrUpdateAclRule(CreateOrUpdateNetrisACLCommand cmd, boolean fo
                 try {
                     aclApi.apiAclPut(aclEditItem);
                 } catch (ApiException e) {
-                    if (e.getResponseBody().contains("This kind of acl already exists")) {
+                    if (e.getResponseBody().contains("already exists")) {
                         logger.info("Netris ACL rule: {} already exists and doesn't need to be updated", aclName);
                         return true;
                     }
@@ -426,7 +455,15 @@ public boolean addOrUpdateAclRule(CreateOrUpdateNetrisACLCommand cmd, boolean fo
             }
             AclAddItem aclAddItem = getAclAddItem(cmd, aclName);
             aclAddItem.setVpc(vpc);
-            aclApi.apiAclPost(aclAddItem);
+            try {
+                aclApi.apiAclPost(aclAddItem);
+            } catch (ApiException e) {
+                if (e.getResponseBody() != null && e.getResponseBody().contains("already exists")) {
+                    logger.info("Netris ACL rule: {} already exists, skipping creation", aclName);
+                    return true;
+                }
+                throw e;
+            }
         } catch (ApiException e) {
             logAndThrowException(String.format("Failed to create Netris ACL: %s", cmd.getNetrisAclName()), e);
         }
@@ -949,13 +986,12 @@ public boolean deleteLbRule(DeleteNetrisLoadBalancerRuleCommand cmd) {
                 logger.error("Could not find the Netris LB rule with name {}", lbName);
                 return false;
             }
-            if (matchingLbId.isEmpty()) {
+            if (!matchingLbId.isEmpty()) {
+                L4LoadBalancerApi lbApi = apiClient.getApiStubForMethod(L4LoadBalancerApi.class);
+                lbApi.apiV2L4lbIdDelete(matchingLbId.get(0).intValue());
+            } else {
                 logger.warn("There doesn't seem to be any LB rule on Netris matching {}", lbName);
-                return true;
             }
-
-            L4LoadBalancerApi lbApi = apiClient.getApiStubForMethod(L4LoadBalancerApi.class);
-            lbApi.apiV2L4lbIdDelete(matchingLbId.get(0).intValue());
             if (Objects.nonNull(cidrList)) {
                 deleteAclRulesForLb(cmd);
             }
@@ -1104,6 +1140,40 @@ private VPCResourceIpam getVpcAllocationResource(VPCResponseResourceOK vpcResour
         return null;
     }
 
+    private String getL2VpcName(NetrisCommand cmd, String name) {
+        return String.format("D%s-A%s-Z%s-N%s-%s",
+                cmd.getDomainId(), cmd.getAccountId(), cmd.getZoneId(), cmd.getId(), name);
+    }
+
+    /**
+     * Returns the existing dedicated Netris VPC for an L2 network, creating it if it does not yet exist.
+     * The VPC is created with no IPAM allocation.
+     */
+    private VPCListing getOrCreateL2Vpc(NetrisCommand cmd) {
+        String l2VpcName = getL2VpcName(cmd, cmd.getName());
+        VPCListing existing = getVpcByNameAndTenant(l2VpcName);
+        if (existing != null) {
+            logger.debug("Found existing dedicated L2 VPC {} on Netris", l2VpcName);
+            return existing;
+        }
+        logger.debug("Creating dedicated L2 VPC {} on Netris (no subnet)", l2VpcName);
+        VPCResponseObjectOK created = createVpcInternal(l2VpcName, tenantId, tenantName);
+        if (created == null || !created.isIsSuccess()) {
+            logger.error("Failed to create dedicated L2 VPC {} on Netris", l2VpcName);
+            return null;
+        }
+
+        return getVpcByNameAndTenant(l2VpcName);
+    }
+
+    private void rollbackL2Vpc(VPCListing l2Vpc) {
+        try {
+            deleteVpcInternal(l2Vpc);
+        } catch (Exception e) {
+            logger.error("Failed to rollback L2 VPC {} after vNet creation failure - manual cleanup may be required: {}", l2Vpc.getName(), e.getMessage());
+        }
+    }
+
     private VPCListing getVpcByNameAndTenant(String vpcName) {
         try {
             List<VPCListing> vpcListings = listVPCs();
@@ -1159,18 +1229,54 @@ public boolean createVnet(CreateNetrisVnetCommand cmd) {
         String vnetCidr = cmd.getCidr();
         Integer vxlanId = cmd.getVxlanId();
         String netrisTag = cmd.getNetrisTag();
-        String netmask = vnetCidr.split("/")[1];
-        String netrisGateway = cmd.getGateway() + "/" + netmask;
-        String netrisV6Cidr = cmd.getIpv6Cidr();
         boolean isVpc = cmd.isVpc();
-        Boolean isGlobalRouting = cmd.isGlobalRouting();
+        boolean isL2 = cmd.isL2();
+
+        // Derive per-address-family global routing flags from networkMode + internetProtocol:
+        //   ipv4 NAT      -> ipv4 global routing: false,  ipv6 global routing: n/a
+        //   ipv4 ROUTED   -> ipv4 global routing: true,   ipv6 global routing: n/a
+        //   dual NAT      -> ipv4 global routing: false,  ipv6 global routing: true
+        //   dual ROUTED   -> ipv4 global routing: true,   ipv6 global routing: true
+        NetworkOffering.NetworkMode networkMode = cmd.getNetworkMode();
+        NetUtils.InternetProtocol internetProtocol = cmd.getInternetProtocol();
+        Boolean ipv4GlobalRouting = null;
+        Boolean ipv6GlobalRouting = null;
+        if (networkMode != null) {
+            ipv4GlobalRouting = NetworkOffering.NetworkMode.ROUTED.equals(networkMode);
+            if (NetUtils.InternetProtocol.DualStack.equals(internetProtocol)) {
+                ipv6GlobalRouting = true;
+            }
+        }
+
+        String netrisGateway = null;
+        if (!isL2 && vnetCidr != null && cmd.getGateway() != null) {
+            String netmask = vnetCidr.split("/")[1];
+            netrisGateway = cmd.getGateway() + "/" + netmask;
+        }
+        String netrisV6Cidr = cmd.getIpv6Cidr();
+
+        VPCListing associatedVpc = null;
+        String netrisSubnetName = null;
+        String netrisV6IpamAllocationName = null;
+        String netrisV6SubnetName = null;
+        boolean createdIpv6Allocation = false;
+        boolean createdL2Vpc = false;
 
         try {
-            String netrisVpcName = getNetrisVpcName(cmd, vpcId, vpcName);
-            VPCListing associatedVpc = getNetrisVpcResource(netrisVpcName);
-            if (associatedVpc == null) {
-                logger.error("Failed to find Netris VPC with name: {}, to create the corresponding vNet for network {}", netrisVpcName, networkName);
-                return false;
+            if (isL2) {
+                createdL2Vpc = getVpcByNameAndTenant(getL2VpcName(cmd, cmd.getName())) == null;
+                associatedVpc = getOrCreateL2Vpc(cmd);
+                if (associatedVpc == null) {
+                    logger.error("Failed to get or create dedicated L2 VPC to create the corresponding vNet for L2 network {}", networkName);
+                    return false;
+                }
+            } else {
+                String netrisVpcName = getNetrisVpcName(cmd, vpcId, vpcName);
+                associatedVpc = getNetrisVpcResource(netrisVpcName);
+                if (associatedVpc == null) {
+                    logger.error("Failed to find Netris VPC with name: {}, to create the corresponding vNet for network {}", netrisVpcName, networkName);
+                    return false;
+                }
             }
 
             String vNetName;
@@ -1179,31 +1285,48 @@ public boolean createVnet(CreateNetrisVnetCommand cmd) {
             } else {
                 vNetName = String.format("N%s-%s", networkId, networkName);
             }
-            String netrisVnetName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.VNET, vNetName) ;
-            String netrisSubnetName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.IPAM_SUBNET, String.valueOf(cmd.getVpcId()), vnetCidr) ;
-
-            createIpamSubnetInternal(netrisSubnetName, vnetCidr, SubnetBody.PurposeEnum.COMMON, associatedVpc, isGlobalRouting);
-            if (Objects.nonNull(netrisV6Cidr)) {
-                String netrisV6IpamAllocationName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.IPAM_ALLOCATION, netrisV6Cidr);
-                String netrisV6SubnetName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.IPAM_SUBNET,  String.valueOf(cmd.getVpcId()), netrisV6Cidr) ;
-                BigDecimal ipamAllocationId = getIpamAllocationIdByPrefixAndVpc(netrisV6Cidr, associatedVpc);
-                if (ipamAllocationId == null) {
-                    InlineResponse2004Data createdIpamAllocation = createIpamAllocationInternal(netrisV6IpamAllocationName, netrisV6Cidr, associatedVpc);
-                    if (Objects.isNull(createdIpamAllocation)) {
-                        throw new CloudRuntimeException(String.format("Failed to create Netris IPAM Allocation %s for VPC %s", netrisV6IpamAllocationName, netrisVpcName));
+            String netrisVnetName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.VNET, vNetName);
+            NetrisResourceObjectUtils.validateNetrisVnetNameLength(netrisVnetName, networkName);
+
+            if (!isL2) {
+                netrisSubnetName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.IPAM_SUBNET, String.valueOf(cmd.getVpcId()), vnetCidr);
+                createIpamSubnetInternal(netrisSubnetName, vnetCidr, SubnetBody.PurposeEnum.COMMON, associatedVpc, ipv4GlobalRouting);
+                if (Objects.nonNull(netrisV6Cidr)) {
+                    netrisV6IpamAllocationName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.IPAM_ALLOCATION, netrisV6Cidr);
+                    netrisV6SubnetName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.IPAM_SUBNET, String.valueOf(cmd.getVpcId()), netrisV6Cidr);
+                    BigDecimal ipamAllocationId = getIpamAllocationIdByPrefixAndVpc(netrisV6Cidr, associatedVpc);
+                    if (ipamAllocationId == null) {
+                        InlineResponse2004Data createdIpamAllocationData = createIpamAllocationInternal(netrisV6IpamAllocationName, netrisV6Cidr, associatedVpc);
+                        if (Objects.isNull(createdIpamAllocationData)) {
+                            rollbackVnetResources(associatedVpc, netrisSubnetName, null, null, networkName);
+                            throw new CloudRuntimeException(String.format("Failed to create Netris IPAM Allocation %s for VPC %s", netrisV6IpamAllocationName, associatedVpc.getName()));
+                        }
+                        createdIpv6Allocation = true;
                     }
+                    createIpamSubnetInternal(netrisV6SubnetName, netrisV6Cidr, SubnetBody.PurposeEnum.COMMON, associatedVpc, ipv6GlobalRouting);
                 }
-                createIpamSubnetInternal(netrisV6SubnetName, netrisV6Cidr, SubnetBody.PurposeEnum.COMMON, associatedVpc, isGlobalRouting);
+                logger.debug("Successfully created IPAM Subnet for network {} on Netris", networkName);
             }
-            logger.debug("Successfully created IPAM Subnet {} for network {} on Netris", netrisSubnetName, networkName);
 
-            VnetResAddBody vnetResponse = createVnetInternal(associatedVpc, netrisVnetName, netrisGateway, netrisV6Cidr, vxlanId, netrisTag);
+            VnetResAddBody vnetResponse = createVnetInternal(associatedVpc, netrisVnetName, netrisGateway, isL2 ? null : netrisV6Cidr, vxlanId, netrisTag);
             if (vnetResponse == null || !vnetResponse.isIsSuccess()) {
                 String reason = vnetResponse == null ? "Empty response" : "Operation failed on Netris";
                 logger.debug("The Netris vNet creation {} failed: {}", vNetName, reason);
+                if (!isL2) {
+                    rollbackVnetResources(associatedVpc, netrisSubnetName, netrisV6SubnetName,
+                            createdIpv6Allocation ? netrisV6IpamAllocationName : null, networkName);
+                } else if (createdL2Vpc) {
+                    rollbackL2Vpc(associatedVpc);
+                }
                 return false;
             }
-        } catch (ApiException e) {
+        } catch (Exception e) {
+            if (!isL2 && associatedVpc != null) {
+                rollbackVnetResources(associatedVpc, netrisSubnetName, netrisV6SubnetName,
+                        createdIpv6Allocation ? netrisV6IpamAllocationName : null, networkName);
+            } else if (isL2 && createdL2Vpc && associatedVpc != null) {
+                rollbackL2Vpc(associatedVpc);
+            }
             throw new CloudRuntimeException(String.format("Failed to create Netris vNet %s", networkName), e);
         }
         return true;
@@ -1217,11 +1340,12 @@ public boolean updateVnet(UpdateNetrisVnetCommand cmd) {
         String vpcName = cmd.getVpcName();
         Long vpcId = cmd.getVpcId();
         boolean isVpc = cmd.isVpc();
+        boolean isL2 = cmd.isL2();
+
+        VPCListing associatedVpc = getAssociatedVPC(cmd);
 
-        String netrisVpcName = getNetrisVpcName(cmd, vpcId, vpcName);
-        VPCListing associatedVpc = getNetrisVpcResource(netrisVpcName);
         if (associatedVpc == null) {
-            logger.error("Failed to find Netris VPC with name: {}, to create the corresponding vNet for network {}", netrisVpcName, networkName);
+            logger.error("Failed to find Netris VPC with name: {}, to update the corresponding vNet for network {}", vpcName, networkName);
             return false;
         }
 
@@ -1237,15 +1361,39 @@ public boolean updateVnet(UpdateNetrisVnetCommand cmd) {
         String netrisVnetName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.VNET, vNetName) ;
         String prevNetrisVnetName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.VNET, prevVnetName) ;
 
+        NetrisResourceObjectUtils.validateNetrisVnetNameLength(netrisVnetName, networkName);
         VnetResAddBody response = updateVnetInternal(associatedVpc, netrisVnetName, prevNetrisVnetName);
         if (response == null || !response.isIsSuccess()) {
             String reason = response == null ? "Empty response" : "Operation failed on Netris";
             logger.debug("Netris vNet: {} update failed: {}", vNetName, reason);
             return false;
         }
+        if (isL2) {
+            String netrisNewVpcName = String.format("D%s-A%s-Z%s-N%s-%s", cmd.getDomainId(), cmd.getAccountId(), cmd.getZoneId(), networkId, networkName);
+            VpcEditResponseOK updatedVpc = updateVpcInternal(netrisNewVpcName, associatedVpc.getName(), tenantId, tenantName);
+            return validateNetrisVpcUpdateResponse(updatedVpc, associatedVpc.getName());
+        }
         return true;
     }
 
+    private VPCListing getAssociatedVPC(UpdateNetrisVnetCommand cmd) {
+        VPCListing associatedVpc;
+        boolean isL2 = cmd.isL2();
+        if (isL2) {
+            String l2VpcName = getL2VpcName(cmd, cmd.getPrevNetworkName());
+            associatedVpc = getVpcByNameAndTenant(l2VpcName);
+            if (associatedVpc == null) {
+                logger.error("Failed to find dedicated L2 VPC {} to update the corresponding vNet for L2 network {}", l2VpcName, cmd.getName());
+            }
+        } else {
+            Long vpcId = cmd.getVpcId();
+            String vpcName = cmd.getVpcName();
+            String netrisVpcName = getNetrisVpcName(cmd, vpcId, vpcName);
+            associatedVpc = getNetrisVpcResource(netrisVpcName);
+        }
+        return associatedVpc;
+    }
+
     private VnetResAddBody updateVnetInternal(VPCListing associatedVpc, String netrisVnetName, String prevVnetName) {
         logger.debug("Updating Netris vNet name from {} to {} ", netrisVnetName, prevVnetName);
         try {
@@ -1263,24 +1411,27 @@ private VnetResAddBody updateVnetInternal(VPCListing associatedVpc, String netri
 
             vnetBody.setCustomAnycastMac(vnetBody.getCustomAnycastMac());
 
-            VnetEditBodyGateways gatewayV4 = new VnetEditBodyGateways();
-            gatewayV4.prefix(vnetsBody.getGateways().get(0).getPrefix());
-            gatewayV4.setDhcpEnabled(false);
-            VnetEditBodyDhcp dhcp = new VnetEditBodyDhcp();
-            dhcp.setEnd("");
-            dhcp.setStart("");
-            dhcp.setOptionSet(new VnetAddBodyDhcpOptionSet());
-            gatewayV4.setDhcp(dhcp);
             List<VnetEditBodyGateways> gatewaysList = new ArrayList<>();
-            gatewaysList.add(gatewayV4);
-
-            if (vnetsBody.getGateways().size() > 1 && Objects.nonNull(vnetsBody.getGateways().get(1))) {
-                String netrisV6Gateway = vnetsBody.getGateways().get(1).getPrefix();
-                VnetEditBodyGateways gatewayV6 = new VnetEditBodyGateways();
-                gatewayV6.prefix(netrisV6Gateway);
-                gatewayV6.setDhcpEnabled(false);
-                gatewayV6.setDhcp(dhcp);
-                gatewaysList.add(gatewayV6);
+            List<VnetsBodyGateways> existingGateways = vnetsBody.getGateways();
+            if (!CollectionUtils.isEmpty(existingGateways)) {
+                VnetEditBodyDhcp dhcp = new VnetEditBodyDhcp();
+                dhcp.setEnd("");
+                dhcp.setStart("");
+                dhcp.setOptionSet(new VnetAddBodyDhcpOptionSet());
+
+                VnetEditBodyGateways gatewayV4 = new VnetEditBodyGateways();
+                gatewayV4.prefix(vnetsBody.getGateways().get(0).getPrefix());
+                gatewayV4.setDhcpEnabled(false);
+                gatewayV4.setDhcp(dhcp);
+                gatewaysList.add(gatewayV4);
+
+                if (existingGateways.size() > 1 && Objects.nonNull(vnetsBody.getGateways().get(1))) {
+                    VnetEditBodyGateways gatewayV6 = new VnetEditBodyGateways();
+                    gatewayV6.prefix(vnetsBody.getGateways().get(1).getPrefix());
+                    gatewayV6.setDhcpEnabled(false);
+                    gatewayV6.setDhcp(dhcp);
+                    gatewaysList.add(gatewayV6);
+                }
             }
 
             vnetBody.setGateways(gatewaysList);
@@ -1333,14 +1484,25 @@ public boolean deleteVnet(DeleteNetrisVnetCommand cmd) {
         String networkName = cmd.getName();
         Long networkId = cmd.getId();
         boolean isVpc = cmd.isVpc();
+        boolean isL2 = cmd.isL2();
         String vnetCidr = cmd.getVNetCidr();
         String vnetV6Cidr = cmd.getvNetV6Cidr();
         try {
-            String netrisVpcName = getNetrisVpcName(cmd, vpcId, vpcName);
-            VPCListing associatedVpc = getNetrisVpcResource(netrisVpcName);
-            if (associatedVpc == null) {
-                logger.error("Failed to find Netris VPC with name: {}, to create the corresponding vNet for network {}", netrisVpcName, networkName);
-                return false;
+            VPCListing associatedVpc;
+            if (isL2) {
+                String l2VpcName = getL2VpcName(cmd, networkName);
+                associatedVpc = getVpcByNameAndTenant(l2VpcName);
+                if (associatedVpc == null) {
+                    logger.warn("Dedicated L2 VPC {} not found on Netris — vNet for network {} may have already been deleted", l2VpcName, networkName);
+                    return true;
+                }
+            } else {
+                String netrisVpcName = getNetrisVpcName(cmd, vpcId, vpcName);
+                associatedVpc = getNetrisVpcResource(netrisVpcName);
+                if (associatedVpc == null) {
+                    logger.error("Failed to find Netris VPC with name: {}, to delete the corresponding vNet for network {}", netrisVpcName, networkName);
+                    return false;
+                }
             }
 
             String vNetName;
@@ -1350,19 +1512,28 @@ public boolean deleteVnet(DeleteNetrisVnetCommand cmd) {
                 vNetName = String.format("N%s-%s", networkId, networkName);
             }
 
-            String netrisVnetName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.VNET, vNetName) ;
-            String netrisSubnetName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.IPAM_SUBNET, String.valueOf(cmd.getVpcId()), vnetCidr);
+            String netrisVnetName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.VNET, vNetName);
             FilterByVpc vpcFilter = new FilterByVpc();
             vpcFilter.add(associatedVpc.getId());
             deleteVnetInternal(associatedVpc, vpcFilter, netrisVnetName, vNetName);
-
             logger.debug("Successfully deleted vNet {}", vNetName);
-            deleteSubnetInternal(vpcFilter, netrisVnetName, netrisSubnetName);
-            if (Objects.nonNull(vnetV6Cidr)) {
-                String netrisV6IpamAllocationName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.IPAM_ALLOCATION, vnetV6Cidr);
-                String netrisV6SubnetName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.IPAM_SUBNET, String.valueOf(cmd.getVpcId()), vnetV6Cidr);
-                deleteSubnetInternal(vpcFilter, netrisVnetName, netrisV6SubnetName);
-                deleteVpcIpamAllocationInternal(associatedVpc, netrisV6IpamAllocationName);
+
+            if (isL2) {
+                // Delete the dedicated L2 VPC now that its only vNet is gone
+                logger.debug("Deleting dedicated L2 VPC {} on Netris", associatedVpc.getName());
+                VPCResponseObjectOK deleteResponse = deleteVpcInternal(associatedVpc);
+                if (deleteResponse == null || !deleteResponse.isIsSuccess()) {
+                    logger.warn("Failed to delete dedicated L2 VPC {} after vNet deletion — manual cleanup may be required", associatedVpc.getName());
+                }
+            } else {
+                String netrisSubnetName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.IPAM_SUBNET, String.valueOf(cmd.getVpcId()), vnetCidr);
+                deleteSubnetInternal(vpcFilter, netrisVnetName, netrisSubnetName);
+                if (Objects.nonNull(vnetV6Cidr)) {
+                    String netrisV6IpamAllocationName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.IPAM_ALLOCATION, vnetV6Cidr);
+                    String netrisV6SubnetName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.IPAM_SUBNET, String.valueOf(cmd.getVpcId()), vnetV6Cidr);
+                    deleteSubnetInternal(vpcFilter, netrisVnetName, netrisV6SubnetName);
+                    deleteVpcIpamAllocationInternal(associatedVpc, netrisV6IpamAllocationName);
+                }
             }
 
         } catch (Exception e) {
@@ -1542,6 +1713,18 @@ public boolean createStaticNatRule(CreateOrUpdateNetrisNatCommand cmd) {
                 logger.error("Could not find the Netris VPC resource with name {} and tenant ID {}", netrisVpcName, tenantId);
                 return false;
             }
+
+            NatGetBody existingRule = netrisNatRuleExists(staticNatRuleName);
+            if (existingRule != null) {
+                logger.debug("Static NAT rule '{}' already exists on Netris, skipping creation", staticNatRuleName);
+                return true;
+            }
+            // Backward compatibility: rule with legacy naming convention (no public IP post-fixed) exists - don't create a duplicate
+            NatGetBody legacyRule = findLegacyStaticNatRule(staticNatRuleName, cmd.getNatIp());
+            if (legacyRule != null) {
+                logger.debug("Legacy static NAT rule '{}' already exists on Netris, skipping creation of '{}'", legacyRule.getName(), staticNatRuleName);
+                return true;
+            }
             // Create a /32 subnet for the DNAT IP
             createNatSubnet(cmd, natIP, vpcResource.getId());
             NatApi natApi = apiClient.getApiStubForMethod(NatApi.class);
@@ -1590,12 +1773,12 @@ private void createNatSubnet(NetrisCommand cmd, String natIp, Integer netrisVpcI
                 IpTreeSubnet existingSubnet = matchedSubnets.stream().filter(x -> x.getPrefix().equals(natIp)).collect(Collectors.toList()).get(0);
                 if (existingSubnet.getPurpose() != IpTreeSubnet.PurposeEnum.NAT) {
                     VPCListing systemVpc = getSystemVpc();
-                    logger.debug("Subnet: {} already exists, but purpose is not NAT, updating its purpose to 'nat'", natIp);
+                    logger.debug("Subnet: {} already exists with purpose '{}', updating its purpose to 'nat'", natIp, existingSubnet.getPurpose());
                     updateIpamSubnetInternal(existingSubnet.getId().intValue(), netrisSubnetName, natIp, SubnetBody.PurposeEnum.NAT, systemVpc, null);
                 }
             }
         } catch (ApiException e) {
-            throw new CloudRuntimeException(String.format("Failed to create subnet for %s with NAT purpose", natIp));
+            logAndThrowException(String.format("Failed to create subnet for %s with NAT purpose (current purpose conflicts and could not be changed)", natIp), e);
         }
     }
 
@@ -1611,12 +1794,13 @@ private void createLBSubnet(NetrisCommand cmd, String lbIp, Integer netrisVpcId)
             if (matchedSubnets.isEmpty()) {
                 createIpamSubnetInternal(netrisSubnetName, lbIp, SubnetBody.PurposeEnum.LOAD_BALANCER, systemVpc, null);
             } else if (IpTreeSubnet.PurposeEnum.LOAD_BALANCER != matchedSubnets.get(0).getPurpose()){
-                logger.debug("Updating existing NAT subnet {} to have load balancer purpose", netrisSubnetName);
-                updateIpamSubnetInternal(matchedSubnets.get(0).getId().intValue(), netrisSubnetName, lbIp, SubnetBody.PurposeEnum.LOAD_BALANCER, systemVpc, null);
+                IpTreeSubnet existingSubnet = matchedSubnets.get(0);
+                logger.debug("Updating existing NAT subnet {} with purpose '{}' to have load balancer purpose", netrisSubnetName, existingSubnet.getPurpose());
+                updateIpamSubnetInternal(existingSubnet.getId().intValue(), netrisSubnetName, lbIp, SubnetBody.PurposeEnum.LOAD_BALANCER, systemVpc, null);
             }
             logger.debug("LB subnet: {} already exists", netrisSubnetName);
         } catch (ApiException e) {
-            throw new CloudRuntimeException(String.format("Failed to create subnet for %s with LB purpose", lbIp));
+            logAndThrowException(String.format("Failed to create subnet for %s with LB purpose (current purpose conflicts and could not be changed)", lbIp), e);
         }
     }
 
@@ -1813,6 +1997,26 @@ private void deleteSubnetInternal(FilterByVpc vpcFilter, String netrisVnetName,
         }
     }
 
+    private void rollbackVnetResources(VPCListing associatedVpc, String ipv4SubnetName, String ipv6SubnetName,
+                                       String ipv6AllocationName, String networkName) {
+        logger.warn("Rolling back Netris resources created for network {}", networkName);
+        FilterByVpc vpcFilter = new FilterByVpc();
+        vpcFilter.add(associatedVpc.getId());
+        try {
+            if (ipv6SubnetName != null) {
+                deleteSubnetInternal(vpcFilter, null, ipv6SubnetName);
+            }
+            if (ipv6AllocationName != null) {
+                deleteVpcIpamAllocationInternal(associatedVpc, ipv6AllocationName);
+            }
+            if (ipv4SubnetName != null) {
+                deleteSubnetInternal(vpcFilter, null, ipv4SubnetName);
+            }
+        } catch (Exception e) {
+            logger.error("Failed to rollback Netris resources for network {} - manual cleanup may be required: {}", networkName, e.getMessage());
+        }
+    }
+
     private SubnetBody getIpamSubnetBody(VPCListing vpc, SubnetBody.PurposeEnum purpose, String subnetName, String subnetPrefix, Boolean isGlobalRouting) {
         SubnetBody subnetBody = new SubnetBody();
         subnetBody.setName(subnetName);
@@ -1886,24 +2090,8 @@ VnetResAddBody createVnetInternal(VPCListing associatedVpc, String netrisVnetNam
 
             vnetBody.setCustomAnycastMac("");
 
-            VnetAddBodyGateways gatewayV4 = new VnetAddBodyGateways();
-            gatewayV4.prefix(netrisGateway);
-            gatewayV4.setDhcpEnabled(false);
-            VnetAddBodyDhcp dhcp = new VnetAddBodyDhcp();
-            dhcp.setEnd("");
-            dhcp.setStart("");
-            dhcp.setOptionSet(new VnetAddBodyDhcpOptionSet());
-            gatewayV4.setDhcp(dhcp);
             List<VnetAddBodyGateways> gatewaysList = new ArrayList<>();
-            gatewaysList.add(gatewayV4);
-
-            if (Objects.nonNull(netrisV6Cidr)) {
-                VnetAddBodyGateways gatewayV6 = new VnetAddBodyGateways();
-                gatewayV6.prefix(NetUtils.getIpv6Gateway(netrisV6Cidr));
-                gatewayV6.setDhcpEnabled(false);
-                gatewayV6.setDhcp(dhcp);
-                gatewaysList.add(gatewayV6);
-            }
+            updateGatewayList(gatewaysList, netrisGateway, netrisV6Cidr);
 
             vnetBody.setGateways(gatewaysList);
             vnetBody.setGuestTenants(new ArrayList<>());
@@ -1948,6 +2136,32 @@ VnetResAddBody createVnetInternal(VPCListing associatedVpc, String netrisVnetNam
         }
     }
 
+    private void updateGatewayList(List<VnetAddBodyGateways> gatewaysList, String netrisGateway, String netrisV6Cidr) {
+        if (netrisGateway != null) {
+            VnetAddBodyGateways gatewayV4 = new VnetAddBodyGateways();
+            gatewayV4.prefix(netrisGateway);
+            gatewayV4.setDhcpEnabled(false);
+            VnetAddBodyDhcp dhcp = new VnetAddBodyDhcp();
+            dhcp.setEnd("");
+            dhcp.setStart("");
+            dhcp.setOptionSet(new VnetAddBodyDhcpOptionSet());
+            gatewayV4.setDhcp(dhcp);
+            gatewaysList.add(gatewayV4);
+
+            if (Objects.nonNull(netrisV6Cidr)) {
+                VnetAddBodyDhcp dhcpV6 = new VnetAddBodyDhcp();
+                dhcpV6.setEnd("");
+                dhcpV6.setStart("");
+                dhcpV6.setOptionSet(new VnetAddBodyDhcpOptionSet());
+                VnetAddBodyGateways gatewayV6 = new VnetAddBodyGateways();
+                gatewayV6.prefix(NetUtils.getIpv6Gateway(netrisV6Cidr));
+                gatewayV6.setDhcpEnabled(false);
+                gatewayV6.setDhcp(dhcpV6);
+                gatewaysList.add(gatewayV6);
+            }
+        }
+    }
+
     private String getNetrisVpcNameSuffix(Long vpcId, String vpcName, Long networkId, String networkName, boolean isVpc) {
         String suffix = null;
         if (isVpc) {
@@ -1971,12 +2185,40 @@ private NatGetBody netrisNatRuleExists(String netrisNatRule) {
                 return null;
             }
             return data.get(0);
-
         } catch (ApiException e) {
             throw new CloudRuntimeException("Failed to list Netris NAT rules");
         }
     }
 
+    /**
+     * Derives the legacy static NAT rule name (without the public IP suffix) from the new name format.
+     * New format: ...-VM{vmId}-STATICNAT-{publicIp}
+     * Legacy format: ...-VM{vmId}-STATICNAT
+     * Returns null if the name doesn't match the new format.
+     */
+    private String getLegacyStaticNatRuleName(String newName) {
+        int idx = newName.indexOf("-STATICNAT-");
+        if (idx == -1) {
+            return null;
+        }
+        return newName.substring(0, idx + "-STATICNAT".length());
+    }
+
+    /**
+     * Returns the legacy-named static NAT rule only if it was created for the given public IP.
+     */
+    private NatGetBody findLegacyStaticNatRule(String newName, String natIp) {
+        String legacyName = getLegacyStaticNatRuleName(newName);
+        if (legacyName == null) {
+            return null;
+        }
+        NatGetBody legacyRule = netrisNatRuleExists(legacyName);
+        if (legacyRule == null || !(natIp + "/32").equals(legacyRule.getDestinationAddress())) {
+            return null;
+        }
+        return legacyRule;
+    }
+
     private VPCListing getNetrisVpcResource(String netrisVpcName) {
         VPCListing vpcResource = getVpcByNameAndTenant(netrisVpcName);
         if (vpcResource == null) {
diff --git a/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisElement.java b/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisElement.java
index 0e798ebb6be1..0e716cc4979a 100644
--- a/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisElement.java
+++ b/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisElement.java
@@ -199,8 +199,12 @@ protected static Map<Network.Service, Map<Network.Capability, String>> initCapab
         Map<Network.Capability, String> sourceNatCapabilities = new HashMap<>();
         sourceNatCapabilities.put(Network.Capability.RedundantRouter, "true");
         sourceNatCapabilities.put(Network.Capability.SupportedSourceNatTypes, "peraccount");
-        capabilities.put(Network.Service.Gateway, null);
         capabilities.put(Network.Service.SourceNat, sourceNatCapabilities);
+
+        final Map<Network.Capability, String> gatewayCapabilities = new HashMap<>();
+        gatewayCapabilities.put(Network.Capability.RedundantRouter, "true");
+        capabilities.put(Network.Service.Gateway, gatewayCapabilities);
+
         return capabilities;
     }
 
@@ -360,8 +364,12 @@ public boolean shutdown(Network network, ReservationContext context, boolean cle
 
     @Override
     public boolean destroy(Network network, ReservationContext context) throws ConcurrentOperationException, ResourceUnavailableException {
-        Account account = accountManager.getAccount(network.getAccountId());
         NetworkVO networkVO = networkDao.findById(network.getId());
+        if (Network.GuestType.L2.equals(networkVO.getGuestType())) {
+            logger.trace("Skipping NetrisElement.destroy() for L2 network {} - handled by guru trash()", network.getId());
+            return true;
+        }
+        Account account = accountManager.getAccount(network.getAccountId());
         DataCenterVO zone = dataCenterDao.findById(network.getDataCenterId());
         DomainVO domain = domainDao.findById(account.getDomainId());
         if (Objects.isNull(zone)) {
@@ -377,7 +385,7 @@ public boolean destroy(Network network, ReservationContext context) throws Concu
                 vpcName = vpc.getName();
             }
         }
-        netrisService.deleteVnetResource(zone.getId(), account.getId(), domain.getId(), vpcName, vpcId, networkVO.getName(), network.getId(), network.getCidr());
+        netrisService.deleteVnetResource(zone.getId(), account.getId(), domain.getId(), vpcName, vpcId, networkVO.getName(), network.getId(), network.getCidr(), false);
         return true;
     }
 
@@ -622,7 +630,7 @@ private boolean applyPFRulesInternal(Network network, List<PortForwardingRule> r
                 .setNetworkResourceName(netrisObject.getNetworkResourceName())
                 .setVpcResource(netrisObject.isVpcResource())
                 .setVmId(Objects.nonNull(vm) ? vm.getId() : 0)
-                .setVmIp(Objects.nonNull(vm) ? vm.getPrivateIpAddress() : null)
+                .setVmIp(rule.getDestinationIpAddress().addr())
                 .setPublicIp(publicIp.getAddress().addr())
                 .setPrivatePort(privatePort)
                 .setPublicPort(publicPort)
diff --git a/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisGuestNetworkGuru.java b/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisGuestNetworkGuru.java
index df566e90b67d..de745626cea8 100644
--- a/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisGuestNetworkGuru.java
+++ b/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisGuestNetworkGuru.java
@@ -17,6 +17,7 @@
 package org.apache.cloudstack.service;
 
 import com.cloud.dc.DataCenter;
+import com.cloud.dc.DataCenterVO;
 import com.cloud.deploy.DeployDestination;
 import com.cloud.deploy.DeploymentPlan;
 import com.cloud.domain.DomainVO;
@@ -44,6 +45,7 @@
 import com.cloud.user.Account;
 import com.cloud.utils.db.DB;
 import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.utils.net.NetUtils;
 import com.cloud.vm.NicProfile;
 import com.cloud.vm.ReservationContext;
 import com.cloud.vm.VirtualMachine;
@@ -51,6 +53,7 @@
 import org.apache.cloudstack.api.ApiCommandResourceType;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.resource.NetrisResourceObjectUtils;
 
 import javax.inject.Inject;
 import java.util.Objects;
@@ -75,10 +78,12 @@ public NetrisGuestNetworkGuru() {
     @Override
     public boolean canHandle(NetworkOffering offering, DataCenter.NetworkType networkType,
                              PhysicalNetwork physicalNetwork) {
+        NetworkOffering.NetworkMode networkMode = NetrisResourceObjectUtils.getNetworkMode(offering.getNetworkMode());
         return networkType == DataCenter.NetworkType.Advanced && isMyTrafficType(offering.getTrafficType())
-                && isMyIsolationMethod(physicalNetwork) && (NetworkOffering.NetworkMode.ROUTED.equals(offering.getNetworkMode())
+                && isMyIsolationMethod(physicalNetwork) && (NetworkOffering.NetworkMode.ROUTED.equals(networkMode)
                 || (networkOfferingServiceMapDao.isProviderForNetworkOffering(
-                offering.getId(), Network.Provider.Netris) && NetworkOffering.NetworkMode.NATTED.equals(offering.getNetworkMode())));
+                offering.getId(), Network.Provider.Netris) && NetworkOffering.NetworkMode.NATTED.equals(networkMode))
+                || (Network.GuestType.L2.equals(offering.getGuestType())));
     }
 
     @Override
@@ -174,8 +179,10 @@ public boolean update(Network network, String prevNetworkName) {
                 vpcName = vpc.getName();
             }
         }
+        NetworkOfferingVO networkOfferingVO = networkOfferingDao.findById(network.getNetworkOfferingId());
+        boolean isL2 = networkOfferingVO != null && Network.GuestType.L2.equals(networkOfferingVO.getGuestType());
         return netrisService.updateVnetResource(network.getDataCenterId(), network.getAccountId(), network.getDomainId(),
-                vpcName, vpcId, network.getName(), network.getId(), prevNetworkName);
+                vpcName, vpcId, network.getName(), network.getId(), prevNetworkName, isL2);
     }
 
     @Override
@@ -201,7 +208,8 @@ public Network implement(Network network, NetworkOffering offering, DeployDestin
         if (network.getName() != null) {
             implemented.setName(network.getName());
         }
-        allocateVnet(network, implemented, network.getDataCenterId(), network.getPhysicalNetworkId(), network.getReservationId());
+
+        allocateVnet(network, implemented, network.getDataCenterId(), network.getPhysicalNetworkId(), context != null ? context.getReservationId() : null);
         return implemented;
     }
 
@@ -210,12 +218,13 @@ protected void allocateVnet(Network network, NetworkVO implemented, long dcId, l
             throws InsufficientVirtualNetworkCapacityException {
         String vnet = null;
         Long networkId = implemented.getId() > 0 ? implemented.getId() : network.getId();
+        long accountId = implemented.getAccountId() > 0 ? implemented.getAccountId() : network.getAccountId();
         if (network.getBroadcastUri() == null) {
             NetworkDetailVO netrisVnetDetail = networkDetailsDao.findDetail(networkId, ApiConstants.NETRIS_VXLAN_ID);
             if (nonNull(netrisVnetDetail)) {
                 vnet = netrisVnetDetail.getValue();
             } else {
-                vnet = _dcDao.allocateVnet(dcId, physicalNetworkId, network.getAccountId(), reservationId, UseSystemGuestVlans.valueIn(network.getAccountId()));
+                vnet = _dcDao.allocateVnet(dcId, physicalNetworkId, accountId, reservationId, UseSystemGuestVlans.valueIn(accountId));
                 if (vnet == null) {
                     throw new InsufficientVirtualNetworkCapacityException("Unable to allocate vnet as a " + "part of network " + network + " implement ", DataCenter.class,
                             dcId);
@@ -223,7 +232,7 @@ protected void allocateVnet(Network network, NetworkVO implemented, long dcId, l
                 networkDetailsDao.addDetail(networkId, ApiConstants.NETRIS_VXLAN_ID, vnet, true);
             }
             implemented.setBroadcastUri(Networks.BroadcastDomainType.Netris.toUri(vnet));
-            ActionEventUtils.onCompletedActionEvent(CallContext.current().getCallingUserId(), network.getAccountId(), EventVO.LEVEL_INFO, EventTypes.EVENT_ZONE_VXLAN_ASSIGN,
+            ActionEventUtils.onCompletedActionEvent(CallContext.current().getCallingUserId(), accountId, EventVO.LEVEL_INFO, EventTypes.EVENT_ZONE_VXLAN_ASSIGN,
                     "Assigned Zone vNet: " + vnet + " Network Id: " + networkId, networkId, ApiCommandResourceType.Network.toString(), 0);
         } else {
             implemented.setBroadcastUri(network.getBroadcastUri());
@@ -264,8 +273,8 @@ public NicProfile allocate(Network network, NicProfile nic, VirtualMachineProfil
         }
 
         NetworkOfferingVO networkOfferingVO = networkOfferingDao.findById(network.getNetworkOfferingId());
-
-        if (isNull(network.getVpcId()) && networkOfferingVO.getNetworkMode().equals(NetworkOffering.NetworkMode.NATTED)) {
+        NetworkOffering.NetworkMode networkMode = NetrisResourceObjectUtils.getNetworkMode(networkOfferingVO.getNetworkMode());
+        if (isNull(network.getVpcId()) && NetworkOffering.NetworkMode.NATTED.equals(networkMode)) {
             // Netris Natted mode
             long domainId = domain.getId();
             long accountId = account.getId();
@@ -299,6 +308,80 @@ public void commitMigration(NicProfile nic, Network network, VirtualMachineProfi
         // Do nothing
     }
 
+    private void releaseAllocatedVnet(Network network) {
+        String vxlanId = null;
+        if (Objects.nonNull(network.getBroadcastUri())) {
+            vxlanId = Networks.BroadcastDomainType.getValue(network.getBroadcastUri());
+        } else {
+            NetworkDetailVO vxlanDetail = networkDetailsDao.findDetail(network.getId(), ApiConstants.NETRIS_VXLAN_ID);
+            if (Objects.nonNull(vxlanDetail)) {
+                vxlanId = vxlanDetail.getValue();
+            }
+        }
+
+        if (Objects.isNull(vxlanId)) {
+            logger.debug("No VXLAN allocated for Netris network {}, nothing to release", network.getId());
+            return;
+        }
+
+        logger.debug("Releasing VXLAN {} for Netris network {}", vxlanId, network.getId());
+        _dcDao.releaseVnet(vxlanId, network.getDataCenterId(), network.getPhysicalNetworkId(),
+                network.getAccountId(), network.getReservationId());
+        // Attempt to clean up with null reservation ID
+        _dcDao.releaseVnet(vxlanId, network.getDataCenterId(), network.getPhysicalNetworkId(),
+                network.getAccountId(), null);
+        if (network.getAccountId() != 0) {
+            _dcDao.releaseVnet(vxlanId, network.getDataCenterId(), network.getPhysicalNetworkId(),
+                    0L, null);
+        }
+        ActionEventUtils.onCompletedActionEvent(CallContext.current().getCallingUserId(), network.getAccountId(),
+                EventVO.LEVEL_INFO, EventTypes.EVENT_ZONE_VXLAN_RELEASE,
+                "Released Zone vNet: " + vxlanId + " for Network: " + network.getId(),
+                network.getDataCenterId(), ApiCommandResourceType.Zone.toString(), 0);
+
+        NetworkDetailVO vxlanDetail = networkDetailsDao.findDetail(network.getId(), ApiConstants.NETRIS_VXLAN_ID);
+        if (Objects.nonNull(vxlanDetail)) {
+            networkDetailsDao.removeDetail(network.getId(), ApiConstants.NETRIS_VXLAN_ID);
+        }
+    }
+
+    @Override
+    public boolean trash(Network network, NetworkOffering offering) {
+        if (Network.GuestType.L2.equals(offering.getGuestType())) {
+            NetworkVO networkVO = _networkDao.findById(network.getId());
+            if (networkVO == null) {
+                logger.warn("Could not find network {} to trash, skipping Netris L2 cleanup", network.getId());
+                return super.trash(network, offering);
+            }
+
+            DataCenterVO zone = _dcDao.findById(network.getDataCenterId());
+            if (Objects.isNull(zone)) {
+                logger.error("Cannot find zone with ID {} while trashing L2 Netris network {}", network.getDataCenterId(), network.getId());
+                return false;
+            }
+
+            Account account = accountDao.findById(network.getAccountId());
+            if (Objects.isNull(account)) {
+                logger.error("Cannot find account with ID {} while trashing L2 Netris network {}", network.getAccountId(), network.getId());
+                return false;
+            }
+
+            DomainVO domain = domainDao.findById(account.getDomainId());
+            if (Objects.isNull(domain)) {
+                logger.error("Cannot find domain with ID {} while trashing L2 Netris network {}", account.getDomainId(), network.getId());
+                return false;
+            }
+
+            logger.debug("Trashing L2 Netris network {}, deleting Netris vNet resource", network.getId());
+            netrisService.deleteVnetResource(zone.getId(), account.getId(), domain.getId(),
+                    null, null, networkVO.getName(), network.getId(), network.getCidr(), true);
+        }
+
+        releaseAllocatedVnet(network);
+
+        return super.trash(network, offering);
+    }
+
     public void createNetrisVnet(NetworkVO networkVO, DataCenter zone) {
         Account account = accountDao.findById(networkVO.getAccountId());
         if (isNull(account)) {
@@ -312,33 +395,38 @@ public void createNetrisVnet(NetworkVO networkVO, DataCenter zone) {
         }
         String vpcName = null;
         Long vpcId = null;
-        Boolean globalRouting = null;
+        boolean isL2 = false;
         long networkOfferingId = networkVO.getNetworkOfferingId();
+
         NetworkOfferingVO networkOfferingVO = networkOfferingDao.findById(networkOfferingId);
-        if (NetworkOffering.NetworkMode.ROUTED.equals(networkOfferingVO.getNetworkMode())) {
-            globalRouting = true;
+        NetUtils.InternetProtocol internetProtocol = networkOfferingDao.getNetworkOfferingInternetProtocol(networkOfferingVO.getId());
+        NetworkOffering.NetworkMode networkMode = networkOfferingVO.getNetworkMode();
+        if (Network.GuestType.L2.equals(networkOfferingVO.getGuestType())) {
+            isL2 = true;
         }
-        if (nonNull(networkVO.getVpcId())) {
-            VpcVO vpc = _vpcDao.findById(networkVO.getVpcId());
-            if (isNull(vpc)) {
-                throw new CloudRuntimeException(String.format("Failed to find VPC network with id: %s", networkVO.getVpcId()));
-            }
-            vpcName = vpc.getName();
-            vpcId = vpc.getId();
-        } else {
-            logger.debug(String.format("Creating IPAM Allocation before creating IPAM Subnet", networkVO.getName()));
-            boolean isSourceNatSupported = !NetworkOffering.NetworkMode.ROUTED.equals(networkOfferingVO.getNetworkMode()) &&
-                    networkOfferingServiceMapDao.areServicesSupportedByNetworkOffering(networkVO.getNetworkOfferingId(), Network.Service.SourceNat);
-            boolean result = netrisService.createVpcResource(zone.getId(), networkVO.getAccountId(), networkVO.getDomainId(),
-                    networkVO.getId(), networkVO.getName(), isSourceNatSupported, networkVO.getCidr(), false);
-            if (!result) {
-                String msg = String.format("Error creating Netris VPC for the network: %s", networkVO.getName());
-                logger.error(msg);
-                throw new CloudRuntimeException(msg);
+        if (!isL2) {
+            if (nonNull(networkVO.getVpcId())) {
+                VpcVO vpc = _vpcDao.findById(networkVO.getVpcId());
+                if (isNull(vpc)) {
+                    throw new CloudRuntimeException(String.format("Failed to find VPC network with id: %s", networkVO.getVpcId()));
+                }
+                vpcName = vpc.getName();
+                vpcId = vpc.getId();
+            } else {
+                logger.debug(String.format("Creating IPAM Allocation before creating IPAM Subnet", networkVO.getName()));
+                boolean isSourceNatSupported = !NetworkOffering.NetworkMode.ROUTED.equals(networkOfferingVO.getNetworkMode()) &&
+                        networkOfferingServiceMapDao.areServicesSupportedByNetworkOffering(networkVO.getNetworkOfferingId(), Network.Service.SourceNat);
+                boolean result = netrisService.createVpcResource(zone.getId(), networkVO.getAccountId(), networkVO.getDomainId(),
+                        networkVO.getId(), networkVO.getName(), isSourceNatSupported, networkVO.getCidr(), false);
+                if (!result) {
+                    String msg = String.format("Error creating Netris VPC for the network: %s", networkVO.getName());
+                    logger.error(msg);
+                    throw new CloudRuntimeException(msg);
+                }
             }
         }
         boolean result = netrisService.createVnetResource(zone.getId(), account.getId(), domain.getId(), vpcName, vpcId,
-                networkVO.getName(), networkVO.getId(), networkVO.getCidr(), globalRouting);
+                networkVO.getName(), networkVO.getId(), networkVO.getCidr(), networkMode, internetProtocol, isL2);
         if (!result) {
             throw new CloudRuntimeException("Failed to create Netris vNet resource for network: " + networkVO.getName());
         }
diff --git a/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisPublicNetworkGuru.java b/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisPublicNetworkGuru.java
index f1cc49b71257..7a89412fa07e 100644
--- a/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisPublicNetworkGuru.java
+++ b/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisPublicNetworkGuru.java
@@ -27,7 +27,6 @@
 import com.cloud.network.dao.NetworkVO;
 import com.cloud.network.guru.PublicNetworkGuru;
 import com.cloud.network.netris.NetrisService;
-import com.cloud.network.vpc.VpcOffering;
 import com.cloud.network.vpc.VpcOfferingVO;
 import com.cloud.network.vpc.VpcVO;
 import com.cloud.offering.NetworkOffering;
@@ -36,6 +35,7 @@
 import com.cloud.vm.NicProfile;
 import com.cloud.vm.VirtualMachineProfile;
 import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.resource.NetrisResourceObjectUtils;
 import org.apache.commons.collections.CollectionUtils;
 
 import javax.inject.Inject;
@@ -110,7 +110,8 @@ public NicProfile allocate(Network network, NicProfile nic, VirtualMachineProfil
                 Network.Service[] services = { Network.Service.SourceNat };
                 long networkOfferingId = vpc.getVpcOfferingId();
                 VpcOfferingVO vpcVO = vpcOfferingDao.findById(networkOfferingId);
-                boolean sourceNatEnabled = !NetworkOffering.NetworkMode.ROUTED.equals(vpcVO.getNetworkMode()) &&
+                NetworkOffering.NetworkMode vpcNetworkMode = NetrisResourceObjectUtils.getNetworkMode(vpcVO.getNetworkMode());
+                boolean sourceNatEnabled = !NetworkOffering.NetworkMode.ROUTED.equals(vpcNetworkMode) &&
                         vpcOfferingServiceMapDao.areServicesSupportedByVpcOffering(vpc.getVpcOfferingId(), services);
 
                 logger.info(String.format("Creating Netris VPC %s", vpc.getName()));
@@ -121,9 +122,7 @@ public NicProfile allocate(Network network, NicProfile nic, VirtualMachineProfil
                     throw new CloudRuntimeException(msg);
                 }
 
-                boolean hasNatSupport = false;
-                VpcOffering vpcOffering = vpcOfferingDao.findById(vpc.getVpcOfferingId());
-                hasNatSupport = NetworkOffering.NetworkMode.NATTED.equals(vpcOffering.getNetworkMode());
+                boolean hasNatSupport = NetworkOffering.NetworkMode.NATTED.equals(NetrisResourceObjectUtils.getNetworkMode(vpcVO.getNetworkMode()));
 
                 if (!hasNatSupport) {
                     return nic;
diff --git a/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisServiceImpl.java b/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisServiceImpl.java
index 6cd944c46780..5329a199d31c 100644
--- a/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisServiceImpl.java
+++ b/plugins/network-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisServiceImpl.java
@@ -38,6 +38,7 @@
 import com.cloud.network.vpc.StaticRoute;
 import com.cloud.network.vpc.Vpc;
 import com.cloud.network.vpc.dao.VpcDao;
+import com.cloud.offering.NetworkOffering;
 import io.netris.model.NatPostBody;
 import org.apache.cloudstack.agent.api.CreateOrUpdateNetrisACLCommand;
 import com.cloud.utils.Pair;
@@ -222,14 +223,16 @@ public boolean deleteVpcResource(long zoneId, long accountId, long domainId, Vpc
     }
 
     @Override
-    public boolean createVnetResource(Long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String cidr, Boolean globalRouting) {
+    public boolean createVnetResource(Long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String cidr, NetworkOffering.NetworkMode networkMode, NetUtils.InternetProtocol internetProtocol, boolean isL2) {
         NetworkVO network = networkDao.findById(networkId);
         String vxlanId = Networks.BroadcastDomainType.getValue(network.getBroadcastUri());
         CreateNetrisVnetCommand cmd = new CreateNetrisVnetCommand(zoneId, accountId, domainId, vpcName, vpcId, networkName, networkId, cidr, network.getGateway(), !Objects.isNull(vpcId));
         cmd.setVxlanId(Integer.parseInt(vxlanId));
+        cmd.setL2(isL2);
         NetrisProviderVO netrisProvider = netrisProviderDao.findByZoneId(zoneId);
         cmd.setNetrisTag(netrisProvider.getNetrisTag());
-        cmd.setGlobalRouting(globalRouting);
+        cmd.setNetworkMode(networkMode);
+        cmd.setInternetProtocol(internetProtocol);
         if (Objects.nonNull(networkId)) {
             Ipv6GuestPrefixSubnetNetworkMapVO ipv6PrefixNetworkMapVO = ipv6PrefixNetworkMapDao.findByNetworkId(networkId);
             if (Objects.nonNull(ipv6PrefixNetworkMapVO)) {
@@ -241,18 +244,20 @@ public boolean createVnetResource(Long zoneId, long accountId, long domainId, St
     }
 
     @Override
-    public boolean updateVnetResource(Long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String prevNetworkName) {
+    public boolean updateVnetResource(Long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String prevNetworkName, boolean isL2) {
         UpdateNetrisVnetCommand cmd = new UpdateNetrisVnetCommand(zoneId, accountId, domainId, networkName, networkId, Objects.nonNull(vpcId));
         cmd.setPrevNetworkName(prevNetworkName);
         cmd.setVpcId(vpcId);
         cmd.setVpcName(vpcName);
+        cmd.setL2(isL2);
         NetrisAnswer answer = sendNetrisCommand(cmd, zoneId);
         return answer.getResult();
     }
 
     @Override
-    public boolean deleteVnetResource(long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String cidr) {
+    public boolean deleteVnetResource(long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String cidr, boolean isL2) {
         DeleteNetrisVnetCommand cmd = new DeleteNetrisVnetCommand(zoneId, accountId, domainId, networkName, networkId, vpcName, vpcId, cidr, Objects.nonNull(vpcName));
+        cmd.setL2(isL2);
         Ipv6GuestPrefixSubnetNetworkMapVO ipv6PrefixNetworkMapVO = ipv6PrefixNetworkMapDao.findByNetworkId(networkId);
         if (Objects.nonNull(ipv6PrefixNetworkMapVO)) {
             cmd.setvNetV6Cidr(ipv6PrefixNetworkMapVO.getSubnet());
@@ -354,7 +359,7 @@ public boolean createStaticNatRule(long zoneId, long accountId, long domainId, S
         cmd.setNatRuleType("STATICNAT");
         cmd.setNatIp(staticNatIp);
         cmd.setVmIp(vmIp);
-        String[] suffixes = getStaticNatResourceSuffixes(vpcId, networkId, isForVpc, vmId);
+        String[] suffixes = getStaticNatResourceSuffixes(vpcId, networkId, isForVpc, vmId, staticNatIp);
         String dnatRuleName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.STATICNAT, suffixes);
         cmd.setNatRuleName(dnatRuleName);
         NetrisAnswer answer = sendNetrisCommand(cmd, zoneId);
@@ -375,7 +380,7 @@ public boolean deleteStaticNatRule(long zoneId, long accountId, long domainId, S
             networkId = networkResourceId;
         }
         DeleteNetrisNatRuleCommand cmd = new DeleteNetrisNatRuleCommand(zoneId, accountId, domainId, vpcName, vpcId, networkName, networkId, isForVpc);
-        String suffixes[] = getStaticNatResourceSuffixes(vpcId, networkId, isForVpc, vmId);
+        String suffixes[] = getStaticNatResourceSuffixes(vpcId, networkId, isForVpc, vmId, staticNatIp);
         String dnatRuleName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.STATICNAT, suffixes);
         cmd.setNatRuleName(dnatRuleName);
         cmd.setNatRuleType("STATICNAT");
@@ -547,10 +552,9 @@ public boolean deleteLbRule(NetrisNetworkRule rule) {
         return answer.getResult();
     }
 
-    public static String[] getStaticNatResourceSuffixes(Long vpcId, Long networkId, boolean isForVpc, long vmId) {
-        String[] suffixes = new String[2];
-        suffixes[0] = isForVpc ? String.valueOf(vpcId) : String.valueOf(networkId);
-        suffixes[1] = String.valueOf(vmId);
-        return suffixes;
+    public static String[] getStaticNatResourceSuffixes(Long vpcId, Long networkId, boolean isForVpc, long vmId, String publicIp) {
+        String resourceId = isForVpc ? String.valueOf(vpcId) : String.valueOf(networkId);
+        // Always include the public IP to ensure uniqueness across multiple static NATs on the same VM
+        return new String[]{resourceId, String.valueOf(vmId), publicIp};
     }
 }
diff --git a/plugins/network-elements/netris/src/test/java/org/apache/cloudstack/agent/api/CreateNetrisVnetCommandTest.java b/plugins/network-elements/netris/src/test/java/org/apache/cloudstack/agent/api/CreateNetrisVnetCommandTest.java
index cc367d181e3f..66fb77d322e5 100644
--- a/plugins/network-elements/netris/src/test/java/org/apache/cloudstack/agent/api/CreateNetrisVnetCommandTest.java
+++ b/plugins/network-elements/netris/src/test/java/org/apache/cloudstack/agent/api/CreateNetrisVnetCommandTest.java
@@ -16,6 +16,8 @@
 // under the License.
 package org.apache.cloudstack.agent.api;
 
+import com.cloud.offering.NetworkOffering;
+import com.cloud.utils.net.NetUtils;
 import org.junit.Assert;
 import org.junit.Test;
 
@@ -34,7 +36,8 @@ public class CreateNetrisVnetCommandTest {
     private static final Integer VXLAN_ID = 100;
     private static final String NETRIS_TAG = "test-tag";
     private static final String IPV6_CIDR = "2001:db8::/64";
-    private static final Boolean GLOBAL_ROUTING = true;
+    private static final NetworkOffering.NetworkMode NETWORK_MODE = NetworkOffering.NetworkMode.NATTED;
+    private static final NetUtils.InternetProtocol INTERNET_PROTOCOL = NetUtils.InternetProtocol.IPv4;
 
     @Test
     public void testConstructorAndGetters() {
@@ -65,13 +68,15 @@ public void testSetters() {
         command.setVxlanId(VXLAN_ID);
         command.setNetrisTag(NETRIS_TAG);
         command.setIpv6Cidr(IPV6_CIDR);
-        command.setGlobalRouting(GLOBAL_ROUTING);
+        command.setInternetProtocol(NetUtils.InternetProtocol.IPv4);
+        command.setNetworkMode(NetworkOffering.NetworkMode.NATTED);
 
         // Assert
         Assert.assertEquals(VXLAN_ID, command.getVxlanId());
         Assert.assertEquals(NETRIS_TAG, command.getNetrisTag());
         Assert.assertEquals(IPV6_CIDR, command.getIpv6Cidr());
-        Assert.assertEquals(GLOBAL_ROUTING, command.isGlobalRouting());
+        Assert.assertEquals(NETWORK_MODE, command.getNetworkMode());
+        Assert.assertEquals(INTERNET_PROTOCOL, command.getInternetProtocol());
     }
 
     @Test
diff --git a/plugins/network-elements/netris/src/test/java/org/apache/cloudstack/resource/NetrisResourceObjectUtilsTest.java b/plugins/network-elements/netris/src/test/java/org/apache/cloudstack/resource/NetrisResourceObjectUtilsTest.java
index 44bd9824b2d2..7f0ceb596bf5 100644
--- a/plugins/network-elements/netris/src/test/java/org/apache/cloudstack/resource/NetrisResourceObjectUtilsTest.java
+++ b/plugins/network-elements/netris/src/test/java/org/apache/cloudstack/resource/NetrisResourceObjectUtilsTest.java
@@ -100,10 +100,12 @@ public void testSourceNatName() {
     @Test
     public void testStaticNatName() {
         long vmId = 1234L;
+        String publicIp = "203.0.113.5";
         CreateOrUpdateNetrisNatCommand cmd = new CreateOrUpdateNetrisNatCommand(zoneId, accountId, domainId, vpcName, vpcId, null, null, true, vpcCidr);
-        String[] suffixes = NetrisServiceImpl.getStaticNatResourceSuffixes(vpcId, null, true, vmId);
+        String[] suffixes = NetrisServiceImpl.getStaticNatResourceSuffixes(vpcId, null, true, vmId, publicIp);
         String staticNatRuleName = NetrisResourceObjectUtils.retrieveNetrisResourceObjectName(cmd, NetrisResourceObjectUtils.NetrisObjectType.STATICNAT, suffixes);
-        String expectedName = String.format("D%s-A%s-Z%s-V%s-VM%s-STATICNAT", domainId, accountId, zoneId, vpcId, vmId);
+        // Public IP always appended for uniqueness; legacy rules without IP are handled via fallback on delete
+        String expectedName = String.format("D%s-A%s-Z%s-V%s-VM%s-STATICNAT-%s", domainId, accountId, zoneId, vpcId, vmId, publicIp);
         Assert.assertEquals(expectedName, staticNatRuleName);
     }
 }
diff --git a/plugins/network-elements/netris/src/test/java/org/apache/cloudstack/service/NetrisElementTest.java b/plugins/network-elements/netris/src/test/java/org/apache/cloudstack/service/NetrisElementTest.java
index a2622549deb7..1010cd48114f 100644
--- a/plugins/network-elements/netris/src/test/java/org/apache/cloudstack/service/NetrisElementTest.java
+++ b/plugins/network-elements/netris/src/test/java/org/apache/cloudstack/service/NetrisElementTest.java
@@ -136,6 +136,6 @@ public void testDeleteNetwork() throws ResourceUnavailableException {
         ReservationContext context = Mockito.mock(ReservationContext.class);
         netrisElement.destroy(network, context);
         Mockito.verify(netrisService).deleteVnetResource(zoneId, accountId, domainId, vpcName, vpcId,
-                networkName, networkId, networkCidr);
+                networkName, networkId, networkCidr, false);
     }
 }
diff --git a/plugins/network-elements/netris/src/test/java/org/apache/cloudstack/service/NetrisGuestNetworkGuruTest.java b/plugins/network-elements/netris/src/test/java/org/apache/cloudstack/service/NetrisGuestNetworkGuruTest.java
index ad8d46c0dd89..d228ca9217c1 100644
--- a/plugins/network-elements/netris/src/test/java/org/apache/cloudstack/service/NetrisGuestNetworkGuruTest.java
+++ b/plugins/network-elements/netris/src/test/java/org/apache/cloudstack/service/NetrisGuestNetworkGuruTest.java
@@ -41,6 +41,7 @@
 import com.cloud.offerings.dao.NetworkOfferingServiceMapDao;
 import com.cloud.user.AccountVO;
 import com.cloud.user.dao.AccountDao;
+import com.cloud.utils.net.NetUtils;
 import com.cloud.vm.ReservationContext;
 import org.junit.After;
 import org.junit.Assert;
@@ -206,12 +207,49 @@ public void testDesignNetrisNetwork() {
     @Test
     public void testCreateNetrisVnetVpcNetworkRoutedMode() {
         Mockito.when(networkOffering.getNetworkMode()).thenReturn(NetworkOffering.NetworkMode.ROUTED);
+        Mockito.when(networkOfferingDao.getNetworkOfferingInternetProtocol(networkOfferingId)).thenReturn(NetUtils.InternetProtocol.IPv4);
         Mockito.when(netrisService.createVnetResource(Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(),
                 Mockito.anyString(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyLong(), Mockito.anyString(),
-                Mockito.anyBoolean())).thenReturn(true);
+                Mockito.any(), Mockito.any(), Mockito.anyBoolean())).thenReturn(true);
         guru.createNetrisVnet(network, zone);
         Mockito.verify(netrisService).createVnetResource(zoneId, accountId, domainId, vpcName, vpcId,
-                networkName, networkId, networkCidr, true);
+                networkName, networkId, networkCidr, NetworkOffering.NetworkMode.ROUTED, NetUtils.InternetProtocol.IPv4, false);
+    }
+
+    @Test
+    public void testCreateNetrisVnetVpcNetworkNattedMode() {
+        Mockito.when(networkOffering.getNetworkMode()).thenReturn(NetworkOffering.NetworkMode.NATTED);
+        Mockito.when(networkOfferingDao.getNetworkOfferingInternetProtocol(networkOfferingId)).thenReturn(NetUtils.InternetProtocol.IPv4);
+        Mockito.when(netrisService.createVnetResource(Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(),
+                Mockito.anyString(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyLong(), Mockito.anyString(),
+                Mockito.any(), Mockito.any(), Mockito.anyBoolean())).thenReturn(true);
+        guru.createNetrisVnet(network, zone);
+        Mockito.verify(netrisService).createVnetResource(zoneId, accountId, domainId, vpcName, vpcId,
+                networkName, networkId, networkCidr, NetworkOffering.NetworkMode.NATTED, NetUtils.InternetProtocol.IPv4, false);
+    }
+
+    @Test
+    public void testCreateNetrisVnetVpcNetworkDualStackNattedMode() {
+        Mockito.when(networkOffering.getNetworkMode()).thenReturn(NetworkOffering.NetworkMode.NATTED);
+        Mockito.when(networkOfferingDao.getNetworkOfferingInternetProtocol(networkOfferingId)).thenReturn(NetUtils.InternetProtocol.DualStack);
+        Mockito.when(netrisService.createVnetResource(Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(),
+                Mockito.anyString(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyLong(), Mockito.anyString(),
+                Mockito.any(), Mockito.any(), Mockito.anyBoolean())).thenReturn(true);
+        guru.createNetrisVnet(network, zone);
+        Mockito.verify(netrisService).createVnetResource(zoneId, accountId, domainId, vpcName, vpcId,
+                networkName, networkId, networkCidr, NetworkOffering.NetworkMode.NATTED, NetUtils.InternetProtocol.DualStack, false);
+    }
+
+    @Test
+    public void testCreateNetrisVnetVpcNetworkDualStackRoutedMode() {
+        Mockito.when(networkOffering.getNetworkMode()).thenReturn(NetworkOffering.NetworkMode.ROUTED);
+        Mockito.when(networkOfferingDao.getNetworkOfferingInternetProtocol(networkOfferingId)).thenReturn(NetUtils.InternetProtocol.DualStack);
+        Mockito.when(netrisService.createVnetResource(Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(),
+                Mockito.anyString(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyLong(), Mockito.anyString(),
+                Mockito.any(), Mockito.any(), Mockito.anyBoolean())).thenReturn(true);
+        guru.createNetrisVnet(network, zone);
+        Mockito.verify(netrisService).createVnetResource(zoneId, accountId, domainId, vpcName, vpcId,
+                networkName, networkId, networkCidr, NetworkOffering.NetworkMode.ROUTED, NetUtils.InternetProtocol.DualStack, false);
     }
 
     @Test
diff --git a/server/src/main/java/com/cloud/api/query/dao/VpcOfferingJoinDaoImpl.java b/server/src/main/java/com/cloud/api/query/dao/VpcOfferingJoinDaoImpl.java
index 7ea4b7d5834f..8f6f6199085c 100644
--- a/server/src/main/java/com/cloud/api/query/dao/VpcOfferingJoinDaoImpl.java
+++ b/server/src/main/java/com/cloud/api/query/dao/VpcOfferingJoinDaoImpl.java
@@ -71,6 +71,7 @@ public VpcOfferingResponse newVpcOfferingResponse(VpcOffering offering) {
         offeringResponse.setSupportsDistributedRouter(offering.isSupportsDistributedRouter());
         offeringResponse.setSupportsRegionLevelVpc(offering.isOffersRegionLevelVPC());
         offeringResponse.setCreated(offering.getCreated());
+        offeringResponse.setRedundantRouter(offering.isRedundantRouter());
         if (offering.getRoutingMode() != null) {
             offeringResponse.setRoutingMode(offering.getRoutingMode().toString());
         }
diff --git a/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java b/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
index 273ca83b6b15..cc3531cc6bf0 100644
--- a/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
@@ -1417,6 +1417,31 @@ private void checkPublicIpOnExternalProviderZone(DataCenter zone, String ip) {
         }
     }
 
+    /**
+     * When the zone is linked to external provider Netris and no explicit IP was requested:
+     * restrict the candidate pool to the VLANs reserved for Netris, so that generic acquisitions
+     * (e.g. associateIpAddress called by the CloudStack cloud-controller-manager on behalf of a
+     * Kubernetes Service of type LoadBalancer) don't fall back to the VR's public range.
+     * Returns null when the zone has no Netris provider, meaning no restriction is applied.
+     *
+     * returns VLAN IDS tagged with forNetris = true
+     */
+    private List<Long> getNetrisVlanDbIds(DataCenter zone) {
+        long zoneId = zone.getId();
+        NetrisProviderVO netrisProvider = netrisProviderDao.findByZoneId(zoneId);
+        if (netrisProvider == null) {
+            return null;
+        }
+        List<Long> vlanIds = _vlanDao.listVlansForExternalNetworkProvider(zoneId, ApiConstants.NETRIS_DETAIL_KEY).stream()
+                .map(VlanVO::getId).collect(Collectors.toList());
+        if (vlanIds.isEmpty()) {
+            throw new CloudRuntimeException(String.format(
+                    "Cannot allocate public IP in zone %s: no VLANs tagged '%s=true' found for the external provider",
+                    zone.getName(), ApiConstants.NETRIS_DETAIL_KEY));
+        }
+        return vlanIds;
+    }
+
     @DB
     @Override
     public IpAddress allocateIp(final Account ipOwner, final boolean isSystem, Account caller, User callerUser, final DataCenter zone, final Boolean displayIp, final String ipaddress)
@@ -1425,8 +1450,6 @@ public IpAddress allocateIp(final Account ipOwner, final boolean isSystem, Accou
         final VlanType vlanType = VlanType.VirtualNetwork;
         final boolean assign = false;
 
-        checkPublicIpOnExternalProviderZone(zone, ipaddress);
-
         if (Grouping.AllocationState.Disabled == zone.getAllocationState() && !_accountMgr.isRootAdmin(caller.getId())) {
             // zone is of type DataCenter. See DataCenterVO.java.
             PermissionDeniedException ex = new PermissionDeniedException(generateErrorMessageForOperationOnDisabledZone("allocate IP addresses", zone));
@@ -1434,6 +1457,12 @@ public IpAddress allocateIp(final Account ipOwner, final boolean isSystem, Accou
             throw ex;
         }
 
+        checkPublicIpOnExternalProviderZone(zone, ipaddress);
+
+        // Only steer the range when no explicit IP was requested: an explicit ipaddress is already
+        // validated against the provider's pool above by checkPublicIpOnExternalProviderZone.
+        final List<Long> vlanDbIds = ipaddress == null ? getNetrisVlanDbIds(zone) : null;
+
         PublicIp ip = null;
 
         Account accountToLock = null;
@@ -1461,7 +1490,7 @@ public IpAddress allocateIp(final Account ipOwner, final boolean isSystem, Accou
             ip = Transaction.execute(new TransactionCallbackWithException<PublicIp, InsufficientAddressCapacityException>() {
                 @Override
                 public PublicIp doInTransaction(TransactionStatus status) throws InsufficientAddressCapacityException {
-                    PublicIp ip = fetchNewPublicIp(zone.getId(), null, null, ipOwner, vlanType, null, false, assign, ipaddress, null, isSystem, null, displayIp, false);
+                    PublicIp ip = fetchNewPublicIp(zone.getId(), null, vlanDbIds, ipOwner, vlanType, null, false, assign, ipaddress, null, isSystem, null, displayIp, false);
 
                     if (ip == null) {
                         InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Unable to find available public IP addresses", DataCenter.class, zone
diff --git a/server/src/main/java/com/cloud/network/NetworkModelImpl.java b/server/src/main/java/com/cloud/network/NetworkModelImpl.java
index 07305c0e6418..0e53c9a6bfbe 100644
--- a/server/src/main/java/com/cloud/network/NetworkModelImpl.java
+++ b/server/src/main/java/com/cloud/network/NetworkModelImpl.java
@@ -495,7 +495,8 @@ Map<Provider, Set<Service>> getProviderServicesMap(long networkId) {
     public Map<Provider, ArrayList<PublicIpAddress>> getProviderToIpList(Network network, Map<PublicIpAddress, Set<Service>> ipToServices) {
         NetworkOffering offering = _networkOfferingDao.findById(network.getNetworkOfferingId());
         boolean isForNsx = isProviderForNetworkOffering(Provider.Nsx, offering.getId());
-        if (!offering.isConserveMode() && !isForNsx) {
+        boolean isForNetris = isProviderForNetworkOffering(Provider.Netris, offering.getId());
+        if (!offering.isConserveMode() && !isForNsx && !isForNetris) {
             for (PublicIpAddress ip : ipToServices.keySet()) {
                 Set<Service> services = new HashSet<Service>();
                 services.addAll(ipToServices.get(ip));
@@ -1649,7 +1650,8 @@ public boolean checkIpForService(IpAddress userIp, Service service, Long network
             return false;
         }
         boolean isForNsx = isProviderForNetworkOffering(Provider.Nsx, offering.getId());
-        if (!offering.isConserveMode() && !isForNsx) {
+        boolean isForNetris = isProviderForNetworkOffering(Provider.Netris, offering.getId());
+        if (!offering.isConserveMode() && !isForNsx && !isForNetris) {
             return canIpUsedForNonConserveService(publicIp, service);
         }
         return true;
diff --git a/server/src/main/java/com/cloud/network/guru/GuestNetworkGuru.java b/server/src/main/java/com/cloud/network/guru/GuestNetworkGuru.java
index 3c677cb19e24..76a8052bff9d 100644
--- a/server/src/main/java/com/cloud/network/guru/GuestNetworkGuru.java
+++ b/server/src/main/java/com/cloud/network/guru/GuestNetworkGuru.java
@@ -17,7 +17,6 @@
 package com.cloud.network.guru;
 
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.List;
 import java.util.Random;
 
@@ -529,16 +528,15 @@ public void shutdown(final NetworkProfile profile, final NetworkOffering offerin
             return; // Nothing to do here if the uri is null already
         }
 
-        if ((profile.getBroadcastDomainType() == BroadcastDomainType.Vlan || profile.getBroadcastDomainType() == BroadcastDomainType.Vxlan || profile.getBroadcastDomainType() == BroadcastDomainType.Netris) && !offering.isSpecifyVlan()) {
-            logger.debug("Releasing vnet for the network: {}", profile);
-            _dcDao.releaseVnet(BroadcastDomainType.getValue(profile.getBroadcastUri()), profile.getDataCenterId(), profile.getPhysicalNetworkId(), profile.getAccountId(),
+        if ((profile.getBroadcastDomainType() == BroadcastDomainType.Vlan || profile.getBroadcastDomainType() == BroadcastDomainType.Vxlan) && !offering.isSpecifyVlan()) {
+            logger.debug("Releasing vnet for the network id=" + profile.getId());
+            final String vnetValue = BroadcastDomainType.getValue(profile.getBroadcastUri());
+            _dcDao.releaseVnet(vnetValue, profile.getDataCenterId(), profile.getPhysicalNetworkId(), profile.getAccountId(),
                     profile.getReservationId());
-            String eventType = EventTypes.EVENT_ZONE_VLAN_RELEASE;
-            if (Arrays.asList(BroadcastDomainType.Vxlan, BroadcastDomainType.Netris).contains(profile.getBroadcastDomainType())) {
-                eventType = EventTypes.EVENT_ZONE_VXLAN_RELEASE;
-            }
+            String eventType = profile.getBroadcastDomainType() == BroadcastDomainType.Vxlan
+                    ? EventTypes.EVENT_ZONE_VXLAN_RELEASE : EventTypes.EVENT_ZONE_VLAN_RELEASE;
             ActionEventUtils.onCompletedActionEvent(CallContext.current().getCallingUserId(), profile.getAccountId(), EventVO.LEVEL_INFO, eventType,
-                    "Released Zone Vnet: " + BroadcastDomainType.getValue(profile.getBroadcastUri()) + " for Network: " + profile.getId(),
+                    "Released Zone Vnet: " + vnetValue + " for Network: " + profile.getId(),
                     profile.getDataCenterId(), ApiCommandResourceType.Zone.toString(), 0);
         }
 
diff --git a/server/src/main/java/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java b/server/src/main/java/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
index 134141575d58..e2415e200768 100644
--- a/server/src/main/java/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
@@ -923,6 +923,15 @@ protected void updateRoutersRedundantState(final List<DomainRouterVO> routers) {
                 logger.info(context);
                 if (currState == RedundantState.PRIMARY) {
                     _alertMgr.sendAlert(AlertManager.AlertType.ALERT_TYPE_DOMAIN_ROUTER, router.getDataCenterId(), router.getPodIdToDeployIn(), title, context);
+                    if (router.getVpcId() != null && vpcManager.isProviderSupportServiceInVpc(router.getVpcId(), Service.SourceNat, Provider.Netris)) {
+                        // re-push VPC VR static NAT/VPN routes so Netris picks up the new PRIMARY
+                        vpcManager.reconfigStaticNatForVpcVr(router.getVpcId());
+                        try {
+                            vpcManager.applyStaticRouteForVpcVpnIfNeeded(router.getVpcId(), true);
+                        } catch (final ResourceUnavailableException e) {
+                            logger.error("Unable to apply static routes for vpc " + router.getVpcId() + " due to " + e.getMessage(), e);
+                        }
+                    }
                 }
             }
         }
diff --git a/server/src/main/java/com/cloud/network/vpc/VpcManagerImpl.java b/server/src/main/java/com/cloud/network/vpc/VpcManagerImpl.java
index 5717f8745aca..9ce68f07d877 100644
--- a/server/src/main/java/com/cloud/network/vpc/VpcManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/vpc/VpcManagerImpl.java
@@ -150,6 +150,7 @@
 import com.cloud.network.element.VpcProvider;
 import com.cloud.network.router.CommandSetupHelper;
 import com.cloud.network.router.NetworkHelper;
+import com.cloud.network.router.VirtualRouter;
 import com.cloud.network.router.VpcVirtualNetworkApplianceManager;
 import com.cloud.network.rules.RulesManager;
 import com.cloud.network.vpn.RemoteAccessVpnService;
@@ -714,10 +715,11 @@ public VpcOffering createVpcOffering(final String name, final String displayText
         Service redundantRouterService = Service.SourceNat;
         if (CollectionUtils.isNotEmpty(sourceNatServiceProviders)) {
             svcProviderMap.put(Service.Gateway, sourceNatServiceProviders);
-        } else if (NetworkOffering.NetworkMode.ROUTED.equals(networkMode) && org.apache.commons.lang3.StringUtils.isBlank(externalProvider)) {
-            // For Routed mode, add the Gateway service except for external providers such as NSX, Netris to not override the svcProviderMap mapping
-            svcProviderMap.put(Service.Gateway, Sets.newHashSet(Provider.VPCVirtualRouter));
+        } else if (NetworkOffering.NetworkMode.ROUTED.equals(networkMode)) {
             redundantRouterService = Service.Gateway;
+            if (org.apache.commons.lang3.StringUtils.isBlank(externalProvider)) {
+                svcProviderMap.put(Service.Gateway, Sets.newHashSet(Provider.VPCVirtualRouter));
+            }
         }
 
         validateConnectivtyServiceCapabilities(svcProviderMap.get(Service.Connectivity), serviceCapabilityList);
@@ -3797,7 +3799,7 @@ public IPAddressVO getIpAddressForVpcVr(Vpc vpc, IPAddressVO ipAddress, boolean
             return ipAddressForVR;
         } else if (ipAddress != null) {
             if (ipAddress.isSourceNat()) {
-                throw new InvalidParameterValueException("Vpn service can not be configured on the Source NAT IP of VPC id=" + ipAddress.getVpcId());
+                throw new InvalidParameterValueException(String.format("Vpn service can not be configured on the Source NAT IP of VPC id = %s. Please acquire another IP to setup VPN", ipAddress.getVpcId()));
             }
             return ipAddress;
         }
@@ -3858,7 +3860,7 @@ public boolean configStaticNatForVpcVr(Vpc vpc, IPAddressVO ipAddress) {
         String newRouterIp = null;
         List<NetworkVO> networks = _ntwkDao.listByVpc(vpc.getId());
         for (NetworkVO network : networks) {
-            NicVO newNic = nicDao.findNonPlaceHolderByNetworkIdAndType(network.getId(), VirtualMachine.Type.DomainRouter);
+            NicVO newNic = getActiveVpcVrNic(network.getId());
             if (newNic != null) {
                 logger.debug("Got VPC VR NIC for network {}: {}", network.getId(), newNic);
                 newNetworkId = network.getId();
@@ -3901,10 +3903,25 @@ public boolean configStaticNatForVpcVr(Vpc vpc, IPAddressVO ipAddress) {
                 }
             }
         } else if (currentRouterId == null || !currentRouterId.equals(newRouterId)) {
-            // (5) otherwise, If VPC VR ID does not exist or is changed, update the VM ID.
+            // (5) active VR changed on the same network (e.g. redundant VR failover)
+            logger.debug("Active VPC VR changed for network {}: router {} -> {}", currentNetworkId, currentRouterId, newRouterId);
+            boolean isNetris = isProviderSupportServiceInVpc(vpc.getId(), Service.SourceNat, Provider.Netris);
+            CallContext ctx = CallContext.current();
+            if (isNetris && currentRouterId != null) {
+                // Netris rule names are keyed by vmId, so revoke the old router's rule before
+                // creating the new one, or it's left behind as an orphan
+                if (!rulesManager.applyStaticNatForIp(ipAddress.getId(), false, ctx.getCallingAccount(), true)) {
+                    throw new CloudRuntimeException("Failed to revoke static nat for VPC VR before router change");
+                }
+            }
             ipAddress.setAssociatedWithVmId(newRouterId);
             ipAddress.setVmIp(newRouterIp);
             _ipAddressDao.update(ipAddress.getId(), ipAddress);
+            if (isNetris) {
+                if (!rulesManager.applyStaticNatForIp(ipAddress.getId(), false, ctx.getCallingAccount(), false)) {
+                    throw new CloudRuntimeException("Failed to reapply static nat for VPC VR after router change");
+                }
+            }
         }
         return true;
     }
@@ -3918,11 +3935,27 @@ public void reconfigStaticNatForVpcVr(Long vpcId) {
         }
     }
 
+    // Select the PRIMARY router's NIC, or the NIC of the router with the lower DB id if redundant state isn't known yet.
+    private NicVO getActiveVpcVrNic(long networkId) {
+        List<NicVO> nics = nicDao.listNonPlaceholderNicsByNetworkIdAndType(networkId, VirtualMachine.Type.DomainRouter);
+        NicVO fallback = null;
+        for (NicVO nic : nics) {
+            if (fallback == null || nic.getInstanceId() < fallback.getInstanceId()) {
+                fallback = nic;
+            }
+            DomainRouterVO router = routerDao.findById(nic.getInstanceId());
+            if (router != null && router.getIsRedundantRouter() && router.getRedundantState() == VirtualRouter.RedundantState.PRIMARY) {
+                return nic;
+            }
+        }
+        return fallback;
+    }
+
     private String getFirstGuestIpAddressForVpcVr(Long vpcId) {
         String nextHop = null;
         List<NetworkVO> networks = _ntwkDao.listByVpc(vpcId);
         for (NetworkVO network : networks) {
-            NicVO nic = nicDao.findNonPlaceHolderByNetworkIdAndType(network.getId(), VirtualMachine.Type.DomainRouter);
+            NicVO nic = getActiveVpcVrNic(network.getId());
             if (nic != null) {
                 nextHop = nic.getIPv4Address();
                 break;
diff --git a/server/src/main/java/com/cloud/network/vpn/RemoteAccessVpnManagerImpl.java b/server/src/main/java/com/cloud/network/vpn/RemoteAccessVpnManagerImpl.java
index 0c2900bf489c..8adb33f2550c 100644
--- a/server/src/main/java/com/cloud/network/vpn/RemoteAccessVpnManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/vpn/RemoteAccessVpnManagerImpl.java
@@ -69,6 +69,7 @@
 import com.cloud.network.vpc.Vpc;
 import com.cloud.network.vpc.VpcManager;
 import com.cloud.network.vpc.dao.VpcDao;
+import com.cloud.network.vpc.dao.VpcOfferingServiceMapDao;
 import com.cloud.projects.Project.ListProjectResourcesCriteria;
 import com.cloud.server.ConfigurationServer;
 import com.cloud.user.Account;
@@ -134,6 +135,8 @@ public class RemoteAccessVpnManagerImpl extends ManagerBase implements RemoteAcc
     ConfigurationServer _configServer;
     @Inject
     VpcDao _vpcDao;
+    @Inject
+    VpcOfferingServiceMapDao _vpcOfferingServiceMapDao;
 
     int _userLimit;
     int _pskLength;
@@ -243,6 +246,9 @@ public RemoteAccessVpn createRemoteAccessVpn(final long publicIpId, String ipRan
                 validateIpAddressForVpnServiceOnNetwork(network, ipAddress);
             } else {
                 Vpc vpc = _vpcDao.findById(vpcId);
+                if (!_vpcOfferingServiceMapDao.areServicesSupportedByVpcOffering(vpc.getVpcOfferingId(), new Network.Service[]{Network.Service.Vpn})) {
+                    throw new InvalidParameterValueException(String.format("Vpn service is not supported for VPC: %s (%s) ", vpc.getName(), vpc.getUuid()));
+                }
                 cidr = NetUtils.getCidr(vpc.getCidr());
                 validateIpAddressForVpnServiceOnVpc(vpc, ipAddress);
             }
diff --git a/server/src/main/java/com/cloud/network/vpn/Site2SiteVpnManagerImpl.java b/server/src/main/java/com/cloud/network/vpn/Site2SiteVpnManagerImpl.java
index ad1d1f02682e..34e2cf712492 100644
--- a/server/src/main/java/com/cloud/network/vpn/Site2SiteVpnManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/vpn/Site2SiteVpnManagerImpl.java
@@ -144,6 +144,9 @@ public Site2SiteVpnGateway createVpnGateway(CreateVpnGatewayCmd cmd) {
         if (vpc == null) {
             throw new InvalidParameterValueException("Invalid VPC " + vpcId + " for site to site vpn gateway creation!");
         }
+        if (!vpcOfferingServiceMapDao.areServicesSupportedByVpcOffering(vpc.getVpcOfferingId(), new Network.Service[]{Network.Service.Vpn})) {
+            throw new InvalidParameterValueException(String.format("Vpn service is not supported for VPC: %s (%s) ", vpc.getName(), vpc.getUuid()));
+        }
         Site2SiteVpnGatewayVO gws = _vpnGatewayDao.findByVpcId(vpcId);
         if (gws != null) {
             throw new InvalidParameterValueException(String.format("The VPN gateway of VPC %s already existed!", vpc));
diff --git a/server/src/test/java/org/apache/cloudstack/service/NetrisServiceMockTest.java b/server/src/test/java/org/apache/cloudstack/service/NetrisServiceMockTest.java
index 9f590dc18078..d72dafeaabc8 100644
--- a/server/src/test/java/org/apache/cloudstack/service/NetrisServiceMockTest.java
+++ b/server/src/test/java/org/apache/cloudstack/service/NetrisServiceMockTest.java
@@ -23,6 +23,8 @@
 import com.cloud.network.netris.NetrisService;
 import com.cloud.network.vpc.StaticRoute;
 import com.cloud.network.vpc.Vpc;
+import com.cloud.offering.NetworkOffering;
+import com.cloud.utils.net.NetUtils;
 
 import java.util.List;
 
@@ -48,17 +50,17 @@ public boolean deleteVpcResource(long zoneId, long accountId, long domainId, Vpc
     }
 
     @Override
-    public boolean createVnetResource(Long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String cidr, Boolean globalRouting) {
+    public boolean createVnetResource(Long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String cidr, NetworkOffering.NetworkMode networkMode, NetUtils.InternetProtocol internetProtocol, boolean isL2) {
         return true;
     }
 
     @Override
-    public boolean updateVnetResource(Long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String prevNetworkName) {
+    public boolean updateVnetResource(Long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String prevNetworkName, boolean isL2) {
         return true;
     }
 
     @Override
-    public boolean deleteVnetResource(long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String cidr) {
+    public boolean deleteVnetResource(long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String cidr, boolean isL2) {
         return true;
     }
 
diff --git a/systemvm/debian/opt/cloud/bin/configure.py b/systemvm/debian/opt/cloud/bin/configure.py
index bf48be66694c..24195a11bff7 100755
--- a/systemvm/debian/opt/cloud/bin/configure.py
+++ b/systemvm/debian/opt/cloud/bin/configure.py
@@ -104,8 +104,9 @@ def __update(self, vm_ip, password):
         for interface in self.config.address().get_interfaces():
             if interface.ip_in_subnet(vm_ip) and interface.is_added():
                 if self.config.cl.is_redundant():
-                    server_ip = interface.get_gateway()
-                    guest_ip = interface.get_ip()
+                    server_ips = interface.get_passwd_server_ips()
+                    server_ip = server_ips[0]
+                    guest_ip = server_ips[1] if len(server_ips) > 1 else None
                 else:
                     server_ip = interface.get_ip()
                 break
diff --git a/systemvm/debian/opt/cloud/bin/cs/CsAddress.py b/systemvm/debian/opt/cloud/bin/cs/CsAddress.py
index 37ca8979edc7..e15eb7a2e3d2 100755
--- a/systemvm/debian/opt/cloud/bin/cs/CsAddress.py
+++ b/systemvm/debian/opt/cloud/bin/cs/CsAddress.py
@@ -23,12 +23,29 @@
 from . import CsHelper
 from .CsDatabag import CsDataBag
 from .CsApp import CsApache, CsDnsmasq, CsPasswdSvc
+from .CsGuestNetwork import CsGuestNetwork
 from .CsRoute import CsRoute
 from .CsRule import CsRule
 from .CsStaticRoutes import CsStaticRoutes
 
 VRRP_TYPES = ['guest']
 
+
+def _guest_needs_vrrp(device, config):
+    """
+    A guest interface only needs to be managed by keepalived (i.e. have the
+    network gateway floated onto it as a VRRP virtual address) when the
+    CloudStack virtual router is actually the gateway for that network.
+    When an external provider (e.g. Netris) owns the gateway/source NAT for
+    the tier, the router must not also claim the gateway IP.
+    If no guestnetwork data is found for the device, default to the
+    historical behaviour (needs vrrp) to avoid regressing existing setups.
+    """
+    gn = CsGuestNetwork(device, config)
+    if gn.is_guestnetwork():
+        return gn.is_vr_guest_gateway()
+    return True
+
 class CsAddress(CsDataBag):
 
     def compare(self):
@@ -99,7 +116,7 @@ def needs_vrrp(self, o):
         Returns if the ip needs to be managed by keepalived or not
         """
         if "nw_type" in o and o['nw_type'] in VRRP_TYPES:
-            return True
+            return _guest_needs_vrrp(o.get('device'), self.config)
         return False
 
     def get_control_if(self):
@@ -149,6 +166,14 @@ def __init__(self, o, config):
     def get_ip(self):
         return self.get_attr("public_ip")
 
+    def get_passwd_server_ips(self):
+        if CsGuestNetwork(self.get_device(), self.config).router_owns_gateway():
+            return [self.get_gateway(), self.get_ip()]
+        return [self.get_ip()]
+
+    def get_passwd_server_address(self):
+        return ",".join(self.get_passwd_server_ips())
+
     def get_ip6(self):
         if not self.config.is_vpc():
             return self.config.cmdline().get_dev_ip6prelen(self.get_device())
@@ -229,7 +254,7 @@ def needs_vrrp(self):
         Returns if the ip needs to be managed by keepalived or not
         """
         if "nw_type" in self.address and self.address['nw_type'] in VRRP_TYPES:
-            return True
+            return _guest_needs_vrrp(self.get_device(), self.config)
         return False
 
     def is_control(self):
@@ -875,9 +900,9 @@ def post_config_change(self, method):
                         CsPasswdSvc(self.address['public_ip']).stop()
                 elif cmdline.is_primary():
                     if method == "add":
-                        CsPasswdSvc(self.get_gateway() + "," + self.address['public_ip']).start()
+                        CsPasswdSvc(CsInterface(self.address, self.config).get_passwd_server_address()).start()
                     elif method == "delete":
-                        CsPasswdSvc(self.get_gateway() + "," + self.address['public_ip']).stop()
+                        CsPasswdSvc(CsInterface(self.address, self.config).get_passwd_server_address()).stop()
 
         if self.get_type() == "public" and self.config.is_vpc() and method == "add" and not self.config.is_routed():
             if self.address["source_nat"]:
@@ -909,7 +934,7 @@ def needs_vrrp(self):
         Returns if the ip needs to be managed by keepalived or not
         """
         if "nw_type" in self.address and self.address['nw_type'] in VRRP_TYPES:
-            return True
+            return _guest_needs_vrrp(self.dev, self.config)
         return False
 
     def is_public(self):
diff --git a/systemvm/debian/opt/cloud/bin/cs/CsDhcp.py b/systemvm/debian/opt/cloud/bin/cs/CsDhcp.py
index 5f603f0baa05..27ba83ada7f4 100755
--- a/systemvm/debian/opt/cloud/bin/cs/CsDhcp.py
+++ b/systemvm/debian/opt/cloud/bin/cs/CsDhcp.py
@@ -145,7 +145,7 @@ def configure_server(self):
             line = "dhcp-option=tag:interface-%s-%s,1,%s" % (device, idx, netmask)
             self.conf.search(sline, line)
             # Listen Address
-            if self.cl.is_redundant():
+            if self.cl.is_redundant() and gn.router_owns_gateway():
                 listen_address.append(gateway)
             else:
                 listen_address.append(ip)
diff --git a/systemvm/debian/opt/cloud/bin/cs/CsGuestNetwork.py b/systemvm/debian/opt/cloud/bin/cs/CsGuestNetwork.py
index a6667c852fd2..983382b7dbf3 100755
--- a/systemvm/debian/opt/cloud/bin/cs/CsGuestNetwork.py
+++ b/systemvm/debian/opt/cloud/bin/cs/CsGuestNetwork.py
@@ -37,6 +37,9 @@ def is_guestnetwork(self):
     def is_vr_guest_gateway(self):
         return self.guest and ('is_vr_guest_gateway' not in self.data or self.data['is_vr_guest_gateway'])
 
+    def router_owns_gateway(self):
+        return not self.guest or self.is_vr_guest_gateway()
+
     def get_dns(self):
         if not self.guest:
             return self.config.get_dns()
diff --git a/ui/src/components/view/DetailsTab.vue b/ui/src/components/view/DetailsTab.vue
index ba9a43ac8716..0e9f10e27c52 100644
--- a/ui/src/components/view/DetailsTab.vue
+++ b/ui/src/components/view/DetailsTab.vue
@@ -381,7 +381,17 @@ export default {
       }
       return null
     },
+    isNetrisNetwork () {
+      if (!this.resource.service) {
+        return false
+      }
+      const networkAclService = this.resource.service.find(svc => svc.name === 'NetworkACL')
+      return networkAclService && networkAclService.provider && networkAclService.provider.some(p => p.name === 'Netris')
+    },
     ip4routes () {
+      if (this.isNetrisNetwork) {
+        return null
+      }
       if (this.resource.ip4routes && this.resource.ip4routes.length > 0) {
         var routes = []
         for (var route of this.resource.ip4routes) {
@@ -392,6 +402,9 @@ export default {
       return null
     },
     ip6routes () {
+      if (this.isNetrisNetwork) {
+        return null
+      }
       if (this.resource.ip6routes && this.resource.ip6routes.length > 0) {
         var routes = []
         for (var route of this.resource.ip6routes) {
diff --git a/ui/src/config/section/network.js b/ui/src/config/section/network.js
index e0137b970b2e..915ef1a8d87d 100644
--- a/ui/src/config/section/network.js
+++ b/ui/src/config/section/network.js
@@ -805,6 +805,7 @@ export default {
       }, {
         name: 'vpn',
         component: shallowRef(defineAsyncComponent(() => import('@/views/network/VpnDetails.vue'))),
+        networkServiceFilter: networkService => networkService.filter(x => x.name === 'Vpn').length > 0,
         show: (record) => { return record.issourcenat || record.virtualmachinetype === 'DomainRouter' || !record.hasrules }
       },
       {
diff --git a/ui/src/config/section/offering.js b/ui/src/config/section/offering.js
index 99ef34623735..0a1c743d66ab 100644
--- a/ui/src/config/section/offering.js
+++ b/ui/src/config/section/offering.js
@@ -514,7 +514,7 @@ export default {
       searchFilters: ['name', 'zoneid', 'domainid'],
       resourceType: 'VpcOffering',
       columns: ['name', 'state', 'displaytext', 'domain', 'zone', 'order'],
-      details: ['name', 'id', 'displaytext', 'internetprotocol', 'distributedvpcrouter', 'tags', 'routingmode', 'specifyasnumber', 'service', 'fornsx', 'networkmode', 'domain', 'zone', 'created'],
+      details: ['name', 'id', 'displaytext', 'internetprotocol', 'distributedvpcrouter', 'redundantrouter', 'tags', 'routingmode', 'specifyasnumber', 'service', 'fornsx', 'networkmode', 'domain', 'zone', 'created'],
       related: [{
         name: 'vpc',
         title: 'label.vpc',
diff --git a/ui/src/views/infra/zone/AdvancedGuestTrafficForm.vue b/ui/src/views/infra/zone/AdvancedGuestTrafficForm.vue
index caf690efcc93..b5aa96fc1705 100644
--- a/ui/src/views/infra/zone/AdvancedGuestTrafficForm.vue
+++ b/ui/src/views/infra/zone/AdvancedGuestTrafficForm.vue
@@ -114,6 +114,10 @@ export default {
           min: 4096,
           max: 16777214
         },
+        Netris: {
+          min: 4096,
+          max: 16777214
+        },
         GRE: {
           min: 0,
           max: 4294967295
diff --git a/ui/src/views/network/VpcTab.vue b/ui/src/views/network/VpcTab.vue
index 12e21cd8ec94..f8f3c88e78d4 100644
--- a/ui/src/views/network/VpcTab.vue
+++ b/ui/src/views/network/VpcTab.vue
@@ -252,7 +252,7 @@
           </a-spin>
         </a-modal>
       </a-tab-pane>
-      <a-tab-pane :tab="$t('label.vpn.gateway')" key="vpngw" v-if="'listVpnGateways' in $store.getters.apis">
+      <a-tab-pane :tab="$t('label.vpn.gateway')" key="vpngw" v-if="'listVpnGateways' in $store.getters.apis && resource.service && resource.service.some(s => s.name === 'Vpn')">
         <a-button
           v-if="vpnGateways.length === 0"
           type="dashed"
@@ -313,7 +313,7 @@
           </a-spin>
         </a-modal>
       </a-tab-pane>
-      <a-tab-pane :tab="$t('label.vpn.connection')" key="vpnc" v-if="'listVpnConnections' in $store.getters.apis">
+      <a-tab-pane :tab="$t('label.vpn.connection')" key="vpnc" v-if="'listVpnConnections' in $store.getters.apis && resource.service && resource.service.some(s => s.name === 'Vpn')">
         <a-button
           type="dashed"
           style="width: 100%"
diff --git a/ui/src/views/network/VpnDetails.vue b/ui/src/views/network/VpnDetails.vue
index 2a75bb3c22eb..3dd6c92c7f8d 100644
--- a/ui/src/views/network/VpnDetails.vue
+++ b/ui/src/views/network/VpnDetails.vue
@@ -216,16 +216,24 @@ export default {
         this.$notifyError(error)
       })
       if (this.resource.vpcid) {
-        this.vpnGatewayEnabled = true
-        getAPI('listVpnGateways', {
-          vpcid: this.resource.vpcid,
-          listAll: true
-        }).then(response => {
-          const vpnGateways = response.listvpngatewaysresponse.vpngateway || []
-          for (const vpnGateway of vpnGateways) {
-            if (vpnGateway.publicip === this.resource.ipaddress) {
-              this.vpnGateway = vpnGateway
-            }
+        getAPI('listVPCs', { id: this.resource.vpcid, listAll: true }).then(vpcResponse => {
+          const vpc = vpcResponse.listvpcsresponse?.vpc?.[0]
+          if (vpc?.service?.some(s => s.name === 'Vpn')) {
+            this.vpnGatewayEnabled = true
+            getAPI('listVpnGateways', {
+              vpcid: this.resource.vpcid,
+              listAll: true
+            }).then(response => {
+              const vpnGateways = response.listvpngatewaysresponse.vpngateway || []
+              for (const vpnGateway of vpnGateways) {
+                if (vpnGateway.publicip === this.resource.ipaddress) {
+                  this.vpnGateway = vpnGateway
+                }
+              }
+            }).catch(error => {
+              console.log(error)
+              this.$notifyError(error)
+            })
           }
         }).catch(error => {
           console.log(error)
diff --git a/ui/src/views/offering/AddNetworkOffering.vue b/ui/src/views/offering/AddNetworkOffering.vue
index 2ca2fd243b58..31f9d4200075 100644
--- a/ui/src/views/offering/AddNetworkOffering.vue
+++ b/ui/src/views/offering/AddNetworkOffering.vue
@@ -311,7 +311,7 @@
             </a-list>
           </div>
         </a-form-item>
-        <a-form-item name="lbtype" ref="lbtype" :label="$t('label.lbtype')" v-if="forVpc && lbServiceChecked">
+        <a-form-item name="lbtype" ref="lbtype" :label="$t('label.lbtype')" v-if="forVpc && lbServiceChecked && form.provider !== 'Netris'">
           <a-radio-group
             v-model:value="form.lbtype"
             buttonStyle="solid"
@@ -358,7 +358,7 @@
           v-if="(guestType === 'shared' || guestType === 'isolated') && sourceNatServiceChecked && !isVpcVirtualRouterForAtLeastOneService">
           <a-switch v-model:checked="form.redundantroutercapability" />
         </a-form-item>
-        <a-form-item name="sourcenattype" ref="sourcenattype" :label="$t('label.sourcenattype')" v-if="(guestType === 'shared' || guestType === 'isolated') && sourceNatServiceChecked">
+        <a-form-item name="sourcenattype" ref="sourcenattype" :label="$t('label.sourcenattype')" v-if="(guestType === 'shared' || guestType === 'isolated') && sourceNatServiceChecked && form.provider !== 'Netris'">
           <a-radio-group
             v-model:value="form.sourcenattype"
             buttonStyle="solid">
@@ -374,8 +374,8 @@
           name="vmautoscalingcapability"
           ref="vmautoscalingcapability"
           :label="$t('label.supportsvmautoscaling')"
-          v-if="lbServiceChecked && ['Netscaler', 'VirtualRouter', 'VpcVirtualRouter'].includes(lbServiceProvider)">
-          <a-switch v-model:checked="form.vmautoscalingcapability" />
+          v-if="lbServiceChecked && ['Netscaler', 'VirtualRouter', 'VpcVirtualRouter', 'Netris'].includes(lbServiceProvider)">
+          <a-switch v-model:checked="form.vmautoscalingcapability" :disabled="lbServiceProvider === 'Netris'" />
         </a-form-item>
         <a-form-item
           name="elasticlb"
@@ -864,6 +864,12 @@ export default {
           this.supportedServices[i].provider = providers
           this.supportedServices[i].description = serviceDisplayName
         }
+        this.supportedSvcs = this.supportedServices.map(service => {
+          return {
+            ...service,
+            provider: (service.provider || []).map(provider => ({ ...provider }))
+          }
+        })
       }).finally(() => {
         this.supportedServiceLoading = false
         this.updateSupportedServices()
@@ -901,7 +907,12 @@ export default {
     },
     updateSupportedServices () {
       this.supportedServiceLoading = true
-      var supportedServices = this.supportedServices
+      var supportedServices = (this.supportedSvcs.length > 0 ? this.supportedSvcs : this.supportedServices).map(service => {
+        return {
+          ...service,
+          provider: (service.provider || []).map(provider => ({ ...provider }))
+        }
+      })
       var self = this
       if (this.provider !== 'NSX' && this.provider !== 'Netris') {
         if (this.networkmode === 'ROUTED' && this.guestType === 'isolated') {
@@ -929,12 +940,10 @@ export default {
           }
         })
         setTimeout(() => {
-          self.supportedSvcs = self.supportedServices
           self.supportedServices = supportedServices
           self.supportedServiceLoading = false
         }, 50)
       } else {
-        supportedServices = this.supportedSvcs
         supportedServices = supportedServices.filter(svc => {
           if (this.provider === 'NSX') {
             return Object.keys(this.nsxSupportedServicesMap).includes(svc.name)
@@ -958,88 +967,93 @@ export default {
           }
           return svc
         })
-        self.supportedSvcs = self.supportedServices
+
+        const externalSelectedProviders = {}
+        supportedServices.forEach(svc => {
+          const providerName = svc.provider?.[0]?.name
+          if (providerName) {
+            externalSelectedProviders[svc.name] = providerName
+          }
+        })
+        this.selectedServiceProviderMap = externalSelectedProviders
+        this.sourceNatServiceChecked = 'SourceNat' in externalSelectedProviders
+        this.lbServiceChecked = 'Lb' in externalSelectedProviders
+        this.lbServiceProvider = this.lbServiceChecked ? externalSelectedProviders.Lb : ''
+        if (this.lbServiceProvider === 'Netris') {
+          this.form.vmautoscalingcapability = true
+        }
+        this.staticNatServiceChecked = 'StaticNat' in externalSelectedProviders
+        this.staticNatServiceProvider = this.staticNatServiceChecked ? externalSelectedProviders.StaticNat : ''
+        this.connectivityServiceChecked = 'Connectivity' in externalSelectedProviders
+        this.firewallServiceChecked = 'Firewall' in externalSelectedProviders
+        this.firewallServiceProvider = this.firewallServiceChecked ? externalSelectedProviders.Firewall : ''
+        const selectedProviders = Object.values(externalSelectedProviders)
+        this.isVirtualRouterForAtLeastOneService = selectedProviders.includes('VirtualRouter')
+        this.isVpcVirtualRouterForAtLeastOneService = selectedProviders.includes('VpcVirtualRouter')
+        if ((this.isVirtualRouterForAtLeastOneService || this.isVpcVirtualRouterForAtLeastOneService) &&
+          this.serviceOfferings.length === 0) {
+          this.fetchServiceOfferingData()
+        }
+
         self.supportedServices = supportedServices
         self.supportedServiceLoading = false
       }
     },
+    refreshExternalSupportedServicesMap () {
+      const selectedProvider = this.form.provider || this.provider
+      if (selectedProvider !== 'NSX' && selectedProvider !== 'Netris') {
+        return
+      }
+
+      const selectedNetworkMode = this.form.networkmode || this.networkmode
+      const effectiveNetworkMode = selectedProvider === 'Netris' && !selectedNetworkMode ? 'NATTED' : selectedNetworkMode
+      const externalProvider = selectedProvider === 'NSX' ? this.NSX : this.Netris
+      const isNsxProvider = selectedProvider === 'NSX'
+      const commonServices = {
+        Dhcp: this.forVpc ? this.VPCVR : this.VR,
+        Dns: this.forVpc ? this.VPCVR : this.VR,
+        UserData: this.forVpc ? this.VPCVR : this.VR,
+        ...(this.forVpc && { NetworkACL: externalProvider }),
+        ...(!this.forVpc && { Firewall: externalProvider })
+      }
+
+      const nattedServices = {
+        SourceNat: externalProvider,
+        StaticNat: externalProvider,
+        PortForwarding: externalProvider,
+        ...(!isNsxProvider && { Vpn: this.forVpc ? this.VPCVR : this.VR }),
+        ...((!isNsxProvider || this.form.nsxsupportlb) && { Lb: externalProvider })
+      }
+
+      const serviceMap = {
+        ...commonServices,
+        ...(effectiveNetworkMode === 'NATTED' && nattedServices)
+      }
+
+      if (isNsxProvider) {
+        this.nsxSupportedServicesMap = serviceMap
+      } else {
+        this.netrisSupportedServicesMap = serviceMap
+      }
+    },
     handleForVpcChange (forVpc) {
       this.forVpc = forVpc
-      if (this.provider === 'NSX') {
-        this.nsxSupportedServicesMap = {
-          Dhcp: this.forVpc ? this.VPCVR : this.VR,
-          Dns: this.forVpc ? this.VPCVR : this.VR,
-          UserData: this.forVpc ? this.VPCVR : this.VR,
-          ...(this.networkmode === 'NATTED' && {
-            SourceNat: this.NSX,
-            StaticNat: this.NSX,
-            PortForwarding: this.NSX,
-            Lb: this.NSX
-          }),
-          ...(forVpc && { NetworkACL: this.NSX }),
-          ...(!forVpc && { Firewall: this.NSX })
-        }
-      } else if (this.provider === 'Netris') {
-        this.netrisSupportedServicesMap = {
-          Dhcp: this.forVpc ? this.VPCVR : this.VR,
-          Dns: this.forVpc ? this.VPCVR : this.VR,
-          UserData: this.forVpc ? this.VPCVR : this.VR,
-          ...(this.networkmode === 'NATTED' && {
-            SourceNat: this.Netris,
-            StaticNat: this.Netris,
-            PortForwarding: this.Netris,
-            Lb: this.Netris
-          }),
-          ...(forVpc && { NetworkACL: this.Netris }),
-          ...(!forVpc && { Firewall: this.Netris })
-        }
-      }
+      this.refreshExternalSupportedServicesMap()
       this.updateSupportedServices()
     },
     handleProviderChange (provider) {
       this.provider = provider
-      if (this.provider === 'NSX') {
-        this.nsxSupportedServicesMap = {
-          Dhcp: this.forVpc ? this.VPCVR : this.VR,
-          Dns: this.forVpc ? this.VPCVR : this.VR,
-          UserData: this.forVpc ? this.VPCVR : this.VR,
-          ...(this.networkmode === 'NATTED' && {
-            SourceNat: this.NSX,
-            StaticNat: this.NSX,
-            PortForwarding: this.NSX,
-            Lb: this.NSX
-          }),
-          ...(this.forVpc && { NetworkACL: this.NSX }),
-          ...(!this.forVpc && { Firewall: this.NSX })
-        }
-      } else if (this.provider === 'Netris') {
-        this.netrisSupportedServicesMap = {
-          Dhcp: this.forVpc ? this.VPCVR : this.VR,
-          Dns: this.forVpc ? this.VPCVR : this.VR,
-          UserData: this.forVpc ? this.VPCVR : this.VR,
-          ...(this.networkmode === 'NATTED' && {
-            SourceNat: this.Netris,
-            StaticNat: this.Netris,
-            PortForwarding: this.Netris,
-            Lb: this.Netris
-          }),
-          ...(this.forVpc && { NetworkACL: this.Netris }),
-          ...(!this.forVpc && { Firewall: this.Netris })
-        }
-      }
+      this.refreshExternalSupportedServicesMap()
       this.fetchSupportedServiceData()
     },
     handleForNetworkModeChange (networkMode) {
       this.networkmode = networkMode
+      this.refreshExternalSupportedServicesMap()
       this.fetchSupportedServiceData()
     },
     handleNsxLbService (supportLb) {
-      if (!supportLb && 'Lb' in this.nsxSupportedServicesMap) {
-        delete this.nsxSupportedServicesMap.Lb
-      }
-      if (supportLb && !('Lb' in this.nsxSupportedServicesMap)) {
-        this.nsxSupportedServicesMap.Lb = this.NSX
-      }
+      this.form.nsxsupportlb = supportLb
+      this.refreshExternalSupportedServicesMap()
       this.fetchSupportedServiceData()
     },
     handleLbTypeChange (lbType) {
@@ -1054,6 +1068,10 @@ export default {
           this.fetchRegisteredServicePackageData()
           if (provider != null & provider !== undefined) {
             this.lbServiceProvider = provider
+            this.lbServiceChecked = true
+            if (provider === 'Netris') {
+              this.form.vmautoscalingcapability = true
+            }
           }
         } else {
           this.lbServiceProvider = ''
@@ -1061,7 +1079,7 @@ export default {
         this.lbServiceChecked = checked
       } else if (service === 'StaticNat') {
         this.staticNatServiceChecked = checked
-        if (checked && provider != null & provider !== undefined) {
+        if (checked && provider != null && provider !== undefined) {
           this.staticNatServiceProvider = provider
         } else {
           this.staticNatServiceProvider = ''
@@ -1070,13 +1088,13 @@ export default {
         this.connectivityServiceChecked = checked
       } else if (service === 'Firewall') {
         this.firewallServiceChecked = checked
-        if (checked && provider != null & provider !== undefined) {
-          this.staticNatServiceProvider = provider
+        if (checked && provider != null && provider !== undefined) {
+          this.firewallServiceProvider = provider
         } else {
-          this.staticNatServiceProvider = ''
+          this.firewallServiceProvider = ''
         }
       }
-      if (checked && provider != null & provider !== undefined) {
+      if (checked && provider != null && provider !== undefined) {
         this.selectedServiceProviderMap[service] = provider
       } else {
         delete this.selectedServiceProviderMap[service]
@@ -1195,16 +1213,19 @@ export default {
             delete params.supportspublicaccess
           }
           if (supportedServices.includes('SourceNat')) {
+            const isNetrisSourceNat = this.selectedServiceProviderMap.SourceNat === 'Netris'
             if (values.redundantroutercapability === true) {
               params['serviceCapabilityList[' + serviceCapabilityIndex + '].service'] = 'SourceNat'
               params['serviceCapabilityList[' + serviceCapabilityIndex + '].capabilitytype'] = 'RedundantRouter'
               params['serviceCapabilityList[' + serviceCapabilityIndex + '].capabilityvalue'] = true
               serviceCapabilityIndex++
             }
-            params['servicecapabilitylist[' + serviceCapabilityIndex + '].service'] = 'SourceNat'
-            params['servicecapabilitylist[' + serviceCapabilityIndex + '].capabilitytype'] = 'SupportedSourceNatTypes'
-            params['servicecapabilitylist[' + serviceCapabilityIndex + '].capabilityvalue'] = values.sourcenattype
-            serviceCapabilityIndex++
+            if (!isNetrisSourceNat) {
+              params['servicecapabilitylist[' + serviceCapabilityIndex + '].service'] = 'SourceNat'
+              params['servicecapabilitylist[' + serviceCapabilityIndex + '].capabilitytype'] = 'SupportedSourceNatTypes'
+              params['servicecapabilitylist[' + serviceCapabilityIndex + '].capabilityvalue'] = values.sourcenattype
+              serviceCapabilityIndex++
+            }
             delete params.redundantroutercapability
             delete params.sourcenattype
           } else if (values.redundantroutercapability === true) {
@@ -1232,7 +1253,7 @@ export default {
             if ('vmautoscalingcapability' in values) {
               params['servicecapabilitylist[' + serviceCapabilityIndex + '].service'] = 'lb'
               params['servicecapabilitylist[' + serviceCapabilityIndex + '].capabilitytype'] = 'VmAutoScaling'
-              params['servicecapabilitylist[' + serviceCapabilityIndex + '].capabilityvalue'] = values.vmautoscalingcapability
+              params['servicecapabilitylist[' + serviceCapabilityIndex + '].capabilityvalue'] = this.selectedServiceProviderMap.Lb === 'Netris' ? true : values.vmautoscalingcapability
               serviceCapabilityIndex++
             }
             if (values.elasticlb === true) {
diff --git a/ui/src/views/offering/AddVpcOffering.vue b/ui/src/views/offering/AddVpcOffering.vue
index d909cbdc3dca..3515ff9e9dd2 100644
--- a/ui/src/views/offering/AddVpcOffering.vue
+++ b/ui/src/views/offering/AddVpcOffering.vue
@@ -166,7 +166,7 @@
         <a-form-item name="distributedrouter" ref="distributedrouter" :label="$t('label.service.connectivity.distributedroutercapabilitycheckbox')" v-if="connectivityServiceChecked">
           <a-switch v-model:checked="form.distributedrouter" />
         </a-form-item>
-        <a-form-item name="redundantrouter" ref="redundantrouter" :label="$t('label.redundantrouter')" v-if="sourceNatServiceChecked">
+        <a-form-item name="redundantrouter" ref="redundantrouter" :label="$t('label.redundantrouter')" v-if="sourceNatServiceChecked || gatewayServiceChecked">
           <a-switch v-model:checked="form.redundantrouter" />
         </a-form-item>
         <a-form-item name="serviceofferingid" ref="serviceofferingid">
@@ -297,6 +297,7 @@ export default {
       isVpcVirtualRouterForAtLeastOneService: false,
       connectivityServiceChecked: false,
       sourceNatServiceChecked: false,
+      gatewayServiceChecked: false,
       selectedServiceProviderMap: {},
       ipv6NetworkOfferingEnabled: false,
       routedNetworkEnabled: false,
@@ -423,6 +424,8 @@ export default {
     },
     fetchSupportedServiceData () {
       var services = []
+      this.sourceNatServiceChecked = false
+      this.gatewayServiceChecked = false
       if (this.provider === 'NSX') {
         services.push({
           name: 'Dhcp',
@@ -509,6 +512,11 @@ export default {
           enabled: true,
           provider: [{ name: 'VpcVirtualRouter' }]
         })
+        services.push({
+          name: 'Vpn',
+          enabled: true,
+          provider: [{ name: 'VpcVirtualRouter' }]
+        })
       } else {
         services.push({
           name: 'Dhcp',
@@ -600,6 +608,13 @@ export default {
           })
         }
       }
+
+      if (this.Netris.name === this.form.provider && services.filter(svc => svc.name === 'SourceNat' && svc.provider[0].name === this.Netris.name).length > 0) {
+        this.sourceNatServiceChecked = true
+      }
+      if (this.Netris.name === this.form.provider && services.filter(svc => svc.name === 'Gateway').length > 0) {
+        this.gatewayServiceChecked = true
+      }
       for (var i in services) {
         services[i].description = services[i].name
       }
@@ -615,6 +630,10 @@ export default {
         this.form.nsxsupportlb = true
         this.handleNsxLbService(true)
       }
+      if (this.provider === 'Netris') {
+        this.form.networkmode = 'NATTED'
+        this.networkmode = 'NATTED'
+      }
       this.fetchSupportedServiceData()
     },
     handleNsxLbService (supportLb) {
@@ -753,7 +772,10 @@ export default {
             params['serviceCapabilityList[' + serviceCapabilityIndex + '].capabilityvalue'] = true
             serviceCapabilityIndex++
           } else if (values.redundantrouter === true) {
-            params['serviceCapabilityList[' + serviceCapabilityIndex + '].service'] = 'Gateway'
+            // For Netris NATTED (where SourceNat is auto-added server-side but not in the local map),
+            // use SourceNat. For all other cases (e.g. ROUTED VPC VR), use Gateway.
+            const redundantRouterService = (forNetris && values.networkmode !== 'ROUTED') ? 'SourceNat' : 'Gateway'
+            params['serviceCapabilityList[' + serviceCapabilityIndex + '].service'] = redundantRouterService
             params['serviceCapabilityList[' + serviceCapabilityIndex + '].capabilitytype'] = 'RedundantRouter'
             params['serviceCapabilityList[' + serviceCapabilityIndex + '].capabilityvalue'] = true
             serviceCapabilityIndex++

From 546569bf24d35ff75dcb694ba5192ebfdb829993 Mon Sep 17 00:00:00 2001
From: Pearl Dsilva <pearl1594@gmail.com>
Date: Tue, 13 Oct 2026 20:39:30 -0400
Subject: [PATCH 33/41] Improve performance of listTemplates API (#13566)

* Bypass logic to create template_pair from 6 tables, with fallback

* added bypass logic to create template_pair from 6 tables, fallback for hard filters

* Removed batching, checking against per pair

* follow try-with-resources design

* unit tests for the bypass logic

* Fix cross-zone template lookup in listTemplates Phase 2

When temp_zone_pair has dcId=0 (cross-zone template with no
data_center), use IS NULL predicate instead of broken EQ/IN
with literal 0 which never matches NULL rows.

* Add filter for non-root domain-admin users

---------

Co-authored-by: anishadas <adas33@apple.com>
Co-authored-by: Aaron Chung <aaron_chung@apple.com>

* Add @Ignore, remove logs/comments (#824)

Co-authored-by: anishadas <adas33@apple.com>
(cherry picked from commit f6c9fd1081f0e1d9386db08e86485b482bf064ab)

* Improve BypassTemplateView config description and rename helper method

* remove logger

* Fix issue with listing templates when filtered on name / keyword - count is correct, but lists all templates

* listTemplates bypass: honor templatetype/isvnf/forcks, EXTERNAL ready format and view-consistent showunique paging

Add templateType, isVnf and forCks to TemplateListFilter and the bypass
WHERE clause, treat EXTERNAL like BAREMETAL for onlyReady, and tie-break
showunique pages on CONCAT(vt.id, '_') so page boundaries match the view
path. Update stale domainPath fallback comments and add unit tests.

* address comments

* honor arch, osCategory, extension, imageStore and domain/isrecursive scoping; fall back for storagePoolId

---------

Co-authored-by: aniishadas <32420385+aniishadas@users.noreply.github.com>
Co-authored-by: anishadas <adas33@apple.com>
Co-authored-by: Aaron Chung <aaron_chung@apple.com>
Co-authored-by: mprokopchuk <mprokopchuk@apple.com>
Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>
---
 .../apache/cloudstack/query/QueryService.java |   6 +
 .../com/cloud/api/query/QueryManagerImpl.java | 160 ++++++-
 .../cloud/api/query/dao/TemplateJoinDao.java  |  15 +
 .../api/query/dao/TemplateJoinDaoImpl.java    | 371 ++++++++++++++--
 .../api/query/dao/TemplateListFilter.java     | 258 ++++++++++++
 .../vo/BaseViewWithTagInformationVO.java      |   4 +
 .../cloud/api/query/vo/TemplateJoinVO.java    |   4 +
 .../TemplateJoinDaoImplBypassExplainTest.java | 398 ++++++++++++++++++
 .../query/dao/TemplateJoinDaoImplTest.java    |  65 +++
 9 files changed, 1235 insertions(+), 46 deletions(-)
 create mode 100644 server/src/main/java/com/cloud/api/query/dao/TemplateListFilter.java
 create mode 100644 server/src/test/java/com/cloud/api/query/dao/TemplateJoinDaoImplBypassExplainTest.java

diff --git a/api/src/main/java/org/apache/cloudstack/query/QueryService.java b/api/src/main/java/org/apache/cloudstack/query/QueryService.java
index 5cd67ffe9bad..0a716d9ca5b1 100644
--- a/api/src/main/java/org/apache/cloudstack/query/QueryService.java
+++ b/api/src/main/java/org/apache/cloudstack/query/QueryService.java
@@ -140,6 +140,12 @@ public interface QueryService {
     ConfigKey<Boolean> ReturnVmStatsOnVmList = new ConfigKey<>("Advanced", Boolean.class, "list.vm.default.details.stats", "true",
             "Determines whether VM stats should be returned when details are not explicitly specified in listVirtualMachines API request. When false, details default to [group, nics, secgrp, tmpl, servoff, diskoff, backoff, iso, volume, min, affgrp]. When true, all details are returned including 'stats'.", true, ConfigKey.Scope.Global);
 
+    ConfigKey<Boolean> BypassTemplateView = new ConfigKey<>("Advanced", Boolean.class, "template.list.bypass.view",
+            "false",
+            "If true, uses an optimized query path for listing templates and ISOs, which can improve performance on " +
+                    "deployments with large numbers of templates. Automatically falls back to the standard query when " +
+                    "filtering by tags, using the shared, featured, or community template filters, or when including " +
+                    "removed templates.", true, ConfigKey.Scope.Global);
 
     ListResponse<UserResponse> searchForUsers(ResponseObject.ResponseView responseView, ListUsersCmd cmd) throws PermissionDeniedException;
 
diff --git a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
index 18f266ebccc2..d557ceb9ce3f 100644
--- a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
+++ b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
@@ -207,6 +207,7 @@
 import com.cloud.api.query.dao.SnapshotJoinDao;
 import com.cloud.api.query.dao.StoragePoolJoinDao;
 import com.cloud.api.query.dao.TemplateJoinDao;
+import com.cloud.api.query.dao.TemplateListFilter;
 import com.cloud.api.query.dao.UserAccountJoinDao;
 import com.cloud.api.query.dao.UserVmJoinDao;
 import com.cloud.api.query.dao.VolumeJoinDao;
@@ -328,6 +329,7 @@
 import com.cloud.storage.dao.VolumeDao;
 import com.cloud.tags.ResourceTagVO;
 import com.cloud.tags.dao.ResourceTagDao;
+import com.cloud.template.VirtualMachineTemplate;
 import com.cloud.template.VirtualMachineTemplate.State;
 import com.cloud.template.VirtualMachineTemplate.TemplateFilter;
 import com.cloud.user.Account;
@@ -4989,8 +4991,9 @@ private Pair<List<TemplateJoinVO>, Integer> searchForTemplatesInternal(Long temp
             sc.setJoinParameters("storagePool", "pool_id", storagePoolId);
         }
 
+        List<Long> guestOsIds = null;
         if (osCategoryId != null) {
-            List<Long> guestOsIds = guestOSDao.listIdsByCategoryId(osCategoryId);
+            guestOsIds = guestOSDao.listIdsByCategoryId(osCategoryId);
             if (CollectionUtils.isNotEmpty(guestOsIds)) {
                 sc.setParameters("guestOsIdIN", guestOsIds.toArray());
             } else {
@@ -5146,7 +5149,12 @@ else if (!template.isPublicTemplate() && caller.getType() != Account.Type.ADMIN)
         applyPublicTemplateSharingRestrictions(sc, caller);
 
         return templateChecks(isIso, hypers, tags, name, keyword, hyperType, onlyReady, bootable, zoneId, showDomr, caller,
-                showRemovedTmpl, parentTemplateId, showUnique, templateType, isVnf, forCks, searchFilter, sc);
+                showRemovedTmpl, parentTemplateId, showUnique, templateType, isVnf, forCks, searchFilter, sc,
+                buildTemplateListFilter(templateId, ids, name, keyword, templateFilter, isIso, bootable,
+                        pageSize, startIndex, zoneId, hyperType, hypers, showDomr, onlyReady,
+                        permittedAccounts, caller, listProjectResourcesCriteria, tags, showRemovedTmpl,
+                        parentTemplateId, showUnique, templateType, isVnf, forCks, arch, guestOsIds, extensionId,
+                        imageStoreId, storagePoolId, domainId, isRecursive));
     }
 
     /**
@@ -5201,7 +5209,8 @@ protected boolean checkIfDomainSharesTemplates(Long domainId) {
     private Pair<List<TemplateJoinVO>, Integer> templateChecks(boolean isIso, List<HypervisorType> hypers, Map<String, String> tags, String name, String keyword,
                                                                HypervisorType hyperType, boolean onlyReady, Boolean bootable, Long zoneId, boolean showDomr, Account caller,
                                                                boolean showRemovedTmpl, Long parentTemplateId, Boolean showUnique, String templateType, Boolean isVnf, Boolean forCks,
-                                                               Filter searchFilter, SearchCriteria<TemplateJoinVO> sc) {
+                                                               Filter searchFilter, SearchCriteria<TemplateJoinVO> sc,
+                                                               TemplateListFilter listFilter) {
         if (!isIso) {
             // add hypervisor criteria for template case
             if (hypers != null && !hypers.isEmpty()) {
@@ -5308,6 +5317,14 @@ private Pair<List<TemplateJoinVO>, Integer> templateChecks(boolean isIso, List<H
 
         // search unique templates and find details by Ids
         Pair<List<TemplateJoinVO>, Integer> uniqueTmplPair;
+
+        // Only attempted when the bypass DAO supports the filter set; falls
+        // back to the SearchBuilder/template_view path below otherwise.
+        if (!showRemovedTmpl && BypassTemplateView.value() && listFilter != null && listFilter.canBypass()) {
+            uniqueTmplPair = _templateJoinDao.findDistinctTempZonePairs(listFilter);
+            return findTemplatesByIdOrTempZonePair(uniqueTmplPair, showRemovedTmpl, showUnique != null && showUnique, caller);
+        }
+
         if (showRemovedTmpl) {
             uniqueTmplPair = _templateJoinDao.searchIncludingRemovedAndCount(sc, searchFilter);
         } else {
@@ -5329,6 +5346,140 @@ private Pair<List<TemplateJoinVO>, Integer> templateChecks(boolean isIso, List<H
         // about what the code was doing.
     }
 
+    /**
+     * Build the immutable filter the bypass-the-view DAO consumes. Mirrors the
+     * SearchCriteria construction in {@link #searchForTemplatesInternal}; the
+     * SearchBuilder path is unchanged. The "hard" markers (sharedAccountIds,
+     * domainIdsForFeaturedCommunity, tags, requiresViewFallback) drive
+     * {@link TemplateListFilter#canBypass()} — when any are populated,
+     * {@code templateChecks} routes to the legacy view-based path instead.
+     */
+    private TemplateListFilter buildTemplateListFilter(Long templateId, List<Long> ids, String name, String keyword,
+                                                       TemplateFilter templateFilter, boolean isIso, Boolean bootable,
+                                                       Long pageSize, Long startIndex, Long zoneId, HypervisorType hyperType,
+                                                       List<HypervisorType> hypers, boolean showDomr, boolean onlyReady,
+                                                       List<Account> permittedAccounts, Account caller,
+                                                       ListProjectResourcesCriteria listProjectResourcesCriteria,
+                                                       Map<String, String> tags, boolean showRemovedTmpl, Long parentTemplateId,
+                                                       Boolean showUnique, String templateType, Boolean isVnf, Boolean forCks,
+                                                       CPU.CPUArch arch, List<Long> guestOsIds, Long extensionId, Long imageStoreId,
+                                                       Long storagePoolId, Long domainId, boolean isRecursive) {
+        TemplateListFilter.Builder b = TemplateListFilter.builder()
+                .templateId(templateId)
+                .ids(ids == null ? null : new ArrayList<>(ids))
+                .name(name)
+                .keyword(keyword)
+                .hypervisorType(hyperType != null && !HypervisorType.None.equals(hyperType) ? hyperType : null)
+                .availableHypervisors(hypers)
+                .format(ImageFormat.ISO)  // bypass DAO uses isIso flag to flip between EQ and NEQ
+                .isIso(isIso)
+                .bootable(bootable)
+                .parentTemplateId(parentTemplateId)
+                .zoneId(zoneId)
+                .onlyReady(onlyReady)
+                .excludeSystemTemplates(!showDomr)
+                .templateType(templateType)
+                .isVnf(isVnf)
+                .forCks(forCks)
+                .arch(arch)
+                .guestOsIds(guestOsIds)
+                .extensionId(extensionId)
+                .imageStoreId(imageStoreId)
+                .showUnique(showUnique != null && showUnique)
+                .startIndex(startIndex)
+                .pageSize(pageSize)
+                .sortAscending(SortKeyAscending.value())
+                .showRemoved(showRemovedTmpl)
+                .tags(tags);
+
+        if (!showRemovedTmpl) {
+            b.templateStates(Arrays.asList(VirtualMachineTemplate.State.Active,
+                    VirtualMachineTemplate.State.UploadAbandoned,
+                    VirtualMachineTemplate.State.UploadError,
+                    VirtualMachineTemplate.State.NotUploaded,
+                    VirtualMachineTemplate.State.UploadInProgress));
+        }
+
+        // accountType filter (Project vs non-Project), applied only when no specific templateId.
+        if (templateId == null && listProjectResourcesCriteria == ListProjectResourcesCriteria.SkipProjectResources) {
+            b.accountTypeNeq(Account.Type.PROJECT);
+        } else if (templateId == null && listProjectResourcesCriteria == ListProjectResourcesCriteria.ListProjectResourcesOnly) {
+            b.accountTypeEq(Account.Type.PROJECT);
+        }
+
+        // ACL handling — mirrors the templateFilter switch in searchForTemplatesInternal.
+        // For "hard" templateFilter values, set requiresViewFallback so canBypass() returns
+        // false and the dispatcher falls back to the legacy view-based path.
+        if (templateId != null) {
+            return b.build();
+        }
+
+        // template_spool_ref join is not modeled in bypass SQL.
+        if (storagePoolId != null) {
+            b.requiresViewFallback(true);
+        }
+
+        List<Long> permittedAccountIds = new ArrayList<>();
+        for (Account account : permittedAccounts) {
+            permittedAccountIds.add(account.getId());
+        }
+
+        if (templateFilter == TemplateFilter.featured || templateFilter == TemplateFilter.community) {
+            // Walks the domain hierarchy and ORs domainId IS NULL — not yet modeled in bypass SQL.
+            b.publicTemplate(Boolean.TRUE);
+            b.featured(templateFilter == TemplateFilter.featured ? Boolean.TRUE : Boolean.FALSE);
+            b.requiresViewFallback(true);
+        } else if (templateFilter == TemplateFilter.self || templateFilter == TemplateFilter.selfexecutable) {
+            if (accountMgr.isAdmin(caller.getAccountId())) {
+                applySelfDomainScope(b, permittedAccounts, caller, domainId, isRecursive);
+            }
+            if (!permittedAccountIds.isEmpty()) {
+                b.accountIds(permittedAccountIds);
+                b.accountIdRequiredForFilter(true);
+            }
+        } else if (templateFilter == TemplateFilter.sharedexecutable || templateFilter == TemplateFilter.shared) {
+            // launch_permission join — not modeled in bypass SQL.
+            b.requiresViewFallback(true);
+        } else if (templateFilter == TemplateFilter.executable) {
+            b.publicOrAccountIdComposite(true);
+            if (!permittedAccountIds.isEmpty()) {
+                b.accountIds(permittedAccountIds);
+            }
+        } else if (templateFilter == TemplateFilter.all && caller.getType() != Account.Type.ADMIN) {
+            // Non-admin "all" composite splits on listProjectResourcesCriteria:
+            //   SkipProjectResources → (public OR domainPath LIKE)         — bypass-eligible
+            //   else                 → (public OR account_id IN OR sharedAccountId IN) — needs launch_permission, falls back
+            if (listProjectResourcesCriteria == ListProjectResourcesCriteria.SkipProjectResources) {
+                DomainVO callerDomain = _domainDao.findById(caller.getDomainId());
+                if (callerDomain != null) {
+                    b.publicOrDomainPathComposite(true);
+                    b.domainPathLike(callerDomain.getPath() + "%");
+                } else {
+                    b.requiresViewFallback(true);
+                }
+            } else {
+                b.requiresViewFallback(true);
+            }
+        }
+
+        return b.build();
+    }
+
+    // Mirrors the admin domain-path scoping of the view path for self/selfexecutable.
+    private void applySelfDomainScope(TemplateListFilter.Builder b, List<Account> permittedAccounts, Account caller,
+                                      Long domainId, boolean isRecursive) {
+        Long domainIdForScope = !permittedAccounts.isEmpty()
+                ? permittedAccounts.get(0).getDomainId()
+                : Objects.requireNonNullElse(domainId, caller.getDomainId());
+        DomainVO scopeDomain = _domainDao.findById(domainIdForScope);
+        // A recursive scope from the root domain matches every row, so skip the domain join.
+        if (scopeDomain == null || (isRecursive && scopeDomain.getId() == Domain.ROOT_DOMAIN)) {
+            return;
+        }
+        b.domainPathLike(isRecursive ? scopeDomain.getPath() + "%" : scopeDomain.getPath());
+        b.domainPathExact(!isRecursive);
+    }
+
     // findTemplatesByIdOrTempZonePair returns the templates with the given ids if showUnique is true, or else by the TempZonePair
     private Pair<List<TemplateJoinVO>, Integer> findTemplatesByIdOrTempZonePair(Pair<List<TemplateJoinVO>, Integer> templateDataPair,
                                                                                 boolean showRemoved, boolean showUnique, Account caller) {
@@ -6342,7 +6493,8 @@ public String getConfigComponentName() {
     @Override
     public ConfigKey<?>[] getConfigKeys() {
         return new ConfigKey<?>[] {AllowUserViewDestroyedVM, UserVMDeniedDetails, UserVMReadOnlyDetails, SortKeyAscending,
-                AllowUserViewAllDomainAccounts, AllowUserViewAllDataCenters, SharePublicTemplatesWithOtherDomains, ReturnVmStatsOnVmList};
+                AllowUserViewAllDomainAccounts, AllowUserViewAllDataCenters, SharePublicTemplatesWithOtherDomains,
+                ReturnVmStatsOnVmList, BypassTemplateView };
     }
 
     @Override
diff --git a/server/src/main/java/com/cloud/api/query/dao/TemplateJoinDao.java b/server/src/main/java/com/cloud/api/query/dao/TemplateJoinDao.java
index a7b82e47265a..2a09b02fd139 100644
--- a/server/src/main/java/com/cloud/api/query/dao/TemplateJoinDao.java
+++ b/server/src/main/java/com/cloud/api/query/dao/TemplateJoinDao.java
@@ -52,5 +52,20 @@ public interface TemplateJoinDao extends GenericDao<TemplateJoinVO, Long> {
 
     Pair<List<TemplateJoinVO>, Integer> searchIncludingRemovedAndCount(final SearchCriteria<TemplateJoinVO> sc, final Filter filter);
 
+    /**
+     * Bypass-the-view Phase 1 implementation. Issues a hand-tuned SQL query
+     * directly against the underlying tables (vm_template, account,
+     * template_store_ref, image_store, template_zone_ref, data_center) instead
+     * of going through {@code template_view}. Caller must check
+     * {@link TemplateListFilter#canBypass()} first; this method does not handle
+     * tags, sharedAccountIds, or featured/community-style domainId
+     * filters and will throw IllegalArgumentException if those are populated.
+     *
+     * Returns TemplateJoinVO objects with only {@code id} (when
+     * {@code filter.showUnique}) or {@code tempZonePair} populated, plus the
+     * total distinct count for pagination.
+     */
+    Pair<List<TemplateJoinVO>, Integer> findDistinctTempZonePairs(TemplateListFilter filter);
+
     List<TemplateJoinVO> findByDistinctIds(Long... ids);
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/TemplateJoinDaoImpl.java b/server/src/main/java/com/cloud/api/query/dao/TemplateJoinDaoImpl.java
index bd73fee5c593..404b0bb8a034 100644
--- a/server/src/main/java/com/cloud/api/query/dao/TemplateJoinDaoImpl.java
+++ b/server/src/main/java/com/cloud/api/query/dao/TemplateJoinDaoImpl.java
@@ -16,6 +16,9 @@
 // under the License.
 package com.cloud.api.query.dao;
 
+import java.sql.PreparedStatement;
+import java.sql.ResultSet;
+import java.sql.SQLException;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.EnumSet;
@@ -82,6 +85,8 @@
 import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
+import com.cloud.utils.db.TransactionLegacy;
+import com.cloud.utils.exception.CloudRuntimeException;
 
 
 @Component
@@ -117,6 +122,8 @@ public class TemplateJoinDaoImpl extends GenericDaoBaseWithTagInformation<Templa
 
     private final SearchBuilder<TemplateJoinVO> tmpltIdPairSearch;
 
+    private final SearchBuilder<TemplateJoinVO> tmpltIdPairCrossZoneSearch;
+
     private final SearchBuilder<TemplateJoinVO> tmpltIdSearch;
 
     private final SearchBuilder<TemplateJoinVO> tmpltIdsSearch;
@@ -130,10 +137,15 @@ public class TemplateJoinDaoImpl extends GenericDaoBaseWithTagInformation<Templa
     protected TemplateJoinDaoImpl() {
 
         tmpltIdPairSearch = createSearchBuilder();
-        tmpltIdPairSearch.and("templateState", tmpltIdPairSearch.entity().getTemplateState(), SearchCriteria.Op.IN);
-        tmpltIdPairSearch.and("tempZonePairIN", tmpltIdPairSearch.entity().getTempZonePair(), SearchCriteria.Op.IN);
+        tmpltIdPairSearch.and("template_dc_pair_templateid", tmpltIdPairSearch.entity().getId(), SearchCriteria.Op.EQ);
+        tmpltIdPairSearch.and("template_dc_pair_dcid", tmpltIdPairSearch.entity().getDataCenterId(), SearchCriteria.Op.EQ);
         tmpltIdPairSearch.done();
 
+        tmpltIdPairCrossZoneSearch = createSearchBuilder();
+        tmpltIdPairCrossZoneSearch.and("template_dc_pair_templateid", tmpltIdPairCrossZoneSearch.entity().getId(), SearchCriteria.Op.EQ);
+        tmpltIdPairCrossZoneSearch.and("template_dc_pair_dcid", tmpltIdPairCrossZoneSearch.entity().getDataCenterId(), SearchCriteria.Op.NULL);
+        tmpltIdPairCrossZoneSearch.done();
+
         tmpltIdSearch = createSearchBuilder();
         tmpltIdSearch.and("id", tmpltIdSearch.entity().getId(), SearchCriteria.Op.EQ);
         tmpltIdSearch.done();
@@ -633,55 +645,48 @@ public List<TemplateJoinVO> newTemplateView(VirtualMachineTemplate template, lon
 
     @Override
     public List<TemplateJoinVO> searchByTemplateZonePair(Boolean showRemoved, String... idPairs) {
-        // set detail batch query size
-        int DETAILS_BATCH_SIZE = 2000;
-        String batchCfg = _configDao.getValue("detail.batch.query.size");
-        if (batchCfg != null) {
-            DETAILS_BATCH_SIZE = Integer.parseInt(batchCfg);
-        }
-        // query details by batches
         Filter searchFilter = new Filter(TemplateJoinVO.class, "sortKey", QueryService.SortKeyAscending.value(), null, null);
         searchFilter.addOrderBy(TemplateJoinVO.class, "tempZonePair", QueryService.SortKeyAscending.value());
+
         List<TemplateJoinVO> uvList = new ArrayList<TemplateJoinVO>();
-        // query details by batches
-        int curr_index = 0;
-        if (idPairs.length > DETAILS_BATCH_SIZE) {
-            while ((curr_index + DETAILS_BATCH_SIZE) <= idPairs.length) {
-                String[] labels = new String[DETAILS_BATCH_SIZE];
-                for (int k = 0, j = curr_index; j < curr_index + DETAILS_BATCH_SIZE; j++, k++) {
-                    labels[k] = idPairs[j];
-                }
-                SearchCriteria<TemplateJoinVO> sc = tmpltIdPairSearch.create();
-                if (!showRemoved) {
-                    sc.setParameters("templateState", VirtualMachineTemplate.State.Active);
-                }
-                sc.setParameters("tempZonePairIN", labels);
-                List<TemplateJoinVO> vms = searchIncludingRemoved(sc, searchFilter, null, false);
-                if (vms != null) {
-                    uvList.addAll(vms);
-                }
-                curr_index += DETAILS_BATCH_SIZE;
-            }
+        if (idPairs == null || idPairs.length == 0) {
+            return uvList;
         }
-        if (curr_index < idPairs.length) {
-            int batch_size = (idPairs.length - curr_index);
-            String[] labels = new String[batch_size];
-            for (int k = 0, j = curr_index; j < curr_index + batch_size; j++, k++) {
-                labels[k] = idPairs[j];
-            }
-            SearchCriteria<TemplateJoinVO> sc = tmpltIdPairSearch.create();
-            if (!showRemoved) {
-                sc.setParameters("templateState", VirtualMachineTemplate.State.Active, VirtualMachineTemplate.State.UploadAbandoned, VirtualMachineTemplate.State.UploadError ,VirtualMachineTemplate.State.NotUploaded, VirtualMachineTemplate.State.UploadInProgress);
-            }
-            sc.setParameters("tempZonePairIN", labels);
-            List<TemplateJoinVO> vms = searchIncludingRemoved(sc, searchFilter, null, false);
-            if (vms != null) {
-                uvList.addAll(vms);
+
+        for (String idPair : idPairs) {
+            SearchCriteria<TemplateJoinVO> sc = buildTemplateZonePairSearchCriteria(idPair);
+            List<TemplateJoinVO> rows = searchIncludingRemoved(sc, searchFilter, null, false);
+            if (rows != null) {
+                uvList.addAll(rows);
             }
         }
         return uvList;
     }
 
+    private SearchCriteria<TemplateJoinVO> buildTemplateZonePairSearchCriteria(String idPair) {
+        if (idPair == null || idPair.isEmpty()) {
+            throw new IllegalArgumentException("template zone pair id is null or empty");
+        }
+        // eg "3124_3" → templateId=3124, dcId=3
+        String[] parts = idPair.split("_");
+        if (parts.length != 2) {
+            throw new IllegalArgumentException("unexpected template zone pair id format: " + idPair);
+        }
+        long templateId = Long.parseLong(parts[0]);
+        long dcId = Long.parseLong(parts[1]);
+
+        SearchCriteria<TemplateJoinVO> sc;
+        if (dcId == 0) {
+            sc = tmpltIdPairCrossZoneSearch.create();
+            sc.setParameters("template_dc_pair_templateid", templateId);
+        } else {
+            sc = tmpltIdPairSearch.create();
+            sc.setParameters("template_dc_pair_templateid", templateId);
+            sc.setParameters("template_dc_pair_dcid", dcId);
+        }
+        return sc;
+    }
+
     @Override
     public List<TemplateJoinVO> listActiveTemplates(long storeId) {
         SearchCriteria<TemplateJoinVO> sc = activeTmpltSearch.create();
@@ -705,6 +710,288 @@ public Pair<List<TemplateJoinVO>, Integer> searchIncludingRemovedAndCount(final
         return new Pair<List<TemplateJoinVO>, Integer>(objects, count);
     }
 
+    // Bypass path: queries only the 6 tables needed for the (template, zone) pair instead of template_view.
+
+    @Override
+    public Pair<List<TemplateJoinVO>, Integer> findDistinctTempZonePairs(TemplateListFilter filter) {
+        if (!filter.canBypass()) {
+            throw new IllegalArgumentException(
+                    "findDistinctTempZonePairs called with unsupported filter (tags / sharedAccountIds / domainIds populated). Caller should fall back to searchAndDistinctCount.");
+        }
+
+        List<Object> params = new ArrayList<>();
+        StringBuilder where = new StringBuilder(" WHERE 1=1");
+        appendCommonWhere(where, params, filter);
+
+        String fromClause = buildFromClause(filter);
+
+        String selectExpr = filter.showUnique
+                ? "vt.id"
+                : "CONCAT(vt.id, '_', IFNULL(dc.id, 0))";
+
+        // Tie-break on the "<id>_<zone>" string like the view path so pages line up; with showUnique
+        // the zone part is dropped as it is not in the DISTINCT select list.
+        String tieBreakExpr = filter.showUnique ? "CONCAT(vt.id, '_')" : "distinct_key";
+
+        String dataSql = "SELECT DISTINCT " + selectExpr + " AS distinct_key, vt.sort_key"
+                + " FROM " + fromClause
+                + where
+                + " ORDER BY vt.sort_key " + (filter.sortAscending ? "ASC" : "DESC")
+                + ", " + tieBreakExpr + " " + (filter.sortAscending ? "ASC" : "DESC")
+                + buildLimitClause(filter);
+
+        String countSql = "SELECT COUNT(DISTINCT " + selectExpr + ")"
+                + " FROM " + fromClause
+                + where;
+
+        List<TemplateJoinVO> rows = executeDistinctQuery(dataSql, params, filter.showUnique);
+        int count = executeCountQuery(countSql, params);
+        return new Pair<>(rows, count);
+    }
+
+    /**
+     * Build the FROM clause. The 6-table base is always present; conditional
+     * joins are added when the filter actually needs them. Today only
+     * `domain` is conditional (used for {@code domainPathLike} predicates);
+     * `launch_permission` and `resource_tags` are added in later iterations.
+     */
+    private String buildFromClause(TemplateListFilter filter) {
+        StringBuilder from = new StringBuilder()
+                .append("cloud.vm_template vt")
+                .append(" JOIN cloud.account a ON a.id = vt.account_id")
+                .append(" LEFT JOIN cloud.template_store_ref tsr")
+                .append("   ON tsr.template_id = vt.id AND tsr.store_role = 'Image' AND tsr.destroyed = 0")
+                .append(" LEFT JOIN cloud.image_store img")
+                .append("   ON img.id = tsr.store_id AND img.removed IS NULL")
+                .append(" LEFT JOIN cloud.template_zone_ref tzr")
+                .append("   ON tzr.template_id = vt.id AND tsr.store_id IS NULL AND tzr.removed IS NULL")
+                .append(" LEFT JOIN cloud.data_center dc")
+                .append("   ON dc.id = COALESCE(img.data_center_id, tzr.zone_id)");
+
+        if (filter.domainPathLike != null) {
+            from.append(" JOIN cloud.domain d ON d.id = a.domain_id");
+        }
+        return from.toString();
+    }
+
+    void appendCommonWhere(StringBuilder where, List<Object> params, TemplateListFilter filter) {
+        if (filter.templateId != null) {
+            where.append(" AND vt.id = ?");
+            params.add(filter.templateId);
+        }
+
+        if (!filter.ids.isEmpty()) {
+            where.append(" AND vt.id IN ").append(inClausePlaceholders(filter.ids.size()));
+            params.addAll(filter.ids);
+        }
+
+        if (filter.keyword != null) {
+            where.append(" AND vt.name LIKE ?");
+            params.add("%" + filter.keyword + "%");
+        } else if (filter.name != null) {
+            where.append(" AND vt.name = ?");
+            params.add(filter.name);
+        }
+
+        if (filter.format != null) {
+            // searchForTemplatesInternal: format = 'ISO' for isos, format != 'ISO' otherwise.
+            String condition = filter.isIso ? "=" : "!=";
+            where.append(" AND vt.format " + condition + " 'ISO'");
+        }
+
+        if (filter.hypervisorType != null) {
+            where.append(" AND vt.hypervisor_type = ?");
+            params.add(filter.hypervisorType.toString());
+        }
+
+        if (!filter.availableHypervisors.isEmpty()) {
+            where.append(" AND vt.hypervisor_type IN ").append(inClausePlaceholders(filter.availableHypervisors.size()));
+            for (HypervisorType h : filter.availableHypervisors) {
+                params.add(h.toString());
+            }
+        }
+
+        if (filter.publicTemplate != null && !filter.publicOrAccountIdComposite) {
+            where.append(" AND vt.public = ?");
+            params.add(filter.publicTemplate ? 1 : 0);
+        }
+
+        if (filter.featured != null) {
+            where.append(" AND vt.featured = ?");
+            params.add(filter.featured ? 1 : 0);
+        }
+
+        if (filter.bootable != null) {
+            where.append(" AND vt.bootable = ?");
+            params.add(filter.bootable ? 1 : 0);
+        }
+
+        if (filter.parentTemplateId != null) {
+            where.append(" AND vt.parent_template_id = ?");
+            params.add(filter.parentTemplateId);
+        }
+
+        if (filter.excludeSystemTemplates) {
+            where.append(" AND vt.type != 'SYSTEM'");
+        }
+
+        if (filter.templateType != null) {
+            where.append(" AND vt.type = ?");
+            params.add(filter.templateType);
+        }
+
+        if (filter.isVnf != null) {
+            where.append(filter.isVnf ? " AND vt.type = 'VNF'" : " AND vt.type != 'VNF'");
+        }
+
+        if (filter.forCks != null) {
+            where.append(" AND vt.for_cks = ?");
+            params.add(filter.forCks ? 1 : 0);
+        }
+
+        if (filter.arch != null) {
+            where.append(" AND vt.arch = ?");
+            params.add(filter.arch.getType());
+        }
+
+        if (!filter.guestOsIds.isEmpty()) {
+            where.append(" AND vt.guest_os_id IN ").append(inClausePlaceholders(filter.guestOsIds.size()));
+            params.addAll(filter.guestOsIds);
+        }
+
+        if (filter.extensionId != null) {
+            where.append(" AND vt.extension_id = ?");
+            params.add(filter.extensionId);
+        }
+
+        if (filter.imageStoreId != null) {
+            where.append(" AND tsr.store_id = ?");
+            params.add(filter.imageStoreId);
+        }
+
+        if (filter.accountTypeNeq != null) {
+            where.append(" AND a.type != ?");
+            params.add(filter.accountTypeNeq.ordinal());
+        }
+        if (filter.accountTypeEq != null) {
+            where.append(" AND a.type = ?");
+            params.add(filter.accountTypeEq.ordinal());
+        }
+
+        // ACL — accountIds: either pure IN, or composite OR with public=true.
+        if (filter.publicOrAccountIdComposite) {
+            where.append(" AND (vt.public = 1");
+            if (!filter.accountIds.isEmpty()) {
+                where.append(" OR vt.account_id IN ").append(inClausePlaceholders(filter.accountIds.size()));
+                params.addAll(filter.accountIds);
+            }
+            where.append(")");
+        } else if (filter.publicOrDomainPathComposite) {
+            // all + non-admin + SkipProjectResources: (public OR domain.path LIKE)
+            where.append(" AND (vt.public = 1");
+            if (filter.domainPathLike != null) {
+                where.append(" OR d.path LIKE ?");
+                params.add(filter.domainPathLike);
+            }
+            where.append(")");
+        } else if (filter.accountIdRequiredForFilter && !filter.accountIds.isEmpty()) {
+            where.append(" AND vt.account_id IN ").append(inClausePlaceholders(filter.accountIds.size()));
+            params.addAll(filter.accountIds);
+        }
+
+        // Standalone domain_path predicate — used when domainPathLike is set
+        // outside any composite (self/selfexecutable + DOMAIN_ADMIN scoping).
+        if (filter.domainPathLike != null
+                && !filter.publicOrDomainPathComposite) {
+            where.append(filter.domainPathExact ? " AND d.path = ?" : " AND d.path LIKE ?");
+            params.add(filter.domainPathLike);
+        }
+
+        if (filter.zoneId != null) {
+            // mirrors templateChecks(): zone match OR REGION-scoped store OR (ISO + PERHOST)
+            where.append(" AND (dc.id = ? OR img.scope = 'REGION' OR (vt.format = 'ISO' AND vt.type = 'PERHOST'))");
+            params.add(filter.zoneId);
+        }
+
+        if (filter.onlyReady) {
+            // mirrors templateChecks(): tsr Ready OR BAREMETAL/EXTERNAL format OR (ISO + PERHOST)
+            where.append(" AND (tsr.state = 'Ready' OR vt.format IN ('BAREMETAL', 'EXTERNAL') OR (vt.format = 'ISO' AND vt.type = 'PERHOST'))");
+        }
+
+        if (!filter.showRemoved) {
+            where.append(" AND vt.removed IS NULL");
+            if (!filter.templateStates.isEmpty()) {
+                where.append(" AND vt.state IN ").append(inClausePlaceholders(filter.templateStates.size()));
+                for (VirtualMachineTemplate.State s : filter.templateStates) {
+                    params.add(s.toString());
+                }
+            }
+        }
+    }
+
+    private String buildLimitClause(TemplateListFilter filter) {
+        if (filter.pageSize == null) {
+            return "";
+        }
+        long start = filter.startIndex == null ? 0L : filter.startIndex;
+        return " LIMIT " + start + ", " + filter.pageSize;
+    }
+
+    private static String inClausePlaceholders(int n) {
+        StringBuilder sb = new StringBuilder("(");
+        for (int i = 0; i < n; i++) {
+            if (i > 0) {
+                sb.append(',');
+            }
+            sb.append('?');
+        }
+        sb.append(')');
+        return sb.toString();
+    }
+
+    private List<TemplateJoinVO> executeDistinctQuery(String sql, List<Object> params, boolean showUnique) {
+        List<TemplateJoinVO> out = new ArrayList<>();
+        try (TransactionLegacy txn = TransactionLegacy.open("TemplateJoinDao");
+             PreparedStatement pstmt = txn.prepareAutoCloseStatement(sql)) {
+            bindParams(pstmt, params);
+            try (ResultSet rs = pstmt.executeQuery()) {
+                while (rs.next()) {
+                    TemplateJoinVO vo = new TemplateJoinVO();
+                    if (showUnique) {
+                        vo.setId(rs.getLong(1));
+                    } else {
+                        vo.setTempZonePair(rs.getString(1));
+                    }
+                    out.add(vo);
+                }
+            }
+        } catch (SQLException e) {
+            throw new CloudRuntimeException("findDistinctTempZonePairs data query failed: " + sql, e);
+        }
+        return out;
+    }
+
+    private int executeCountQuery(String sql, List<Object> params) {
+        try (TransactionLegacy txn = TransactionLegacy.open("TemplateJoinDao");
+             PreparedStatement pstmt = txn.prepareAutoCloseStatement(sql)) {
+            bindParams(pstmt, params);
+            try (ResultSet rs = pstmt.executeQuery()) {
+                if (rs.next()) {
+                    return rs.getInt(1);
+                }
+                return 0;
+            }
+        } catch (SQLException e) {
+            throw new CloudRuntimeException("findDistinctTempZonePairs count query failed: " + sql, e);
+        }
+    }
+
+    private static void bindParams(PreparedStatement pstmt, List<Object> params) throws SQLException {
+        for (int i = 0; i < params.size(); i++) {
+            pstmt.setObject(i + 1, params.get(i));
+        }
+    }
+
     @Override
     public List<TemplateJoinVO> findByDistinctIds(Long... ids) {
         if (ids == null || ids.length == 0) {
diff --git a/server/src/main/java/com/cloud/api/query/dao/TemplateListFilter.java b/server/src/main/java/com/cloud/api/query/dao/TemplateListFilter.java
new file mode 100644
index 000000000000..fb4e6f3cc4d2
--- /dev/null
+++ b/server/src/main/java/com/cloud/api/query/dao/TemplateListFilter.java
@@ -0,0 +1,258 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.api.query.dao;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+
+import com.cloud.cpu.CPU;
+import com.cloud.hypervisor.Hypervisor.HypervisorType;
+import com.cloud.storage.Storage.ImageFormat;
+import com.cloud.template.VirtualMachineTemplate.State;
+import com.cloud.user.Account;
+
+/**
+ * Immutable filter parameters for a listTemplates / listIsos call.
+ *
+ * Built once from the cmd parameters in QueryManagerImpl.searchForTemplatesInternal,
+ * then either consumed by the SearchBuilder path (existing behavior) or by the
+ * bypass-the-view path (TemplateJoinDaoImpl.findDistinctTempZonePairs).
+ *
+ * {@link #canBypass()} reports whether the bypass implementation supports this
+ * filter combination. The dispatcher must fall back to the SearchBuilder path
+ * when canBypass() returns false.
+ */
+public final class TemplateListFilter {
+
+    // identity
+    public final Long templateId;            // exact id match
+    public final List<Long> ids;             // id IN list
+
+    // text search
+    public final String name;                // name EQ when keyword is null
+    public final String keyword;             // name LIKE %keyword% (overrides name)
+
+    // attributes
+    public final HypervisorType hypervisorType;            // EQ when present and not None
+    public final List<HypervisorType> availableHypervisors; // IN list (from listAvailHypervisorInZone)
+    public final ImageFormat format;         // EQ for ISO, NEQ for non-ISO
+    public final boolean isIso;
+    public final boolean excludeSystemTemplates;  // templateType NEQ SYSTEM
+    public final String templateType;        // templateType EQ when non-null
+    public final Boolean isVnf;              // templateType EQ VNF (true) / NEQ VNF (false) when non-null
+    public final Boolean forCks;             // forCks EQ when non-null
+    public final CPU.CPUArch arch;           // arch EQ when non-null
+    public final List<Long> guestOsIds;      // guest_os_id IN list (resolved from os category)
+    public final Long extensionId;           // extension_id EQ when non-null
+    public final Long imageStoreId;          // image store id EQ when non-null
+    public final Boolean publicTemplate;     // EQ when non-null (forced by featured/community/all-non-admin paths)
+    public final Boolean featured;           // EQ when non-null (true=featured, false=community)
+    public final Boolean bootable;           // EQ when non-null
+    public final Long parentTemplateId;
+    public final boolean onlyReady;          // composite state-Ready filter
+
+    // ACL
+    public final Account.Type accountTypeNeq;     // accountType NEQ (typically !=Project)
+    public final Account.Type accountTypeEq;      // accountType EQ (typically ==Project)
+    public final List<Long> accountIds;           // EQ-OR-IN over account_id
+    public final boolean accountIdRequiredForFilter; // when templateFilter forces it (self/selfexecutable)
+    public final boolean publicOrAccountIdComposite; // executable composite: (public OR account_id IN)
+    public final boolean publicOrDomainPathComposite; // all-non-admin SkipProjectResources composite: (public OR domain.path LIKE)
+
+    // location
+    public final Long zoneId;                // composite dataCenterId filter
+
+    // state
+    public final boolean showRemoved;        // when true, no templateState filter applied
+    public final List<State> templateStates; // states IN list when showRemoved is false
+
+    // pagination & shape
+    public final boolean showUnique;
+    public final Long startIndex;
+    public final Long pageSize;
+    public final boolean sortAscending;
+
+    // hard filters — presence forces fallback to the SearchBuilder path
+    public final List<Long> sharedAccountIds;        // sharedexecutable / shared / all-non-admin
+    public final String domainPathLike;              // domain scoping; modeled by the bypass SQL (joins domain)
+    public final boolean domainPathExact;            // domainPathLike is an exact path (non-recursive) when true
+    public final List<Long> domainIdsForFeaturedCommunity; // featured/community related-domain hierarchy
+    public final Map<String, String> tags;
+    public final boolean requiresViewFallback;       // catch-all flag for templateFilter combinations the bypass SQL doesn't model
+
+    private TemplateListFilter(Builder b) {
+        this.templateId = b.templateId;
+        this.ids = nullSafe(b.ids);
+        this.name = b.name;
+        this.keyword = b.keyword;
+        this.hypervisorType = b.hypervisorType;
+        this.availableHypervisors = nullSafe(b.availableHypervisors);
+        this.format = b.format;
+        this.isIso = b.isIso;
+        this.excludeSystemTemplates = b.excludeSystemTemplates;
+        this.templateType = b.templateType;
+        this.isVnf = b.isVnf;
+        this.forCks = b.forCks;
+        this.arch = b.arch;
+        this.guestOsIds = nullSafe(b.guestOsIds);
+        this.extensionId = b.extensionId;
+        this.imageStoreId = b.imageStoreId;
+        this.publicTemplate = b.publicTemplate;
+        this.featured = b.featured;
+        this.bootable = b.bootable;
+        this.parentTemplateId = b.parentTemplateId;
+        this.onlyReady = b.onlyReady;
+        this.accountTypeNeq = b.accountTypeNeq;
+        this.accountTypeEq = b.accountTypeEq;
+        this.accountIds = nullSafe(b.accountIds);
+        this.accountIdRequiredForFilter = b.accountIdRequiredForFilter;
+        this.publicOrAccountIdComposite = b.publicOrAccountIdComposite;
+        this.publicOrDomainPathComposite = b.publicOrDomainPathComposite;
+        this.zoneId = b.zoneId;
+        this.showRemoved = b.showRemoved;
+        this.templateStates = nullSafe(b.templateStates);
+        this.showUnique = b.showUnique;
+        this.startIndex = b.startIndex;
+        this.pageSize = b.pageSize;
+        this.sortAscending = b.sortAscending;
+        this.sharedAccountIds = nullSafe(b.sharedAccountIds);
+        this.domainPathLike = b.domainPathLike;
+        this.domainPathExact = b.domainPathExact;
+        this.domainIdsForFeaturedCommunity = nullSafe(b.domainIdsForFeaturedCommunity);
+        this.tags = b.tags == null ? Collections.emptyMap() : Collections.unmodifiableMap(b.tags);
+        this.requiresViewFallback = b.requiresViewFallback;
+    }
+
+    /**
+     * True if the bypass-the-view DAO path can handle this filter set. False
+     * if any "hard" filter is set that requires extra joins beyond the base 6
+     * tables (vm_template, account, template_store_ref, image_store,
+     * template_zone_ref, data_center).
+     */
+    public boolean canBypass() {
+        if (requiresViewFallback) {
+            return false;
+        }
+        if (!sharedAccountIds.isEmpty()) {
+            return false;
+        }
+        if (!domainIdsForFeaturedCommunity.isEmpty()) {
+            return false;
+        }
+        if (!tags.isEmpty()) {
+            return false;
+        }
+        return true;
+    }
+
+    private static <T> List<T> nullSafe(List<T> in) {
+        return in == null ? Collections.<T>emptyList() : Collections.unmodifiableList(in);
+    }
+
+    public static Builder builder() {
+        return new Builder();
+    }
+
+    public static final class Builder {
+        private Long templateId;
+        private List<Long> ids;
+        private String name;
+        private String keyword;
+        private HypervisorType hypervisorType;
+        private List<HypervisorType> availableHypervisors;
+        private ImageFormat format;
+        private boolean isIso;
+        private boolean excludeSystemTemplates;
+        private String templateType;
+        private Boolean isVnf;
+        private Boolean forCks;
+        private CPU.CPUArch arch;
+        private List<Long> guestOsIds;
+        private Long extensionId;
+        private Long imageStoreId;
+        private Boolean publicTemplate;
+        private Boolean featured;
+        private Boolean bootable;
+        private Long parentTemplateId;
+        private boolean onlyReady;
+        private Account.Type accountTypeNeq;
+        private Account.Type accountTypeEq;
+        private List<Long> accountIds;
+        private boolean accountIdRequiredForFilter;
+        private boolean publicOrAccountIdComposite;
+        private boolean publicOrDomainPathComposite;
+        private Long zoneId;
+        private boolean showRemoved;
+        private List<State> templateStates;
+        private boolean showUnique;
+        private Long startIndex;
+        private Long pageSize;
+        private boolean sortAscending = true;
+        private List<Long> sharedAccountIds;
+        private String domainPathLike;
+        private boolean domainPathExact;
+        private List<Long> domainIdsForFeaturedCommunity;
+        private Map<String, String> tags;
+        private boolean requiresViewFallback;
+
+        public Builder templateId(Long v) { this.templateId = v; return this; }
+        public Builder ids(List<Long> v) { this.ids = v; return this; }
+        public Builder name(String v) { this.name = v; return this; }
+        public Builder keyword(String v) { this.keyword = v; return this; }
+        public Builder hypervisorType(HypervisorType v) { this.hypervisorType = v; return this; }
+        public Builder availableHypervisors(List<HypervisorType> v) { this.availableHypervisors = v; return this; }
+        public Builder format(ImageFormat v) { this.format = v; return this; }
+        public Builder isIso(boolean v) { this.isIso = v; return this; }
+        public Builder excludeSystemTemplates(boolean v) { this.excludeSystemTemplates = v; return this; }
+        public Builder templateType(String v) { this.templateType = v; return this; }
+        public Builder isVnf(Boolean v) { this.isVnf = v; return this; }
+        public Builder forCks(Boolean v) { this.forCks = v; return this; }
+        public Builder arch(CPU.CPUArch v) { this.arch = v; return this; }
+        public Builder guestOsIds(List<Long> v) { this.guestOsIds = v; return this; }
+        public Builder extensionId(Long v) { this.extensionId = v; return this; }
+        public Builder imageStoreId(Long v) { this.imageStoreId = v; return this; }
+        public Builder publicTemplate(Boolean v) { this.publicTemplate = v; return this; }
+        public Builder featured(Boolean v) { this.featured = v; return this; }
+        public Builder bootable(Boolean v) { this.bootable = v; return this; }
+        public Builder parentTemplateId(Long v) { this.parentTemplateId = v; return this; }
+        public Builder onlyReady(boolean v) { this.onlyReady = v; return this; }
+        public Builder accountTypeNeq(Account.Type v) { this.accountTypeNeq = v; return this; }
+        public Builder accountTypeEq(Account.Type v) { this.accountTypeEq = v; return this; }
+        public Builder accountIds(List<Long> v) { this.accountIds = v; return this; }
+        public Builder accountIdRequiredForFilter(boolean v) { this.accountIdRequiredForFilter = v; return this; }
+        public Builder publicOrAccountIdComposite(boolean v) { this.publicOrAccountIdComposite = v; return this; }
+        public Builder publicOrDomainPathComposite(boolean v) { this.publicOrDomainPathComposite = v; return this; }
+        public Builder zoneId(Long v) { this.zoneId = v; return this; }
+        public Builder showRemoved(boolean v) { this.showRemoved = v; return this; }
+        public Builder templateStates(List<State> v) { this.templateStates = v; return this; }
+        public Builder showUnique(boolean v) { this.showUnique = v; return this; }
+        public Builder startIndex(Long v) { this.startIndex = v; return this; }
+        public Builder pageSize(Long v) { this.pageSize = v; return this; }
+        public Builder sortAscending(boolean v) { this.sortAscending = v; return this; }
+        public Builder sharedAccountIds(List<Long> v) { this.sharedAccountIds = v; return this; }
+        public Builder domainPathLike(String v) { this.domainPathLike = v; return this; }
+        public Builder domainPathExact(boolean v) { this.domainPathExact = v; return this; }
+        public Builder domainIdsForFeaturedCommunity(List<Long> v) { this.domainIdsForFeaturedCommunity = v; return this; }
+        public Builder tags(Map<String, String> v) { this.tags = v; return this; }
+        public Builder requiresViewFallback(boolean v) { this.requiresViewFallback = v; return this; }
+
+        public TemplateListFilter build() {
+            return new TemplateListFilter(this);
+        }
+    }
+}
diff --git a/server/src/main/java/com/cloud/api/query/vo/BaseViewWithTagInformationVO.java b/server/src/main/java/com/cloud/api/query/vo/BaseViewWithTagInformationVO.java
index ec2947ae1fe9..9b7c27e9b6f6 100755
--- a/server/src/main/java/com/cloud/api/query/vo/BaseViewWithTagInformationVO.java
+++ b/server/src/main/java/com/cloud/api/query/vo/BaseViewWithTagInformationVO.java
@@ -180,4 +180,8 @@ public long getId() {
         return id;
     }
 
+    public void setId(long id) {
+        this.id = id;
+    }
+
 }
diff --git a/server/src/main/java/com/cloud/api/query/vo/TemplateJoinVO.java b/server/src/main/java/com/cloud/api/query/vo/TemplateJoinVO.java
index 201b081b962b..f7d3e9e7e7be 100644
--- a/server/src/main/java/com/cloud/api/query/vo/TemplateJoinVO.java
+++ b/server/src/main/java/com/cloud/api/query/vo/TemplateJoinVO.java
@@ -520,6 +520,10 @@ public String getTempZonePair() {
         return tempZonePair;
     }
 
+    public void setTempZonePair(String tempZonePair) {
+        this.tempZonePair = tempZonePair;
+    }
+
     public State getTemplateState() {
         return templateState;
     }
diff --git a/server/src/test/java/com/cloud/api/query/dao/TemplateJoinDaoImplBypassExplainTest.java b/server/src/test/java/com/cloud/api/query/dao/TemplateJoinDaoImplBypassExplainTest.java
new file mode 100644
index 000000000000..ef07c8cdcfb2
--- /dev/null
+++ b/server/src/test/java/com/cloud/api/query/dao/TemplateJoinDaoImplBypassExplainTest.java
@@ -0,0 +1,398 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.api.query.dao;
+
+import java.sql.Connection;
+import java.sql.DriverManager;
+import java.sql.ResultSet;
+import java.sql.ResultSetMetaData;
+import java.sql.Statement;
+import java.util.LinkedHashMap;
+import java.util.Map;
+import java.util.Set;
+import java.util.TreeSet;
+import org.junit.After;
+import org.junit.Assume;
+import org.junit.Before;
+import org.junit.Ignore;
+import org.junit.Test;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+
+/**
+ * Integration test that EXPLAINs the Phase-1 bypass SQL versus the legacy
+ * template_view SQL, and asserts that the bypass plan no longer trips the
+ * "Range checked for each record" path on data_center.
+ *
+ * Skipped unless a MySQL URL is provided via system properties:
+ *   -Dtest.cloudstack.mysql.url=jdbc:mysql://host:3306/cloud
+ *   -Dtest.cloudstack.mysql.user=root
+ *   -Dtest.cloudstack.mysql.password=
+ *
+ */
+public class TemplateJoinDaoImplBypassExplainTest {
+
+    private static final String BYPASS_SQL =
+            "SELECT DISTINCT CONCAT(vt.id, '_', IFNULL(dc.id, 0)) AS pair " +
+            "FROM cloud.vm_template vt " +
+            "JOIN cloud.account a ON a.id = vt.account_id " +
+            "LEFT JOIN cloud.template_store_ref tsr " +
+            "  ON tsr.template_id = vt.id AND tsr.store_role = 'Image' AND tsr.destroyed = 0 " +
+            "LEFT JOIN cloud.image_store img " +
+            "  ON img.id = tsr.store_id AND img.removed IS NULL " +
+            "LEFT JOIN cloud.template_zone_ref tzr " +
+            "  ON tzr.template_id = vt.id AND tsr.store_id IS NULL AND tzr.removed IS NULL " +
+            "LEFT JOIN cloud.data_center dc " +
+            "  ON dc.id = COALESCE(img.data_center_id, tzr.zone_id) " +
+            "WHERE vt.removed IS NULL " +
+            "  AND vt.state IN ('Active','UploadAbandoned','UploadError','NotUploaded','UploadInProgress')";
+
+    /**
+     * Bypass SQL with the conditional `JOIN cloud.domain` added.
+     * Triggered when the request needs domain.path scoping (DA self/selfexecutable
+     * or non-admin all + SkipProjectResources). Should still use eq_ref / PRIMARY
+     * on data_center; domain itself is small.
+     */
+    private static final String BYPASS_SQL_WITH_DOMAIN =
+            "SELECT DISTINCT CONCAT(vt.id, '_', IFNULL(dc.id, 0)) AS pair " +
+            "FROM cloud.vm_template vt " +
+            "JOIN cloud.account a ON a.id = vt.account_id " +
+            "LEFT JOIN cloud.template_store_ref tsr " +
+            "  ON tsr.template_id = vt.id AND tsr.store_role = 'Image' AND tsr.destroyed = 0 " +
+            "LEFT JOIN cloud.image_store img " +
+            "  ON img.id = tsr.store_id AND img.removed IS NULL " +
+            "LEFT JOIN cloud.template_zone_ref tzr " +
+            "  ON tzr.template_id = vt.id AND tsr.store_id IS NULL AND tzr.removed IS NULL " +
+            "LEFT JOIN cloud.data_center dc " +
+            "  ON dc.id = COALESCE(img.data_center_id, tzr.zone_id) " +
+            "JOIN cloud.domain d ON d.id = a.domain_id " +
+            "WHERE vt.removed IS NULL " +
+            "  AND vt.state IN ('Active','UploadAbandoned','UploadError','NotUploaded','UploadInProgress') " +
+            "  AND d.path LIKE '/%' ";
+
+    private static final String VIEW_SQL =
+            "SELECT DISTINCT temp_zone_pair FROM cloud.template_view " +
+            "WHERE template_state IN ('Active','UploadAbandoned','UploadError','NotUploaded','UploadInProgress')";
+
+    private Connection conn;
+
+    @Before
+    public void setUp() throws Exception {
+        String url = System.getProperty("test.cloudstack.mysql.url");
+        String user = System.getProperty("test.cloudstack.mysql.user", "root");
+        String pwd = System.getProperty("test.cloudstack.mysql.password", "");
+        Assume.assumeNotNull("test.cloudstack.mysql.url not set; skipping EXPLAIN integration test", url);
+        conn = DriverManager.getConnection(url, user, pwd);
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        if (conn != null) {
+            conn.close();
+        }
+    }
+
+    @Test
+    @Ignore("Integration test - requires -Dtest.cloudstack.mysql.url; run manually against a CloudStack DB")
+    public void bypass_dataCenter_isPkLookup_notRangeChecked() throws Exception {
+        Map<String, Map<String, String>> rowsByTable = explain(BYPASS_SQL);
+        Map<String, String> dc = rowsByTable.get("dc");
+        assertNotNull("EXPLAIN row for `dc` (data_center) missing", dc);
+
+        String type = dc.get("type");
+        String key = dc.get("key");
+        String extra = dc.get("Extra") == null ? "" : dc.get("Extra");
+
+        // dc.id is the PK; COALESCE on the other side. Optimizer should pick eq_ref / ref / const.
+        assertTrue("dc access type is " + type + ", expected eq_ref/ref/const",
+                "eq_ref".equals(type) || "ref".equals(type) || "const".equals(type));
+        assertEquals("dc should use PRIMARY", "PRIMARY", key);
+        assertFalse("dc should not use 'Range checked for each record'; Extra=" + extra,
+                extra.contains("Range checked for each record"));
+    }
+
+    /**
+     * Asserts the bypass plan trims the join graph the legacy view drags along.
+     *
+     * Portable across CIB and prod
+     *
+     */
+    @Test
+    @Ignore("Integration test - requires -Dtest.cloudstack.mysql.url; run manually against a CloudStack DB")
+    public void view_joinsMoreTablesThanBypass() throws Exception {
+        Map<String, Map<String, String>> view = explain(VIEW_SQL);
+        Map<String, Map<String, String>> bypass = explain(BYPASS_SQL);
+        assertTrue(
+                "expected legacy view plan (" + view.size() + " tables) to join more than bypass (" + bypass.size() + ")",
+                view.size() > bypass.size());
+        // Row-multiplier tables that the bypass intentionally drops.
+        assertTrue("expected view plan to include vm_template_details",
+                view.containsKey("vm_template_details"));
+        assertTrue("expected view plan to include resource_tags",
+                view.containsKey("resource_tags"));
+    }
+
+    @Test
+    @Ignore("Integration test - requires -Dtest.cloudstack.mysql.url; run manually against a CloudStack DB")
+    public void bypass_doesNotJoin_resourceTags_or_vmTemplateDetails() throws Exception {
+        Map<String, Map<String, String>> rowsByTable = explain(BYPASS_SQL);
+        assertFalse("bypass must not join resource_tags", rowsByTable.containsKey("resource_tags"));
+        assertFalse("bypass must not join vm_template_details", rowsByTable.containsKey("vm_template_details"));
+        assertFalse("bypass must not join launch_permission", rowsByTable.containsKey("launch_permission"));
+    }
+
+    @Test
+    @Ignore("Integration test - requires -Dtest.cloudstack.mysql.url; run manually against a CloudStack DB")
+    public void bypassWithDomain_joinsDomainTable() throws Exception {
+        Map<String, Map<String, String>> rowsByTable = explain(BYPASS_SQL_WITH_DOMAIN);
+        assertTrue("bypass+domain plan must include domain table", rowsByTable.containsKey("d"));
+    }
+
+    @Test
+    @Ignore("Integration test - requires -Dtest.cloudstack.mysql.url; run manually against a CloudStack DB")
+    public void bypassWithDomain_domain_isPkLookup() throws Exception {
+        // domain.id is the PK; the join is on a.domain_id. Optimizer should pick eq_ref / ref / const.
+        Map<String, Map<String, String>> rowsByTable = explain(BYPASS_SQL_WITH_DOMAIN);
+        Map<String, String> d = rowsByTable.get("d");
+        assertNotNull("EXPLAIN row for `d` (domain) missing", d);
+
+        String type = d.get("type");
+        String key = d.get("key");
+        String extra = d.get("Extra") == null ? "" : d.get("Extra");
+
+        assertTrue("domain access type is " + type + ", expected eq_ref/ref/const/index",
+                "eq_ref".equals(type) || "ref".equals(type) || "const".equals(type) || "index".equals(type));
+        assertNotNull("domain should use SOME index", key);
+        assertFalse("domain should not be 'Range checked for each record'; Extra=" + extra,
+                extra.contains("Range checked for each record"));
+    }
+
+    @Test
+    @Ignore("Integration test - requires -Dtest.cloudstack.mysql.url; run manually against a CloudStack DB")
+    public void bypassWithDomain_dataCenter_stillPkLookup() throws Exception {
+        // Adding the domain join must not regress the data_center PK-lookup gain.
+        Map<String, Map<String, String>> rowsByTable = explain(BYPASS_SQL_WITH_DOMAIN);
+        Map<String, String> dc = rowsByTable.get("dc");
+        assertNotNull("EXPLAIN row for `dc` missing in bypass+domain plan", dc);
+        String type = dc.get("type");
+        assertTrue("dc access type with domain join is " + type + ", expected eq_ref/ref/const",
+                "eq_ref".equals(type) || "ref".equals(type) || "const".equals(type));
+        assertEquals("PRIMARY", dc.get("key"));
+    }
+
+    @Test
+    @Ignore("Integration test - requires -Dtest.cloudstack.mysql.url; run manually against a CloudStack DB")
+    public void bypassWithDomain_stillFewerTablesThanView() throws Exception {
+        // Even with the conditional domain join, the bypass plan is still smaller than the legacy view.
+        Map<String, Map<String, String>> bypass = explain(BYPASS_SQL_WITH_DOMAIN);
+        Map<String, Map<String, String>> view = explain(VIEW_SQL);
+        assertTrue(
+                "bypass+domain plan (" + bypass.size() + " tables) should still join fewer than the view (" + view.size() + ")",
+                bypass.size() < view.size());
+    }
+
+    @Test
+    @Ignore("Integration test - requires -Dtest.cloudstack.mysql.url; run manually against a CloudStack DB")
+    public void bypassWithDomain_stillNoRowMultipliers() throws Exception {
+        // Critical: adding the domain join must not pull in the row multipliers the bypass dropped.
+        Map<String, Map<String, String>> rowsByTable = explain(BYPASS_SQL_WITH_DOMAIN);
+        assertFalse("bypass+domain must not join resource_tags",       rowsByTable.containsKey("resource_tags"));
+        assertFalse("bypass+domain must not join vm_template_details", rowsByTable.containsKey("vm_template_details"));
+        assertFalse("bypass+domain must not join launch_permission",   rowsByTable.containsKey("launch_permission"));
+    }
+
+    // ============================================================================
+    // Timing tests
+    // ============================================================================
+
+    /** Number of iterations per query; first 2 are warm-up. */
+    private static final int TIMING_ITERATIONS = 5;
+    /** Skip first N iterations from the average (warm-up). */
+    private static final int TIMING_WARMUP = 2;
+    /**
+     * Tolerance for the timing assertion. With sparse test data both queries
+     * complete in ~1 ms, where measurement noise can flip the order; allow the
+     * bypass to be marginally slower without failing the test.
+     */
+    private static final double TIMING_TOLERANCE_FACTOR = 2.0;
+    /** Floor below which we don't bother asserting (pure JDBC overhead). */
+    private static final long TIMING_NOISE_FLOOR_NS = 5_000_000L; // 5 ms
+
+    @Test
+    @Ignore("Integration test - requires -Dtest.cloudstack.mysql.url; run manually against a CloudStack DB")
+    public void bypass_isFasterThanLegacyView() throws Exception {
+        long legacyAvgNs = averageQueryNanos(VIEW_SQL);
+        long bypassAvgNs = averageQueryNanos(BYPASS_SQL);
+
+        System.out.println(String.format(
+                "Timing avg over %d iterations (warm-up %d): legacy=%.2f ms, bypass=%.2f ms (%.1fx speedup)",
+                TIMING_ITERATIONS, TIMING_WARMUP,
+                legacyAvgNs / 1_000_000.0,
+                bypassAvgNs / 1_000_000.0,
+                (double) legacyAvgNs / Math.max(bypassAvgNs, 1)));
+
+        // Below the noise floor both queries are dominated by JDBC overhead;
+        // the structural improvement is unmeasurable. Skip the strict comparison.
+        if (legacyAvgNs < TIMING_NOISE_FLOOR_NS) {
+            System.out.println("Skipping strict timing assertion: legacy duration below noise floor");
+            return;
+        }
+        assertTrue(
+                String.format("bypass (%.2f ms) should be at most %.1fx legacy (%.2f ms)",
+                        bypassAvgNs / 1_000_000.0, TIMING_TOLERANCE_FACTOR, legacyAvgNs / 1_000_000.0),
+                bypassAvgNs <= (long) (legacyAvgNs * TIMING_TOLERANCE_FACTOR));
+    }
+
+    @Test
+    @Ignore("Integration test - requires -Dtest.cloudstack.mysql.url; run manually against a CloudStack DB")
+    public void bypassWithDomain_isFasterThanLegacyView() throws Exception {
+        long legacyAvgNs = averageQueryNanos(VIEW_SQL);
+        long bypassAvgNs = averageQueryNanos(BYPASS_SQL_WITH_DOMAIN);
+
+        System.out.println(String.format(
+                "Timing avg (bypass+domain join): legacy=%.2f ms, bypass+domain=%.2f ms (%.1fx speedup)",
+                legacyAvgNs / 1_000_000.0,
+                bypassAvgNs / 1_000_000.0,
+                (double) legacyAvgNs / Math.max(bypassAvgNs, 1)));
+
+        if (legacyAvgNs < TIMING_NOISE_FLOOR_NS) {
+            System.out.println("Skipping strict timing assertion: legacy duration below noise floor");
+            return;
+        }
+        assertTrue(
+                String.format("bypass+domain (%.2f ms) should be at most %.1fx legacy (%.2f ms)",
+                        bypassAvgNs / 1_000_000.0, TIMING_TOLERANCE_FACTOR, legacyAvgNs / 1_000_000.0),
+                bypassAvgNs <= (long) (legacyAvgNs * TIMING_TOLERANCE_FACTOR));
+    }
+
+    // ============================================================================
+    // Parity tests — bypass and legacy must return identical pair sets and counts
+    // ============================================================================
+
+    @Test
+    @Ignore("Integration test - requires -Dtest.cloudstack.mysql.url; run manually against a CloudStack DB")
+    public void bypass_returnsSameTemplatePairSetAsLegacy() throws Exception {
+        Set<String> legacy = collectColumn1(VIEW_SQL);
+        Set<String> bypass = collectColumn1(BYPASS_SQL);
+
+        assertEquals("legacy and bypass must return the same number of distinct pairs",
+                legacy.size(), bypass.size());
+        assertEquals("legacy and bypass must return identical pair values",
+                legacy, bypass);
+    }
+
+    @Test
+    @Ignore("Integration test - requires -Dtest.cloudstack.mysql.url; run manually against a CloudStack DB")
+    public void bypass_distinctCountMatchesLegacy() throws Exception {
+        long legacyCount = scalarLong(
+                "SELECT COUNT(*) FROM (" + VIEW_SQL + ") AS t");
+        long bypassCount = scalarLong(
+                "SELECT COUNT(*) FROM (" + BYPASS_SQL + ") AS t");
+
+        assertEquals("legacy and bypass DISTINCT counts must match", legacyCount, bypassCount);
+    }
+
+    /** Collect column 1 of every row into a sorted set (for set equality assertion). */
+    private Set<String> collectColumn1(String query) throws Exception {
+        Set<String> out = new TreeSet<>();
+        try (Statement st = conn.createStatement();
+             ResultSet rs = st.executeQuery(query)) {
+            while (rs.next()) {
+                out.add(rs.getString(1));
+            }
+        }
+        return out;
+    }
+
+    /** Run a query that returns one numeric scalar in column 1. */
+    private long scalarLong(String query) throws Exception {
+        try (Statement st = conn.createStatement();
+             ResultSet rs = st.executeQuery(query)) {
+            if (rs.next()) {
+                return rs.getLong(1);
+            }
+            return 0L;
+        }
+    }
+
+    /**
+     * Run the query {@link #TIMING_ITERATIONS} times, drop the first
+     * {@link #TIMING_WARMUP} as warm-up, return the average wall-clock duration
+     * of the remaining iterations in nanoseconds. Each iteration drains the
+     * ResultSet so we measure execution + transport, not just submission.
+     */
+    private long averageQueryNanos(String query) throws Exception {
+        long total = 0;
+        int counted = 0;
+        for (int i = 0; i < TIMING_ITERATIONS; i++) {
+            long start = System.nanoTime();
+            try (Statement st = conn.createStatement();
+                 ResultSet rs = st.executeQuery(query)) {
+                while (rs.next()) {
+                    rs.getString(1);
+                }
+            }
+            long elapsed = System.nanoTime() - start;
+            if (i >= TIMING_WARMUP) {
+                total += elapsed;
+                counted++;
+            }
+        }
+        return counted == 0 ? 0 : total / counted;
+    }
+
+    /**
+     * Run EXPLAIN and return one map per table alias (or table name) → column→value.
+     * Uses traditional EXPLAIN format so column names match across MySQL versions.
+     * Also logs the raw EXPLAIN rows so test output makes plan differences visible.
+     */
+    private Map<String, Map<String, String>> explain(String query) throws Exception {
+        Map<String, Map<String, String>> out = new LinkedHashMap<>();
+        try (Statement st = conn.createStatement();
+             ResultSet rs = st.executeQuery("EXPLAIN " + query)) {
+            ResultSetMetaData md = rs.getMetaData();
+            int colCount = md.getColumnCount();
+
+            StringBuilder log = new StringBuilder("\nEXPLAIN result for query:\n  ").append(query).append('\n');
+            // header
+            for (int i = 1; i <= colCount; i++) {
+                log.append(md.getColumnLabel(i)).append('\t');
+            }
+            log.append('\n');
+
+            while (rs.next()) {
+                Map<String, String> row = new LinkedHashMap<>();
+                for (int i = 1; i <= colCount; i++) {
+                    String val = rs.getString(i);
+                    row.put(md.getColumnLabel(i), val);
+                    log.append(val == null ? "NULL" : val).append('\t');
+                }
+                log.append('\n');
+                String tableKey = row.get("table");
+                if (tableKey != null) {
+                    out.put(tableKey, row);
+                }
+            }
+            // uncomment if need verbose EXPLAIN output
+//            System.out.println(log.toString());
+        }
+        return out;
+    }
+}
diff --git a/server/src/test/java/com/cloud/api/query/dao/TemplateJoinDaoImplTest.java b/server/src/test/java/com/cloud/api/query/dao/TemplateJoinDaoImplTest.java
index 94d6722a7c5d..9565d1af4b31 100755
--- a/server/src/test/java/com/cloud/api/query/dao/TemplateJoinDaoImplTest.java
+++ b/server/src/test/java/com/cloud/api/query/dao/TemplateJoinDaoImplTest.java
@@ -17,6 +17,7 @@
 package com.cloud.api.query.dao;
 
 import com.cloud.api.query.vo.TemplateJoinVO;
+import com.cloud.cpu.CPU;
 import com.cloud.hypervisor.Hypervisor;
 import com.cloud.storage.Storage;
 import com.cloud.storage.VnfTemplateDetailVO;
@@ -38,7 +39,9 @@
 import org.springframework.test.util.ReflectionTestUtils;
 
 import java.util.Arrays;
+import java.util.ArrayList;
 import java.util.Date;
+import java.util.List;
 import java.util.Map;
 
 @RunWith(MockitoJUnitRunner.class)
@@ -150,4 +153,66 @@ public void testNewUpdateResponseForVnf() {
         Assert.assertEquals(3, ((VnfTemplateResponse)response).getVnfDetails().size());
 
     }
+
+    private String buildWhere(TemplateListFilter filter, List<Object> params) {
+        StringBuilder where = new StringBuilder();
+        _templateJoinDaoImpl.appendCommonWhere(where, params, filter);
+        return where.toString();
+    }
+
+    @Test
+    public void testAppendCommonWhereTemplateType() {
+        List<Object> params = new ArrayList<>();
+        String where = buildWhere(TemplateListFilter.builder().templateType("SYSTEM").build(), params);
+        Assert.assertTrue(where.contains(" AND vt.type = ?"));
+        Assert.assertEquals(Arrays.<Object>asList("SYSTEM"), params);
+    }
+
+    @Test
+    public void testAppendCommonWhereIsVnf() {
+        Assert.assertTrue(buildWhere(TemplateListFilter.builder().isVnf(true).build(), new ArrayList<>()).contains("vt.type = 'VNF'"));
+        Assert.assertTrue(buildWhere(TemplateListFilter.builder().isVnf(false).build(), new ArrayList<>()).contains("vt.type != 'VNF'"));
+    }
+
+    @Test
+    public void testAppendCommonWhereForCks() {
+        List<Object> params = new ArrayList<>();
+        String where = buildWhere(TemplateListFilter.builder().forCks(true).build(), params);
+        Assert.assertTrue(where.contains(" AND vt.for_cks = ?"));
+        Assert.assertEquals(Arrays.<Object>asList(1), params);
+    }
+
+    @Test
+    public void testAppendCommonWhereOnlyReadyIncludesExternalFormat() {
+        String where = buildWhere(TemplateListFilter.builder().onlyReady(true).build(), new ArrayList<>());
+        Assert.assertTrue(where.contains("vt.format IN ('BAREMETAL', 'EXTERNAL')"));
+    }
+
+    @Test
+    public void testAppendCommonWhereOmitsUnsetTypeFilters() {
+        String where = buildWhere(TemplateListFilter.builder().build(), new ArrayList<>());
+        Assert.assertFalse(where.contains("for_cks"));
+        Assert.assertFalse(where.contains("vt.type"));
+    }
+
+    @Test
+    public void testAppendCommonWhereArchOsCategoryExtensionAndImageStore() {
+        List<Object> params = new ArrayList<>();
+        String where = buildWhere(TemplateListFilter.builder().arch(CPU.CPUArch.arm64)
+                .guestOsIds(Arrays.asList(1L, 2L)).extensionId(5L).imageStoreId(7L).build(), params);
+        Assert.assertTrue(where.contains(" AND vt.arch = ?"));
+        Assert.assertTrue(where.contains(" AND vt.guest_os_id IN (?,?)"));
+        Assert.assertTrue(where.contains(" AND vt.extension_id = ?"));
+        Assert.assertTrue(where.contains(" AND tsr.store_id = ?"));
+        Assert.assertEquals(Arrays.<Object>asList(CPU.CPUArch.arm64.getType(), 1L, 2L, 5L, 7L), params);
+    }
+
+    @Test
+    public void testAppendCommonWhereDomainPathExactVsLike() {
+        List<Object> params = new ArrayList<>();
+        String exact = buildWhere(TemplateListFilter.builder().domainPathLike("/a/").domainPathExact(true).build(), params);
+        Assert.assertTrue(exact.contains(" AND d.path = ?"));
+        String like = buildWhere(TemplateListFilter.builder().domainPathLike("/a/%").build(), new ArrayList<>());
+        Assert.assertTrue(like.contains(" AND d.path LIKE ?"));
+    }
 }

From a945a7c203e95ce427b9e9954e971a3d3c9967b3 Mon Sep 17 00:00:00 2001
From: Daniel Augusto Veronezi Salvador
 <38945620+GutoVeronezi@users.noreply.github.com>
Date: Wed, 14 Oct 2026 08:42:01 +0100
Subject: [PATCH 34/41] Develocity integration (#14394)

* Added basic Develocity integration

* Added develocity access key setup to github actions (maven) workflows

* Cleanup

* Added licensing header to .mvn/extensions.xml

* Added lincesing info and .gitignore for develocity integration

* Point Develocity at develocity.apache.org

Signed-off-by: Gasper Kojek <gkojek@gradle.com>

* Bump Develocity Maven extensions and drop unused access key env

- develocity-maven-extension 1.21.4 -> 2.5.0
- common-custom-user-data-maven-extension 2.0 -> 2.4.0

CCUD 2.4.0 targets develocity-maven-extension 2.5.0, and both are
compatible with the Develocity 2026.2.x server. Verified locally with
`mvn -N validate`: both extensions load and the existing
.mvn/develocity.xml is read and accepted unchanged.

Also drop DEVELOCITY_ACCESS_KEY from ui.yml and pre-commit.yml, which do
not run Maven.

Signed-off-by: Gasper Kojek <gkojek@gradle.com>

* Use the DEVELOCITY_ACCESS_KEY secret name

Signed-off-by: Gasper Kojek <gkojek@gradle.com>

* Update develocity-maven-extension version to 2.6.0

* Scope DEVELOCITY_ACCESS_KEY to the Maven steps

Signed-off-by: Gasper Kojek <gkojek@gradle.com>

---------

Signed-off-by: Gasper Kojek <gkojek@gradle.com>
Co-authored-by: Gasper Kojek <gkojek@gradle.com>
---
 .github/workflows/build.yml            |  2 ++
 .github/workflows/ci.yml               |  8 +++++
 .github/workflows/main-sonar-check.yml |  3 ++
 .github/workflows/rat.yml              |  2 ++
 .github/workflows/sonar-check.yml      |  3 ++
 .gitignore                             |  3 ++
 .mvn/develocity.xml                    | 50 ++++++++++++++++++++++++++
 .mvn/extensions.xml                    | 34 ++++++++++++++++++
 8 files changed, 105 insertions(+)
 create mode 100644 .mvn/develocity.xml
 create mode 100644 .mvn/extensions.xml

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9c8ca10f85e9..742faf57e4bb 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -54,5 +54,7 @@ jobs:
       - name: Install Non-OSS
         uses: ./.github/actions/install-nonoss
       - name: Noredist Build
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
         run: |
           mvn -B -P developer,systemvm -Dsimulator -Dnoredist clean install -T$(nproc)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7f6645f4af4d..d46df2f395f5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -54,6 +54,8 @@ jobs:
           git status
           ipmitool -V
       - name: Build with Maven
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
         run: |
           mvn -B -P developer,systemvm -Dsimulator clean install -DskipTests=true -T$(nproc)
       - name: Archive artifacts
@@ -307,6 +309,8 @@ jobs:
           mkdir -p ~/.m2/repository
           tar -xzf /tmp/artifacts/m2-cloudstack.tar.gz -C ~/.m2/repository
       - name: Setup Simulator Prerequisites
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
         run: |
           sudo python3 -m pip install --upgrade netaddr mysql-connector-python
           python3 -m pip install --user --upgrade tools/marvin/dist/[mM]arvin-*.tar.gz
@@ -319,6 +323,8 @@ jobs:
           find . | grep "src/main/java" | sed 's/\/java\//\/java /g' | awk '{print "--sourcefiles", $1, "\\"}' | sort | uniq >> jacoco-report.sh
           echo "--xml jacoco-coverage.xml" >> jacoco-report.sh
       - name: Start CloudStack Management Server with Simulator
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
         run: |
           export MAVEN_OPTS="-Xmx4096m -XX:MaxMetaspaceSize=800m -Djava.security.egd=file:/dev/urandom  -javaagent:jacoco/lib/jacocoagent.jar=address=*,port=36320,output=tcpserver --add-opens=java.base/java.lang=ALL-UNNAMED --add-exports=java.base/sun.security.x509=ALL-UNNAMED --add-opens=java.base/jdk.internal.reflect=ALL-UNNAMED"
           echo -e "\nStarting simulator"
@@ -329,6 +335,8 @@ jobs:
           echo -e "\nStarting Advanced Zone DataCenter deployment"
           python3 tools/marvin/marvin/deployDataCenter.py -i setup/dev/advdualzone.cfg 2>&1 || true
       - name: Run Integration Tests with Simulator
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
         run: |
           mkdir -p integration-test-results/smoke/misc
           mkdir -p integration-test-results/component
diff --git a/.github/workflows/main-sonar-check.yml b/.github/workflows/main-sonar-check.yml
index f48409fbc0c3..1c9f1273b976 100644
--- a/.github/workflows/main-sonar-check.yml
+++ b/.github/workflows/main-sonar-check.yml
@@ -49,9 +49,12 @@ jobs:
       - name: Install Non-OSS
         uses: ./.github/actions/install-nonoss
       - name: Run Build and Tests with Coverage
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
         run: mvn -B -T$(nproc) -P developer,systemvm,quality -Dsimulator -Dnoredist clean install
       - name: Upload to SonarQube
         env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
         run: mvn -B -P quality org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=apache_cloudstack -Dsonar.branch.name=${{ github.ref_name }}
diff --git a/.github/workflows/rat.yml b/.github/workflows/rat.yml
index 5c72d64d6ed9..f4659885fbb3 100644
--- a/.github/workflows/rat.yml
+++ b/.github/workflows/rat.yml
@@ -40,6 +40,8 @@ jobs:
       - name: Install Non-OSS
         uses: ./.github/actions/install-nonoss
       - name: RAT licence checks
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
         run: |
           mvn -P developer,systemvm -Dsimulator -Dnoredist -pl . org.apache.rat:apache-rat-plugin:0.18:check
       - name: Rat Report
diff --git a/.github/workflows/sonar-check.yml b/.github/workflows/sonar-check.yml
index 7f2a1bdb2935..3fe8c53fecea 100644
--- a/.github/workflows/sonar-check.yml
+++ b/.github/workflows/sonar-check.yml
@@ -47,10 +47,13 @@ jobs:
       - name: Install Non-OSS
         uses: ./.github/actions/install-nonoss
       - name: Run Build and Tests with Coverage
+        env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
         run: mvn -B -T$(nproc) -P developer,systemvm,quality -Dsimulator -Dnoredist clean install
       - name: Upload to SonarQube
         if: github.repository == 'apache/cloudstack' && github.event.pull_request.head.repo.full_name == github.repository
         env:
+          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
           PR_ID: ${{ github.event.pull_request.number }}
diff --git a/.gitignore b/.gitignore
index abaef83e4555..1c96edf51e2b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -99,6 +99,9 @@ tools/marvin/marvin/cloudstackAPI/*
 unittest
 venv
 waf-*
+waf3-*
+
+**/.mvn/.develocity*
 
 # this ignores _all files starting with '.'. Don't do that!
 #.*
diff --git a/.mvn/develocity.xml b/.mvn/develocity.xml
new file mode 100644
index 000000000000..bde8355a5e2f
--- /dev/null
+++ b/.mvn/develocity.xml
@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes" ?>
+<!--
+
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+
+-->
+
+<develocity
+  xmlns="https://www.gradle.com/develocity-maven" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="https://www.gradle.com/develocity-maven https://www.gradle.com/schema/develocity-maven.xsd">
+  <server>
+    <url>https://develocity.apache.org</url>
+    <allowUntrusted>false</allowUntrusted>
+  </server>
+  <buildScan>
+    <backgroundBuildScanUpload>#{isFalse(env['GITHUB_ACTIONS'])}</backgroundBuildScanUpload>
+    <obfuscation>
+      <ipAddresses>#{{'0.0.0.0'}}</ipAddresses>
+    </obfuscation>
+    <publishing>
+      <onlyIf>
+        <![CDATA[authenticated]]>
+      </onlyIf>
+    </publishing>
+  </buildScan>
+  <buildCache>
+    <local>
+      <enabled>false</enabled>
+    </local>
+    <remote>
+      <enabled>false</enabled>
+      <storeEnabled>#{isTrue(env['GITHUB_ACTIONS'])}</storeEnabled>
+    </remote>
+  </buildCache>
+</develocity>
diff --git a/.mvn/extensions.xml b/.mvn/extensions.xml
new file mode 100644
index 000000000000..8118c8f9f463
--- /dev/null
+++ b/.mvn/extensions.xml
@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+
+-->
+
+<extensions>
+  <extension>
+    <groupId>com.gradle</groupId>
+    <artifactId>develocity-maven-extension</artifactId>
+    <version>2.6.0</version>
+  </extension>
+  <extension>
+    <groupId>com.gradle</groupId>
+    <artifactId>common-custom-user-data-maven-extension</artifactId>
+    <version>2.4.0</version>
+  </extension>
+</extensions>

From d3f0700e978390f65805a488a96ef9ca8e9e8070 Mon Sep 17 00:00:00 2001
From: Andrija Panic <45762285+andrijapanicsb@users.noreply.github.com>
Date: Wed, 14 Oct 2026 21:02:45 +0200
Subject: [PATCH 35/41] Restore VMware-to-KVM migration changes from #13656
 (#14256)

VMware to KVM: cold (VDDK) and warm (CBT) migration into Ceph/RBD and Linstor, plus importVm adoption of existing RBD and Linstor volumes

Restores #13656 (merged as 0a5bf30af3, reverted by 510d0ec378), with
the fixes found in review:

- CBT: the per-disk checkpoint between delta cycles is now read from
  the cycle snapshot's disk backing, so each delta copies only the
  changes since the previous cycle (a5578d6f53)
- CBT: failures of the final agent command or of recording the final
  cycle are handled through the normal cutover failure path
  (6fa7d30b47)
- CBT: cancel and delete keep the target disks of an imported VM
  (fd1673629d)
- importVm: load template details from the supplied template, so
  imports with the removed "VM Import Default Template" work again
  (port of #14195, 2a3598ad6a)
- LINSTOR import: resource-group validation against the selected pool,
  and inspection and listing from controller metadata without
  connecting or disconnecting local DRBD resources (01058cd674);
  pagination offset/limit order (ce349d813e)

Feature summary:
- warm VMware-to-KVM migration with VDDK and Changed Block Tracking:
  persisted migration, cycle and disk records, preflight, delta cycles,
  operator cutover, cancel and cleanup; new admin APIs
  startVmwareCbtMigration, syncVmwareCbtMigration,
  cutoverVmwareCbtMigration, cancelVmwareCbtMigration,
  deleteVmwareCbtMigration, listVmwareCbtMigrations and
  checkVmwareCbtMigrationPrerequisites; UI under Tools
- cold direct VDDK import straight into Ceph/RBD or Linstor (raw), with
  virt-v2v in-place finalization
- adoption of existing RBD and Linstor ROOT (importVm
  importsource=shared) and DATA (importVolume) volumes without copying
- guest OS type, firmware (BIOS/UEFI, secure boot) and console defaults
  derived from the source VM configuration; static IPv4 preservation;
  Windows data disks brought online at first boot
- database changes in the 4.23.0 to 24.0.0 upgrade path

Reviewed and tested: LGTM from rp- (LINSTOR maintainer) and
alexandremattioli (tested warm CBT to QCOW2 and Ceph); Trillian smoke
tests tid-17130 on 95fc5b5: 157 OK, 0 errors.

Signed-off-by: Andrija Panic <andrija.panic@gmail.com>
---
 PendingReleaseNotes                           |   19 +
 .../agent/properties/AgentProperties.java     |   13 +
 .../cloud/agent/api/to/RemoteInstanceTO.java  |   14 +
 .../api/to/VmwareCbtChangedBlockRangeTO.java  |   47 +
 .../api/to/VmwareCbtDiskSyncResultTO.java     |   78 +
 .../cloud/agent/api/to/VmwareCbtDiskTO.java   |   85 +
 .../agent/api/to/VmwareVddkSourceDiskTO.java  |   53 +
 .../main/java/com/cloud/event/EventTypes.java |    3 +
 api/src/main/java/com/cloud/host/Host.java    |   10 +
 .../apache/cloudstack/api/ApiConstants.java   |   23 +
 .../admin/vm/CancelVmwareCbtMigrationCmd.java |   73 +
 ...eckVmwareCbtMigrationPrerequisitesCmd.java |  204 ++
 .../vm/CutoverVmwareCbtMigrationCmd.java      |  110 +
 .../admin/vm/DeleteVmwareCbtMigrationCmd.java |   81 +
 .../api/command/admin/vm/ImportVmCmd.java     |   36 +-
 .../admin/vm/ListVmwareCbtMigrationsCmd.java  |  109 +
 .../admin/vm/StartVmwareCbtMigrationCmd.java  |  361 ++
 .../admin/vm/SyncVmwareCbtMigrationCmd.java   |  110 +
 .../VmwareCbtMigrationCycleResponse.java      |  111 +
 .../VmwareCbtMigrationDiskResponse.java       |  117 +
 ...wareCbtMigrationPreflightDiskResponse.java |  114 +
 ...eCbtMigrationPreflightFindingResponse.java |   55 +
 .../VmwareCbtMigrationPreflightResponse.java  |  284 ++
 .../response/VmwareCbtMigrationResponse.java  |  288 ++
 .../volume/VolumeImportUnmanageService.java   |    3 +-
 .../cloudstack/vm/UnmanagedInstanceTO.java    |   43 +
 .../cloudstack/vm/UnmanagedVMsManager.java    |   50 +
 .../vm/VmwareCbtChangedBlockInfo.java         |   36 +
 .../vm/VmwareCbtChangedDiskInfo.java          |   46 +
 .../cloudstack/vm/VmwareCbtDiskInfo.java      |   67 +
 .../cloudstack/vm/VmwareCbtMigration.java     |   47 +
 .../vm/VmwareCbtMigrationCycle.java           |   30 +
 .../cloudstack/vm/VmwareCbtMigrationDisk.java |   30 +
 .../vm/VmwareCbtMigrationManager.java         |   46 +
 .../vm/VmwareCbtMigrationService.java         |   47 +
 .../vm/VmwareCbtPreflightDiskInfo.java        |   59 +
 .../cloudstack/vm/VmwareCbtPreflightInfo.java |  138 +
 .../vm/VmwareCbtPreflightNicInfo.java         |   87 +
 .../cloudstack/vm/VmwareCbtSnapshotInfo.java  |   46 +
 .../api/CheckConvertInstanceCommand.java      |   18 +
 .../agent/api/ConvertInstanceCommand.java     |   21 +
 .../api/ImportConvertedInstanceCommand.java   |   15 +
 .../agent/api/VmwareCbtCleanupCommand.java    |  100 +
 .../agent/api/VmwareCbtCutoverCommand.java    |  133 +
 .../agent/api/VmwareCbtMigrationAnswer.java   |   82 +
 .../agent/api/VmwareCbtPrepareCommand.java    |  110 +
 .../agent/api/VmwareCbtRbdProbeCommand.java   |   63 +
 .../cloud/agent/api/VmwareCbtSyncCommand.java |  138 +
 .../api/to/VmwareCbtTargetStorageType.java    |   28 +
 docs/vmware-cbt-migration.md                  |  457 +++
 docs/vmware-cbt/README.md                     | 1550 +++++++++
 docs/vmware-cbt/architecture.md               |  266 ++
 docs/vmware-linstor-migration.md              |  238 ++
 .../api/storage/PrimaryDataStoreDriver.java   |    7 +
 .../cloud/agent/manager/AgentManagerImpl.java |   73 +-
 .../orchestration/VolumeOrchestrator.java     |   18 +-
 .../orchestration/VolumeOrchestratorTest.java |   25 +
 .../cloud/vm/VmwareCbtMigrationCycleVO.java   |  171 +
 .../cloud/vm/VmwareCbtMigrationDiskVO.java    |  197 ++
 .../com/cloud/vm/VmwareCbtMigrationVO.java    |  465 +++
 .../vm/dao/VmwareCbtMigrationCycleDao.java    |   26 +
 .../dao/VmwareCbtMigrationCycleDaoImpl.java   |   46 +
 .../cloud/vm/dao/VmwareCbtMigrationDao.java   |   62 +
 .../vm/dao/VmwareCbtMigrationDaoImpl.java     |  129 +
 .../vm/dao/VmwareCbtMigrationDiskDao.java     |   26 +
 .../vm/dao/VmwareCbtMigrationDiskDaoImpl.java |   44 +
 ...spring-engine-schema-core-daos-context.xml |    3 +
 .../META-INF/db/schema-42300to2400.sql        |  126 +
 .../resource/LibvirtComputingResource.java    |  261 +-
 .../LibvirtBaseConvertCommandWrapper.java     |   73 +-
 ...irtCheckConvertInstanceCommandWrapper.java |   15 +
 .../LibvirtCheckVolumeCommandWrapper.java     |   53 +-
 .../LibvirtConvertInstanceCommandWrapper.java |  748 +++-
 ...virtGetVolumesOnStorageCommandWrapper.java |   32 +-
 ...ImportConvertedInstanceCommandWrapper.java |   21 +-
 .../wrapper/LibvirtReadyCommandWrapper.java   |   10 +
 ...LibvirtVmwareCbtCleanupCommandWrapper.java |  339 ++
 ...LibvirtVmwareCbtCutoverCommandWrapper.java |  794 +++++
 ...LibvirtVmwareCbtPrepareCommandWrapper.java |  506 +++
 ...ibvirtVmwareCbtRbdProbeCommandWrapper.java |  218 ++
 .../LibvirtVmwareCbtSyncCommandWrapper.java   |  489 +++
 .../wrapper/VmwareCbtCommandOutputLogger.java |   83 +
 .../wrapper/VmwareCbtCommandResult.java       |   41 +
 .../resource/wrapper/VmwareCbtSyncPlan.java   |  273 ++
 .../kvm/storage/KVMStoragePool.java           |   43 +
 .../kvm/storage/LibvirtStoragePool.java       |   31 +-
 .../apache/cloudstack/utils/qemu/QemuImg.java |   48 +-
 .../LibvirtComputingResourceTest.java         |   32 +
 ...heckConvertInstanceCommandWrapperTest.java |   65 +
 .../LibvirtCheckVolumeCommandWrapperTest.java |  238 ++
 ...virtConvertInstanceCommandWrapperTest.java |  123 +-
 ...rtConvertedInstanceCommandWrapperTest.java |  110 +
 .../LibvirtLinstorImportListingTest.java      |  123 +
 ...irtVmwareCbtCleanupCommandWrapperTest.java |  239 ++
 ...irtVmwareCbtCutoverCommandWrapperTest.java |  412 +++
 ...irtVmwareCbtPrepareCommandWrapperTest.java |  254 ++
 ...rtVmwareCbtRbdProbeCommandWrapperTest.java |  167 +
 ...ibvirtVmwareCbtSyncCommandWrapperTest.java |  246 ++
 .../wrapper/VmwareCbtSyncPlanTest.java        |   98 +
 .../kvm/storage/LibvirtStoragePoolTest.java   |   56 +
 .../VmwareCbtMigrationServiceImpl.java        |  602 ++++
 .../core/spring-vmware-core-context.xml       |    2 +
 .../VmwareCbtMigrationServiceImplTest.java    |   70 +
 .../kvm/storage/LinstorStorageAdaptor.java    |   33 +-
 .../kvm/storage/LinstorStoragePool.java       |   28 +
 .../LinstorPrimaryDataStoreDriverImpl.java    |    7 +
 .../datastore/util/LinstorImportHelper.java   |  201 ++
 .../storage/datastore/util/LinstorUtil.java   |   85 +-
 .../LinstorApiPaginationContractTest.java     |   74 +
 .../util/LinstorImportHelperTest.java         |  306 ++
 .../cloud/server/ManagementServerImpl.java    |    7 +-
 .../java/com/cloud/vm/UserVmManagerImpl.java  |   11 +-
 .../VolumeImportUnmanageManagerImpl.java      |    8 +
 .../vm/UnmanagedVMsManagerImpl.java           |  658 +++-
 .../vm/VmwareCbtMigrationCutoverPolicy.java   |   81 +
 .../vm/VmwareCbtMigrationManagerImpl.java     | 3008 +++++++++++++++++
 .../cloudstack/vm/VmwareCbtStorageTarget.java |   89 +
 .../spring-server-compute-context.xml         |    2 +
 .../cloud/vm/UserVmImportTemplateTest.java    |  206 ++
 .../VolumeImportUnmanageManagerImplTest.java  |   72 +
 .../vm/UnmanagedVMsManagerImplTest.java       |  416 +++
 .../vm/VmwareCbtMigrationCheckpointTest.java  |   52 +
 .../VmwareCbtMigrationCutoverFailureTest.java |   78 +
 .../VmwareCbtMigrationCutoverPolicyTest.java  |   75 +
 .../VmwareCbtMigrationDeletePolicyTest.java   |  179 +
 .../vm/VmwareCbtMigrationImportTest.java      |  126 +
 .../VmwareCbtMigrationNicValidationTest.java  |  144 +
 ...areCbtMigrationOfferingValidationTest.java |  135 +
 .../vm/VmwareCbtStorageTargetTest.java        |  205 ++
 ui/public/locales/en.json                     |   47 +-
 ui/public/locales/pt_BR.json                  |    8 +-
 ui/public/locales/te.json                     |    8 +-
 ui/src/config/section/tools.js                |   17 +-
 ui/src/utils/vmware.js                        |   41 +
 ui/src/views/infra/HostInfo.vue               |   88 +-
 .../views/tools/ImportUnmanagedInstance.vue   |  346 +-
 ui/src/views/tools/ManageInstances.vue        |  416 ++-
 ui/src/views/tools/SelectVmwareVcenter.vue    |    4 +-
 ui/src/views/tools/VmwareCbtMigrations.vue    |  493 +++
 ui/tests/unit/utils/vmware.spec.js            |   51 +
 .../hypervisor/vmware/util/VmwareHelper.java  |   59 +
 141 files changed, 22350 insertions(+), 239 deletions(-)
 create mode 100644 api/src/main/java/com/cloud/agent/api/to/VmwareCbtChangedBlockRangeTO.java
 create mode 100644 api/src/main/java/com/cloud/agent/api/to/VmwareCbtDiskSyncResultTO.java
 create mode 100644 api/src/main/java/com/cloud/agent/api/to/VmwareCbtDiskTO.java
 create mode 100644 api/src/main/java/com/cloud/agent/api/to/VmwareVddkSourceDiskTO.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/admin/vm/CancelVmwareCbtMigrationCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/admin/vm/CheckVmwareCbtMigrationPrerequisitesCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/admin/vm/CutoverVmwareCbtMigrationCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/admin/vm/DeleteVmwareCbtMigrationCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ListVmwareCbtMigrationsCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/admin/vm/StartVmwareCbtMigrationCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/admin/vm/SyncVmwareCbtMigrationCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationCycleResponse.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationDiskResponse.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationPreflightDiskResponse.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationPreflightFindingResponse.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationPreflightResponse.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationResponse.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/vm/VmwareCbtChangedBlockInfo.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/vm/VmwareCbtChangedDiskInfo.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/vm/VmwareCbtDiskInfo.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigration.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationCycle.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationDisk.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationManager.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationService.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/vm/VmwareCbtPreflightDiskInfo.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/vm/VmwareCbtPreflightInfo.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/vm/VmwareCbtPreflightNicInfo.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/vm/VmwareCbtSnapshotInfo.java
 create mode 100644 core/src/main/java/com/cloud/agent/api/VmwareCbtCleanupCommand.java
 create mode 100644 core/src/main/java/com/cloud/agent/api/VmwareCbtCutoverCommand.java
 create mode 100644 core/src/main/java/com/cloud/agent/api/VmwareCbtMigrationAnswer.java
 create mode 100644 core/src/main/java/com/cloud/agent/api/VmwareCbtPrepareCommand.java
 create mode 100644 core/src/main/java/com/cloud/agent/api/VmwareCbtRbdProbeCommand.java
 create mode 100644 core/src/main/java/com/cloud/agent/api/VmwareCbtSyncCommand.java
 create mode 100644 core/src/main/java/com/cloud/agent/api/to/VmwareCbtTargetStorageType.java
 create mode 100644 docs/vmware-cbt-migration.md
 create mode 100644 docs/vmware-cbt/README.md
 create mode 100644 docs/vmware-cbt/architecture.md
 create mode 100644 docs/vmware-linstor-migration.md
 create mode 100644 engine/schema/src/main/java/com/cloud/vm/VmwareCbtMigrationCycleVO.java
 create mode 100644 engine/schema/src/main/java/com/cloud/vm/VmwareCbtMigrationDiskVO.java
 create mode 100644 engine/schema/src/main/java/com/cloud/vm/VmwareCbtMigrationVO.java
 create mode 100644 engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationCycleDao.java
 create mode 100644 engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationCycleDaoImpl.java
 create mode 100644 engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationDao.java
 create mode 100644 engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationDaoImpl.java
 create mode 100644 engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationDiskDao.java
 create mode 100644 engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationDiskDaoImpl.java
 create mode 100644 plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtCleanupCommandWrapper.java
 create mode 100644 plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtCutoverCommandWrapper.java
 create mode 100644 plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtPrepareCommandWrapper.java
 create mode 100644 plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtRbdProbeCommandWrapper.java
 create mode 100644 plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtSyncCommandWrapper.java
 create mode 100644 plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/VmwareCbtCommandOutputLogger.java
 create mode 100644 plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/VmwareCbtCommandResult.java
 create mode 100644 plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/VmwareCbtSyncPlan.java
 create mode 100644 plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckVolumeCommandWrapperTest.java
 create mode 100644 plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtLinstorImportListingTest.java
 create mode 100644 plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtCleanupCommandWrapperTest.java
 create mode 100644 plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtCutoverCommandWrapperTest.java
 create mode 100644 plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtPrepareCommandWrapperTest.java
 create mode 100644 plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtRbdProbeCommandWrapperTest.java
 create mode 100644 plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtSyncCommandWrapperTest.java
 create mode 100644 plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/VmwareCbtSyncPlanTest.java
 create mode 100644 plugins/hypervisors/vmware/src/main/java/com/cloud/hypervisor/vmware/manager/VmwareCbtMigrationServiceImpl.java
 create mode 100644 plugins/hypervisors/vmware/src/test/java/com/cloud/hypervisor/vmware/manager/VmwareCbtMigrationServiceImplTest.java
 create mode 100644 plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorImportHelper.java
 create mode 100644 plugins/storage/volume/linstor/src/test/java/org/apache/cloudstack/storage/datastore/util/LinstorApiPaginationContractTest.java
 create mode 100644 plugins/storage/volume/linstor/src/test/java/org/apache/cloudstack/storage/datastore/util/LinstorImportHelperTest.java
 create mode 100644 server/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationCutoverPolicy.java
 create mode 100644 server/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationManagerImpl.java
 create mode 100644 server/src/main/java/org/apache/cloudstack/vm/VmwareCbtStorageTarget.java
 create mode 100644 server/src/test/java/com/cloud/vm/UserVmImportTemplateTest.java
 create mode 100644 server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationCheckpointTest.java
 create mode 100644 server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationCutoverFailureTest.java
 create mode 100644 server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationCutoverPolicyTest.java
 create mode 100644 server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationDeletePolicyTest.java
 create mode 100644 server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationImportTest.java
 create mode 100644 server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationNicValidationTest.java
 create mode 100644 server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationOfferingValidationTest.java
 create mode 100644 server/src/test/java/org/apache/cloudstack/vm/VmwareCbtStorageTargetTest.java
 create mode 100644 ui/src/utils/vmware.js
 create mode 100644 ui/src/views/tools/VmwareCbtMigrations.vue
 create mode 100644 ui/tests/unit/utils/vmware.spec.js

diff --git a/PendingReleaseNotes b/PendingReleaseNotes
index 44923495b23f..bc6068fa3310 100644
--- a/PendingReleaseNotes
+++ b/PendingReleaseNotes
@@ -55,6 +55,25 @@ example.ver.1 > example.ver.2:
     continue to snapshot live.
 
 4.23.0.0 > 24.0.0:
+  * VMware-to-KVM import using VDDK can import powered-off VMware VMs directly
+    into Ceph RBD primary storage when forceconverttopool is enabled and the
+    selected KVM conversion host supports qemu RBD access and in-place virt-v2v
+    finalization. Hosts without in-place finalization support can still use the
+    staged VDDK flow, converting to temporary qcow2 storage before copying the
+    finalized disks into RBD.
+
+  * Linstor primary storage can now be the destination for VMware-to-KVM
+    imports in all three modes. Staged imports (virt-v2v to a temporary NFS
+    location) copy the converted disks into pre-created DRBD block devices
+    through the Linstor storage adaptor; the import host must be a LINSTOR
+    satellite connected to the destination pool. Direct VDDK imports with
+    forceconverttopool write each powered-off VMware disk over nbdkit/VDDK
+    straight into the DRBD device and finalize it with virt-v2v in place.
+    VMware CBT warm migrations replicate the initial full copy and all
+    incremental changed-block cycles directly into Linstor volumes and
+    finalize in place at cutover; the conversion host requires VDDK,
+    in-place virt-v2v support and access to the Linstor pool.
+
   * KVM/Ceph: RBD volumes can now be encrypted at rest using native librbd
     LUKS2 (<encryption format='luks2' engine='librbd'>), for both data disks
     and root disks. Encryption is transparent to the guest and reuses the
diff --git a/agent/src/main/java/com/cloud/agent/properties/AgentProperties.java b/agent/src/main/java/com/cloud/agent/properties/AgentProperties.java
index e4775188d0ca..f27f7d89e5bc 100644
--- a/agent/src/main/java/com/cloud/agent/properties/AgentProperties.java
+++ b/agent/src/main/java/com/cloud/agent/properties/AgentProperties.java
@@ -848,6 +848,19 @@ public Property<Integer> getWorkers() {
      */
     public static final Property<String> VDDK_TRANSPORTS = new Property<>("vddk.transports", null, String.class);
 
+    /**
+     * NBD-transport compression used between the VDDK and the VMware server for the
+     * agent-driven nbdkit full-disk copies (cold direct import and CBT initial full
+     * sync). Passed to the nbdkit vddk plugin as <code>compression=&lt;value&gt;</code>.
+     * Valid values: <code>none</code>, <code>zlib</code>, <code>fastlz</code>,
+     * <code>skipz</code> (nbdkit &ge; 1.24, vSphere &ge; 6.5). <code>fastlz</code>
+     * compresses both zero regions and real data at low CPU cost; <code>skipz</code>
+     * only elides zero blocks. Does not affect the staged virt-v2v conversion path.
+     * Data type: String.<br>
+     * Default value: <code>fastlz</code>
+     */
+    public static final Property<String> VDDK_NBD_COMPRESSION = new Property<>("vddk.nbd.compression", "fastlz", String.class);
+
     /**
      * vCenter TLS certificate thumbprint used by virt-v2v VDDK mode, passed as <code>-io vddk-thumbprint=&lt;value&gt;</code>.
      * If unset, the KVM host computes it at runtime from the vCenter endpoint.
diff --git a/api/src/main/java/com/cloud/agent/api/to/RemoteInstanceTO.java b/api/src/main/java/com/cloud/agent/api/to/RemoteInstanceTO.java
index 7daeb9649177..8aec16d4b101 100644
--- a/api/src/main/java/com/cloud/agent/api/to/RemoteInstanceTO.java
+++ b/api/src/main/java/com/cloud/agent/api/to/RemoteInstanceTO.java
@@ -38,6 +38,7 @@ public class RemoteInstanceTO implements Serializable {
     private String datacenterName;
     private String clusterName;
     private String hostName;
+    private String vmwareMoref;
 
     public RemoteInstanceTO() {
     }
@@ -65,6 +66,11 @@ public RemoteInstanceTO(String instanceName, String instancePath, String vcenter
         this.hostName = hostName;
     }
 
+    public RemoteInstanceTO(String instanceName, String instancePath, String vcenterHost, String vcenterUsername, String vcenterPassword, String datacenterName, String clusterName, String hostName, String vmwareMoref) {
+        this(instanceName, instancePath, vcenterHost, vcenterUsername, vcenterPassword, datacenterName, clusterName, hostName);
+        this.vmwareMoref = vmwareMoref;
+    }
+
     public Hypervisor.HypervisorType getHypervisorType() {
         return this.hypervisorType;
     }
@@ -100,4 +106,12 @@ public String getClusterName() {
     public String getHostName() {
         return hostName;
     }
+
+    public String getVmwareMoref() {
+        return vmwareMoref;
+    }
+
+    public void setVmwareMoref(String vmwareMoref) {
+        this.vmwareMoref = vmwareMoref;
+    }
 }
diff --git a/api/src/main/java/com/cloud/agent/api/to/VmwareCbtChangedBlockRangeTO.java b/api/src/main/java/com/cloud/agent/api/to/VmwareCbtChangedBlockRangeTO.java
new file mode 100644
index 000000000000..ee8fcc59a290
--- /dev/null
+++ b/api/src/main/java/com/cloud/agent/api/to/VmwareCbtChangedBlockRangeTO.java
@@ -0,0 +1,47 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.agent.api.to;
+
+import java.io.Serializable;
+
+public class VmwareCbtChangedBlockRangeTO implements Serializable {
+
+    private String diskId;
+    private long startOffset;
+    private long length;
+
+    public VmwareCbtChangedBlockRangeTO() {
+    }
+
+    public VmwareCbtChangedBlockRangeTO(String diskId, long startOffset, long length) {
+        this.diskId = diskId;
+        this.startOffset = startOffset;
+        this.length = length;
+    }
+
+    public String getDiskId() {
+        return diskId;
+    }
+
+    public long getStartOffset() {
+        return startOffset;
+    }
+
+    public long getLength() {
+        return length;
+    }
+}
diff --git a/api/src/main/java/com/cloud/agent/api/to/VmwareCbtDiskSyncResultTO.java b/api/src/main/java/com/cloud/agent/api/to/VmwareCbtDiskSyncResultTO.java
new file mode 100644
index 000000000000..c22ea0bb24c0
--- /dev/null
+++ b/api/src/main/java/com/cloud/agent/api/to/VmwareCbtDiskSyncResultTO.java
@@ -0,0 +1,78 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.agent.api.to;
+
+import java.io.Serializable;
+
+public class VmwareCbtDiskSyncResultTO implements Serializable {
+
+    private String diskId;
+    private String targetPath;
+    private String changeId;
+    private String snapshotMor;
+    private long changedBytes;
+    private long durationSeconds;
+    private boolean result;
+    private String details;
+
+    public VmwareCbtDiskSyncResultTO() {
+    }
+
+    public VmwareCbtDiskSyncResultTO(String diskId, String targetPath, String changeId, String snapshotMor,
+                                    long changedBytes, long durationSeconds, boolean result, String details) {
+        this.diskId = diskId;
+        this.targetPath = targetPath;
+        this.changeId = changeId;
+        this.snapshotMor = snapshotMor;
+        this.changedBytes = changedBytes;
+        this.durationSeconds = durationSeconds;
+        this.result = result;
+        this.details = details;
+    }
+
+    public String getDiskId() {
+        return diskId;
+    }
+
+    public String getTargetPath() {
+        return targetPath;
+    }
+
+    public String getChangeId() {
+        return changeId;
+    }
+
+    public String getSnapshotMor() {
+        return snapshotMor;
+    }
+
+    public long getChangedBytes() {
+        return changedBytes;
+    }
+
+    public long getDurationSeconds() {
+        return durationSeconds;
+    }
+
+    public boolean getResult() {
+        return result;
+    }
+
+    public String getDetails() {
+        return details;
+    }
+}
diff --git a/api/src/main/java/com/cloud/agent/api/to/VmwareCbtDiskTO.java b/api/src/main/java/com/cloud/agent/api/to/VmwareCbtDiskTO.java
new file mode 100644
index 000000000000..e6dcf1bfbca6
--- /dev/null
+++ b/api/src/main/java/com/cloud/agent/api/to/VmwareCbtDiskTO.java
@@ -0,0 +1,85 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.agent.api.to;
+
+import java.io.Serializable;
+
+public class VmwareCbtDiskTO implements Serializable {
+
+    private String diskId;
+    private Integer diskDeviceKey;
+    private String sourceDiskPath;
+    private String datastoreName;
+    private String targetPath;
+    private String targetFormat;
+    private String changeId;
+    private String snapshotMor;
+    private long capacityBytes;
+
+    public VmwareCbtDiskTO() {
+    }
+
+    public VmwareCbtDiskTO(String diskId, Integer diskDeviceKey, String sourceDiskPath, String datastoreName,
+                          String targetPath, String targetFormat, String changeId, String snapshotMor,
+                          long capacityBytes) {
+        this.diskId = diskId;
+        this.diskDeviceKey = diskDeviceKey;
+        this.sourceDiskPath = sourceDiskPath;
+        this.datastoreName = datastoreName;
+        this.targetPath = targetPath;
+        this.targetFormat = targetFormat;
+        this.changeId = changeId;
+        this.snapshotMor = snapshotMor;
+        this.capacityBytes = capacityBytes;
+    }
+
+    public String getDiskId() {
+        return diskId;
+    }
+
+    public Integer getDiskDeviceKey() {
+        return diskDeviceKey;
+    }
+
+    public String getSourceDiskPath() {
+        return sourceDiskPath;
+    }
+
+    public String getDatastoreName() {
+        return datastoreName;
+    }
+
+    public String getTargetPath() {
+        return targetPath;
+    }
+
+    public String getTargetFormat() {
+        return targetFormat;
+    }
+
+    public String getChangeId() {
+        return changeId;
+    }
+
+    public String getSnapshotMor() {
+        return snapshotMor;
+    }
+
+    public long getCapacityBytes() {
+        return capacityBytes;
+    }
+}
diff --git a/api/src/main/java/com/cloud/agent/api/to/VmwareVddkSourceDiskTO.java b/api/src/main/java/com/cloud/agent/api/to/VmwareVddkSourceDiskTO.java
new file mode 100644
index 000000000000..b980c611abc9
--- /dev/null
+++ b/api/src/main/java/com/cloud/agent/api/to/VmwareVddkSourceDiskTO.java
@@ -0,0 +1,53 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.agent.api.to;
+
+import java.io.Serializable;
+
+public class VmwareVddkSourceDiskTO implements Serializable {
+
+    private String diskId;
+    private String sourceDiskPath;
+    private long capacityBytes;
+    private Integer position;
+
+    public VmwareVddkSourceDiskTO() {
+    }
+
+    public VmwareVddkSourceDiskTO(String diskId, String sourceDiskPath, long capacityBytes, Integer position) {
+        this.diskId = diskId;
+        this.sourceDiskPath = sourceDiskPath;
+        this.capacityBytes = capacityBytes;
+        this.position = position;
+    }
+
+    public String getDiskId() {
+        return diskId;
+    }
+
+    public String getSourceDiskPath() {
+        return sourceDiskPath;
+    }
+
+    public long getCapacityBytes() {
+        return capacityBytes;
+    }
+
+    public Integer getPosition() {
+        return position;
+    }
+}
diff --git a/api/src/main/java/com/cloud/event/EventTypes.java b/api/src/main/java/com/cloud/event/EventTypes.java
index 6dc9be25dbd1..7f45c8acd3f7 100644
--- a/api/src/main/java/com/cloud/event/EventTypes.java
+++ b/api/src/main/java/com/cloud/event/EventTypes.java
@@ -129,6 +129,9 @@ public class EventTypes {
     public static final String EVENT_VM_RESTORE = "VM.RESTORE";
     public static final String EVENT_VM_EXPUNGE = "VM.EXPUNGE";
     public static final String EVENT_VM_IMPORT = "VM.IMPORT";
+    public static final String EVENT_VMWARE_CBT_MIGRATION_START = "VMWARE.CBT.MIGRATION.START";
+    public static final String EVENT_VMWARE_CBT_MIGRATION_SYNC = "VMWARE.CBT.MIGRATION.SYNC";
+    public static final String EVENT_VMWARE_CBT_MIGRATION_CUTOVER = "VMWARE.CBT.MIGRATION.CUTOVER";
     public static final String EVENT_VM_UNMANAGE = "VM.UNMANAGE";
     public static final String EVENT_VM_RECOVER = "VM.RECOVER";
 
diff --git a/api/src/main/java/com/cloud/host/Host.java b/api/src/main/java/com/cloud/host/Host.java
index 79bec7a5871a..cca250c2a90f 100644
--- a/api/src/main/java/com/cloud/host/Host.java
+++ b/api/src/main/java/com/cloud/host/Host.java
@@ -62,8 +62,18 @@ public static String[] toStrings(Host.Type... types) {
     String HOST_VDDK_SUPPORT = "host.vddk.support";
     String HOST_VDDK_LIB_DIR = "vddk.lib.dir";
     String HOST_VDDK_VERSION = "host.vddk.version";
+    String HOST_VDDK_BLOCKCOPY_SUPPORT = "host.vddk.blockcopy.support";
+    String HOST_VDDK_BLOCKCOPY_INPLACE_FINALIZATION_SUPPORT = "host.vddk.blockcopy.inplace.finalization.support";
+    String HOST_VDDK_BLOCKCOPY_RBD_SUPPORT = "host.vddk.blockcopy.rbd.support";
+    String HOST_QEMU_IMG_VERSION = "host.qemu.img.version";
+    String HOST_QEMU_NBD_VERSION = "host.qemu.nbd.version";
+    String HOST_QEMU_IO_VERSION = "host.qemu.io.version";
     String HOST_OVFTOOL_VERSION = "host.ovftool.version";
     String HOST_VIRTV2V_VERSION = "host.virtv2v.version";
+    String HOST_VIRTV2V_INPLACE_VERSION = "host.virtv2v.inplace.version";
+    String HOST_VDDK_RBD_DIRECT_IMPORT_SUPPORT = "host.vddk.rbd.direct.import.support";
+    String HOST_VIRTV2V_INPLACE_SUPPORT = "host.virtv2v.inplace.support";
+    String HOST_QEMU_RBD_SUPPORT = "host.qemu.rbd.support";
     String HOST_SSH_PORT = "host.ssh.port";
     String HOST_CDROM_MAX_COUNT = "host.cdrom.max.count";
     String GUEST_OS_CATEGORY_ID = "guest.os.category.id";
diff --git a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
index b1fc6246ff9a..12cc2ba20c25 100644
--- a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
+++ b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
@@ -671,6 +671,29 @@ public class ApiConstants {
     public static final String USER_SECURITY_GROUP_LIST = "usersecuritygrouplist";
     public static final String USER_SECRET_KEY = "usersecretkey";
     public static final String USE_VDDK = "usevddk";
+    public static final String VMWARE_MIGRATION_MODE = "vmwaremigrationmode";
+    public static final String VMWARE_CBT_MIGRATION_ID = "vmwarecbtmigrationid";
+    public static final String SOURCE_HOST = "sourcehost";
+    public static final String SOURCE_CLUSTER = "sourcecluster";
+    public static final String SOURCE_VM_NAME = "sourcevmname";
+    public static final String SOURCE_DISK_ID = "sourcediskid";
+    public static final String SOURCE_DISK_DEVICE_KEY = "sourcediskdevicekey";
+    public static final String SOURCE_DISK_PATH = "sourcediskpath";
+    public static final String TARGET_PATH = "targetpath";
+    public static final String TARGET_FORMAT = "targetformat";
+    public static final String CHANGE_ID = "changeid";
+    public static final String SNAPSHOT_MOR = "snapshotmor";
+    public static final String CURRENT_STEP = "currentstep";
+    public static final String LAST_ERROR = "lasterror";
+    public static final String COMPLETED_CYCLES = "completedcycles";
+    public static final String QUIET_CYCLES = "quietcycles";
+    public static final String LAST_CHANGED_BYTES = "lastchangedbytes";
+    public static final String LAST_DIRTY_RATE = "lastdirtyrate";
+    public static final String TOTAL_CHANGED_BYTES = "totalchangedbytes";
+    public static final String CYCLE = "cycle";
+    public static final String CYCLE_NUMBER = "cyclenumber";
+    public static final String CHANGED_BYTES = "changedbytes";
+    public static final String DIRTY_RATE = "dirtyrate";
     public static final String USE_VIRTUAL_NETWORK = "usevirtualnetwork";
     public static final String USE_VIRTUAL_ROUTER_IP_RESOLVER = "userouteripresolver";
     public static final String UPDATE_IN_SEQUENCE = "updateinsequence";
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/CancelVmwareCbtMigrationCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/CancelVmwareCbtMigrationCmd.java
new file mode 100644
index 000000000000..fa4fc4f7bb6f
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/CancelVmwareCbtMigrationCmd.java
@@ -0,0 +1,73 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.admin.vm;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ResponseObject;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.VmwareCbtMigrationResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.VmwareCbtMigrationManager;
+
+import com.cloud.exception.ConcurrentOperationException;
+import com.cloud.exception.InsufficientCapacityException;
+import com.cloud.exception.NetworkRuleConflictException;
+import com.cloud.exception.ResourceAllocationException;
+import com.cloud.exception.ResourceUnavailableException;
+import com.cloud.user.Account;
+
+@APICommand(name = "cancelVmwareCbtMigration",
+        description = "Cancel a VMware CBT migration session",
+        responseObject = VmwareCbtMigrationResponse.class,
+        responseView = ResponseObject.ResponseView.Full,
+        requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin},
+        since = "4.24.0")
+public class CancelVmwareCbtMigrationCmd extends BaseCmd {
+
+    @Inject
+    public VmwareCbtMigrationManager vmwareCbtMigrationManager;
+
+    @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = VmwareCbtMigrationResponse.class,
+            required = true, description = "the VMware CBT migration ID")
+    private Long id;
+
+    public Long getId() {
+        return id;
+    }
+
+    @Override
+    public void execute() throws ResourceUnavailableException, InsufficientCapacityException, ServerApiException,
+            ConcurrentOperationException, ResourceAllocationException, NetworkRuleConflictException {
+        VmwareCbtMigrationResponse response = vmwareCbtMigrationManager.cancelVmwareCbtMigration(this);
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        Account account = CallContext.current().getCallingAccount();
+        return account == null ? Account.ACCOUNT_ID_SYSTEM : account.getId();
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/CheckVmwareCbtMigrationPrerequisitesCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/CheckVmwareCbtMigrationPrerequisitesCmd.java
new file mode 100644
index 000000000000..cbbadc090ce5
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/CheckVmwareCbtMigrationPrerequisitesCmd.java
@@ -0,0 +1,204 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.admin.vm;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ResponseObject;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.ClusterResponse;
+import org.apache.cloudstack.api.response.HostResponse;
+import org.apache.cloudstack.api.response.ServiceOfferingResponse;
+import org.apache.cloudstack.api.response.StoragePoolResponse;
+import org.apache.cloudstack.api.response.VmwareCbtMigrationPreflightResponse;
+import org.apache.cloudstack.api.response.VmwareDatacenterResponse;
+import org.apache.cloudstack.api.response.ZoneResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.VmwareCbtMigrationManager;
+import org.apache.commons.collections.MapUtils;
+
+import com.cloud.exception.ConcurrentOperationException;
+import com.cloud.exception.InsufficientCapacityException;
+import com.cloud.exception.NetworkRuleConflictException;
+import com.cloud.exception.ResourceAllocationException;
+import com.cloud.exception.ResourceUnavailableException;
+import com.cloud.user.Account;
+
+@APICommand(name = "checkVmwareCbtMigrationPrerequisites",
+        description = "Check whether a VMware VM and KVM destination are ready for VMware CBT based migration",
+        responseObject = VmwareCbtMigrationPreflightResponse.class,
+        responseView = ResponseObject.ResponseView.Full,
+        requestHasSensitiveInfo = true,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin},
+        since = "4.24.0")
+public class CheckVmwareCbtMigrationPrerequisitesCmd extends BaseCmd {
+
+    @Inject
+    public VmwareCbtMigrationManager vmwareCbtMigrationManager;
+
+    @Parameter(name = ApiConstants.ZONE_ID, type = CommandType.UUID, entityType = ZoneResponse.class,
+            required = true, description = "the destination zone ID")
+    private Long zoneId;
+
+    @Parameter(name = ApiConstants.CLUSTER_ID, type = CommandType.UUID, entityType = ClusterResponse.class,
+            required = true, description = "the destination KVM cluster ID")
+    private Long clusterId;
+
+    @Parameter(name = ApiConstants.SOURCE_VM_NAME, type = CommandType.STRING,
+            required = true, description = "the source VMware VM name")
+    private String sourceVmName;
+
+    @Parameter(name = ApiConstants.EXISTING_VCENTER_ID, type = CommandType.UUID, entityType = VmwareDatacenterResponse.class,
+            description = "UUID of a linked existing vCenter")
+    private Long existingVcenterId;
+
+    @Parameter(name = ApiConstants.VCENTER, type = CommandType.STRING,
+            description = "the source vCenter IP address or FQDN")
+    private String vcenter;
+
+    @Parameter(name = ApiConstants.DATACENTER_NAME, type = CommandType.STRING,
+            description = "the source VMware datacenter name")
+    private String datacenterName;
+
+    @Parameter(name = ApiConstants.CLUSTER_NAME, type = CommandType.STRING,
+            description = "the source VMware cluster name")
+    private String sourceCluster;
+
+    @Parameter(name = ApiConstants.HOST_IP, type = CommandType.STRING,
+            description = "the source VMware ESXi host IP address or FQDN")
+    private String sourceHost;
+
+    @Parameter(name = ApiConstants.USERNAME, type = CommandType.STRING,
+            description = "the username for the source vCenter")
+    private String username;
+
+    @Parameter(name = ApiConstants.PASSWORD, type = CommandType.STRING,
+            description = "the password for the source vCenter")
+    private String password;
+
+    @Parameter(name = ApiConstants.CONVERT_INSTANCE_HOST_ID, type = CommandType.UUID, entityType = HostResponse.class,
+            description = "optional KVM host to perform CBT block replication")
+    private Long convertInstanceHostId;
+
+    @Parameter(name = ApiConstants.CONVERT_INSTANCE_STORAGE_POOL_ID, type = CommandType.UUID, entityType = StoragePoolResponse.class,
+            description = "optional primary storage pool for converted disks")
+    private Long storagePoolId;
+
+    @Parameter(name = ApiConstants.SERVICE_OFFERING_ID, type = CommandType.UUID, entityType = ServiceOfferingResponse.class,
+            description = "optional service offering to validate against the source VM CPU and memory requirements")
+    private Long serviceOfferingId;
+
+    @Parameter(name = ApiConstants.DETAILS, type = CommandType.MAP,
+            description = "optional service offering custom parameters and migration details")
+    private Map details;
+
+    public Long getZoneId() {
+        return zoneId;
+    }
+
+    public Long getClusterId() {
+        return clusterId;
+    }
+
+    public String getSourceVmName() {
+        return sourceVmName;
+    }
+
+    public Long getExistingVcenterId() {
+        return existingVcenterId;
+    }
+
+    public String getVcenter() {
+        return vcenter;
+    }
+
+    public String getDatacenterName() {
+        return datacenterName;
+    }
+
+    public String getSourceCluster() {
+        return sourceCluster;
+    }
+
+    public String getSourceHost() {
+        return sourceHost;
+    }
+
+    public String getUsername() {
+        return username;
+    }
+
+    public String getPassword() {
+        return password;
+    }
+
+    public Long getConvertInstanceHostId() {
+        return convertInstanceHostId;
+    }
+
+    public Long getStoragePoolId() {
+        return storagePoolId;
+    }
+
+    public Long getServiceOfferingId() {
+        return serviceOfferingId;
+    }
+
+    @SuppressWarnings("unchecked")
+    public Map<String, String> getDetails() {
+        Map<String, String> params = new HashMap<>();
+        if (MapUtils.isEmpty(details)) {
+            return params;
+        }
+
+        for (Object value : details.values()) {
+            if (!(value instanceof Map)) {
+                continue;
+            }
+            Map<Object, Object> detailMap = (Map<Object, Object>)value;
+            for (Map.Entry<Object, Object> entry : detailMap.entrySet()) {
+                if (entry.getKey() != null && entry.getValue() != null) {
+                    params.put(entry.getKey().toString(), entry.getValue().toString());
+                }
+            }
+        }
+        return params;
+    }
+
+    @Override
+    public void execute() throws ResourceUnavailableException, InsufficientCapacityException, ServerApiException,
+            ConcurrentOperationException, ResourceAllocationException, NetworkRuleConflictException {
+        VmwareCbtMigrationPreflightResponse response = vmwareCbtMigrationManager.checkVmwareCbtMigrationPrerequisites(this);
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        Account account = CallContext.current().getCallingAccount();
+        return account == null ? Account.ACCOUNT_ID_SYSTEM : account.getId();
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/CutoverVmwareCbtMigrationCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/CutoverVmwareCbtMigrationCmd.java
new file mode 100644
index 000000000000..61aedf31f4a2
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/CutoverVmwareCbtMigrationCmd.java
@@ -0,0 +1,110 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.admin.vm;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseAsyncCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ResponseObject;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.VmwareCbtMigrationResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.VmwareCbtMigrationManager;
+
+import com.cloud.event.EventTypes;
+import com.cloud.exception.ConcurrentOperationException;
+import com.cloud.exception.InsufficientCapacityException;
+import com.cloud.exception.NetworkRuleConflictException;
+import com.cloud.exception.ResourceAllocationException;
+import com.cloud.exception.ResourceUnavailableException;
+import com.cloud.user.Account;
+
+@APICommand(name = "cutoverVmwareCbtMigration",
+        description = "Perform final cutover for a VMware CBT migration",
+        responseObject = VmwareCbtMigrationResponse.class,
+        responseView = ResponseObject.ResponseView.Full,
+        requestHasSensitiveInfo = true,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin},
+        since = "4.24.0")
+public class CutoverVmwareCbtMigrationCmd extends BaseAsyncCmd {
+
+    @Inject
+    public VmwareCbtMigrationManager vmwareCbtMigrationManager;
+
+    @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = VmwareCbtMigrationResponse.class,
+            required = true, description = "the VMware CBT migration ID")
+    private Long id;
+
+    @Parameter(name = ApiConstants.USERNAME, type = CommandType.STRING,
+            description = "optional username override for the source vCenter. Stored external vCenter credentials are used when available")
+    private String username;
+
+    @Parameter(name = ApiConstants.PASSWORD, type = CommandType.STRING,
+            description = "optional password override for the source vCenter. Stored external vCenter credentials are used when available")
+    private String password;
+
+    public Long getId() {
+        return id;
+    }
+
+    public String getUsername() {
+        return username;
+    }
+
+    public String getPassword() {
+        return password;
+    }
+
+    @Override
+    public String getEventType() {
+        return EventTypes.EVENT_VMWARE_CBT_MIGRATION_CUTOVER;
+    }
+
+    @Override
+    public String getEventDescription() {
+        return String.format("Cutting over VMware CBT migration: %s", id);
+    }
+
+    @Override
+    public String getSyncObjType() {
+        return BaseAsyncCmd.migrationSyncObject;
+    }
+
+    @Override
+    public Long getSyncObjId() {
+        return id;
+    }
+
+    @Override
+    public void execute() throws ResourceUnavailableException, InsufficientCapacityException, ServerApiException,
+            ConcurrentOperationException, ResourceAllocationException, NetworkRuleConflictException {
+        VmwareCbtMigrationResponse response = vmwareCbtMigrationManager.cutoverVmwareCbtMigration(this);
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        Account account = CallContext.current().getCallingAccount();
+        return account == null ? Account.ACCOUNT_ID_SYSTEM : account.getId();
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/DeleteVmwareCbtMigrationCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/DeleteVmwareCbtMigrationCmd.java
new file mode 100644
index 000000000000..67163814b23a
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/DeleteVmwareCbtMigrationCmd.java
@@ -0,0 +1,81 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.admin.vm;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.SuccessResponse;
+import org.apache.cloudstack.api.response.VmwareCbtMigrationResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.VmwareCbtMigrationManager;
+
+import com.cloud.exception.ConcurrentOperationException;
+import com.cloud.exception.InsufficientCapacityException;
+import com.cloud.exception.NetworkRuleConflictException;
+import com.cloud.exception.ResourceAllocationException;
+import com.cloud.exception.ResourceUnavailableException;
+import com.cloud.user.Account;
+
+@APICommand(name = "deleteVmwareCbtMigration",
+        description = "Deletes a failed, cancelled or completed VMware CBT migration record. Failed and cancelled migrations can optionally clean up replicated target disks; completed migrations are record-only deletes.",
+        responseObject = SuccessResponse.class,
+        requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin},
+        since = "4.24.0")
+public class DeleteVmwareCbtMigrationCmd extends BaseCmd {
+
+    @Inject
+    public VmwareCbtMigrationManager vmwareCbtMigrationManager;
+
+    @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = VmwareCbtMigrationResponse.class,
+            required = true, description = "the VMware CBT migration ID")
+    private Long id;
+
+    @Parameter(name = ApiConstants.CLEANUP, type = CommandType.BOOLEAN,
+            description = "If true, clean up replicated target disks before removing a failed or cancelled migration record. True by default. Ignored for completed migrations.")
+    private Boolean cleanup;
+
+    public Long getId() {
+        return id;
+    }
+
+    public boolean getCleanup() {
+        return cleanup == null || cleanup;
+    }
+
+    @Override
+    public void execute() throws ResourceUnavailableException, InsufficientCapacityException, ServerApiException,
+            ConcurrentOperationException, ResourceAllocationException, NetworkRuleConflictException {
+        boolean result = vmwareCbtMigrationManager.deleteVmwareCbtMigration(this);
+        SuccessResponse response = new SuccessResponse(getCommandName());
+        response.setSuccess(result);
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        Account account = CallContext.current().getCallingAccount();
+        return account == null ? Account.ACCOUNT_ID_SYSTEM : account.getId();
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ImportVmCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ImportVmCmd.java
index db7dcc3fb44f..94249dd92e9b 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ImportVmCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ImportVmCmd.java
@@ -57,6 +57,24 @@ public class ImportVmCmd extends ImportUnmanagedInstanceCmd {
     @Inject
     public VmImportService vmImportService;
 
+    public enum VmwareMigrationMode {
+        OVF,
+        VDDK,
+        CBT;
+
+        public static VmwareMigrationMode fromValue(String value, boolean useVddkFallback) {
+            if (StringUtils.isBlank(value)) {
+                return useVddkFallback ? VDDK : OVF;
+            }
+            for (VmwareMigrationMode mode : values()) {
+                if (mode.name().equalsIgnoreCase(value)) {
+                    return mode;
+                }
+            }
+            throw new IllegalArgumentException(String.format("Unsupported VMware migration mode: %s", value));
+        }
+    }
+
     /////////////////////////////////////////////////////
     //////////////// API parameters /////////////////////
     /////////////////////////////////////////////////////
@@ -153,7 +171,8 @@ public class ImportVmCmd extends ImportUnmanagedInstanceCmd {
     private Long importInstanceHostId;
 
     @Parameter(name = ApiConstants.CONVERT_INSTANCE_STORAGE_POOL_ID, type = CommandType.UUID, entityType = StoragePoolResponse.class,
-            description = "(only for importing VMs from VMware to KVM) optional - the temporary storage pool to perform the virt-v2v migration from VMware to KVM.")
+            description = "(only for importing VMs from VMware to KVM) optional - the temporary storage pool to perform the virt-v2v migration from VMware to KVM. " +
+                    "When " + ApiConstants.USE_VDDK + " and " + ApiConstants.FORCE_CONVERT_TO_POOL + " are true, this can be an RBD primary storage pool for direct RBD import.")
     private Long convertStoragePoolId;
 
     @Parameter(name = ApiConstants.FORCE_MS_TO_IMPORT_VM_FILES, type = CommandType.BOOLEAN,
@@ -183,9 +202,18 @@ public class ImportVmCmd extends ImportUnmanagedInstanceCmd {
             type = CommandType.BOOLEAN,
             since = "4.22.1",
             description = "(only for importing VMs from VMware to KVM) optional - if true, uses VDDK on the KVM conversion host for converting the VM. " +
-                    "This parameter is mutually exclusive with " + ApiConstants.FORCE_MS_TO_IMPORT_VM_FILES + ".")
+                    "This parameter is mutually exclusive with " + ApiConstants.FORCE_MS_TO_IMPORT_VM_FILES + ". " +
+                    "With " + ApiConstants.FORCE_CONVERT_TO_POOL + "=true and an RBD conversion pool, the source VMware VM must be powered off and " +
+                    "the conversion host must support qemu RBD access and in-place virt-v2v finalization.")
     private Boolean useVddk;
 
+    @Parameter(name = ApiConstants.VMWARE_MIGRATION_MODE,
+            type = CommandType.STRING,
+            since = "4.22.1",
+            description = "(only for importing VMs from VMware to KVM) optional - migration mode to use. Valid values are OVF, VDDK, and CBT. " +
+                    "When omitted, CloudStack preserves the existing usevddk behavior.")
+    private String vmwareMigrationMode;
+
 
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
@@ -267,6 +295,10 @@ public boolean getUseVddk() {
         return BooleanUtils.toBooleanDefaultIfNull(useVddk, true);
     }
 
+    public String getVmwareMigrationMode() {
+        return vmwareMigrationMode;
+    }
+
     public String getTmpPath() {
         return tmpPath;
     }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ListVmwareCbtMigrationsCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ListVmwareCbtMigrationsCmd.java
new file mode 100644
index 000000000000..3ea5f53970cf
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ListVmwareCbtMigrationsCmd.java
@@ -0,0 +1,109 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.admin.vm;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseListCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ResponseObject;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.AccountResponse;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.api.response.VmwareCbtMigrationResponse;
+import org.apache.cloudstack.api.response.ZoneResponse;
+import org.apache.cloudstack.vm.VmwareCbtMigrationManager;
+
+import com.cloud.exception.ConcurrentOperationException;
+import com.cloud.exception.InsufficientCapacityException;
+import com.cloud.exception.NetworkRuleConflictException;
+import com.cloud.exception.ResourceAllocationException;
+import com.cloud.exception.ResourceUnavailableException;
+
+@APICommand(name = "listVmwareCbtMigrations",
+        description = "List VMware CBT based migration sessions",
+        responseObject = VmwareCbtMigrationResponse.class,
+        responseView = ResponseObject.ResponseView.Full,
+        requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin},
+        since = "4.24.0")
+public class ListVmwareCbtMigrationsCmd extends BaseListCmd {
+
+    @Inject
+    public VmwareCbtMigrationManager vmwareCbtMigrationManager;
+
+    @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = VmwareCbtMigrationResponse.class,
+            description = "the VMware CBT migration ID")
+    private Long id;
+
+    @Parameter(name = ApiConstants.ZONE_ID, type = CommandType.UUID, entityType = ZoneResponse.class,
+            description = "the destination zone ID")
+    private Long zoneId;
+
+    @Parameter(name = ApiConstants.ACCOUNT_ID, type = CommandType.UUID, entityType = AccountResponse.class,
+            description = "the account ID")
+    private Long accountId;
+
+    @Parameter(name = ApiConstants.VCENTER, type = CommandType.STRING,
+            description = "the source VMware vCenter")
+    private String vcenter;
+
+    @Parameter(name = ApiConstants.SOURCE_VM_NAME, type = CommandType.STRING,
+            description = "the source VMware VM name")
+    private String sourceVmName;
+
+    @Parameter(name = ApiConstants.STATE, type = CommandType.STRING,
+            description = "the migration state")
+    private String state;
+
+    public Long getId() {
+        return id;
+    }
+
+    public Long getZoneId() {
+        return zoneId;
+    }
+
+    public Long getAccountId() {
+        return accountId;
+    }
+
+    public String getVcenter() {
+        return vcenter;
+    }
+
+    public String getSourceVmName() {
+        return sourceVmName;
+    }
+
+    public String getState() {
+        return state;
+    }
+
+    @Override
+    public void execute() throws ResourceUnavailableException, InsufficientCapacityException, ServerApiException,
+            ConcurrentOperationException, ResourceAllocationException, NetworkRuleConflictException {
+        ListResponse<VmwareCbtMigrationResponse> response = vmwareCbtMigrationManager.listVmwareCbtMigrations(this);
+        response.setResponseName(getCommandName());
+        response.setObjectName("vmwarecbtmigration");
+        setResponseObject(response);
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/StartVmwareCbtMigrationCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/StartVmwareCbtMigrationCmd.java
new file mode 100644
index 000000000000..0746e40c34ca
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/StartVmwareCbtMigrationCmd.java
@@ -0,0 +1,361 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.admin.vm;
+
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.Map;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseAsyncCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ResponseObject;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.ClusterResponse;
+import org.apache.cloudstack.api.response.DomainResponse;
+import org.apache.cloudstack.api.response.GuestOSResponse;
+import org.apache.cloudstack.api.response.HostResponse;
+import org.apache.cloudstack.api.response.ProjectResponse;
+import org.apache.cloudstack.api.response.ServiceOfferingResponse;
+import org.apache.cloudstack.api.response.StoragePoolResponse;
+import org.apache.cloudstack.api.response.TemplateResponse;
+import org.apache.cloudstack.api.response.VmwareCbtMigrationResponse;
+import org.apache.cloudstack.api.response.VmwareDatacenterResponse;
+import org.apache.cloudstack.api.response.ZoneResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.VmwareCbtMigrationManager;
+import org.apache.commons.collections.MapUtils;
+import org.apache.commons.lang.BooleanUtils;
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.event.EventTypes;
+import com.cloud.exception.ConcurrentOperationException;
+import com.cloud.exception.InsufficientCapacityException;
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.exception.NetworkRuleConflictException;
+import com.cloud.exception.ResourceAllocationException;
+import com.cloud.exception.ResourceUnavailableException;
+import com.cloud.network.Network;
+import com.cloud.offering.DiskOffering;
+import com.cloud.user.Account;
+import com.cloud.utils.net.NetUtils;
+import com.cloud.vm.VmDetailConstants;
+
+@APICommand(name = "startVmwareCbtMigration",
+        description = "Start tracking a VMware CBT based migration session",
+        responseObject = VmwareCbtMigrationResponse.class,
+        responseView = ResponseObject.ResponseView.Full,
+        requestHasSensitiveInfo = true,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin},
+        since = "4.24.0")
+public class StartVmwareCbtMigrationCmd extends BaseAsyncCmd {
+
+    @Inject
+    public VmwareCbtMigrationManager vmwareCbtMigrationManager;
+
+    @Parameter(name = ApiConstants.ZONE_ID, type = CommandType.UUID, entityType = ZoneResponse.class,
+            required = true, description = "the destination zone ID")
+    private Long zoneId;
+
+    @Parameter(name = ApiConstants.CLUSTER_ID, type = CommandType.UUID, entityType = ClusterResponse.class,
+            required = true, description = "the destination KVM cluster ID")
+    private Long clusterId;
+
+    @Parameter(name = ApiConstants.DISPLAY_NAME, type = CommandType.STRING,
+            description = "the display name of the migrated VM")
+    private String displayName;
+
+    @Parameter(name = ApiConstants.HOST_NAME, type = CommandType.STRING,
+            description = "the host name of the migrated VM")
+    private String hostName;
+
+    @Parameter(name = ApiConstants.ACCOUNT, type = CommandType.STRING,
+            description = "optional account for the migrated VM. Must be used with domainid")
+    private String accountName;
+
+    @Parameter(name = ApiConstants.DOMAIN_ID, type = CommandType.UUID, entityType = DomainResponse.class,
+            description = "import the migrated VM to the specified domain")
+    private Long domainId;
+
+    @Parameter(name = ApiConstants.PROJECT_ID, type = CommandType.UUID, entityType = ProjectResponse.class,
+            description = "import the migrated VM for the project")
+    private Long projectId;
+
+    @Parameter(name = ApiConstants.TEMPLATE_ID, type = CommandType.UUID, entityType = TemplateResponse.class,
+            description = "the template ID for the migrated VM")
+    private Long templateId;
+
+    @Parameter(name = ApiConstants.SERVICE_OFFERING_ID, type = CommandType.UUID, entityType = ServiceOfferingResponse.class,
+            required = true, description = "the service offering for the migrated VM")
+    private Long serviceOfferingId;
+
+    @Parameter(name = ApiConstants.OS_ID, type = CommandType.UUID, entityType = GuestOSResponse.class,
+            description = "optional guest OS ID for the migrated VM")
+    private Long guestOsId;
+
+    @Parameter(name = ApiConstants.SOURCE_VM_NAME, type = CommandType.STRING,
+            required = true, description = "the source VMware VM name")
+    private String sourceVmName;
+
+    @Parameter(name = ApiConstants.EXISTING_VCENTER_ID, type = CommandType.UUID, entityType = VmwareDatacenterResponse.class,
+            description = "UUID of a linked existing vCenter")
+    private Long existingVcenterId;
+
+    @Parameter(name = ApiConstants.VCENTER, type = CommandType.STRING,
+            description = "the source vCenter IP address or FQDN")
+    private String vcenter;
+
+    @Parameter(name = ApiConstants.DATACENTER_NAME, type = CommandType.STRING,
+            description = "the source VMware datacenter name")
+    private String datacenterName;
+
+    @Parameter(name = ApiConstants.CLUSTER_NAME, type = CommandType.STRING,
+            description = "the source VMware cluster name")
+    private String sourceCluster;
+
+    @Parameter(name = ApiConstants.HOST_IP, type = CommandType.STRING,
+            description = "the source VMware ESXi host IP address or FQDN")
+    private String sourceHost;
+
+    @Parameter(name = ApiConstants.USERNAME, type = CommandType.STRING,
+            description = "the username for the source vCenter")
+    private String username;
+
+    @Parameter(name = ApiConstants.PASSWORD, type = CommandType.STRING,
+            description = "the password for the source vCenter")
+    private String password;
+
+    @Parameter(name = ApiConstants.CONVERT_INSTANCE_HOST_ID, type = CommandType.UUID, entityType = HostResponse.class,
+            description = "optional KVM host to perform virt-v2v conversion and CBT block replication")
+    private Long convertInstanceHostId;
+
+    @Parameter(name = ApiConstants.CONVERT_INSTANCE_STORAGE_POOL_ID, type = CommandType.UUID, entityType = StoragePoolResponse.class,
+            description = "optional primary storage pool for converted disks")
+    private Long storagePoolId;
+
+    @Parameter(name = ApiConstants.DETAILS, type = CommandType.MAP,
+            description = "optional migration details, including VDDK settings such as vddk.lib.dir, vddk.transports and vddk.thumbprint")
+    private Map details;
+
+    @Parameter(name = ApiConstants.NIC_NETWORK_LIST, type = CommandType.MAP,
+            description = "VM NIC to network id mapping using keys NIC and network")
+    private Map nicNetworkList;
+
+    @Parameter(name = ApiConstants.NIC_IP_ADDRESS_LIST, type = CommandType.MAP,
+            description = "VM NIC to ip address mapping using keys NIC, ip4Address")
+    private Map nicIpAddressList;
+
+    @Parameter(name = ApiConstants.DATADISK_OFFERING_LIST, type = CommandType.MAP,
+            description = "datadisk to disk-offering mapping using keys disk and diskOffering")
+    private Map dataDiskToDiskOfferingList;
+
+    @Parameter(name = ApiConstants.FORCED, type = CommandType.BOOLEAN,
+            description = "import despite duplicate NIC MAC addresses; CloudStack generates a new MAC address when a duplicate exists")
+    private Boolean forced;
+
+    public Long getZoneId() {
+        return zoneId;
+    }
+
+    public Long getClusterId() {
+        return clusterId;
+    }
+
+    public String getDisplayName() {
+        return displayName;
+    }
+
+    public String getHostName() {
+        return hostName;
+    }
+
+    public String getAccountName() {
+        return accountName;
+    }
+
+    public Long getDomainId() {
+        return domainId;
+    }
+
+    public Long getProjectId() {
+        return projectId;
+    }
+
+    public Long getTemplateId() {
+        return templateId;
+    }
+
+    public Long getServiceOfferingId() {
+        return serviceOfferingId;
+    }
+
+    public Long getGuestOsId() {
+        return guestOsId;
+    }
+
+    public String getSourceVmName() {
+        return sourceVmName;
+    }
+
+    public Long getExistingVcenterId() {
+        return existingVcenterId;
+    }
+
+    public String getVcenter() {
+        return vcenter;
+    }
+
+    public String getDatacenterName() {
+        return datacenterName;
+    }
+
+    public String getSourceCluster() {
+        return sourceCluster;
+    }
+
+    public String getSourceHost() {
+        return sourceHost;
+    }
+
+    public String getUsername() {
+        return username;
+    }
+
+    public String getPassword() {
+        return password;
+    }
+
+    public Long getConvertInstanceHostId() {
+        return convertInstanceHostId;
+    }
+
+    public Long getStoragePoolId() {
+        return storagePoolId;
+    }
+
+    @SuppressWarnings("unchecked")
+    public Map<String, String> getDetails() {
+        Map<String, String> params = new HashMap<>();
+        if (MapUtils.isEmpty(details)) {
+            return params;
+        }
+
+        for (Object value : details.values()) {
+            if (!(value instanceof Map)) {
+                continue;
+            }
+            Map<Object, Object> detailMap = (Map<Object, Object>)value;
+            for (Map.Entry<Object, Object> entry : detailMap.entrySet()) {
+                if (entry.getKey() != null && entry.getValue() != null) {
+                    params.put(entry.getKey().toString(), entry.getValue().toString());
+                }
+            }
+        }
+        return params;
+    }
+
+    @SuppressWarnings("unchecked")
+    public Map<String, Long> getNicNetworkList() {
+        Map<String, Long> nicNetworkMap = new HashMap<>();
+        if (MapUtils.isNotEmpty(nicNetworkList)) {
+            for (Map<String, String> entry : (Collection<Map<String, String>>) nicNetworkList.values()) {
+                String nic = entry.get(VmDetailConstants.NIC);
+                String networkUuid = entry.get(VmDetailConstants.NETWORK);
+                if (StringUtils.isAnyEmpty(nic, networkUuid) || _entityMgr.findByUuid(Network.class, networkUuid) == null) {
+                    throw new InvalidParameterValueException(String.format("Network ID: %s for NIC ID: %s is invalid", networkUuid, nic));
+                }
+                nicNetworkMap.put(nic, _entityMgr.findByUuid(Network.class, networkUuid).getId());
+            }
+        }
+        return nicNetworkMap;
+    }
+
+    @SuppressWarnings("unchecked")
+    public Map<String, Network.IpAddresses> getNicIpAddressList() {
+        Map<String, Network.IpAddresses> nicIpAddressMap = new HashMap<>();
+        if (MapUtils.isNotEmpty(nicIpAddressList)) {
+            for (Map<String, String> entry : (Collection<Map<String, String>>) nicIpAddressList.values()) {
+                String nic = entry.get(VmDetailConstants.NIC);
+                String ipAddress = StringUtils.defaultIfEmpty(entry.get(VmDetailConstants.IP4_ADDRESS), null);
+                if (StringUtils.isEmpty(nic)) {
+                    throw new InvalidParameterValueException(String.format("NIC ID: '%s' is invalid for IP address mapping", nic));
+                }
+                if (StringUtils.isEmpty(ipAddress)) {
+                    throw new InvalidParameterValueException(String.format("Empty address for NIC ID: %s is invalid", nic));
+                }
+                if (StringUtils.isNotEmpty(ipAddress) && !ipAddress.equals("auto") && !NetUtils.isValidIp4(ipAddress)) {
+                    throw new InvalidParameterValueException(String.format("IP address '%s' for NIC ID: %s is invalid", ipAddress, nic));
+                }
+                nicIpAddressMap.put(nic, new Network.IpAddresses(ipAddress, null));
+            }
+        }
+        return nicIpAddressMap;
+    }
+
+    @SuppressWarnings("unchecked")
+    public Map<String, Long> getDataDiskToDiskOfferingList() {
+        Map<String, Long> dataDiskToDiskOfferingMap = new HashMap<>();
+        if (MapUtils.isNotEmpty(dataDiskToDiskOfferingList)) {
+            for (Map<String, String> entry : (Collection<Map<String, String>>) dataDiskToDiskOfferingList.values()) {
+                String disk = entry.get(VmDetailConstants.DISK);
+                String offeringUuid = entry.get(VmDetailConstants.DISK_OFFERING);
+                if (StringUtils.isAnyEmpty(disk, offeringUuid) || _entityMgr.findByUuid(DiskOffering.class, offeringUuid) == null) {
+                    throw new InvalidParameterValueException(String.format("Disk offering ID: %s for disk ID: %s is invalid", offeringUuid, disk));
+                }
+                dataDiskToDiskOfferingMap.put(disk, _entityMgr.findByUuid(DiskOffering.class, offeringUuid).getId());
+            }
+        }
+        return dataDiskToDiskOfferingMap;
+    }
+
+    public boolean isForced() {
+        return BooleanUtils.isTrue(forced);
+    }
+
+    @Override
+    public String getEventType() {
+        return EventTypes.EVENT_VMWARE_CBT_MIGRATION_START;
+    }
+
+    @Override
+    public String getEventDescription() {
+        return String.format("Starting VMware CBT migration for source VM: %s", sourceVmName);
+    }
+
+    @Override
+    public void execute() throws ResourceUnavailableException, InsufficientCapacityException, ServerApiException,
+            ConcurrentOperationException, ResourceAllocationException, NetworkRuleConflictException {
+        VmwareCbtMigrationResponse response = vmwareCbtMigrationManager.startVmwareCbtMigration(this);
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
+        if (accountId != null) {
+            return accountId;
+        }
+        Account account = CallContext.current().getCallingAccount();
+        return account == null ? Account.ACCOUNT_ID_SYSTEM : account.getId();
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/SyncVmwareCbtMigrationCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/SyncVmwareCbtMigrationCmd.java
new file mode 100644
index 000000000000..7589360564a5
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/SyncVmwareCbtMigrationCmd.java
@@ -0,0 +1,110 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.admin.vm;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseAsyncCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ResponseObject;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.VmwareCbtMigrationResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.vm.VmwareCbtMigrationManager;
+
+import com.cloud.event.EventTypes;
+import com.cloud.exception.ConcurrentOperationException;
+import com.cloud.exception.InsufficientCapacityException;
+import com.cloud.exception.NetworkRuleConflictException;
+import com.cloud.exception.ResourceAllocationException;
+import com.cloud.exception.ResourceUnavailableException;
+import com.cloud.user.Account;
+
+@APICommand(name = "syncVmwareCbtMigration",
+        description = "Run a VMware CBT delta synchronization cycle",
+        responseObject = VmwareCbtMigrationResponse.class,
+        responseView = ResponseObject.ResponseView.Full,
+        requestHasSensitiveInfo = true,
+        responseHasSensitiveInfo = false,
+        authorized = {RoleType.Admin},
+        since = "4.24.0")
+public class SyncVmwareCbtMigrationCmd extends BaseAsyncCmd {
+
+    @Inject
+    public VmwareCbtMigrationManager vmwareCbtMigrationManager;
+
+    @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = VmwareCbtMigrationResponse.class,
+            required = true, description = "the VMware CBT migration ID")
+    private Long id;
+
+    @Parameter(name = ApiConstants.USERNAME, type = CommandType.STRING,
+            description = "optional username override for the source vCenter. Stored external vCenter credentials are used when available")
+    private String username;
+
+    @Parameter(name = ApiConstants.PASSWORD, type = CommandType.STRING,
+            description = "optional password override for the source vCenter. Stored external vCenter credentials are used when available")
+    private String password;
+
+    public Long getId() {
+        return id;
+    }
+
+    public String getUsername() {
+        return username;
+    }
+
+    public String getPassword() {
+        return password;
+    }
+
+    @Override
+    public String getEventType() {
+        return EventTypes.EVENT_VMWARE_CBT_MIGRATION_SYNC;
+    }
+
+    @Override
+    public String getEventDescription() {
+        return String.format("Synchronizing VMware CBT migration: %s", id);
+    }
+
+    @Override
+    public String getSyncObjType() {
+        return BaseAsyncCmd.migrationSyncObject;
+    }
+
+    @Override
+    public Long getSyncObjId() {
+        return id;
+    }
+
+    @Override
+    public void execute() throws ResourceUnavailableException, InsufficientCapacityException, ServerApiException,
+            ConcurrentOperationException, ResourceAllocationException, NetworkRuleConflictException {
+        VmwareCbtMigrationResponse response = vmwareCbtMigrationManager.syncVmwareCbtMigration(this);
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        Account account = CallContext.current().getCallingAccount();
+        return account == null ? Account.ACCOUNT_ID_SYSTEM : account.getId();
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationCycleResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationCycleResponse.java
new file mode 100644
index 000000000000..2ceab991b179
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationCycleResponse.java
@@ -0,0 +1,111 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.response;
+
+import java.util.Date;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseResponse;
+import org.apache.cloudstack.api.EntityReference;
+import org.apache.cloudstack.vm.VmwareCbtMigrationCycle;
+
+import com.cloud.serializer.Param;
+import com.google.gson.annotations.SerializedName;
+
+@EntityReference(value = VmwareCbtMigrationCycle.class)
+public class VmwareCbtMigrationCycleResponse extends BaseResponse {
+
+    @SerializedName(ApiConstants.ID)
+    @Param(description = "the ID of the VMware CBT migration cycle")
+    private String id;
+
+    @SerializedName(ApiConstants.CYCLE_NUMBER)
+    @Param(description = "the CBT delta synchronization cycle number")
+    private int cycleNumber;
+
+    @SerializedName(ApiConstants.SNAPSHOT_MOR)
+    @Param(description = "the VMware snapshot managed object reference used for this cycle")
+    private String snapshotMor;
+
+    @SerializedName(ApiConstants.CHANGED_BYTES)
+    @Param(description = "the changed bytes copied in this cycle")
+    private Long changedBytes;
+
+    @SerializedName(ApiConstants.DIRTY_RATE)
+    @Param(description = "the dirty rate in bytes per second observed in this cycle")
+    private Long dirtyRate;
+
+    @SerializedName(ApiConstants.DURATION)
+    @Param(description = "the cycle duration in milliseconds")
+    private Long duration;
+
+    @SerializedName(ApiConstants.STATE)
+    @Param(description = "the cycle state")
+    private String state;
+
+    @SerializedName(ApiConstants.DESCRIPTION)
+    @Param(description = "the cycle status or failure description")
+    private String description;
+
+    @SerializedName(ApiConstants.CREATED)
+    @Param(description = "the create date of the VMware CBT migration cycle")
+    private Date created;
+
+    @SerializedName(ApiConstants.LAST_UPDATED)
+    @Param(description = "the last updated date of the VMware CBT migration cycle")
+    private Date lastUpdated;
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public void setCycleNumber(int cycleNumber) {
+        this.cycleNumber = cycleNumber;
+    }
+
+    public void setSnapshotMor(String snapshotMor) {
+        this.snapshotMor = snapshotMor;
+    }
+
+    public void setChangedBytes(Long changedBytes) {
+        this.changedBytes = changedBytes;
+    }
+
+    public void setDirtyRate(Long dirtyRate) {
+        this.dirtyRate = dirtyRate;
+    }
+
+    public void setDuration(Long duration) {
+        this.duration = duration;
+    }
+
+    public void setState(String state) {
+        this.state = state;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public void setCreated(Date created) {
+        this.created = created;
+    }
+
+    public void setLastUpdated(Date lastUpdated) {
+        this.lastUpdated = lastUpdated;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationDiskResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationDiskResponse.java
new file mode 100644
index 000000000000..9a23cf44cad1
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationDiskResponse.java
@@ -0,0 +1,117 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.response;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseResponse;
+import org.apache.cloudstack.api.EntityReference;
+import org.apache.cloudstack.vm.VmwareCbtMigrationDisk;
+
+import com.cloud.serializer.Param;
+import com.google.gson.annotations.SerializedName;
+
+@EntityReference(value = VmwareCbtMigrationDisk.class)
+public class VmwareCbtMigrationDiskResponse extends BaseResponse {
+
+    @SerializedName(ApiConstants.ID)
+    @Param(description = "the ID of the VMware CBT migration disk")
+    private String id;
+
+    @SerializedName(ApiConstants.SOURCE_DISK_ID)
+    @Param(description = "the source VMware disk identifier")
+    private String sourceDiskId;
+
+    @SerializedName(ApiConstants.SOURCE_DISK_DEVICE_KEY)
+    @Param(description = "the source VMware disk device key")
+    private Integer sourceDiskDeviceKey;
+
+    @SerializedName(ApiConstants.SOURCE_DISK_PATH)
+    @Param(description = "the source VMware disk path")
+    private String sourceDiskPath;
+
+    @SerializedName(ApiConstants.DATASTORE_NAME)
+    @Param(description = "the source VMware datastore name")
+    private String datastoreName;
+
+    @SerializedName(ApiConstants.CAPACITY)
+    @Param(description = "the source disk capacity in bytes")
+    private Long capacityBytes;
+
+    @SerializedName(ApiConstants.TARGET_PATH)
+    @Param(description = "the planned or actual KVM target disk path")
+    private String targetPath;
+
+    @SerializedName(ApiConstants.TARGET_FORMAT)
+    @Param(description = "the KVM target disk format")
+    private String targetFormat;
+
+    @SerializedName(ApiConstants.CHANGE_ID)
+    @Param(description = "the VMware CBT change ID used for the next delta query")
+    private String changeId;
+
+    @SerializedName(ApiConstants.SNAPSHOT_MOR)
+    @Param(description = "the VMware snapshot managed object reference currently associated with this disk")
+    private String snapshotMor;
+
+    @SerializedName(ApiConstants.STATE)
+    @Param(description = "the disk replication state")
+    private String state;
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public void setSourceDiskId(String sourceDiskId) {
+        this.sourceDiskId = sourceDiskId;
+    }
+
+    public void setSourceDiskDeviceKey(Integer sourceDiskDeviceKey) {
+        this.sourceDiskDeviceKey = sourceDiskDeviceKey;
+    }
+
+    public void setSourceDiskPath(String sourceDiskPath) {
+        this.sourceDiskPath = sourceDiskPath;
+    }
+
+    public void setDatastoreName(String datastoreName) {
+        this.datastoreName = datastoreName;
+    }
+
+    public void setCapacityBytes(Long capacityBytes) {
+        this.capacityBytes = capacityBytes;
+    }
+
+    public void setTargetPath(String targetPath) {
+        this.targetPath = targetPath;
+    }
+
+    public void setTargetFormat(String targetFormat) {
+        this.targetFormat = targetFormat;
+    }
+
+    public void setChangeId(String changeId) {
+        this.changeId = changeId;
+    }
+
+    public void setSnapshotMor(String snapshotMor) {
+        this.snapshotMor = snapshotMor;
+    }
+
+    public void setState(String state) {
+        this.state = state;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationPreflightDiskResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationPreflightDiskResponse.java
new file mode 100644
index 000000000000..e637619a9a8d
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationPreflightDiskResponse.java
@@ -0,0 +1,114 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.response;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseResponse;
+
+import com.cloud.serializer.Param;
+import com.google.gson.annotations.SerializedName;
+
+public class VmwareCbtMigrationPreflightDiskResponse extends BaseResponse {
+
+    @SerializedName(ApiConstants.SOURCE_DISK_ID)
+    @Param(description = "the source VMware disk identifier")
+    private String sourceDiskId;
+
+    @SerializedName(ApiConstants.SOURCE_DISK_DEVICE_KEY)
+    @Param(description = "the source VMware disk device key")
+    private Integer sourceDiskDeviceKey;
+
+    @SerializedName(ApiConstants.SOURCE_DISK_PATH)
+    @Param(description = "the source VMware disk path")
+    private String sourceDiskPath;
+
+    @SerializedName(ApiConstants.DATASTORE_NAME)
+    @Param(description = "the source VMware datastore name")
+    private String datastoreName;
+
+    @SerializedName(ApiConstants.CAPACITY)
+    @Param(description = "the source disk capacity in bytes")
+    private Long capacityBytes;
+
+    @SerializedName("backingtype")
+    @Param(description = "the VMware disk backing class")
+    private String backingType;
+
+    @SerializedName("diskmode")
+    @Param(description = "the VMware disk mode")
+    private String diskMode;
+
+    @SerializedName("rdmcompatibilitymode")
+    @Param(description = "the RDM compatibility mode, when the disk is an RDM")
+    private String rdmCompatibilityMode;
+
+    @SerializedName("independentdisk")
+    @Param(description = "whether the VMware disk is configured as independent")
+    private boolean independentDisk;
+
+    @SerializedName("physicalrdm")
+    @Param(description = "whether the VMware disk is a physical-mode RDM")
+    private boolean physicalRdm;
+
+    @SerializedName("changeidpresent")
+    @Param(description = "whether a VMware CBT change ID is currently visible for this disk")
+    private boolean changeIdPresent;
+
+    public void setSourceDiskId(String sourceDiskId) {
+        this.sourceDiskId = sourceDiskId;
+    }
+
+    public void setSourceDiskDeviceKey(Integer sourceDiskDeviceKey) {
+        this.sourceDiskDeviceKey = sourceDiskDeviceKey;
+    }
+
+    public void setSourceDiskPath(String sourceDiskPath) {
+        this.sourceDiskPath = sourceDiskPath;
+    }
+
+    public void setDatastoreName(String datastoreName) {
+        this.datastoreName = datastoreName;
+    }
+
+    public void setCapacityBytes(Long capacityBytes) {
+        this.capacityBytes = capacityBytes;
+    }
+
+    public void setBackingType(String backingType) {
+        this.backingType = backingType;
+    }
+
+    public void setDiskMode(String diskMode) {
+        this.diskMode = diskMode;
+    }
+
+    public void setRdmCompatibilityMode(String rdmCompatibilityMode) {
+        this.rdmCompatibilityMode = rdmCompatibilityMode;
+    }
+
+    public void setIndependentDisk(boolean independentDisk) {
+        this.independentDisk = independentDisk;
+    }
+
+    public void setPhysicalRdm(boolean physicalRdm) {
+        this.physicalRdm = physicalRdm;
+    }
+
+    public void setChangeIdPresent(boolean changeIdPresent) {
+        this.changeIdPresent = changeIdPresent;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationPreflightFindingResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationPreflightFindingResponse.java
new file mode 100644
index 000000000000..a4cccd06fa69
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationPreflightFindingResponse.java
@@ -0,0 +1,55 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.response;
+
+import org.apache.cloudstack.api.BaseResponse;
+
+import com.cloud.serializer.Param;
+import com.google.gson.annotations.SerializedName;
+
+public class VmwareCbtMigrationPreflightFindingResponse extends BaseResponse {
+
+    @SerializedName("severity")
+    @Param(description = "finding severity: PASS, WARN or FAIL")
+    private String severity;
+
+    @SerializedName("code")
+    @Param(description = "technical preflight finding code")
+    private String code;
+
+    @SerializedName("component")
+    @Param(description = "component checked by the preflight finding")
+    private String component;
+
+    @SerializedName("resource")
+    @Param(description = "resource checked by the preflight finding")
+    private String resource;
+
+    @SerializedName("message")
+    @Param(description = "human-readable preflight finding message")
+    private String message;
+
+    public VmwareCbtMigrationPreflightFindingResponse(String severity, String code, String component,
+                                                     String resource, String message) {
+        this.severity = severity;
+        this.code = code;
+        this.component = component;
+        this.resource = resource;
+        this.message = message;
+        setObjectName("finding");
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationPreflightResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationPreflightResponse.java
new file mode 100644
index 000000000000..ec151189ee3a
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationPreflightResponse.java
@@ -0,0 +1,284 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.response;
+
+import java.util.List;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseResponse;
+
+import com.cloud.serializer.Param;
+import com.google.gson.annotations.SerializedName;
+
+public class VmwareCbtMigrationPreflightResponse extends BaseResponse {
+
+    @SerializedName("ready")
+    @Param(description = "whether the source VM and destination are ready for VMware CBT migration start")
+    private boolean ready;
+
+    @SerializedName(ApiConstants.ZONE_ID)
+    @Param(description = "the destination zone ID")
+    private String zoneId;
+
+    @SerializedName(ApiConstants.ZONE_NAME)
+    @Param(description = "the destination zone name")
+    private String zoneName;
+
+    @SerializedName(ApiConstants.CLUSTER_ID)
+    @Param(description = "the destination KVM cluster ID")
+    private String clusterId;
+
+    @SerializedName(ApiConstants.CLUSTER_NAME)
+    @Param(description = "the destination KVM cluster name")
+    private String clusterName;
+
+    @SerializedName(ApiConstants.CONVERT_INSTANCE_HOST_ID)
+    @Param(description = "the KVM host selected for conversion and CBT replication")
+    private String convertInstanceHostId;
+
+    @SerializedName("convertinstancehostname")
+    @Param(description = "the KVM host selected for conversion and CBT replication")
+    private String convertInstanceHostName;
+
+    @SerializedName(ApiConstants.CONVERT_INSTANCE_STORAGE_POOL_ID)
+    @Param(description = "the destination storage pool ID")
+    private String storagePoolId;
+
+    @SerializedName(ApiConstants.POOL_NAME)
+    @Param(description = "the destination storage pool name")
+    private String storagePoolName;
+
+    @SerializedName("storagepooltype")
+    @Param(description = "the destination storage pool type")
+    private String storagePoolType;
+
+    @SerializedName("storagewritertype")
+    @Param(description = "the VMware CBT target storage writer type")
+    private String storageWriterType;
+
+    @SerializedName("storagewritersupported")
+    @Param(description = "whether the target storage writer is implemented")
+    private boolean storageWriterSupported;
+
+    @SerializedName("storagerequiresinplacefinalization")
+    @Param(description = "whether the target storage writer requires virt-v2v in-place finalization")
+    private boolean storageRequiresInPlaceFinalization;
+
+    @SerializedName("convertinstancehostinplacefinalizationsupported")
+    @Param(description = "whether the selected KVM host reports VMware CBT in-place finalization support")
+    private boolean convertInstanceHostInPlaceFinalizationSupported;
+
+    @SerializedName("noninplacefinalizationfallbackallowed")
+    @Param(description = "whether VMware CBT non-in-place fallback finalization is enabled by configuration")
+    private boolean nonInPlaceFinalizationFallbackAllowed;
+
+    @SerializedName("noninplacefinalizationfallbacksupported")
+    @Param(description = "whether the selected target storage can use non-in-place fallback finalization")
+    private boolean nonInPlaceFinalizationFallbackSupported;
+
+    @SerializedName(ApiConstants.VCENTER)
+    @Param(description = "the source VMware vCenter")
+    private String vcenter;
+
+    @SerializedName(ApiConstants.DATACENTER_NAME)
+    @Param(description = "the source VMware datacenter")
+    private String datacenterName;
+
+    @SerializedName(ApiConstants.SOURCE_HOST)
+    @Param(description = "the source VMware ESXi host")
+    private String sourceHost;
+
+    @SerializedName(ApiConstants.SOURCE_VM_NAME)
+    @Param(description = "the source VMware VM name")
+    private String sourceVmName;
+
+    @SerializedName("sourcevmmor")
+    @Param(description = "the source VMware VM managed object reference")
+    private String sourceVmMor;
+
+    @SerializedName("changetrackingsupported")
+    @Param(description = "whether the source VM reports CBT support")
+    private Boolean changeTrackingSupported;
+
+    @SerializedName("changetrackingenabled")
+    @Param(description = "whether CBT is currently enabled on the source VM")
+    private Boolean changeTrackingEnabled;
+
+    @SerializedName("consolidationneeded")
+    @Param(description = "whether the source VM reports disk consolidation is needed")
+    private Boolean consolidationNeeded;
+
+    @SerializedName("existingsnapshotcount")
+    @Param(description = "number of existing VMware snapshots on the source VM")
+    private Integer existingSnapshotCount;
+
+    @SerializedName("sourcecpunumber")
+    @Param(description = "source VMware VM CPU count")
+    private Integer sourceCpuNumber;
+
+    @SerializedName("sourcecpuspeed")
+    @Param(description = "source VMware VM CPU reservation in MHz used for offering validation, when available")
+    private Integer sourceCpuSpeed;
+
+    @SerializedName("sourcememory")
+    @Param(description = "source VMware VM memory in MB")
+    private Integer sourceMemory;
+
+    @SerializedName("sourceguestosid")
+    @Param(description = "source VMware VM guest OS identifier")
+    private String sourceGuestOsId;
+
+    @SerializedName("sourceguestos")
+    @Param(description = "source VMware VM guest OS name")
+    private String sourceGuestOs;
+
+    @SerializedName(ApiConstants.DISK)
+    @Param(description = "source VMware disk preflight information")
+    private List<VmwareCbtMigrationPreflightDiskResponse> disks;
+
+    @SerializedName("finding")
+    @Param(description = "preflight findings")
+    private List<VmwareCbtMigrationPreflightFindingResponse> findings;
+
+    public void setReady(boolean ready) {
+        this.ready = ready;
+    }
+
+    public void setZoneId(String zoneId) {
+        this.zoneId = zoneId;
+    }
+
+    public void setZoneName(String zoneName) {
+        this.zoneName = zoneName;
+    }
+
+    public void setClusterId(String clusterId) {
+        this.clusterId = clusterId;
+    }
+
+    public void setClusterName(String clusterName) {
+        this.clusterName = clusterName;
+    }
+
+    public void setConvertInstanceHostId(String convertInstanceHostId) {
+        this.convertInstanceHostId = convertInstanceHostId;
+    }
+
+    public void setConvertInstanceHostName(String convertInstanceHostName) {
+        this.convertInstanceHostName = convertInstanceHostName;
+    }
+
+    public void setStoragePoolId(String storagePoolId) {
+        this.storagePoolId = storagePoolId;
+    }
+
+    public void setStoragePoolName(String storagePoolName) {
+        this.storagePoolName = storagePoolName;
+    }
+
+    public void setStoragePoolType(String storagePoolType) {
+        this.storagePoolType = storagePoolType;
+    }
+
+    public void setStorageWriterType(String storageWriterType) {
+        this.storageWriterType = storageWriterType;
+    }
+
+    public void setStorageWriterSupported(boolean storageWriterSupported) {
+        this.storageWriterSupported = storageWriterSupported;
+    }
+
+    public void setStorageRequiresInPlaceFinalization(boolean storageRequiresInPlaceFinalization) {
+        this.storageRequiresInPlaceFinalization = storageRequiresInPlaceFinalization;
+    }
+
+    public void setConvertInstanceHostInPlaceFinalizationSupported(boolean convertInstanceHostInPlaceFinalizationSupported) {
+        this.convertInstanceHostInPlaceFinalizationSupported = convertInstanceHostInPlaceFinalizationSupported;
+    }
+
+    public void setNonInPlaceFinalizationFallbackAllowed(boolean nonInPlaceFinalizationFallbackAllowed) {
+        this.nonInPlaceFinalizationFallbackAllowed = nonInPlaceFinalizationFallbackAllowed;
+    }
+
+    public void setNonInPlaceFinalizationFallbackSupported(boolean nonInPlaceFinalizationFallbackSupported) {
+        this.nonInPlaceFinalizationFallbackSupported = nonInPlaceFinalizationFallbackSupported;
+    }
+
+    public void setVcenter(String vcenter) {
+        this.vcenter = vcenter;
+    }
+
+    public void setDatacenterName(String datacenterName) {
+        this.datacenterName = datacenterName;
+    }
+
+    public void setSourceHost(String sourceHost) {
+        this.sourceHost = sourceHost;
+    }
+
+    public void setSourceVmName(String sourceVmName) {
+        this.sourceVmName = sourceVmName;
+    }
+
+    public void setSourceVmMor(String sourceVmMor) {
+        this.sourceVmMor = sourceVmMor;
+    }
+
+    public void setChangeTrackingSupported(Boolean changeTrackingSupported) {
+        this.changeTrackingSupported = changeTrackingSupported;
+    }
+
+    public void setChangeTrackingEnabled(Boolean changeTrackingEnabled) {
+        this.changeTrackingEnabled = changeTrackingEnabled;
+    }
+
+    public void setConsolidationNeeded(Boolean consolidationNeeded) {
+        this.consolidationNeeded = consolidationNeeded;
+    }
+
+    public void setExistingSnapshotCount(Integer existingSnapshotCount) {
+        this.existingSnapshotCount = existingSnapshotCount;
+    }
+
+    public void setSourceCpuNumber(Integer sourceCpuNumber) {
+        this.sourceCpuNumber = sourceCpuNumber;
+    }
+
+    public void setSourceCpuSpeed(Integer sourceCpuSpeed) {
+        this.sourceCpuSpeed = sourceCpuSpeed;
+    }
+
+    public void setSourceMemory(Integer sourceMemory) {
+        this.sourceMemory = sourceMemory;
+    }
+
+    public void setSourceGuestOsId(String sourceGuestOsId) {
+        this.sourceGuestOsId = sourceGuestOsId;
+    }
+
+    public void setSourceGuestOs(String sourceGuestOs) {
+        this.sourceGuestOs = sourceGuestOs;
+    }
+
+    public void setDisks(List<VmwareCbtMigrationPreflightDiskResponse> disks) {
+        this.disks = disks;
+    }
+
+    public void setFindings(List<VmwareCbtMigrationPreflightFindingResponse> findings) {
+        this.findings = findings;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationResponse.java
new file mode 100644
index 000000000000..37ee6906f9f3
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/response/VmwareCbtMigrationResponse.java
@@ -0,0 +1,288 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.response;
+
+import java.util.Date;
+import java.util.List;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseResponse;
+import org.apache.cloudstack.api.EntityReference;
+import org.apache.cloudstack.vm.VmwareCbtMigration;
+
+import com.cloud.serializer.Param;
+import com.google.gson.annotations.SerializedName;
+
+@EntityReference(value = VmwareCbtMigration.class)
+public class VmwareCbtMigrationResponse extends BaseResponse {
+
+    @SerializedName(ApiConstants.ID)
+    @Param(description = "the ID of the VMware CBT migration")
+    private String id;
+
+    @SerializedName(ApiConstants.ZONE_ID)
+    @Param(description = "the destination zone ID")
+    private String zoneId;
+
+    @SerializedName(ApiConstants.ZONE_NAME)
+    @Param(description = "the destination zone name")
+    private String zoneName;
+
+    @SerializedName(ApiConstants.ACCOUNT)
+    @Param(description = "the account name")
+    private String accountName;
+
+    @SerializedName(ApiConstants.ACCOUNT_ID)
+    @Param(description = "the account ID")
+    private String accountId;
+
+    @SerializedName(ApiConstants.VIRTUAL_MACHINE_ID)
+    @Param(description = "the ID of the imported VM after cutover")
+    private String virtualMachineId;
+
+    @SerializedName(ApiConstants.CLUSTER_ID)
+    @Param(description = "the destination KVM cluster ID")
+    private String clusterId;
+
+    @SerializedName(ApiConstants.CLUSTER_NAME)
+    @Param(description = "the destination KVM cluster name")
+    private String clusterName;
+
+    @SerializedName(ApiConstants.CONVERT_INSTANCE_HOST_ID)
+    @Param(description = "the KVM host selected for conversion and CBT replication")
+    private String convertInstanceHostId;
+
+    @SerializedName("convertinstancehostname")
+    @Param(description = "the KVM host name selected for conversion and CBT replication")
+    private String convertInstanceHostName;
+
+    @SerializedName(ApiConstants.CONVERT_INSTANCE_STORAGE_POOL_ID)
+    @Param(description = "the storage pool selected for converted disks")
+    private String storagePoolId;
+
+    @SerializedName(ApiConstants.POOL_NAME)
+    @Param(description = "the storage pool name selected for converted disks")
+    private String storagePoolName;
+
+    @SerializedName(ApiConstants.DISPLAY_NAME)
+    @Param(description = "the display name of the target VM")
+    private String displayName;
+
+    @SerializedName(ApiConstants.VCENTER)
+    @Param(description = "the source VMware vCenter")
+    private String vcenter;
+
+    @SerializedName(ApiConstants.EXISTING_VCENTER_ID)
+    @Param(description = "the linked existing vCenter ID, when used")
+    private String existingVcenterId;
+
+    @SerializedName(ApiConstants.DATACENTER_NAME)
+    @Param(description = "the source VMware datacenter")
+    private String datacenterName;
+
+    @SerializedName(ApiConstants.SOURCE_HOST)
+    @Param(description = "the source VMware ESXi host")
+    private String sourceHost;
+
+    @SerializedName(ApiConstants.SOURCE_CLUSTER)
+    @Param(description = "the source VMware cluster")
+    private String sourceCluster;
+
+    @SerializedName(ApiConstants.SOURCE_VM_NAME)
+    @Param(description = "the source VMware VM name")
+    private String sourceVmName;
+
+    @SerializedName(ApiConstants.STATE)
+    @Param(description = "the migration state")
+    private String state;
+
+    @SerializedName(ApiConstants.CURRENT_STEP)
+    @Param(description = "the current migration step")
+    private String currentStep;
+
+    @SerializedName("currentstepduration")
+    @Param(description = "the elapsed time spent in the current migration step")
+    private String currentStepDuration;
+
+    @SerializedName(ApiConstants.LAST_ERROR)
+    @Param(description = "the last migration error")
+    private String lastError;
+
+    @SerializedName(ApiConstants.COMPLETED_CYCLES)
+    @Param(description = "the number of completed CBT delta cycles")
+    private int completedCycles;
+
+    @SerializedName(ApiConstants.QUIET_CYCLES)
+    @Param(description = "the number of consecutive quiet CBT delta cycles")
+    private int quietCycles;
+
+    @SerializedName(ApiConstants.TOTAL_CHANGED_BYTES)
+    @Param(description = "the total changed bytes synchronized across CBT delta cycles")
+    private long totalChangedBytes;
+
+    @SerializedName(ApiConstants.LAST_CHANGED_BYTES)
+    @Param(description = "the changed bytes observed in the last CBT delta cycle")
+    private Long lastChangedBytes;
+
+    @SerializedName(ApiConstants.LAST_DIRTY_RATE)
+    @Param(description = "the dirty rate in bytes per second observed in the last CBT delta cycle")
+    private Long lastDirtyRate;
+
+    @SerializedName(ApiConstants.DISK)
+    @Param(description = "the source and target disks tracked by this VMware CBT migration")
+    private List<VmwareCbtMigrationDiskResponse> disks;
+
+    @SerializedName(ApiConstants.CYCLE)
+    @Param(description = "the CBT delta synchronization cycles tracked by this VMware CBT migration")
+    private List<VmwareCbtMigrationCycleResponse> cycles;
+
+    @SerializedName(ApiConstants.CREATED)
+    @Param(description = "the create date of the VMware CBT migration")
+    private Date created;
+
+    @SerializedName(ApiConstants.LAST_UPDATED)
+    @Param(description = "the last updated date of the VMware CBT migration")
+    private Date lastUpdated;
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public void setZoneId(String zoneId) {
+        this.zoneId = zoneId;
+    }
+
+    public void setZoneName(String zoneName) {
+        this.zoneName = zoneName;
+    }
+
+    public void setAccountName(String accountName) {
+        this.accountName = accountName;
+    }
+
+    public void setAccountId(String accountId) {
+        this.accountId = accountId;
+    }
+
+    public void setVirtualMachineId(String virtualMachineId) {
+        this.virtualMachineId = virtualMachineId;
+    }
+
+    public void setClusterId(String clusterId) {
+        this.clusterId = clusterId;
+    }
+
+    public void setClusterName(String clusterName) {
+        this.clusterName = clusterName;
+    }
+
+    public void setConvertInstanceHostId(String convertInstanceHostId) {
+        this.convertInstanceHostId = convertInstanceHostId;
+    }
+
+    public void setConvertInstanceHostName(String convertInstanceHostName) {
+        this.convertInstanceHostName = convertInstanceHostName;
+    }
+
+    public void setStoragePoolId(String storagePoolId) {
+        this.storagePoolId = storagePoolId;
+    }
+
+    public void setStoragePoolName(String storagePoolName) {
+        this.storagePoolName = storagePoolName;
+    }
+
+    public void setDisplayName(String displayName) {
+        this.displayName = displayName;
+    }
+
+    public void setVcenter(String vcenter) {
+        this.vcenter = vcenter;
+    }
+
+    public void setExistingVcenterId(String existingVcenterId) {
+        this.existingVcenterId = existingVcenterId;
+    }
+
+    public void setDatacenterName(String datacenterName) {
+        this.datacenterName = datacenterName;
+    }
+
+    public void setSourceHost(String sourceHost) {
+        this.sourceHost = sourceHost;
+    }
+
+    public void setSourceCluster(String sourceCluster) {
+        this.sourceCluster = sourceCluster;
+    }
+
+    public void setSourceVmName(String sourceVmName) {
+        this.sourceVmName = sourceVmName;
+    }
+
+    public void setState(String state) {
+        this.state = state;
+    }
+
+    public void setCurrentStep(String currentStep) {
+        this.currentStep = currentStep;
+    }
+
+    public void setCurrentStepDuration(String currentStepDuration) {
+        this.currentStepDuration = currentStepDuration;
+    }
+
+    public void setLastError(String lastError) {
+        this.lastError = lastError;
+    }
+
+    public void setCompletedCycles(int completedCycles) {
+        this.completedCycles = completedCycles;
+    }
+
+    public void setQuietCycles(int quietCycles) {
+        this.quietCycles = quietCycles;
+    }
+
+    public void setTotalChangedBytes(long totalChangedBytes) {
+        this.totalChangedBytes = totalChangedBytes;
+    }
+
+    public void setLastChangedBytes(Long lastChangedBytes) {
+        this.lastChangedBytes = lastChangedBytes;
+    }
+
+    public void setLastDirtyRate(Long lastDirtyRate) {
+        this.lastDirtyRate = lastDirtyRate;
+    }
+
+    public void setDisks(List<VmwareCbtMigrationDiskResponse> disks) {
+        this.disks = disks;
+    }
+
+    public void setCycles(List<VmwareCbtMigrationCycleResponse> cycles) {
+        this.cycles = cycles;
+    }
+
+    public void setCreated(Date created) {
+        this.created = created;
+    }
+
+    public void setLastUpdated(Date lastUpdated) {
+        this.lastUpdated = lastUpdated;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/storage/volume/VolumeImportUnmanageService.java b/api/src/main/java/org/apache/cloudstack/storage/volume/VolumeImportUnmanageService.java
index 13f01b4944ad..709ad691971a 100644
--- a/api/src/main/java/org/apache/cloudstack/storage/volume/VolumeImportUnmanageService.java
+++ b/api/src/main/java/org/apache/cloudstack/storage/volume/VolumeImportUnmanageService.java
@@ -37,7 +37,8 @@ public interface VolumeImportUnmanageService extends PluggableService, Configura
             Arrays.asList(Hypervisor.HypervisorType.KVM, Hypervisor.HypervisorType.VMware);
 
     List<Storage.StoragePoolType> SUPPORTED_STORAGE_POOL_TYPES_FOR_KVM = Arrays.asList(Storage.StoragePoolType.NetworkFilesystem,
-            Storage.StoragePoolType.Filesystem, Storage.StoragePoolType.RBD, Storage.StoragePoolType.SharedMountPoint);
+            Storage.StoragePoolType.Filesystem, Storage.StoragePoolType.RBD, Storage.StoragePoolType.SharedMountPoint,
+            Storage.StoragePoolType.Linstor);
 
     ConfigKey<Boolean> AllowImportVolumeWithBackingFile = new ConfigKey<>(Boolean.class,
             "allow.import.volume.with.backing.file",
diff --git a/api/src/main/java/org/apache/cloudstack/vm/UnmanagedInstanceTO.java b/api/src/main/java/org/apache/cloudstack/vm/UnmanagedInstanceTO.java
index cbb7c4de698a..63ef8892d2c6 100644
--- a/api/src/main/java/org/apache/cloudstack/vm/UnmanagedInstanceTO.java
+++ b/api/src/main/java/org/apache/cloudstack/vm/UnmanagedInstanceTO.java
@@ -66,6 +66,7 @@ public enum PowerState {
 
     private String bootType;
     private String bootMode;
+    private String vmwareMoref;
 
     public String getName() {
         return name;
@@ -234,6 +235,14 @@ public void setBootMode(String bootMode) {
         this.bootMode = bootMode;
     }
 
+    public String getVmwareMoref() {
+        return vmwareMoref;
+    }
+
+    public void setVmwareMoref(String vmwareMoref) {
+        this.vmwareMoref = vmwareMoref;
+    }
+
     public static class Disk {
         private String diskId;
 
@@ -400,6 +409,16 @@ public static class Nic {
 
         private List<String> ipAddress;
 
+        // Guest network facts captured from VMware Tools while the source runs, used to preserve
+        // static configuration across the migration: IPv4 addresses in CIDR form, the default
+        // gateway serving this NIC's subnet, and the guest's DNS servers. Null when Tools is not
+        // running or the guest reports nothing for this NIC.
+        private List<String> ipv4Cidrs;
+
+        private String ipv4Gateway;
+
+        private List<String> dnsServers;
+
         private String pciSlot;
 
         public String getNicId() {
@@ -466,6 +485,30 @@ public void setIpAddress(List<String> ipAddress) {
             this.ipAddress = ipAddress;
         }
 
+        public List<String> getIpv4Cidrs() {
+            return ipv4Cidrs;
+        }
+
+        public void setIpv4Cidrs(List<String> ipv4Cidrs) {
+            this.ipv4Cidrs = ipv4Cidrs;
+        }
+
+        public String getIpv4Gateway() {
+            return ipv4Gateway;
+        }
+
+        public void setIpv4Gateway(String ipv4Gateway) {
+            this.ipv4Gateway = ipv4Gateway;
+        }
+
+        public List<String> getDnsServers() {
+            return dnsServers;
+        }
+
+        public void setDnsServers(List<String> dnsServers) {
+            this.dnsServers = dnsServers;
+        }
+
         public String getPciSlot() {
             return pciSlot;
         }
diff --git a/api/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManager.java b/api/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManager.java
index e1963313eb6f..ec7128caa7fc 100644
--- a/api/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManager.java
+++ b/api/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManager.java
@@ -17,10 +17,20 @@
 
 package org.apache.cloudstack.vm;
 
+import java.util.List;
+import java.util.Map;
+
+import com.cloud.dc.DataCenter;
 import com.cloud.hypervisor.Hypervisor;
+import com.cloud.network.Network;
+import com.cloud.org.Cluster;
+import com.cloud.user.Account;
 import com.cloud.utils.component.PluggableService;
+import com.cloud.uservm.UserVm;
+
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.framework.config.Configurable;
+
 import static com.cloud.hypervisor.Hypervisor.HypervisorType.KVM;
 import static com.cloud.hypervisor.Hypervisor.HypervisorType.VMware;
 
@@ -75,4 +85,44 @@ public interface UnmanagedVMsManager extends VmImportService, UnmanageVMService,
     static boolean isSupported(Hypervisor.HypervisorType hypervisorType) {
         return hypervisorType == VMware || hypervisorType == KVM;
     }
+
+    UserVm importConvertedVmwareCbtInstanceToKvm(String vcenter, String datacenterName, String username, String password,
+                                                 String clusterName, String sourceHostName, String sourceVMName,
+                                                 UnmanagedInstanceTO convertedInstance, DataCenter zone,
+                                                 Cluster destinationCluster, String displayName, String hostName,
+                                                 Account caller, Account owner, long userId, Long templateId,
+                                                 Long serviceOfferingId, Map<String, Long> dataDiskOfferingMap,
+                                                 Map<String, Long> nicNetworkMap,
+                                                 Map<String, Network.IpAddresses> nicIpAddressMap,
+                                                 Long guestOsId, Map<String, String> details, boolean forced,
+                                                 Long storagePoolId);
+
+    /**
+     * Maps a VMware guest identity (config.guestFullName / config.guestId, available regardless of
+     * the source VM's power state) to a CloudStack guest OS id, so an imported VM does not inherit
+     * the import dummy template's generic OS type. Returns null when no reasonable match exists;
+     * callers then keep their previous behaviour.
+     */
+    Long resolveGuestOsIdForVmwareImport(String osName, String osId);
+
+    /**
+     * Fills in the imported VM's hardware details from the VMware source: UEFI boot (with SECURE
+     * when the source has secure boot enabled) plus the q35 machine type when the source firmware
+     * is UEFI, and a vga console for Windows guests. Only keys the caller did not provide are
+     * added, so explicit user choices always win.
+     */
+    Map<String, String> applyVmwareImportHardwareDetails(Map<String, String> details, String bootType, String bootMode, String osName);
+
+    /**
+     * Preserves static source IPs across the migration: for every NIC that is mapped to a
+     * CloudStack network but has no caller-provided IP, requests the guest's own IPv4 address
+     * (captured from VMware Tools while the source runs) when that address fits the target
+     * network's CIDR, is not the network's gateway and is not already in use. Caller-provided
+     * entries always win; NICs whose source address does not fit fall back to normal allocation.
+     *
+     * @param nicIdToIpv4Cidrs source NIC id to its captured IPv4 addresses in CIDR form
+     * @return the effective NIC-to-IP map to use for the import
+     */
+    Map<String, Network.IpAddresses> autoFillStaticNicIpAddresses(Map<String, Long> nicNetworkMap,
+            Map<String, Network.IpAddresses> nicIpAddressMap, Map<String, List<String>> nicIdToIpv4Cidrs);
 }
diff --git a/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtChangedBlockInfo.java b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtChangedBlockInfo.java
new file mode 100644
index 000000000000..998bfc701dd0
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtChangedBlockInfo.java
@@ -0,0 +1,36 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+public class VmwareCbtChangedBlockInfo {
+
+    private final long startOffset;
+    private final long length;
+
+    public VmwareCbtChangedBlockInfo(long startOffset, long length) {
+        this.startOffset = startOffset;
+        this.length = length;
+    }
+
+    public long getStartOffset() {
+        return startOffset;
+    }
+
+    public long getLength() {
+        return length;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtChangedDiskInfo.java b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtChangedDiskInfo.java
new file mode 100644
index 000000000000..958cbffa3519
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtChangedDiskInfo.java
@@ -0,0 +1,46 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+import java.util.Collections;
+import java.util.List;
+
+public class VmwareCbtChangedDiskInfo {
+
+    private final String sourceDiskId;
+    private final String nextChangeId;
+    private final List<VmwareCbtChangedBlockInfo> changedBlocks;
+
+    public VmwareCbtChangedDiskInfo(String sourceDiskId, String nextChangeId,
+                                    List<VmwareCbtChangedBlockInfo> changedBlocks) {
+        this.sourceDiskId = sourceDiskId;
+        this.nextChangeId = nextChangeId;
+        this.changedBlocks = changedBlocks == null ? Collections.emptyList() : changedBlocks;
+    }
+
+    public String getSourceDiskId() {
+        return sourceDiskId;
+    }
+
+    public String getNextChangeId() {
+        return nextChangeId;
+    }
+
+    public List<VmwareCbtChangedBlockInfo> getChangedBlocks() {
+        return changedBlocks;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtDiskInfo.java b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtDiskInfo.java
new file mode 100644
index 000000000000..99ed6d5de530
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtDiskInfo.java
@@ -0,0 +1,67 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+public class VmwareCbtDiskInfo {
+
+    private final String sourceDiskId;
+    private final Integer sourceDiskDeviceKey;
+    private final String label;
+    private final String sourceDiskPath;
+    private final String datastoreName;
+    private final Long capacityBytes;
+    private final String changeId;
+
+    public VmwareCbtDiskInfo(String sourceDiskId, Integer sourceDiskDeviceKey, String label, String sourceDiskPath,
+                             String datastoreName, Long capacityBytes, String changeId) {
+        this.sourceDiskId = sourceDiskId;
+        this.sourceDiskDeviceKey = sourceDiskDeviceKey;
+        this.label = label;
+        this.sourceDiskPath = sourceDiskPath;
+        this.datastoreName = datastoreName;
+        this.capacityBytes = capacityBytes;
+        this.changeId = changeId;
+    }
+
+    public String getSourceDiskId() {
+        return sourceDiskId;
+    }
+
+    public Integer getSourceDiskDeviceKey() {
+        return sourceDiskDeviceKey;
+    }
+
+    public String getLabel() {
+        return label;
+    }
+
+    public String getSourceDiskPath() {
+        return sourceDiskPath;
+    }
+
+    public String getDatastoreName() {
+        return datastoreName;
+    }
+
+    public Long getCapacityBytes() {
+        return capacityBytes;
+    }
+
+    public String getChangeId() {
+        return changeId;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigration.java b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigration.java
new file mode 100644
index 000000000000..3f56a9c64451
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigration.java
@@ -0,0 +1,47 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+import org.apache.cloudstack.api.Identity;
+import org.apache.cloudstack.api.InternalIdentity;
+
+public interface VmwareCbtMigration extends Identity, InternalIdentity {
+    enum State {
+        Created,
+        InitialSync,
+        Replicating,
+        ReadyForCutover,
+        CuttingOver,
+        ReadyForImport,
+        Completed,
+        Failed,
+        Cancelled;
+
+        public boolean isTerminal() {
+            return this == Completed || this == Failed || this == Cancelled;
+        }
+
+        public static State getValue(String state) {
+            for (State value : values()) {
+                if (value.name().equalsIgnoreCase(state)) {
+                    return value;
+                }
+            }
+            throw new IllegalArgumentException("Invalid VMware CBT migration state: " + state);
+        }
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationCycle.java b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationCycle.java
new file mode 100644
index 000000000000..e1e8758358aa
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationCycle.java
@@ -0,0 +1,30 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+import org.apache.cloudstack.api.Identity;
+import org.apache.cloudstack.api.InternalIdentity;
+
+public interface VmwareCbtMigrationCycle extends Identity, InternalIdentity {
+    enum State {
+        Created,
+        QueryingChangedAreas,
+        CopyingChangedBlocks,
+        Completed,
+        Failed
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationDisk.java b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationDisk.java
new file mode 100644
index 000000000000..41d672de69c9
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationDisk.java
@@ -0,0 +1,30 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+import org.apache.cloudstack.api.Identity;
+import org.apache.cloudstack.api.InternalIdentity;
+
+public interface VmwareCbtMigrationDisk extends Identity, InternalIdentity {
+    enum State {
+        Created,
+        Prepared,
+        Syncing,
+        Ready,
+        Failed
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationManager.java b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationManager.java
new file mode 100644
index 000000000000..bf248782c2a0
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationManager.java
@@ -0,0 +1,46 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+import org.apache.cloudstack.api.command.admin.vm.CancelVmwareCbtMigrationCmd;
+import org.apache.cloudstack.api.command.admin.vm.CheckVmwareCbtMigrationPrerequisitesCmd;
+import org.apache.cloudstack.api.command.admin.vm.CutoverVmwareCbtMigrationCmd;
+import org.apache.cloudstack.api.command.admin.vm.DeleteVmwareCbtMigrationCmd;
+import org.apache.cloudstack.api.command.admin.vm.ListVmwareCbtMigrationsCmd;
+import org.apache.cloudstack.api.command.admin.vm.StartVmwareCbtMigrationCmd;
+import org.apache.cloudstack.api.command.admin.vm.SyncVmwareCbtMigrationCmd;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.api.response.VmwareCbtMigrationPreflightResponse;
+import org.apache.cloudstack.api.response.VmwareCbtMigrationResponse;
+
+import com.cloud.utils.component.PluggableService;
+
+public interface VmwareCbtMigrationManager extends PluggableService {
+    VmwareCbtMigrationPreflightResponse checkVmwareCbtMigrationPrerequisites(CheckVmwareCbtMigrationPrerequisitesCmd cmd);
+
+    VmwareCbtMigrationResponse startVmwareCbtMigration(StartVmwareCbtMigrationCmd cmd);
+
+    ListResponse<VmwareCbtMigrationResponse> listVmwareCbtMigrations(ListVmwareCbtMigrationsCmd cmd);
+
+    VmwareCbtMigrationResponse syncVmwareCbtMigration(SyncVmwareCbtMigrationCmd cmd);
+
+    VmwareCbtMigrationResponse cutoverVmwareCbtMigration(CutoverVmwareCbtMigrationCmd cmd);
+
+    VmwareCbtMigrationResponse cancelVmwareCbtMigration(CancelVmwareCbtMigrationCmd cmd);
+
+    boolean deleteVmwareCbtMigration(DeleteVmwareCbtMigrationCmd cmd);
+}
diff --git a/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationService.java b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationService.java
new file mode 100644
index 000000000000..9527ac67fd1f
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationService.java
@@ -0,0 +1,47 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+import java.util.List;
+
+public interface VmwareCbtMigrationService {
+    VmwareCbtPreflightInfo getPreflightInfo(String vcenter, String datacenterName, String username, String password,
+                                            String sourceHost, String sourceVmName);
+
+    List<VmwareCbtDiskInfo> listSourceDisks(String vcenter, String datacenterName, String username, String password,
+                                            String sourceHost, String sourceVmName);
+
+    List<VmwareCbtDiskInfo> listSnapshotDisks(String vcenter, String datacenterName, String username, String password,
+                                              String sourceHost, String sourceVmName, String snapshotMor);
+
+    void ensureChangeTrackingEnabled(String vcenter, String datacenterName, String username, String password,
+                                     String sourceHost, String sourceVmName);
+
+    VmwareCbtSnapshotInfo createSnapshot(String vcenter, String datacenterName, String username, String password,
+                                         String sourceHost, String sourceVmName, String snapshotName,
+                                         String snapshotDescription, boolean quiesce);
+
+    List<VmwareCbtChangedDiskInfo> queryChangedDiskAreas(String vcenter, String datacenterName, String username,
+                                                         String password, String sourceHost, String sourceVmName,
+                                                         List<VmwareCbtDiskInfo> disks, String snapshotMor);
+
+    UnmanagedInstanceTO.PowerState getPowerState(String vcenter, String datacenterName, String username,
+                                                 String password, String sourceHost, String sourceVmName);
+
+    void removeSnapshot(String vcenter, String datacenterName, String username, String password, String sourceHost,
+                        String sourceVmName, String snapshotMor);
+}
diff --git a/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtPreflightDiskInfo.java b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtPreflightDiskInfo.java
new file mode 100644
index 000000000000..a574af96a083
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtPreflightDiskInfo.java
@@ -0,0 +1,59 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+public class VmwareCbtPreflightDiskInfo extends VmwareCbtDiskInfo {
+
+    private final String backingType;
+    private final String diskMode;
+    private final String rdmCompatibilityMode;
+    private final boolean independentDisk;
+    private final boolean physicalRdm;
+
+    public VmwareCbtPreflightDiskInfo(String sourceDiskId, Integer sourceDiskDeviceKey, String label,
+                                      String sourceDiskPath, String datastoreName, Long capacityBytes,
+                                      String changeId, String backingType, String diskMode,
+                                      String rdmCompatibilityMode, boolean independentDisk,
+                                      boolean physicalRdm) {
+        super(sourceDiskId, sourceDiskDeviceKey, label, sourceDiskPath, datastoreName, capacityBytes, changeId);
+        this.backingType = backingType;
+        this.diskMode = diskMode;
+        this.rdmCompatibilityMode = rdmCompatibilityMode;
+        this.independentDisk = independentDisk;
+        this.physicalRdm = physicalRdm;
+    }
+
+    public String getBackingType() {
+        return backingType;
+    }
+
+    public String getDiskMode() {
+        return diskMode;
+    }
+
+    public String getRdmCompatibilityMode() {
+        return rdmCompatibilityMode;
+    }
+
+    public boolean isIndependentDisk() {
+        return independentDisk;
+    }
+
+    public boolean isPhysicalRdm() {
+        return physicalRdm;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtPreflightInfo.java b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtPreflightInfo.java
new file mode 100644
index 000000000000..bf76922926e0
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtPreflightInfo.java
@@ -0,0 +1,138 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+import java.util.Collections;
+import java.util.List;
+
+public class VmwareCbtPreflightInfo {
+
+    private final String sourceVmName;
+    private final String sourceVmMor;
+    private final Boolean changeTrackingSupported;
+    private final Boolean changeTrackingEnabled;
+    private final Boolean consolidationNeeded;
+    private final Integer existingSnapshotCount;
+    private final List<VmwareCbtPreflightDiskInfo> disks;
+    private final List<VmwareCbtPreflightNicInfo> nics;
+    private final Integer cpuCores;
+    private final Integer cpuSpeed;
+    private final Integer memoryMb;
+    private final String operatingSystemId;
+    private final String operatingSystem;
+    private String bootType;
+    private String bootMode;
+
+    public VmwareCbtPreflightInfo(String sourceVmName, String sourceVmMor,
+                                  Boolean changeTrackingSupported, Boolean changeTrackingEnabled,
+                                  Boolean consolidationNeeded, Integer existingSnapshotCount,
+                                  List<VmwareCbtPreflightDiskInfo> disks,
+                                  Integer cpuCores, Integer cpuSpeed, Integer memoryMb) {
+        this(sourceVmName, sourceVmMor, changeTrackingSupported, changeTrackingEnabled, consolidationNeeded,
+                existingSnapshotCount, disks, null, cpuCores, cpuSpeed, memoryMb, null, null);
+    }
+
+    public VmwareCbtPreflightInfo(String sourceVmName, String sourceVmMor,
+                                  Boolean changeTrackingSupported, Boolean changeTrackingEnabled,
+                                  Boolean consolidationNeeded, Integer existingSnapshotCount,
+                                  List<VmwareCbtPreflightDiskInfo> disks,
+                                  List<VmwareCbtPreflightNicInfo> nics,
+                                  Integer cpuCores, Integer cpuSpeed, Integer memoryMb,
+                                  String operatingSystemId, String operatingSystem) {
+        this.sourceVmName = sourceVmName;
+        this.sourceVmMor = sourceVmMor;
+        this.changeTrackingSupported = changeTrackingSupported;
+        this.changeTrackingEnabled = changeTrackingEnabled;
+        this.consolidationNeeded = consolidationNeeded;
+        this.existingSnapshotCount = existingSnapshotCount;
+        this.disks = disks == null ? Collections.emptyList() : Collections.unmodifiableList(disks);
+        this.nics = nics == null ? Collections.emptyList() : Collections.unmodifiableList(nics);
+        this.cpuCores = cpuCores;
+        this.cpuSpeed = cpuSpeed;
+        this.memoryMb = memoryMb;
+        this.operatingSystemId = operatingSystemId;
+        this.operatingSystem = operatingSystem;
+    }
+
+    public String getSourceVmName() {
+        return sourceVmName;
+    }
+
+    public String getSourceVmMor() {
+        return sourceVmMor;
+    }
+
+    public Boolean getChangeTrackingSupported() {
+        return changeTrackingSupported;
+    }
+
+    public Boolean getChangeTrackingEnabled() {
+        return changeTrackingEnabled;
+    }
+
+    public Boolean getConsolidationNeeded() {
+        return consolidationNeeded;
+    }
+
+    public Integer getExistingSnapshotCount() {
+        return existingSnapshotCount;
+    }
+
+    public List<VmwareCbtPreflightNicInfo> getNics() {
+        return nics;
+    }
+
+    public List<VmwareCbtPreflightDiskInfo> getDisks() {
+        return disks;
+    }
+
+    public Integer getCpuCores() {
+        return cpuCores;
+    }
+
+    public Integer getCpuSpeed() {
+        return cpuSpeed;
+    }
+
+    public Integer getMemoryMb() {
+        return memoryMb;
+    }
+
+    public String getOperatingSystemId() {
+        return operatingSystemId;
+    }
+
+    public String getOperatingSystem() {
+        return operatingSystem;
+    }
+
+    public String getBootType() {
+        return bootType;
+    }
+
+    public void setBootType(String bootType) {
+        this.bootType = bootType;
+    }
+
+    public String getBootMode() {
+        return bootMode;
+    }
+
+    public void setBootMode(String bootMode) {
+        this.bootMode = bootMode;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtPreflightNicInfo.java b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtPreflightNicInfo.java
new file mode 100644
index 000000000000..d22d61235d7a
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtPreflightNicInfo.java
@@ -0,0 +1,87 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+import java.util.List;
+
+/**
+ * A source VM NIC discovered during VMware CBT preflight, so NIC-to-network
+ * mappings can be validated when the migration is started instead of failing
+ * at import time, after replication has already run.
+ */
+public class VmwareCbtPreflightNicInfo {
+
+    private final String sourceNicId;
+    private final String adapterType;
+    private final String macAddress;
+    private final Integer vlan;
+
+    // Guest network facts from VMware Tools (available while the source runs): the IPv4
+    // addresses in CIDR form, the default gateway of this NIC's subnet, and the guest's DNS
+    // servers. Null when Tools is not running or reports nothing for this NIC. Used to
+    // preserve a static source IP across the migration when it fits the target network.
+    private List<String> ipv4Cidrs;
+    private String ipv4Gateway;
+    private List<String> dnsServers;
+
+    public VmwareCbtPreflightNicInfo(String sourceNicId, String adapterType, String macAddress, Integer vlan) {
+        this.sourceNicId = sourceNicId;
+        this.adapterType = adapterType;
+        this.macAddress = macAddress;
+        this.vlan = vlan;
+    }
+
+    public String getSourceNicId() {
+        return sourceNicId;
+    }
+
+    public String getAdapterType() {
+        return adapterType;
+    }
+
+    public String getMacAddress() {
+        return macAddress;
+    }
+
+    public Integer getVlan() {
+        return vlan;
+    }
+
+    public List<String> getIpv4Cidrs() {
+        return ipv4Cidrs;
+    }
+
+    public void setIpv4Cidrs(List<String> ipv4Cidrs) {
+        this.ipv4Cidrs = ipv4Cidrs;
+    }
+
+    public String getIpv4Gateway() {
+        return ipv4Gateway;
+    }
+
+    public void setIpv4Gateway(String ipv4Gateway) {
+        this.ipv4Gateway = ipv4Gateway;
+    }
+
+    public List<String> getDnsServers() {
+        return dnsServers;
+    }
+
+    public void setDnsServers(List<String> dnsServers) {
+        this.dnsServers = dnsServers;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtSnapshotInfo.java b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtSnapshotInfo.java
new file mode 100644
index 000000000000..c8bfe3edbe84
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/vm/VmwareCbtSnapshotInfo.java
@@ -0,0 +1,46 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+public class VmwareCbtSnapshotInfo {
+
+    private final String snapshotName;
+    private final String snapshotMor;
+    private final String sourceVmMor;
+
+    public VmwareCbtSnapshotInfo(String snapshotName, String snapshotMor) {
+        this(snapshotName, snapshotMor, null);
+    }
+
+    public VmwareCbtSnapshotInfo(String snapshotName, String snapshotMor, String sourceVmMor) {
+        this.snapshotName = snapshotName;
+        this.snapshotMor = snapshotMor;
+        this.sourceVmMor = sourceVmMor;
+    }
+
+    public String getSnapshotName() {
+        return snapshotName;
+    }
+
+    public String getSnapshotMor() {
+        return snapshotMor;
+    }
+
+    public String getSourceVmMor() {
+        return sourceVmMor;
+    }
+}
diff --git a/core/src/main/java/com/cloud/agent/api/CheckConvertInstanceCommand.java b/core/src/main/java/com/cloud/agent/api/CheckConvertInstanceCommand.java
index c46fb697a3c1..9bd5bf168a3d 100644
--- a/core/src/main/java/com/cloud/agent/api/CheckConvertInstanceCommand.java
+++ b/core/src/main/java/com/cloud/agent/api/CheckConvertInstanceCommand.java
@@ -19,6 +19,8 @@
 public class CheckConvertInstanceCommand extends Command {
     boolean checkWindowsGuestConversionSupport = false;
     boolean useVddk = false;
+    boolean checkVddkRbdDirectImportSupport = false;
+    boolean checkVddkInPlaceFinalizationSupport = false;
     String vddkLibDir;
 
     public CheckConvertInstanceCommand() {
@@ -50,6 +52,22 @@ public void setUseVddk(boolean useVddk) {
         this.useVddk = useVddk;
     }
 
+    public boolean isCheckVddkRbdDirectImportSupport() {
+        return checkVddkRbdDirectImportSupport;
+    }
+
+    public void setCheckVddkRbdDirectImportSupport(boolean checkVddkRbdDirectImportSupport) {
+        this.checkVddkRbdDirectImportSupport = checkVddkRbdDirectImportSupport;
+    }
+
+    public boolean isCheckVddkInPlaceFinalizationSupport() {
+        return checkVddkInPlaceFinalizationSupport;
+    }
+
+    public void setCheckVddkInPlaceFinalizationSupport(boolean checkVddkInPlaceFinalizationSupport) {
+        this.checkVddkInPlaceFinalizationSupport = checkVddkInPlaceFinalizationSupport;
+    }
+
     public String getVddkLibDir() {
         return vddkLibDir;
     }
diff --git a/core/src/main/java/com/cloud/agent/api/ConvertInstanceCommand.java b/core/src/main/java/com/cloud/agent/api/ConvertInstanceCommand.java
index 38e0dca7736c..8a8e194ee220 100644
--- a/core/src/main/java/com/cloud/agent/api/ConvertInstanceCommand.java
+++ b/core/src/main/java/com/cloud/agent/api/ConvertInstanceCommand.java
@@ -18,8 +18,11 @@
 
 import com.cloud.agent.api.to.DataStoreTO;
 import com.cloud.agent.api.to.RemoteInstanceTO;
+import com.cloud.agent.api.to.VmwareVddkSourceDiskTO;
 import com.cloud.hypervisor.Hypervisor;
 
+import java.util.List;
+
 public class ConvertInstanceCommand extends Command {
 
     private RemoteInstanceTO sourceInstance;
@@ -35,6 +38,8 @@ public class ConvertInstanceCommand extends Command {
     private String vddkLibDir;
     private String vddkTransports;
     private String vddkThumbprint;
+    private List<VmwareVddkSourceDiskTO> vmwareVddkSourceDisks;
+    private boolean windowsGuest;
 
     public ConvertInstanceCommand() {
     }
@@ -126,6 +131,22 @@ public void setVddkThumbprint(String vddkThumbprint) {
         this.vddkThumbprint = vddkThumbprint;
     }
 
+    public List<VmwareVddkSourceDiskTO> getVmwareVddkSourceDisks() {
+        return vmwareVddkSourceDisks;
+    }
+
+    public void setVmwareVddkSourceDisks(List<VmwareVddkSourceDiskTO> vmwareVddkSourceDisks) {
+        this.vmwareVddkSourceDisks = vmwareVddkSourceDisks;
+    }
+
+    public boolean isWindowsGuest() {
+        return windowsGuest;
+    }
+
+    public void setWindowsGuest(boolean windowsGuest) {
+        this.windowsGuest = windowsGuest;
+    }
+
     @Override
     public boolean executeInSequence() {
         return false;
diff --git a/core/src/main/java/com/cloud/agent/api/ImportConvertedInstanceCommand.java b/core/src/main/java/com/cloud/agent/api/ImportConvertedInstanceCommand.java
index eadfa6556f86..e5b970814fab 100644
--- a/core/src/main/java/com/cloud/agent/api/ImportConvertedInstanceCommand.java
+++ b/core/src/main/java/com/cloud/agent/api/ImportConvertedInstanceCommand.java
@@ -18,6 +18,7 @@
 
 import com.cloud.agent.api.to.DataStoreTO;
 import com.cloud.agent.api.to.RemoteInstanceTO;
+import com.cloud.storage.Storage;
 
 import java.util.List;
 
@@ -25,6 +26,7 @@ public class ImportConvertedInstanceCommand extends Command {
 
     private RemoteInstanceTO sourceInstance;
     private List<String> destinationStoragePools;
+    private List<Storage.StoragePoolType> destinationStoragePoolTypes;
     private DataStoreTO conversionTemporaryLocation;
     private String temporaryConvertUuid;
     private boolean forceConvertToPool;
@@ -34,15 +36,24 @@ public ImportConvertedInstanceCommand() {
 
     public ImportConvertedInstanceCommand(RemoteInstanceTO sourceInstance,
                                           List<String> destinationStoragePools,
+                                          List<Storage.StoragePoolType> destinationStoragePoolTypes,
                                           DataStoreTO conversionTemporaryLocation, String temporaryConvertUuid,
                                           boolean forceConvertToPool) {
         this.sourceInstance = sourceInstance;
         this.destinationStoragePools = destinationStoragePools;
+        this.destinationStoragePoolTypes = destinationStoragePoolTypes;
         this.conversionTemporaryLocation = conversionTemporaryLocation;
         this.temporaryConvertUuid = temporaryConvertUuid;
         this.forceConvertToPool = forceConvertToPool;
     }
 
+    public ImportConvertedInstanceCommand(RemoteInstanceTO sourceInstance,
+                                          List<String> destinationStoragePools,
+                                          DataStoreTO conversionTemporaryLocation, String temporaryConvertUuid,
+                                          boolean forceConvertToPool) {
+        this(sourceInstance, destinationStoragePools, null, conversionTemporaryLocation, temporaryConvertUuid, forceConvertToPool);
+    }
+
     public RemoteInstanceTO getSourceInstance() {
         return sourceInstance;
     }
@@ -51,6 +62,10 @@ public List<String> getDestinationStoragePools() {
         return destinationStoragePools;
     }
 
+    public List<Storage.StoragePoolType> getDestinationStoragePoolTypes() {
+        return destinationStoragePoolTypes;
+    }
+
     public DataStoreTO getConversionTemporaryLocation() {
         return conversionTemporaryLocation;
     }
diff --git a/core/src/main/java/com/cloud/agent/api/VmwareCbtCleanupCommand.java b/core/src/main/java/com/cloud/agent/api/VmwareCbtCleanupCommand.java
new file mode 100644
index 000000000000..65ae402e1140
--- /dev/null
+++ b/core/src/main/java/com/cloud/agent/api/VmwareCbtCleanupCommand.java
@@ -0,0 +1,100 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.agent.api;
+
+import java.util.List;
+
+import com.cloud.agent.api.to.VmwareCbtDiskTO;
+import com.cloud.agent.api.to.VmwareCbtTargetStorageType;
+import com.cloud.storage.Storage;
+
+public class VmwareCbtCleanupCommand extends Command {
+
+    private String migrationUuid;
+    private List<VmwareCbtDiskTO> disks;
+    private boolean removeTemporarySnapshots;
+    private boolean removeNbdExports;
+    private boolean removePartialTargetDisks;
+    private Storage.StoragePoolType destinationStoragePoolType;
+    private String destinationStoragePoolUuid;
+    private VmwareCbtTargetStorageType targetStorageType;
+
+    public VmwareCbtCleanupCommand() {
+    }
+
+    public VmwareCbtCleanupCommand(String migrationUuid, List<VmwareCbtDiskTO> disks, boolean removeTemporarySnapshots,
+                                   boolean removeNbdExports, boolean removePartialTargetDisks) {
+        this.migrationUuid = migrationUuid;
+        this.disks = disks;
+        this.removeTemporarySnapshots = removeTemporarySnapshots;
+        this.removeNbdExports = removeNbdExports;
+        this.removePartialTargetDisks = removePartialTargetDisks;
+    }
+
+    public String getMigrationUuid() {
+        return migrationUuid;
+    }
+
+    public List<VmwareCbtDiskTO> getDisks() {
+        return disks;
+    }
+
+    public boolean getRemoveTemporarySnapshots() {
+        return removeTemporarySnapshots;
+    }
+
+    public boolean getRemoveNbdExports() {
+        return removeNbdExports;
+    }
+
+    public boolean getRemovePartialTargetDisks() {
+        return removePartialTargetDisks;
+    }
+
+    public Storage.StoragePoolType getDestinationStoragePoolType() {
+        return destinationStoragePoolType;
+    }
+
+    public void setDestinationStoragePoolType(Storage.StoragePoolType destinationStoragePoolType) {
+        this.destinationStoragePoolType = destinationStoragePoolType;
+    }
+
+    public String getDestinationStoragePoolUuid() {
+        return destinationStoragePoolUuid;
+    }
+
+    public void setDestinationStoragePoolUuid(String destinationStoragePoolUuid) {
+        this.destinationStoragePoolUuid = destinationStoragePoolUuid;
+    }
+
+    public VmwareCbtTargetStorageType getTargetStorageType() {
+        return targetStorageType;
+    }
+
+    public void setTargetStorageType(VmwareCbtTargetStorageType targetStorageType) {
+        this.targetStorageType = targetStorageType;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        // Cancellation must be able to interrupt a long-running prepare/sync command on the
+        // same host. If cleanup is queued behind that command, the VDDK reader keeps the source
+        // snapshot open until the entire copy finishes and the cleanup request can time out
+        // before it ever reaches the agent.
+        return false;
+    }
+}
diff --git a/core/src/main/java/com/cloud/agent/api/VmwareCbtCutoverCommand.java b/core/src/main/java/com/cloud/agent/api/VmwareCbtCutoverCommand.java
new file mode 100644
index 000000000000..24d82c434afe
--- /dev/null
+++ b/core/src/main/java/com/cloud/agent/api/VmwareCbtCutoverCommand.java
@@ -0,0 +1,133 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.agent.api;
+
+import java.util.List;
+
+import com.cloud.agent.api.to.RemoteInstanceTO;
+import com.cloud.agent.api.to.VmwareCbtDiskTO;
+import com.cloud.agent.api.to.VmwareCbtTargetStorageType;
+import com.cloud.storage.Storage;
+
+public class VmwareCbtCutoverCommand extends Command {
+
+    private String migrationUuid;
+    private RemoteInstanceTO sourceInstance;
+    private List<VmwareCbtDiskTO> disks;
+    private int finalCycleNumber;
+    private boolean runVirtV2vFinalization;
+    private boolean allowNonInPlaceFinalization;
+    private Storage.StoragePoolType destinationStoragePoolType;
+    private String destinationStoragePoolUuid;
+    private VmwareCbtTargetStorageType targetStorageType;
+    private String vddkLibDir;
+    private String vddkTransports;
+    private String vddkThumbprint;
+
+    public VmwareCbtCutoverCommand() {
+    }
+
+    public VmwareCbtCutoverCommand(String migrationUuid, RemoteInstanceTO sourceInstance, List<VmwareCbtDiskTO> disks,
+                                   int finalCycleNumber, boolean runVirtV2vFinalization) {
+        this.migrationUuid = migrationUuid;
+        this.sourceInstance = sourceInstance;
+        this.disks = disks;
+        this.finalCycleNumber = finalCycleNumber;
+        this.runVirtV2vFinalization = runVirtV2vFinalization;
+    }
+
+    public String getMigrationUuid() {
+        return migrationUuid;
+    }
+
+    public RemoteInstanceTO getSourceInstance() {
+        return sourceInstance;
+    }
+
+    public List<VmwareCbtDiskTO> getDisks() {
+        return disks;
+    }
+
+    public int getFinalCycleNumber() {
+        return finalCycleNumber;
+    }
+
+    public boolean getRunVirtV2vFinalization() {
+        return runVirtV2vFinalization;
+    }
+
+    public boolean getAllowNonInPlaceFinalization() {
+        return allowNonInPlaceFinalization;
+    }
+
+    public void setAllowNonInPlaceFinalization(boolean allowNonInPlaceFinalization) {
+        this.allowNonInPlaceFinalization = allowNonInPlaceFinalization;
+    }
+
+    public Storage.StoragePoolType getDestinationStoragePoolType() {
+        return destinationStoragePoolType;
+    }
+
+    public void setDestinationStoragePoolType(Storage.StoragePoolType destinationStoragePoolType) {
+        this.destinationStoragePoolType = destinationStoragePoolType;
+    }
+
+    public String getDestinationStoragePoolUuid() {
+        return destinationStoragePoolUuid;
+    }
+
+    public void setDestinationStoragePoolUuid(String destinationStoragePoolUuid) {
+        this.destinationStoragePoolUuid = destinationStoragePoolUuid;
+    }
+
+    public VmwareCbtTargetStorageType getTargetStorageType() {
+        return targetStorageType;
+    }
+
+    public void setTargetStorageType(VmwareCbtTargetStorageType targetStorageType) {
+        this.targetStorageType = targetStorageType;
+    }
+
+    public String getVddkLibDir() {
+        return vddkLibDir;
+    }
+
+    public void setVddkLibDir(String vddkLibDir) {
+        this.vddkLibDir = vddkLibDir;
+    }
+
+    public String getVddkTransports() {
+        return vddkTransports;
+    }
+
+    public void setVddkTransports(String vddkTransports) {
+        this.vddkTransports = vddkTransports;
+    }
+
+    public String getVddkThumbprint() {
+        return vddkThumbprint;
+    }
+
+    public void setVddkThumbprint(String vddkThumbprint) {
+        this.vddkThumbprint = vddkThumbprint;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return true;
+    }
+}
diff --git a/core/src/main/java/com/cloud/agent/api/VmwareCbtMigrationAnswer.java b/core/src/main/java/com/cloud/agent/api/VmwareCbtMigrationAnswer.java
new file mode 100644
index 000000000000..2a0435639418
--- /dev/null
+++ b/core/src/main/java/com/cloud/agent/api/VmwareCbtMigrationAnswer.java
@@ -0,0 +1,82 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.agent.api;
+
+import java.util.List;
+
+import com.cloud.agent.api.to.VmwareCbtDiskSyncResultTO;
+
+public class VmwareCbtMigrationAnswer extends Answer {
+
+    private String migrationUuid;
+    private int cycleNumber;
+    private long changedBytes;
+    private long dirtyRateBytesPerSecond;
+    private long durationSeconds;
+    private boolean readyForCutover;
+    private List<VmwareCbtDiskSyncResultTO> diskResults;
+
+    public VmwareCbtMigrationAnswer() {
+        super();
+    }
+
+    public VmwareCbtMigrationAnswer(Command command, boolean result, String details, String migrationUuid) {
+        super(command, result, details);
+        this.migrationUuid = migrationUuid;
+    }
+
+    public VmwareCbtMigrationAnswer(Command command, boolean result, String details, String migrationUuid, int cycleNumber,
+                                    long changedBytes, long dirtyRateBytesPerSecond, long durationSeconds,
+                                    boolean readyForCutover, List<VmwareCbtDiskSyncResultTO> diskResults) {
+        super(command, result, details);
+        this.migrationUuid = migrationUuid;
+        this.cycleNumber = cycleNumber;
+        this.changedBytes = changedBytes;
+        this.dirtyRateBytesPerSecond = dirtyRateBytesPerSecond;
+        this.durationSeconds = durationSeconds;
+        this.readyForCutover = readyForCutover;
+        this.diskResults = diskResults;
+    }
+
+    public String getMigrationUuid() {
+        return migrationUuid;
+    }
+
+    public int getCycleNumber() {
+        return cycleNumber;
+    }
+
+    public long getChangedBytes() {
+        return changedBytes;
+    }
+
+    public long getDirtyRateBytesPerSecond() {
+        return dirtyRateBytesPerSecond;
+    }
+
+    public long getDurationSeconds() {
+        return durationSeconds;
+    }
+
+    public boolean getReadyForCutover() {
+        return readyForCutover;
+    }
+
+    public List<VmwareCbtDiskSyncResultTO> getDiskResults() {
+        return diskResults;
+    }
+}
diff --git a/core/src/main/java/com/cloud/agent/api/VmwareCbtPrepareCommand.java b/core/src/main/java/com/cloud/agent/api/VmwareCbtPrepareCommand.java
new file mode 100644
index 000000000000..0791d3b06a6f
--- /dev/null
+++ b/core/src/main/java/com/cloud/agent/api/VmwareCbtPrepareCommand.java
@@ -0,0 +1,110 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.agent.api;
+
+import java.util.List;
+
+import com.cloud.agent.api.to.RemoteInstanceTO;
+import com.cloud.agent.api.to.VmwareCbtDiskTO;
+import com.cloud.agent.api.to.VmwareCbtTargetStorageType;
+import com.cloud.storage.Storage;
+
+public class VmwareCbtPrepareCommand extends Command {
+
+    private String migrationUuid;
+    private RemoteInstanceTO sourceInstance;
+    private List<VmwareCbtDiskTO> disks;
+    private Storage.StoragePoolType destinationStoragePoolType;
+    private String destinationStoragePoolUuid;
+    private VmwareCbtTargetStorageType targetStorageType;
+    private String baselineSnapshotMor;
+    private String vddkLibDir;
+    private String vddkTransports;
+    private String vddkThumbprint;
+
+    public VmwareCbtPrepareCommand() {
+    }
+
+    public VmwareCbtPrepareCommand(String migrationUuid, RemoteInstanceTO sourceInstance, List<VmwareCbtDiskTO> disks,
+                                   Storage.StoragePoolType destinationStoragePoolType, String destinationStoragePoolUuid,
+                                   VmwareCbtTargetStorageType targetStorageType, String baselineSnapshotMor) {
+        this.migrationUuid = migrationUuid;
+        this.sourceInstance = sourceInstance;
+        this.disks = disks;
+        this.destinationStoragePoolType = destinationStoragePoolType;
+        this.destinationStoragePoolUuid = destinationStoragePoolUuid;
+        this.targetStorageType = targetStorageType;
+        this.baselineSnapshotMor = baselineSnapshotMor;
+    }
+
+    public String getMigrationUuid() {
+        return migrationUuid;
+    }
+
+    public RemoteInstanceTO getSourceInstance() {
+        return sourceInstance;
+    }
+
+    public List<VmwareCbtDiskTO> getDisks() {
+        return disks;
+    }
+
+    public Storage.StoragePoolType getDestinationStoragePoolType() {
+        return destinationStoragePoolType;
+    }
+
+    public String getDestinationStoragePoolUuid() {
+        return destinationStoragePoolUuid;
+    }
+
+    public VmwareCbtTargetStorageType getTargetStorageType() {
+        return targetStorageType;
+    }
+
+    public String getBaselineSnapshotMor() {
+        return baselineSnapshotMor;
+    }
+
+    public String getVddkLibDir() {
+        return vddkLibDir;
+    }
+
+    public void setVddkLibDir(String vddkLibDir) {
+        this.vddkLibDir = vddkLibDir;
+    }
+
+    public String getVddkTransports() {
+        return vddkTransports;
+    }
+
+    public void setVddkTransports(String vddkTransports) {
+        this.vddkTransports = vddkTransports;
+    }
+
+    public String getVddkThumbprint() {
+        return vddkThumbprint;
+    }
+
+    public void setVddkThumbprint(String vddkThumbprint) {
+        this.vddkThumbprint = vddkThumbprint;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return true;
+    }
+}
diff --git a/core/src/main/java/com/cloud/agent/api/VmwareCbtRbdProbeCommand.java b/core/src/main/java/com/cloud/agent/api/VmwareCbtRbdProbeCommand.java
new file mode 100644
index 000000000000..73b532bfff71
--- /dev/null
+++ b/core/src/main/java/com/cloud/agent/api/VmwareCbtRbdProbeCommand.java
@@ -0,0 +1,63 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.agent.api;
+
+import com.cloud.agent.api.to.VmwareCbtTargetStorageType;
+import com.cloud.storage.Storage;
+
+public class VmwareCbtRbdProbeCommand extends Command {
+
+    private Storage.StoragePoolType destinationStoragePoolType;
+    private String destinationStoragePoolUuid;
+    private String probeImageName;
+    private VmwareCbtTargetStorageType targetStorageType;
+
+    public VmwareCbtRbdProbeCommand() {
+    }
+
+    public VmwareCbtRbdProbeCommand(Storage.StoragePoolType destinationStoragePoolType,
+                                    String destinationStoragePoolUuid, String probeImageName) {
+        this.destinationStoragePoolType = destinationStoragePoolType;
+        this.destinationStoragePoolUuid = destinationStoragePoolUuid;
+        this.probeImageName = probeImageName;
+    }
+
+    public Storage.StoragePoolType getDestinationStoragePoolType() {
+        return destinationStoragePoolType;
+    }
+
+    public String getDestinationStoragePoolUuid() {
+        return destinationStoragePoolUuid;
+    }
+
+    public String getProbeImageName() {
+        return probeImageName;
+    }
+
+    public VmwareCbtTargetStorageType getTargetStorageType() {
+        return targetStorageType;
+    }
+
+    public void setTargetStorageType(VmwareCbtTargetStorageType targetStorageType) {
+        this.targetStorageType = targetStorageType;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return true;
+    }
+}
diff --git a/core/src/main/java/com/cloud/agent/api/VmwareCbtSyncCommand.java b/core/src/main/java/com/cloud/agent/api/VmwareCbtSyncCommand.java
new file mode 100644
index 000000000000..a58c0029c43f
--- /dev/null
+++ b/core/src/main/java/com/cloud/agent/api/VmwareCbtSyncCommand.java
@@ -0,0 +1,138 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.agent.api;
+
+import java.util.List;
+
+import com.cloud.agent.api.to.RemoteInstanceTO;
+import com.cloud.agent.api.to.VmwareCbtChangedBlockRangeTO;
+import com.cloud.agent.api.to.VmwareCbtDiskTO;
+import com.cloud.agent.api.to.VmwareCbtTargetStorageType;
+import com.cloud.storage.Storage;
+
+public class VmwareCbtSyncCommand extends Command {
+
+    private String migrationUuid;
+    private RemoteInstanceTO sourceInstance;
+    private List<VmwareCbtDiskTO> disks;
+    private List<VmwareCbtChangedBlockRangeTO> changedBlocks;
+    private int cycleNumber;
+    private String snapshotMor;
+    private boolean finalSync;
+    private Storage.StoragePoolType destinationStoragePoolType;
+    private String destinationStoragePoolUuid;
+    private VmwareCbtTargetStorageType targetStorageType;
+    private String vddkLibDir;
+    private String vddkTransports;
+    private String vddkThumbprint;
+
+    public VmwareCbtSyncCommand() {
+    }
+
+    public VmwareCbtSyncCommand(String migrationUuid, RemoteInstanceTO sourceInstance, List<VmwareCbtDiskTO> disks,
+                                List<VmwareCbtChangedBlockRangeTO> changedBlocks, int cycleNumber, String snapshotMor,
+                                boolean finalSync) {
+        this.migrationUuid = migrationUuid;
+        this.sourceInstance = sourceInstance;
+        this.disks = disks;
+        this.changedBlocks = changedBlocks;
+        this.cycleNumber = cycleNumber;
+        this.snapshotMor = snapshotMor;
+        this.finalSync = finalSync;
+    }
+
+    public String getMigrationUuid() {
+        return migrationUuid;
+    }
+
+    public RemoteInstanceTO getSourceInstance() {
+        return sourceInstance;
+    }
+
+    public List<VmwareCbtDiskTO> getDisks() {
+        return disks;
+    }
+
+    public List<VmwareCbtChangedBlockRangeTO> getChangedBlocks() {
+        return changedBlocks;
+    }
+
+    public int getCycleNumber() {
+        return cycleNumber;
+    }
+
+    public String getSnapshotMor() {
+        return snapshotMor;
+    }
+
+    public boolean getFinalSync() {
+        return finalSync;
+    }
+
+    public Storage.StoragePoolType getDestinationStoragePoolType() {
+        return destinationStoragePoolType;
+    }
+
+    public void setDestinationStoragePoolType(Storage.StoragePoolType destinationStoragePoolType) {
+        this.destinationStoragePoolType = destinationStoragePoolType;
+    }
+
+    public String getDestinationStoragePoolUuid() {
+        return destinationStoragePoolUuid;
+    }
+
+    public void setDestinationStoragePoolUuid(String destinationStoragePoolUuid) {
+        this.destinationStoragePoolUuid = destinationStoragePoolUuid;
+    }
+
+    public VmwareCbtTargetStorageType getTargetStorageType() {
+        return targetStorageType;
+    }
+
+    public void setTargetStorageType(VmwareCbtTargetStorageType targetStorageType) {
+        this.targetStorageType = targetStorageType;
+    }
+
+    public String getVddkLibDir() {
+        return vddkLibDir;
+    }
+
+    public void setVddkLibDir(String vddkLibDir) {
+        this.vddkLibDir = vddkLibDir;
+    }
+
+    public String getVddkTransports() {
+        return vddkTransports;
+    }
+
+    public void setVddkTransports(String vddkTransports) {
+        this.vddkTransports = vddkTransports;
+    }
+
+    public String getVddkThumbprint() {
+        return vddkThumbprint;
+    }
+
+    public void setVddkThumbprint(String vddkThumbprint) {
+        this.vddkThumbprint = vddkThumbprint;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return true;
+    }
+}
diff --git a/core/src/main/java/com/cloud/agent/api/to/VmwareCbtTargetStorageType.java b/core/src/main/java/com/cloud/agent/api/to/VmwareCbtTargetStorageType.java
new file mode 100644
index 000000000000..3707ea498744
--- /dev/null
+++ b/core/src/main/java/com/cloud/agent/api/to/VmwareCbtTargetStorageType.java
@@ -0,0 +1,28 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.agent.api.to;
+
+public enum VmwareCbtTargetStorageType {
+    QCOW2_FILE,
+    RBD_RAW,
+    /**
+     * Raw writes into a host-local block device provided by the destination
+     * primary storage (e.g. a Linstor/DRBD volume). The device is pre-created
+     * at source capacity through the storage adaptor before any data copy.
+     */
+    RAW_BLOCK_DEVICE
+}
diff --git a/docs/vmware-cbt-migration.md b/docs/vmware-cbt-migration.md
new file mode 100644
index 000000000000..cc33fa2a99df
--- /dev/null
+++ b/docs/vmware-cbt-migration.md
@@ -0,0 +1,457 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# VMware CBT migration to KVM
+
+This document describes the implemented VMware Changed Block Tracking (CBT)
+migration flow for Apache CloudStack and the host-level prerequisites required
+on KVM migration hosts.
+
+The goal of this flow is to reduce the downtime and bandwidth needed when
+migrating VMware guests to KVM. Instead of repeatedly copying the full VMware
+disk, CloudStack performs one initial full synchronization and then uses VMware
+CBT to copy only changed disk ranges until the VM is quiet enough for final
+cutover.
+
+No additional CloudStack software is installed on the VMware ESXi hosts or
+vCenter for this flow. The extra migration tooling is installed on the selected
+CloudStack KVM host that performs the VDDK read, virt-v2v conversion, and CBT
+delta application work.
+
+## Implementation status
+
+The implementation contains the CloudStack management model, API
+surface, state tracking, cutover policy, VMware changed-block query
+orchestration, KVM agent initial sync, KVM agent delta sync, cutover
+finalization, import retry handling, delete/cancel cleanup, and UI status
+tracking.
+
+## High-level flow
+
+1. Start a VMware CBT migration session.
+   CloudStack records the destination zone, KVM cluster, optional conversion
+   host, optional storage pool, source vCenter/ESXi details, and discovered
+   VMware disks.
+
+2. Run the initial full sync.
+   The KVM agent exposes each VMware snapshot disk through `nbdkit-vddk` and
+   copies it to a source-equivalent target on KVM primary storage. It uses
+   `qemu-img convert` for the general path and can use `nbdcopy` as an optional
+   accelerator for supported targets. `virt-v2v` does not run in this phase.
+
+3. Register target disks.
+   The management server records the target disk path, format, initial VMware
+   CBT change ID, and snapshot reference for each migrated disk.
+
+4. Run CBT delta synchronization cycles.
+   For each cycle CloudStack creates a VMware snapshot, calls
+   `QueryChangedDiskAreas()` for the source disks, dispatches changed byte
+   ranges to the selected KVM host, records copied bytes and dirty rate, and
+   removes the VMware snapshot.
+
+5. Decide when to cut over.
+   The decision is controlled by global settings:
+
+   * `vmware.cbt.migration.min.cycles`
+   * `vmware.cbt.migration.max.cycles`
+   * `vmware.cbt.migration.quiet.cycles`
+   * `vmware.cbt.migration.quiet.bytes`
+   * `vmware.cbt.migration.quiet.dirty.rate`
+
+   Long-running KVM agent commands are controlled separately by:
+
+   * `vmware.cbt.migration.agent.command.timeout`
+
+6. Final cutover.
+   After the operator powers down the VMware VM, CloudStack performs the final
+   delta sync, runs `virt-v2v` locally against the current KVM-side replica,
+   and imports/registers the VM on KVM.
+
+## Long-running operation timeout
+
+CBT initial full sync, regular delta sync, final delta sync, and cutover
+finalization run as KVM agent commands. The command wait value and the
+agent-side child process timeout are both controlled by:
+
+```text
+vmware.cbt.migration.agent.command.timeout=86400
+```
+
+The value is in seconds. The default is 24 hours. It is intentionally separate
+from `convert.vmware.instance.to.kvm.timeout`, which applies to the older
+OVF/VDDK `ConvertInstanceCommand` import path, and from
+`remote.kvm.instance.disks.copy.timeout`, which applies to remote KVM unmanaged
+disk copy imports.
+
+For very large source disks, set
+`vmware.cbt.migration.agent.command.timeout` above the worst-case expected
+duration. A 1 TiB initial sync can easily require multiple hours depending on
+VDDK transport, ESXi storage, destination storage, and sparse extent behavior.
+The setting is finite because the shared CloudStack script runner treats zero
+as its default one-hour timeout, not as "no timeout".
+
+## KVM migration host selection
+
+CBT migration runs on a KVM host in the destination cluster. If the API call
+does not specify a conversion host, CloudStack selects an enabled KVM routing
+host in the destination cluster that reports:
+
+```text
+host.vddk.blockcopy.support=true
+```
+
+The KVM agent reports this capability during host startup. It is true only when
+the host satisfies the required VDDK, `virt-v2v`, `qemu-img`, `qemu-nbd`, and
+`qemu-io` checks.
+
+Related host detail keys:
+
+```text
+host.vddk.support
+vddk.lib.dir
+host.vddk.version
+host.vddk.blockcopy.support
+host.vddk.blockcopy.inplace.finalization.support
+host.vddk.blockcopy.rbd.support
+host.qemu.img.version
+host.qemu.nbd.version
+host.qemu.io.version
+host.virtv2v.version
+host.virtv2v.inplace.version
+```
+
+Restart `cloudstack-agent` after installing packages or changing
+`agent.properties` so these details are refreshed on the management server.
+
+## Required host capabilities
+
+Each KVM host that can be selected for VMware CBT migration needs:
+
+* A normal CloudStack KVM agent installation.
+* `virt-v2v` for final cutover conversion.
+* `nbdkit` and an `nbdkit` VDDK plugin.
+* VMware VDDK libraries, with a directory containing
+  `lib64/libvixDiskLib.so`.
+* `qemu-img` for target image inspection, creation, and manipulation.
+* `qemu-nbd` for block device exposure during incremental copy workflows.
+* `qemu-io` for applying and verifying changed block ranges.
+* Optional `nbdcopy` from libnbd to accelerate supported initial full-copy
+  paths. CloudStack falls back to `qemu-img` when it is unavailable.
+* Network access from the KVM host to vCenter and ESXi hosts.
+* Access to the destination KVM primary storage pool.
+* `virtio-win` drivers when migrating Windows guests.
+
+Destination-specific requirements:
+
+* Ceph/RBD destination pools additionally require qemu built with the RBD
+  block driver on the conversion host, plus in-place `virt-v2v` support
+  (the `virt-v2v-in-place` binary or the `virt-v2v --in-place` option).
+* Linstor destination pools additionally require in-place `virt-v2v` support,
+  and the conversion host must be a LINSTOR satellite connected to the
+  destination pool (the CloudStack primary storage must be attached to the
+  host, and the host's `hostname` must match its LINSTOR node name). Target
+  volumes are pre-created through the Linstor storage adaptor and written as
+  raw data to the local DRBD device path, so no extra qemu block driver is
+  needed. DRBD permits only one writer: make sure no other node holds the
+  target resource Primary while a migration writes to it.
+
+You do not have to install these packages on every KVM host in the zone unless
+you want every KVM host to be eligible for VMware CBT migration. A common
+deployment model is to prepare a smaller set of conversion-capable KVM hosts and
+explicitly select one of them for migration work.
+
+The KVM agent checks these commands:
+
+```bash
+virt-v2v --version
+nbdkit vddk --dump-plugin libdir=<vddk-lib-dir>
+qemu-img --version
+qemu-nbd --version
+qemu-io --version
+```
+
+On Ubuntu and Debian hosts the conversion support check also verifies
+that the `nbdkit` package is installed with `dpkg -l nbdkit`.
+
+## VMware VDDK installation
+
+Install VMware VDDK on every KVM host that may run a VMware-to-KVM conversion or
+CBT replication session. A common layout is:
+
+```bash
+mkdir -p /opt/vmware
+tar -xzf VMware-vix-disklib-*.tar.gz -C /opt/vmware
+```
+
+The extracted directory is usually named:
+
+```text
+/opt/vmware/vmware-vix-disklib-distrib
+```
+
+CloudStack auto-detects the first directory named
+`vmware-vix-disklib-distrib`. If auto-detection is not desirable, configure the
+path explicitly in the KVM agent properties:
+
+```properties
+vddk.lib.dir=/opt/vmware/vmware-vix-disklib-distrib
+```
+
+Optional VDDK settings:
+
+```properties
+vddk.transports=nbdssl:nbd
+vddk.thumbprint=<vcenter-sha1-thumbprint>
+```
+
+If `vddk.thumbprint` is not set, CloudStack attempts to compute the vCenter
+thumbprint on the KVM host.
+
+## EL8 and Oracle Linux 8 host packages
+
+On an EL8-compatible KVM host, the CloudStack agent package already brings in
+the normal KVM runtime dependencies such as libvirt, qemu-kvm, qemu-img, and
+Python libvirt bindings. The VMware CBT path additionally needs virt-v2v,
+nbdkit, the nbdkit VDDK plugin, qemu-nbd support, and VDDK itself.
+
+Example package installation:
+
+```bash
+dnf install -y cloudstack-agent
+dnf install -y virt-v2v nbdkit qemu-img qemu-kvm-core qemu-kvm-block-curl libnbd
+dnf install -y nbdkit-plugin-vddk || dnf install -y nbdkit-vddk-plugin
+```
+
+Package names can differ between RHEL, Oracle Linux, Rocky, AlmaLinux, and
+enabled module streams. The important validation is not the exact package name,
+but that these commands work:
+
+```bash
+virt-v2v --version
+qemu-img --version
+qemu-nbd --version
+qemu-io --version
+nbdkit vddk --dump-plugin libdir=/opt/vmware/vmware-vix-disklib-distrib
+```
+
+For Windows guests, install a `virtio-win` package or otherwise make the
+VirtIO drivers available to virt-v2v. Some EL8 environments provide this from
+an additional repository rather than the base distribution repositories.
+
+Distribution `virtio-win` packages can lag the upstream project and omit
+drivers for recent Windows releases. `virt-v2v` treats missing drivers as a
+non-fatal warning and would deliver a guest that cannot boot from its VirtIO
+disk, so both the cold import and the CBT cutover conversion **fail fast
+instead**. When `virt-v2v` reports that no VirtIO drivers are available, the
+operation is aborted and identifies the conversion host's
+`/usr/share/virtio-win/virtio-win.iso` as the file to update. Install the
+upstream `latest-virtio` ISO on every conversion host:
+
+```bash
+curl -L -o /usr/share/virtio-win/virtio-win.iso \
+    https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/latest-virtio/virtio-win.iso
+```
+
+Windows Server 2025 additionally rejects the optional `smbus` driver's
+signature at first boot, which loops the virt-v2v firstboot driver
+installation forever; rebuild the ISO without `smbus.inf`/`smbus.cat` before
+converting Windows Server 2025 guests (the admin guide page "Importing VMware
+VMs into KVM" carries the exact commands). Older Windows releases work with
+the unmodified ISO.
+
+### Guest CPU model for Windows 11 and Windows Server 2025
+
+Those releases require CPU features that the KVM agent's default guest CPU
+model (`qemu64`) does not expose. The conversion itself is unaffected — the
+disks convert, the drivers install, the imported instance starts and reaches
+its UEFI firmware — but the guest then drops into *Preparing Automatic Repair*
+instead of the login screen, on every boot. Nothing in the migration output
+indicates a problem, so it reads like a corrupt image.
+
+Set a modern named model on every KVM host that will run such guests, in
+`/etc/cloudstack/agent/agent.properties`, and restart the agent:
+
+```
+guest.cpu.mode=custom
+guest.cpu.model=<a model your hosts support>
+```
+
+The model has to be one the host can actually provide, and that differs by
+processor vendor and generation — `Broadwell-noTSX-IBRS` or newer on Intel,
+`EPYC-IBPB` or newer on AMD. Check before setting it:
+
+```bash
+virsh domcapabilities | grep "usable='yes'"
+```
+
+A model reported as `usable='no'` is refused at domain start with *"the CPU is
+incompatible with host CPU: Host CPU does not provide required features"*, and
+the instance never launches — including system VMs, if the host is the one
+running them. In a cluster, pick a model every host reports as usable so live
+migration stays possible.
+
+`guest.cpu.mode=host-model` and `host-passthrough` also work and need no such
+check, but they tie the instance to the host's CPU and prevent live migration
+between hosts with different processors.
+
+This applies equally to instances deployed natively on KVM — it is a host
+prerequisite for the guest OS, not a property of the migration.
+
+If the nbdkit VDDK plugin package conflicts with the installed nbdkit module
+stream, align the enabled AppStream or vendor repository so `nbdkit` and the
+VDDK plugin come from compatible builds.
+
+## Ubuntu 24.04 host packages
+
+On Ubuntu 24.04, the base KVM and conversion packages are available from the
+standard repositories, but the nbdkit VDDK plugin is not necessarily provided by
+the default Ubuntu archive. Plan for an internal package, a vendor-provided
+package, or a locally built nbdkit VDDK plugin.
+
+Example base package installation:
+
+```bash
+apt-get update
+apt-get install -y cloudstack-agent
+apt-get install -y qemu-utils qemu-system-x86 libvirt-daemon-system libvirt-clients
+apt-get install -y virt-v2v nbdkit libguestfs-tools libnbd-bin
+```
+
+Then install or build the nbdkit VDDK plugin and verify:
+
+```bash
+nbdkit vddk --dump-plugin libdir=/opt/vmware/vmware-vix-disklib-distrib
+```
+
+`qemu-img` and `qemu-nbd` are provided by `qemu-utils` on Ubuntu 24.04.
+
+For Windows guests, ensure a `virtio-win` package or equivalent VirtIO driver
+bundle is available. The KVM agent check looks for a package named
+`virtio-win` on Debian-based hosts, so an internal package with that name is
+the easiest way to satisfy the current check. The upstream-ISO, `smbus` and
+guest CPU model notes above apply here as well.
+
+## Network and VMware requirements
+
+The selected KVM migration host must be able to reach:
+
+* vCenter HTTPS, normally TCP 443.
+* ESXi hosts used for VDDK/NFC access, commonly TCP 902 for NFC paths.
+* Any network paths required by the selected VDDK transport mode.
+* The destination primary storage backend.
+
+The VMware account used for migration must be able to discover the VM, create
+and remove snapshots, read virtual disk data, and query changed disk areas.
+
+VMware CBT must be enabled and valid for the source VM disks before incremental
+cycles can be trusted. A full resync is required when VMware invalidates CBT
+state, for example after CBT reset, certain disk changes, failed snapshot
+consolidation, or storage operations that change disk backing identity.
+
+Avoid or explicitly handle VMware disk types that do not participate cleanly in
+CBT, such as independent disks and unsupported raw device mappings.
+
+## Guest identity, firmware and network defaults derived from the source
+
+Both the cold import and the CBT warm migration derive sensible defaults from
+the source VM instead of falling back to generic import defaults. Everything
+below applies only when the caller did not specify the value explicitly -
+operator-provided parameters always win.
+
+* **Guest OS type** is resolved from the source's configured identity
+  (`config.guestFullName` / `config.guestId`, available regardless of power
+  state). Windows releases newer than the guest OS catalog map to the nearest
+  older entry of the same family (for example Windows Server 2025 maps to the
+  Windows Server 2022 type until the catalog catches up); the mapped type
+  keeps Windows clock and Hyper-V enlightenment semantics correct on KVM.
+* **Firmware** follows the source: a UEFI source gets the `UEFI` setting
+  (`SECURE` when the source has secure boot enabled) and the `q35` machine
+  type. Previously every import defaulted to BIOS, which leaves a UEFI
+  source's GPT/EFI disk unbootable.
+* **Console video** for Windows guests is set to `vga`; the libvirt default
+  (legacy cirrus) renders a blank console on Windows Server 2025 Server Core.
+* **Static IPv4 preservation**: while the source runs, per-NIC addresses,
+  the subnet's default gateway and the DNS servers are captured from VMware
+  Tools. A NIC that is mapped to a CloudStack network without an explicit
+  `nicipaddresslist` entry keeps its guest-configured address when that
+  address fits the target network's CIDR, is not the gateway and is free;
+  otherwise the NIC falls back to normal allocation. DHCP NICs are untouched
+  and pick up the virtual router's lease after migration. Capture requires
+  VMware Tools running in the source, which the warm flow guarantees (the
+  source is live when the migration starts).
+
+## Validation checklist
+
+Run this checklist on every candidate KVM migration host:
+
+```bash
+virt-v2v --version
+qemu-img --version
+qemu-nbd --version
+qemu-io --version
+nbdkit vddk --dump-plugin libdir=/opt/vmware/vmware-vix-disklib-distrib
+test -f /opt/vmware/vmware-vix-disklib-distrib/lib64/libvixDiskLib.so
+systemctl restart cloudstack-agent
+```
+
+Then confirm the host details from the CloudStack API or UI show:
+
+```text
+host.vddk.support=true
+host.vddk.blockcopy.support=true
+host.vddk.blockcopy.inplace.finalization.support=<true-or-false>
+host.vddk.blockcopy.rbd.support=<true-or-false>
+host.qemu.img.version=<detected>
+host.qemu.nbd.version=<detected>
+host.qemu.io.version=<detected>
+host.virtv2v.version=<detected>
+```
+
+If `host.vddk.blockcopy.support` is false, check the agent log on the KVM host
+and validate each command above manually. In-place and RBD capability can be
+false on hosts intended only for QCOW2 fallback, but those hosts are not
+eligible for RBD or LINSTOR cutover.
+
+## Operational notes
+
+* Prefer `nbdssl` or another encrypted VDDK transport where supported.
+* Run migrations from hosts with fast access to destination primary storage.
+* Keep enough temporary space for virt-v2v and libguestfs scratch data; use
+  `convert.instance.env.tmpdir` and `convert.instance.env.virtv2v.tmpdir` when
+  the default temporary filesystem is too small.
+* Use the current quiet-cycle settings to avoid cutting over while the source
+  VM is still producing a high dirty rate.
+* Increase `vmware.cbt.migration.agent.command.timeout` before migrating very
+  large VMs if the baseline copy or cutover finalization can exceed 24 hours.
+* Always clean up VMware snapshots after failed or cancelled cycles.
+* Treat CBT change IDs as per-disk state. If any disk loses valid CBT state,
+  restart that disk from a full sync.
+* On Linstor destinations, prefer a conversion host that holds a diskful
+  replica of the target resources; writes from a diskless satellite traverse
+  the DRBD replication network. DRBD rounds volume sizes up to its extent
+  granularity, so target devices can be slightly larger than the source
+  disks; qemu writes only within the source capacity.
+* Linstor storage-pool heartbeats can fence (reboot) an HA-enabled KVM host if
+  the LINSTOR controller becomes unreachable. Prefer conversion hosts that do
+  not run HA-protected guests, or ensure controller availability for the whole
+  duration of long migrations.
+* Migrated Linstor volumes keep their migration-time names (the LINSTOR
+  resource is `cs-` plus the recorded volume path, e.g. `cs-cbt-<marker>-<disk>`
+  for warm migrations). This is expected and does not affect volume lifecycle
+  operations, which address volumes by their recorded path.
diff --git a/docs/vmware-cbt/README.md b/docs/vmware-cbt/README.md
new file mode 100644
index 000000000000..b9d745750e1a
--- /dev/null
+++ b/docs/vmware-cbt/README.md
@@ -0,0 +1,1550 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# VMware CBT Migration Implementation Notes
+
+## Introduction
+
+This document describes the VMware Changed Block Tracking (CBT) migration design
+and implementation for Apache CloudStack 24.0.0. It is written as source material
+for an Apache CloudStack CWIKI architecture page and should be treated as an
+implementation guide, not only as a design sketch.
+
+The feature provides a warm VMware-to-KVM migration flow. CloudStack creates a
+KVM-side source-equivalent disk replica from a VMware VDDK snapshot, keeps that
+replica current with one or more VMware CBT delta cycles, requires the operator
+to power off the VMware source VM, runs one final CBT delta cycle, finalizes the
+replica with `virt-v2v`, and imports the finalized disk(s) as a regular
+CloudStack KVM VM.
+
+The essential architectural point is that VMware CBT migration is a two-phase
+disk strategy:
+
+- Phase 1 keeps a KVM-side source-equivalent replica current using VDDK and
+  VMware CBT.
+- Phase 2 finalizes the fully synchronized replica with `virt-v2v` only after
+  the source VM is powered off.
+
+This gives CloudStack warm migration behavior without trying to apply VMware
+changed blocks to a disk that has already been transformed for KVM, and without
+requiring a second full VMware read at cutover time.
+
+## Problem Statement
+
+The existing VMware import paths are useful for one-time imports, but they do
+not provide a warm migration loop where the target disk is kept current while
+the source VM continues to run on VMware. Large VMs therefore either require a
+longer downtime window or repeated full-copy style attempts.
+
+VMware CBT provides the changed-block metadata needed for a replication-style
+workflow, but the design must avoid a common trap: once `virt-v2v` modifies a
+disk for KVM guest bootability, VMware CBT byte ranges can no longer be safely
+applied to that transformed disk. The implementation must therefore keep the
+replication target source-equivalent until final cutover, then run guest
+conversion only after the final delta is applied.
+
+## Goals
+
+- Provide an operator-driven warm migration flow from VMware to CloudStack KVM.
+- Support both existing registered vCenter records and external vCenter details
+  supplied during import.
+- Run the initial full copy once through VDDK and `qemu-img`.
+- Apply subsequent VMware CBT delta cycles to the KVM-side replica.
+- Make long-running start, sync, and cutover operations asynchronous.
+- Keep migration progress visible through list APIs and the UI migration table.
+- Validate destination storage, host capabilities, and compute offering sizing
+  before expensive work starts.
+- Persist external vCenter credentials only through CloudStack encrypted DAO
+  fields and never expose passwords in API responses.
+- Reuse the existing CloudStack converted-VM import path after cutover
+  finalization.
+
+## Scope
+
+Current implementation scope:
+
+- Target hypervisor: KVM.
+- Source hypervisor: VMware through VDDK and VMware CBT.
+- Admin API surface for preflight, start, list, sync, cutover, cancel, and
+  delete.
+- Async API execution for long-running start, sync, and cutover operations.
+- Management-server state model for migrations, disks, and delta cycles.
+- External vCenter credential persistence for long-lived UI sessions, encrypted
+  with CloudStack DAO encryption.
+- KVM agent wrappers for initial VDDK full sync, delta block copy, cutover
+  finalization, and cleanup.
+- Filesystem-like primary storage target support using QCOW2 files.
+- Ceph/RBD primary storage target support using raw RBD images.
+- Non-in-place `virt-v2v` fallback for QCOW2 file targets, gated by global
+  configuration.
+- Early compute-offering validation against discovered VMware VM CPU and memory.
+- Dynamic/custom service offering support through the same `details` keys used
+  by the existing OVF/VDDK import flow.
+- UI integration in the Import/Export Instances area, including job polling and
+  table auto-refresh while CBT migrations are active.
+
+## Non-Goals
+
+Not implemented or intentionally blocked:
+
+- Non-in-place `virt-v2v` fallback for Ceph/RBD targets. RBD targets require
+  in-place finalization because fallback produces local QCOW2 files.
+- Automatic source VM shutdown during cutover.
+- Continuous byte-level progress from `qemu-img convert`. The UI currently
+  receives state transitions, disk target paths, delta cycle byte counts, dirty
+  rates, and cycle descriptions through the list API.
+- Applying CBT deltas to a guest-converted disk.
+- Replacing the existing OVF/VDDK one-time import flows.
+
+## Key Principles
+
+- CloudStack does not power off the VMware source VM automatically. The
+  operator must shut it down before final cutover.
+- CloudStack does not store vCenter passwords in clear text.
+- Initial sync and delta sync keep the target disk source-equivalent.
+- `virt-v2v` runs only at finalization, after the final CBT delta cycle.
+- The final `virt-v2v` work is local to the KVM-side replica and does not
+  perform a second full VMware read.
+- The detailed status source is `listVmwareCbtMigrations`, not only the async
+  job result.
+- Failed final import after successful finalization is retryable through the
+  `ReadyForImport` state.
+
+## High-Level Architecture
+
+The implementation has four main layers:
+
+- CloudStack management-server APIs and orchestration.
+- CloudStack database state for migration sessions, source disks, and delta
+  cycles.
+- KVM agent commands that perform VDDK reads, QCOW2 or raw RBD writes,
+  `virt-v2v` finalization, and cleanup.
+- UI workflow in the Import/Export Instances area.
+
+Management-server API and orchestration:
+
+- `StartVmwareCbtMigrationCmd`
+- `CheckVmwareCbtMigrationPrerequisitesCmd`
+- `ListVmwareCbtMigrationsCmd`
+- `SyncVmwareCbtMigrationCmd`
+- `CutoverVmwareCbtMigrationCmd`
+- `CancelVmwareCbtMigrationCmd`
+- `DeleteVmwareCbtMigrationCmd`
+- `VmwareCbtMigrationManagerImpl`
+- `VmwareCbtStorageTarget`
+- `VmwareCbtMigrationCutoverPolicy`
+
+Persistence:
+
+- `cloud.vmware_cbt_migration`
+- `cloud.vmware_cbt_migration_disk`
+- `cloud.vmware_cbt_migration_cycle`
+
+KVM agent wrappers:
+
+- `LibvirtVmwareCbtPrepareCommandWrapper`
+- `LibvirtVmwareCbtSyncCommandWrapper`
+- `LibvirtVmwareCbtCutoverCommandWrapper`
+- `LibvirtVmwareCbtCleanupCommandWrapper`
+
+UI:
+
+- `ui/src/views/tools/ImportUnmanagedInstance.vue`
+- `ui/src/views/tools/ManageInstances.vue`
+- `ui/src/views/tools/VmwareCbtMigrations.vue`
+
+## Architecture Diagrams
+
+The diagrams below are intentionally plain text so they can be pasted directly
+into Apache CWIKI source and remain editable.
+
+### End-To-End CBT Flow
+
+```text
+VMware source VM
+     |
+     | VMware snapshot + CBT metadata
+     v
+VDDK / nbdkit-vddk on KVM conversion host
+     |
+     | Initial baseline: full logical disk read
+     v
+CloudStack primary storage
+     |
+     | Source-equivalent replica
+     |   - qcow2 file on filesystem-like storage
+     |   - raw RBD image on Ceph/RBD storage
+     v
+Delta sync cycles
+     |
+     | CBT changed ranges only
+     v
+Operator powers off source VM
+     |
+     | Cutover: final delta + virt-v2v finalization
+     v
+CloudStack KVM VM
+```
+
+### Initial Sync Transfer Behavior
+
+VMware CBT initial sync is not guest-filesystem-used-space-oriented. CloudStack
+does not inspect the guest filesystem to decide which files are in use; it reads
+the disk image exposed by VDDK/NBD and writes the target replica.
+
+The amount of data transferred depends on what VDDK exposes for the source disk
+and datastore. Some source paths expose the baseline as one allocated logical
+range, while others expose sparse `hole,zero` extents. The destination can remain
+thin or sparse when the source and copy path expose zero ranges correctly, but
+operators must size the initial-copy window for the full logical disk capacity.
+
+The KVM agent uses `qemu-img convert` for the general full-copy path. When
+`nbdcopy` is installed, it can accelerate supported pre-created raw targets and
+RBD targets served through a local `qemu-nbd` bridge. `nbdcopy` is optional;
+capability and correctness do not depend on it.
+
+```text
+Example VMware disk capacity: 5 GiB
+Guest-used data:              near 0 GiB
+Datastore/path behavior:      datastore-dependent
+
+During initial sync:
+  VMware/VDDK exposes allocation/extents to NBD.
+  CloudStack reads the ranges that qemu sees through that NBD export.
+  qemu-img writes a qcow2 target and can preserve thin/sparse output.
+
+Possible outcome:             full logical transfer or sparse-aware transfer
+Target allocation:            backend- and extent-dependent
+```
+
+### Linked Clone And Full Clone Baselines
+
+The initial baseline reads the logical disk presented by VDDK. Linked clone vs
+full clone is not enough by itself to predict transfer volume. The decisive
+question is whether VDDK/NBD exposes trustworthy allocation and zero extents for
+the source datastore and disk chain.
+
+```text
+Linked clone source
+  child delta VMDK
+       |
+       v
+  parent/base VMDK chain
+       |
+       v
+  VDDK presents one logical disk
+
+Full clone source
+  single/full VMDK
+       |
+       v
+  VDDK presents one logical disk
+
+CBT initial sync:
+  both are read as the full logical disk capacity.
+  The target qcow2 can still be sparse/thin after the write.
+```
+
+### Delta Sync And Cutover Eligibility
+
+```text
+Initial sync completed
+        |
+        v
+Delta cycle 1 -> changed bytes / dirty rate measured
+        |
+        v
+Delta cycle 2 -> quiet-cycle counters updated
+        |
+        v
+Repeat until one boundary is met:
+
+  min cycles satisfied
+  AND quiet bytes threshold satisfied
+  AND quiet dirty-rate threshold satisfied
+  AND quiet cycle count satisfied
+
+OR
+
+  max cycle count reached
+
+        |
+        v
+Migration becomes ReadyForCutover
+```
+
+### Cutover Finalization Paths
+
+```text
+Final CBT delta sync
+      |
+      v
+Check selected conversion host capability
+      |
+      +--> virt-v2v-in-place available
+      |        |
+      |        v
+      |   run virt-v2v-in-place finalization
+      |
+      +--> virt-v2v supports --in-place
+      |        |
+      |        v
+      |   run virt-v2v --in-place finalization
+      |
+      +--> non-in-place fallback explicitly allowed
+               |
+               v
+          run regular virt-v2v -o local fallback finalization
+
+Result:
+  finalized qcow2 moved to primary storage root
+  VM imported with VirtIO root disk controller
+```
+
+### Final Disk Placement
+
+```text
+During sync:
+  /mnt/<pool-uuid>/cloudstack-cbt/<migration-uuid>/...
+
+After finalization/import:
+  /mnt/<pool-uuid>/<generated-volume-uuid>.qcow2
+
+CloudStack DB target path:
+  updated to the final primary-storage-root location
+```
+
+## End-To-End Flow
+
+### 1. Preflight
+
+`checkVmwareCbtMigrationPrerequisites` validates the source and destination
+before a long-running job is started. The command is synchronous and returns a
+structured preflight response with pass, warn, and fail findings.
+
+The preflight checks include:
+
+- Destination zone and KVM cluster lookup.
+- Destination primary storage lookup or implicit pool selection.
+- Storage target classification.
+- KVM conversion host selection.
+- Host VMware CBT capability checks.
+- Host in-place finalization capability checks.
+- Host qemu RBD capability checks and an active temporary RBD create/write/read/delete
+  probe when the selected primary storage is Ceph/RBD.
+- vCenter source resolution, either by `existingvcenterid` or external
+  vCenter fields.
+- Source VM discovery.
+- Source VM CBT support.
+- Source VM CBT enabled state.
+- Source VM consolidation-needed state.
+- Existing VMware snapshot count.
+- Source disk discovery.
+- Windows guest conversion dependency check on the selected KVM conversion host
+  when the source VM is a Windows guest.
+- Optional compute offering sizing validation.
+
+The preflight response includes, among other fields:
+
+- `ready`
+- `storagewritertype`
+- `storagewritersupported`
+- `storagerequiresinplacefinalization`
+- `convertinstancehostinplacefinalizationsupported`
+- `noninplacefinalizationfallbackallowed`
+- `noninplacefinalizationfallbacksupported`
+- `sourcecpunumber`
+- `sourcecpuspeed`
+- `sourcememory`
+- `sourceguestosid`
+- `sourceguestos`
+- `disk`
+- `finding`
+
+If CBT is supported but not enabled, preflight reports a warning. The start
+path can enable CBT before creating the baseline snapshot.
+
+The source guest OS fields are populated from the VMware inventory and are used
+to decide whether Windows-specific conversion prerequisites apply. They do not
+change the migration mode or disk-copy behavior by themselves.
+
+### Guest OS Mapping And Source OS Labels
+
+VMware exposes more than one guest OS signal. The VM's configured guest OS
+option can differ from the runtime guest OS label reported by VMware Tools. For
+example, a powered-on VM can show `Ubuntu Linux (64-bit)` in the vSphere summary
+while VM Options still show `Other (64-bit)`. CloudStack discovery and preflight
+therefore treat source guest OS values as inventory facts rather than as a safe
+automatic target OS selection.
+
+The target CloudStack guest OS is the optional `osid` supplied to
+`startVmwareCbtMigration` and used later by the shared KVM import path. Operators
+should verify this value before starting migration, especially for generic VMware
+guest IDs such as `ubuntu64Guest`, which can represent multiple Ubuntu releases.
+If the desired target guest OS is not selectable, the corresponding
+`guest_os_hypervisor` mapping must exist for the source hypervisor version.
+
+### 2. Start And Initial Full Sync
+
+`startVmwareCbtMigration` is async. It creates the migration record, persists
+source disk rows, creates a baseline VMware snapshot, prepares target paths, and
+dispatches the initial full sync to the selected KVM host.
+
+For Windows source VMs, the start path repeats the same conversion dependency
+check reported by preflight before the baseline snapshot and initial sync are
+started. This prevents a long CBT copy from producing a disk that cannot be made
+bootable because the selected KVM conversion host is missing `virtio-win`.
+
+State transitions:
+
+- `Created`
+- `InitialSync`
+- `Replicating` when the initial VDDK full sync completes successfully
+- `Failed` if any initial copy or metadata step fails
+
+Important implementation details:
+
+- For filesystem-like storage, target paths are prepared before dispatch and
+  are shown in API/UI while the sync is running.
+- Default target path pattern with explicit primary storage:
+  `/mnt/<storage-pool-uuid>/cloudstack-cbt/<migration-uuid>/<disk>.qcow2`
+- Default target path pattern without explicit pool:
+  `/var/lib/libvirt/images/cloudstack-cbt/<migration-uuid>/<disk>.qcow2`
+- The agent writes the vCenter password to a temporary password file and passes
+  it to `nbdkit` as `password=+<file>`.
+- After successful copy, management refreshes and records the baseline disk
+  `changeId` values from the VMware snapshot.
+- The baseline snapshot is removed after the initial sync attempt when possible.
+
+### 3. Delta Synchronization
+
+`syncVmwareCbtMigration` is async and serialized by migration ID through
+`BaseAsyncCmd.migrationSyncObject`.
+
+Allowed migration states:
+
+- `Replicating`
+- `ReadyForCutover`
+
+Delta cycle sequence:
+
+1. Create a new `vmware_cbt_migration_cycle` row.
+2. Create a VMware snapshot for the cycle.
+3. Query VMware CBT changed disk areas from the previous per-disk `changeId`.
+4. Persist cycle state as `QueryingChangedAreas`, then `CopyingChangedBlocks`.
+5. Send changed block ranges to the KVM agent.
+6. Agent copies only those ranges from the VDDK NBD source into the target
+   replica.
+7. Management records changed bytes, duration, dirty rate, and the next
+   per-disk `changeId`.
+8. The cycle snapshot is removed when possible.
+9. The cutover policy decides whether to remain in `Replicating` or move to
+   `ReadyForCutover`.
+
+The cycle response exposes:
+
+- `cyclenumber`
+- `snapshotmor`
+- `changedbytes`
+- `dirtyrate`
+- `duration`
+- `state`
+- `description`
+- `created`
+- `lastupdated`
+
+Delta sync progress is represented as state and cycle metadata rather than a
+streamed progress bar. While a cycle is running, the row description can show
+what the manager knows, for example that changed areas are being queried or
+that a number of ranges has been dispatched. After the agent returns, the cycle
+shows copied bytes, dirty rate, duration, and a textual summary.
+
+### 4. Cutover
+
+`cutoverVmwareCbtMigration` is async and serialized by migration ID.
+
+Allowed migration states:
+
+- `ReadyForCutover`
+- `ReadyForImport`
+
+Cutover requires the source VM to be powered off. CloudStack checks the VMware
+power state and rejects cutover if the source VM is still powered on:
+
+```text
+Cannot cut over VMware CBT migration <uuid> while source VM <name> is in power state PowerOn.
+Gracefully shut down the source VM, then retry cutover.
+```
+
+CloudStack does not attempt a graceful shutdown or power-off. The operator must
+shut down the VMware source VM before final cutover. This avoids surprising the
+operator and avoids needing to encode site-specific guest shutdown policy in the
+migration path.
+
+Cutover sequence:
+
+1. Verify source VM is powered off.
+2. Set migration state to `CuttingOver`.
+3. Run a final CBT delta sync while the VM is off.
+4. Run `virt-v2v` finalization on the KVM host.
+5. Move finalized disk files to the primary storage root with generated UUID
+   names, then update disk target paths from the agent result.
+6. Set state to `ReadyForImport`.
+7. Call the shared external KVM VM import path.
+8. On success, set state to `Completed`, store the new CloudStack VM ID, and
+   clear stored external vCenter credentials.
+9. On import failure, keep state as `ReadyForImport` so the operator can retry
+   cutover to repeat only the import step against already finalized disks.
+
+### 5. Cancel And Delete
+
+`cancelVmwareCbtMigration` is synchronous. If the migration is not terminal, it
+sends a best-effort cleanup command, marks the migration `Cancelled`, and clears
+stored external vCenter credentials.
+
+`deleteVmwareCbtMigration` is synchronous. It is allowed for `Failed`,
+`Cancelled`, and `Completed` migrations. With `cleanup=true` (the default), it
+sends a cleanup command before deleting failed or cancelled child rows and the
+parent row. `Completed` migration deletion is always record-only: CloudStack
+removes the CBT bookkeeping rows but never deletes the imported VM, CloudStack
+volumes, finalized target disks, or primary-storage files.
+
+Deletion behavior:
+
+- Deletes `vmware_cbt_migration_cycle` rows.
+- Deletes `vmware_cbt_migration_disk` rows.
+- Deletes the `vmware_cbt_migration` row.
+- Clears stored source credentials before row removal.
+- For `Failed` or `Cancelled` rows, cleans target files only if the paths are
+  under the migration-specific `/cloudstack-cbt/<migration-uuid>/` directory
+  and cleanup is enabled. For RBD targets, cleanup removes only temporary RBD
+  image names containing the CloudStack-owned `cloudstack-cbt-<migration-uuid>-`
+  marker.
+- For `Completed` rows, ignores cleanup and removes only CBT migration records.
+- Skips immediate cleanup if another active migration is running on the same
+  conversion host, to avoid disturbing active agent-side work.
+
+The KVM cleanup wrapper resolves migration directories from disk target paths
+and removes only the migration-specific directory tree for file targets. For RBD
+targets it uses the destination storage pool and deletes only marked temporary
+images, never arbitrary RBD images.
+
+## Conversion Model: One VMware Baseline Read
+
+The feature deliberately separates replication from final conversion.
+
+Initial full sync does not run `virt-v2v`. The KVM agent opens the VMware source
+snapshot through `nbdkit` with the VDDK plugin. Filesystem-like primary storage
+writes QCOW2 with `qemu-img convert`:
+
+```text
+nbdkit -r -U - vddk ... --run \
+  'qemu-img convert -f raw -O qcow2 "$uri" "<targetPath>"'
+```
+
+Ceph/RBD primary storage is a raw RBD image. When `nbdcopy` is available, the
+agent pre-creates the image, exposes it through a temporary local `qemu-nbd`
+bridge, and copies NBD to NBD. Otherwise it uses `qemu-img convert` directly
+against the qemu RBD URL. LINSTOR similarly uses `nbdcopy` when available for
+its pre-created raw DRBD device and falls back to `qemu-img convert`.
+
+Example RBD fallback path:
+
+```text
+nbdkit -r -U - vddk ... --run \
+  'qemu-img convert -f raw -O raw "$uri" "rbd:<pool>/<image>:..."'
+```
+
+This produces a source-equivalent replica on the selected primary storage. It
+is not yet a CloudStack-imported VM disk. It is a replication target that can
+safely receive raw changed blocks from later CBT cycles.
+
+Delta sync also does not run `virt-v2v`. Management creates a VMware snapshot,
+queries changed disk areas using VMware CBT metadata, and dispatches changed
+byte ranges to the KVM agent. The agent opens the snapshot through `nbdkit`,
+parses the temporary nbdkit Unix socket from the NBD URI, uses `qemu-img
+convert --image-opts` to materialize bounded raw chunks for only the changed
+ranges, and patches the replica with `qemu-io`. File targets use `-f qcow2`;
+RBD targets use `-f raw` against the qemu RBD URL for the target image.
+
+Final cutover is where `virt-v2v` runs. After the source VM is powered off, the
+manager runs one final CBT delta cycle so the replica is current. Then the agent
+runs one of the finalization paths:
+
+- `virt-v2v-in-place`, when available.
+- `virt-v2v --in-place`, when the installed `virt-v2v` supports it.
+- Regular `virt-v2v -o local`, only when the non-in-place fallback is explicitly
+  enabled and the target is a QCOW2 file target.
+
+Ceph/RBD targets require one of the in-place finalization paths. They do not
+allow non-in-place fallback because fallback creates local QCOW2 output rather
+than modifying the raw RBD image that CloudStack will import.
+
+So there is not a second full VMware read during finalization. The final
+`virt-v2v` step is local work against the up-to-date KVM-side replica. It may
+still require local storage reads and writes, especially in fallback mode, but
+it is not another VDDK full copy from vCenter.
+
+The initial baseline may read up to the full logical VMware disk range,
+regardless of guest filesystem usage. This does not imply thick allocation on
+the destination: QCOW2, RBD, and LINSTOR can remain sparse or thin when the
+source and copy path expose zero ranges correctly. Delta cycles are CBT-range
+based and copy only changed ranges.
+
+This design avoids applying future CBT raw block deltas to a disk that has
+already been modified by `virt-v2v`. Applying VMware CBT ranges to a converted
+guest disk would be unsafe because the layout no longer represents the source
+VMware disk byte-for-byte.
+
+## API Changes
+
+All commands are admin-only.
+
+### `checkVmwareCbtMigrationPrerequisites`
+
+Synchronous preflight command.
+
+Required:
+
+- `zoneid`
+- `clusterid`
+- `sourcevmname`
+
+Source vCenter selection:
+
+- Existing registered vCenter: `existingvcenterid`
+- External vCenter: `vcenter`, `datacentername`, `username`, `password`
+
+Optional:
+
+- `hostip`
+- `clustername`
+- `convertinstancehostid`
+- `convertinstancestoragepoolid`
+- `serviceofferingid`
+- `details`
+
+The command has `requestHasSensitiveInfo=true` because external vCenter
+credentials can be provided.
+
+### `startVmwareCbtMigration`
+
+Async command. Starts the migration and initial full sync.
+
+Required:
+
+- `zoneid`
+- `clusterid`
+- `serviceofferingid`
+- `sourcevmname`
+
+Source vCenter selection:
+
+- Existing registered vCenter: `existingvcenterid`
+- External vCenter: `vcenter`, `datacentername`, `username`, `password`
+
+Optional import inputs:
+
+- `displayname`
+- `hostname`
+- `account`
+- `domainid`
+- `projectid`
+- `templateid`
+- `osid`
+- `datadiskofferinglist`
+- `nicnetworklist`
+- `nicipaddresslist`
+- `forced`
+
+Optional conversion inputs:
+
+- `convertinstancehostid`
+- `convertinstancestoragepoolid`
+- `details`
+
+If `convertinstancestoragepoolid` is omitted, CloudStack auto-selects the only
+CBT-compatible primary storage pool in the destination cluster/zone. Supported
+target pool types are `NetworkFilesystem`, `Filesystem`, `SharedMountPoint`,
+and `RBD`. If more than one compatible pool is available, the operator must
+provide the pool explicitly.
+
+Useful `details` keys:
+
+- `vddk.lib.dir`
+- `vddk.transports`
+- `vddk.thumbprint`
+- `cpuNumber`
+- `cpuSpeed`
+- `memory`
+
+The command has `requestHasSensitiveInfo=true` and
+`responseHasSensitiveInfo=false`.
+
+### `listVmwareCbtMigrations`
+
+Synchronous status command and the main progress source for UI and automation.
+
+Filters:
+
+- `id`
+- `zoneid`
+- `accountid`
+- `vcenter`
+- `sourcevmname`
+- `state`
+
+The response includes migration-level state, current step, current step
+duration, last error, cycle counters, changed byte totals, disks, and cycles.
+`currentstepduration` is populated for non-terminal migrations and is intended
+for the UI table marker similar to Import VM Tasks.
+
+### `syncVmwareCbtMigration`
+
+Async command. Runs one delta sync cycle.
+
+Required:
+
+- `id`
+
+Optional:
+
+- `username`
+- `password`
+
+For an external vCenter migration, stored credentials are used when available.
+If override credentials are supplied, both username and password must be
+provided. Overrides are stored back to the migration so a UI operator can return
+later and continue syncing.
+
+### `cutoverVmwareCbtMigration`
+
+Async command. Runs final powered-off sync, finalizes disks, and imports the VM.
+
+Required:
+
+- `id`
+
+Optional:
+
+- `username`
+- `password`
+
+The command fails early if the source VMware VM is not powered off.
+
+### `cancelVmwareCbtMigration`
+
+Synchronous command.
+
+Required:
+
+- `id`
+
+Cancels a non-terminal migration, attempts cleanup, and clears stored external
+source credentials.
+
+### `deleteVmwareCbtMigration`
+
+Synchronous command.
+
+Required:
+
+- `id`
+
+Optional:
+
+- `cleanup` (default `true`)
+
+Allowed for `Failed`, `Cancelled`, and `Completed` migrations. Completed
+migration deletes are record-only and never remove the imported CloudStack VM,
+volumes, finalized target disks, or primary-storage files.
+
+## Configuration And Cutover Policy
+
+The cutover recommendation is based on global settings:
+
+| Global setting | Default | Meaning |
+| --- | ---: | --- |
+| `vmware.cbt.migration.min.cycles` | `1` | Minimum number of manual/API delta cycles that must complete before quiet-cycle readiness can make the migration eligible for cutover. |
+| `vmware.cbt.migration.max.cycles` | `5` | Maximum number of manual/API delta cycles before CloudStack marks the migration ready for cutover even if the quiet-cycle thresholds were not met. |
+| `vmware.cbt.migration.quiet.cycles` | `2` | Number of consecutive quiet cycles required before CloudStack marks the migration ready for cutover. |
+| `vmware.cbt.migration.quiet.bytes` | `1073741824` | Maximum changed bytes in one cycle for that cycle to be considered quiet. The default is 1 GiB. |
+| `vmware.cbt.migration.quiet.dirty.rate` | `16777216` | Maximum changed bytes per second for that cycle to be considered quiet. The default is 16 MiB/s. |
+| `vmware.cbt.migration.agent.command.timeout` | `86400` | Timeout in seconds for long-running VMware CBT data-plane commands on the KVM agent. This covers initial full sync, regular delta sync, final delta sync, and cutover finalization. The default is 24 hours. |
+
+The manager tracks:
+
+- Number of completed delta cycles.
+- Number of consecutive quiet cycles.
+- Last changed bytes.
+- Last dirty rate.
+- Total changed bytes.
+
+A cycle is quiet when its changed bytes and dirty rate are below the configured
+thresholds. Both thresholds must pass. For example, with defaults, a cycle that
+copies 1.2 GiB at 10 MiB/s is not quiet because the changed-byte threshold is
+exceeded even though the dirty-rate threshold passed.
+
+Once enough quiet cycles have accumulated, or once the maximum manual/API
+delta-cycle count is reached, the migration moves to `ReadyForCutover`.
+
+The operator can still manually run sync cycles while the migration is in
+`Replicating` or `ReadyForCutover`.
+
+The UI intentionally exposes the Cutover button only when the server-side
+migration state is exactly `ReadyForCutover`. Before that point the UI exposes
+Sync delta, because the server has not yet recommended final cutover. If a
+cutover is started, CloudStack creates one additional final CBT delta cycle
+inside the cutover operation. Therefore the final displayed cycle count can be
+one higher than `vmware.cbt.migration.max.cycles`: for example, five ordinary
+delta cycles can make the migration ready, and cutover can then record cycle 6
+as the final synchronization cycle.
+
+### Timeouts And Large VMs
+
+The long-running CBT work is done by KVM agent commands. CloudStack sets the
+agent command `wait` value from
+`vmware.cbt.migration.agent.command.timeout`, and the KVM wrappers use the same
+value as the timeout for child processes such as `nbdkit`, `qemu-img`, and
+`virt-v2v`.
+
+The timeout is finite by design. The shared CloudStack `Script` helper treats a
+zero timeout as its default one-hour timeout, so `0` is not a safe way to mean
+"run forever". For large source disks, tune the timeout above the expected
+worst-case duration. A rough estimate is:
+
+```text
+timeout_seconds >= source_bytes / expected_bytes_per_second * safety_factor
+```
+
+For example, a 1 TiB initial sync at 100 MiB/s is roughly 3 hours before
+overhead; at 25 MiB/s it is roughly 12 hours. The default 24-hour timeout is
+intended to be safe for large migrations while still
+protecting the agent from permanently stuck child processes.
+
+Related import settings that operators often notice are:
+
+| Global setting | Applies to CBT? | Default | Meaning |
+| --- | --- | ---: | --- |
+| `convert.vmware.instance.to.kvm.timeout` | No | `3` | OVF/VDDK import timeout, in hours, for the `ConvertInstanceCommand` virt-v2v path. CBT cutover has its own timeout because it uses CBT-specific agent commands. |
+| `remote.kvm.instance.disks.copy.timeout` | No | `30` | Remote KVM unmanaged import disk-copy timeout, in minutes. It is unrelated to VMware CBT. |
+
+If a CBT command exceeds `vmware.cbt.migration.agent.command.timeout`, the
+migration is marked failed with the agent error details in `last_error`.
+Failed or cancelled migration records can be deleted with cleanup enabled to
+remove CloudStack-owned `cloudstack-cbt/<migration-uuid>` working files.
+
+## Database Changes
+
+The feature targets the Apache CloudStack 24.0.0 release, so the schema changes
+are delivered through the canonical 4.23.0.0 to 24.0.0 upgrade path:
+
+- `engine/schema/src/main/resources/META-INF/db/schema-42300to2400.sql`
+- `engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42300to2400.java`
+
+### `cloud.vmware_cbt_migration`
+
+One row per migration session.
+
+Important columns:
+
+- `uuid`
+- `zone_id`
+- `account_id`
+- `user_id`
+- `vm_id`
+- `existing_vcenter_id`
+- `source_username`
+- `source_password`
+- `destination_cluster_id`
+- `convert_host_id`
+- `storage_pool_id`
+- `display_name`
+- `host_name`
+- `template_id`
+- `service_offering_id`
+- `guest_os_id`
+- `data_disk_offering_map`
+- `nic_network_map`
+- `nic_ip_address_map`
+- `import_details`
+- `forced`
+- `vcenter`
+- `datacenter`
+- `source_host`
+- `source_cluster`
+- `source_vm_name`
+- `vddk_lib_dir`
+- `vddk_transports`
+- `vddk_thumbprint`
+- `state`
+- `current_step`
+- `last_error`
+- `completed_cycles`
+- `quiet_cycles`
+- `total_changed_bytes`
+- `last_changed_bytes`
+- `last_dirty_rate`
+- `created`
+- `updated`
+- `removed`
+
+`source_password` is annotated with `@Encrypt` in `VmwareCbtMigrationVO`, using
+the same CloudStack encrypted DAO field mechanism used by VMware datacenter
+credentials and VM VNC passwords.
+
+### `cloud.vmware_cbt_migration_disk`
+
+One row per source VMware disk.
+
+Important columns:
+
+- `migration_id`
+- `source_disk_id`
+- `source_disk_device_key`
+- `source_disk_path`
+- `datastore_name`
+- `capacity_bytes`
+- `target_path`
+- `target_format`
+- `change_id`
+- `snapshot_moref`
+- `state`
+
+Disk states:
+
+- `Created`
+- `Prepared`
+- `Syncing`
+- `Ready`
+- `Failed`
+
+### `cloud.vmware_cbt_migration_cycle`
+
+One row per delta cycle.
+
+Important columns:
+
+- `migration_id`
+- `cycle_number`
+- `snapshot_moref`
+- `changed_bytes`
+- `dirty_rate`
+- `duration`
+- `state`
+- `description`
+
+Cycle states:
+
+- `Created`
+- `QueryingChangedAreas`
+- `CopyingChangedBlocks`
+- `Completed`
+- `Failed`
+
+## Migration State Machine
+
+Migration states:
+
+- `Created`
+- `InitialSync`
+- `Replicating`
+- `ReadyForCutover`
+- `CuttingOver`
+- `ReadyForImport`
+- `Completed`
+- `Failed`
+- `Cancelled`
+
+Terminal states:
+
+- `Completed`
+- `Failed`
+- `Cancelled`
+
+Normal successful path:
+
+```text
+Created
+  -> InitialSync
+  -> Replicating
+  -> ReadyForCutover
+  -> CuttingOver
+  -> ReadyForImport
+  -> Completed
+```
+
+`ReadyForImport` is intentionally retryable. If the final `virt-v2v`
+finalization succeeded but CloudStack VM import failed, the next cutover command
+does not rerun the final CBT copy and finalization. It retries the VM import
+against the already finalized disk paths.
+
+## Storage Target And Finalization
+
+`VmwareCbtStorageTarget` maps primary storage to a target writer:
+
+- `NetworkFilesystem`, `Filesystem`, and `SharedMountPoint` use `QCOW2_FILE`.
+- No explicit pool also uses a filesystem QCOW2 target under the default local
+  CBT path.
+- `RBD` maps to `RBD_RAW`. Initial sync writes a raw RBD image with `nbdcopy`
+  through a local NBD bridge when available, otherwise with
+  `qemu-img convert -O raw`. Delta sync writes changed ranges with `qemu-io -f
+  raw`, and cutover finalization is in-place only.
+- `Linstor` maps to `RAW_BLOCK_DEVICE`. The agent pre-creates each target
+  volume at source capacity through the Linstor storage adaptor (qemu cannot
+  create DRBD devices the way it creates RBD images), then the initial sync
+  writes the local DRBD device with `nbdcopy` when available or
+  `qemu-img convert -n -O raw` otherwise. Delta sync patches changed ranges
+  with `qemu-io -f raw` against the device path, and cutover finalization is
+  in-place only, using a plain `<disk type='block'>` libvirt XML (no qemu-nbd
+  bridges are needed for local block devices).
+  Target names are `cbt-<mig8>-<disk-id>` where `mig8` is the first eight
+  characters of the migration UUID: LINSTOR resource names ("cs-" + name) are
+  capped at 48 characters, so the RBD-style naming with the full migration
+  UUID does not fit; the short marker still guards cleanup on both the
+  management server and the agent. The conversion host must be a LINSTOR
+  satellite connected to the pool; host selection and the preflight storage
+  probe (create a 4 MiB volume, qemu-io write/read on the device, delete)
+  enforce this.
+- Other primary storage types are unsupported.
+
+For QCOW2 file targets, the initial replica is stored under the selected
+primary storage:
+
+```text
+/mnt/<pool-uuid>/cloudstack-cbt/<migration-uuid>/<disk>.qcow2
+```
+
+If no storage pool is selected, the fallback path is:
+
+```text
+/var/lib/libvirt/images/cloudstack-cbt/<migration-uuid>/<disk>.qcow2
+```
+
+For Ceph/RBD targets, the initial replica is a raw RBD image in the selected
+pool:
+
+```text
+<ceph-pool>/cloudstack-cbt-<migration-uuid>-<source-disk-id>-<source-name>
+```
+
+Only the image name is persisted as the migration disk target path. The agent
+reconstructs the qemu RBD URL from the selected storage pool when writing
+initial and delta data. During in-place `virt-v2v` finalization, the agent
+starts a temporary localhost `qemu-nbd` bridge for each RBD image and gives
+`virt-v2v` a libvirt XML disk that points to that local NBD endpoint. This keeps
+RBD credentials and monitor options in the qemu layer and presents a local NBD
+endpoint to the conversion appliance.
+
+The preferred cutover finalization is in-place:
+
+- `virt-v2v-in-place`, if present.
+- `virt-v2v --in-place`, if the installed `virt-v2v` supports it.
+
+If neither in-place method is available, QCOW2 file targets can use regular
+`virt-v2v -o local` only when this global configuration is enabled:
+
+```text
+vmware.cbt.allow.non.inplace.finalization=true
+```
+
+Default:
+
+```text
+false
+```
+
+When fallback is enabled:
+
+- The fallback is only allowed for supported QCOW2 file targets.
+- The agent stages both `TMPDIR` and `virt-v2v` output under the current
+  migration directory on the selected primary storage.
+- The agent validates free space before running fallback finalization.
+- Required free space is conservatively estimated as two times the summed disk
+  capacity.
+- After successful fallback finalization, source replica disks are deleted.
+
+Fallback is never allowed for RBD targets. RBD migrations require
+`virt-v2v-in-place` or `virt-v2v --in-place` support on the selected conversion
+host.
+
+Example fallback output path:
+
+```text
+/mnt/<pool-uuid>/cloudstack-cbt/<migration-uuid>/virt-v2v-output-<random>/<migration-uuid>-sda
+```
+
+After successful finalization, both in-place and fallback paths are normalized
+to the same final layout used by the OVF/VDDK import flow: the KVM agent moves
+each finalized QCOW2 file to the selected primary storage root and gives it a
+generated UUID filename:
+
+```text
+/mnt/<pool-uuid>/<generated-volume-uuid>
+```
+
+The agent returns the relocated target paths in the cutover answer. The
+management server persists them in `vmware_cbt_migration_disk.target_path`
+through the normal disk-result update path, so no manual database update or
+schema change is required for this relocation. CloudStack then imports the VM
+using the flat root-level file name, matching the final placement used by
+regular OVF/VDDK migrations.
+
+For RBD targets, successful in-place finalization keeps the raw RBD image in
+place and CloudStack imports it by image name from the selected RBD storage
+pool. No post-finalization file move is performed, and completed migration
+deletion remains record-only.
+
+RBD finalization creates only temporary localhost `qemu-nbd` processes and
+temporary XML/script files on the conversion host. The wrapper installs a shell
+trap to stop those bridge processes and remove the PID files after `virt-v2v`
+finishes or fails. The persistent storage artifact remains the raw RBD image
+whose name contains the `cloudstack-cbt-<migration-uuid>-` marker until
+CloudStack imports it or cleanup removes it for a failed/cancelled migration.
+
+CloudStack imports finalized CBT disks with the KVM `virtio` root disk
+controller. The conversion host must have `virtio-win` available for Windows
+guests so that `virt-v2v` can enable the matching boot driver before the VM is
+started under KVM. This keeps the persisted `rootDiskController` detail aligned
+with the controller model used by the converted guest.
+
+## Ceph/RBD Conversion Host Requirements
+
+Ceph/RBD support relies on the same KVM host plumbing that normal CloudStack RBD
+primary storage uses, plus the CBT-specific VMware conversion tools. The
+selected conversion host must be able to access the destination RBD pool from
+both Java/libvirt storage code and the qemu command-line tools used by the CBT
+wrappers.
+
+Required conversion-host capabilities:
+
+- CloudStack KVM agent with the normal RBD primary-storage dependencies.
+- The selected KVM/conversion host must already be able to use the destination
+  CloudStack RBD primary storage pool.
+- `librados` and `librbd` client libraries compatible with the Ceph cluster.
+- Java RADOS/RBD bindings used by CloudStack's RBD storage adaptor.
+- qemu RBD block driver support so `qemu-img` and `qemu-io` can open
+  `rbd:<pool>/<image>:...` URLs.
+- VDDK and `nbdkit-vddk` for VMware source reads.
+- `virt-v2v-in-place` or `virt-v2v --in-place` for RBD cutover finalization.
+- `virtio-win` or equivalent VirtIO driver media/packages for Windows guests,
+  same as the existing VMware import requirements.
+
+CloudStack RBD primary-storage configuration must be valid on the selected
+KVM/conversion host. For CBT-to-RBD, CloudStack uses the existing KVM
+storage-pool metadata to build qemu RBD URLs, including monitor addresses,
+authentication mode, Ceph user, and secret. The CBT qemu path therefore does not
+rely on `/etc/ceph/ceph.conf` or a local keyring as its primary credential source
+when CloudStack supplies explicit RBD URL options.
+
+A local Ceph configuration and keyring can still be useful for operator
+diagnostics and site-local tooling, for example running `ceph -s`,
+`rbd ls <pool>`, or similar commands without manually passing monitor and
+authentication options each time. Sites may choose to install those files for
+operational convenience, but they should not be documented as the required
+credential source for CBT RBD writes.
+
+The Ceph client packages on every KVM/conversion host should match the Ceph
+cluster major release, or at least be explicitly supported by that cluster
+release. Avoid relying on the distribution's stock Ceph packages if they are
+older than the deployed Ceph cluster. Ancient `librbd`, `librados`, qemu RBD
+block-driver, or Java binding packages can fail in ways that look like CBT
+errors even though the actual problem is a client/cluster compatibility mismatch.
+
+Practical guidance:
+
+- If the Ceph cluster is deployed from upstream Ceph packages, install the
+  corresponding upstream Ceph client repository on all KVM/conversion hosts.
+- If the Ceph cluster is deployed from a vendor repository, use that vendor's
+  matching client packages on the KVM/conversion hosts.
+- Keep `ceph-common`, `librados`, `librbd`, qemu RBD block-driver packages, and
+  Java RADOS/RBD bindings aligned as a set. Do not mix a modern Ceph cluster
+  with old OS-default client libraries unless the Ceph vendor explicitly
+  supports that combination.
+- Verify the KVM host can already use the selected RBD primary storage for
+  ordinary CloudStack VM volumes before enabling CBT migrations to the same
+  pool.
+- Verify that qemu tools can see RBD support. Package names vary by OS, but on
+  many EL-like distributions this is provided by a qemu RBD block-driver package
+  such as `qemu-kvm-block-rbd`; on Debian/Ubuntu-like systems it is commonly
+  part of qemu block extras.
+
+CBT preflight and `startVmwareCbtMigration` actively probe RBD access when the
+selected destination pool is RBD. The management server sends the selected
+conversion host a small probe command using a temporary image named
+`cloudstack-cbt-probe-<uuid>`. The KVM agent builds the qemu RBD URL from the
+existing CloudStack storage-pool metadata, runs `qemu-img create`, writes and
+reads a 4 KiB pattern with `qemu-io`, and removes the temporary image through
+CloudStack's existing RBD storage adaptor. This catches qemu RBD driver issues,
+Ceph monitor/authentication problems, and Java RADOS/RBD cleanup failures before
+the long-running VMware copy starts.
+
+Useful host checks:
+
+```bash
+ceph -s
+ceph osd lspools
+rbd ls <pool>
+qemu-img --help | grep -i rbd
+qemu-io --help | grep -i rbd
+```
+
+Useful package/version checks:
+
+```bash
+ceph --version
+rbd --version
+ldconfig -p | egrep 'librbd|librados'
+java -version
+```
+
+Useful CloudStack database check after the host reconnects:
+
+```sql
+SELECT h.id, h.name, hd.name, hd.value
+FROM cloud.host h
+JOIN cloud.host_details hd ON hd.host_id = h.id
+WHERE h.name = '<kvm-host-name>'
+  AND hd.name IN (
+    'host.vddk.blockcopy.support',
+    'host.vddk.blockcopy.inplace.finalization.support',
+    'host.vddk.blockcopy.rbd.support',
+    'host.vddk.support',
+    'host.vddk.version',
+    'host.virtv2v.inplace.version',
+    'vddk.lib.dir'
+  )
+ORDER BY hd.name;
+```
+
+An RBD-capable conversion host should already report VMware CBT capability as
+`true` before a migration starts, and the selected destination storage pool must
+be the RBD pool that the host can access. If these host details are stale after
+installing packages, restart `cloudstack-agent`, ensure the management server is
+running, and wait for host details to be refreshed.
+
+## Host Capability Reporting
+
+The agent checks these on startup/ready and sends them as host details. Management then persists them into `cloud.host_details`.
+
+| Host detail | How agent checks it |
+| --- | --- |
+| `host.virtv2v.version` | Runs `virt-v2v --version`. On Ubuntu/Debian it also checks `dpkg -l nbdkit`. Version is parsed from `virt-v2v --version`. |
+| `vddk.lib.dir` | Reads `vddk.lib.dir` from `agent.properties`; if blank/invalid, auto-detects with `find / -type d -name 'vmware-vix-disklib-distrib' 2>/dev/null \| head -n 1`. Valid means `<dir>/lib64/libvixDiskLib.so*` exists. |
+| `host.vddk.version` | Runs `nbdkit vddk --dump-plugin libdir=<vddk-lib-dir>` and parses `vddk_library_version=<n>`. |
+| `host.vddk.support` | True only if `virt-v2v`/`nbdkit` support is present, VDDK dir is valid, and `nbdkit-vddk-plugin` can load VDDK via `nbdkit vddk --dump-plugin libdir=<dir>`. |
+| `host.qemu.img.version` | Runs `qemu-img --version`, parses first non-empty line. |
+| `host.qemu.nbd.version` | Runs `qemu-nbd --version`, parses first non-empty line. |
+| `host.qemu.io.version` | Runs `qemu-io --version`, parses first non-empty line. |
+| `host.vddk.blockcopy.support` | True only if `host.vddk.support` is true and `qemu-img --version`, `qemu-nbd --version`, and `qemu-io --version` all exit `0`. |
+| `host.vddk.blockcopy.inplace.finalization.support` | True only if CBT support is true and either `virt-v2v-in-place --version` works, or `virt-v2v --help 2>&1 \| grep -q -- '--in-place'` succeeds. |
+| `host.virtv2v.inplace.version` | If `virt-v2v-in-place` exists, parses `virt-v2v-in-place --version`. If only `virt-v2v --in-place` exists, reports the normal `virt-v2v` version. |
+| `host.vddk.blockcopy.rbd.support` | True only if in-place finalization support is true and `qemu-img --help` advertises the `rbd` block driver. |
+
+Important nuance: `host.vddk.blockcopy.rbd.support` is only the coarse host capability. For an actual selected RBD pool, preflight/start also runs an active probe: create a temporary `cloudstack-cbt-probe-<uuid>` RBD image, write/read 4 KiB using `qemu-io`, then delete it through CloudStack's RBD storage adapter. That catches Ceph auth, monitor, qemu RBD, librados/librbd, and Java binding problems.
+
+Windows source VMs also require `virtio-win` on the selected KVM conversion
+host. CBT preflight and `startVmwareCbtMigration` use the same
+`CheckConvertInstanceCommand` path as OVF/VDDK import with Windows guest
+conversion enabled, so a missing `virtio-win` package is reported before the
+initial sync starts.
+
+VDDK detection uses either agent configuration or auto-detection. The agent
+validates the VDDK library by checking that `lib64/libvixDiskLib.so*` exists
+and that `nbdkit vddk --dump-plugin libdir=<path>` reports a library version.
+
+## VDDK Details
+
+VDDK options can be provided as API `details` at migration start:
+
+- `vddk.lib.dir`
+- `vddk.transports`
+- `vddk.thumbprint`
+
+If a value is not provided by the API, the agent uses its configured or detected
+value. If `vddk.thumbprint` is not provided, the agent attempts to fetch the
+vCenter SHA1 certificate thumbprint with `openssl`.
+
+The implementation does not hard-code one VDDK version. The installed VDDK
+build must be compatible with the host libraries and pass the agent capability
+check.
+
+## Credential Handling
+
+There are two source credential modes:
+
+- Existing registered vCenter: credentials are read from the registered
+  `vmware_data_center` record.
+- External vCenter: credentials are supplied to start/preflight and stored on
+  the migration record so later UI sync/cutover actions can run without asking
+  again.
+
+External credential behavior:
+
+- `source_password` is stored through the CloudStack encrypted DAO field
+  mechanism via `@Encrypt`.
+- Start, preflight, sync, and cutover commands that can carry credentials are
+  marked `requestHasSensitiveInfo=true`.
+- API responses are marked `responseHasSensitiveInfo=false`.
+- Agent-side VDDK commands pass the password through a temporary password file
+  and `nbdkit` `password=+<file>`, not by embedding the clear-text password in
+  the command line.
+- Management sanitizes returned error messages by replacing the resolved source
+  password with `******` before storing `last_error` or cycle descriptions.
+- Stored external credentials are cleared when the migration completes,
+  when it is cancelled, and before deletion.
+
+The implementation avoids logging clear-text passwords. As with other
+CloudStack secret handling, this also depends on callers not placing secrets in
+unrelated free-form log messages.
+
+## Compute Offering And Preflight Validation
+
+CBT migration uses the same eventual import path as the existing OVF/VDDK VM
+import code. The final CloudStack VM sizing still comes from the selected
+service offering and any dynamic offering details.
+
+The CBT-specific difference is timing: CBT validates obvious sizing problems
+early, before the long initial full sync begins. This is meant to avoid spending
+hours copying disks only to fail final VM import because the selected offering
+is too small.
+
+The source VM sizing captured during preflight/start includes:
+
+- `sourcecpunumber`
+- `sourcecpuspeed`
+- `sourcememory`
+
+Validation rule:
+
+- If the source value and requested value are both known and greater than zero,
+  the requested value must be greater than or equal to the source value.
+- Unknown or zero source values are not used to reject the offering.
+
+Validated fields:
+
+- CPU number
+- CPU speed
+- Memory
+
+Fixed offerings:
+
+- CPU number comes from `service_offering.cpu`.
+- CPU speed comes from `service_offering.speed`.
+- Memory comes from `service_offering.ram_size`.
+
+Dynamic/custom offerings:
+
+- Caller details can provide `cpuNumber`, `cpuSpeed`, and `memory`.
+- If caller details are missing, offering minimums such as `mincpunumber` and
+  `minmemory` can be used where applicable.
+- This mirrors the shared import behavior in
+  `UnmanagedVMsManagerImpl.addServiceOfferingDetailsToParams`.
+
+Example custom offering details:
+
+```text
+details[0].key=cpuNumber
+details[0].value=4
+details[1].key=cpuSpeed
+details[1].value=2100
+details[2].key=memory
+details[2].value=4096
+```
+
+This early validation is not intended to be stricter than OVF/VDDK import. It
+is intended to fail earlier for the same class of sizing mismatch.
+
+## UI Changes
+
+The CBT UI is integrated into the Import/Export Instances area.
+
+Implemented UI behavior:
+
+- Start migration uses the async `startVmwareCbtMigration` job.
+- Sync delta uses the async `syncVmwareCbtMigration` job.
+- Cutover uses the async `cutoverVmwareCbtMigration` job.
+- Each async action uses CloudStack job polling.
+- The CBT migration table also calls `listVmwareCbtMigrations` as the detailed
+  status source.
+- The table auto-refreshes while the CBT tab is active and any migration is in
+  an active state or a CBT action job is still running.
+
+Active states for UI refresh:
+
+- `Created`
+- `InitialSync`
+- `Replicating`
+- `CuttingOver`
+
+The table exposes:
+
+- Migration state.
+- Current step.
+- Completed cycles.
+- Quiet cycles.
+- Last changed bytes.
+- Last dirty rate.
+- Total changed bytes.
+- Last error.
+- Per-disk target path, target format, change ID, snapshot MOR, and state.
+- Per-cycle state, changed bytes, dirty rate, duration, description, created,
+  and updated timestamps.
+
+Initial sync progress is currently coarse. While `qemu-img convert` runs on the
+agent, management can show the migration state, current step, target path, and
+disk state, but not a continuously updated percentage. Delta syncs have better
+post-cycle metrics because changed bytes and dirty rate are returned by the
+cycle result.
+
+## Failure And Retry Semantics
+
+Initial full sync failure:
+
+- Migration moves to `Failed`.
+- Created or syncing disks are marked `Failed`.
+- Last error is stored on the migration.
+- Delete with cleanup can remove the migration directory.
+
+Delta sync failure:
+
+- The cycle is marked `Failed`.
+- The migration moves to `Failed`.
+- Last error and cycle description are stored.
+- VMware cycle snapshot removal is still attempted.
+
+Cutover finalization failure:
+
+- Migration moves to `Failed`.
+- The source VM remains under operator control in vCenter.
+- Delete with cleanup can remove replicated/finalized target directories if the
+  paths are under the migration directory.
+
+Import failure after successful finalization:
+
+- Migration remains `ReadyForImport`.
+- Target disk paths point at the finalized disk files.
+- Retrying cutover retries the import step.
+
+Cancel:
+
+- Best-effort cleanup.
+- State becomes `Cancelled`.
+- Stored external credentials are cleared.
+
+Delete:
+
+- `Failed`, `Cancelled`, or `Completed`.
+- Optional cleanup, default `true`, applies only to `Failed` and `Cancelled`.
+- `Completed` deletion is record-only and intentionally preserves the imported
+  VM and all destination storage artifacts.
+- Child rows and parent row are removed.
+
+## Security And Logging Considerations
+
+Important security choices:
+
+- Credential-bearing commands are marked sensitive.
+- External vCenter password storage uses encrypted DAO fields.
+- Passwords are passed to VDDK through temp files instead of clear-text command
+  arguments.
+- Password temp files are owner-readable and owner-writable where POSIX
+  permissions are supported.
+- Returned failure messages are sanitized against the active source password
+  before persistence.
+- CBT delta and cutover agent wrappers include the last useful command output
+  line in returned failure details when available. This keeps management server
+  and UI errors actionable for `qemu-nbd`, `qemu-io`, `nbdkit`, and `virt-v2v`
+  failures without logging or returning clear-text passwords.
+
+Operational caution:
+
+- `source_username` is not encrypted.
+- vCenter host, datacenter, VM name, datastore names, disk paths, change IDs,
+  and snapshot MORs are not treated as secrets and can appear in API responses
+  and logs.
+- Operators should still avoid manually pasting credentials into log-visible
+  free-form fields.
+
+## Testing Strategy
+
+Relevant unit coverage includes:
+
+- `VmwareCbtMigrationOfferingValidationTest`
+- `VmwareCbtMigrationDeletePolicyTest`
+- `VmwareCbtStorageTargetTest`
+- `VmwareCbtMigrationCutoverPolicyTest`
+- `LibvirtVmwareCbtSyncCommandWrapperTest`
+- `VmwareCbtSyncPlanTest`
+- `LibvirtVmwareCbtCutoverCommandWrapperTest`
+- `LibvirtVmwareCbtCleanupCommandWrapperTest`
+- `LibvirtVmwareCbtRbdProbeCommandWrapperTest`
+- `LibvirtStoragePoolTest`
+
+The tests cover:
+
+- Fixed offering validation.
+- Dynamic/custom offering detail handling.
+- Storage target classification.
+- Non-in-place finalization gating.
+- Cutover policy decisions.
+- Delta copy script planning.
+- Chunked changed-range reads from the nbdkit Unix socket.
+- RBD probe create/write/read/delete command planning.
+- RBD finalization through temporary localhost `qemu-nbd` bridges.
+- Fallback `virt-v2v` output path handling.
+- Cleanup scoping to migration directories.
+- Cleanup scoping to migration-owned RBD image names.
+- Nested relative KVM volume path resolution under filesystem pools.
+
+## Operational Verification
+
+Useful host capability check:
+
+```bash
+cmk list hosts name=<kvm-host-name> details=all | egrep \
+'host.vddk.blockcopy.support|host.vddk.blockcopy.inplace.finalization.support|host.vddk.blockcopy.rbd.support|host.vddk.support|host.vddk.version|host.virtv2v.version|host.virtv2v.inplace.version|host.qemu.img.version|host.qemu.nbd.version|host.qemu.io.version|vddk.lib.dir'
+```
+
+Useful VDDK plugin check on the KVM host:
+
+```bash
+nbdkit vddk --dump-plugin libdir=/opt/vmware-vix-disklib-distrib | \
+  egrep 'vddk_library_version|vddk_dll|vddk_transport_modes'
+```
+
+Useful process check during initial sync:
+
+```bash
+pgrep -af 'nbdkit|qemu-img|qemu-nbd|nbdcopy'
+```
+
+Useful target disk inspection:
+
+```bash
+qemu-img info /mnt/<pool-uuid>/cloudstack-cbt/<migration-uuid>/<disk>.qcow2
+```
+
+## References
+
+- [Apache CloudStack: Importing VMware VMs into KVM](https://docs.cloudstack.apache.org/en/latest/adminguide/virtual_machines/importing_vmware_vms_into_kvm.html)
+- [Broadcom vSphere `QueryChangedDiskAreas` API](https://developer.broadcom.com/xapis/virtual-infrastructure-json-api/latest/sdk/vim25/release/VirtualMachine/moId/QueryChangedDiskAreas/post/)
+- [Broadcom Virtual Disk API disk operations](https://developer.broadcom.com/xapis/virtual-disk-api/latest/vddkFunctions.6.4.html)
+- [Broadcom VDDK CBT notes and limitations](https://developer.broadcom.com/xapis/virtual-disk-api/latest/vddkBkupVadp.9.5.html)
+- [nbdkit VDDK plugin](https://libguestfs.org/nbdkit-vddk-plugin.1.html)
diff --git a/docs/vmware-cbt/architecture.md b/docs/vmware-cbt/architecture.md
new file mode 100644
index 000000000000..299a0d769afe
--- /dev/null
+++ b/docs/vmware-cbt/architecture.md
@@ -0,0 +1,266 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# VMware CBT migration architecture
+
+This document describes the implemented Apache CloudStack architecture for
+warm VMware-to-KVM migration based on VMware Changed Block Tracking (CBT).
+Detailed API, database, configuration, and operational information is in
+[`README.md`](README.md). KVM host preparation is documented in
+[`../vmware-cbt-migration.md`](../vmware-cbt-migration.md).
+
+## Design invariant
+
+The KVM-side replica remains byte-compatible with the VMware source disk until
+the final CBT cycle has completed. Raw VMware CBT ranges are never applied to a
+disk after guest conversion has changed its layout.
+
+The migration therefore has two distinct phases:
+
+1. Replication: copy the initial source-equivalent baseline and apply CBT delta
+   ranges to it.
+2. Finalization: after the source VM is powered off, apply one final delta and
+   run `virt-v2v` locally against the current KVM-side replica.
+
+This avoids a second full VMware read during cutover. CloudStack does not power
+off the source VM; shutdown remains an explicit operator action.
+
+## Components
+
+### Management server
+
+The API commands are:
+
+- `checkVmwareCbtMigrationPrerequisites`
+- `startVmwareCbtMigration`
+- `listVmwareCbtMigrations`
+- `syncVmwareCbtMigration`
+- `cutoverVmwareCbtMigration`
+- `cancelVmwareCbtMigration`
+- `deleteVmwareCbtMigration`
+
+`VmwareCbtMigrationManagerImpl` owns migration orchestration, host and storage
+validation, state transitions, cutover policy, agent command dispatch, import,
+and cleanup. `VmwareCbtMigrationServiceImpl` performs VMware inventory,
+snapshot, power-state, CBT enablement, and changed-area operations.
+
+`VmwareCbtStorageTarget` classifies the selected primary storage and determines
+the target representation and finalization constraints.
+
+### Persistence
+
+The feature persists its state in three CloudStack tables:
+
+- `cloud.vmware_cbt_migration`: one row per migration session.
+- `cloud.vmware_cbt_migration_disk`: source and target metadata for each disk,
+  including the current per-disk VMware `changeId`.
+- `cloud.vmware_cbt_migration_cycle`: metrics and status for each delta cycle.
+
+The schema and configuration entries are delivered through the standard
+4.23.0.0-to-24.0.0 database upgrade path:
+
+- `engine/schema/src/main/resources/META-INF/db/schema-42300to2400.sql`
+- `engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42300to2400.java`
+
+### KVM agent
+
+The management server sends these commands to the selected conversion host:
+
+- `VmwareCbtPrepareCommand`: create or resolve target disks and perform the
+  initial VDDK full copy.
+- `VmwareCbtSyncCommand`: read and apply VMware CBT ranges.
+- `VmwareCbtCutoverCommand`: finalize the current replica with `virt-v2v`.
+- `VmwareCbtCleanupCommand`: terminate migration-owned processes and remove
+  migration-owned temporary artifacts.
+- `VmwareCbtRbdProbeCommand`: actively validate RBD create/write/read/delete
+  access for the selected pool.
+
+The corresponding KVM wrappers are
+`LibvirtVmwareCbtPrepareCommandWrapper`,
+`LibvirtVmwareCbtSyncCommandWrapper`,
+`LibvirtVmwareCbtCutoverCommandWrapper`,
+`LibvirtVmwareCbtCleanupCommandWrapper`, and
+`LibvirtVmwareCbtRbdProbeCommandWrapper`.
+
+### User interface
+
+The workflow is integrated into Import/Export Instances. The UI starts async
+operations through the API and uses `listVmwareCbtMigrations` as the detailed
+source for migration, disk, and cycle state.
+
+## End-to-end flow
+
+```text
+VMware source VM
+    |
+    | preflight and source discovery
+    v
+baseline VMware snapshot
+    |
+    | nbdkit-vddk full logical disk read
+    v
+source-equivalent replica on KVM primary storage
+    |
+    | repeated VMware snapshots + QueryChangedDiskAreas
+    | changed ranges copied through VDDK and patched in place
+    v
+ReadyForCutover
+    |
+    | operator powers off the VMware VM
+    | final CBT delta
+    | local virt-v2v finalization
+    v
+CloudStack KVM import
+```
+
+### Preflight
+
+Preflight resolves the source, destination cluster, conversion host, and
+primary storage. It validates source CBT state, source disks, snapshots,
+storage support, host block-copy and in-place-finalization capabilities, RBD or
+LINSTOR access where applicable, Windows conversion dependencies, and optional
+compute-offering sizing.
+
+The selected conversion host reports capability through host details. The
+principal gates are:
+
+- `host.vddk.blockcopy.support`
+- `host.vddk.blockcopy.inplace.finalization.support`
+- `host.vddk.blockcopy.rbd.support`
+- `vddk.lib.dir`
+- `host.vddk.version`
+- qemu and `virt-v2v` version details
+
+### Initial synchronization
+
+Start creates the migration and disk records, enables CBT when required,
+creates a baseline VMware snapshot, prepares destination targets, and dispatches
+`VmwareCbtPrepareCommand`.
+
+The KVM agent exposes each snapshot disk with `nbdkit-vddk`. It uses
+`qemu-img convert` for the general copy path and can use `nbdcopy` as an
+optional accelerator for supported pre-created or NBD-bridged targets. The
+result remains source-equivalent; `virt-v2v` is not run during initial sync.
+
+After a successful copy, CloudStack records the baseline per-disk `changeId`
+and removes the baseline snapshot when possible.
+
+### Delta synchronization
+
+Each synchronization cycle:
+
+1. Creates a VMware snapshot.
+2. Calls VMware `QueryChangedDiskAreas` from the previous per-disk `changeId`.
+3. Persists the changed ranges and cycle state.
+4. Opens the snapshot disk through `nbdkit-vddk` on the KVM host.
+5. Copies only the changed ranges and writes them at their original byte
+   offsets with `qemu-io`.
+6. Records changed bytes, duration, dirty rate, and the new `changeId`.
+7. Removes the cycle snapshot when possible.
+
+`VmwareCbtMigrationCutoverPolicy` evaluates the configured minimum, maximum,
+and quiet-cycle thresholds and moves the migration to `ReadyForCutover` when
+the policy boundary is reached.
+
+### Cutover
+
+Cutover is accepted only when the source VM is powered off. CloudStack runs one
+final CBT cycle, then finalizes the current KVM-side replica with one of these
+paths:
+
+- `virt-v2v-in-place`;
+- `virt-v2v --in-place`; or
+- regular `virt-v2v -o local` for QCOW2 file targets only, when the explicit
+  non-in-place fallback configuration is enabled.
+
+After finalization, CloudStack imports the disks through the shared external
+KVM import path. A successful import sets the migration to `Completed`. If
+finalization succeeds but import fails, the migration remains `ReadyForImport`
+and a retry repeats only the import stage.
+
+## Storage targets
+
+| Primary storage | Replica | Initial copy | Delta writes | Finalization |
+| --- | --- | --- | --- | --- |
+| NFS, filesystem, shared mount | QCOW2 file | `qemu-img` | `qemu-io -f qcow2` | In-place preferred; explicitly gated local fallback supported |
+| Ceph/RBD | Raw RBD image | Direct qemu RBD path or `nbdcopy` through a local NBD bridge | `qemu-io -f raw` | In-place only |
+| LINSTOR | Pre-created raw DRBD block device | `nbdcopy` when available, otherwise `qemu-img` | `qemu-io -f raw` | In-place only |
+
+For filesystem targets, temporary replicas are stored under a migration-owned
+`cloudstack-cbt/<migration-uuid>/` directory. RBD and LINSTOR resources use
+CloudStack-owned migration markers. Cleanup is restricted to these owned paths
+and resource names.
+
+## State model
+
+Migration states:
+
+```text
+Created
+  -> InitialSync
+  -> Replicating
+  -> ReadyForCutover
+  -> CuttingOver
+  -> ReadyForImport
+  -> Completed
+```
+
+`Failed` and `Cancelled` are terminal states. `ReadyForImport` is deliberately
+retryable.
+
+Disk states are `Created`, `Prepared`, `Syncing`, `Ready`, and `Failed`.
+Cycle states are `Created`, `QueryingChangedAreas`, `CopyingChangedBlocks`,
+`Completed`, and `Failed`.
+
+## Concurrency and cleanup
+
+Sync and cutover commands are serialized by migration ID. Cancellation sends a
+best-effort agent cleanup command before marking a non-terminal migration as
+cancelled. Failed and cancelled migrations can delete their migration-owned
+temporary replicas when cleanup is requested.
+
+Deleting a completed migration is record-only. It removes CBT bookkeeping but
+does not delete the imported VM, its CloudStack volumes, or finalized primary
+storage artifacts.
+
+VMware snapshots are removed after initial and delta attempts when possible.
+Snapshot identifiers and cleanup errors remain visible in migration state so
+operators can identify VMware-side cleanup work.
+
+## Credential handling
+
+Existing registered vCenter credentials are resolved from CloudStack's VMware
+datacenter record. External-source credentials are accepted by sensitive API
+commands and the password is stored through CloudStack's encrypted DAO field
+handling until the migration no longer needs it.
+
+On the KVM host, the password is written to a temporary owner-only file and
+passed to `nbdkit` with `password=+<file>`. It is not placed directly in the
+process command line. Returned errors are sanitized before persistence.
+
+## Operational boundaries
+
+- The operator is responsible for shutting down the source VM before cutover.
+- Initial baseline transfer size depends on the extents exposed by VMware VDDK
+  and the source datastore; CBT optimization applies to subsequent cycles.
+- Invalidated VMware CBT state requires a new baseline migration.
+- RBD and LINSTOR require in-place finalization and active backend access from
+  the selected conversion host.
+- Windows guests require a usable `virtio-win` driver bundle on that host.
+- The source VMware VM remains authoritative until cutover succeeds.
diff --git a/docs/vmware-linstor-migration.md b/docs/vmware-linstor-migration.md
new file mode 100644
index 000000000000..bf3f8b69b20e
--- /dev/null
+++ b/docs/vmware-linstor-migration.md
@@ -0,0 +1,238 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# Linstor primary storage as a destination for VMware-to-KVM migration
+
+This document describes the Linstor-destination portion of the VMware-to-KVM
+migration work, in enough detail for LINSTOR/DRBD maintainers to review the
+design choices and advise on Linstor-side behavior.
+
+## Summary
+
+This change lets Linstor (DRBD) primary storage be the **destination** for
+VMware-to-KVM instance imports, across all three migration modes CloudStack
+offers for Ceph/RBD:
+
+- **Cold, staged** — convert with virt-v2v to a temporary NFS location, then
+  copy the finalized disks into Linstor.
+- **Cold, direct (VDDK)** — read each disk over nbdkit/VDDK straight into the
+  DRBD device and finalize it in place, with no NFS staging.
+- **Warm (CBT)** — replicate the running VM with an initial full sync plus
+  incremental changed-block cycles into the DRBD device, then finalize in
+  place at cutover.
+
+Before this change Linstor was blocked everywhere in the import/conversion
+path by NFS-only (and, more recently, RBD-only) assumptions. The work
+generalizes those code paths rather than special-casing Linstor: a new
+`RAW_BLOCK_DEVICE` target type covers "write RAW into a host-local block
+device provided by the storage adaptor", which also lays the groundwork for
+other block backends (PowerFlex, FiberChannel, StorPool) later.
+
+## Background and motivation
+
+CloudStack can import VMware VMs onto KVM by converting them with virt-v2v
+(optionally reading disks over the VMware VDDK). The converted disks have to
+land on KVM primary storage. That path historically supported only
+filesystem-style pools (NFS/Filesystem/SharedMountPoint); the companion
+commits in this series add Ceph/RBD as a destination and a full VMware
+**CBT warm-migration** framework. Linstor — a very common CloudStack block
+backend — was still unsupported as a conversion destination.
+
+Linstor differs from RBD in ways that shaped the design:
+
+- A Linstor volume is a **local block device** (`/dev/drbd/by-res/<res>/0`),
+  which is the universal abstraction the whole toolchain (qemu-img, qemu-io,
+  virt-v2v-in-place) already consumes — so finalization is actually *simpler*
+  than RBD (no qemu-nbd credential bridge needed; a plain
+  `<disk type='block'>` works).
+- Unlike RBD, `qemu-img convert` **cannot create** the device — the resource
+  must be pre-created at the source capacity through the storage adaptor,
+  then written with `qemu-img convert -n` (no-create).
+- LINSTOR resource names are capped at ~48 characters and cannot be renamed,
+  so the RBD-style naming carrying a full migration UUID does not fit; short,
+  deterministic names are used and imported volumes keep the name as their
+  recorded volume path.
+
+## What this change does
+
+### New generic block-device target type
+`VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE`, alongside the existing
+`QCOW2_FILE` and `RBD_RAW`. Linstor pools classify to it and require in-place
+finalization (the qcow2 fallback cannot write to a device).
+
+### Server-side (orchestration)
+- Linstor added to the staged-conversion destination pool types, the direct
+  VDDK-convert allow-list, and the CBT-compatible pool types, for both
+  explicit and implicit destination-pool selection.
+- Conversion/import host selection validates that the host is a LINSTOR
+  satellite connected to the pool (in addition to the VDDK / in-place
+  virt-v2v capability checks), for auto-selection and explicit host IDs.
+- `CheckConvertInstanceCommand` carries a new in-place-finalization capability
+  check so unsupported hosts fail fast with a clear message.
+- The powered-off, non-cloned source requirement (already enforced for direct
+  RBD) now applies to any direct block-storage import.
+
+### KVM agent-side (data plane)
+- **Staged**: the converted-disk move already dispatches per pool type to
+  `LinstorStorageAdaptor.copyPhysicalDisk` (qemu-img into the DRBD device);
+  converted-disk metadata for Linstor reports the pool UUID and volume name
+  instead of parsing an NFS mount.
+- **Direct VDDK**: pre-creates each resource at source capacity via the
+  adaptor, then `nbdkit vddk --run 'qemu-img convert -n ... <device>'`, and
+  finalizes with `virt-v2v-in-place` fed a `<disk type='block'>` domain XML.
+- **Warm CBT**: initial sync pre-creates the device and `qemu-img convert -n`
+  into it; delta cycles patch changed extents; cutover finalizes in place
+  with block-device XML (no qemu-nbd bridges). Cleanup deletes only
+  marker-guarded volumes.
+- `LinstorStorageAdaptor.listPhysicalDisks` is implemented (resource
+  definitions filtered by the pool's resource group), replacing the previous
+  `UnsupportedOperationException`, so the forced-conversion import short
+  circuit works for Linstor.
+
+### Performance: nbdcopy for full-disk copies to block devices
+The cold direct-VDDK import and the CBT initial full sync copy an entire disk
+from the nbdkit/VDDK source into the target. For a local raw block-device
+target (Linstor/DRBD), this now uses `nbdcopy` (libnbd) when the host has it,
+falling back to `qemu-img convert`. nbdcopy keeps many requests in flight
+(it is what virt-v2v itself uses for this step) and is typically faster than a
+single-connection `qemu-img convert`. Availability is probed locally on the
+agent; it is a pure optimization with automatic fallback, so no server-side
+gating is needed. Only block-device targets are affected — the RBD URI target
+and qcow2 file targets keep qemu-img convert (nbdcopy is raw-only and cannot
+address an rbd: URI without a bridge). On a 16 GiB disk over network NBD
+transport it measured ~20% faster than qemu-img convert in the lab, and the
+result was byte-identical to a full VDDK read of the source.
+
+### Performance: direct CBT delta copy for block devices
+Previously a CBT delta copied each changed extent in two hops — qemu-img the
+nbd source window into a temporary raw file, then qemu-io write that file into
+the target. For a raw block-device target that doubles local I/O and needs
+scratch space. This change streams each changed extent from the nbd source
+window straight into the same device window in a single
+`qemu-img convert -n -S 0 --image-opts --target-image-opts`. `-S 0` disables
+zero/sparse skipping so blocks the source cleared to zero are actually
+overwritten in the target — a full copy can skip zeros because the target
+starts zeroed, but a delta into an already-populated device cannot. The
+qcow2-file and RBD paths are unchanged.
+
+## Migration support matrix (Linstor destination)
+
+| Mode | Trigger | Source VM state | Data movement | Guest downtime |
+| --- | --- | --- | --- | --- |
+| Cold, staged | `importVm` (no `forceconverttopool`) | Running (auto-cloned on vSphere) or stopped | virt-v2v -> qcow2 on NFS temp -> qemu-img copy to DRBD device | Offline copy (running source undisturbed via clone) |
+| Cold, direct VDDK | `importVm usevddk=true forceconverttopool=true` -> Linstor pool | Stopped only (non-cloned) | nbdkit/VDDK -> qemu-img convert -n into DRBD device -> virt-v2v-in-place | Whole migration (VM is off) |
+| Warm, CBT | `startVmwareCbtMigration` -> sync cycles -> `cutoverVmwareCbtMigration` | Running | Initial full sync + incremental CBT deltas into DRBD device; final delta + in-place finalize at cutover | Minimal (only the final cutover delta) |
+
+Notes:
+- Warm CBT does **not** power off the source automatically. The operator
+  gracefully shuts down the VMware VM, then triggers cutover; the code
+  rejects cutover on a running VM. This is deliberate — never auto-kill a
+  production VM.
+- Direct VDDK requires a powered-off, non-cloned source.
+- Imported Linstor volumes are recorded QCOW2 in the DB (Linstor convention;
+  RAW on the device).
+
+## How to use
+
+Cold, direct VDDK into Linstor (source powered off):
+
+    import vm zoneid=<zone> clusterid=<kvm-cluster> \
+      importsource=vmware hypervisor=KVM \
+      vcenter=<vc> datacentername=<dc> username=<u> password=<p> \
+      clustername=<vmware-cluster> host=<esxi-ip> \
+      name=<source-vm> displayname=<new-name> serviceofferingid=<so> \
+      usevddk=true forceconverttopool=true \
+      convertinstancepoolid=<linstor-pool> \
+      nicnetworklist[0].nic="Network adapter 1" nicnetworklist[0].network=<net> \
+      datadiskofferinglist[0].disk=<data-disk-id> datadiskofferinglist[0].diskOffering=<do>
+
+Warm CBT into Linstor: `startVmwareCbtMigration` with the Linstor pool as
+`storagepoolid`, let the delta cycles run, power off the source, then
+`cutoverVmwareCbtMigration`.
+
+(The web import wizard fills the NIC/disk mappings from the discovered VM, so
+the UI is the easiest way to drive it.)
+
+## Host prerequisites
+
+For any Linstor destination the conversion host must be a LINSTOR satellite
+connected to the pool (its `hostname` must match its LINSTOR node name).
+Direct-VDDK and warm-CBT additionally need VDDK, an nbdkit VDDK plugin, and
+in-place virt-v2v (`virt-v2v-in-place` or `virt-v2v --in-place`). No extra
+qemu block-driver is needed (writes go to a local device). Prefer a diskful
+satellite as the conversion host so writes are local rather than traversing
+the DRBD replication network.
+
+## Backwards compatibility
+
+- No behavior change for existing NFS or RBD destinations; Linstor is added
+  to the same gate lists and dispatch branches.
+- The CBT-delta optimization only affects `RAW_BLOCK_DEVICE` targets; qcow2
+  and RBD keep their existing code paths.
+- One host-capability check flag was added to `CheckConvertInstanceCommand`
+  (old constructor preserved, null-tolerant).
+
+## Testing
+
+- **Unit tests**: full server + KVM-plugin suites pass, including new
+  Linstor-specific tests across the gate lists, host selection, the
+  convert/import/CBT wrappers, `listPhysicalDisks`, and the block-device
+  delta script.
+- **Data plane, real 3-node LINSTOR/DRBD lab, real VMware source**:
+  - Cold direct VDDK: a real VM's disks read over VDDK into DRBD devices +
+    in-place finalized; `qemu-img compare` against the source = identical.
+  - Warm CBT: baseline + delta + power-off + final delta + finalize;
+    integrity verified (file checksum inside the migrated volume matched the
+    source, and `qemu-img compare` of a delta-applied device against a full
+    read of the snapshot = identical).
+  - CBT-delta optimization: 144 real changed extents applied via the new
+    direct-copy script; `qemu-img compare` = images identical.
+- **Full end-to-end through CloudStack**: `importVm` (usevddk +
+  forceconverttopool) against a real vCenter produced a Stopped CloudStack VM
+  with its root and data disks as Linstor volumes on the pool, each backed by
+  a DRBD resource UpToDate on all three nodes.
+
+## Known limitations / possible follow-ups
+
+- Full-disk copies into block devices use nbdcopy when present (see above).
+  RBD URI and qcow2 file targets still use qemu-img convert; extending
+  nbdcopy to RBD would need a qemu-nbd bridge (nbdcopy is raw-device/file
+  only), which is a possible follow-up.
+- The conversion host is usually not ESXi-adjacent, so VDDK typically uses
+  network (NBD/NBDSSL) transport rather than the faster HotAdd; largely
+  inherent to the KVM conversion-host model.
+- A diskful conversion host is recommended but not enforced; a diskless
+  satellite makes every write traverse the replication network.
+- The staged path keeps its extra NFS hop (needed for running-VM clones and
+  hosts without in-place support).
+
+## Relationship to the RBD series
+
+The Linstor support is layered on the VMware-to-KVM RBD series in this same
+change set (direct VDDK-to-RBD imports, the CBT warm-migration framework,
+importVm RBD adoption, and the consolidated host-capability probe names).
+The Linstor-specific commits, in order:
+
+- KVM: allow staged VMware instance imports into Linstor primary storage
+- KVM: support direct VDDK VMware imports into Linstor primary storage
+- VMware CBT warm migration to KVM with Linstor destination storage
+- Document Linstor destination support for VMware-to-KVM imports
+- Drop unsupported -O option from virt-v2v-in-place invocations
+- KVM: stream VMware CBT block-device deltas directly, without a temp file
+- KVM: use nbdcopy for full-disk copies into Linstor block devices when available
diff --git a/engine/api/src/main/java/org/apache/cloudstack/engine/subsystem/api/storage/PrimaryDataStoreDriver.java b/engine/api/src/main/java/org/apache/cloudstack/engine/subsystem/api/storage/PrimaryDataStoreDriver.java
index d908ef6af508..9788b6c2dd14 100644
--- a/engine/api/src/main/java/org/apache/cloudstack/engine/subsystem/api/storage/PrimaryDataStoreDriver.java
+++ b/engine/api/src/main/java/org/apache/cloudstack/engine/subsystem/api/storage/PrimaryDataStoreDriver.java
@@ -31,6 +31,13 @@
 import com.cloud.utils.Pair;
 
 public interface PrimaryDataStoreDriver extends DataStoreDriver {
+    /** Validate backend ownership before adopting an existing volume, without modifying it. */
+    default void validateVolumeForImport(StoragePool pool, String path) {
+        if (pool.getPoolType() == StoragePoolType.Linstor) {
+            throw new UnsupportedOperationException("The storage driver cannot validate LINSTOR volume imports");
+        }
+    }
+
     enum QualityOfServiceState { MIGRATION, NO_MIGRATION }
 
     String BASIC_CREATE = "basicCreate";
diff --git a/engine/orchestration/src/main/java/com/cloud/agent/manager/AgentManagerImpl.java b/engine/orchestration/src/main/java/com/cloud/agent/manager/AgentManagerImpl.java
index d3225f2fda5e..9eab15214aeb 100644
--- a/engine/orchestration/src/main/java/com/cloud/agent/manager/AgentManagerImpl.java
+++ b/engine/orchestration/src/main/java/com/cloud/agent/manager/AgentManagerImpl.java
@@ -817,8 +817,21 @@ protected AgentAttache notifyMonitorsOfConnection(final AgentAttache attache, fi
                 String vddkSupport = detailsMap.get(Host.HOST_VDDK_SUPPORT);
                 String vddkLibDir = detailsMap.get(Host.HOST_VDDK_LIB_DIR);
                 String vddkVersion = detailsMap.get(Host.HOST_VDDK_VERSION);
+                String vmwareCbtSupport = detailsMap.get(Host.HOST_VDDK_BLOCKCOPY_SUPPORT);
+                String vmwareCbtInPlaceFinalizationSupport = detailsMap.get(Host.HOST_VDDK_BLOCKCOPY_INPLACE_FINALIZATION_SUPPORT);
+                String vmwareCbtRbdSupport = detailsMap.get(Host.HOST_VDDK_BLOCKCOPY_RBD_SUPPORT);
+                String qemuImgVersion = detailsMap.get(Host.HOST_QEMU_IMG_VERSION);
+                String qemuNbdVersion = detailsMap.get(Host.HOST_QEMU_NBD_VERSION);
+                String qemuIoVersion = detailsMap.get(Host.HOST_QEMU_IO_VERSION);
+                String virtV2vInPlaceVersion = detailsMap.get(Host.HOST_VIRTV2V_INPLACE_VERSION);
+                String virtv2vInPlaceSupport = detailsMap.get(Host.HOST_VIRTV2V_INPLACE_SUPPORT);
+                String qemuImgRbdSupport = detailsMap.get(Host.HOST_QEMU_RBD_SUPPORT);
+                String vddkRbdDirectImportSupport = detailsMap.get(Host.HOST_VDDK_RBD_DIRECT_IMPORT_SUPPORT);
                 logger.debug("Got HOST_UEFI_ENABLE [{}] for host [{}]:", uefiEnabled, host);
-                if (ObjectUtils.anyNotNull(uefiEnabled, diskOnlyVmSnapshotNvramSupport, virtv2vVersion, ovftoolVersion, vddkSupport, vddkLibDir, vddkVersion)) {
+                if (ObjectUtils.anyNotNull(uefiEnabled, diskOnlyVmSnapshotNvramSupport, virtv2vVersion, ovftoolVersion, vddkSupport, vddkLibDir, vddkVersion,
+                        vmwareCbtSupport, vmwareCbtInPlaceFinalizationSupport, vmwareCbtRbdSupport, qemuImgVersion, qemuNbdVersion, qemuIoVersion, virtV2vInPlaceVersion,
+                        virtv2vInPlaceSupport, qemuImgRbdSupport, vddkRbdDirectImportSupport)) {
+                    _hostDao.loadDetails(host);
                     boolean updateNeeded = false;
                     if (syncBooleanHostCapability(host, Host.HOST_UEFI_ENABLE, uefiEnabled)) {
                         updateNeeded = true;
@@ -854,6 +867,64 @@ protected AgentAttache notifyMonitorsOfConnection(final AgentAttache attache, fi
                         }
                         updateNeeded = true;
                     }
+                    if (StringUtils.isNotBlank(vmwareCbtSupport) && !vmwareCbtSupport.equals(host.getDetails().get(Host.HOST_VDDK_BLOCKCOPY_SUPPORT))) {
+                        host.getDetails().put(Host.HOST_VDDK_BLOCKCOPY_SUPPORT, vmwareCbtSupport);
+                        updateNeeded = true;
+                    }
+                    if (StringUtils.isNotBlank(vmwareCbtInPlaceFinalizationSupport) &&
+                            !vmwareCbtInPlaceFinalizationSupport.equals(host.getDetails().get(Host.HOST_VDDK_BLOCKCOPY_INPLACE_FINALIZATION_SUPPORT))) {
+                        host.getDetails().put(Host.HOST_VDDK_BLOCKCOPY_INPLACE_FINALIZATION_SUPPORT, vmwareCbtInPlaceFinalizationSupport);
+                        updateNeeded = true;
+                    }
+                    if (StringUtils.isNotBlank(vmwareCbtRbdSupport) &&
+                            !vmwareCbtRbdSupport.equals(host.getDetails().get(Host.HOST_VDDK_BLOCKCOPY_RBD_SUPPORT))) {
+                        host.getDetails().put(Host.HOST_VDDK_BLOCKCOPY_RBD_SUPPORT, vmwareCbtRbdSupport);
+                        updateNeeded = true;
+                    }
+                    if (!StringUtils.defaultString(qemuImgVersion).equals(StringUtils.defaultString(host.getDetails().get(Host.HOST_QEMU_IMG_VERSION)))) {
+                        if (StringUtils.isBlank(qemuImgVersion)) {
+                            host.getDetails().remove(Host.HOST_QEMU_IMG_VERSION);
+                        } else {
+                            host.getDetails().put(Host.HOST_QEMU_IMG_VERSION, qemuImgVersion);
+                        }
+                        updateNeeded = true;
+                    }
+                    if (!StringUtils.defaultString(qemuNbdVersion).equals(StringUtils.defaultString(host.getDetails().get(Host.HOST_QEMU_NBD_VERSION)))) {
+                        if (StringUtils.isBlank(qemuNbdVersion)) {
+                            host.getDetails().remove(Host.HOST_QEMU_NBD_VERSION);
+                        } else {
+                            host.getDetails().put(Host.HOST_QEMU_NBD_VERSION, qemuNbdVersion);
+                        }
+                        updateNeeded = true;
+                    }
+                    if (!StringUtils.defaultString(qemuIoVersion).equals(StringUtils.defaultString(host.getDetails().get(Host.HOST_QEMU_IO_VERSION)))) {
+                        if (StringUtils.isBlank(qemuIoVersion)) {
+                            host.getDetails().remove(Host.HOST_QEMU_IO_VERSION);
+                        } else {
+                            host.getDetails().put(Host.HOST_QEMU_IO_VERSION, qemuIoVersion);
+                        }
+                        updateNeeded = true;
+                    }
+                    if (!StringUtils.defaultString(virtV2vInPlaceVersion).equals(StringUtils.defaultString(host.getDetails().get(Host.HOST_VIRTV2V_INPLACE_VERSION)))) {
+                        if (StringUtils.isBlank(virtV2vInPlaceVersion)) {
+                            host.getDetails().remove(Host.HOST_VIRTV2V_INPLACE_VERSION);
+                        } else {
+                            host.getDetails().put(Host.HOST_VIRTV2V_INPLACE_VERSION, virtV2vInPlaceVersion);
+                        }
+                        updateNeeded = true;
+                    }
+                    if (StringUtils.isNotBlank(virtv2vInPlaceSupport) && !virtv2vInPlaceSupport.equals(host.getDetails().get(Host.HOST_VIRTV2V_INPLACE_SUPPORT))) {
+                        host.getDetails().put(Host.HOST_VIRTV2V_INPLACE_SUPPORT, virtv2vInPlaceSupport);
+                        updateNeeded = true;
+                    }
+                    if (StringUtils.isNotBlank(qemuImgRbdSupport) && !qemuImgRbdSupport.equals(host.getDetails().get(Host.HOST_QEMU_RBD_SUPPORT))) {
+                        host.getDetails().put(Host.HOST_QEMU_RBD_SUPPORT, qemuImgRbdSupport);
+                        updateNeeded = true;
+                    }
+                    if (StringUtils.isNotBlank(vddkRbdDirectImportSupport) && !vddkRbdDirectImportSupport.equals(host.getDetails().get(Host.HOST_VDDK_RBD_DIRECT_IMPORT_SUPPORT))) {
+                        host.getDetails().put(Host.HOST_VDDK_RBD_DIRECT_IMPORT_SUPPORT, vddkRbdDirectImportSupport);
+                        updateNeeded = true;
+                    }
                     if (updateNeeded) {
                         _hostDao.saveDetails(host);
                     }
diff --git a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestrator.java b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestrator.java
index 2fad96ec1da2..c4fadc552857 100644
--- a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestrator.java
+++ b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestrator.java
@@ -1335,6 +1335,20 @@ private ImageFormat getSupportedImageFormatForCluster(HypervisorType hyperType)
         }
     }
 
+    /**
+     * Returns the image format for a volume taking the underlying storage pool type into account.
+     * On KVM the default cluster format is QCOW2, but block-based pools such as RBD (Ceph) and
+     * Linstor (DRBD) store volumes as RAW images. This is relevant when importing/adopting an
+     * existing volume so the recorded format matches what is actually on the pool.
+     */
+    protected ImageFormat getSupportedImageFormatForCluster(HypervisorType hyperType, Storage.StoragePoolType poolType) {
+        if (hyperType == HypervisorType.KVM
+                && (poolType == Storage.StoragePoolType.RBD || poolType == Storage.StoragePoolType.Linstor)) {
+            return ImageFormat.RAW;
+        }
+        return getSupportedImageFormatForCluster(hyperType);
+    }
+
     private boolean isSupportedImageFormatForCluster(VolumeInfo volume, HypervisorType rootDiskHyperType) {
         ImageFormat volumeFormat = volume.getFormat();
         if (rootDiskHyperType == HypervisorType.Hyperv) {
@@ -2665,7 +2679,7 @@ public DiskProfile importVolume(Type type, String name, DiskOffering offering, L
             vol.setDisplayVolume(userVm.isDisplayVm());
         }
 
-        vol.setFormat(getSupportedImageFormatForCluster(hypervisorType));
+        vol.setFormat(getSupportedImageFormatForCluster(hypervisorType, poolType));
         vol.setPoolId(poolId);
         vol.setPoolType(poolType);
         vol.setPath(path);
@@ -2709,7 +2723,7 @@ public DiskProfile updateImportedVolume(Type type, DiskOffering offering, Virtua
             vol.setDisplayVolume(userVm.isDisplayVm());
         }
 
-        vol.setFormat(getSupportedImageFormatForCluster(vm.getHypervisorType()));
+        vol.setFormat(getSupportedImageFormatForCluster(vm.getHypervisorType(), poolType));
         vol.setPoolId(poolId);
         vol.setPoolType(poolType);
         vol.setPath(path);
diff --git a/engine/orchestration/src/test/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestratorTest.java b/engine/orchestration/src/test/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestratorTest.java
index d61caf16ae5d..41f71b1b4773 100644
--- a/engine/orchestration/src/test/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestratorTest.java
+++ b/engine/orchestration/src/test/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestratorTest.java
@@ -178,6 +178,31 @@ public void testCheckAndUpdateVolumeAccountResourceCountLessSize() {
         runCheckAndUpdateVolumeAccountResourceCountTest(20L, 10L);
     }
 
+    @Test
+    public void testGetSupportedImageFormatForClusterKvmRbdIsRaw() {
+        Assert.assertEquals(Storage.ImageFormat.RAW,
+                volumeOrchestrator.getSupportedImageFormatForCluster(Hypervisor.HypervisorType.KVM, Storage.StoragePoolType.RBD));
+        // Linstor (DRBD) volumes are also raw block devices.
+        Assert.assertEquals(Storage.ImageFormat.RAW,
+                volumeOrchestrator.getSupportedImageFormatForCluster(Hypervisor.HypervisorType.KVM, Storage.StoragePoolType.Linstor));
+    }
+
+    @Test
+    public void testGetSupportedImageFormatForClusterKvmNonRbdIsQcow2() {
+        Assert.assertEquals(Storage.ImageFormat.QCOW2,
+                volumeOrchestrator.getSupportedImageFormatForCluster(Hypervisor.HypervisorType.KVM, Storage.StoragePoolType.NetworkFilesystem));
+        Assert.assertEquals(Storage.ImageFormat.QCOW2,
+                volumeOrchestrator.getSupportedImageFormatForCluster(Hypervisor.HypervisorType.KVM, Storage.StoragePoolType.Filesystem));
+    }
+
+    @Test
+    public void testGetSupportedImageFormatForClusterNonKvmIgnoresPoolType() {
+        Assert.assertEquals(Storage.ImageFormat.VHD,
+                volumeOrchestrator.getSupportedImageFormatForCluster(Hypervisor.HypervisorType.XenServer, Storage.StoragePoolType.RBD));
+        Assert.assertEquals(Storage.ImageFormat.OVA,
+                volumeOrchestrator.getSupportedImageFormatForCluster(Hypervisor.HypervisorType.VMware, Storage.StoragePoolType.RBD));
+    }
+
     @Test
     public void testGrantVolumeAccessToHostIfNeededDriverNoNeed() {
         PrimaryDataStore store = Mockito.mock(PrimaryDataStore.class);
diff --git a/engine/schema/src/main/java/com/cloud/vm/VmwareCbtMigrationCycleVO.java b/engine/schema/src/main/java/com/cloud/vm/VmwareCbtMigrationCycleVO.java
new file mode 100644
index 000000000000..78e492a434d9
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/vm/VmwareCbtMigrationCycleVO.java
@@ -0,0 +1,171 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.vm;
+
+import org.apache.cloudstack.vm.VmwareCbtMigrationCycle;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.EnumType;
+import javax.persistence.Enumerated;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Table;
+import javax.persistence.Temporal;
+import javax.persistence.TemporalType;
+import java.util.Date;
+import java.util.UUID;
+
+@Entity
+@Table(name = "vmware_cbt_migration_cycle")
+public class VmwareCbtMigrationCycleVO implements VmwareCbtMigrationCycle {
+
+    public VmwareCbtMigrationCycleVO() {
+        uuid = UUID.randomUUID().toString();
+    }
+
+    public VmwareCbtMigrationCycleVO(long migrationId, int cycleNumber) {
+        this();
+        this.migrationId = migrationId;
+        this.cycleNumber = cycleNumber;
+        this.state = State.Created;
+    }
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "id")
+    private long id;
+
+    @Column(name = "uuid")
+    private String uuid;
+
+    @Column(name = "migration_id")
+    private long migrationId;
+
+    @Column(name = "cycle_number")
+    private int cycleNumber;
+
+    @Column(name = "snapshot_moref")
+    private String snapshotMor;
+
+    @Column(name = "changed_bytes")
+    private Long changedBytes;
+
+    @Column(name = "dirty_rate")
+    private Long dirtyRate;
+
+    @Column(name = "duration")
+    private Long duration;
+
+    @Column(name = "state")
+    @Enumerated(value = EnumType.STRING)
+    private State state;
+
+    @Column(name = "description")
+    private String description;
+
+    @Column(name = "created")
+    @Temporal(value = TemporalType.TIMESTAMP)
+    private Date created;
+
+    @Column(name = "updated")
+    @Temporal(value = TemporalType.TIMESTAMP)
+    private Date updated;
+
+    @Column(name = "removed")
+    @Temporal(value = TemporalType.TIMESTAMP)
+    private Date removed;
+
+    @Override
+    public long getId() {
+        return id;
+    }
+
+    @Override
+    public String getUuid() {
+        return uuid;
+    }
+
+    public long getMigrationId() {
+        return migrationId;
+    }
+
+    public int getCycleNumber() {
+        return cycleNumber;
+    }
+
+    public String getSnapshotMor() {
+        return snapshotMor;
+    }
+
+    public void setSnapshotMor(String snapshotMor) {
+        this.snapshotMor = snapshotMor;
+    }
+
+    public Long getChangedBytes() {
+        return changedBytes;
+    }
+
+    public void setChangedBytes(Long changedBytes) {
+        this.changedBytes = changedBytes;
+    }
+
+    public Long getDirtyRate() {
+        return dirtyRate;
+    }
+
+    public void setDirtyRate(Long dirtyRate) {
+        this.dirtyRate = dirtyRate;
+    }
+
+    public Long getDuration() {
+        return duration;
+    }
+
+    public void setDuration(Long duration) {
+        this.duration = duration;
+    }
+
+    public State getState() {
+        return state;
+    }
+
+    public void setState(State state) {
+        this.state = state;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public Date getCreated() {
+        return created;
+    }
+
+    public Date getUpdated() {
+        return updated;
+    }
+
+    public void setUpdated(Date updated) {
+        this.updated = updated;
+    }
+}
diff --git a/engine/schema/src/main/java/com/cloud/vm/VmwareCbtMigrationDiskVO.java b/engine/schema/src/main/java/com/cloud/vm/VmwareCbtMigrationDiskVO.java
new file mode 100644
index 000000000000..62069cfbcd97
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/vm/VmwareCbtMigrationDiskVO.java
@@ -0,0 +1,197 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.vm;
+
+import org.apache.cloudstack.vm.VmwareCbtMigrationDisk;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.EnumType;
+import javax.persistence.Enumerated;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Table;
+import javax.persistence.Temporal;
+import javax.persistence.TemporalType;
+import java.util.Date;
+import java.util.UUID;
+
+@Entity
+@Table(name = "vmware_cbt_migration_disk")
+public class VmwareCbtMigrationDiskVO implements VmwareCbtMigrationDisk {
+
+    public VmwareCbtMigrationDiskVO() {
+        uuid = UUID.randomUUID().toString();
+    }
+
+    public VmwareCbtMigrationDiskVO(long migrationId, String sourceDiskId, Integer sourceDiskDeviceKey,
+                                    String sourceDiskPath, String datastoreName, Long capacityBytes) {
+        this();
+        this.migrationId = migrationId;
+        this.sourceDiskId = sourceDiskId;
+        this.sourceDiskDeviceKey = sourceDiskDeviceKey;
+        this.sourceDiskPath = sourceDiskPath;
+        this.datastoreName = datastoreName;
+        this.capacityBytes = capacityBytes;
+        this.state = State.Created;
+    }
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "id")
+    private long id;
+
+    @Column(name = "uuid")
+    private String uuid;
+
+    @Column(name = "migration_id")
+    private long migrationId;
+
+    @Column(name = "source_disk_id")
+    private String sourceDiskId;
+
+    @Column(name = "source_disk_device_key")
+    private Integer sourceDiskDeviceKey;
+
+    @Column(name = "source_disk_path")
+    private String sourceDiskPath;
+
+    @Column(name = "datastore_name")
+    private String datastoreName;
+
+    @Column(name = "capacity_bytes")
+    private Long capacityBytes;
+
+    @Column(name = "target_path")
+    private String targetPath;
+
+    @Column(name = "target_format")
+    private String targetFormat;
+
+    @Column(name = "change_id")
+    private String changeId;
+
+    @Column(name = "snapshot_moref")
+    private String snapshotMor;
+
+    @Column(name = "state")
+    @Enumerated(value = EnumType.STRING)
+    private State state;
+
+    @Column(name = "created")
+    @Temporal(value = TemporalType.TIMESTAMP)
+    private Date created;
+
+    @Column(name = "updated")
+    @Temporal(value = TemporalType.TIMESTAMP)
+    private Date updated;
+
+    @Column(name = "removed")
+    @Temporal(value = TemporalType.TIMESTAMP)
+    private Date removed;
+
+    @Override
+    public long getId() {
+        return id;
+    }
+
+    @Override
+    public String getUuid() {
+        return uuid;
+    }
+
+    public long getMigrationId() {
+        return migrationId;
+    }
+
+    public String getSourceDiskId() {
+        return sourceDiskId;
+    }
+
+    public Integer getSourceDiskDeviceKey() {
+        return sourceDiskDeviceKey;
+    }
+
+    public void setSourceDiskDeviceKey(Integer sourceDiskDeviceKey) {
+        this.sourceDiskDeviceKey = sourceDiskDeviceKey;
+    }
+
+    public String getSourceDiskPath() {
+        return sourceDiskPath;
+    }
+
+    public String getDatastoreName() {
+        return datastoreName;
+    }
+
+    public Long getCapacityBytes() {
+        return capacityBytes;
+    }
+
+    public String getTargetPath() {
+        return targetPath;
+    }
+
+    public void setTargetPath(String targetPath) {
+        this.targetPath = targetPath;
+    }
+
+    public String getTargetFormat() {
+        return targetFormat;
+    }
+
+    public void setTargetFormat(String targetFormat) {
+        this.targetFormat = targetFormat;
+    }
+
+    public String getChangeId() {
+        return changeId;
+    }
+
+    public void setChangeId(String changeId) {
+        this.changeId = changeId;
+    }
+
+    public String getSnapshotMor() {
+        return snapshotMor;
+    }
+
+    public void setSnapshotMor(String snapshotMor) {
+        this.snapshotMor = snapshotMor;
+    }
+
+    public State getState() {
+        return state;
+    }
+
+    public void setState(State state) {
+        this.state = state;
+    }
+
+    public Date getCreated() {
+        return created;
+    }
+
+    public Date getUpdated() {
+        return updated;
+    }
+
+    public void setUpdated(Date updated) {
+        this.updated = updated;
+    }
+}
diff --git a/engine/schema/src/main/java/com/cloud/vm/VmwareCbtMigrationVO.java b/engine/schema/src/main/java/com/cloud/vm/VmwareCbtMigrationVO.java
new file mode 100644
index 000000000000..24ad5b1dd552
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/vm/VmwareCbtMigrationVO.java
@@ -0,0 +1,465 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.vm;
+
+import org.apache.cloudstack.vm.VmwareCbtMigration;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.EnumType;
+import javax.persistence.Enumerated;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Table;
+import javax.persistence.Temporal;
+import javax.persistence.TemporalType;
+import java.util.Date;
+import java.util.UUID;
+
+import com.cloud.utils.db.Encrypt;
+
+@Entity
+@Table(name = "vmware_cbt_migration")
+public class VmwareCbtMigrationVO implements VmwareCbtMigration {
+
+    public VmwareCbtMigrationVO() {
+        uuid = UUID.randomUUID().toString();
+    }
+
+    public VmwareCbtMigrationVO(long zoneId, long accountId, long userId, long destinationClusterId,
+                                String displayName, String vcenter, String datacenter, String sourceHost,
+                                String sourceCluster, String sourceVmName) {
+        this();
+        this.zoneId = zoneId;
+        this.accountId = accountId;
+        this.userId = userId;
+        this.destinationClusterId = destinationClusterId;
+        this.displayName = displayName;
+        this.vcenter = vcenter;
+        this.datacenter = datacenter;
+        this.sourceHost = sourceHost;
+        this.sourceCluster = sourceCluster;
+        this.sourceVmName = sourceVmName;
+        this.state = State.Created;
+        this.currentStep = "Created";
+    }
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "id")
+    private long id;
+
+    @Column(name = "uuid")
+    private String uuid;
+
+    @Column(name = "zone_id")
+    private long zoneId;
+
+    @Column(name = "account_id")
+    private long accountId;
+
+    @Column(name = "user_id")
+    private long userId;
+
+    @Column(name = "vm_id")
+    private Long vmId;
+
+    @Column(name = "existing_vcenter_id")
+    private Long existingVcenterId;
+
+    @Column(name = "source_username")
+    private String sourceUsername;
+
+    @Encrypt
+    @Column(name = "source_password")
+    private String sourcePassword;
+
+    @Column(name = "destination_cluster_id")
+    private long destinationClusterId;
+
+    @Column(name = "convert_host_id")
+    private Long convertHostId;
+
+    @Column(name = "storage_pool_id")
+    private Long storagePoolId;
+
+    @Column(name = "display_name")
+    private String displayName;
+
+    @Column(name = "host_name")
+    private String hostName;
+
+    @Column(name = "template_id")
+    private Long templateId;
+
+    @Column(name = "service_offering_id")
+    private Long serviceOfferingId;
+
+    @Column(name = "guest_os_id")
+    private Long guestOsId;
+
+    @Column(name = "data_disk_offering_map")
+    private String dataDiskOfferingMap;
+
+    @Column(name = "nic_network_map")
+    private String nicNetworkMap;
+
+    @Column(name = "nic_ip_address_map")
+    private String nicIpAddressMap;
+
+    @Column(name = "import_details")
+    private String importDetails;
+
+    @Column(name = "forced")
+    private boolean forced;
+
+    @Column(name = "vcenter")
+    private String vcenter;
+
+    @Column(name = "datacenter")
+    private String datacenter;
+
+    @Column(name = "source_host")
+    private String sourceHost;
+
+    @Column(name = "source_cluster")
+    private String sourceCluster;
+
+    @Column(name = "source_vm_name")
+    private String sourceVmName;
+
+    @Column(name = "vddk_lib_dir")
+    private String vddkLibDir;
+
+    @Column(name = "vddk_transports")
+    private String vddkTransports;
+
+    @Column(name = "vddk_thumbprint")
+    private String vddkThumbprint;
+
+    @Column(name = "state")
+    @Enumerated(value = EnumType.STRING)
+    private State state;
+
+    @Column(name = "current_step")
+    private String currentStep;
+
+    @Column(name = "last_error")
+    private String lastError;
+
+    @Column(name = "completed_cycles")
+    private int completedCycles;
+
+    @Column(name = "quiet_cycles")
+    private int quietCycles;
+
+    @Column(name = "total_changed_bytes")
+    private long totalChangedBytes;
+
+    @Column(name = "last_changed_bytes")
+    private Long lastChangedBytes;
+
+    @Column(name = "last_dirty_rate")
+    private Long lastDirtyRate;
+
+    @Column(name = "created")
+    @Temporal(value = TemporalType.TIMESTAMP)
+    private Date created;
+
+    @Column(name = "updated")
+    @Temporal(value = TemporalType.TIMESTAMP)
+    private Date updated;
+
+    @Column(name = "removed")
+    @Temporal(value = TemporalType.TIMESTAMP)
+    private Date removed;
+
+    @Override
+    public long getId() {
+        return id;
+    }
+
+    @Override
+    public String getUuid() {
+        return uuid;
+    }
+
+    public long getZoneId() {
+        return zoneId;
+    }
+
+    public long getAccountId() {
+        return accountId;
+    }
+
+    public long getUserId() {
+        return userId;
+    }
+
+    public Long getVmId() {
+        return vmId;
+    }
+
+    public void setVmId(Long vmId) {
+        this.vmId = vmId;
+    }
+
+    public Long getExistingVcenterId() {
+        return existingVcenterId;
+    }
+
+    public void setExistingVcenterId(Long existingVcenterId) {
+        this.existingVcenterId = existingVcenterId;
+    }
+
+    public String getSourceUsername() {
+        return sourceUsername;
+    }
+
+    public void setSourceUsername(String sourceUsername) {
+        this.sourceUsername = sourceUsername;
+    }
+
+    public String getSourcePassword() {
+        return sourcePassword;
+    }
+
+    public void setSourcePassword(String sourcePassword) {
+        this.sourcePassword = sourcePassword;
+    }
+
+    public long getDestinationClusterId() {
+        return destinationClusterId;
+    }
+
+    public Long getConvertHostId() {
+        return convertHostId;
+    }
+
+    public void setConvertHostId(Long convertHostId) {
+        this.convertHostId = convertHostId;
+    }
+
+    public Long getStoragePoolId() {
+        return storagePoolId;
+    }
+
+    public void setStoragePoolId(Long storagePoolId) {
+        this.storagePoolId = storagePoolId;
+    }
+
+    public String getDisplayName() {
+        return displayName;
+    }
+
+    public String getHostName() {
+        return hostName;
+    }
+
+    public void setHostName(String hostName) {
+        this.hostName = hostName;
+    }
+
+    public Long getTemplateId() {
+        return templateId;
+    }
+
+    public void setTemplateId(Long templateId) {
+        this.templateId = templateId;
+    }
+
+    public Long getServiceOfferingId() {
+        return serviceOfferingId;
+    }
+
+    public void setServiceOfferingId(Long serviceOfferingId) {
+        this.serviceOfferingId = serviceOfferingId;
+    }
+
+    public Long getGuestOsId() {
+        return guestOsId;
+    }
+
+    public void setGuestOsId(Long guestOsId) {
+        this.guestOsId = guestOsId;
+    }
+
+    public String getDataDiskOfferingMap() {
+        return dataDiskOfferingMap;
+    }
+
+    public void setDataDiskOfferingMap(String dataDiskOfferingMap) {
+        this.dataDiskOfferingMap = dataDiskOfferingMap;
+    }
+
+    public String getNicNetworkMap() {
+        return nicNetworkMap;
+    }
+
+    public void setNicNetworkMap(String nicNetworkMap) {
+        this.nicNetworkMap = nicNetworkMap;
+    }
+
+    public String getNicIpAddressMap() {
+        return nicIpAddressMap;
+    }
+
+    public void setNicIpAddressMap(String nicIpAddressMap) {
+        this.nicIpAddressMap = nicIpAddressMap;
+    }
+
+    public String getImportDetails() {
+        return importDetails;
+    }
+
+    public void setImportDetails(String importDetails) {
+        this.importDetails = importDetails;
+    }
+
+    public boolean isForced() {
+        return forced;
+    }
+
+    public void setForced(boolean forced) {
+        this.forced = forced;
+    }
+
+    public String getVcenter() {
+        return vcenter;
+    }
+
+    public String getDatacenter() {
+        return datacenter;
+    }
+
+    public String getSourceHost() {
+        return sourceHost;
+    }
+
+    public String getSourceCluster() {
+        return sourceCluster;
+    }
+
+    public String getSourceVmName() {
+        return sourceVmName;
+    }
+
+    public String getVddkLibDir() {
+        return vddkLibDir;
+    }
+
+    public void setVddkLibDir(String vddkLibDir) {
+        this.vddkLibDir = vddkLibDir;
+    }
+
+    public String getVddkTransports() {
+        return vddkTransports;
+    }
+
+    public void setVddkTransports(String vddkTransports) {
+        this.vddkTransports = vddkTransports;
+    }
+
+    public String getVddkThumbprint() {
+        return vddkThumbprint;
+    }
+
+    public void setVddkThumbprint(String vddkThumbprint) {
+        this.vddkThumbprint = vddkThumbprint;
+    }
+
+    public State getState() {
+        return state;
+    }
+
+    public void setState(State state) {
+        this.state = state;
+    }
+
+    public String getCurrentStep() {
+        return currentStep;
+    }
+
+    public void setCurrentStep(String currentStep) {
+        this.currentStep = currentStep;
+    }
+
+    public String getLastError() {
+        return lastError;
+    }
+
+    public void setLastError(String lastError) {
+        this.lastError = lastError;
+    }
+
+    public int getCompletedCycles() {
+        return completedCycles;
+    }
+
+    public void setCompletedCycles(int completedCycles) {
+        this.completedCycles = completedCycles;
+    }
+
+    public int getQuietCycles() {
+        return quietCycles;
+    }
+
+    public void setQuietCycles(int quietCycles) {
+        this.quietCycles = quietCycles;
+    }
+
+    public long getTotalChangedBytes() {
+        return totalChangedBytes;
+    }
+
+    public void setTotalChangedBytes(long totalChangedBytes) {
+        this.totalChangedBytes = totalChangedBytes;
+    }
+
+    public Long getLastChangedBytes() {
+        return lastChangedBytes;
+    }
+
+    public void setLastChangedBytes(Long lastChangedBytes) {
+        this.lastChangedBytes = lastChangedBytes;
+    }
+
+    public Long getLastDirtyRate() {
+        return lastDirtyRate;
+    }
+
+    public void setLastDirtyRate(Long lastDirtyRate) {
+        this.lastDirtyRate = lastDirtyRate;
+    }
+
+    public Date getCreated() {
+        return created;
+    }
+
+    public Date getUpdated() {
+        return updated;
+    }
+
+    public void setUpdated(Date updated) {
+        this.updated = updated;
+    }
+
+    public Date getRemoved() {
+        return removed;
+    }
+}
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationCycleDao.java b/engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationCycleDao.java
new file mode 100644
index 000000000000..25debad70156
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationCycleDao.java
@@ -0,0 +1,26 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.vm.dao;
+
+import com.cloud.utils.db.GenericDao;
+import com.cloud.vm.VmwareCbtMigrationCycleVO;
+
+import java.util.List;
+
+public interface VmwareCbtMigrationCycleDao extends GenericDao<VmwareCbtMigrationCycleVO, Long> {
+    List<VmwareCbtMigrationCycleVO> listByMigrationId(long migrationId);
+}
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationCycleDaoImpl.java b/engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationCycleDaoImpl.java
new file mode 100644
index 000000000000..0d823a29287b
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationCycleDaoImpl.java
@@ -0,0 +1,46 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.vm.dao;
+
+import com.cloud.utils.db.Filter;
+import com.cloud.utils.db.GenericDaoBase;
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
+import com.cloud.vm.VmwareCbtMigrationCycleVO;
+import org.springframework.stereotype.Component;
+
+import java.util.List;
+
+@Component
+public class VmwareCbtMigrationCycleDaoImpl extends GenericDaoBase<VmwareCbtMigrationCycleVO, Long> implements VmwareCbtMigrationCycleDao {
+
+    private final SearchBuilder<VmwareCbtMigrationCycleVO> migrationSearch;
+
+    public VmwareCbtMigrationCycleDaoImpl() {
+        migrationSearch = createSearchBuilder();
+        migrationSearch.and("migrationId", migrationSearch.entity().getMigrationId(), SearchCriteria.Op.EQ);
+        migrationSearch.done();
+    }
+
+    @Override
+    public List<VmwareCbtMigrationCycleVO> listByMigrationId(long migrationId) {
+        SearchCriteria<VmwareCbtMigrationCycleVO> sc = migrationSearch.create();
+        sc.setParameters("migrationId", migrationId);
+        Filter filter = new Filter(VmwareCbtMigrationCycleVO.class, "cycleNumber", true, null, null);
+        return listBy(sc, filter);
+    }
+}
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationDao.java b/engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationDao.java
new file mode 100644
index 000000000000..09ee0e6367c3
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationDao.java
@@ -0,0 +1,62 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.vm.dao;
+
+import com.cloud.utils.Pair;
+import com.cloud.utils.db.GenericDao;
+import com.cloud.vm.VmwareCbtMigrationVO;
+import org.apache.cloudstack.vm.VmwareCbtMigration;
+
+import java.util.Date;
+import java.util.List;
+
+public interface VmwareCbtMigrationDao extends GenericDao<VmwareCbtMigrationVO, Long> {
+    Pair<List<VmwareCbtMigrationVO>, Integer> listMigrations(Long id, Long zoneId, Long accountId, String vcenter,
+                                                             String sourceVmName, VmwareCbtMigration.State state,
+                                                             Long startIndex, Long pageSizeVal);
+
+    List<VmwareCbtMigrationVO> listByConvertHostId(Long convertHostId);
+
+    /**
+     * Persists the given migration only while the stored record has not reached a terminal
+     * state (Completed, Failed or Cancelled), as a single conditional statement.
+     *
+     * Long-running replication and cutover jobs use this instead of a plain update so a
+     * migration that an operator cancelled mid-flight is not resurrected by a job that started
+     * before the cancellation: cancelling removes the target disks, so a later blind write of a
+     * non-terminal state would leave a record claiming to replicate onto disks that no longer
+     * exist, and which can no longer be deleted because it is not terminal.
+     *
+     * @return true if the record was still non-terminal and was updated, false if it had
+     *         already reached a terminal state and was therefore left untouched.
+     */
+    boolean updateIfNotTerminal(VmwareCbtMigrationVO migration);
+
+    /**
+     * Atomically records a successful CloudStack VM import while the migration is still
+     * non-terminal. The VM reference, terminal state and credential removal must be one
+     * conditional update so a concurrent cancellation cannot be overwritten.
+     */
+    boolean completeImportIfNotTerminal(long migrationId, long vmId, Date updated);
+
+    /**
+     * Records the VM created by an import that raced with a terminal state without changing that
+     * terminal state. This keeps the imported VM discoverable for operator reconciliation and
+     * removes stored source credentials.
+     */
+    boolean recordImportedVmAndClearCredentials(long migrationId, long vmId, Date updated);
+}
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationDaoImpl.java b/engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationDaoImpl.java
new file mode 100644
index 000000000000..3bcb0a087b39
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationDaoImpl.java
@@ -0,0 +1,129 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.vm.dao;
+
+import com.cloud.utils.Pair;
+import com.cloud.utils.db.Filter;
+import com.cloud.utils.db.GenericDaoBase;
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
+import com.cloud.vm.VmwareCbtMigrationVO;
+import org.apache.cloudstack.vm.VmwareCbtMigration;
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.stereotype.Component;
+
+import java.util.Date;
+import java.util.List;
+
+@Component
+public class VmwareCbtMigrationDaoImpl extends GenericDaoBase<VmwareCbtMigrationVO, Long> implements VmwareCbtMigrationDao {
+
+    private static final VmwareCbtMigration.State[] TERMINAL_STATES = {
+            VmwareCbtMigration.State.Completed,
+            VmwareCbtMigration.State.Failed,
+            VmwareCbtMigration.State.Cancelled
+    };
+
+    private final SearchBuilder<VmwareCbtMigrationVO> migrationSearch;
+    private final SearchBuilder<VmwareCbtMigrationVO> convertHostSearch;
+    private final SearchBuilder<VmwareCbtMigrationVO> nonTerminalSearch;
+
+    public VmwareCbtMigrationDaoImpl() {
+        migrationSearch = createSearchBuilder();
+        migrationSearch.and("id", migrationSearch.entity().getId(), SearchCriteria.Op.EQ);
+        migrationSearch.and("zoneId", migrationSearch.entity().getZoneId(), SearchCriteria.Op.EQ);
+        migrationSearch.and("accountId", migrationSearch.entity().getAccountId(), SearchCriteria.Op.EQ);
+        migrationSearch.and("vcenter", migrationSearch.entity().getVcenter(), SearchCriteria.Op.EQ);
+        migrationSearch.and("sourceVmName", migrationSearch.entity().getSourceVmName(), SearchCriteria.Op.EQ);
+        migrationSearch.and("state", migrationSearch.entity().getState(), SearchCriteria.Op.EQ);
+        migrationSearch.done();
+
+        convertHostSearch = createSearchBuilder();
+        convertHostSearch.and("convertHostId", convertHostSearch.entity().getConvertHostId(), SearchCriteria.Op.EQ);
+        convertHostSearch.done();
+
+        nonTerminalSearch = createSearchBuilder();
+        nonTerminalSearch.and("id", nonTerminalSearch.entity().getId(), SearchCriteria.Op.EQ);
+        nonTerminalSearch.and("state", nonTerminalSearch.entity().getState(), SearchCriteria.Op.NOTIN);
+        nonTerminalSearch.done();
+    }
+
+    @Override
+    public boolean updateIfNotTerminal(VmwareCbtMigrationVO migration) {
+        SearchCriteria<VmwareCbtMigrationVO> sc = nonTerminalSearch.create();
+        sc.setParameters("id", migration.getId());
+        sc.setParameters("state", (Object[]) TERMINAL_STATES);
+        return update(migration, sc) > 0;
+    }
+
+    @Override
+    public boolean completeImportIfNotTerminal(long migrationId, long vmId, Date updated) {
+        VmwareCbtMigrationVO migration = createImportedVmUpdate(migrationId, vmId, updated);
+        migration.setState(VmwareCbtMigration.State.Completed);
+        migration.setCurrentStep("CloudStack VM import completed");
+        migration.setLastError(null);
+        return updateIfNotTerminal(migration);
+    }
+
+    @Override
+    public boolean recordImportedVmAndClearCredentials(long migrationId, long vmId, Date updated) {
+        return update(migrationId, createImportedVmUpdate(migrationId, vmId, updated));
+    }
+
+    private VmwareCbtMigrationVO createImportedVmUpdate(long migrationId, long vmId, Date updated) {
+        VmwareCbtMigrationVO migration = createForUpdate(migrationId);
+        migration.setVmId(vmId);
+        migration.setSourceUsername(null);
+        migration.setSourcePassword(null);
+        migration.setUpdated(updated);
+        return migration;
+    }
+
+    @Override
+    public Pair<List<VmwareCbtMigrationVO>, Integer> listMigrations(Long id, Long zoneId, Long accountId, String vcenter,
+                                                                    String sourceVmName, VmwareCbtMigration.State state,
+                                                                    Long startIndex, Long pageSizeVal) {
+        SearchCriteria<VmwareCbtMigrationVO> sc = migrationSearch.create();
+        if (id != null) {
+            sc.setParameters("id", id);
+        }
+        if (zoneId != null) {
+            sc.setParameters("zoneId", zoneId);
+        }
+        if (accountId != null) {
+            sc.setParameters("accountId", accountId);
+        }
+        if (StringUtils.isNotBlank(vcenter)) {
+            sc.setParameters("vcenter", vcenter);
+        }
+        if (StringUtils.isNotBlank(sourceVmName)) {
+            sc.setParameters("sourceVmName", sourceVmName);
+        }
+        if (state != null) {
+            sc.setParameters("state", state);
+        }
+        Filter filter = new Filter(VmwareCbtMigrationVO.class, "created", false, startIndex, pageSizeVal);
+        return searchAndCount(sc, filter);
+    }
+
+    @Override
+    public List<VmwareCbtMigrationVO> listByConvertHostId(Long convertHostId) {
+        SearchCriteria<VmwareCbtMigrationVO> sc = convertHostSearch.create();
+        sc.setParameters("convertHostId", convertHostId);
+        return listBy(sc);
+    }
+}
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationDiskDao.java b/engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationDiskDao.java
new file mode 100644
index 000000000000..60a3f13355c6
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationDiskDao.java
@@ -0,0 +1,26 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.vm.dao;
+
+import com.cloud.utils.db.GenericDao;
+import com.cloud.vm.VmwareCbtMigrationDiskVO;
+
+import java.util.List;
+
+public interface VmwareCbtMigrationDiskDao extends GenericDao<VmwareCbtMigrationDiskVO, Long> {
+    List<VmwareCbtMigrationDiskVO> listByMigrationId(long migrationId);
+}
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationDiskDaoImpl.java b/engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationDiskDaoImpl.java
new file mode 100644
index 000000000000..55463f249366
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/VmwareCbtMigrationDiskDaoImpl.java
@@ -0,0 +1,44 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.vm.dao;
+
+import com.cloud.utils.db.GenericDaoBase;
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
+import com.cloud.vm.VmwareCbtMigrationDiskVO;
+import org.springframework.stereotype.Component;
+
+import java.util.List;
+
+@Component
+public class VmwareCbtMigrationDiskDaoImpl extends GenericDaoBase<VmwareCbtMigrationDiskVO, Long> implements VmwareCbtMigrationDiskDao {
+
+    private final SearchBuilder<VmwareCbtMigrationDiskVO> migrationSearch;
+
+    public VmwareCbtMigrationDiskDaoImpl() {
+        migrationSearch = createSearchBuilder();
+        migrationSearch.and("migrationId", migrationSearch.entity().getMigrationId(), SearchCriteria.Op.EQ);
+        migrationSearch.done();
+    }
+
+    @Override
+    public List<VmwareCbtMigrationDiskVO> listByMigrationId(long migrationId) {
+        SearchCriteria<VmwareCbtMigrationDiskVO> sc = migrationSearch.create();
+        sc.setParameters("migrationId", migrationId);
+        return listBy(sc);
+    }
+}
diff --git a/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-daos-context.xml b/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-daos-context.xml
index 484bebe22a09..291f9c0b72d8 100644
--- a/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-daos-context.xml
+++ b/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-daos-context.xml
@@ -322,6 +322,9 @@
   <bean id="gpuDeviceDaoImpl" class="com.cloud.gpu.dao.GpuDeviceDaoImpl" />
   <bean id="vgpuProfileDaoImpl" class="com.cloud.gpu.dao.VgpuProfileDaoImpl" />
   <bean id="importVMTaskDaoImpl" class="com.cloud.vm.dao.ImportVMTaskDaoImpl" />
+  <bean id="vmwareCbtMigrationDaoImpl" class="com.cloud.vm.dao.VmwareCbtMigrationDaoImpl" />
+  <bean id="vmwareCbtMigrationDiskDaoImpl" class="com.cloud.vm.dao.VmwareCbtMigrationDiskDaoImpl" />
+  <bean id="vmwareCbtMigrationCycleDaoImpl" class="com.cloud.vm.dao.VmwareCbtMigrationCycleDaoImpl" />
   <bean id="apiKeyPairDaoImpl" class="org.apache.cloudstack.acl.dao.ApiKeyPairDaoImpl" />
   <bean id="apiKeyPairPermissionsDaoImpl" class="org.apache.cloudstack.acl.dao.ApiKeyPairPermissionsDaoImpl" />
   <bean id="kmsKeyDaoImpl" class="org.apache.cloudstack.kms.dao.KMSKeyDaoImpl" />
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42300to2400.sql b/engine/schema/src/main/resources/META-INF/db/schema-42300to2400.sql
index 863ee93bc01a..8f59321627db 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-42300to2400.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42300to2400.sql
@@ -19,6 +19,132 @@
 -- Schema upgrade from 4.23.0.0 to 24.0.0
 --;
 
+-- VMware CBT warm migration session state
+CREATE TABLE IF NOT EXISTS `cloud`.`vmware_cbt_migration` (
+    `id` bigint unsigned NOT NULL auto_increment COMMENT 'id',
+    `uuid` varchar(40) NOT NULL COMMENT 'UUID',
+    `zone_id` bigint unsigned NOT NULL COMMENT 'Zone ID',
+    `account_id` bigint unsigned NOT NULL COMMENT 'Account ID',
+    `user_id` bigint unsigned NOT NULL COMMENT 'User ID',
+    `vm_id` bigint unsigned COMMENT 'Imported VM ID after cutover',
+    `existing_vcenter_id` bigint unsigned COMMENT 'Linked VMware datacenter ID when the source vCenter is registered',
+    `source_username` varchar(255) COMMENT 'Stored source vCenter username for external VMware CBT migrations',
+    `source_password` varchar(1024) COMMENT 'Encrypted stored source vCenter password for external VMware CBT migrations',
+    `destination_cluster_id` bigint unsigned NOT NULL COMMENT 'Destination KVM cluster ID',
+    `convert_host_id` bigint unsigned COMMENT 'KVM host used for conversion and synchronization',
+    `storage_pool_id` bigint unsigned COMMENT 'Destination primary storage pool ID',
+    `display_name` varchar(255) COMMENT 'Target VM display name',
+    `host_name` varchar(255) COMMENT 'Target VM host name',
+    `template_id` bigint unsigned COMMENT 'Template ID for CloudStack VM import',
+    `service_offering_id` bigint unsigned COMMENT 'Service offering ID for CloudStack VM import',
+    `guest_os_id` bigint unsigned COMMENT 'Guest OS ID for CloudStack VM import',
+    `data_disk_offering_map` text COMMENT 'JSON data disk to disk offering ID map for CloudStack VM import',
+    `nic_network_map` text COMMENT 'JSON NIC to network ID map for CloudStack VM import',
+    `nic_ip_address_map` text COMMENT 'JSON NIC to IPv4 address map for CloudStack VM import',
+    `import_details` text COMMENT 'JSON details map for CloudStack VM import',
+    `forced` tinyint(1) NOT NULL DEFAULT 0 COMMENT 'Whether duplicate NIC MAC addresses are allowed during CloudStack VM import',
+    `vcenter` varchar(255) COMMENT 'Source vCenter',
+    `datacenter` varchar(255) COMMENT 'Source vCenter datacenter name',
+    `source_host` varchar(255) COMMENT 'Source VMware host name or IP',
+    `source_cluster` varchar(255) COMMENT 'Source VMware cluster name',
+    `source_vm_name` varchar(255) NOT NULL COMMENT 'Source VM name on vCenter',
+    `vddk_lib_dir` varchar(1024) COMMENT 'Optional VDDK library directory override',
+    `vddk_transports` varchar(255) COMMENT 'Optional VDDK transport list override',
+    `vddk_thumbprint` varchar(255) COMMENT 'Optional vCenter TLS thumbprint for VDDK connections',
+    `state` varchar(32) NOT NULL COMMENT 'Migration state',
+    `current_step` varchar(255) COMMENT 'Current migration step',
+    `last_error` varchar(1024) COMMENT 'Last error message',
+    `completed_cycles` int unsigned NOT NULL DEFAULT 0 COMMENT 'Completed CBT delta cycles',
+    `quiet_cycles` int unsigned NOT NULL DEFAULT 0 COMMENT 'Consecutive quiet CBT delta cycles',
+    `total_changed_bytes` bigint unsigned NOT NULL DEFAULT 0 COMMENT 'Total changed bytes copied across delta cycles',
+    `last_changed_bytes` bigint unsigned COMMENT 'Changed bytes copied in the latest delta cycle',
+    `last_dirty_rate` bigint unsigned COMMENT 'Changed bytes per second in the latest delta cycle',
+    `created` datetime NOT NULL COMMENT 'date created',
+    `updated` datetime COMMENT 'date updated if not null',
+    `removed` datetime COMMENT 'date removed if not null',
+    PRIMARY KEY (`id`),
+    CONSTRAINT `fk_vmware_cbt_migration__zone_id` FOREIGN KEY (`zone_id`) REFERENCES `data_center`(`id`) ON DELETE CASCADE,
+    CONSTRAINT `fk_vmware_cbt_migration__account_id` FOREIGN KEY (`account_id`) REFERENCES `account`(`id`) ON DELETE CASCADE,
+    CONSTRAINT `fk_vmware_cbt_migration__user_id` FOREIGN KEY (`user_id`) REFERENCES `user`(`id`) ON DELETE CASCADE,
+    CONSTRAINT `fk_vmware_cbt_migration__vm_id` FOREIGN KEY (`vm_id`) REFERENCES `vm_instance`(`id`) ON DELETE SET NULL,
+    CONSTRAINT `fk_vmware_cbt_migration__existing_vcenter_id` FOREIGN KEY (`existing_vcenter_id`) REFERENCES `vmware_data_center`(`id`) ON DELETE SET NULL,
+    CONSTRAINT `fk_vmware_cbt_migration__destination_cluster_id` FOREIGN KEY (`destination_cluster_id`) REFERENCES `cluster`(`id`) ON DELETE CASCADE,
+    CONSTRAINT `fk_vmware_cbt_migration__convert_host_id` FOREIGN KEY (`convert_host_id`) REFERENCES `host`(`id`) ON DELETE SET NULL,
+    CONSTRAINT `fk_vmware_cbt_migration__storage_pool_id` FOREIGN KEY (`storage_pool_id`) REFERENCES `storage_pool`(`id`) ON DELETE SET NULL,
+    INDEX `i_vmware_cbt_migration__zone_id` (`zone_id`),
+    INDEX `i_vmware_cbt_migration__state` (`state`),
+    INDEX `i_vmware_cbt_migration__source_vm_name` (`source_vm_name`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.vmware_cbt_migration', 'host_name', 'varchar(255) COMMENT "Target VM host name"');
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.vmware_cbt_migration', 'source_username', 'varchar(255) COMMENT "Stored source vCenter username for external VMware CBT migrations"');
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.vmware_cbt_migration', 'source_password', 'varchar(1024) COMMENT "Encrypted stored source vCenter password for external VMware CBT migrations"');
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.vmware_cbt_migration', 'template_id', 'bigint unsigned COMMENT "Template ID for CloudStack VM import"');
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.vmware_cbt_migration', 'service_offering_id', 'bigint unsigned COMMENT "Service offering ID for CloudStack VM import"');
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.vmware_cbt_migration', 'guest_os_id', 'bigint unsigned COMMENT "Guest OS ID for CloudStack VM import"');
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.vmware_cbt_migration', 'data_disk_offering_map', 'text COMMENT "JSON data disk to disk offering ID map for CloudStack VM import"');
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.vmware_cbt_migration', 'nic_network_map', 'text COMMENT "JSON NIC to network ID map for CloudStack VM import"');
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.vmware_cbt_migration', 'nic_ip_address_map', 'text COMMENT "JSON NIC to IPv4 address map for CloudStack VM import"');
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.vmware_cbt_migration', 'import_details', 'text COMMENT "JSON details map for CloudStack VM import"');
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.vmware_cbt_migration', 'forced', 'tinyint(1) NOT NULL DEFAULT 0 COMMENT "Whether duplicate NIC MAC addresses are allowed during CloudStack VM import"');
+
+INSERT INTO `cloud`.`configuration` (`category`, `instance`, `component`, `name`, `value`, `description`, `default_value`, `updated`, `scope`, `is_dynamic`)
+VALUES ('Advanced', 'DEFAULT', 'VmwareCbtMigrationManagerImpl', 'vmware.cbt.allow.non.inplace.finalization', 'false',
+        'If true, VMware CBT cutover may fall back to regular virt-v2v finalization for qcow2 file targets when true in-place finalization is unavailable. The fallback stages temporary data on the selected primary storage and requires additional free space.',
+        'false', NOW(), 1, 1)
+ON DUPLICATE KEY UPDATE `category` = VALUES(`category`), `component` = VALUES(`component`),
+    `description` = VALUES(`description`), `default_value` = VALUES(`default_value`),
+    `updated` = NOW(), `scope` = VALUES(`scope`), `is_dynamic` = VALUES(`is_dynamic`);
+
+INSERT INTO `cloud`.`configuration` (`category`, `instance`, `component`, `name`, `value`, `description`, `default_value`, `updated`, `scope`, `is_dynamic`)
+VALUES ('Advanced', 'DEFAULT', 'VmwareCbtMigrationManagerImpl', 'vmware.cbt.migration.agent.command.timeout', '86400',
+        'Timeout in seconds for long-running VMware CBT data-plane commands dispatched to the KVM agent, including initial full sync, delta sync, final delta sync, and cutover finalization.',
+        '86400', NOW(), 1, 1)
+ON DUPLICATE KEY UPDATE `category` = VALUES(`category`), `component` = VALUES(`component`),
+    `description` = VALUES(`description`), `default_value` = VALUES(`default_value`),
+    `updated` = NOW(), `scope` = VALUES(`scope`), `is_dynamic` = VALUES(`is_dynamic`);
+
+CREATE TABLE IF NOT EXISTS `cloud`.`vmware_cbt_migration_disk` (
+    `id` bigint unsigned NOT NULL auto_increment COMMENT 'id',
+    `uuid` varchar(40) NOT NULL COMMENT 'UUID',
+    `migration_id` bigint unsigned NOT NULL COMMENT 'VMware CBT migration ID',
+    `source_disk_id` varchar(255) COMMENT 'Source VMware disk key or label',
+    `source_disk_device_key` int COMMENT 'Source VMware virtual disk device key for QueryChangedDiskAreas',
+    `source_disk_path` varchar(1024) COMMENT 'Source VMware disk path',
+    `datastore_name` varchar(255) COMMENT 'Source VMware datastore name',
+    `capacity_bytes` bigint unsigned COMMENT 'Source disk capacity in bytes',
+    `target_path` varchar(1024) COMMENT 'Target KVM disk path',
+    `target_format` varchar(32) COMMENT 'Target KVM disk format',
+    `change_id` varchar(255) COMMENT 'Latest VMware CBT change ID',
+    `snapshot_moref` varchar(255) COMMENT 'Latest VMware snapshot managed object reference',
+    `state` varchar(32) NOT NULL COMMENT 'Disk synchronization state',
+    `created` datetime NOT NULL COMMENT 'date created',
+    `updated` datetime COMMENT 'date updated if not null',
+    `removed` datetime COMMENT 'date removed if not null',
+    PRIMARY KEY (`id`),
+    CONSTRAINT `fk_vmware_cbt_migration_disk__migration_id` FOREIGN KEY (`migration_id`) REFERENCES `vmware_cbt_migration`(`id`) ON DELETE CASCADE,
+    INDEX `i_vmware_cbt_migration_disk__migration_id` (`migration_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+CREATE TABLE IF NOT EXISTS `cloud`.`vmware_cbt_migration_cycle` (
+    `id` bigint unsigned NOT NULL auto_increment COMMENT 'id',
+    `uuid` varchar(40) NOT NULL COMMENT 'UUID',
+    `migration_id` bigint unsigned NOT NULL COMMENT 'VMware CBT migration ID',
+    `cycle_number` int unsigned NOT NULL COMMENT 'CBT delta cycle number',
+    `snapshot_moref` varchar(255) COMMENT 'VMware snapshot managed object reference used for the cycle',
+    `changed_bytes` bigint unsigned COMMENT 'Changed bytes copied in this cycle',
+    `dirty_rate` bigint unsigned COMMENT 'Changed bytes per second in this cycle',
+    `duration` bigint unsigned COMMENT 'Cycle duration in milliseconds',
+    `state` varchar(32) NOT NULL COMMENT 'CBT delta cycle state',
+    `description` varchar(1024) COMMENT 'Cycle description or error message',
+    `created` datetime NOT NULL COMMENT 'date created',
+    `updated` datetime COMMENT 'date updated if not null',
+    `removed` datetime COMMENT 'date removed if not null',
+    PRIMARY KEY (`id`),
+    CONSTRAINT `fk_vmware_cbt_migration_cycle__migration_id` FOREIGN KEY (`migration_id`) REFERENCES `vmware_cbt_migration`(`id`) ON DELETE CASCADE,
+    UNIQUE KEY `uc_vmware_cbt_migration_cycle__migration_id__cycle_number` (`migration_id`, `cycle_number`),
+    INDEX `i_vmware_cbt_migration_cycle__migration_id` (`migration_id`)
+) ENGINE=InnoDB DEFAULT CHARSET=utf8;
 -- InstanceBootGroup: ordered boot sequencing for VMs and InstanceGroups
 CREATE TABLE IF NOT EXISTS `cloud`.`instance_boot_group` (
     `id`          bigint unsigned NOT NULL UNIQUE AUTO_INCREMENT,
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
index 9009ec629ca3..7c3f826be171 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
@@ -20,11 +20,21 @@
 import static com.cloud.host.Host.HOST_INSTANCE_CONVERSION;
 import static com.cloud.host.Host.HOST_KVM_DISK_ONLY_VM_SNAPSHOT_NVRAM;
 import static com.cloud.host.Host.HOST_OVFTOOL_VERSION;
+import static com.cloud.host.Host.HOST_QEMU_RBD_SUPPORT;
+import static com.cloud.host.Host.HOST_QEMU_IMG_VERSION;
+import static com.cloud.host.Host.HOST_QEMU_IO_VERSION;
+import static com.cloud.host.Host.HOST_QEMU_NBD_VERSION;
 import static com.cloud.host.Host.HOST_RBD_VOLUME_ENCRYPTION;
 import static com.cloud.host.Host.HOST_VDDK_LIB_DIR;
+import static com.cloud.host.Host.HOST_VDDK_RBD_DIRECT_IMPORT_SUPPORT;
 import static com.cloud.host.Host.HOST_VDDK_SUPPORT;
 import static com.cloud.host.Host.HOST_VDDK_VERSION;
+import static com.cloud.host.Host.HOST_VIRTV2V_INPLACE_SUPPORT;
+import static com.cloud.host.Host.HOST_VIRTV2V_INPLACE_VERSION;
 import static com.cloud.host.Host.HOST_VIRTV2V_VERSION;
+import static com.cloud.host.Host.HOST_VDDK_BLOCKCOPY_INPLACE_FINALIZATION_SUPPORT;
+import static com.cloud.host.Host.HOST_VDDK_BLOCKCOPY_RBD_SUPPORT;
+import static com.cloud.host.Host.HOST_VDDK_BLOCKCOPY_SUPPORT;
 import static com.cloud.host.Host.HOST_VOLUME_ENCRYPTION;
 import static org.apache.cloudstack.utils.linux.KVMHostInfo.isHostS390x;
 
@@ -54,6 +64,7 @@
 import java.util.UUID;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.CopyOnWriteArrayList;
+import java.util.concurrent.TimeUnit;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
@@ -373,6 +384,10 @@ public class LibvirtComputingResource extends ServerResourceBase implements Serv
 
     public static final String INSTANCE_CONVERSION_SUPPORTED_CHECK_CMD = "virt-v2v --version";
     // virt-v2v --version => sample output: virt-v2v 1.42.0rhel=8,release=22.module+el8.10.0+1590+a67ab969
+    public static final String INSTANCE_CONVERSION_IN_PLACE_SUPPORTED_CHECK_CMD = "virt-v2v-in-place --version";
+    // EL9-family distributions install virt-v2v-in-place in libexecdir, outside $PATH
+    public static final String VIRT_V2V_IN_PLACE_LIBEXEC_PATH = "/usr/libexec/virt-v2v-in-place";
+    public static final String INSTANCE_CONVERSION_IN_PLACE_OPTION_SUPPORTED_CHECK_CMD = "virt-v2v --help 2>&1 | grep -q -- '--in-place'";
     public static final String OVF_EXPORT_SUPPORTED_CHECK_CMD = "ovftool --version";
     // ovftool --version => sample output: VMware ovftool 4.6.0 (build-21452615)
     public static final String OVF_EXPORT_TOOl_GET_VERSION_CMD = "ovftool --version | awk '{print $3}'";
@@ -381,6 +396,12 @@ public class LibvirtComputingResource extends ServerResourceBase implements Serv
     public static final String UBUNTU_WINDOWS_GUEST_CONVERSION_SUPPORTED_CHECK_CMD = "dpkg -l virtio-win";
     public static final String UBUNTU_NBDKIT_PKG_CHECK_CMD = "dpkg -l nbdkit";
     public static final String VDDK_AUTODETECT_PATH_CMD = "find / -type d -name 'vmware-vix-disklib-distrib' 2>/dev/null | head -n 1";
+    public static final String NBDKIT_VDDK_DUMP_PLUGIN_CMD = "nbdkit vddk --dump-plugin";
+    public static final String QEMU_IMG_SUPPORTED_CHECK_CMD = "qemu-img --version";
+    public static final String QEMU_NBD_SUPPORTED_CHECK_CMD = "qemu-nbd --version";
+    public static final String QEMU_IO_SUPPORTED_CHECK_CMD = "qemu-io --version";
+    public static final String QEMU_IMG_RBD_SUPPORTED_CHECK_CMD = "qemu-img --help 2>&1 | grep -Eq '(^|[[:space:]])rbd([[:space:]]|$)'";
+    public static final String NBDCOPY_SUPPORTED_CHECK_CMD = "nbdcopy --version";
 
     public static final int LIBVIRT_CGROUP_CPU_SHARES_MIN = 2;
     public static final int LIBVIRT_CGROUP_CPU_SHARES_MAX = 262144;
@@ -961,6 +982,7 @@ public String toString() {
     protected String directDownloadTemporaryDownloadPath;
     protected String cachePath;
     private String vddkTransports = null;
+    private String vddkNbdCompression = null;
     private String vddkThumbprint = null;
     private String vddkVersion = null;
     private String detectedPasswordFileOption = null;
@@ -1040,6 +1062,10 @@ public String getVddkTransports() {
         return vddkTransports;
     }
 
+    public String getVddkNbdCompression() {
+        return vddkNbdCompression;
+    }
+
     public String getVddkThumbprint() {
         return vddkThumbprint;
     }
@@ -1271,13 +1297,15 @@ public boolean configure(final String name, final Map<String, Object> params) th
             LOGGER.warn("Could not detect a valid VDDK library dir; VDDK conversion will be unavailable");
         }
 
-        vddkVersion = detectVddkVersion();
+        vddkVersion = detectVddkVersion(vddkLibDir);
         if (StringUtils.isNotBlank(vddkVersion)) {
-            LOGGER.info("Detected nbdkit VDDK plugin version: {}", vddkVersion);
+            LOGGER.info("Detected usable VMware VDDK library version: {}", vddkVersion);
         }
 
         vddkTransports = StringUtils.trimToNull(
                 AgentPropertiesFileHandler.getPropertyValue(AgentProperties.VDDK_TRANSPORTS));
+        vddkNbdCompression = StringUtils.trimToNull(
+                AgentPropertiesFileHandler.getPropertyValue(AgentProperties.VDDK_NBD_COMPRESSION));
         vddkThumbprint = StringUtils.trimToNull(
                 AgentPropertiesFileHandler.getPropertyValue(AgentProperties.VDDK_THUMBPRINT));
 
@@ -4437,15 +4465,37 @@ public StartupCommand[] initialize() {
         cmd.getHostDetails().put(HOST_INSTANCE_CONVERSION, String.valueOf(instanceConversionSupported));
         cmd.getHostDetails().put(HOST_VDDK_SUPPORT, String.valueOf(hostSupportsVddk()));
         cmd.getHostDetails().put(HOST_CDROM_MAX_COUNT, String.valueOf(LibvirtVMDef.MAX_CDROMS_PER_VM));
+        cmd.getHostDetails().put(HOST_VDDK_BLOCKCOPY_SUPPORT, String.valueOf(hostSupportsVddkBlockCopy()));
+        cmd.getHostDetails().put(HOST_VDDK_BLOCKCOPY_INPLACE_FINALIZATION_SUPPORT, String.valueOf(hostSupportsVddkBlockCopyInPlaceFinalization()));
+        cmd.getHostDetails().put(HOST_VDDK_BLOCKCOPY_RBD_SUPPORT, String.valueOf(hostSupportsVddkBlockCopyRbd()));
+        cmd.getHostDetails().put(HOST_VIRTV2V_INPLACE_SUPPORT, String.valueOf(hostSupportsVirtV2vInPlace()));
+        cmd.getHostDetails().put(HOST_QEMU_RBD_SUPPORT, String.valueOf(hostSupportsQemuRbd()));
+        cmd.getHostDetails().put(HOST_VDDK_RBD_DIRECT_IMPORT_SUPPORT, String.valueOf(hostSupportsVddkRbdDirectImport()));
         if (StringUtils.isNotBlank(vddkLibDir)) {
             cmd.getHostDetails().put(HOST_VDDK_LIB_DIR, vddkLibDir);
         }
         if (StringUtils.isNotBlank(vddkVersion)) {
             cmd.getHostDetails().put(HOST_VDDK_VERSION, vddkVersion);
         }
+        String qemuImgVersion = getQemuImgVersion();
+        if (StringUtils.isNotBlank(qemuImgVersion)) {
+            cmd.getHostDetails().put(HOST_QEMU_IMG_VERSION, qemuImgVersion);
+        }
+        String qemuNbdVersion = getQemuNbdVersion();
+        if (StringUtils.isNotBlank(qemuNbdVersion)) {
+            cmd.getHostDetails().put(HOST_QEMU_NBD_VERSION, qemuNbdVersion);
+        }
+        String qemuIoVersion = getQemuIoVersion();
+        if (StringUtils.isNotBlank(qemuIoVersion)) {
+            cmd.getHostDetails().put(HOST_QEMU_IO_VERSION, qemuIoVersion);
+        }
         if (instanceConversionSupported) {
             cmd.getHostDetails().put(HOST_VIRTV2V_VERSION, getHostVirtV2vVersion());
         }
+        String virtV2vInPlaceVersion = getHostVirtV2vInPlaceVersion();
+        if (StringUtils.isNotBlank(virtV2vInPlaceVersion)) {
+            cmd.getHostDetails().put(HOST_VIRTV2V_INPLACE_VERSION, virtV2vInPlaceVersion);
+        }
         if (hostSupportsOvfExport()) {
             cmd.getHostDetails().put(HOST_OVFTOOL_VERSION, getHostOvfToolVersion());
         }
@@ -6273,14 +6323,135 @@ public boolean hostSupportsVddk() {
     }
 
     public boolean hostSupportsVddk(String overriddenVddkLibDir) {
-        String effectiveVddkLibDir = StringUtils.trimToNull(overriddenVddkLibDir);
-        if (StringUtils.isBlank(effectiveVddkLibDir)) {
-            effectiveVddkLibDir = StringUtils.trimToNull(vddkLibDir);
+        String effectiveVddkLibDir = resolveVddkLibDir(overriddenVddkLibDir);
+        return hostSupportsInstanceConversion() && isVddkLibDirValid(effectiveVddkLibDir) && isNbdkitVddkPluginUsable(effectiveVddkLibDir);
+    }
+
+    public boolean hostSupportsVddkBlockCopy() {
+        return hostSupportsVddkBlockCopy(null);
+    }
+
+    public boolean hostSupportsVddkBlockCopy(String overriddenVddkLibDir) {
+        return hostSupportsVddk(overriddenVddkLibDir)
+                && Script.runSimpleBashScriptForExitValue(QEMU_IMG_SUPPORTED_CHECK_CMD) == 0
+                && Script.runSimpleBashScriptForExitValue(QEMU_NBD_SUPPORTED_CHECK_CMD) == 0
+                && Script.runSimpleBashScriptForExitValue(QEMU_IO_SUPPORTED_CHECK_CMD) == 0;
+    }
+
+    public boolean hostSupportsVddkBlockCopyInPlaceFinalization() {
+        return hostSupportsVddkBlockCopy() && hostSupportsVirtV2vInPlace();
+    }
+
+    public boolean hostSupportsVddkBlockCopyRbd() {
+        return hostSupportsVddkBlockCopyInPlaceFinalization()
+                && Script.runSimpleBashScriptForExitValue(QEMU_IMG_RBD_SUPPORTED_CHECK_CMD) == 0;
+    }
+
+    public String getQemuImgVersion() {
+        return detectFirstLineVersion("qemu-img", "--version");
+    }
+
+    public String getQemuNbdVersion() {
+        return detectFirstLineVersion("qemu-nbd", "--version");
+    }
+
+    public String getQemuIoVersion() {
+        return detectFirstLineVersion("qemu-io", "--version");
+    }
+
+    public boolean hostSupportsVirtV2vInPlace() {
+        return hostSupportsVirtV2vInPlaceBinary() || hostSupportsVirtV2vInPlaceOption();
+    }
+
+    /**
+     * nbdcopy (from libnbd) is an optional accelerator for full-disk copies from an
+     * nbdkit/VDDK source into a local raw block device: it uses multiple in-flight
+     * requests and connections, so it is typically faster than a single-connection
+     * qemu-img convert. It is a pure optimization - callers fall back to
+     * qemu-img convert when it is absent.
+     */
+    public boolean hostSupportsNbdcopy() {
+        return Script.runSimpleBashScriptForExitValue(NBDCOPY_SUPPORTED_CHECK_CMD) == 0;
+    }
+
+    public boolean hostSupportsVirtV2vInPlaceBinary() {
+        return getVirtV2vInPlaceBinary() != null;
+    }
+
+    /**
+     * Resolves the virt-v2v-in-place executable. Ubuntu/Debian install it on $PATH,
+     * but EL9-family distributions ship it in /usr/libexec, so probing the bare name
+     * alone would (wrongly) disable in-place finalization there. Returns the
+     * invocable binary (name or absolute path), or null when neither works.
+     */
+    public String getVirtV2vInPlaceBinary() {
+        if (Script.runSimpleBashScriptForExitValue(INSTANCE_CONVERSION_IN_PLACE_SUPPORTED_CHECK_CMD) == 0) {
+            return "virt-v2v-in-place";
         }
-        if (StringUtils.isBlank(effectiveVddkLibDir) || !isVddkLibDirValid(effectiveVddkLibDir)) {
-            effectiveVddkLibDir = detectVddkLibDir();
+        if (Script.runSimpleBashScriptForExitValue(VIRT_V2V_IN_PLACE_LIBEXEC_PATH + " --version") == 0) {
+            return VIRT_V2V_IN_PLACE_LIBEXEC_PATH;
+        }
+        return null;
+    }
+
+    public boolean hostSupportsVirtV2vInPlaceOption() {
+        return Script.runSimpleBashScriptForExitValue(INSTANCE_CONVERSION_IN_PLACE_OPTION_SUPPORTED_CHECK_CMD) == 0;
+    }
+
+    public String getHostVirtV2vInPlaceVersion() {
+        if (!hostSupportsVirtV2vInPlace()) {
+            return "";
+        }
+        String inPlaceBinary = getVirtV2vInPlaceBinary();
+        if (inPlaceBinary == null) {
+            return getHostVirtV2vVersion();
+        }
+        String cmd = String.format("%s --version | awk '{print $2}'", inPlaceBinary);
+        String version = Script.runSimpleBashScript(cmd);
+        return StringUtils.isNotBlank(version) ? version.split(",")[0] : "";
+    }
+
+    protected String detectFirstLineVersion(String... command) {
+        try {
+            ProcessBuilder pb = new ProcessBuilder(command);
+            Process process = pb.start();
+
+            String output = new String(process.getInputStream().readAllBytes());
+            process.waitFor();
+
+            for (String line : output.split("\\R")) {
+                String trimmed = StringUtils.trimToNull(line);
+                if (StringUtils.isNotBlank(trimmed)) {
+                    return parseVersionToken(trimmed);
+                }
+            }
+        } catch (Exception e) {
+            LOGGER.debug("Failed to detect version for command {}: {}", String.join(" ", command), e.getMessage());
         }
-        return hostSupportsInstanceConversion() && isVddkLibDirValid(effectiveVddkLibDir) && StringUtils.isNotBlank(detectVddkVersion());
+        return null;
+    }
+
+    protected String parseVersionToken(String versionLine) {
+        String versionMarker = " version ";
+        int markerIndex = versionLine.indexOf(versionMarker);
+        if (markerIndex < 0) {
+            return versionLine;
+        }
+        String value = versionLine.substring(markerIndex + versionMarker.length());
+        String[] parts = value.split("\\s+", 2);
+        return parts.length > 0 ? parts[0] : versionLine;
+    }
+
+    public boolean hostSupportsQemuRbd() {
+        return Script.runSimpleBashScriptForExitValue(QEMU_IMG_RBD_SUPPORTED_CHECK_CMD) == 0;
+    }
+
+    public boolean hostSupportsVddkRbdDirectImport() {
+        return hostSupportsVddkRbdDirectImport(null);
+    }
+
+    public boolean hostSupportsVddkRbdDirectImport(String overriddenVddkLibDir) {
+        return hostSupportsVddk(overriddenVddkLibDir) && hostSupportsQemuRbd() && hostSupportsVirtV2vInPlace();
     }
 
     protected boolean isVddkLibDirValid(String path) {
@@ -6295,6 +6466,17 @@ protected boolean isVddkLibDirValid(String path) {
         return libs != null && libs.length > 0;
     }
 
+    protected String resolveVddkLibDir(String overriddenVddkLibDir) {
+        String effectiveVddkLibDir = StringUtils.trimToNull(overriddenVddkLibDir);
+        if (StringUtils.isBlank(effectiveVddkLibDir)) {
+            effectiveVddkLibDir = StringUtils.trimToNull(vddkLibDir);
+        }
+        if (StringUtils.isBlank(effectiveVddkLibDir) || !isVddkLibDirValid(effectiveVddkLibDir)) {
+            effectiveVddkLibDir = detectVddkLibDir();
+        }
+        return effectiveVddkLibDir;
+    }
+
     protected String detectVddkLibDir() {
         String detectedPath = StringUtils.trimToNull(Script.runSimpleBashScript(VDDK_AUTODETECT_PATH_CMD));
         if (StringUtils.isNotBlank(detectedPath) && isVddkLibDirValid(detectedPath)) {
@@ -6304,28 +6486,73 @@ protected String detectVddkLibDir() {
     }
 
     protected String detectVddkVersion() {
+        return detectVddkVersion(null);
+    }
+
+    protected String detectVddkVersion(String overriddenVddkLibDir) {
+        String effectiveVddkLibDir = resolveVddkLibDir(overriddenVddkLibDir);
+        if (!isVddkLibDirValid(effectiveVddkLibDir)) {
+            return null;
+        }
+        return parseVddkLibraryVersionFromDumpPluginOutput(runNbdkitVddkDumpPlugin(effectiveVddkLibDir));
+    }
+
+    protected boolean isNbdkitVddkPluginUsable(String vddkLibDir) {
+        if (!isVddkLibDirValid(vddkLibDir)) {
+            return false;
+        }
+        String dumpPluginOutput = runNbdkitVddkDumpPlugin(vddkLibDir);
+        if (StringUtils.isBlank(parseVddkLibraryVersionFromDumpPluginOutput(dumpPluginOutput))) {
+            LOGGER.warn("nbdkit-vddk-plugin could not load VMware VDDK from [{}]", vddkLibDir);
+            return false;
+        }
+        return true;
+    }
+
+    protected String runNbdkitVddkDumpPlugin(String vddkLibDir) {
         try {
-            ProcessBuilder pb = new ProcessBuilder("nbdkit", "vddk", "--version");
+            ProcessBuilder pb = new ProcessBuilder("nbdkit", "vddk", "--dump-plugin", String.format("libdir=%s", vddkLibDir));
+            pb.redirectErrorStream(true);
             Process process = pb.start();
 
+            boolean completed = process.waitFor(10, TimeUnit.SECONDS);
+            if (!completed) {
+                process.destroyForcibly();
+                process.waitFor(5, TimeUnit.SECONDS);
+            }
             String output = new String(process.getInputStream().readAllBytes());
-            process.waitFor();
-
-            if (StringUtils.isBlank(output)) {
-                return null;
+            if (!completed) {
+                LOGGER.warn("Timed out while checking nbdkit-vddk-plugin with libdir [{}]", vddkLibDir);
+                return output;
+            }
+            if (process.exitValue() != 0) {
+                LOGGER.warn("nbdkit-vddk-plugin check failed for libdir [{}]: {}", vddkLibDir, StringUtils.trimToEmpty(output));
+                return output;
             }
+            return output;
+        } catch (Exception e) {
+            LOGGER.error("Failed to check nbdkit-vddk-plugin with libdir [{}]: {}", vddkLibDir, e.getMessage());
+            return null;
+        }
+    }
 
+    protected String parseVddkLibraryVersionFromDumpPluginOutput(String output) {
+        if (StringUtils.isBlank(output)) {
+            return null;
+        }
+        String libraryVersionPrefix = "vddk_library_version=";
+        try {
             for (String line : output.split("\\R")) {
                 String trimmed = StringUtils.trimToEmpty(line);
-                if (trimmed.startsWith("vddk ")) {
-                    return StringUtils.trimToNull(trimmed.substring("vddk ".length()));
+                if (trimmed.startsWith(libraryVersionPrefix)) {
+                    return StringUtils.trimToNull(trimmed.substring(libraryVersionPrefix.length()));
                 }
             }
-            return null;
         } catch (Exception e) {
-            LOGGER.error("Failed to detect vddk version: {}", e.getMessage());
+            LOGGER.error("Failed to parse nbdkit-vddk-plugin output: {}", e.getMessage());
             return null;
         }
+        return null;
     }
 
     public boolean hostSupportsWindowsGuestConversion() {
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtBaseConvertCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtBaseConvertCommandWrapper.java
index dc34a4cb62d8..7bb525ba196f 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtBaseConvertCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtBaseConvertCommandWrapper.java
@@ -128,6 +128,13 @@ protected void sanitizeDisksPath(List<LibvirtVMDef.DiskDef> disks) {
     protected List<KVMPhysicalDisk> moveTemporaryDisksToDestination(List<KVMPhysicalDisk> temporaryDisks,
                                                                     List<String> destinationStoragePools,
                                                                     KVMStoragePoolManager storagePoolMgr) {
+        return moveTemporaryDisksToDestination(temporaryDisks, destinationStoragePools, null, storagePoolMgr);
+    }
+
+    protected List<KVMPhysicalDisk> moveTemporaryDisksToDestination(List<KVMPhysicalDisk> temporaryDisks,
+                                                                    List<String> destinationStoragePools,
+                                                                    List<Storage.StoragePoolType> destinationStoragePoolTypes,
+                                                                    KVMStoragePoolManager storagePoolMgr) {
         List<KVMPhysicalDisk> targetDisks = new ArrayList<>();
         if (temporaryDisks.size() != destinationStoragePools.size()) {
             String warn = String.format("Discrepancy between the converted instance disks (%s) " +
@@ -136,17 +143,13 @@ protected List<KVMPhysicalDisk> moveTemporaryDisksToDestination(List<KVMPhysical
         }
         for (int i = 0; i < temporaryDisks.size(); i++) {
             String poolPath = destinationStoragePools.get(i);
-            KVMStoragePool destinationPool = storagePoolMgr.getStoragePool(Storage.StoragePoolType.NetworkFilesystem, poolPath);
+            Storage.StoragePoolType poolType = getDestinationStoragePoolType(destinationStoragePoolTypes, i);
+            KVMStoragePool destinationPool = storagePoolMgr.getStoragePool(poolType, poolPath);
             if (destinationPool == null) {
                 String err = String.format("Could not find a storage pool by URI: %s", poolPath);
                 logger.error(err);
                 continue;
             }
-            if (destinationPool.getType() != Storage.StoragePoolType.NetworkFilesystem) {
-                String err = String.format("Storage pool by URI: %s is not an NFS storage", poolPath);
-                logger.error(err);
-                continue;
-            }
             KVMPhysicalDisk sourceDisk = temporaryDisks.get(i);
             if (logger.isDebugEnabled()) {
                 String msg = String.format("Trying to copy converted instance disk number %s from the temporary location %s" +
@@ -157,13 +160,18 @@ protected List<KVMPhysicalDisk> moveTemporaryDisksToDestination(List<KVMPhysical
             String destinationName = UUID.randomUUID().toString();
 
             try {
-                if (destinationPool.getAvailable() < sourceDisk.getSize()) {
+                if (destinationPool.getType() != Storage.StoragePoolType.RBD
+                        && destinationPool.getAvailable() < sourceDisk.getSize()) {
                     String msg = String.format("Not enough space on destination pool %s (%s bytes) to copy disk %s (size %s)",
                             destinationPool.getUuid(), destinationPool.getAvailable(), sourceDisk.getName(), sourceDisk.getSize());
                     logger.error(msg);
                     throw new CloudRuntimeException(msg);
                 }
 
+                if (destinationPool.getType() == Storage.StoragePoolType.RBD) {
+                    probeRbdQemuAccess(destinationPool, destinationName);
+                }
+
                 KVMPhysicalDisk destinationDisk = storagePoolMgr.copyPhysicalDisk(sourceDisk, destinationName, destinationPool, 7200 * 1000);
                 targetDisks.add(destinationDisk);
             } catch (Exception e) {
@@ -177,6 +185,40 @@ protected List<KVMPhysicalDisk> moveTemporaryDisksToDestination(List<KVMPhysical
         return targetDisks;
     }
 
+    private Storage.StoragePoolType getDestinationStoragePoolType(List<Storage.StoragePoolType> destinationStoragePoolTypes, int index) {
+        if (CollectionUtils.isEmpty(destinationStoragePoolTypes) || destinationStoragePoolTypes.size() <= index || destinationStoragePoolTypes.get(index) == null) {
+            return Storage.StoragePoolType.NetworkFilesystem;
+        }
+        return destinationStoragePoolTypes.get(index);
+    }
+
+    private void probeRbdQemuAccess(KVMStoragePool pool, String destinationName) {
+        String probeName = destinationName + "-probe";
+        String rbdImagePath = pool.getSourceDir() + "/" + probeName;
+        String qemuRbdPath = KVMPhysicalDisk.RBDStringBuilder(pool, rbdImagePath);
+        try {
+            Script qemuImg = new Script("qemu-img", 120000, logger);
+            qemuImg.add("create", "-f", "raw", qemuRbdPath, "4194304");
+            qemuImg.execute();
+            if (qemuImg.getExitValue() != 0) {
+                throw new CloudRuntimeException(String.format("qemu-img could not create RBD probe image %s", rbdImagePath));
+            }
+
+            Script qemuIo = new Script("qemu-io", 120000, logger);
+            qemuIo.add("-f", "raw", "-c", "write -P 0x5a 0 4k", "-c", "read -P 0x5a 0 4k", qemuRbdPath);
+            qemuIo.execute();
+            if (qemuIo.getExitValue() != 0) {
+                throw new CloudRuntimeException(String.format("qemu-io could not verify RBD probe image %s", rbdImagePath));
+            }
+        } finally {
+            try {
+                pool.deletePhysicalDisk(probeName, Storage.ImageFormat.RAW);
+            } catch (Exception e) {
+                logger.warn("Failed to delete RBD probe image {} from pool {}: {}", probeName, pool.getUuid(), e.getMessage());
+            }
+        }
+    }
+
     private void cleanupMovedDisksOnDestinationPool(List<KVMPhysicalDisk> targetDisks) {
         if (CollectionUtils.isEmpty(targetDisks)) {
             return;
@@ -220,9 +262,20 @@ protected List<UnmanagedInstanceTO.Disk> getUnmanagedInstanceDisks(List<KVMPhysi
             KVMStoragePool storagePool = physicalDisk.getPool();
             UnmanagedInstanceTO.Disk disk = new UnmanagedInstanceTO.Disk();
             disk.setPosition(i);
-            Pair<String, String> storagePoolHostAndPath = getNfsStoragePoolHostAndPath(storagePool);
-            disk.setDatastoreHost(storagePoolHostAndPath.first());
-            disk.setDatastorePath(storagePoolHostAndPath.second());
+            if (storagePool.getType() == Storage.StoragePoolType.RBD) {
+                disk.setDatastoreHost(storagePool.getSourceHost());
+                disk.setDatastorePath(storagePool.getSourceDir());
+                disk.setImagePath(physicalDisk.getName());
+            } else if (storagePool.getType() == Storage.StoragePoolType.Linstor) {
+                // Linstor pools expose no local mount path; the management server resolves the
+                // pool by its UUID (datastore name), and the volume by its disk name (path).
+                disk.setDatastoreHost(storagePool.getSourceHost());
+                disk.setImagePath(physicalDisk.getName());
+            } else {
+                Pair<String, String> storagePoolHostAndPath = getNfsStoragePoolHostAndPath(storagePool);
+                disk.setDatastoreHost(storagePoolHostAndPath.first());
+                disk.setDatastorePath(storagePoolHostAndPath.second());
+            }
             disk.setDatastoreName(storagePool.getUuid());
             disk.setDatastoreType(storagePool.getType().name());
             disk.setCapacity(physicalDisk.getVirtualSize());
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckConvertInstanceCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckConvertInstanceCommandWrapper.java
index de9341715f02..0eb728d5d37e 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckConvertInstanceCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckConvertInstanceCommandWrapper.java
@@ -31,6 +31,21 @@ public class LibvirtCheckConvertInstanceCommandWrapper extends CommandWrapper<Ch
     @Override
     public Answer execute(CheckConvertInstanceCommand cmd, LibvirtComputingResource serverResource) {
         if (cmd.isUseVddk()) {
+            if (cmd.isCheckVddkRbdDirectImportSupport() && !serverResource.hostSupportsVddkRbdDirectImport(cmd.getVddkLibDir())) {
+                String msg = String.format("Cannot directly import VMware disks to RBD on host %s. Direct RBD VDDK import requires VDDK, qemu-img RBD support, and in-place virt-v2v support. " +
+                                "Use staged import with temporary conversion storage on this host, or select an EL9/Ubuntu 24.04-like conversion host with virt-v2v-in-place support.",
+                        serverResource.getPrivateIp());
+                logger.info(msg);
+                return new CheckConvertInstanceAnswer(cmd, false, msg);
+            }
+            if (cmd.isCheckVddkInPlaceFinalizationSupport() && !serverResource.hostSupportsVirtV2vInPlace()) {
+                String msg = String.format("Cannot directly import VMware disks to a block storage pool on host %s as it lacks " +
+                                "in-place virt-v2v support (the virt-v2v-in-place binary or the virt-v2v --in-place option). " +
+                                "Use staged import with temporary conversion storage on this host, or select an EL9/Ubuntu 24.04-like conversion host.",
+                        serverResource.getPrivateIp());
+                logger.info(msg);
+                return new CheckConvertInstanceAnswer(cmd, false, msg);
+            }
             if (!serverResource.hostSupportsVddk(cmd.getVddkLibDir())) {
                 String msg = String.format("Cannot convert the instance from VMware using VDDK on host %s. " +
                                 "Please make sure virt-v2v%s, nbdkit-vddk and a valid VDDK library directory are available on the host.",
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckVolumeCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckVolumeCommandWrapper.java
index 6788516df741..acfb85a3f47b 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckVolumeCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckVolumeCommandWrapper.java
@@ -50,11 +50,12 @@ public final class LibvirtCheckVolumeCommandWrapper extends CommandWrapper<Check
     private static final List<Storage.StoragePoolType> STORAGE_POOL_TYPES_SUPPORTED = Arrays.asList(
             Storage.StoragePoolType.Filesystem,
             Storage.StoragePoolType.NetworkFilesystem,
-            Storage.StoragePoolType.SharedMountPoint);
+            Storage.StoragePoolType.SharedMountPoint,
+            Storage.StoragePoolType.RBD,
+            Storage.StoragePoolType.Linstor);
 
     @Override
     public Answer execute(final CheckVolumeCommand command, final LibvirtComputingResource libvirtComputingResource) {
-        String result = null;
         String srcFile = command.getSrcFile();
         StorageFilerTO storageFilerTO = command.getStorageFilerTO();
         KVMStoragePoolManager poolMgr = libvirtComputingResource.getStoragePoolMgr();
@@ -62,7 +63,18 @@ public Answer execute(final CheckVolumeCommand command, final LibvirtComputingRe
 
         try {
             if (STORAGE_POOL_TYPES_SUPPORTED.contains(storageFilerTO.getType())) {
+                if (Storage.StoragePoolType.Linstor.equals(storageFilerTO.getType())) {
+                    List<VolumeOnStorageTO> volumes = pool.getVolumesForImport(srcFile);
+                    if (volumes == null || volumes.size() != 1 || !srcFile.equals(volumes.get(0).getPath())) {
+                        return new CheckVolumeAnswer(command, false, "LINSTOR volume not found", 0, null);
+                    }
+                    VolumeOnStorageTO volume = volumes.get(0);
+                    return new CheckVolumeAnswer(command, true, "", volume.getVirtualSize(), volume.getDetails());
+                }
                 final KVMPhysicalDisk vol = pool.getPhysicalDisk(srcFile);
+                if (Storage.StoragePoolType.RBD.equals(storageFilerTO.getType())) {
+                    return checkRbdVolume(command, pool, vol);
+                }
                 final String path = vol.getPath();
                 try {
                     KVMPhysicalDisk.checkQcow2File(path);
@@ -77,8 +89,23 @@ public Answer execute(final CheckVolumeCommand command, final LibvirtComputingRe
             }
         } catch (final Exception e) {
             logger.error("Error while checking the disk: {}", e.getMessage());
-            return new Answer(command, false, result);
+            return new Answer(command, false, e.getMessage());
+        }
+    }
+
+    /**
+     * RBD (Ceph) volumes are raw images that cannot be inspected through direct file reads
+     * (checkQcow2File / getVirtualSizeFromFile operate on a local path). Instead the volume is
+     * inspected through the RBD URI via qemu-img (see {@link #getDiskFileInfo}). The virtual size
+     * is taken from the disk reported by the storage pool, and the encrypted/backing-file/locked
+     * details are still collected so the management server can apply its import validations.
+     */
+    private Answer checkRbdVolume(final CheckVolumeCommand command, final KVMStoragePool pool, final KVMPhysicalDisk disk) {
+        Map<VolumeOnStorageTO.Detail, String> volumeDetails = getVolumeDetails(pool, disk);
+        if (volumeDetails == null) {
+            return new CheckVolumeAnswer(command, false, "", 0, null);
         }
+        return new CheckVolumeAnswer(command, true, "", disk.getVirtualSize(), volumeDetails);
     }
 
     private Map<VolumeOnStorageTO.Detail, String> getVolumeDetails(KVMStoragePool pool, KVMPhysicalDisk disk) {
@@ -109,7 +136,21 @@ private Map<VolumeOnStorageTO.Detail, String> getVolumeDetails(KVMStoragePool po
         if (StringUtils.isNotBlank(encrypted) && encrypted.equalsIgnoreCase("yes")) {
             volumeDetails.put(VolumeOnStorageTO.Detail.IS_ENCRYPTED, String.valueOf(Boolean.TRUE));
         }
-        Boolean isLocked = isDiskFileLocked(pool, disk);
+        boolean isLocked = isDiskFileLocked(pool, disk);
+        if (!isLocked) {
+            // For clustered block storage (Linstor/DRBD) the host-local qemu-img lock is not
+            // authoritative: a volume can be attached to a running VM on another node. Consult
+            // the backend's cluster-wide in-use state so such a volume is not adopted.
+            String inUseNode = pool.getVolumeInUseNode(disk.getName());
+            if (KVMStoragePool.IN_USE_NODE_UNKNOWN.equals(inUseNode)) {
+                logger.warn("Could not determine cluster-wide in-use state of volume {}; marking as locked",
+                        disk.getName());
+                isLocked = true;
+            } else if (inUseNode != null) {
+                logger.info("Volume {} is in use on node {}; marking as locked", disk.getName(), inUseNode);
+                isLocked = true;
+            }
+        }
         volumeDetails.put(VolumeOnStorageTO.Detail.IS_LOCKED, String.valueOf(isLocked));
 
         return volumeDetails;
@@ -122,6 +163,10 @@ private Map<String, String> getDiskFileInfo(KVMStoragePool pool, KVMPhysicalDisk
         try {
             QemuImg qemu = new QemuImg(0);
             QemuImgFile qemuFile = new QemuImgFile(disk.getPath(), disk.getFormat());
+            if (Storage.StoragePoolType.RBD.equals(pool.getType())) {
+                String rbdDestFile = KVMPhysicalDisk.RBDStringBuilder(pool, disk.getPath());
+                qemuFile = new QemuImgFile(rbdDestFile, disk.getFormat());
+            }
             return qemu.info(qemuFile, secure);
         } catch (QemuImgException | LibvirtException ex) {
             logger.error("Failed to get info of disk file: " + ex.getMessage());
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtConvertInstanceCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtConvertInstanceCommandWrapper.java
index f28b5eda4a63..0979b10d5186 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtConvertInstanceCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtConvertInstanceCommandWrapper.java
@@ -18,11 +18,13 @@
 //
 package com.cloud.hypervisor.kvm.resource.wrapper;
 
+import java.net.ServerSocket;
 import java.net.URLEncoder;
 import java.nio.charset.Charset;
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.attribute.PosixFilePermission;
+import java.util.ArrayList;
 import java.util.Locale;
 import java.util.Arrays;
 import java.util.List;
@@ -33,6 +35,7 @@
 import java.util.regex.Pattern;
 
 import org.apache.cloudstack.storage.to.PrimaryDataStoreTO;
+import org.apache.cloudstack.utils.qemu.QemuImg;
 import org.apache.commons.collections4.MapUtils;
 import org.apache.commons.lang3.StringUtils;
 
@@ -42,14 +45,18 @@
 import com.cloud.agent.api.to.DataStoreTO;
 import com.cloud.agent.api.to.NfsTO;
 import com.cloud.agent.api.to.RemoteInstanceTO;
+import com.cloud.agent.api.to.VmwareVddkSourceDiskTO;
 import com.cloud.hypervisor.Hypervisor;
 import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
 import com.cloud.hypervisor.kvm.resource.LibvirtVMDef;
+import com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk;
 import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
 import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
 import com.cloud.resource.CommandWrapper;
 import com.cloud.resource.ResourceWrapper;
+import com.cloud.storage.Storage;
 import com.cloud.utils.FileUtil;
+import com.cloud.utils.exception.CloudRuntimeException;
 import com.cloud.utils.script.OutputInterpreter;
 import com.cloud.utils.script.Script;
 
@@ -59,6 +66,55 @@ public class LibvirtConvertInstanceCommandWrapper extends CommandWrapper<Convert
     private static final List<Hypervisor.HypervisorType> supportedInstanceConvertSourceHypervisors =
             List.of(Hypervisor.HypervisorType.VMware);
     private static final Pattern SHA1_FINGERPRINT_PATTERN = Pattern.compile("(?i)(?:SHA1\\s+)?Fingerprint\\s*=\\s*([0-9A-F:]+)");
+    // virt-v2v's exact wording when the host's virtio-win driver set has no match for the guest.
+    private static final String NO_VIRTIO_DRIVERS_MARKER = "there are no virtio drivers available";
+
+    /**
+     * Logs virt-v2v output like {@link OutputInterpreter.LineByLineOutputLogger} while watching for
+     * the "no virtio drivers available" warning. virt-v2v treats it as non-fatal and finishes the
+     * conversion, but a Windows guest converted without a virtio storage driver cannot boot from
+     * the virtio disk the import gives it - the failure only shows up later as an unbootable VM,
+     * so the conversion itself must refuse instead.
+     */
+    private static class VirtioDriverOutputWatcher extends OutputInterpreter {
+        private final org.apache.logging.log4j.Logger watcherLogger;
+        private final String logPrefix;
+        private boolean noVirtioDriversReported;
+
+        VirtioDriverOutputWatcher(org.apache.logging.log4j.Logger logger, String logPrefix) {
+            this.watcherLogger = logger;
+            this.logPrefix = logPrefix;
+        }
+
+        @Override
+        public boolean drain() {
+            return true;
+        }
+
+        @Override
+        public String interpret(java.io.BufferedReader reader) throws java.io.IOException {
+            String line;
+            while ((line = reader.readLine()) != null) {
+                watcherLogger.info("({}) {}", logPrefix, line);
+                if (line.toLowerCase().contains(NO_VIRTIO_DRIVERS_MARKER)) {
+                    noVirtioDriversReported = true;
+                }
+            }
+            return null;
+        }
+
+        boolean isNoVirtioDriversReported() {
+            return noVirtioDriversReported;
+        }
+    }
+
+    private void failWindowsConversionWithoutVirtioDrivers(String originalVMName) {
+        throw new CloudRuntimeException(String.format(
+                "Conversion of Windows VM %s finished without virtio drivers: the conversion host's virtio-win driver set " +
+                "(/usr/share/virtio-win/virtio-win.iso) has no drivers for this Windows version, and the imported VM would not " +
+                "boot from its virtio disk. Update virtio-win on the conversion host to the upstream latest-virtio ISO and retry.",
+                originalVMName));
+    }
 
     @Override
     public Answer execute(ConvertInstanceCommand cmd, LibvirtComputingResource serverResource) {
@@ -70,6 +126,7 @@ public Answer execute(ConvertInstanceCommand cmd, LibvirtComputingResource serve
         long timeout = (long) cmd.getWait() * 1000;
         String extraParams = cmd.getExtraParams();
         boolean useVddk = cmd.isUseVddk();
+        boolean windowsGuest = cmd.isWindowsGuest();
         String originalVMName = cmd.getOriginalVMName();
 
         if (cmd.getCheckConversionSupport() && !serverResource.hostSupportsInstanceConversion()) {
@@ -89,6 +146,8 @@ public Answer execute(ConvertInstanceCommand cmd, LibvirtComputingResource serve
 
         final KVMStoragePoolManager storagePoolMgr = serverResource.getStoragePoolMgr();
         KVMStoragePool temporaryStoragePool = getTemporaryStoragePool(conversionTemporaryLocation, storagePoolMgr);
+        boolean directRbdVddkImport = isDirectRbdVddkImport(cmd);
+        boolean directLinstorVddkImport = isDirectLinstorVddkImport(cmd);
 
         logger.info(String.format("(%s) Attempting to convert the instance %s from %s to KVM",
                 originalVMName, sourceInstanceName, sourceHypervisorType));
@@ -114,9 +173,27 @@ public Answer execute(ConvertInstanceCommand cmd, LibvirtComputingResource serve
                 String vddkTransports = resolveVddkSetting(cmd.getVddkTransports(), serverResource.getVddkTransports());
                 String configuredVddkThumbprint = resolveVddkSetting(cmd.getVddkThumbprint(), serverResource.getVddkThumbprint());
                 String passwordOption = serverResource.getDetectedPasswordFileOption();
-                result = performInstanceConversionUsingVddk(sourceInstance, originalVMName, temporaryConvertPath,
-                        vddkLibDir, serverResource.getLibguestfsBackend(), vddkTransports, configuredVddkThumbprint,
-                        timeout, verboseModeEnabled, extraParams, temporaryConvertUuid, passwordOption);
+                if (directRbdVddkImport || directLinstorVddkImport) {
+                    if (directRbdVddkImport && !serverResource.hostSupportsVddkRbdDirectImport(cmd.getVddkLibDir())) {
+                        String err = String.format("Direct RBD VDDK import requires VDDK, qemu-img RBD support, and virt-v2v in-place support on host %s. " +
+                                "Use staged import with temporary conversion storage or select a newer conversion host.", serverResource.getPrivateIp());
+                        logger.error("({}) {}", originalVMName, err);
+                        return new Answer(cmd, false, err);
+                    }
+                    if (directLinstorVddkImport && !serverResource.hostSupportsVirtV2vInPlace()) {
+                        String err = String.format("Direct Linstor VDDK import requires virt-v2v in-place support on host %s. " +
+                                "Use staged import with temporary conversion storage or select a newer conversion host.", serverResource.getPrivateIp());
+                        logger.error("({}) {}", originalVMName, err);
+                        return new Answer(cmd, false, err);
+                    }
+                    result = performInstanceConversionUsingVddkDirectToPool(cmd, temporaryStoragePool, originalVMName,
+                            vddkLibDir, serverResource.getLibguestfsBackend(), vddkTransports, configuredVddkThumbprint,
+                            timeout, verboseModeEnabled, temporaryConvertUuid, serverResource);
+                } else {
+                    result = performInstanceConversionUsingVddk(sourceInstance, originalVMName, temporaryConvertPath,
+                            vddkLibDir, serverResource.getLibguestfsBackend(), vddkTransports, configuredVddkThumbprint,
+                            timeout, verboseModeEnabled, extraParams, temporaryConvertUuid, passwordOption, windowsGuest);
+                }
             } else {
                 logger.info("({}) Using OVF-based conversion (export + local convert)", originalVMName);
                 String sourceOVFDirPath;
@@ -150,7 +227,7 @@ public Answer execute(ConvertInstanceCommand cmd, LibvirtComputingResource serve
                 }
 
                 result = performInstanceConversion(originalVMName, sourceOVFDirPath, temporaryConvertPath, temporaryConvertUuid,
-                        timeout, verboseModeEnabled, extraParams, serverResource);
+                        timeout, verboseModeEnabled, extraParams, serverResource, windowsGuest);
             }
 
             if (!result) {
@@ -177,6 +254,20 @@ public Answer execute(ConvertInstanceCommand cmd, LibvirtComputingResource serve
         }
     }
 
+    private boolean isDirectRbdVddkImport(ConvertInstanceCommand cmd) {
+        return isDirectVddkImportToPoolType(cmd, Storage.StoragePoolType.RBD);
+    }
+
+    private boolean isDirectLinstorVddkImport(ConvertInstanceCommand cmd) {
+        return isDirectVddkImportToPoolType(cmd, Storage.StoragePoolType.Linstor);
+    }
+
+    private boolean isDirectVddkImportToPoolType(ConvertInstanceCommand cmd, Storage.StoragePoolType poolType) {
+        DataStoreTO conversionTemporaryLocation = cmd.getConversionTemporaryLocation();
+        return cmd.isUseVddk() && conversionTemporaryLocation instanceof PrimaryDataStoreTO &&
+                ((PrimaryDataStoreTO) conversionTemporaryLocation).getPoolType() == poolType;
+    }
+
     protected KVMStoragePool getTemporaryStoragePool(DataStoreTO conversionTemporaryLocation, KVMStoragePoolManager storagePoolMgr) {
         if (conversionTemporaryLocation instanceof NfsTO) {
             NfsTO nfsTO = (NfsTO) conversionTemporaryLocation;
@@ -251,7 +342,7 @@ protected boolean performInstanceConversion(String originalVMName, String source
                                                 String temporaryConvertFolder,
                                                 String temporaryConvertUuid,
                                                 long timeout, boolean verboseModeEnabled, String extraParams,
-                                                LibvirtComputingResource serverResource) {
+                                                LibvirtComputingResource serverResource, boolean windowsGuest) {
         Script script = new Script("virt-v2v", timeout, logger);
         script.add("--root", "first");
         script.add("-i", "ova");
@@ -266,17 +357,28 @@ protected boolean performInstanceConversion(String originalVMName, String source
         if (StringUtils.isNotBlank(extraParams)) {
             addExtraParamsToScript(extraParams, script);
         }
+        Path firstbootScript = windowsGuest ? writeWindowsOnlineDisksFirstbootScript(originalVMName) : null;
+        if (firstbootScript != null) {
+            script.add("--firstboot", firstbootScript.toString());
+        }
 
-        String logPrefix = String.format("(%s) virt-v2v ovf source: %s progress", originalVMName, sourceOVFDirPath);
-        OutputInterpreter.LineByLineOutputLogger outputLogger = new OutputInterpreter.LineByLineOutputLogger(logger, logPrefix);
-        Map<String, String> convertInstanceEnv = serverResource.getConvertInstanceEnv();
-        if (MapUtils.isEmpty(convertInstanceEnv)) {
-            script.execute(outputLogger);
-        } else {
-            script.execute(outputLogger, convertInstanceEnv);
+        try {
+            String logPrefix = String.format("(%s) virt-v2v ovf source: %s progress", originalVMName, sourceOVFDirPath);
+            VirtioDriverOutputWatcher outputLogger = new VirtioDriverOutputWatcher(logger, logPrefix);
+            Map<String, String> convertInstanceEnv = serverResource.getConvertInstanceEnv();
+            if (MapUtils.isEmpty(convertInstanceEnv)) {
+                script.execute(outputLogger);
+            } else {
+                script.execute(outputLogger, convertInstanceEnv);
+            }
+            if (windowsGuest && outputLogger.isNoVirtioDriversReported()) {
+                failWindowsConversionWithoutVirtioDrivers(originalVMName);
+            }
+            int exitValue = script.getExitValue();
+            return exitValue == 0;
+        } finally {
+            deleteFirstbootScriptQuietly(firstbootScript, originalVMName);
         }
-        int exitValue = script.getExitValue();
-        return exitValue == 0;
     }
 
     protected void addExtraParamsToScript(String extraParams, Script script) {
@@ -308,7 +410,7 @@ protected boolean performInstanceConversionUsingVddk(RemoteInstanceTO vmwareInst
                                                          String libguestfsBackend, String vddkTransports,
                                                          String configuredVddkThumbprint,
                                                          long timeout, boolean verboseModeEnabled, String extraParams,
-                                                         String temporaryConvertUuid, String passwordOption) {
+                                                         String temporaryConvertUuid, String passwordOption, boolean windowsGuest) {
 
         String vcenterPassword = vmwareInstance.getVcenterPassword();
         if (StringUtils.isBlank(vcenterPassword)) {
@@ -328,6 +430,7 @@ protected boolean performInstanceConversionUsingVddk(RemoteInstanceTO vmwareInst
             return false;
         }
 
+        Path firstbootScript = windowsGuest ? writeWindowsOnlineDisksFirstbootScript(originalVMName) : null;
         try {
             String vpxUrl = buildVpxUrl(vmwareInstance);
 
@@ -372,6 +475,10 @@ protected boolean performInstanceConversionUsingVddk(RemoteInstanceTO vmwareInst
                 cmd.append(extraParams).append(" ");
             }
 
+            if (firstbootScript != null) {
+                cmd.append("--firstboot ").append(shellQuote(firstbootScript.toString())).append(" ");
+            }
+
             Script script = new Script("/bin/bash", timeout, logger);
             script.add("-c");
             script.add(cmd.toString());
@@ -396,9 +503,620 @@ protected boolean performInstanceConversionUsingVddk(RemoteInstanceTO vmwareInst
             } catch (Exception e) {
                 logger.warn("({}) Failed to delete password file {}: {}", originalVMName, passwordFilePath, e.getMessage());
             }
+            deleteFirstbootScriptQuietly(firstbootScript, originalVMName);
+        }
+    }
+
+    protected boolean performInstanceConversionUsingVddkDirectToPool(ConvertInstanceCommand cmd,
+                                                                     KVMStoragePool targetPool,
+                                                                     String originalVMName,
+                                                                     String vddkLibDir,
+                                                                     String libguestfsBackend,
+                                                                     String vddkTransports,
+                                                                     String configuredVddkThumbprint,
+                                                                     long timeout,
+                                                                     boolean verboseModeEnabled,
+                                                                     String temporaryConvertUuid,
+                                                                     LibvirtComputingResource serverResource) {
+        RemoteInstanceTO vmwareInstance = cmd.getSourceInstance();
+        List<VmwareVddkSourceDiskTO> sourceDisks = cmd.getVmwareVddkSourceDisks();
+        final boolean linstorTarget = targetPool.getType() == Storage.StoragePoolType.Linstor;
+        final boolean windowsGuest = cmd.isWindowsGuest();
+        if (sourceDisks == null || sourceDisks.isEmpty()) {
+            logger.error("({}) Direct {} VDDK import requires VMware source disk metadata", originalVMName, targetPool.getType());
+            return false;
+        }
+
+        if (linstorTarget) {
+            probeLinstorQemuAccess(targetPool, temporaryConvertUuid);
+        } else {
+            probeRbdQemuAccess(targetPool, temporaryConvertUuid);
+        }
+
+        String vcenterPassword = vmwareInstance.getVcenterPassword();
+        if (StringUtils.isBlank(vcenterPassword)) {
+            logger.error("({}) Could not determine vCenter password for {}", originalVMName, vmwareInstance.getVcenterHost());
+            return false;
+        }
+
+        String vddkThumbprint = StringUtils.trimToNull(configuredVddkThumbprint);
+        if (StringUtils.isBlank(vddkThumbprint)) {
+            vddkThumbprint = getVcenterThumbprint(vmwareInstance.getVcenterHost(), timeout, originalVMName);
+        }
+        if (StringUtils.isBlank(vddkThumbprint)) {
+            logger.error("({}) Could not determine vCenter thumbprint for {}", originalVMName, vmwareInstance.getVcenterHost());
+            return false;
+        }
+
+        String passwordFilePath = String.format("/tmp/v2v.rbd.pass.cloud.%s.%s",
+                StringUtils.defaultIfBlank(vmwareInstance.getVcenterHost(), "unknown"),
+                UUID.randomUUID());
+        List<String> createdImages = new ArrayList<>();
+        List<String> blockDevicePaths = new ArrayList<>();
+        try {
+            Files.writeString(Path.of(passwordFilePath), vcenterPassword);
+            Files.setPosixFilePermissions(Path.of(passwordFilePath), Set.of(PosixFilePermission.OWNER_READ, PosixFilePermission.OWNER_WRITE));
+
+            String vddkNbdCompression = serverResource.getVddkNbdCompression();
+            for (int i = 0; i < sourceDisks.size(); i++) {
+                VmwareVddkSourceDiskTO sourceDisk = sourceDisks.get(i);
+                if (linstorTarget) {
+                    String diskName = buildLinstorDiskName(temporaryConvertUuid, i);
+                    createdImages.add(diskName);
+                    String devicePath = copyVddkSourceDiskToLinstor(vmwareInstance, sourceDisk, targetPool, diskName, passwordFilePath,
+                            vddkLibDir, vddkTransports, vddkNbdCompression, vddkThumbprint, timeout, originalVMName, serverResource.hostSupportsNbdcopy());
+                    blockDevicePaths.add(devicePath);
+                } else {
+                    String imageName = buildRbdImageName(temporaryConvertUuid, i);
+                    createdImages.add(imageName);
+                    copyVddkSourceDiskToRbd(vmwareInstance, sourceDisk, targetPool, imageName, passwordFilePath,
+                            vddkLibDir, vddkTransports, vddkNbdCompression, vddkThumbprint, timeout, originalVMName,
+                            serverResource.hostSupportsNbdcopy());
+                }
+            }
+
+            boolean finalized;
+            if (linstorTarget) {
+                Path inputXml = Files.createTempFile("cloudstack-vddk-direct-" + temporaryConvertUuid, ".xml");
+                Files.writeString(inputXml, buildDirectBlockDeviceLibvirtXml(temporaryConvertUuid, blockDevicePaths));
+                finalized = runInPlaceFinalization(inputXml, libguestfsBackend, timeout, verboseModeEnabled, originalVMName, serverResource, windowsGuest);
+                Files.deleteIfExists(inputXml);
+            } else {
+                finalized = runRbdInPlaceFinalizationOverNbdBridges(targetPool, createdImages, temporaryConvertUuid,
+                        libguestfsBackend, timeout, verboseModeEnabled, originalVMName, serverResource, windowsGuest);
+            }
+            if (!finalized) {
+                cleanupDirectImportDisks(targetPool, createdImages, originalVMName);
+            }
+            return finalized;
+        } catch (Exception e) {
+            logger.error("({}) Direct {} VDDK import failed: {}", originalVMName, targetPool.getType(), e.getMessage(), e);
+            cleanupDirectImportDisks(targetPool, createdImages, originalVMName);
+            return false;
+        } finally {
+            try {
+                Files.deleteIfExists(Path.of(passwordFilePath));
+            } catch (Exception e) {
+                logger.warn("({}) Failed to delete password file {}: {}", originalVMName, passwordFilePath, e.getMessage());
+            }
+        }
+    }
+
+    private void copyVddkSourceDiskToRbd(RemoteInstanceTO vmwareInstance, VmwareVddkSourceDiskTO sourceDisk,
+                                         KVMStoragePool targetPool, String imageName, String passwordFilePath,
+                                         String vddkLibDir, String vddkTransports, String vddkNbdCompression,
+                                         String vddkThumbprint, long timeout, String originalVMName, boolean useNbdcopy) {
+        if (StringUtils.isBlank(sourceDisk.getSourceDiskPath())) {
+            throw new CloudRuntimeException(String.format("VMware source disk %s does not have a VMDK path", sourceDisk.getDiskId()));
+        }
+        String rbdImagePath = targetPool.getSourceDir() + "/" + imageName;
+        String qemuRbdTarget = KVMPhysicalDisk.RBDStringBuilder(targetPool, rbdImagePath);
+
+        StringBuilder nbdkit = new StringBuilder();
+        nbdkit.append("nbdkit -r -U - vddk ");
+        nbdkit.append("file=").append(shellQuote(sourceDisk.getSourceDiskPath())).append(" ");
+        nbdkit.append("server=").append(shellQuote(vmwareInstance.getVcenterHost())).append(" ");
+        nbdkit.append("user=").append(shellQuote(vmwareInstance.getVcenterUsername())).append(" ");
+        nbdkit.append("password=+").append(shellQuote(passwordFilePath)).append(" ");
+        if (StringUtils.isNotBlank(vmwareInstance.getVmwareMoref())) {
+            nbdkit.append("vm=").append(shellQuote("moref=" + vmwareInstance.getVmwareMoref())).append(" ");
+        } else {
+            nbdkit.append("vm=").append(shellQuote(vmwareInstance.getInstanceName())).append(" ");
+        }
+        nbdkit.append("libdir=").append(shellQuote(vddkLibDir)).append(" ");
+        nbdkit.append("thumbprint=").append(shellQuote(vddkThumbprint)).append(" ");
+        if (StringUtils.isNotBlank(vddkTransports)) {
+            nbdkit.append("transports=").append(shellQuote(vddkTransports)).append(" ");
+        }
+        if (StringUtils.isNotBlank(vddkNbdCompression)) {
+            nbdkit.append("compression=").append(shellQuote(vddkNbdCompression)).append(" ");
+        }
+
+        boolean bridgeCopy = useNbdcopy && sourceDisk.getCapacityBytes() > 0;
+        Path scriptFile = null;
+        try {
+            Script script;
+            if (bridgeCopy) {
+                // Multi-connection nbdcopy is typically faster than a single-stream qemu-img
+                // convert, but nbdcopy needs both ends as NBD. qemu-img cannot create the
+                // image here (nbdcopy does not), so pre-create it, then serve it over a
+                // localhost qemu-nbd bridge and copy NBD-to-NBD. The fresh raw image reads
+                // as zeros, so --destination-is-zero keeps it sparse.
+                int port = allocateLocalhostPort();
+                Path pidFile = Files.createTempFile("cloudstack-vddk-rbd-nbd-" + imageName + "-", ".pid");
+                Files.deleteIfExists(pidFile);
+                nbdkit.append("--run ").append(shellQuote(
+                        "nbdcopy --destination-is-zero \"$uri\" " + String.format("nbd://localhost:%d", port)));
+
+                StringBuilder scriptBody = new StringBuilder();
+                scriptBody.append("#!/bin/bash\n");
+                scriptBody.append("set -euo pipefail\n");
+                scriptBody.append("cleanup() {\n");
+                scriptBody.append("  set +e\n");
+                scriptBody.append("  if [[ -s ").append(shellQuote(pidFile.toString())).append(" ]]; then\n");
+                scriptBody.append("    pid=$(cat ").append(shellQuote(pidFile.toString())).append(")\n");
+                scriptBody.append("    kill \"$pid\" >/dev/null 2>&1 || true\n");
+                scriptBody.append("    for attempt in {1..20}; do kill -0 \"$pid\" >/dev/null 2>&1 || break; sleep 0.1; done\n");
+                scriptBody.append("  fi\n");
+                scriptBody.append("  rm -f ").append(shellQuote(pidFile.toString())).append("\n");
+                scriptBody.append("}\n");
+                scriptBody.append("trap cleanup EXIT\n");
+                scriptBody.append("qemu-img create -f raw ").append(shellQuote(qemuRbdTarget)).append(" ")
+                        .append(sourceDisk.getCapacityBytes()).append("\n");
+                scriptBody.append("qemu-nbd --fork --persistent --shared=8 --format=raw --bind=127.0.0.1 --port=")
+                        .append(port).append(" --pid-file=").append(shellQuote(pidFile.toString()))
+                        .append(" ").append(shellQuote(qemuRbdTarget)).append("\n");
+                scriptBody.append(nbdkit).append("\n");
+
+                scriptFile = Files.createTempFile("cloudstack-vddk-rbd-copy-" + imageName + "-", ".sh");
+                Files.writeString(scriptFile, scriptBody.toString());
+                Files.setPosixFilePermissions(scriptFile, Set.of(PosixFilePermission.OWNER_READ,
+                        PosixFilePermission.OWNER_WRITE, PosixFilePermission.OWNER_EXECUTE));
+
+                script = new Script("/bin/bash", timeout, logger);
+                script.add(scriptFile.toString());
+            } else {
+                // qemu-img convert creates and writes the RBD image in one step (fallback when
+                // nbdcopy is unavailable or the source capacity is unknown).
+                nbdkit.append("--run ").append(shellQuote("qemu-img convert -f raw -O raw \"$uri\" " + shellQuote(qemuRbdTarget)));
+                script = new Script("/bin/bash", timeout, logger);
+                script.add("-c");
+                script.add(nbdkit.toString());
+            }
+
+            String logPrefix = String.format("(%s) vddk%s to rbd disk %s", originalVMName,
+                    bridgeCopy ? "(nbdcopy)" : "", sourceDisk.getDiskId());
+            OutputInterpreter.LineByLineOutputLogger outputLogger = new OutputInterpreter.LineByLineOutputLogger(logger, logPrefix);
+            logger.info("({}) Copying VMware disk {} to RBD image {}{}", originalVMName, sourceDisk.getSourceDiskPath(),
+                    rbdImagePath, bridgeCopy ? " via nbdcopy over qemu-nbd bridge" : "");
+            script.execute(outputLogger);
+            if (script.getExitValue() != 0) {
+                throw new CloudRuntimeException(String.format("Failed to copy VMware disk %s to RBD image %s", sourceDisk.getSourceDiskPath(), rbdImagePath));
+            }
+        } catch (java.io.IOException e) {
+            throw new CloudRuntimeException(String.format("Failed to prepare RBD copy for VMware disk %s: %s",
+                    sourceDisk.getDiskId(), e.getMessage()), e);
+        } finally {
+            deleteQuietly(scriptFile);
+        }
+    }
+
+    private String copyVddkSourceDiskToLinstor(RemoteInstanceTO vmwareInstance, VmwareVddkSourceDiskTO sourceDisk,
+                                               KVMStoragePool targetPool, String diskName, String passwordFilePath,
+                                               String vddkLibDir, String vddkTransports, String vddkNbdCompression,
+                                               String vddkThumbprint, long timeout, String originalVMName, boolean useNbdcopy) {
+        if (StringUtils.isBlank(sourceDisk.getSourceDiskPath())) {
+            throw new CloudRuntimeException(String.format("VMware source disk %s does not have a VMDK path", sourceDisk.getDiskId()));
+        }
+        if (sourceDisk.getCapacityBytes() <= 0) {
+            throw new CloudRuntimeException(String.format("VMware source disk %s does not have a valid capacity, " +
+                    "which is required to pre-create the Linstor target volume", sourceDisk.getDiskId()));
+        }
+        KVMPhysicalDisk targetDisk = targetPool.createPhysicalDisk(diskName, QemuImg.PhysicalDiskFormat.RAW,
+                Storage.ProvisioningType.THIN, sourceDisk.getCapacityBytes(), null);
+        String devicePath = targetDisk.getPath();
+        if (StringUtils.isBlank(devicePath)) {
+            throw new CloudRuntimeException(String.format("Could not resolve a local device path for Linstor volume %s", diskName));
+        }
+        StringBuilder command = new StringBuilder();
+        command.append("nbdkit -r -U - vddk ");
+        command.append("file=").append(shellQuote(sourceDisk.getSourceDiskPath())).append(" ");
+        command.append("server=").append(shellQuote(vmwareInstance.getVcenterHost())).append(" ");
+        command.append("user=").append(shellQuote(vmwareInstance.getVcenterUsername())).append(" ");
+        command.append("password=+").append(shellQuote(passwordFilePath)).append(" ");
+        if (StringUtils.isNotBlank(vmwareInstance.getVmwareMoref())) {
+            command.append("vm=").append(shellQuote("moref=" + vmwareInstance.getVmwareMoref())).append(" ");
+        } else {
+            command.append("vm=").append(shellQuote(vmwareInstance.getInstanceName())).append(" ");
+        }
+        command.append("libdir=").append(shellQuote(vddkLibDir)).append(" ");
+        command.append("thumbprint=").append(shellQuote(vddkThumbprint)).append(" ");
+        if (StringUtils.isNotBlank(vddkTransports)) {
+            command.append("transports=").append(shellQuote(vddkTransports)).append(" ");
+        }
+        if (StringUtils.isNotBlank(vddkNbdCompression)) {
+            command.append("compression=").append(shellQuote(vddkNbdCompression)).append(" ");
+        }
+        // Full-disk copy into the local raw device: prefer nbdcopy (libnbd) when present -
+        // it pipelines many in-flight requests and is typically faster than a single-connection
+        // qemu-img convert - and fall back to qemu-img convert otherwise. Skip writing zero
+        // blocks (nbdcopy --destination-is-zero / qemu-img --target-is-zero) only when the
+        // backend guarantees a freshly created volume reads back as zeros (thin providers);
+        // on backends that do not (e.g. LVM-thick) the zeros must be written or stale data from
+        // a previously deleted volume would leak into the unwritten regions.
+        boolean targetIsZero = targetPool.isVolumeZeroInitialized(diskName);
+        String runCommand = useNbdcopy
+                ? "nbdcopy " + (targetIsZero ? "--destination-is-zero " : "") + "\"$uri\" " + shellQuote(devicePath)
+                : "qemu-img convert -n " + (targetIsZero ? "--target-is-zero " : "") + "-f raw -O raw \"$uri\" " + shellQuote(devicePath);
+        command.append("--run ").append(shellQuote(runCommand));
+
+        Script script = new Script("/bin/bash", timeout, logger);
+        script.add("-c");
+        script.add(command.toString());
+        String logPrefix = String.format("(%s) %s to linstor disk %s", originalVMName,
+                useNbdcopy ? "vddk(nbdcopy)" : "vddk", sourceDisk.getDiskId());
+        OutputInterpreter.LineByLineOutputLogger outputLogger = new OutputInterpreter.LineByLineOutputLogger(logger, logPrefix);
+        logger.info("({}) Copying VMware disk {} to Linstor device {}", originalVMName, sourceDisk.getSourceDiskPath(), devicePath);
+        script.execute(outputLogger);
+        if (script.getExitValue() != 0) {
+            throw new CloudRuntimeException(String.format("Failed to copy VMware disk %s to Linstor device %s", sourceDisk.getSourceDiskPath(), devicePath));
+        }
+        return devicePath;
+    }
+
+    private boolean runInPlaceFinalization(Path inputXml, String libguestfsBackend, long timeout,
+                                           boolean verboseModeEnabled, String originalVMName,
+                                           LibvirtComputingResource serverResource, boolean windowsGuest) {
+        Path firstbootScript = windowsGuest ? writeWindowsOnlineDisksFirstbootScript(originalVMName) : null;
+        try {
+            String inPlaceCommand = buildInPlaceCommand(inputXml, libguestfsBackend, verboseModeEnabled, serverResource, firstbootScript);
+            if (inPlaceCommand == null) {
+                logger.error("({}) No virt-v2v in-place finalization method is available", originalVMName);
+                return false;
+            }
+
+            Script script = new Script("/bin/bash", timeout, logger);
+            script.add("-c");
+            script.add(inPlaceCommand);
+            VirtioDriverOutputWatcher outputLogger = new VirtioDriverOutputWatcher(logger,
+                    String.format("(%s) virt-v2v in-place", originalVMName));
+            script.execute(outputLogger);
+            if (windowsGuest && outputLogger.isNoVirtioDriversReported()) {
+                failWindowsConversionWithoutVirtioDrivers(originalVMName);
+            }
+            return script.getExitValue() == 0;
+        } finally {
+            deleteFirstbootScriptQuietly(firstbootScript, originalVMName);
+        }
+    }
+
+    /**
+     * Builds the in-place finalization command, resolving the virt-v2v-in-place
+     * binary through the server resource (EL9 ships it in /usr/libexec, outside
+     * $PATH) and falling back to "virt-v2v --in-place". Returns null when the host
+     * has no in-place method.
+     */
+    private String buildInPlaceCommand(Path inputXml, String libguestfsBackend, boolean verboseModeEnabled,
+                                       LibvirtComputingResource serverResource, Path firstbootScript) {
+        StringBuilder command = new StringBuilder();
+        command.append("export LIBGUESTFS_BACKEND=").append(shellQuote(libguestfsBackend)).append(" && ");
+        String inPlaceBinary = serverResource.getVirtV2vInPlaceBinary();
+        if (inPlaceBinary != null) {
+            // No -O (write updated output XML): nothing consumes it and the option only
+            // exists from virt-v2v 2.5 on, so passing it breaks otherwise capable hosts
+            // such as Ubuntu 24.04 with virt-v2v-in-place 2.4.
+            command.append(inPlaceBinary).append(" --root first -i libvirtxml ")
+                    .append(shellQuote(inputXml.toString())).append(" ");
+        } else if (serverResource.hostSupportsVirtV2vInPlaceOption()) {
+            command.append("virt-v2v --root first -i libvirtxml ")
+                    .append(shellQuote(inputXml.toString())).append(" --in-place ");
+        } else {
+            return null;
+        }
+        if (verboseModeEnabled) {
+            command.append("-v ");
+        }
+        if (firstbootScript != null) {
+            command.append("--firstboot ").append(shellQuote(firstbootScript.toString())).append(" ");
+        }
+        return command.toString();
+    }
+
+    /**
+     * Finalizes direct-RBD import disks with in-place virt-v2v over temporary
+     * localhost qemu-nbd bridges (one per image), mirroring the CBT cutover
+     * approach. Native {@code <disk type='network' protocol='rbd'>} sources cannot
+     * be used here: their cephx {@code <auth>} element references a libvirt secret,
+     * and virt-v2v's {@code -i libvirtxml} input runs without a libvirt connection,
+     * so the secret cannot be resolved and no drives are attached (observed as
+     * "you must call guestfs_add_drive before guestfs_launch" on EL9).
+     */
+    protected boolean runRbdInPlaceFinalizationOverNbdBridges(KVMStoragePool targetPool, List<String> imageNames,
+                                                              String temporaryConvertUuid, String libguestfsBackend,
+                                                              long timeout, boolean verboseModeEnabled,
+                                                              String originalVMName, LibvirtComputingResource serverResource,
+                                                              boolean windowsGuest) {
+        List<Integer> ports = new ArrayList<>();
+        List<Path> pidFiles = new ArrayList<>();
+        Path inputXml = null;
+        Path scriptPath = null;
+        Path firstbootScript = windowsGuest ? writeWindowsOnlineDisksFirstbootScript(originalVMName) : null;
+        try {
+            for (int i = 0; i < imageNames.size(); i++) {
+                ports.add(allocateLocalhostPort());
+                Path pidFile = Files.createTempFile("cloudstack-vddk-rbd-nbd-" + temporaryConvertUuid + "-", ".pid");
+                Files.deleteIfExists(pidFile);
+                pidFiles.add(pidFile);
+            }
+
+            inputXml = Files.createTempFile("cloudstack-vddk-rbd-" + temporaryConvertUuid, ".xml");
+            Files.writeString(inputXml, buildDirectRbdNbdLibvirtXml(temporaryConvertUuid, ports));
+
+            String inPlaceCommand = buildInPlaceCommand(inputXml, libguestfsBackend, verboseModeEnabled, serverResource, firstbootScript);
+            if (inPlaceCommand == null) {
+                logger.error("({}) No virt-v2v in-place finalization method is available", originalVMName);
+                return false;
+            }
+
+            StringBuilder script = new StringBuilder();
+            script.append("#!/bin/bash\n");
+            script.append("set -euo pipefail\n");
+            script.append("cleanup() {\n");
+            script.append("  set +e\n");
+            script.append("  for pid_file in");
+            for (Path pidFile : pidFiles) {
+                script.append(" ").append(shellQuote(pidFile.toString()));
+            }
+            script.append("; do\n");
+            script.append("    if [[ -s \"$pid_file\" ]]; then\n");
+            script.append("      pid=$(cat \"$pid_file\")\n");
+            script.append("      kill \"$pid\" >/dev/null 2>&1 || true\n");
+            script.append("      for attempt in {1..20}; do\n");
+            script.append("        kill -0 \"$pid\" >/dev/null 2>&1 || break\n");
+            script.append("        sleep 0.1\n");
+            script.append("      done\n");
+            script.append("    fi\n");
+            script.append("    rm -f \"$pid_file\"\n");
+            script.append("  done\n");
+            script.append("}\n");
+            script.append("trap cleanup EXIT\n");
+            for (int i = 0; i < imageNames.size(); i++) {
+                String qemuRbdPath = KVMPhysicalDisk.RBDStringBuilder(targetPool,
+                        targetPool.getSourceDir() + "/" + imageNames.get(i));
+                script.append("qemu-nbd --fork --persistent --shared=1 --format=raw --bind=127.0.0.1 --port=")
+                        .append(ports.get(i))
+                        .append(" --pid-file=").append(shellQuote(pidFiles.get(i).toString()))
+                        .append(" ").append(shellQuote(qemuRbdPath)).append("\n");
+            }
+            script.append(inPlaceCommand).append("\n");
+
+            scriptPath = Files.createTempFile("cloudstack-vddk-rbd-finalize-" + temporaryConvertUuid + "-", ".sh");
+            Files.writeString(scriptPath, script.toString());
+            Files.setPosixFilePermissions(scriptPath, Set.of(PosixFilePermission.OWNER_READ,
+                    PosixFilePermission.OWNER_WRITE, PosixFilePermission.OWNER_EXECUTE));
+
+            Script runner = new Script("/bin/bash", timeout, logger);
+            runner.add(scriptPath.toString());
+            VirtioDriverOutputWatcher outputLogger = new VirtioDriverOutputWatcher(logger,
+                    String.format("(%s) virt-v2v rbd in-place", originalVMName));
+            runner.execute(outputLogger);
+            if (windowsGuest && outputLogger.isNoVirtioDriversReported()) {
+                failWindowsConversionWithoutVirtioDrivers(originalVMName);
+            }
+            return runner.getExitValue() == 0;
+        } catch (CloudRuntimeException e) {
+            throw e;
+        } catch (Exception e) {
+            logger.error("({}) RBD in-place finalization over NBD bridges failed: {}", originalVMName, e.getMessage(), e);
+            return false;
+        } finally {
+            deleteQuietly(inputXml);
+            deleteQuietly(scriptPath);
+            deleteQuietly(firstbootScript);
+            for (Path pidFile : pidFiles) {
+                deleteQuietly(pidFile);
+            }
+        }
+    }
+
+    private void deleteQuietly(Path path) {
+        if (path == null) {
+            return;
+        }
+        try {
+            Files.deleteIfExists(path);
+        } catch (Exception e) {
+            logger.debug("Unable to delete temporary file {}: {}", path, e.getMessage());
+        }
+    }
+
+    private int allocateLocalhostPort() throws java.io.IOException {
+        try (ServerSocket socket = new ServerSocket(0)) {
+            socket.setReuseAddress(false);
+            return socket.getLocalPort();
+        }
+    }
+
+    protected String buildDirectRbdNbdLibvirtXml(String temporaryConvertUuid, List<Integer> ports) {
+        StringBuilder xml = new StringBuilder();
+        xml.append("<domain type='kvm'>\n");
+        xml.append("  <name>").append(xmlEscape("cloudstack-vddk-rbd-" + temporaryConvertUuid)).append("</name>\n");
+        xml.append("  <memory unit='KiB'>1048576</memory>\n");
+        xml.append("  <vcpu>1</vcpu>\n");
+        xml.append("  <os><type>hvm</type><boot dev='hd'/></os>\n");
+        xml.append("  <devices>\n");
+        for (int i = 0; i < ports.size(); i++) {
+            xml.append("    <disk type='network' device='disk'>\n");
+            xml.append("      <driver name='qemu' type='raw'/>\n");
+            xml.append("      <source protocol='nbd'>\n");
+            xml.append("        <host name='localhost' port='").append(ports.get(i)).append("'/>\n");
+            xml.append("      </source>\n");
+            xml.append("      <target dev='").append(diskTargetName(i)).append("' bus='scsi'/>\n");
+            xml.append("    </disk>\n");
+        }
+        xml.append("  </devices>\n");
+        xml.append("</domain>\n");
+        return xml.toString();
+    }
+
+    private String buildDirectBlockDeviceLibvirtXml(String temporaryConvertUuid, List<String> devicePaths) {
+        StringBuilder xml = new StringBuilder();
+        xml.append("<domain type='kvm'>\n");
+        xml.append("  <name>").append(xmlEscape("cloudstack-vddk-direct-" + temporaryConvertUuid)).append("</name>\n");
+        xml.append("  <memory unit='KiB'>1048576</memory>\n");
+        xml.append("  <vcpu>1</vcpu>\n");
+        xml.append("  <os><type>hvm</type><boot dev='hd'/></os>\n");
+        xml.append("  <devices>\n");
+        for (int i = 0; i < devicePaths.size(); i++) {
+            xml.append("    <disk type='block' device='disk'>\n");
+            xml.append("      <driver name='qemu' type='raw'/>\n");
+            xml.append("      <source dev='").append(xmlEscape(devicePaths.get(i))).append("'/>\n");
+            xml.append("      <target dev='").append(diskTargetName(i)).append("' bus='scsi'/>\n");
+            xml.append("    </disk>\n");
+        }
+        xml.append("  </devices>\n");
+        xml.append("</domain>\n");
+        return xml.toString();
+    }
+
+    private String buildRbdImageName(String temporaryConvertUuid, int position) {
+        return String.format("%s-disk-%03d", temporaryConvertUuid, position);
+    }
+
+    /**
+     * Linstor disk names use a shorter position suffix than the RBD naming scheme:
+     * LINSTOR resource names are limited to 48 characters and the "cs-" prefix plus
+     * a 36-character UUID leaves little room ("-d%02d" keeps the name at 43).
+     */
+    private String buildLinstorDiskName(String temporaryConvertUuid, int position) {
+        return String.format("%s-d%02d", temporaryConvertUuid, position);
+    }
+
+    private String diskTargetName(int index) {
+        StringBuilder target = new StringBuilder("sd");
+        int value = index;
+        do {
+            target.insert(2, (char) ('a' + (value % 26)));
+            value = value / 26 - 1;
+        } while (value >= 0);
+        return target.toString();
+    }
+
+    private void probeRbdQemuAccess(KVMStoragePool pool, String temporaryConvertUuid) {
+        String probeName = temporaryConvertUuid + "-probe-" + UUID.randomUUID();
+        String rbdImagePath = pool.getSourceDir() + "/" + probeName;
+        String qemuRbdPath = KVMPhysicalDisk.RBDStringBuilder(pool, rbdImagePath);
+        try {
+            Script qemuImg = new Script("qemu-img", 120000, logger);
+            qemuImg.add("create", "-f", "raw", qemuRbdPath, "4194304");
+            qemuImg.execute();
+            if (qemuImg.getExitValue() != 0) {
+                throw new CloudRuntimeException(String.format("qemu-img could not create RBD probe image %s", rbdImagePath));
+            }
+
+            Script qemuIo = new Script("qemu-io", 120000, logger);
+            qemuIo.add("-f", "raw", "-c", "write -P 0x5a 0 4k", "-c", "read -P 0x5a 0 4k", qemuRbdPath);
+            qemuIo.execute();
+            if (qemuIo.getExitValue() != 0) {
+                throw new CloudRuntimeException(String.format("qemu-io could not verify RBD probe image %s", rbdImagePath));
+            }
+        } finally {
+            try {
+                pool.deletePhysicalDisk(probeName, Storage.ImageFormat.RAW);
+            } catch (Exception e) {
+                logger.warn("Failed to delete RBD probe image {} from pool {}: {}", probeName, pool.getUuid(), e.getMessage());
+            }
         }
     }
 
+    /**
+     * First-boot batch script injected into converted Windows guests. virt-v2v runs it once on the
+     * guest's first boot. It brings migrated data disks online and read-write and sets the SAN policy to
+     * OnlineAll, working around the common post-v2v symptom where secondary disks stay Offline/Read-only
+     * under the default Windows SAN policy. The Storage cmdlets used exist on Windows Server 2012+.
+     */
+    protected static final String WINDOWS_ONLINE_DISKS_FIRSTBOOT =
+            "@echo off\r\n" +
+            "rem CloudStack post-migration: online offline disks, clear read-only, set SAN policy OnlineAll\r\n" +
+            "set CSLOG=%SystemDrive%\\cloudstack-firstboot.log\r\n" +
+            "echo [%DATE% %TIME%] CloudStack firstboot: bringing migrated disks online >> \"%CSLOG%\"\r\n" +
+            "powershell -NonInteractive -ExecutionPolicy Bypass -Command \"try { Set-StorageSetting -NewDiskPolicy OnlineAll -ErrorAction SilentlyContinue } catch {}; Get-Disk | Where-Object { $_.IsOffline } | ForEach-Object { Set-Disk -Number $_.Number -IsOffline $false }; Get-Disk | Where-Object { $_.IsReadOnly } | ForEach-Object { Set-Disk -Number $_.Number -IsReadOnly $false }\" >> \"%CSLOG%\" 2>&1\r\n" +
+            "exit /b 0\r\n";
+
+    /**
+     * Writes the Windows online-disks first-boot batch script to a temporary file so it can be passed to
+     * virt-v2v / virt-v2v-in-place via {@code --firstboot}. Returns the path, or {@code null} if it could
+     * not be written (conversion then proceeds without the first-boot fix rather than failing).
+     */
+    protected Path writeWindowsOnlineDisksFirstbootScript(String originalVMName) {
+        try {
+            Path firstbootScript = Files.createTempFile("cloudstack-firstboot-online-disks-", ".bat");
+            Files.writeString(firstbootScript, WINDOWS_ONLINE_DISKS_FIRSTBOOT);
+            logger.info("({}) Windows guest detected; injecting first-boot script to online migrated disks: {}",
+                    originalVMName, firstbootScript);
+            return firstbootScript;
+        } catch (Exception e) {
+            logger.warn("({}) Failed to write Windows online-disks first-boot script; conversion will proceed without it: {}",
+                    originalVMName, e.getMessage());
+            return null;
+        }
+    }
+
+    private void deleteFirstbootScriptQuietly(Path firstbootScript, String originalVMName) {
+        if (firstbootScript == null) {
+            return;
+        }
+        try {
+            Files.deleteIfExists(firstbootScript);
+        } catch (Exception e) {
+            logger.warn("({}) Failed to delete first-boot script {}: {}", originalVMName, firstbootScript, e.getMessage());
+        }
+    }
+
+    private void probeLinstorQemuAccess(KVMStoragePool pool, String temporaryConvertUuid) {
+        String probeName = temporaryConvertUuid.substring(0, 8) + "-probe";
+        try {
+            KVMPhysicalDisk probeDisk = pool.createPhysicalDisk(probeName, QemuImg.PhysicalDiskFormat.RAW,
+                    Storage.ProvisioningType.THIN, 4194304L, null);
+            Script qemuIo = new Script("qemu-io", 120000, logger);
+            qemuIo.add("-f", "raw", "-c", "write -P 0x5a 0 4k", "-c", "read -P 0x5a 0 4k", probeDisk.getPath());
+            qemuIo.execute();
+            if (qemuIo.getExitValue() != 0) {
+                throw new CloudRuntimeException(String.format("qemu-io could not verify Linstor probe volume %s on pool %s", probeName, pool.getUuid()));
+            }
+        } finally {
+            try {
+                pool.deletePhysicalDisk(probeName, Storage.ImageFormat.RAW);
+            } catch (Exception e) {
+                logger.warn("Failed to delete Linstor probe volume {} from pool {}: {}", probeName, pool.getUuid(), e.getMessage());
+            }
+        }
+    }
+
+    private void cleanupDirectImportDisks(KVMStoragePool pool, List<String> imageNames, String originalVMName) {
+        for (String imageName : imageNames) {
+            try {
+                logger.info("({}) Cleaning up disk {} after failed direct import", originalVMName, imageName);
+                pool.deletePhysicalDisk(imageName, Storage.ImageFormat.RAW);
+            } catch (Exception e) {
+                logger.warn("({}) Failed to delete disk {} from pool {}: {}", originalVMName, imageName, pool.getUuid(), e.getMessage());
+            }
+        }
+    }
+
+    private String shellQuote(String value) {
+        return "'" + StringUtils.defaultString(value).replace("'", "'\"'\"'") + "'";
+    }
+
+    private String xmlEscape(String value) {
+        return StringUtils.defaultString(value)
+                .replace("&", "&amp;")
+                .replace("<", "&lt;")
+                .replace(">", "&gt;")
+                .replace("\"", "&quot;")
+                .replace("'", "&apos;");
+    }
+
     protected String getVcenterThumbprint(String vcenterHost, long timeout, String originalVMName) {
         if (StringUtils.isBlank(vcenterHost)) {
             return null;
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVolumesOnStorageCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVolumesOnStorageCommandWrapper.java
index 1109d240a035..46cb1b9bee33 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVolumesOnStorageCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVolumesOnStorageCommandWrapper.java
@@ -52,7 +52,7 @@
 public final class LibvirtGetVolumesOnStorageCommandWrapper extends CommandWrapper<GetVolumesOnStorageCommand, Answer, LibvirtComputingResource> {
 
     static final List<StoragePoolType> STORAGE_POOL_TYPES_SUPPORTED_BY_QEMU_IMG = Arrays.asList(StoragePoolType.NetworkFilesystem,
-            StoragePoolType.Filesystem, StoragePoolType.RBD, StoragePoolType.SharedMountPoint);
+            StoragePoolType.Filesystem, StoragePoolType.RBD, StoragePoolType.SharedMountPoint, StoragePoolType.Linstor);
 
     @Override
     public Answer execute(final GetVolumesOnStorageCommand command, final LibvirtComputingResource libvirtComputingResource) {
@@ -64,11 +64,22 @@ public Answer execute(final GetVolumesOnStorageCommand command, final LibvirtCom
         final KVMStoragePoolManager storagePoolMgr = libvirtComputingResource.getStoragePoolMgr();
         final KVMStoragePool storagePool = storagePoolMgr.getStoragePool(pool.getType(), pool.getUuid(), true, true);
 
+        if (StoragePoolType.Linstor.equals(pool.getType())) {
+            try {
+                List<VolumeOnStorageTO> volumes = storagePool.getVolumesForImport(
+                        StringUtils.isBlank(volumePath) ? null : volumePath);
+                if (StringUtils.isNotBlank(keyword)) {
+                    volumes = volumes.stream().filter(volume -> volume.getName().contains(keyword)).collect(Collectors.toList());
+                }
+                return new GetVolumesOnStorageAnswer(command, volumes);
+            } catch (RuntimeException e) {
+                return new GetVolumesOnStorageAnswer(command, false, e.getMessage());
+            }
+        }
         if (StringUtils.isNotBlank(volumePath)) {
             return addVolumeByVolumePath(command, storagePool, volumePath);
-        } else {
-            return addAllVolumes(command, storagePool, keyword);
         }
+        return addAllVolumes(command, storagePool, keyword);
     }
 
     private GetVolumesOnStorageAnswer addVolumeByVolumePath(final GetVolumesOnStorageCommand command, final KVMStoragePool storagePool, String volumePath) {
@@ -128,7 +139,20 @@ private void addDetailsToVolumeOnStorageTO(VolumeOnStorageTO volumeOnStorageTO,
         if (StringUtils.isNotBlank(encrypted) && encrypted.equalsIgnoreCase("yes")) {
             volumeOnStorageTO.addDetail(VolumeOnStorageTO.Detail.IS_ENCRYPTED, String.valueOf(Boolean.TRUE));
         }
-        Boolean isLocked = isDiskFileLocked(storagePool, disk);
+        boolean isLocked = isDiskFileLocked(storagePool, disk);
+        if (!isLocked) {
+            // Clustered block storage (Linstor/DRBD): the host-local qemu-img lock cannot see a
+            // volume in use by a running VM on another node — consult the cluster-wide state.
+            String inUseNode = storagePool.getVolumeInUseNode(disk.getName());
+            if (KVMStoragePool.IN_USE_NODE_UNKNOWN.equals(inUseNode)) {
+                logger.warn("Could not determine cluster-wide in-use state of volume {}; marking as locked",
+                        disk.getName());
+                isLocked = true;
+            } else if (inUseNode != null) {
+                logger.info("Volume {} is in use on node {}; marking as locked", disk.getName(), inUseNode);
+                isLocked = true;
+            }
+        }
         volumeOnStorageTO.addDetail(VolumeOnStorageTO.Detail.IS_LOCKED, String.valueOf(isLocked));
     }
 
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtImportConvertedInstanceCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtImportConvertedInstanceCommandWrapper.java
index 28e24a9e0f2d..fb432cd71e66 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtImportConvertedInstanceCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtImportConvertedInstanceCommandWrapper.java
@@ -20,7 +20,9 @@
 
 import java.util.List;
 
+import org.apache.cloudstack.storage.to.PrimaryDataStoreTO;
 import org.apache.cloudstack.vm.UnmanagedInstanceTO;
+import org.apache.commons.collections4.CollectionUtils;
 
 import com.cloud.agent.api.Answer;
 import com.cloud.agent.api.ImportConvertedInstanceAnswer;
@@ -35,7 +37,7 @@
 import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
 import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
 import com.cloud.resource.ResourceWrapper;
-import org.apache.commons.collections4.CollectionUtils;
+import com.cloud.storage.Storage;
 
 @ResourceWrapper(handles =  ImportConvertedInstanceCommand.class)
 public class LibvirtImportConvertedInstanceCommandWrapper extends LibvirtBaseConvertCommandWrapper<ImportConvertedInstanceCommand, Answer, LibvirtComputingResource> {
@@ -46,6 +48,7 @@ public Answer execute(ImportConvertedInstanceCommand cmd, LibvirtComputingResour
         Hypervisor.HypervisorType sourceHypervisorType = sourceInstance.getHypervisorType();
         String sourceInstanceName = sourceInstance.getInstanceName();
         List<String> destinationStoragePools = cmd.getDestinationStoragePools();
+        List<Storage.StoragePoolType> destinationStoragePoolTypes = cmd.getDestinationStoragePoolTypes();
         DataStoreTO conversionTemporaryLocation = cmd.getConversionTemporaryLocation();
         final String temporaryConvertUuid = cmd.getTemporaryConvertUuid();
         final boolean forceConvertToPool = cmd.isForceConvertToPool();
@@ -55,6 +58,12 @@ public Answer execute(ImportConvertedInstanceCommand cmd, LibvirtComputingResour
         final String temporaryConvertPath = temporaryStoragePool.getLocalPath();
 
         try {
+            if (isForcedBlockStorageConversion(conversionTemporaryLocation, forceConvertToPool)) {
+                List<KVMPhysicalDisk> disks = getTemporaryDisksWithPrefixFromTemporaryPool(temporaryStoragePool, temporaryConvertPath, temporaryConvertUuid);
+                UnmanagedInstanceTO convertedInstanceTO = getConvertedUnmanagedInstance(temporaryConvertUuid, disks, null);
+                return new ImportConvertedInstanceAnswer(cmd, convertedInstanceTO);
+            }
+
             String convertedBasePath = String.format("%s/%s", temporaryConvertPath, temporaryConvertUuid);
             LibvirtDomainXMLParser xmlParser = parseMigratedVMXmlDomain(convertedBasePath);
 
@@ -68,7 +77,7 @@ public Answer execute(ImportConvertedInstanceCommand cmd, LibvirtComputingResour
                 disks = temporaryDisks;
             } else {
                 disks = moveTemporaryDisksToDestination(temporaryDisks,
-                        destinationStoragePools, storagePoolMgr);
+                        destinationStoragePools, destinationStoragePoolTypes, storagePoolMgr);
                 cleanupDisksAndDomainFromTemporaryLocation(temporaryDisks, temporaryStoragePool, temporaryConvertUuid, true);
             }
 
@@ -93,4 +102,12 @@ public Answer execute(ImportConvertedInstanceCommand cmd, LibvirtComputingResour
             }
         }
     }
+
+    private boolean isForcedBlockStorageConversion(DataStoreTO conversionTemporaryLocation, boolean forceConvertToPool) {
+        if (!forceConvertToPool || !(conversionTemporaryLocation instanceof PrimaryDataStoreTO)) {
+            return false;
+        }
+        Storage.StoragePoolType poolType = ((PrimaryDataStoreTO) conversionTemporaryLocation).getPoolType();
+        return poolType == Storage.StoragePoolType.RBD || poolType == Storage.StoragePoolType.Linstor;
+    }
 }
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtReadyCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtReadyCommandWrapper.java
index 1ff6d7851f20..72d9c3c84c46 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtReadyCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtReadyCommandWrapper.java
@@ -52,9 +52,19 @@ public Answer execute(final ReadyCommand command, final LibvirtComputingResource
         if (libvirtComputingResource.hostSupportsInstanceConversion()) {
             hostDetails.put(Host.HOST_VIRTV2V_VERSION, libvirtComputingResource.getHostVirtV2vVersion());
         }
+        hostDetails.put(Host.HOST_VIRTV2V_INPLACE_VERSION, libvirtComputingResource.getHostVirtV2vInPlaceVersion());
         hostDetails.put(Host.HOST_VDDK_SUPPORT, Boolean.toString(libvirtComputingResource.hostSupportsVddk()));
         hostDetails.put(Host.HOST_VDDK_LIB_DIR, StringUtils.defaultString(libvirtComputingResource.getVddkLibDir()));
         hostDetails.put(Host.HOST_VDDK_VERSION, StringUtils.defaultString(libvirtComputingResource.getVddkVersion()));
+        hostDetails.put(Host.HOST_VDDK_BLOCKCOPY_SUPPORT, Boolean.toString(libvirtComputingResource.hostSupportsVddkBlockCopy()));
+        hostDetails.put(Host.HOST_VDDK_BLOCKCOPY_INPLACE_FINALIZATION_SUPPORT, Boolean.toString(libvirtComputingResource.hostSupportsVddkBlockCopyInPlaceFinalization()));
+        hostDetails.put(Host.HOST_VDDK_BLOCKCOPY_RBD_SUPPORT, Boolean.toString(libvirtComputingResource.hostSupportsVddkBlockCopyRbd()));
+        hostDetails.put(Host.HOST_QEMU_IMG_VERSION, StringUtils.defaultString(libvirtComputingResource.getQemuImgVersion()));
+        hostDetails.put(Host.HOST_QEMU_NBD_VERSION, StringUtils.defaultString(libvirtComputingResource.getQemuNbdVersion()));
+        hostDetails.put(Host.HOST_QEMU_IO_VERSION, StringUtils.defaultString(libvirtComputingResource.getQemuIoVersion()));
+        hostDetails.put(Host.HOST_VIRTV2V_INPLACE_SUPPORT, Boolean.toString(libvirtComputingResource.hostSupportsVirtV2vInPlace()));
+        hostDetails.put(Host.HOST_QEMU_RBD_SUPPORT, Boolean.toString(libvirtComputingResource.hostSupportsQemuRbd()));
+        hostDetails.put(Host.HOST_VDDK_RBD_DIRECT_IMPORT_SUPPORT, Boolean.toString(libvirtComputingResource.hostSupportsVddkRbdDirectImport()));
 
         if (libvirtComputingResource.hostSupportsOvfExport()) {
             hostDetails.put(Host.HOST_OVFTOOL_VERSION, libvirtComputingResource.getHostOvfToolVersion());
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtCleanupCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtCleanupCommandWrapper.java
new file mode 100644
index 000000000000..3db111fa56a2
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtCleanupCommandWrapper.java
@@ -0,0 +1,339 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.VmwareCbtCleanupCommand;
+import com.cloud.agent.api.VmwareCbtMigrationAnswer;
+import com.cloud.agent.api.to.VmwareCbtDiskTO;
+import com.cloud.agent.api.to.VmwareCbtTargetStorageType;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.storage.Storage;
+import com.cloud.utils.script.Script;
+
+@ResourceWrapper(handles = VmwareCbtCleanupCommand.class)
+public class LibvirtVmwareCbtCleanupCommandWrapper extends CommandWrapper<VmwareCbtCleanupCommand, Answer, LibvirtComputingResource> {
+
+    @Override
+    public Answer execute(VmwareCbtCleanupCommand cmd, LibvirtComputingResource serverResource) {
+        if (!cmd.getRemovePartialTargetDisks()) {
+            String msg = String.format("VMware CBT cleanup for migration %s skipped target disk cleanup by command policy.",
+                    cmd.getMigrationUuid());
+            logger.info(msg);
+            return new VmwareCbtMigrationAnswer(cmd, true, msg, cmd.getMigrationUuid());
+        }
+
+        try {
+            if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RBD_RAW) {
+                int removedImages = deleteRbdTargetImages(cmd, serverResource.getStoragePoolMgr());
+                String msg = String.format("VMware CBT cleanup for migration %s removed %s replicated RBD target image(s).",
+                        cmd.getMigrationUuid(), removedImages);
+                logger.info(msg);
+                return new VmwareCbtMigrationAnswer(cmd, true, msg, cmd.getMigrationUuid());
+            }
+
+            if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE) {
+                int removedVolumes = deleteBlockDeviceTargetVolumes(cmd, serverResource.getStoragePoolMgr());
+                String msg = String.format("VMware CBT cleanup for migration %s removed %s replicated block device target volume(s).",
+                        cmd.getMigrationUuid(), removedVolumes);
+                logger.info(msg);
+                return new VmwareCbtMigrationAnswer(cmd, true, msg, cmd.getMigrationUuid());
+            }
+
+            killInFlightCopyProcesses(String.format("/cloudstack-cbt/%s/", cmd.getMigrationUuid()),
+                    cmd.getMigrationUuid());
+            Set<Path> migrationDirectories = getMigrationDirectories(cmd);
+            int removedDirectories = 0;
+            for (Path migrationDirectory : migrationDirectories) {
+                if (deleteMigrationDirectory(migrationDirectory)) {
+                    removedDirectories++;
+                }
+            }
+            String msg = String.format("VMware CBT cleanup for migration %s removed %s replicated target directorie(s).",
+                    cmd.getMigrationUuid(), removedDirectories);
+            logger.info(msg);
+            return new VmwareCbtMigrationAnswer(cmd, true, msg, cmd.getMigrationUuid());
+        } catch (Exception e) {
+            String msg = String.format("Unable to clean up VMware CBT migration %s on host %s: %s",
+                    cmd.getMigrationUuid(), serverResource.getPrivateIp(),
+                    StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()));
+            logger.error(msg, e);
+            return new VmwareCbtMigrationAnswer(cmd, false, msg, cmd.getMigrationUuid());
+        }
+    }
+
+    private int deleteRbdTargetImages(VmwareCbtCleanupCommand cmd, KVMStoragePoolManager storagePoolMgr) {
+        KVMStoragePool targetPool = getTargetStoragePool(cmd, storagePoolMgr);
+        if (targetPool == null || targetPool.getType() != Storage.StoragePoolType.RBD) {
+            throw new IllegalArgumentException(String.format("VMware CBT migration %s requires an RBD destination storage pool for RBD cleanup",
+                    cmd.getMigrationUuid()));
+        }
+        if (CollectionUtils.isEmpty(cmd.getDisks())) {
+            return 0;
+        }
+
+        killInFlightCopyProcesses(String.format("cloudstack-cbt-%s-", cmd.getMigrationUuid()), cmd.getMigrationUuid());
+
+        int removedImages = 0;
+        List<String> failedImages = new ArrayList<>();
+        for (VmwareCbtDiskTO disk : cmd.getDisks()) {
+            String imageName = getRbdCleanupImageName(cmd.getMigrationUuid(), disk.getTargetPath());
+            if (StringUtils.isBlank(imageName)) {
+                continue;
+            }
+            if (deletePhysicalDiskWithRetries(targetPool, imageName, cmd.getMigrationUuid())) {
+                removedImages++;
+            } else {
+                failedImages.add(imageName);
+            }
+        }
+        if (CollectionUtils.isNotEmpty(failedImages)) {
+            throw new IllegalStateException(String.format("Unable to delete VMware CBT RBD target image(s) %s from storage pool %s",
+                    StringUtils.join(failedImages, ", "), targetPool.getUuid()));
+        }
+        return removedImages;
+    }
+
+    private int deleteBlockDeviceTargetVolumes(VmwareCbtCleanupCommand cmd, KVMStoragePoolManager storagePoolMgr) {
+        KVMStoragePool targetPool = getTargetStoragePool(cmd, storagePoolMgr);
+        if (targetPool == null || targetPool.getType() != Storage.StoragePoolType.Linstor) {
+            throw new IllegalArgumentException(String.format("VMware CBT migration %s requires a Linstor destination storage pool for block device cleanup",
+                    cmd.getMigrationUuid()));
+        }
+        if (CollectionUtils.isEmpty(cmd.getDisks())) {
+            return 0;
+        }
+
+        killInFlightCopyProcesses(String.format("cbt-%s-", StringUtils.defaultString(cmd.getMigrationUuid()).replace("-", "").substring(0, 8)),
+                cmd.getMigrationUuid());
+
+        int removedVolumes = 0;
+        List<String> failedVolumes = new ArrayList<>();
+        for (VmwareCbtDiskTO disk : cmd.getDisks()) {
+            String volumeName = getBlockDeviceCleanupVolumeName(cmd.getMigrationUuid(), disk.getTargetPath());
+            if (StringUtils.isBlank(volumeName)) {
+                continue;
+            }
+            if (deletePhysicalDiskWithRetries(targetPool, volumeName, cmd.getMigrationUuid())) {
+                removedVolumes++;
+            } else {
+                failedVolumes.add(volumeName);
+            }
+        }
+        if (CollectionUtils.isNotEmpty(failedVolumes)) {
+            throw new IllegalStateException(String.format("Unable to delete VMware CBT block device target volume(s) %s from storage pool %s",
+                    StringUtils.join(failedVolumes, ", "), targetPool.getUuid()));
+        }
+        return removedVolumes;
+    }
+
+    /**
+     * Block device target names carry a short migration marker ("cbt-" plus the first
+     * eight non-dash characters of the migration UUID) instead of the full RBD-style
+     * marker, because LINSTOR resource names are limited to 48 characters.
+     */
+    private String getBlockDeviceCleanupVolumeName(String migrationUuid, String targetPath) {
+        String normalizedTargetPath = StringUtils.defaultString(targetPath).replace('\\', '/');
+        String volumeName = StringUtils.contains(normalizedTargetPath, "/") ? StringUtils.substringAfterLast(normalizedTargetPath, "/") : normalizedTargetPath;
+        String marker = String.format("cbt-%s-", StringUtils.defaultString(migrationUuid).replace("-", "").substring(0, 8));
+        if (!StringUtils.startsWith(volumeName, marker)) {
+            logger.warn("Skipping VMware CBT block device cleanup target {} because it does not start with marker {}", targetPath, marker);
+            return null;
+        }
+        return volumeName;
+    }
+
+    /**
+     * A cancelled migration's initial/delta sync may still be copying into the
+     * target volumes when this cleanup runs (the data-plane copy is not aborted by
+     * the cancel itself). Any surviving copy keeps the target device/image busy -
+     * volume deletion then fails and the copy keeps burning VDDK/network/storage on
+     * a dead migration. Kill processes whose command line references this
+     * migration's marker-guarded target names before deleting them: this matches
+     * the nbdcopy / qemu-img convert / qemu-io processes (their arguments carry the
+     * marker-named target); the nbdkit --run parent exits with its child.
+     */
+    protected void killInFlightCopyProcesses(String marker, String migrationUuid) {
+        if (StringUtils.isBlank(marker)) {
+            return;
+        }
+        // Make the first character a bracket expression. The regex still matches the literal
+        // target marker, but it does not match the bash command line running pkill itself.
+        String processMatchPattern = String.format("[%s]%s", marker.charAt(0), marker.substring(1));
+        int exitValue = Script.runSimpleBashScriptForExitValue(String.format("pkill -f -- %s",
+                quoteShellArgument(processMatchPattern)));
+        if (exitValue == 0) {
+            logger.info("Killed in-flight copy process(es) matching marker {} for VMware CBT migration {}", marker, migrationUuid);
+            try {
+                Thread.sleep(2000);
+            } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
+            }
+        }
+    }
+
+    /**
+     * Retries volume deletion briefly: right after in-flight copies are killed the
+     * device may still be held open (DRBD demotion, qemu teardown) for a moment.
+     */
+    protected boolean deletePhysicalDiskWithRetries(KVMStoragePool targetPool, String volumeName, String migrationUuid) {
+        final int attempts = 3;
+        for (int attempt = 1; attempt <= attempts; attempt++) {
+            try {
+                if (targetPool.deletePhysicalDisk(volumeName, Storage.ImageFormat.RAW)) {
+                    return true;
+                }
+                logger.warn("Attempt {}/{} to delete VMware CBT target {} for migration {} returned false",
+                        attempt, attempts, volumeName, migrationUuid);
+            } catch (RuntimeException e) {
+                logger.warn("Attempt {}/{} to delete VMware CBT target {} for migration {} failed: {}",
+                        attempt, attempts, volumeName, migrationUuid,
+                        StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()));
+            }
+            if (isTargetAlreadyAbsent(targetPool, volumeName, migrationUuid)) {
+                return true;
+            }
+            if (attempt < attempts) {
+                try {
+                    Thread.sleep(2000L * attempt);
+                } catch (InterruptedException e) {
+                    Thread.currentThread().interrupt();
+                    return false;
+                }
+            }
+        }
+        return isTargetAlreadyAbsent(targetPool, volumeName, migrationUuid);
+    }
+
+    /**
+     * Target cleanup has to be idempotent. A cancelled migration has already had its targets
+     * removed by the cancel itself, and deleting the migration afterwards runs cleanup again
+     * (the delete API defaults to cleanup=true). Without this check that second pass fails on
+     * targets that are legitimately gone, and the migration record can never be removed.
+     * <p>
+     * Absence is only reported when it can be positively confirmed by listing the pool; if the
+     * pool cannot be inspected the target is assumed to still exist, so a genuine failure is
+     * still surfaced rather than being masked.
+     */
+    protected boolean isTargetAlreadyAbsent(KVMStoragePool targetPool, String volumeName, String migrationUuid) {
+        try {
+            List<KVMPhysicalDisk> disks = targetPool.listPhysicalDisks();
+            if (disks == null) {
+                return false;
+            }
+            for (KVMPhysicalDisk disk : disks) {
+                if (disk != null && StringUtils.equals(disk.getName(), volumeName)) {
+                    return false;
+                }
+            }
+            logger.info("VMware CBT target {} for migration {} is no longer present on storage pool {}; treating cleanup as complete",
+                    volumeName, migrationUuid, targetPool.getUuid());
+            return true;
+        } catch (RuntimeException e) {
+            logger.warn("Unable to confirm whether VMware CBT target {} for migration {} still exists on storage pool {}: {}",
+                    volumeName, migrationUuid, targetPool.getUuid(),
+                    StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()));
+            return false;
+        }
+    }
+
+    private String quoteShellArgument(String value) {
+        return "'" + StringUtils.defaultString(value).replace("'", "'\"'\"'") + "'";
+    }
+
+    private KVMStoragePool getTargetStoragePool(VmwareCbtCleanupCommand cmd, KVMStoragePoolManager storagePoolMgr) {
+        Storage.StoragePoolType poolType = cmd.getDestinationStoragePoolType();
+        String poolUuid = StringUtils.trimToNull(cmd.getDestinationStoragePoolUuid());
+        if (poolType != null && StringUtils.isNotBlank(poolUuid)) {
+            return storagePoolMgr.getStoragePool(poolType, poolUuid);
+        }
+        return null;
+    }
+
+    private String getRbdCleanupImageName(String migrationUuid, String targetPath) {
+        String normalizedTargetPath = StringUtils.defaultString(targetPath).replace('\\', '/');
+        String imageName = StringUtils.contains(normalizedTargetPath, "/") ? StringUtils.substringAfterLast(normalizedTargetPath, "/") : normalizedTargetPath;
+        String marker = String.format("cloudstack-cbt-%s-", migrationUuid);
+        if (!StringUtils.contains(imageName, marker)) {
+            logger.warn("Skipping VMware CBT RBD cleanup target {} because it does not contain marker {}", targetPath, marker);
+            return null;
+        }
+        return imageName;
+    }
+
+    private Set<Path> getMigrationDirectories(VmwareCbtCleanupCommand cmd) {
+        Set<Path> migrationDirectories = new HashSet<>();
+        if (CollectionUtils.isEmpty(cmd.getDisks())) {
+            return migrationDirectories;
+        }
+
+        for (VmwareCbtDiskTO disk : cmd.getDisks()) {
+            Path migrationDirectory = getMigrationDirectory(cmd.getMigrationUuid(), disk.getTargetPath());
+            if (migrationDirectory != null) {
+                migrationDirectories.add(migrationDirectory);
+            }
+        }
+        return migrationDirectories;
+    }
+
+    private Path getMigrationDirectory(String migrationUuid, String targetPath) {
+        if (StringUtils.isAnyBlank(migrationUuid, targetPath)) {
+            return null;
+        }
+
+        Path normalizedTargetPath = Path.of(targetPath).normalize();
+        String normalized = normalizedTargetPath.toString().replace('\\', '/');
+        String marker = String.format("/cloudstack-cbt/%s/", migrationUuid);
+        int markerIndex = normalized.indexOf(marker);
+        if (markerIndex < 0) {
+            logger.warn("Skipping VMware CBT cleanup target {} because it is not under {}", targetPath, marker);
+            return null;
+        }
+        String rootPath = normalized.substring(0, markerIndex + marker.length() - 1);
+        return Path.of(rootPath).normalize();
+    }
+
+    private boolean deleteMigrationDirectory(Path migrationDirectory) throws Exception {
+        if (!Files.isDirectory(migrationDirectory)) {
+            return false;
+        }
+        try (Stream<Path> stream = Files.walk(migrationDirectory)) {
+            for (Path path : stream.sorted(Comparator.reverseOrder()).collect(Collectors.toList())) {
+                Files.deleteIfExists(path);
+            }
+        }
+        return true;
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtCutoverCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtCutoverCommandWrapper.java
new file mode 100644
index 000000000000..b59aa1e0b1e6
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtCutoverCommandWrapper.java
@@ -0,0 +1,794 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.io.IOException;
+import java.net.ServerSocket;
+import java.nio.file.DirectoryNotEmptyException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.attribute.PosixFilePermission;
+import java.util.ArrayList;
+import java.util.Comparator;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Locale;
+import java.util.Set;
+import java.util.UUID;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.VmwareCbtCutoverCommand;
+import com.cloud.agent.api.VmwareCbtMigrationAnswer;
+import com.cloud.agent.api.to.VmwareCbtDiskSyncResultTO;
+import com.cloud.agent.api.to.VmwareCbtDiskTO;
+import com.cloud.agent.api.to.VmwareCbtTargetStorageType;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.storage.Storage;
+import com.cloud.utils.script.Script;
+
+@ResourceWrapper(handles = VmwareCbtCutoverCommand.class)
+public class LibvirtVmwareCbtCutoverCommandWrapper extends CommandWrapper<VmwareCbtCutoverCommand, Answer, LibvirtComputingResource> {
+
+    @Override
+    public Answer execute(VmwareCbtCutoverCommand cmd, LibvirtComputingResource serverResource) {
+        if (!serverResource.hostSupportsVddkBlockCopy(cmd.getVddkLibDir())) {
+            String msg = String.format("Cannot cut over VMware CBT migration %s on host %s. VDDK, qemu-img, qemu-nbd and qemu-io are required.",
+                    cmd.getMigrationUuid(), serverResource.getPrivateIp());
+            logger.info(msg);
+            return new VmwareCbtMigrationAnswer(cmd, false, msg, cmd.getMigrationUuid());
+        }
+
+        if (!cmd.getRunVirtV2vFinalization()) {
+            String msg = String.format("VMware CBT cutover finalization for migration %s was skipped by command policy.",
+                    cmd.getMigrationUuid());
+            logger.info(msg);
+            return new VmwareCbtMigrationAnswer(cmd, true, msg, cmd.getMigrationUuid(), cmd.getFinalCycleNumber(),
+                    0, 0, 0, true, getDiskResults(cmd.getDisks(), 0, msg));
+        }
+
+        long startTime = System.currentTimeMillis();
+        Path sourceXmlPath = null;
+        Path fallbackOutputDir = null;
+        Path fallbackStagingDir = null;
+        Path rbdNbdBridgeScriptPath = null;
+        boolean keepFallbackOutputDir = false;
+        boolean cutoverFinalizationCompleted = false;
+        try {
+            validateCutoverCommand(cmd);
+            KVMStoragePool targetPool = getTargetStoragePool(cmd, serverResource.getStoragePoolMgr());
+            if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RBD_RAW) {
+                validateRbdTargetPool(cmd, targetPool);
+            } else if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE) {
+                validateBlockDeviceTargetPool(cmd, targetPool);
+            }
+
+            VirtV2vFinalizationMode finalizationMode = getVirtV2vFinalizationMode(serverResource);
+            boolean inPlaceFinalization = finalizationMode.isInPlace();
+            if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RBD_RAW && !inPlaceFinalization) {
+                throw new IllegalArgumentException("RBD target finalization requires virt-v2v in-place support on the selected KVM host; non-in-place fallback finalization cannot write directly back to RBD targets.");
+            }
+            if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE && !inPlaceFinalization) {
+                throw new IllegalArgumentException("Block device target finalization requires virt-v2v in-place support on the selected KVM host; non-in-place fallback finalization cannot write directly back to block device targets.");
+            }
+            List<RbdNbdBridge> rbdNbdBridges = cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RBD_RAW ?
+                    createRbdNbdBridges(cmd, targetPool) : List.of();
+            sourceXmlPath = writeSourceXml(cmd, rbdNbdBridges, targetPool);
+
+            String command;
+            String logSuffix;
+            if (inPlaceFinalization) {
+                command = buildVirtV2vInPlaceCommand(sourceXmlPath, serverResource, finalizationMode);
+                if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RBD_RAW) {
+                    rbdNbdBridgeScriptPath = writeRbdNbdBridgeScript(cmd, rbdNbdBridges, command);
+                    command = String.format("bash %s", shellQuote(rbdNbdBridgeScriptPath.toString()));
+                }
+                logSuffix = String.format("%s finalization", finalizationMode.getDisplayName());
+            } else {
+                if (!cmd.getAllowNonInPlaceFinalization()) {
+                    throw new IllegalArgumentException("Selected KVM host cannot finalize VMware CBT migration in-place. Enable virt-v2v in-place support or explicitly allow non-in-place fallback finalization.");
+                }
+                validateFallbackCapacity(cmd);
+                fallbackOutputDir = getFallbackOutputDir(cmd);
+                fallbackStagingDir = getFallbackStagingDir(cmd);
+                command = buildVirtV2vFallbackCommand(sourceXmlPath, fallbackOutputDir, fallbackStagingDir, serverResource);
+                logSuffix = String.format("%s finalization", finalizationMode.getDisplayName());
+            }
+
+            VmwareCbtCommandResult commandResult = executeLoggedBash(command, getTimeout(cmd),
+                    String.format("(%s) VMware CBT %s", cmd.getMigrationUuid(), logSuffix));
+            long durationSeconds = Math.max(1L, (System.currentTimeMillis() - startTime) / 1000L);
+            if (commandResult.getExitValue() != 0) {
+                String msg = String.format("%s failed for VMware CBT migration %s with exit code %s.",
+                        finalizationMode.getDisplayName(), cmd.getMigrationUuid(), commandResult.getExitValue());
+                msg = commandResult.appendLastCommandOutput(msg);
+                logger.info(msg);
+                return new VmwareCbtMigrationAnswer(cmd, false, msg, cmd.getMigrationUuid(), cmd.getFinalCycleNumber(),
+                        0, 0, durationSeconds, false, null);
+            }
+
+            List<VmwareCbtDiskSyncResultTO> diskResults = inPlaceFinalization ?
+                    getDiskResults(cmd.getDisks(), durationSeconds,
+                            String.format("Final %s conversion completed", finalizationMode.getDisplayName())) :
+                    getFallbackDiskResults(cmd, fallbackOutputDir, durationSeconds);
+            diskResults = relocateFinalizedDiskResultsToStorageRoot(cmd.getMigrationUuid(), diskResults);
+            if (!inPlaceFinalization) {
+                deleteFallbackSourceDisks(cmd);
+                keepFallbackOutputDir = containsDiskResultUnderDirectory(diskResults, fallbackOutputDir);
+            }
+            cutoverFinalizationCompleted = true;
+            String msg = String.format("Final %s conversion completed for VMware CBT migration %s.",
+                    finalizationMode.getDisplayName(), cmd.getMigrationUuid());
+            logger.info(msg);
+            return new VmwareCbtMigrationAnswer(cmd, true, msg, cmd.getMigrationUuid(), cmd.getFinalCycleNumber(),
+                    0, 0, durationSeconds, true, diskResults);
+        } catch (IllegalArgumentException e) {
+            String msg = String.format("Cannot cut over VMware CBT migration %s: %s",
+                    cmd.getMigrationUuid(), StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()));
+            logger.info(msg);
+            return new VmwareCbtMigrationAnswer(cmd, false, msg, cmd.getMigrationUuid(), cmd.getFinalCycleNumber(),
+                    0, 0, Math.max(1L, (System.currentTimeMillis() - startTime) / 1000L), false, null);
+        } catch (Exception e) {
+            String msg = String.format("Cannot cut over VMware CBT migration %s: %s",
+                    cmd.getMigrationUuid(), StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()));
+            logger.error(msg, e);
+            return new VmwareCbtMigrationAnswer(cmd, false, msg, cmd.getMigrationUuid(), cmd.getFinalCycleNumber(),
+                    0, 0, Math.max(1L, (System.currentTimeMillis() - startTime) / 1000L), false, null);
+        } finally {
+            deleteTempFile(sourceXmlPath);
+            deleteTempFile(rbdNbdBridgeScriptPath);
+            deleteTempTree(fallbackStagingDir);
+            if (!keepFallbackOutputDir) {
+                deleteTempTree(fallbackOutputDir);
+            }
+            if (cutoverFinalizationCompleted) {
+                deleteEmptyCbtMigrationDirectories(cmd);
+            }
+        }
+    }
+
+    protected VirtV2vFinalizationMode getVirtV2vFinalizationMode(LibvirtComputingResource serverResource) {
+        if (serverResource.hostSupportsVirtV2vInPlaceBinary()) {
+            return VirtV2vFinalizationMode.VIRT_V2V_IN_PLACE_BINARY;
+        }
+        if (serverResource.hostSupportsVirtV2vInPlaceOption()) {
+            return VirtV2vFinalizationMode.VIRT_V2V_IN_PLACE_OPTION;
+        }
+        return VirtV2vFinalizationMode.VIRT_V2V_FALLBACK;
+    }
+
+    private void validateCutoverCommand(VmwareCbtCutoverCommand cmd) {
+        if (StringUtils.isBlank(cmd.getMigrationUuid())) {
+            throw new IllegalArgumentException("migration UUID is missing");
+        }
+        if (CollectionUtils.isEmpty(cmd.getDisks())) {
+            throw new IllegalArgumentException("no target disks were provided for final conversion");
+        }
+
+        for (VmwareCbtDiskTO disk : cmd.getDisks()) {
+            validateDisk(cmd, disk);
+        }
+    }
+
+    private void validateDisk(VmwareCbtCutoverCommand cmd, VmwareCbtDiskTO disk) {
+        if (disk == null) {
+            throw new IllegalArgumentException("target disk cannot be null");
+        }
+        if (StringUtils.isBlank(disk.getDiskId())) {
+            throw new IllegalArgumentException("target disk ID is missing");
+        }
+        if (StringUtils.isBlank(disk.getTargetPath())) {
+            throw new IllegalArgumentException(String.format("target path is missing for disk %s", disk.getDiskId()));
+        }
+        if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RBD_RAW ||
+                cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE) {
+            String targetFormat = StringUtils.defaultIfBlank(disk.getTargetFormat(), "raw").toLowerCase(Locale.ROOT);
+            if (!StringUtils.equals(targetFormat, "raw")) {
+                throw new IllegalArgumentException(String.format("target disk %s uses unsupported finalization format %s; only raw targets are supported for %s finalization",
+                        disk.getDiskId(), targetFormat, cmd.getTargetStorageType()));
+            }
+            return;
+        }
+        if (!Files.isRegularFile(Path.of(disk.getTargetPath()))) {
+            throw new IllegalArgumentException(String.format("target disk %s does not exist at %s",
+                    disk.getDiskId(), disk.getTargetPath()));
+        }
+        String targetFormat = StringUtils.defaultIfBlank(disk.getTargetFormat(), "qcow2").toLowerCase(Locale.ROOT);
+        if (!StringUtils.equals(targetFormat, "qcow2")) {
+            throw new IllegalArgumentException(String.format("target disk %s uses unsupported finalization format %s; only qcow2 file targets are currently supported",
+                    disk.getDiskId(), targetFormat));
+        }
+    }
+
+    private Path writeSourceXml(VmwareCbtCutoverCommand cmd, List<RbdNbdBridge> rbdNbdBridges, KVMStoragePool targetPool) throws Exception {
+        Path sourceXmlPath = Files.createTempFile(String.format("vmware-cbt-%s-v2v-in-place-source-",
+                sanitizeFileName(cmd.getMigrationUuid())), ".xml");
+        Files.writeString(sourceXmlPath, buildSourceXml(cmd, rbdNbdBridges, targetPool));
+        return sourceXmlPath;
+    }
+
+    private String buildSourceXml(VmwareCbtCutoverCommand cmd, List<RbdNbdBridge> rbdNbdBridges, KVMStoragePool targetPool) {
+        StringBuilder xml = new StringBuilder();
+        xml.append("<domain type='kvm'>\n");
+        xml.append("  <name>").append(escapeXml(StringUtils.defaultIfBlank(cmd.getMigrationUuid(), "vmware-cbt-migration"))).append("</name>\n");
+        xml.append("  <memory unit='KiB'>1048576</memory>\n");
+        xml.append("  <vcpu>1</vcpu>\n");
+        xml.append("  <os>\n");
+        xml.append("    <type>hvm</type>\n");
+        xml.append("    <boot dev='hd'/>\n");
+        xml.append("  </os>\n");
+        xml.append("  <features>\n");
+        xml.append("    <acpi/>\n");
+        xml.append("    <apic/>\n");
+        xml.append("  </features>\n");
+        xml.append("  <devices>\n");
+        for (int index = 0; index < cmd.getDisks().size(); index++) {
+            VmwareCbtDiskTO disk = cmd.getDisks().get(index);
+            if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RBD_RAW) {
+                appendRbdNbdDiskXml(xml, disk, rbdNbdBridges.get(index), index);
+            } else if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE) {
+                appendBlockDeviceDiskXml(xml, disk, targetPool, index);
+            } else {
+                xml.append("    <disk type='file' device='disk'>\n");
+                xml.append("      <driver name='qemu' type='qcow2'/>\n");
+                xml.append("      <source file='").append(escapeXml(disk.getTargetPath())).append("'/>\n");
+                xml.append("      <target dev='").append(getDiskDeviceName(index)).append("' bus='scsi'/>\n");
+                xml.append("    </disk>\n");
+            }
+        }
+        xml.append("  </devices>\n");
+        xml.append("</domain>\n");
+        return xml.toString();
+    }
+
+    private void appendRbdNbdDiskXml(StringBuilder xml, VmwareCbtDiskTO disk, RbdNbdBridge rbdNbdBridge, int index) {
+        xml.append("    <disk type='network' device='disk'>\n");
+        xml.append("      <driver name='qemu' type='raw'/>\n");
+        xml.append("      <source protocol='nbd'>\n");
+        xml.append("        <host name='localhost' port='").append(rbdNbdBridge.port).append("'/>\n");
+        xml.append("      </source>\n");
+        xml.append("      <target dev='").append(getDiskDeviceName(index)).append("' bus='scsi'/>\n");
+        xml.append("    </disk>\n");
+        logger.info("Prepared temporary localhost NBD bridge on port {} for VMware CBT RBD target disk {}",
+                rbdNbdBridge.port, disk.getDiskId());
+    }
+
+    private void appendBlockDeviceDiskXml(StringBuilder xml, VmwareCbtDiskTO disk, KVMStoragePool targetPool, int index) {
+        String devicePath = getBlockDevicePath(targetPool, disk);
+        xml.append("    <disk type='block' device='disk'>\n");
+        xml.append("      <driver name='qemu' type='raw'/>\n");
+        xml.append("      <source dev='").append(escapeXml(devicePath)).append("'/>\n");
+        xml.append("      <target dev='").append(getDiskDeviceName(index)).append("' bus='scsi'/>\n");
+        xml.append("    </disk>\n");
+        logger.info("Prepared block device {} for VMware CBT target disk {} finalization", devicePath, disk.getDiskId());
+    }
+
+    private String getBlockDevicePath(KVMStoragePool targetPool, VmwareCbtDiskTO disk) {
+        String normalizedTargetPath = StringUtils.defaultString(disk.getTargetPath()).replace('\\', '/');
+        String volumeName = StringUtils.contains(normalizedTargetPath, "/") ?
+                StringUtils.substringAfterLast(normalizedTargetPath, "/") : normalizedTargetPath;
+        com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk targetDisk = targetPool.getPhysicalDisk(volumeName);
+        String devicePath = targetDisk == null ? null : targetDisk.getPath();
+        if (StringUtils.isBlank(devicePath)) {
+            throw new IllegalStateException(String.format("could not resolve a local device path for block device target volume %s of disk %s",
+                    volumeName, disk.getDiskId()));
+        }
+        return devicePath;
+    }
+
+    private void validateBlockDeviceTargetPool(VmwareCbtCutoverCommand cmd, KVMStoragePool targetPool) {
+        if (targetPool == null || targetPool.getType() != Storage.StoragePoolType.Linstor) {
+            throw new IllegalArgumentException(String.format("VMware CBT migration %s requires a Linstor destination storage pool for block device target finalization",
+                    cmd.getMigrationUuid()));
+        }
+    }
+
+    private List<RbdNbdBridge> createRbdNbdBridges(VmwareCbtCutoverCommand cmd, KVMStoragePool targetPool) throws Exception {
+        List<RbdNbdBridge> bridges = new ArrayList<>();
+        // Every probe socket is held open until all ports have been chosen. Probing and closing
+        // one port at a time lets the kernel hand the same ephemeral port to the next probe,
+        // which would point two disks' bridges at a single port and silently corrupt one of them.
+        List<ServerSocket> portProbes = new ArrayList<>();
+        try {
+            for (VmwareCbtDiskTO disk : cmd.getDisks()) {
+                ServerSocket probe = new ServerSocket(0);
+                portProbes.add(probe);
+                int port = probe.getLocalPort();
+                Path pidFile = Files.createTempFile(String.format("vmware-cbt-%s-qemu-nbd-",
+                        sanitizeFileName(cmd.getMigrationUuid())), ".pid");
+                Files.deleteIfExists(pidFile);
+                String qemuRbdPath = KVMPhysicalDisk.RBDStringBuilder(targetPool, getRbdImagePath(targetPool, disk.getTargetPath()));
+                bridges.add(new RbdNbdBridge(port, pidFile, qemuRbdPath));
+            }
+        } finally {
+            // Released only now, right before the ports are written into the bridge script:
+            // qemu-nbd cannot bind a port this process still holds.
+            for (ServerSocket probe : portProbes) {
+                try {
+                    probe.close();
+                } catch (IOException e) {
+                    logger.debug("Failed to release probe socket for port {}: {}", probe.getLocalPort(), e.getMessage());
+                }
+            }
+        }
+        return bridges;
+    }
+
+    private Path writeRbdNbdBridgeScript(VmwareCbtCutoverCommand cmd, List<RbdNbdBridge> rbdNbdBridges,
+                                         String virtV2vCommand) throws Exception {
+        Path scriptPath = Files.createTempFile(String.format("vmware-cbt-%s-rbd-finalize-",
+                sanitizeFileName(cmd.getMigrationUuid())), ".sh");
+        StringBuilder script = new StringBuilder();
+        script.append("#!/bin/bash\n");
+        script.append("set -euo pipefail\n");
+        script.append("cleanup() {\n");
+        script.append("  set +e\n");
+        script.append("  for pid_file in");
+        for (RbdNbdBridge bridge : rbdNbdBridges) {
+            script.append(" ").append(shellQuote(bridge.pidFile.toString()));
+        }
+        script.append("; do\n");
+        script.append("    if [[ -s \"$pid_file\" ]]; then\n");
+        script.append("      pid=$(cat \"$pid_file\")\n");
+        script.append("      kill \"$pid\" >/dev/null 2>&1 || true\n");
+        script.append("      for attempt in {1..20}; do\n");
+        script.append("        kill -0 \"$pid\" >/dev/null 2>&1 || break\n");
+        script.append("        sleep 0.1\n");
+        script.append("      done\n");
+        script.append("    fi\n");
+        script.append("    rm -f \"$pid_file\"\n");
+        script.append("  done\n");
+        script.append("}\n");
+        script.append("trap cleanup EXIT\n");
+        for (RbdNbdBridge bridge : rbdNbdBridges) {
+            script.append("qemu-nbd --fork --persistent --shared=1 --format=raw --bind=127.0.0.1 --port=")
+                    .append(bridge.port)
+                    .append(" --pid-file=").append(shellQuote(bridge.pidFile.toString()))
+                    .append(" ").append(shellQuote(bridge.qemuRbdPath)).append("\n");
+        }
+        script.append(virtV2vCommand).append("\n");
+        Files.writeString(scriptPath, script.toString());
+        setPosixFilePermissionsIfSupported(scriptPath, Set.of(PosixFilePermission.OWNER_READ,
+                PosixFilePermission.OWNER_WRITE, PosixFilePermission.OWNER_EXECUTE));
+        return scriptPath;
+    }
+
+    private void setPosixFilePermissionsIfSupported(Path path, Set<PosixFilePermission> permissions) throws Exception {
+        try {
+            Files.setPosixFilePermissions(path, permissions);
+        } catch (UnsupportedOperationException e) {
+            logger.debug("POSIX file permissions are not supported for {}", path);
+        }
+    }
+
+    private static class RbdNbdBridge {
+        private final int port;
+        private final Path pidFile;
+        private final String qemuRbdPath;
+
+        private RbdNbdBridge(int port, Path pidFile, String qemuRbdPath) {
+            this.port = port;
+            this.pidFile = pidFile;
+            this.qemuRbdPath = qemuRbdPath;
+        }
+    }
+
+    private KVMStoragePool getTargetStoragePool(VmwareCbtCutoverCommand cmd, KVMStoragePoolManager storagePoolMgr) {
+        Storage.StoragePoolType poolType = cmd.getDestinationStoragePoolType();
+        String poolUuid = StringUtils.trimToNull(cmd.getDestinationStoragePoolUuid());
+        if (poolType != null && StringUtils.isNotBlank(poolUuid)) {
+            KVMStoragePool pool = storagePoolMgr.getStoragePool(poolType, poolUuid);
+            if (pool == null) {
+                throw new IllegalArgumentException(String.format("destination storage pool %s/%s is not available on this host",
+                        poolType, poolUuid));
+            }
+            return pool;
+        }
+        return null;
+    }
+
+    private void validateRbdTargetPool(VmwareCbtCutoverCommand cmd, KVMStoragePool targetPool) {
+        if (targetPool == null || targetPool.getType() != Storage.StoragePoolType.RBD) {
+            throw new IllegalArgumentException(String.format("VMware CBT migration %s requires an RBD destination storage pool for RBD target finalization",
+                    cmd.getMigrationUuid()));
+        }
+    }
+
+    private String getRbdImagePath(KVMStoragePool targetPool, String targetPath) {
+        String normalizedTargetPath = StringUtils.defaultString(targetPath).replace('\\', '/');
+        String imageName = StringUtils.contains(normalizedTargetPath, "/") ? StringUtils.substringAfterLast(normalizedTargetPath, "/") : normalizedTargetPath;
+        return String.format("%s/%s", StringUtils.removeEnd(targetPool.getSourceDir(), "/"), imageName);
+    }
+
+    private String getDiskDeviceName(int index) {
+        StringBuilder suffix = new StringBuilder();
+        int value = index;
+        do {
+            suffix.insert(0, (char)('a' + (value % 26)));
+            value = (value / 26) - 1;
+        } while (value >= 0);
+        return "sd" + suffix;
+    }
+
+    private String buildVirtV2vInPlaceCommand(Path sourceXmlPath, LibvirtComputingResource serverResource,
+                                              VirtV2vFinalizationMode finalizationMode) {
+        StringBuilder command = new StringBuilder();
+        appendLibguestfsBackend(command, serverResource);
+        if (finalizationMode == VirtV2vFinalizationMode.VIRT_V2V_IN_PLACE_OPTION) {
+            command.append("virt-v2v --root first -i libvirtxml ");
+            command.append(shellQuote(sourceXmlPath.toString())).append(" ");
+            command.append("--in-place -v");
+        } else {
+            // Resolve the binary through the server resource: EL9-family distributions
+            // install virt-v2v-in-place in /usr/libexec, outside $PATH.
+            String inPlaceBinary = StringUtils.defaultIfBlank(serverResource.getVirtV2vInPlaceBinary(), "virt-v2v-in-place");
+            // No -O (write updated output XML): nothing consumes it and the option only
+            // exists from virt-v2v 2.5 on, so passing it breaks otherwise capable hosts
+            // such as Ubuntu 24.04 with virt-v2v-in-place 2.4.
+            command.append(inPlaceBinary).append(" --root first -i libvirtxml ");
+            command.append(shellQuote(sourceXmlPath.toString())).append(" ");
+            command.append("-v");
+        }
+        return command.toString();
+    }
+
+    private String buildVirtV2vFallbackCommand(Path sourceXmlPath, Path outputDir, Path stagingDir,
+                                               LibvirtComputingResource serverResource) {
+        StringBuilder command = new StringBuilder();
+        appendLibguestfsBackend(command, serverResource);
+        command.append("export TMPDIR=").append(shellQuote(stagingDir.toString())).append(" && ");
+        command.append("virt-v2v --root first -i libvirtxml ");
+        command.append(shellQuote(sourceXmlPath.toString())).append(" ");
+        command.append("-o local -os ").append(shellQuote(outputDir.toString())).append(" ");
+        command.append("-of qcow2 -v");
+        return command.toString();
+    }
+
+    private void appendLibguestfsBackend(StringBuilder command, LibvirtComputingResource serverResource) {
+        String libguestfsBackend = StringUtils.trimToNull(serverResource.getLibguestfsBackend());
+        if (StringUtils.isNotBlank(libguestfsBackend)) {
+            command.append("export LIBGUESTFS_BACKEND=").append(shellQuote(libguestfsBackend)).append(" && ");
+        }
+    }
+
+    private void validateFallbackCapacity(VmwareCbtCutoverCommand cmd) throws Exception {
+        Path targetBasePath = getTargetBasePath(cmd);
+        long requiredBytes = saturatingMultiply(sumDiskCapacityBytes(cmd), 2L);
+        long availableBytes = Files.getFileStore(targetBasePath).getUsableSpace();
+        if (availableBytes < requiredBytes) {
+            throw new IllegalArgumentException(String.format("Non-in-place fallback finalization requires additional free space on target primary storage. Required: %s bytes, available: %s bytes.",
+                    requiredBytes, availableBytes));
+        }
+    }
+
+    private long sumDiskCapacityBytes(VmwareCbtCutoverCommand cmd) throws Exception {
+        long total = 0L;
+        for (VmwareCbtDiskTO disk : cmd.getDisks()) {
+            long capacity = disk.getCapacityBytes();
+            if (capacity <= 0) {
+                capacity = Files.size(Path.of(disk.getTargetPath()));
+            }
+            total = saturatingAdd(total, capacity);
+        }
+        return total;
+    }
+
+    private long saturatingAdd(long left, long right) {
+        if (Long.MAX_VALUE - left < right) {
+            return Long.MAX_VALUE;
+        }
+        return left + right;
+    }
+
+    private long saturatingMultiply(long value, long multiplier) {
+        if (value > 0 && multiplier > Long.MAX_VALUE / value) {
+            return Long.MAX_VALUE;
+        }
+        return value * multiplier;
+    }
+
+    private Path getFallbackOutputDir(VmwareCbtCutoverCommand cmd) throws Exception {
+        Path targetBasePath = getTargetBasePath(cmd);
+        Path outputDir = Files.createTempDirectory(targetBasePath, "virt-v2v-output-").normalize();
+        if (!outputDir.startsWith(targetBasePath)) {
+            throw new IllegalArgumentException(String.format("resolved fallback output path %s is outside %s",
+                    outputDir, targetBasePath));
+        }
+        return outputDir;
+    }
+
+    private Path getFallbackStagingDir(VmwareCbtCutoverCommand cmd) throws Exception {
+        Path targetBasePath = getTargetBasePath(cmd);
+        Path stagingDir = Files.createTempDirectory(targetBasePath, "virt-v2v-tmp-").normalize();
+        if (!stagingDir.startsWith(targetBasePath)) {
+            throw new IllegalArgumentException(String.format("resolved fallback staging path %s is outside %s",
+                    stagingDir, targetBasePath));
+        }
+        return stagingDir;
+    }
+
+    private Path getTargetBasePath(VmwareCbtCutoverCommand cmd) {
+        Path firstDiskPath = Path.of(cmd.getDisks().get(0).getTargetPath()).normalize();
+        Path targetBasePath = firstDiskPath.getParent();
+        if (targetBasePath == null) {
+            throw new IllegalArgumentException("unable to determine VMware CBT target disk directory");
+        }
+        return targetBasePath;
+    }
+
+    private List<VmwareCbtDiskSyncResultTO> getFallbackDiskResults(VmwareCbtCutoverCommand cmd, Path fallbackOutputDir,
+                                                                   long durationSeconds) throws Exception {
+        List<Path> outputFiles;
+        try (Stream<Path> stream = Files.list(fallbackOutputDir)) {
+            outputFiles = stream
+                    .filter(Files::isRegularFile)
+                    .filter(path -> !StringUtils.endsWithIgnoreCase(path.getFileName().toString(), ".xml"))
+                    .sorted(Comparator.comparing(path -> path.getFileName().toString()))
+                    .collect(Collectors.toList());
+        }
+        if (outputFiles.size() < cmd.getDisks().size()) {
+            throw new IllegalArgumentException(String.format("virt-v2v fallback produced %s disk file(s), expected at least %s",
+                    outputFiles.size(), cmd.getDisks().size()));
+        }
+        List<VmwareCbtDiskSyncResultTO> results = new ArrayList<>();
+        for (int index = 0; index < cmd.getDisks().size(); index++) {
+            VmwareCbtDiskTO disk = cmd.getDisks().get(index);
+            results.add(new VmwareCbtDiskSyncResultTO(disk.getDiskId(), outputFiles.get(index).toString(),
+                    disk.getChangeId(), disk.getSnapshotMor(), 0, durationSeconds, true,
+                    "Final virt-v2v fallback conversion completed"));
+        }
+        return results;
+    }
+
+    protected List<VmwareCbtDiskSyncResultTO> relocateFinalizedDiskResultsToStorageRoot(String migrationUuid,
+                                                                                       List<VmwareCbtDiskSyncResultTO> diskResults) throws Exception {
+        if (CollectionUtils.isEmpty(diskResults)) {
+            return diskResults;
+        }
+
+        List<VmwareCbtDiskSyncResultTO> relocatedResults = new ArrayList<>();
+        Set<Path> usedDestinations = new HashSet<>();
+        List<FinalizedDiskMove> completedMoves = new ArrayList<>();
+        try {
+            for (VmwareCbtDiskSyncResultTO diskResult : diskResults) {
+                if (diskResult == null || !diskResult.getResult() || StringUtils.isBlank(diskResult.getTargetPath())) {
+                    relocatedResults.add(diskResult);
+                    continue;
+                }
+
+                Path sourcePath = Path.of(diskResult.getTargetPath()).normalize();
+                Path storageRoot = getStorageRootForCbtPath(migrationUuid, sourcePath);
+                if (storageRoot == null) {
+                    relocatedResults.add(diskResult);
+                    continue;
+                }
+
+                Path destinationPath = getAvailableRootDiskPath(storageRoot, usedDestinations);
+                logger.info("Relocating finalized VMware CBT disk {} to primary storage root {}", sourcePath, destinationPath);
+                Files.move(sourcePath, destinationPath);
+                completedMoves.add(new FinalizedDiskMove(sourcePath, destinationPath));
+                relocatedResults.add(new VmwareCbtDiskSyncResultTO(diskResult.getDiskId(), destinationPath.toString(),
+                        diskResult.getChangeId(), diskResult.getSnapshotMor(), diskResult.getChangedBytes(),
+                        diskResult.getDurationSeconds(), diskResult.getResult(), diskResult.getDetails()));
+            }
+        } catch (Exception e) {
+            rollbackFinalizedDiskMoves(completedMoves);
+            throw e;
+        }
+        return relocatedResults;
+    }
+
+    private Path getStorageRootForCbtPath(String migrationUuid, Path targetPath) {
+        if (StringUtils.isBlank(migrationUuid) || targetPath == null) {
+            return null;
+        }
+        String normalizedPath = targetPath.normalize().toString().replace('\\', '/');
+        String marker = String.format("/cloudstack-cbt/%s/", migrationUuid);
+        int markerIndex = normalizedPath.indexOf(marker);
+        if (markerIndex < 0) {
+            return null;
+        }
+        String storageRoot = StringUtils.trimToNull(normalizedPath.substring(0, markerIndex));
+        return storageRoot == null ? null : Path.of(storageRoot).normalize();
+    }
+
+    private Path getAvailableRootDiskPath(Path storageRoot, Set<Path> usedDestinations) {
+        while (true) {
+            Path candidate = storageRoot.resolve(UUID.randomUUID().toString()).normalize();
+            if (!Files.exists(candidate) && usedDestinations.add(candidate)) {
+                return candidate;
+            }
+        }
+    }
+
+    private boolean containsDiskResultUnderDirectory(List<VmwareCbtDiskSyncResultTO> diskResults, Path directory) {
+        if (CollectionUtils.isEmpty(diskResults) || directory == null) {
+            return false;
+        }
+        Path normalizedDirectory = directory.normalize();
+        for (VmwareCbtDiskSyncResultTO diskResult : diskResults) {
+            if (diskResult != null && StringUtils.isNotBlank(diskResult.getTargetPath()) &&
+                    Path.of(diskResult.getTargetPath()).normalize().startsWith(normalizedDirectory)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private void rollbackFinalizedDiskMoves(List<FinalizedDiskMove> completedMoves) {
+        if (CollectionUtils.isEmpty(completedMoves)) {
+            return;
+        }
+        for (int index = completedMoves.size() - 1; index >= 0; index--) {
+            FinalizedDiskMove move = completedMoves.get(index);
+            try {
+                if (Files.exists(move.destinationPath) && !Files.exists(move.sourcePath)) {
+                    Files.move(move.destinationPath, move.sourcePath);
+                }
+            } catch (Exception rollbackException) {
+                logger.warn("Failed to roll back finalized VMware CBT disk relocation from {} to {}",
+                        move.destinationPath, move.sourcePath, rollbackException);
+            }
+        }
+    }
+
+    private static class FinalizedDiskMove {
+        private final Path sourcePath;
+        private final Path destinationPath;
+
+        private FinalizedDiskMove(Path sourcePath, Path destinationPath) {
+            this.sourcePath = sourcePath;
+            this.destinationPath = destinationPath;
+        }
+    }
+
+    private void deleteFallbackSourceDisks(VmwareCbtCutoverCommand cmd) {
+        for (VmwareCbtDiskTO disk : cmd.getDisks()) {
+            deleteTempFile(Path.of(disk.getTargetPath()));
+        }
+    }
+
+    private void deleteEmptyCbtMigrationDirectories(VmwareCbtCutoverCommand cmd) {
+        Set<Path> migrationDirectories = new HashSet<>();
+        for (VmwareCbtDiskTO disk : cmd.getDisks()) {
+            Path sourcePath = Path.of(disk.getTargetPath()).normalize();
+            Path storageRoot = getStorageRootForCbtPath(cmd.getMigrationUuid(), sourcePath);
+            if (storageRoot == null) {
+                continue;
+            }
+            Path migrationDirectory = storageRoot.resolve("cloudstack-cbt").resolve(cmd.getMigrationUuid()).normalize();
+            if (sourcePath.startsWith(migrationDirectory)) {
+                migrationDirectories.add(migrationDirectory);
+            }
+        }
+
+        for (Path migrationDirectory : migrationDirectories) {
+            if (!Files.isDirectory(migrationDirectory) || Files.isSymbolicLink(migrationDirectory)) {
+                continue;
+            }
+            try {
+                Files.deleteIfExists(migrationDirectory);
+            } catch (DirectoryNotEmptyException e) {
+                logger.warn("Preserving non-empty VMware CBT migration directory {} after successful cutover",
+                        migrationDirectory);
+            } catch (Exception e) {
+                logger.warn("Unable to remove VMware CBT migration directory {} after successful cutover: {}",
+                        migrationDirectory, e.getMessage());
+            }
+        }
+    }
+
+    protected VmwareCbtCommandResult executeLoggedBash(String command, long timeout, String logPrefix) {
+        Script script = new Script("/bin/bash", timeout, logger);
+        script.add("-c");
+        script.add(command);
+        VmwareCbtCommandOutputLogger outputLogger = new VmwareCbtCommandOutputLogger(logger, logPrefix);
+        script.execute(outputLogger);
+        return new VmwareCbtCommandResult(script.getExitValue(), outputLogger.getLastRelevantOutputLine());
+    }
+
+    private long getTimeout(VmwareCbtCutoverCommand cmd) {
+        return Math.max(1L, cmd.getWait()) * 1000L;
+    }
+
+    private List<VmwareCbtDiskSyncResultTO> getDiskResults(List<VmwareCbtDiskTO> disks, long durationSeconds,
+                                                           String details) {
+        List<VmwareCbtDiskSyncResultTO> results = new ArrayList<>();
+        if (CollectionUtils.isEmpty(disks)) {
+            return results;
+        }
+        for (VmwareCbtDiskTO disk : disks) {
+            results.add(new VmwareCbtDiskSyncResultTO(disk.getDiskId(), disk.getTargetPath(),
+                    disk.getChangeId(), disk.getSnapshotMor(), 0, durationSeconds, true, details));
+        }
+        return results;
+    }
+
+    private void deleteTempFile(Path path) {
+        if (path == null) {
+            return;
+        }
+        try {
+            Files.deleteIfExists(path);
+        } catch (Exception e) {
+            logger.debug("Unable to delete temporary VMware CBT cutover file {}: {}", path, e.getMessage());
+        }
+    }
+
+    private void deleteTempTree(Path path) {
+        if (path == null || !Files.exists(path)) {
+            return;
+        }
+        try (Stream<Path> stream = Files.walk(path)) {
+            List<Path> paths = stream.sorted(Comparator.reverseOrder()).collect(Collectors.toList());
+            for (Path entry : paths) {
+                Files.deleteIfExists(entry);
+            }
+        } catch (Exception e) {
+            logger.debug("Unable to delete temporary VMware CBT cutover directory {}: {}", path, e.getMessage());
+        }
+    }
+
+    private String shellQuote(String value) {
+        return "'" + StringUtils.defaultString(value).replace("'", "'\"'\"'") + "'";
+    }
+
+    private String escapeXml(String value) {
+        return StringUtils.defaultString(value)
+                .replace("&", "&amp;")
+                .replace("<", "&lt;")
+                .replace(">", "&gt;")
+                .replace("\"", "&quot;")
+                .replace("'", "&apos;");
+    }
+
+    private String sanitizeFileName(String value) {
+        String sanitized = StringUtils.defaultIfBlank(value, "migration").replaceAll("[^A-Za-z0-9._-]", "-");
+        return StringUtils.defaultIfBlank(sanitized, "migration");
+    }
+
+    protected enum VirtV2vFinalizationMode {
+        VIRT_V2V_IN_PLACE_BINARY("virt-v2v-in-place", true),
+        VIRT_V2V_IN_PLACE_OPTION("virt-v2v --in-place", true),
+        VIRT_V2V_FALLBACK("virt-v2v fallback", false);
+
+        private final String displayName;
+        private final boolean inPlace;
+
+        VirtV2vFinalizationMode(String displayName, boolean inPlace) {
+            this.displayName = displayName;
+            this.inPlace = inPlace;
+        }
+
+        public String getDisplayName() {
+            return displayName;
+        }
+
+        public boolean isInPlace() {
+            return inPlace;
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtPrepareCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtPrepareCommandWrapper.java
new file mode 100644
index 000000000000..1386c18ff443
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtPrepareCommandWrapper.java
@@ -0,0 +1,506 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.attribute.PosixFilePermission;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Locale;
+import java.util.Set;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.VmwareCbtMigrationAnswer;
+import com.cloud.agent.api.VmwareCbtPrepareCommand;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.agent.api.to.RemoteInstanceTO;
+import com.cloud.agent.api.to.VmwareCbtDiskSyncResultTO;
+import com.cloud.agent.api.to.VmwareCbtDiskTO;
+import com.cloud.agent.api.to.VmwareCbtTargetStorageType;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.storage.Storage;
+import com.cloud.utils.script.OutputInterpreter;
+import com.cloud.utils.script.Script;
+import org.apache.cloudstack.utils.qemu.QemuImg;
+
+@ResourceWrapper(handles = VmwareCbtPrepareCommand.class)
+public class LibvirtVmwareCbtPrepareCommandWrapper extends CommandWrapper<VmwareCbtPrepareCommand, Answer, LibvirtComputingResource> {
+
+    private static final String DEFAULT_CBT_DISK_BASE_PATH = "/var/lib/libvirt/images/cloudstack-cbt";
+    private static final Pattern SHA1_FINGERPRINT_PATTERN = Pattern.compile("(?i)(?:SHA1\\s+)?Fingerprint\\s*=\\s*([0-9A-F:]+)");
+
+    @Override
+    public Answer execute(VmwareCbtPrepareCommand cmd, LibvirtComputingResource serverResource) {
+        if (!serverResource.hostSupportsVddkBlockCopy(cmd.getVddkLibDir())) {
+            String msg = String.format("Cannot prepare VMware CBT migration %s on host %s. VDDK, qemu-img, qemu-nbd and qemu-io are required.",
+                    cmd.getMigrationUuid(), serverResource.getPrivateIp());
+            logger.info(msg);
+            return new VmwareCbtMigrationAnswer(cmd, false, msg, cmd.getMigrationUuid());
+        }
+
+        try {
+            validatePrepareCommand(cmd);
+            String vddkLibDir = resolveVddkSetting(cmd.getVddkLibDir(), serverResource.getVddkLibDir());
+            if (StringUtils.isBlank(vddkLibDir)) {
+                String msg = String.format("Cannot prepare VMware CBT migration %s because no VDDK library directory is configured or detected.",
+                        cmd.getMigrationUuid());
+                logger.info(msg);
+                return new VmwareCbtMigrationAnswer(cmd, false, msg, cmd.getMigrationUuid());
+            }
+
+            RemoteInstanceTO sourceInstance = cmd.getSourceInstance();
+            String vddkThumbprint = resolveVddkSetting(cmd.getVddkThumbprint(), serverResource.getVddkThumbprint());
+            if (StringUtils.isBlank(vddkThumbprint)) {
+                vddkThumbprint = getVcenterThumbprint(sourceInstance.getVcenterHost(), getTimeout(cmd), sourceInstance.getInstanceName());
+            }
+            if (StringUtils.isBlank(vddkThumbprint)) {
+                String msg = String.format("Cannot prepare VMware CBT migration %s because the vCenter SSL thumbprint could not be determined.",
+                        cmd.getMigrationUuid());
+                logger.info(msg);
+                return new VmwareCbtMigrationAnswer(cmd, false, msg, cmd.getMigrationUuid());
+            }
+
+            KVMStoragePool targetPool = getTargetStoragePool(cmd, serverResource.getStoragePoolMgr());
+            Path targetBasePath = null;
+            if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RBD_RAW) {
+                validateRbdTargetPool(cmd, targetPool);
+            } else if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE) {
+                validateBlockDeviceTargetPool(cmd, targetPool);
+            } else {
+                targetBasePath = getTargetBasePath(cmd, targetPool);
+                Files.createDirectories(targetBasePath);
+            }
+
+            String passwordFilePath = writePasswordFile(cmd);
+            try {
+                List<VmwareCbtDiskSyncResultTO> diskResults = new ArrayList<>();
+                long startTime = System.currentTimeMillis();
+                for (VmwareCbtDiskTO disk : cmd.getDisks()) {
+                    diskResults.add(copyDiskFromVmwareSnapshot(cmd, disk, targetPool, targetBasePath, passwordFilePath,
+                            vddkLibDir, vddkThumbprint, serverResource));
+                }
+                long durationSeconds = Math.max(1L, (System.currentTimeMillis() - startTime) / 1000L);
+                String msg = String.format("Initial VDDK full sync for VMware CBT migration %s completed for %s disk(s).",
+                        cmd.getMigrationUuid(), diskResults.size());
+                logger.info(msg);
+                return new VmwareCbtMigrationAnswer(cmd, true, msg, cmd.getMigrationUuid(), 0,
+                        0, 0, durationSeconds, false, diskResults);
+            } finally {
+                Files.deleteIfExists(Path.of(passwordFilePath));
+            }
+        } catch (Exception e) {
+            String msg = String.format("Cannot prepare VMware CBT migration %s: %s",
+                    cmd.getMigrationUuid(), StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()));
+            logger.error(msg, e);
+            return new VmwareCbtMigrationAnswer(cmd, false, msg, cmd.getMigrationUuid());
+        }
+    }
+
+    private void validatePrepareCommand(VmwareCbtPrepareCommand cmd) {
+        RemoteInstanceTO sourceInstance = cmd.getSourceInstance();
+        if (sourceInstance == null) {
+            throw new IllegalArgumentException("source VMware instance information is missing");
+        }
+        if (StringUtils.isAnyBlank(sourceInstance.getVcenterHost(), sourceInstance.getVcenterUsername(),
+                sourceInstance.getVcenterPassword(), sourceInstance.getInstanceName())) {
+            throw new IllegalArgumentException("source vCenter host, username, password and VM name are required");
+        }
+        if (StringUtils.isBlank(sourceInstance.getVmwareMoref())) {
+            throw new IllegalArgumentException("source VMware VM managed object reference is missing");
+        }
+        if (StringUtils.isBlank(cmd.getBaselineSnapshotMor())) {
+            throw new IllegalArgumentException("baseline VMware snapshot managed object reference is missing");
+        }
+        if (CollectionUtils.isEmpty(cmd.getDisks())) {
+            throw new IllegalArgumentException("no source disks were provided for initial full sync");
+        }
+    }
+
+    private long getTimeout(VmwareCbtPrepareCommand cmd) {
+        return Math.max(1L, cmd.getWait()) * 1000L;
+    }
+
+    private KVMStoragePool getTargetStoragePool(VmwareCbtPrepareCommand cmd, KVMStoragePoolManager storagePoolMgr) {
+        Storage.StoragePoolType poolType = cmd.getDestinationStoragePoolType();
+        String poolUuid = StringUtils.trimToNull(cmd.getDestinationStoragePoolUuid());
+        if (poolType != null && StringUtils.isNotBlank(poolUuid)) {
+            KVMStoragePool pool = storagePoolMgr.getStoragePool(poolType, poolUuid);
+            if (pool == null) {
+                throw new IllegalArgumentException(String.format("destination storage pool %s/%s is not available on this host",
+                        poolType, poolUuid));
+            }
+            return pool;
+        }
+        return null;
+    }
+
+    private void validateRbdTargetPool(VmwareCbtPrepareCommand cmd, KVMStoragePool targetPool) {
+        if (targetPool == null || targetPool.getType() != Storage.StoragePoolType.RBD) {
+            throw new IllegalArgumentException(String.format("VMware CBT migration %s requires an RBD destination storage pool for RBD target writing",
+                    cmd.getMigrationUuid()));
+        }
+    }
+
+    private void validateBlockDeviceTargetPool(VmwareCbtPrepareCommand cmd, KVMStoragePool targetPool) {
+        if (targetPool == null || targetPool.getType() != Storage.StoragePoolType.Linstor) {
+            throw new IllegalArgumentException(String.format("VMware CBT migration %s requires a Linstor destination storage pool for block device target writing",
+                    cmd.getMigrationUuid()));
+        }
+    }
+
+    private Path getTargetBasePath(VmwareCbtPrepareCommand cmd, KVMStoragePool targetPool) {
+        if (targetPool != null) {
+            return Path.of(targetPool.getLocalPath(), "cloudstack-cbt", cmd.getMigrationUuid()).normalize();
+        }
+        return Path.of(DEFAULT_CBT_DISK_BASE_PATH, cmd.getMigrationUuid()).normalize();
+    }
+
+    private String writePasswordFile(VmwareCbtPrepareCommand cmd) throws Exception {
+        Path passwordFile = Files.createTempFile(String.format("vmware-cbt-%s-", sanitizeFileName(cmd.getMigrationUuid())),
+                ".pass");
+        Files.writeString(passwordFile, cmd.getSourceInstance().getVcenterPassword());
+        setPosixFilePermissionsIfSupported(passwordFile, Set.of(PosixFilePermission.OWNER_READ,
+                PosixFilePermission.OWNER_WRITE));
+        return passwordFile.toString();
+    }
+
+    private void setPosixFilePermissionsIfSupported(Path path, Set<PosixFilePermission> permissions) throws Exception {
+        try {
+            Files.setPosixFilePermissions(path, permissions);
+        } catch (UnsupportedOperationException e) {
+            logger.debug("POSIX permissions are not supported for temporary VMware CBT password file {}", path);
+        }
+    }
+
+    private VmwareCbtDiskSyncResultTO copyDiskFromVmwareSnapshot(VmwareCbtPrepareCommand cmd, VmwareCbtDiskTO disk,
+                                                                 KVMStoragePool targetPool, Path targetBasePath,
+                                                                 String passwordFilePath,
+                                                                 String vddkLibDir, String vddkThumbprint,
+                                                                 LibvirtComputingResource serverResource) throws Exception {
+        validateDisk(disk);
+        long startTime = System.currentTimeMillis();
+        String targetFormat = getTargetFormat(cmd, disk);
+        String targetPath;
+        String qemuTargetPath;
+        boolean preCreatedTarget = false;
+        if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RBD_RAW) {
+            targetPath = getRbdTargetImageName(cmd, disk);
+            deleteRbdTargetIfExists(targetPool, targetPath);
+            qemuTargetPath = KVMPhysicalDisk.RBDStringBuilder(targetPool, getRbdImagePath(targetPool, targetPath));
+        } else if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE) {
+            targetPath = getBlockDeviceTargetName(disk);
+            qemuTargetPath = createBlockDeviceTarget(targetPool, targetPath, disk);
+            preCreatedTarget = true;
+        } else {
+            Path fileTargetPath = getTargetPath(disk, targetBasePath, targetFormat);
+            if (!fileTargetPath.startsWith(targetBasePath)) {
+                throw new IllegalArgumentException(String.format("resolved target path %s is outside %s", fileTargetPath, targetBasePath));
+            }
+            Files.deleteIfExists(fileTargetPath);
+            targetPath = fileTargetPath.toString();
+            qemuTargetPath = targetPath;
+        }
+
+        // Prefer multi-connection nbdcopy over a single-stream qemu-img convert when available:
+        // for a pre-created local raw block-device target (Linstor) nbdcopy writes it directly;
+        // for an RBD target it copies over a localhost qemu-nbd bridge (see the builder). qcow2
+        // file targets keep qemu-img convert.
+        boolean nbdcopyAvailable = serverResource.hostSupportsNbdcopy();
+        // Only skip zero-writes into a pre-created block-device target when the backend
+        // guarantees a fresh volume reads back as zeros (thin providers); on backends that do
+        // not (e.g. LVM-thick) the zeros must be written or stale data leaks into the disk.
+        boolean targetIsZero = preCreatedTarget && targetPool.isVolumeZeroInitialized(targetPath);
+        String command = buildNbdkitFullCopyCommand(cmd, disk, passwordFilePath, vddkLibDir, vddkThumbprint,
+                StringUtils.defaultIfBlank(cmd.getVddkTransports(), serverResource.getVddkTransports()),
+                serverResource.getVddkNbdCompression(), qemuTargetPath, targetFormat, preCreatedTarget, nbdcopyAvailable, targetIsZero);
+        VmwareCbtCommandResult commandResult = executeLoggedBash(command, getTimeout(cmd),
+                String.format("(%s) VMware CBT initial full sync disk %s", cmd.getMigrationUuid(), disk.getDiskId()));
+        long durationSeconds = Math.max(1L, (System.currentTimeMillis() - startTime) / 1000L);
+        if (commandResult.getExitValue() != 0) {
+            String details = String.format("qemu-img conversion from VMware VDDK snapshot failed for source disk %s with exit code %s",
+                    disk.getDiskId(), commandResult.getExitValue());
+            throw new IllegalStateException(commandResult.appendLastCommandOutput(details));
+        }
+
+        return new VmwareCbtDiskSyncResultTO(disk.getDiskId(), targetPath, disk.getChangeId(),
+                cmd.getBaselineSnapshotMor(), disk.getCapacityBytes(), durationSeconds, true,
+                "Initial VDDK full sync completed");
+    }
+
+    private String getTargetFormat(VmwareCbtPrepareCommand cmd, VmwareCbtDiskTO disk) {
+        if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RBD_RAW ||
+                cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE) {
+            return "raw";
+        }
+        return StringUtils.defaultIfBlank(disk.getTargetFormat(), "qcow2");
+    }
+
+    private String getBlockDeviceTargetName(VmwareCbtDiskTO disk) {
+        String targetPath = StringUtils.trimToNull(disk.getTargetPath());
+        if (targetPath == null) {
+            throw new IllegalArgumentException(String.format("no block device target name was assigned for source disk %s", disk.getDiskId()));
+        }
+        String normalizedTargetPath = targetPath.replace('\\', '/');
+        return StringUtils.contains(normalizedTargetPath, "/") ? StringUtils.substringAfterLast(normalizedTargetPath, "/") : normalizedTargetPath;
+    }
+
+    private String createBlockDeviceTarget(KVMStoragePool targetPool, String targetName, VmwareCbtDiskTO disk) {
+        if (disk.getCapacityBytes() <= 0) {
+            throw new IllegalArgumentException(String.format("source disk %s does not have a valid capacity, " +
+                    "which is required to pre-create the block device target volume", disk.getDiskId()));
+        }
+        deleteRbdTargetIfExists(targetPool, targetName);
+        KVMPhysicalDisk targetDisk = targetPool.createPhysicalDisk(targetName, QemuImg.PhysicalDiskFormat.RAW,
+                Storage.ProvisioningType.THIN, disk.getCapacityBytes(), null);
+        String devicePath = targetDisk == null ? null : targetDisk.getPath();
+        if (StringUtils.isBlank(devicePath)) {
+            throw new IllegalStateException(String.format("could not resolve a local device path for block device target volume %s", targetName));
+        }
+        return devicePath;
+    }
+
+    private String getRbdTargetImageName(VmwareCbtPrepareCommand cmd, VmwareCbtDiskTO disk) {
+        String targetPath = StringUtils.trimToNull(disk.getTargetPath());
+        if (targetPath != null) {
+            String normalizedTargetPath = targetPath.replace('\\', '/');
+            return StringUtils.contains(normalizedTargetPath, "/") ? StringUtils.substringAfterLast(normalizedTargetPath, "/") : normalizedTargetPath;
+        }
+        String sourceName = StringUtils.substringAfterLast(StringUtils.defaultIfBlank(disk.getSourceDiskPath(), disk.getDiskId()), "/");
+        sourceName = StringUtils.substringBeforeLast(StringUtils.defaultIfBlank(sourceName, disk.getDiskId()), ".");
+        return String.format("cloudstack-cbt-%s-%s-%s", sanitizeFileName(cmd.getMigrationUuid()),
+                sanitizeFileName(disk.getDiskId()), sanitizeFileName(sourceName));
+    }
+
+    private String getRbdImagePath(KVMStoragePool targetPool, String imageName) {
+        return String.format("%s/%s", StringUtils.removeEnd(targetPool.getSourceDir(), "/"), imageName);
+    }
+
+    private void deleteRbdTargetIfExists(KVMStoragePool targetPool, String imageName) {
+        try {
+            targetPool.deletePhysicalDisk(imageName, Storage.ImageFormat.RAW);
+        } catch (RuntimeException e) {
+            logger.debug("No existing RBD image {} was removed before VMware CBT initial sync, or removal was not required: {}",
+                    imageName, e.getMessage());
+        }
+    }
+
+    private Path getTargetPath(VmwareCbtDiskTO disk, Path targetBasePath, String targetFormat) {
+        String targetPathValue = StringUtils.trimToNull(disk.getTargetPath());
+        Path targetPath = targetPathValue == null ?
+                targetBasePath.resolve(getTargetDiskFileName(disk, targetFormat)) :
+                Path.of(targetPathValue);
+        if (!targetPath.isAbsolute()) {
+            targetPath = targetBasePath.resolve(targetPath);
+        }
+        return targetPath.normalize();
+    }
+
+    private void validateDisk(VmwareCbtDiskTO disk) {
+        if (disk == null) {
+            throw new IllegalArgumentException("source disk cannot be null");
+        }
+        if (StringUtils.isBlank(disk.getDiskId())) {
+            throw new IllegalArgumentException("source disk ID is missing");
+        }
+        if (StringUtils.isBlank(disk.getSourceDiskPath())) {
+            throw new IllegalArgumentException(String.format("source disk path is missing for disk %s", disk.getDiskId()));
+        }
+    }
+
+    private String buildNbdkitFullCopyCommand(VmwareCbtPrepareCommand cmd, VmwareCbtDiskTO disk,
+                                              String passwordFilePath, String vddkLibDir, String vddkThumbprint,
+                                              String vddkTransports, String vddkNbdCompression, String targetPath,
+                                              String targetFormat, boolean preCreatedTarget, boolean nbdcopyAvailable,
+                                              boolean targetIsZero) {
+        RemoteInstanceTO sourceInstance = cmd.getSourceInstance();
+        String sourceVmMoref = getMorefValue(sourceInstance.getVmwareMoref());
+        String snapshotMoref = getMorefValue(cmd.getBaselineSnapshotMor());
+        StringBuilder nbdkit = new StringBuilder("nbdkit -r -U - vddk ");
+        appendPluginParameter(nbdkit, "file", disk.getSourceDiskPath());
+        appendPluginParameter(nbdkit, "server", sourceInstance.getVcenterHost());
+        appendPluginParameter(nbdkit, "user", sourceInstance.getVcenterUsername());
+        nbdkit.append("password=+").append(shellQuote(passwordFilePath)).append(" ");
+        nbdkit.append("vm=moref=").append(shellQuote(sourceVmMoref)).append(" ");
+        appendPluginParameter(nbdkit, "snapshot", snapshotMoref);
+        appendPluginParameter(nbdkit, "libdir", vddkLibDir);
+        appendPluginParameter(nbdkit, "thumbprint", vddkThumbprint);
+        if (StringUtils.isNotBlank(vddkTransports)) {
+            appendPluginParameter(nbdkit, "transports", vddkTransports);
+        }
+        if (StringUtils.isNotBlank(vddkNbdCompression)) {
+            appendPluginParameter(nbdkit, "compression", vddkNbdCompression);
+        }
+
+        boolean rbdTarget = cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RBD_RAW;
+
+        // RBD target with nbdcopy available: copy over a localhost qemu-nbd bridge (nbdcopy
+        // needs both ends as NBD, and qemu-img create - which nbdcopy cannot do - pre-creates
+        // the raw image). Multi-connection nbdcopy is typically faster than the single-stream
+        // qemu-img convert. The fresh raw image reads as zeros, so --destination-is-zero keeps
+        // it sparse.
+        if (rbdTarget && nbdcopyAvailable && disk.getCapacityBytes() > 0) {
+            return buildRbdNbdcopyBridgeCommand(nbdkit, targetPath, disk.getCapacityBytes());
+        }
+
+        // For a pre-created block-device target, skip writing zero blocks
+        // (--destination-is-zero / --target-is-zero) only when the backend guarantees the
+        // fresh volume reads back as zeros (targetIsZero, i.e. thin providers). On backends
+        // that do not (e.g. LVM-thick) the zeros must be written or stale data from a
+        // previously deleted volume would leak into the unwritten regions.
+        boolean useNbdcopy = preCreatedTarget && nbdcopyAvailable;
+        String nbdcopyZeroFlag = (preCreatedTarget && targetIsZero) ? "--destination-is-zero " : "";
+        String qemuImgFlags = preCreatedTarget ? ("-n " + (targetIsZero ? "--target-is-zero " : "")) : "";
+        String runCommand = useNbdcopy
+                ? String.format("nbdcopy %s\"$uri\" %s", nbdcopyZeroFlag, shellQuote(targetPath))
+                : String.format("qemu-img convert %s-f raw -O %s \"$uri\" %s",
+                        qemuImgFlags, shellQuote(targetFormat), shellQuote(targetPath));
+        return nbdkit.append("--run ").append(shellQuote(runCommand)).toString();
+    }
+
+    /**
+     * Wraps the nbdkit VDDK source with a localhost qemu-nbd bridge over the RBD target so
+     * nbdcopy can copy NBD-to-NBD. The returned string is a self-contained bash script (run
+     * via bash -c) that pre-creates the raw RBD image, starts qemu-nbd, runs the nbdcopy, and
+     * tears the bridge down on exit. Package-private for unit testing.
+     */
+    String buildRbdNbdcopyBridgeCommand(StringBuilder nbdkitSource, String qemuRbdTarget, long capacityBytes) {
+        int port = allocateLocalhostPort();
+        nbdkitSource.append("--run ").append(shellQuote(
+                String.format("nbdcopy --destination-is-zero \"$uri\" nbd://localhost:%d", port)));
+        StringBuilder script = new StringBuilder();
+        script.append("set -euo pipefail; ");
+        script.append("__pidf=$(mktemp); ");
+        script.append("cleanup() { set +e; if [[ -s \"$__pidf\" ]]; then __p=$(cat \"$__pidf\"); ");
+        script.append("kill \"$__p\" >/dev/null 2>&1 || true; ");
+        script.append("for __a in {1..20}; do kill -0 \"$__p\" >/dev/null 2>&1 || break; sleep 0.1; done; fi; ");
+        script.append("rm -f \"$__pidf\"; }; trap cleanup EXIT; ");
+        script.append("qemu-img create -f raw ").append(shellQuote(qemuRbdTarget)).append(" ").append(capacityBytes).append("; ");
+        script.append("qemu-nbd --fork --persistent --shared=8 --format=raw --bind=127.0.0.1 --port=").append(port)
+                .append(" --pid-file=\"$__pidf\" ").append(shellQuote(qemuRbdTarget)).append("; ");
+        script.append(nbdkitSource);
+        return script.toString();
+    }
+
+    private int allocateLocalhostPort() {
+        try (java.net.ServerSocket socket = new java.net.ServerSocket(0)) {
+            socket.setReuseAddress(false);
+            return socket.getLocalPort();
+        } catch (java.io.IOException e) {
+            throw new CloudRuntimeException("Unable to allocate a localhost port for the RBD qemu-nbd bridge", e);
+        }
+    }
+
+    private void appendPluginParameter(StringBuilder command, String key, String value) {
+        command.append(key).append("=").append(shellQuote(value)).append(" ");
+    }
+
+    private String getTargetDiskFileName(VmwareCbtDiskTO disk, String targetFormat) {
+        String sourceName = StringUtils.substringAfterLast(StringUtils.defaultIfBlank(disk.getSourceDiskPath(), disk.getDiskId()), "/");
+        sourceName = StringUtils.substringBeforeLast(StringUtils.defaultIfBlank(sourceName, disk.getDiskId()), ".");
+        return String.format("%s-%s.%s", sanitizeFileName(disk.getDiskId()), sanitizeFileName(sourceName),
+                sanitizeFileName(targetFormat));
+    }
+
+    private String sanitizeFileName(String value) {
+        String sanitized = StringUtils.defaultIfBlank(value, "disk").replaceAll("[^A-Za-z0-9._-]", "-");
+        return StringUtils.defaultIfBlank(sanitized, "disk");
+    }
+
+    private String getMorefValue(String moref) {
+        String value = StringUtils.trimToNull(moref);
+        if (value == null) {
+            return null;
+        }
+        return value.contains(":") ? StringUtils.substringAfter(value, ":") : value;
+    }
+
+    private String shellQuote(String value) {
+        return "'" + StringUtils.defaultString(value).replace("'", "'\"'\"'") + "'";
+    }
+
+    private String resolveVddkSetting(String commandValue, String agentValue) {
+        return StringUtils.defaultIfBlank(StringUtils.trimToNull(commandValue), StringUtils.trimToNull(agentValue));
+    }
+
+    protected VmwareCbtCommandResult executeLoggedBash(String command, long timeout, String logPrefix) {
+        Script script = new Script("/bin/bash", timeout, logger);
+        script.add("-c");
+        script.add(command);
+        VmwareCbtCommandOutputLogger outputLogger = new VmwareCbtCommandOutputLogger(logger, logPrefix);
+        script.execute(outputLogger);
+        return new VmwareCbtCommandResult(script.getExitValue(), outputLogger.getLastRelevantOutputLine());
+    }
+
+    private String getVcenterThumbprint(String vcenterHost, long timeout, String sourceVmName) {
+        if (StringUtils.isBlank(vcenterHost)) {
+            return null;
+        }
+        String endpoint = String.format("%s:443", vcenterHost);
+        String command = String.format("openssl s_client -connect %s </dev/null 2>/dev/null | " +
+                "openssl x509 -fingerprint -sha1 -noout", shellQuote(endpoint));
+
+        Script script = new Script("/bin/bash", timeout, logger);
+        script.add("-c");
+        script.add(command);
+
+        OutputInterpreter.AllLinesParser parser = new OutputInterpreter.AllLinesParser();
+        script.execute(parser);
+
+        String output = parser.getLines();
+        if (script.getExitValue() != 0) {
+            logger.error("({}) Failed to fetch vCenter thumbprint for {}", sourceVmName, vcenterHost);
+            return null;
+        }
+
+        return extractSha1Fingerprint(output);
+    }
+
+    private String extractSha1Fingerprint(String output) {
+        String parsedOutput = StringUtils.trimToEmpty(output);
+        if (StringUtils.isBlank(parsedOutput)) {
+            return null;
+        }
+
+        for (String line : parsedOutput.split("\\R")) {
+            String trimmedLine = StringUtils.trimToEmpty(line);
+            if (StringUtils.isBlank(trimmedLine)) {
+                continue;
+            }
+
+            Matcher matcher = SHA1_FINGERPRINT_PATTERN.matcher(trimmedLine);
+            if (matcher.find()) {
+                return matcher.group(1).toUpperCase(Locale.ROOT);
+            }
+
+            if (trimmedLine.matches("(?i)[0-9a-f]{2}(:[0-9a-f]{2})+")) {
+                return trimmedLine.toUpperCase(Locale.ROOT);
+            }
+        }
+        return null;
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtRbdProbeCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtRbdProbeCommandWrapper.java
new file mode 100644
index 000000000000..23f76b1619fb
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtRbdProbeCommandWrapper.java
@@ -0,0 +1,218 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.util.regex.Pattern;
+
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.VmwareCbtRbdProbeCommand;
+import com.cloud.agent.api.to.VmwareCbtTargetStorageType;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.storage.Storage;
+import com.cloud.utils.script.Script;
+
+@ResourceWrapper(handles = VmwareCbtRbdProbeCommand.class)
+public class LibvirtVmwareCbtRbdProbeCommandWrapper extends CommandWrapper<VmwareCbtRbdProbeCommand, Answer, LibvirtComputingResource> {
+
+    static final String PROBE_IMAGE_PREFIX = "cloudstack-cbt-probe-";
+    static final String BLOCK_DEVICE_PROBE_PREFIX = "cbt-probe-";
+    private static final Pattern PROBE_IMAGE_NAME_PATTERN = Pattern.compile("^" + PROBE_IMAGE_PREFIX +
+            "[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$");
+    private static final Pattern BLOCK_DEVICE_PROBE_NAME_PATTERN = Pattern.compile("^" + BLOCK_DEVICE_PROBE_PREFIX +
+            "[0-9a-fA-F]{8}$");
+    private static final long PROBE_SIZE_BYTES = 4L * 1024L * 1024L;
+
+    @Override
+    public Answer execute(VmwareCbtRbdProbeCommand cmd, LibvirtComputingResource serverResource) {
+        String probeImageName = StringUtils.trimToNull(cmd.getProbeImageName());
+        if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE) {
+            return executeBlockDeviceProbe(cmd, probeImageName, serverResource);
+        }
+        try {
+            validateCommand(cmd, probeImageName);
+            KVMStoragePool targetPool = getTargetStoragePool(cmd, serverResource.getStoragePoolMgr());
+            String qemuRbdPath = KVMPhysicalDisk.RBDStringBuilder(targetPool, getRbdImagePath(targetPool, probeImageName));
+
+            Exception probeFailure = null;
+            try {
+                executeProbeCommand(buildCreateCommand(qemuRbdPath), getTimeout(cmd), "create", targetPool, probeImageName);
+                executeProbeCommand(buildWriteReadCommand(qemuRbdPath), getTimeout(cmd), "write/read", targetPool, probeImageName);
+            } catch (Exception e) {
+                probeFailure = e;
+                throw e;
+            } finally {
+                try {
+                    cleanupProbeImage(targetPool, probeImageName);
+                } catch (RuntimeException e) {
+                    if (probeFailure == null) {
+                        throw e;
+                    }
+                    logger.warn("Unable to clean up RBD probe image {} after a failed probe: {}", probeImageName,
+                            StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()));
+                }
+            }
+
+            String message = String.format("Selected KVM host can create, write, read and delete temporary RBD image %s in storage pool %s.",
+                    probeImageName, cmd.getDestinationStoragePoolUuid());
+            logger.info(message);
+            return new Answer(cmd, true, message);
+        } catch (Exception e) {
+            String message = String.format("Cannot verify VMware CBT access to selected RBD primary storage pool %s on host %s: %s",
+                    cmd.getDestinationStoragePoolUuid(), serverResource.getPrivateIp(),
+                    StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()));
+            logger.warn(message, e);
+            return new Answer(cmd, false, message);
+        }
+    }
+
+    private Answer executeBlockDeviceProbe(VmwareCbtRbdProbeCommand cmd, String probeVolumeName,
+                                           LibvirtComputingResource serverResource) {
+        try {
+            validateBlockDeviceCommand(cmd, probeVolumeName);
+            KVMStoragePool targetPool = getBlockDeviceTargetStoragePool(cmd, serverResource.getStoragePoolMgr());
+
+            Exception probeFailure = null;
+            try {
+                KVMPhysicalDisk probeDisk = targetPool.createPhysicalDisk(probeVolumeName,
+                        org.apache.cloudstack.utils.qemu.QemuImg.PhysicalDiskFormat.RAW,
+                        Storage.ProvisioningType.THIN, PROBE_SIZE_BYTES, null);
+                String devicePath = probeDisk == null ? null : probeDisk.getPath();
+                if (StringUtils.isBlank(devicePath)) {
+                    throw new IllegalStateException(String.format("could not resolve a local device path for probe volume %s", probeVolumeName));
+                }
+                executeProbeCommand(buildWriteReadCommand(devicePath), getTimeout(cmd), "write/read", targetPool, probeVolumeName);
+            } catch (Exception e) {
+                probeFailure = e;
+                throw e;
+            } finally {
+                try {
+                    cleanupProbeImage(targetPool, probeVolumeName);
+                } catch (RuntimeException e) {
+                    if (probeFailure == null) {
+                        throw e;
+                    }
+                    logger.warn("Unable to clean up block device probe volume {} after a failed probe: {}", probeVolumeName,
+                            StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()));
+                }
+            }
+
+            String message = String.format("Selected KVM host can create, write, read and delete temporary block device volume %s in storage pool %s.",
+                    probeVolumeName, cmd.getDestinationStoragePoolUuid());
+            logger.info(message);
+            return new Answer(cmd, true, message);
+        } catch (Exception e) {
+            String message = String.format("Cannot verify VMware CBT access to selected block device primary storage pool %s on host %s: %s",
+                    cmd.getDestinationStoragePoolUuid(), serverResource.getPrivateIp(),
+                    StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()));
+            logger.warn(message, e);
+            return new Answer(cmd, false, message);
+        }
+    }
+
+    private void validateBlockDeviceCommand(VmwareCbtRbdProbeCommand cmd, String probeVolumeName) {
+        if (cmd.getDestinationStoragePoolType() != Storage.StoragePoolType.Linstor) {
+            throw new IllegalArgumentException("VMware CBT block device probe requires a Linstor destination storage pool");
+        }
+        if (StringUtils.isBlank(cmd.getDestinationStoragePoolUuid())) {
+            throw new IllegalArgumentException("destination storage pool UUID is required");
+        }
+        if (StringUtils.isBlank(probeVolumeName) || !BLOCK_DEVICE_PROBE_NAME_PATTERN.matcher(probeVolumeName).matches()) {
+            throw new IllegalArgumentException(String.format("probe volume name must match %s<8 hex characters>", BLOCK_DEVICE_PROBE_PREFIX));
+        }
+    }
+
+    private KVMStoragePool getBlockDeviceTargetStoragePool(VmwareCbtRbdProbeCommand cmd, KVMStoragePoolManager storagePoolMgr) {
+        KVMStoragePool targetPool = storagePoolMgr.getStoragePool(cmd.getDestinationStoragePoolType(), cmd.getDestinationStoragePoolUuid());
+        if (targetPool == null || targetPool.getType() != Storage.StoragePoolType.Linstor) {
+            throw new IllegalArgumentException(String.format("selected Linstor storage pool %s is not available on this KVM host",
+                    cmd.getDestinationStoragePoolUuid()));
+        }
+        return targetPool;
+    }
+
+    private void validateCommand(VmwareCbtRbdProbeCommand cmd, String probeImageName) {
+        if (cmd.getDestinationStoragePoolType() != Storage.StoragePoolType.RBD) {
+            throw new IllegalArgumentException("VMware CBT RBD probe requires an RBD destination storage pool");
+        }
+        if (StringUtils.isBlank(cmd.getDestinationStoragePoolUuid())) {
+            throw new IllegalArgumentException("destination RBD storage pool UUID is required");
+        }
+        if (StringUtils.isBlank(probeImageName) || !PROBE_IMAGE_NAME_PATTERN.matcher(probeImageName).matches()) {
+            throw new IllegalArgumentException(String.format("probe image name must match %s<uuid>", PROBE_IMAGE_PREFIX));
+        }
+    }
+
+    private KVMStoragePool getTargetStoragePool(VmwareCbtRbdProbeCommand cmd, KVMStoragePoolManager storagePoolMgr) {
+        KVMStoragePool targetPool = storagePoolMgr.getStoragePool(cmd.getDestinationStoragePoolType(), cmd.getDestinationStoragePoolUuid());
+        if (targetPool == null || targetPool.getType() != Storage.StoragePoolType.RBD) {
+            throw new IllegalArgumentException(String.format("selected RBD storage pool %s is not available on this KVM host",
+                    cmd.getDestinationStoragePoolUuid()));
+        }
+        return targetPool;
+    }
+
+    private String getRbdImagePath(KVMStoragePool targetPool, String imageName) {
+        return String.format("%s/%s", StringUtils.removeEnd(targetPool.getSourceDir(), "/"), imageName);
+    }
+
+    private String buildCreateCommand(String qemuRbdPath) {
+        return String.format("qemu-img create -f raw %s %s", shellQuote(qemuRbdPath), PROBE_SIZE_BYTES);
+    }
+
+    private String buildWriteReadCommand(String qemuRbdPath) {
+        return String.format("qemu-io -f raw -c %s -c %s %s",
+                shellQuote("write -P 0x5a 0 4k"), shellQuote("read -P 0x5a 0 4k"), shellQuote(qemuRbdPath));
+    }
+
+    protected void executeProbeCommand(String command, long timeout, String operation, KVMStoragePool targetPool,
+                                       String probeImageName) {
+        int exitValue = runBashCommand(command, timeout);
+        if (exitValue != 0) {
+            throw new IllegalStateException(String.format("qemu RBD probe %s failed with exit code %s. Verify CloudStack RBD primary-storage configuration, Ceph monitor connectivity, qemu RBD block-driver support, librados/librbd client libraries, Java RADOS/RBD bindings and Ceph authentication for pool %s.",
+                    operation, exitValue, targetPool.getUuid()));
+        }
+    }
+
+    protected int runBashCommand(String command, long timeout) {
+        int boundedTimeout = (int)Math.min(Integer.MAX_VALUE, Math.max(0L, timeout));
+        return Script.runSimpleBashScriptForExitValue(command, boundedTimeout, true);
+    }
+
+    protected void cleanupProbeImage(KVMStoragePool targetPool, String probeImageName) {
+        try {
+            targetPool.deletePhysicalDisk(probeImageName, Storage.ImageFormat.RAW);
+        } catch (RuntimeException e) {
+            throw new IllegalStateException(String.format("RBD probe cleanup failed for temporary image %s. Verify Java RADOS/RBD bindings and Ceph authentication for pool %s. Manual cleanup may be required.",
+                    probeImageName, targetPool.getUuid()), e);
+        }
+    }
+
+    private long getTimeout(VmwareCbtRbdProbeCommand cmd) {
+        return Math.max(1L, cmd.getWait()) * 1000L;
+    }
+
+    private String shellQuote(String value) {
+        return "'" + StringUtils.defaultString(value).replace("'", "'\"'\"'") + "'";
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtSyncCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtSyncCommandWrapper.java
new file mode 100644
index 000000000000..ed9a6a992c40
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtSyncCommandWrapper.java
@@ -0,0 +1,489 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.attribute.PosixFilePermission;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Locale;
+import java.util.Set;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.VmwareCbtMigrationAnswer;
+import com.cloud.agent.api.VmwareCbtSyncCommand;
+import com.cloud.agent.api.to.RemoteInstanceTO;
+import com.cloud.agent.api.to.VmwareCbtChangedBlockRangeTO;
+import com.cloud.agent.api.to.VmwareCbtDiskSyncResultTO;
+import com.cloud.agent.api.to.VmwareCbtDiskTO;
+import com.cloud.agent.api.to.VmwareCbtTargetStorageType;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.storage.Storage;
+import com.cloud.utils.script.OutputInterpreter;
+import com.cloud.utils.script.Script;
+
+@ResourceWrapper(handles = VmwareCbtSyncCommand.class)
+public class LibvirtVmwareCbtSyncCommandWrapper extends CommandWrapper<VmwareCbtSyncCommand, Answer, LibvirtComputingResource> {
+
+    private static final long DEFAULT_MAX_COPY_CHUNK_BYTES = 256L * 1024L * 1024L;
+    private static final Pattern SHA1_FINGERPRINT_PATTERN = Pattern.compile("(?i)(?:SHA1\\s+)?Fingerprint\\s*=\\s*([0-9A-F:]+)");
+
+    @Override
+    public Answer execute(VmwareCbtSyncCommand cmd, LibvirtComputingResource serverResource) {
+        if (!serverResource.hostSupportsVddkBlockCopy(cmd.getVddkLibDir())) {
+            String msg = String.format("Cannot synchronize VMware CBT migration %s on host %s. VDDK, qemu-img, qemu-nbd and qemu-io are required.",
+                    cmd.getMigrationUuid(), serverResource.getPrivateIp());
+            logger.info(msg);
+            return new VmwareCbtMigrationAnswer(cmd, false, msg, cmd.getMigrationUuid(), cmd.getCycleNumber(),
+                    0, 0, 0, false, null);
+        }
+
+        long startTime = System.currentTimeMillis();
+        List<VmwareCbtChangedBlockRangeTO> changedBlocks = cmd.getChangedBlocks();
+        if (changedBlocks == null || changedBlocks.isEmpty()) {
+            long durationSeconds = Math.max(1L, (System.currentTimeMillis() - startTime) / 1000L);
+            String msg = String.format("VMware CBT cycle %s for migration %s completed with no changed blocks.",
+                    cmd.getCycleNumber(), cmd.getMigrationUuid());
+            logger.info(msg);
+            return new VmwareCbtMigrationAnswer(cmd, true, msg, cmd.getMigrationUuid(), cmd.getCycleNumber(),
+                    0, 0, durationSeconds, true, null);
+        }
+
+        VmwareCbtSyncPlan syncPlan = VmwareCbtSyncPlan.create(cmd.getDisks(), changedBlocks);
+        if (!syncPlan.isValid()) {
+            String msg = String.format("Cannot synchronize VMware CBT cycle %s for migration %s: %s",
+                    cmd.getCycleNumber(), cmd.getMigrationUuid(), syncPlan.getValidationError());
+            logger.info(msg);
+            return new VmwareCbtMigrationAnswer(cmd, false, msg, cmd.getMigrationUuid(), cmd.getCycleNumber(),
+                    0, 0, 0, false, null);
+        }
+
+        try {
+            validateSyncCommand(cmd);
+            String vddkLibDir = resolveVddkSetting(cmd.getVddkLibDir(), serverResource.getVddkLibDir());
+            if (StringUtils.isBlank(vddkLibDir)) {
+                String msg = String.format("Cannot synchronize VMware CBT migration %s because no VDDK library directory is configured or detected.",
+                        cmd.getMigrationUuid());
+                logger.info(msg);
+                return new VmwareCbtMigrationAnswer(cmd, false, msg, cmd.getMigrationUuid(), cmd.getCycleNumber(),
+                        syncPlan.getChangedBytes(), 0, 0, false, null);
+            }
+
+            RemoteInstanceTO sourceInstance = cmd.getSourceInstance();
+            String vddkThumbprint = resolveVddkSetting(cmd.getVddkThumbprint(), serverResource.getVddkThumbprint());
+            if (StringUtils.isBlank(vddkThumbprint)) {
+                vddkThumbprint = getVcenterThumbprint(sourceInstance.getVcenterHost(), getTimeout(cmd),
+                        sourceInstance.getInstanceName());
+            }
+            if (StringUtils.isBlank(vddkThumbprint)) {
+                String msg = String.format("Cannot synchronize VMware CBT migration %s because the vCenter SSL thumbprint could not be determined.",
+                        cmd.getMigrationUuid());
+                logger.info(msg);
+                return new VmwareCbtMigrationAnswer(cmd, false, msg, cmd.getMigrationUuid(), cmd.getCycleNumber(),
+                        syncPlan.getChangedBytes(), 0, 0, false, null);
+            }
+
+            KVMStoragePool targetPool = getTargetStoragePool(cmd, serverResource.getStoragePoolMgr());
+            if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RBD_RAW) {
+                validateRbdTargetPool(cmd, targetPool);
+            } else if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE) {
+                validateBlockDeviceTargetPool(cmd, targetPool);
+            }
+
+            String passwordFilePath = writePasswordFile(cmd);
+            try {
+                List<VmwareCbtDiskSyncResultTO> diskResults = new ArrayList<>();
+                for (VmwareCbtSyncPlan.DiskPlan diskPlan : syncPlan.getDiskPlans()) {
+                    diskResults.add(syncDiskChangedBlocks(cmd, diskPlan, targetPool, passwordFilePath, vddkLibDir, vddkThumbprint,
+                            StringUtils.defaultIfBlank(cmd.getVddkTransports(), serverResource.getVddkTransports())));
+                }
+                long durationSeconds = Math.max(1L, (System.currentTimeMillis() - startTime) / 1000L);
+                long dirtyRate = getDirtyRateBytesPerSecond(syncPlan.getChangedBytes(), durationSeconds);
+                String msg = String.format("VMware CBT cycle %s for migration %s copied %s changed block range(s), " +
+                                "coalesced into %s copy range(s) across %s disk(s), totaling %s bytes.",
+                        cmd.getCycleNumber(), cmd.getMigrationUuid(), syncPlan.getChangedRangeCount(),
+                        syncPlan.getCopyRangeCount(), syncPlan.getDiskPlans().size(), syncPlan.getChangedBytes());
+                logger.info(msg);
+                return new VmwareCbtMigrationAnswer(cmd, true, msg, cmd.getMigrationUuid(), cmd.getCycleNumber(),
+                        syncPlan.getChangedBytes(), dirtyRate, durationSeconds, false, diskResults);
+            } finally {
+                Files.deleteIfExists(Path.of(passwordFilePath));
+            }
+        } catch (Exception e) {
+            String msg = String.format("Cannot synchronize VMware CBT cycle %s for migration %s: %s",
+                    cmd.getCycleNumber(), cmd.getMigrationUuid(),
+                    StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()));
+            logger.error(msg, e);
+            return new VmwareCbtMigrationAnswer(cmd, false, msg, cmd.getMigrationUuid(), cmd.getCycleNumber(),
+                    syncPlan.getChangedBytes(), 0, 0, false, null);
+        }
+    }
+
+    private void validateSyncCommand(VmwareCbtSyncCommand cmd) {
+        RemoteInstanceTO sourceInstance = cmd.getSourceInstance();
+        if (sourceInstance == null) {
+            throw new IllegalArgumentException("source VMware instance information is missing");
+        }
+        if (StringUtils.isAnyBlank(sourceInstance.getVcenterHost(), sourceInstance.getVcenterUsername(),
+                sourceInstance.getVcenterPassword(), sourceInstance.getInstanceName())) {
+            throw new IllegalArgumentException("source vCenter host, username, password and VM name are required");
+        }
+        if (StringUtils.isBlank(sourceInstance.getVmwareMoref())) {
+            throw new IllegalArgumentException("source VMware VM managed object reference is missing");
+        }
+        if (StringUtils.isBlank(cmd.getSnapshotMor())) {
+            throw new IllegalArgumentException("VMware snapshot managed object reference is missing");
+        }
+    }
+
+    private VmwareCbtDiskSyncResultTO syncDiskChangedBlocks(VmwareCbtSyncCommand cmd, VmwareCbtSyncPlan.DiskPlan diskPlan,
+                                                            KVMStoragePool targetPool, String passwordFilePath, String vddkLibDir,
+                                                            String vddkThumbprint, String vddkTransports) throws Exception {
+        VmwareCbtDiskTO disk = diskPlan.getDisk();
+        validateDisk(cmd, disk);
+        long startTime = System.currentTimeMillis();
+        String scriptPath = writeDiskSyncScript(cmd, diskPlan, targetPool);
+        try {
+            String command = buildNbdkitDeltaSyncCommand(cmd, disk, passwordFilePath, vddkLibDir, vddkThumbprint,
+                    vddkTransports, scriptPath);
+            VmwareCbtCommandResult commandResult = executeLoggedBash(command, getTimeout(cmd),
+                    String.format("(%s) VMware CBT delta sync disk %s", cmd.getMigrationUuid(), disk.getDiskId()));
+            long durationSeconds = Math.max(1L, (System.currentTimeMillis() - startTime) / 1000L);
+            if (commandResult.getExitValue() != 0) {
+                String details = String.format("changed-block copy from VMware VDDK snapshot failed for source disk %s with exit code %s",
+                        disk.getDiskId(), commandResult.getExitValue());
+                throw new IllegalStateException(commandResult.appendLastCommandOutput(details));
+            }
+            return new VmwareCbtDiskSyncResultTO(disk.getDiskId(), disk.getTargetPath(), disk.getChangeId(),
+                    cmd.getSnapshotMor(), diskPlan.getChangedBytes(), durationSeconds, true,
+                    String.format("Copied %s changed bytes in %s range(s)", diskPlan.getChangedBytes(),
+                            diskPlan.getChangedBlocks().size()));
+        } finally {
+            Files.deleteIfExists(Path.of(scriptPath));
+        }
+    }
+
+    private void validateDisk(VmwareCbtSyncCommand cmd, VmwareCbtDiskTO disk) {
+        if (disk == null) {
+            throw new IllegalArgumentException("source disk cannot be null");
+        }
+        if (StringUtils.isBlank(disk.getDiskId())) {
+            throw new IllegalArgumentException("source disk ID is missing");
+        }
+        if (StringUtils.isBlank(disk.getSourceDiskPath())) {
+            throw new IllegalArgumentException(String.format("source disk path is missing for disk %s", disk.getDiskId()));
+        }
+        if (StringUtils.isBlank(disk.getTargetPath())) {
+            throw new IllegalArgumentException(String.format("target disk path is missing for disk %s", disk.getDiskId()));
+        }
+        if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RBD_RAW ||
+                cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE) {
+            if (!StringUtils.equalsIgnoreCase(StringUtils.defaultIfBlank(disk.getTargetFormat(), "raw"), "raw")) {
+                throw new IllegalArgumentException(String.format("only raw target disks are supported for VMware CBT delta sync to %s; disk %s uses %s",
+                        cmd.getTargetStorageType(), disk.getDiskId(), disk.getTargetFormat()));
+            }
+            return;
+        }
+        if (!Files.isRegularFile(Path.of(disk.getTargetPath()))) {
+            throw new IllegalArgumentException(String.format("target disk path %s for disk %s does not exist or is not a regular file",
+                    disk.getTargetPath(), disk.getDiskId()));
+        }
+        if (!StringUtils.equalsIgnoreCase(StringUtils.defaultIfBlank(disk.getTargetFormat(), "qcow2"), "qcow2")) {
+            throw new IllegalArgumentException(String.format("only qcow2 target disks are supported for VMware CBT delta sync; disk %s uses %s",
+                    disk.getDiskId(), disk.getTargetFormat()));
+        }
+    }
+
+    private String writePasswordFile(VmwareCbtSyncCommand cmd) throws Exception {
+        Path passwordFile = Files.createTempFile(String.format("vmware-cbt-%s-", sanitizeFileName(cmd.getMigrationUuid())),
+                ".pass");
+        Files.writeString(passwordFile, cmd.getSourceInstance().getVcenterPassword());
+        setPosixFilePermissionsIfSupported(passwordFile, Set.of(PosixFilePermission.OWNER_READ,
+                PosixFilePermission.OWNER_WRITE));
+        return passwordFile.toString();
+    }
+
+    protected String writeDiskSyncScript(VmwareCbtSyncCommand cmd, VmwareCbtSyncPlan.DiskPlan diskPlan,
+                                         KVMStoragePool targetPool) throws Exception {
+        VmwareCbtDiskTO disk = diskPlan.getDisk();
+        boolean directBlockTarget = cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE;
+        Path scriptPath = Files.createTempFile(String.format("vmware-cbt-%s-%s-", sanitizeFileName(cmd.getMigrationUuid()),
+                sanitizeFileName(disk.getDiskId())), ".sh");
+        StringBuilder script = new StringBuilder();
+        script.append("#!/bin/bash\n");
+        script.append("set -euo pipefail\n");
+        script.append("target_path=").append(shellQuote(getQemuTargetPath(cmd, disk, targetPool))).append("\n");
+        script.append("target_format=").append(shellQuote(getTargetFormat(cmd, disk))).append("\n");
+        script.append("get_nbd_socket_path() {\n");
+        script.append("  local socket_path=\"${uri#*socket=}\"\n");
+        script.append("  socket_path=\"${socket_path%%&*}\"\n");
+        script.append("  if [[ \"$socket_path\" == \"$uri\" || -z \"$socket_path\" ]]; then\n");
+        script.append("    echo \"Cannot parse nbdkit unix socket from uri: $uri\" >&2\n");
+        script.append("    exit 1\n");
+        script.append("  fi\n");
+        script.append("  echo \"$socket_path\"\n");
+        script.append("}\n");
+        script.append("nbd_socket_path=$(get_nbd_socket_path)\n");
+        if (directBlockTarget) {
+            // Local raw block device (e.g. Linstor/DRBD): copy each changed extent straight from the
+            // nbdkit source window into the same target window in a single qemu-img convert, avoiding
+            // the temporary-file round-trip the qemu-io path needs. -S 0 disables zero/sparse skipping
+            // so blocks the source cleared to zero are actually overwritten in the target (delta
+            // correctness); -n keeps the pre-created device.
+            script.append("copy_range() {\n");
+            script.append("  local range_start=\"$1\"\n");
+            script.append("  local range_length=\"$2\"\n");
+            script.append("  local source_opts=\"driver=raw,offset=$range_start,size=$range_length,file.driver=nbd,file.server.type=unix,file.server.path=$nbd_socket_path\"\n");
+            script.append("  local target_opts=\"driver=raw,offset=$range_start,size=$range_length,file.driver=host_device,file.filename=$target_path\"\n");
+            script.append("  qemu-img convert -n -S 0 --image-opts --target-image-opts \"$source_opts\" \"$target_opts\"\n");
+            script.append("}\n");
+        } else {
+            script.append("max_chunk_bytes=").append(DEFAULT_MAX_COPY_CHUNK_BYTES).append("\n");
+            script.append("tmp_dir=$(mktemp -d /var/tmp/cloudstack-cbt-").append(sanitizeFileName(cmd.getMigrationUuid()))
+                    .append("-").append(sanitizeFileName(disk.getDiskId())).append("-XXXXXX)\n");
+            script.append("cleanup() {\n");
+            script.append("  rm -rf \"$tmp_dir\"\n");
+            script.append("}\n");
+            script.append("trap cleanup EXIT\n");
+            script.append("copy_range() {\n");
+            script.append("  local range_start=\"$1\"\n");
+            script.append("  local range_length=\"$2\"\n");
+            script.append("  local current_start=\"$range_start\"\n");
+            script.append("  local remaining=\"$range_length\"\n");
+            script.append("  while (( remaining > 0 )); do\n");
+            script.append("    local chunk_length=\"$remaining\"\n");
+            script.append("    if (( chunk_length > max_chunk_bytes )); then\n");
+            script.append("      chunk_length=\"$max_chunk_bytes\"\n");
+            script.append("    fi\n");
+            script.append("    local chunk_file=\"$tmp_dir/range-${current_start}-${chunk_length}.raw\"\n");
+            script.append("    local source_opts=\"driver=raw,offset=$current_start,size=$chunk_length,file.driver=nbd,file.server.type=unix,file.server.path=$nbd_socket_path\"\n");
+            script.append("    qemu-img convert --image-opts -O raw \"$source_opts\" \"$chunk_file\" >/dev/null\n");
+            script.append("    qemu-io -f \"$target_format\" -c \"write -s $chunk_file $current_start $chunk_length\" \"$target_path\"\n");
+            script.append("    rm -f \"$chunk_file\"\n");
+            script.append("    remaining=$((remaining - chunk_length))\n");
+            script.append("    current_start=$((current_start + chunk_length))\n");
+            script.append("  done\n");
+            script.append("}\n");
+        }
+        for (VmwareCbtChangedBlockRangeTO changedBlock : diskPlan.getChangedBlocks()) {
+            script.append("copy_range ").append(changedBlock.getStartOffset()).append(" ")
+                    .append(changedBlock.getLength()).append("\n");
+        }
+        Files.writeString(scriptPath, script.toString());
+        setPosixFilePermissionsIfSupported(scriptPath, Set.of(PosixFilePermission.OWNER_READ,
+                PosixFilePermission.OWNER_WRITE, PosixFilePermission.OWNER_EXECUTE));
+        return scriptPath.toString();
+    }
+
+    private KVMStoragePool getTargetStoragePool(VmwareCbtSyncCommand cmd, KVMStoragePoolManager storagePoolMgr) {
+        Storage.StoragePoolType poolType = cmd.getDestinationStoragePoolType();
+        String poolUuid = StringUtils.trimToNull(cmd.getDestinationStoragePoolUuid());
+        if (poolType != null && StringUtils.isNotBlank(poolUuid)) {
+            KVMStoragePool pool = storagePoolMgr.getStoragePool(poolType, poolUuid);
+            if (pool == null) {
+                throw new IllegalArgumentException(String.format("destination storage pool %s/%s is not available on this host",
+                        poolType, poolUuid));
+            }
+            return pool;
+        }
+        return null;
+    }
+
+    private void validateRbdTargetPool(VmwareCbtSyncCommand cmd, KVMStoragePool targetPool) {
+        if (targetPool == null || targetPool.getType() != Storage.StoragePoolType.RBD) {
+            throw new IllegalArgumentException(String.format("VMware CBT migration %s requires an RBD destination storage pool for RBD target writing",
+                    cmd.getMigrationUuid()));
+        }
+    }
+
+    private void validateBlockDeviceTargetPool(VmwareCbtSyncCommand cmd, KVMStoragePool targetPool) {
+        if (targetPool == null || targetPool.getType() != Storage.StoragePoolType.Linstor) {
+            throw new IllegalArgumentException(String.format("VMware CBT migration %s requires a Linstor destination storage pool for block device target writing",
+                    cmd.getMigrationUuid()));
+        }
+    }
+
+    private String getQemuTargetPath(VmwareCbtSyncCommand cmd, VmwareCbtDiskTO disk, KVMStoragePool targetPool) {
+        if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RBD_RAW) {
+            return KVMPhysicalDisk.RBDStringBuilder(targetPool, getRbdImagePath(targetPool, disk.getTargetPath()));
+        }
+        if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE) {
+            return getBlockDevicePath(targetPool, disk);
+        }
+        return disk.getTargetPath();
+    }
+
+    private String getBlockDevicePath(KVMStoragePool targetPool, VmwareCbtDiskTO disk) {
+        String normalizedTargetPath = StringUtils.defaultString(disk.getTargetPath()).replace('\\', '/');
+        String volumeName = StringUtils.contains(normalizedTargetPath, "/") ?
+                StringUtils.substringAfterLast(normalizedTargetPath, "/") : normalizedTargetPath;
+        KVMPhysicalDisk targetDisk = targetPool.getPhysicalDisk(volumeName);
+        String devicePath = targetDisk == null ? null : targetDisk.getPath();
+        if (StringUtils.isBlank(devicePath)) {
+            throw new IllegalStateException(String.format("could not resolve a local device path for block device target volume %s of disk %s",
+                    volumeName, disk.getDiskId()));
+        }
+        return devicePath;
+    }
+
+    private String getTargetFormat(VmwareCbtSyncCommand cmd, VmwareCbtDiskTO disk) {
+        if (cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RBD_RAW ||
+                cmd.getTargetStorageType() == VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE) {
+            return "raw";
+        }
+        return StringUtils.defaultIfBlank(disk.getTargetFormat(), "qcow2");
+    }
+
+    private String getRbdImagePath(KVMStoragePool targetPool, String targetPath) {
+        String normalizedTargetPath = StringUtils.defaultString(targetPath).replace('\\', '/');
+        String imageName = StringUtils.contains(normalizedTargetPath, "/") ? StringUtils.substringAfterLast(normalizedTargetPath, "/") : normalizedTargetPath;
+        return String.format("%s/%s", StringUtils.removeEnd(targetPool.getSourceDir(), "/"), imageName);
+    }
+
+    private void setPosixFilePermissionsIfSupported(Path path, Set<PosixFilePermission> permissions) throws Exception {
+        try {
+            Files.setPosixFilePermissions(path, permissions);
+        } catch (UnsupportedOperationException e) {
+            logger.debug("POSIX file permissions are not supported for {}", path);
+        }
+    }
+
+    private String buildNbdkitDeltaSyncCommand(VmwareCbtSyncCommand cmd, VmwareCbtDiskTO disk,
+                                                String passwordFilePath, String vddkLibDir, String vddkThumbprint,
+                                                String vddkTransports, String scriptPath) {
+        RemoteInstanceTO sourceInstance = cmd.getSourceInstance();
+        String sourceVmMoref = getMorefValue(sourceInstance.getVmwareMoref());
+        String snapshotMoref = getMorefValue(cmd.getSnapshotMor());
+        StringBuilder nbdkit = new StringBuilder("nbdkit -r -U - vddk ");
+        appendPluginParameter(nbdkit, "file", disk.getSourceDiskPath());
+        appendPluginParameter(nbdkit, "server", sourceInstance.getVcenterHost());
+        appendPluginParameter(nbdkit, "user", sourceInstance.getVcenterUsername());
+        nbdkit.append("password=+").append(shellQuote(passwordFilePath)).append(" ");
+        nbdkit.append("vm=moref=").append(shellQuote(sourceVmMoref)).append(" ");
+        appendPluginParameter(nbdkit, "snapshot", snapshotMoref);
+        appendPluginParameter(nbdkit, "libdir", vddkLibDir);
+        appendPluginParameter(nbdkit, "thumbprint", vddkThumbprint);
+        if (StringUtils.isNotBlank(vddkTransports)) {
+            appendPluginParameter(nbdkit, "transports", vddkTransports);
+        }
+        String runCommand = String.format("export uri; bash %s", shellQuote(scriptPath));
+        return nbdkit.append("--run ").append(shellQuote(runCommand)).toString();
+    }
+
+    private void appendPluginParameter(StringBuilder command, String key, String value) {
+        command.append(key).append("=").append(shellQuote(value)).append(" ");
+    }
+
+    private long getDirtyRateBytesPerSecond(long changedBytes, long durationSeconds) {
+        if (durationSeconds <= 0) {
+            return changedBytes;
+        }
+        return changedBytes / durationSeconds;
+    }
+
+    private long getTimeout(VmwareCbtSyncCommand cmd) {
+        return Math.max(1L, cmd.getWait()) * 1000L;
+    }
+
+    private String getMorefValue(String moref) {
+        String value = StringUtils.trimToNull(moref);
+        if (value == null) {
+            return null;
+        }
+        return value.contains(":") ? StringUtils.substringAfter(value, ":") : value;
+    }
+
+    private String sanitizeFileName(String value) {
+        String sanitized = StringUtils.defaultIfBlank(value, "disk").replaceAll("[^A-Za-z0-9._-]", "-");
+        return StringUtils.defaultIfBlank(sanitized, "disk");
+    }
+
+    private String shellQuote(String value) {
+        return "'" + StringUtils.defaultString(value).replace("'", "'\"'\"'") + "'";
+    }
+
+    private String resolveVddkSetting(String commandValue, String agentValue) {
+        return StringUtils.defaultIfBlank(StringUtils.trimToNull(commandValue), StringUtils.trimToNull(agentValue));
+    }
+
+    protected VmwareCbtCommandResult executeLoggedBash(String command, long timeout, String logPrefix) {
+        Script script = new Script("/bin/bash", timeout, logger);
+        script.add("-c");
+        script.add(command);
+        VmwareCbtCommandOutputLogger outputLogger = new VmwareCbtCommandOutputLogger(logger, logPrefix);
+        script.execute(outputLogger);
+        return new VmwareCbtCommandResult(script.getExitValue(), outputLogger.getLastRelevantOutputLine());
+    }
+
+    protected String getVcenterThumbprint(String vcenterHost, long timeout, String sourceVmName) {
+        if (StringUtils.isBlank(vcenterHost)) {
+            return null;
+        }
+        String endpoint = String.format("%s:443", vcenterHost);
+        String command = String.format("openssl s_client -connect %s </dev/null 2>/dev/null | " +
+                "openssl x509 -fingerprint -sha1 -noout", shellQuote(endpoint));
+
+        Script script = new Script("/bin/bash", timeout, logger);
+        script.add("-c");
+        script.add(command);
+
+        OutputInterpreter.AllLinesParser parser = new OutputInterpreter.AllLinesParser();
+        script.execute(parser);
+
+        String output = parser.getLines();
+        if (script.getExitValue() != 0) {
+            logger.error("({}) Failed to fetch vCenter thumbprint for {}", sourceVmName, vcenterHost);
+            return null;
+        }
+
+        return extractSha1Fingerprint(output);
+    }
+
+    private String extractSha1Fingerprint(String output) {
+        String parsedOutput = StringUtils.trimToEmpty(output);
+        if (StringUtils.isBlank(parsedOutput)) {
+            return null;
+        }
+
+        for (String line : parsedOutput.split("\\R")) {
+            String trimmedLine = StringUtils.trimToEmpty(line);
+            if (StringUtils.isBlank(trimmedLine)) {
+                continue;
+            }
+
+            Matcher matcher = SHA1_FINGERPRINT_PATTERN.matcher(trimmedLine);
+            if (matcher.find()) {
+                return matcher.group(1).toUpperCase(Locale.ROOT);
+            }
+
+            if (trimmedLine.matches("(?i)[0-9a-f]{2}(:[0-9a-f]{2})+")) {
+                return trimmedLine.toUpperCase(Locale.ROOT);
+            }
+        }
+        return null;
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/VmwareCbtCommandOutputLogger.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/VmwareCbtCommandOutputLogger.java
new file mode 100644
index 000000000000..2825e9c52a19
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/VmwareCbtCommandOutputLogger.java
@@ -0,0 +1,83 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.util.regex.Pattern;
+
+import org.apache.commons.lang3.StringUtils;
+import org.apache.logging.log4j.Logger;
+
+import com.cloud.utils.script.OutputInterpreter;
+
+class VmwareCbtCommandOutputLogger extends OutputInterpreter {
+
+    private static final Pattern PASSWORD_ARGUMENT_PATTERN = Pattern.compile("(?i)(password=)([^\\s]+)");
+
+    private final Logger logger;
+    private final String logPrefix;
+    private String lastOutputLine;
+    private String lastImportantOutputLine;
+
+    VmwareCbtCommandOutputLogger(Logger logger, String logPrefix) {
+        this.logger = logger;
+        this.logPrefix = logPrefix;
+    }
+
+    @Override
+    public boolean drain() {
+        return true;
+    }
+
+    @Override
+    public String interpret(BufferedReader reader) throws IOException {
+        String line;
+        while ((line = reader.readLine()) != null) {
+            String safeLine = sanitize(line);
+            logger.info(StringUtils.isNotBlank(logPrefix) ? String.format("%s %s", logPrefix, safeLine) : safeLine);
+            captureOutputLine(safeLine);
+        }
+        return null;
+    }
+
+    String getLastRelevantOutputLine() {
+        return StringUtils.defaultIfBlank(lastImportantOutputLine, lastOutputLine);
+    }
+
+    private void captureOutputLine(String line) {
+        String trimmedLine = StringUtils.trimToNull(line);
+        if (trimmedLine == null) {
+            return;
+        }
+        lastOutputLine = trimmedLine;
+        if (isImportantOutputLine(trimmedLine)) {
+            lastImportantOutputLine = trimmedLine;
+        }
+    }
+
+    private boolean isImportantOutputLine(String line) {
+        String lowerCaseLine = StringUtils.lowerCase(line);
+        return StringUtils.containsAny(lowerCaseLine,
+                "error", "failed", "unable", "cannot", "permission denied", "no such file",
+                "not found", "file is empty", "traceback", "exception");
+    }
+
+    private String sanitize(String line) {
+        return PASSWORD_ARGUMENT_PATTERN.matcher(StringUtils.defaultString(line)).replaceAll("$1******");
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/VmwareCbtCommandResult.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/VmwareCbtCommandResult.java
new file mode 100644
index 000000000000..184c6f3111f9
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/VmwareCbtCommandResult.java
@@ -0,0 +1,41 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import org.apache.commons.lang3.StringUtils;
+
+class VmwareCbtCommandResult {
+
+    private final int exitValue;
+    private final String lastCommandOutput;
+
+    VmwareCbtCommandResult(int exitValue, String lastCommandOutput) {
+        this.exitValue = exitValue;
+        this.lastCommandOutput = lastCommandOutput;
+    }
+
+    int getExitValue() {
+        return exitValue;
+    }
+
+    String appendLastCommandOutput(String details) {
+        if (StringUtils.isBlank(lastCommandOutput) || StringUtils.contains(details, lastCommandOutput)) {
+            return details;
+        }
+        return String.format("%s Last command output: %s", details, lastCommandOutput);
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/VmwareCbtSyncPlan.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/VmwareCbtSyncPlan.java
new file mode 100644
index 000000000000..458b5e6bba60
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/VmwareCbtSyncPlan.java
@@ -0,0 +1,273 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.agent.api.to.VmwareCbtChangedBlockRangeTO;
+import com.cloud.agent.api.to.VmwareCbtDiskTO;
+
+class VmwareCbtSyncPlan {
+
+    private final boolean valid;
+    private final String validationError;
+    private final List<DiskPlan> diskPlans;
+    private final int changedRangeCount;
+    private final int copyRangeCount;
+    private final long changedBytes;
+
+    private VmwareCbtSyncPlan(boolean valid, String validationError, List<DiskPlan> diskPlans,
+                              int changedRangeCount, int copyRangeCount, long changedBytes) {
+        this.valid = valid;
+        this.validationError = validationError;
+        this.diskPlans = diskPlans;
+        this.changedRangeCount = changedRangeCount;
+        this.copyRangeCount = copyRangeCount;
+        this.changedBytes = changedBytes;
+    }
+
+    static VmwareCbtSyncPlan create(List<VmwareCbtDiskTO> disks, List<VmwareCbtChangedBlockRangeTO> changedBlocks) {
+        if (CollectionUtils.isEmpty(changedBlocks)) {
+            return new VmwareCbtSyncPlan(true, null, Collections.emptyList(), 0, 0, 0);
+        }
+
+        Map<String, DiskPlanBuilder> diskPlansById = getDiskPlansById(disks);
+        int changedRangeCount = 0;
+
+        for (VmwareCbtChangedBlockRangeTO changedBlock : changedBlocks) {
+            ValidationResult validationResult = validateChangedBlock(changedBlock, diskPlansById);
+            if (!validationResult.valid) {
+                return invalid(validationResult.error);
+            }
+
+            DiskPlanBuilder diskPlan = diskPlansById.get(changedBlock.getDiskId());
+            long rangeEnd = changedBlock.getStartOffset() + changedBlock.getLength();
+            if (rangeEnd < changedBlock.getStartOffset()) {
+                return invalid(String.format("Changed block range for disk %s overflows the virtual disk address space.",
+                        changedBlock.getDiskId()));
+            }
+            if (diskPlan.disk.getCapacityBytes() > 0 && rangeEnd > diskPlan.disk.getCapacityBytes()) {
+                return invalid(String.format("Changed block range for disk %s exceeds disk capacity.", changedBlock.getDiskId()));
+            }
+
+            diskPlan.addChangedBlock(changedBlock);
+            changedRangeCount++;
+        }
+
+        List<DiskPlan> diskPlans = getPopulatedDiskPlans(diskPlansById);
+        long changedBytes = 0;
+        int copyRangeCount = 0;
+        for (DiskPlan diskPlan : diskPlans) {
+            changedBytes += diskPlan.getChangedBytes();
+            copyRangeCount += diskPlan.getChangedBlocks().size();
+        }
+
+        return new VmwareCbtSyncPlan(true, null, diskPlans, changedRangeCount, copyRangeCount, changedBytes);
+    }
+
+    private static Map<String, DiskPlanBuilder> getDiskPlansById(List<VmwareCbtDiskTO> disks) {
+        Map<String, DiskPlanBuilder> diskPlansById = new LinkedHashMap<>();
+        if (CollectionUtils.isEmpty(disks)) {
+            return diskPlansById;
+        }
+
+        for (VmwareCbtDiskTO disk : disks) {
+            if (disk != null && StringUtils.isNotBlank(disk.getDiskId())) {
+                diskPlansById.put(disk.getDiskId(), new DiskPlanBuilder(disk));
+            }
+        }
+        return diskPlansById;
+    }
+
+    private static ValidationResult validateChangedBlock(VmwareCbtChangedBlockRangeTO changedBlock,
+                                                         Map<String, DiskPlanBuilder> diskPlansById) {
+        if (changedBlock == null) {
+            return ValidationResult.invalid("Changed block range cannot be null.");
+        }
+        if (StringUtils.isBlank(changedBlock.getDiskId())) {
+            return ValidationResult.invalid("Changed block range is missing a disk id.");
+        }
+
+        DiskPlanBuilder diskPlan = diskPlansById.get(changedBlock.getDiskId());
+        if (diskPlan == null) {
+            return ValidationResult.invalid(String.format("Changed block range references unknown disk %s.", changedBlock.getDiskId()));
+        }
+        if (StringUtils.isBlank(diskPlan.disk.getTargetPath())) {
+            return ValidationResult.invalid(String.format("Changed block range references disk %s, but no target path is known. " +
+                    "The initial full sync must create and persist the KVM target disk before CBT delta sync can run.",
+                    changedBlock.getDiskId()));
+        }
+        if (changedBlock.getStartOffset() < 0) {
+            return ValidationResult.invalid(String.format("Changed block range for disk %s has a negative start offset.",
+                    changedBlock.getDiskId()));
+        }
+        if (changedBlock.getLength() <= 0) {
+            return ValidationResult.invalid(String.format("Changed block range for disk %s has a non-positive length.",
+                    changedBlock.getDiskId()));
+        }
+
+        return ValidationResult.valid();
+    }
+
+    private static List<DiskPlan> getPopulatedDiskPlans(Map<String, DiskPlanBuilder> diskPlansById) {
+        List<DiskPlan> diskPlans = new ArrayList<>();
+        for (DiskPlanBuilder diskPlan : diskPlansById.values()) {
+            if (CollectionUtils.isNotEmpty(diskPlan.changedBlocks)) {
+                diskPlans.add(diskPlan.build());
+            }
+        }
+        return diskPlans;
+    }
+
+    private static VmwareCbtSyncPlan invalid(String validationError) {
+        return new VmwareCbtSyncPlan(false, validationError, Collections.emptyList(), 0, 0, 0);
+    }
+
+    boolean isValid() {
+        return valid;
+    }
+
+    String getValidationError() {
+        return validationError;
+    }
+
+    List<DiskPlan> getDiskPlans() {
+        return diskPlans;
+    }
+
+    int getChangedRangeCount() {
+        return changedRangeCount;
+    }
+
+    int getCopyRangeCount() {
+        return copyRangeCount;
+    }
+
+    long getChangedBytes() {
+        return changedBytes;
+    }
+
+    static class DiskPlan {
+
+        private final VmwareCbtDiskTO disk;
+        private final List<VmwareCbtChangedBlockRangeTO> changedBlocks;
+        private final long changedBytes;
+
+        DiskPlan(VmwareCbtDiskTO disk, List<VmwareCbtChangedBlockRangeTO> changedBlocks, long changedBytes) {
+            this.disk = disk;
+            this.changedBlocks = Collections.unmodifiableList(changedBlocks);
+            this.changedBytes = changedBytes;
+        }
+
+        VmwareCbtDiskTO getDisk() {
+            return disk;
+        }
+
+        List<VmwareCbtChangedBlockRangeTO> getChangedBlocks() {
+            return changedBlocks;
+        }
+
+        long getChangedBytes() {
+            return changedBytes;
+        }
+    }
+
+    private static class DiskPlanBuilder {
+
+        private final VmwareCbtDiskTO disk;
+        private final List<VmwareCbtChangedBlockRangeTO> changedBlocks = new ArrayList<>();
+
+        DiskPlanBuilder(VmwareCbtDiskTO disk) {
+            this.disk = disk;
+        }
+
+        void addChangedBlock(VmwareCbtChangedBlockRangeTO changedBlock) {
+            changedBlocks.add(changedBlock);
+        }
+
+        DiskPlan build() {
+            List<VmwareCbtChangedBlockRangeTO> copyBlocks = coalesceChangedBlocks(changedBlocks);
+            return new DiskPlan(disk, copyBlocks, sumChangedBytes(copyBlocks));
+        }
+
+        private List<VmwareCbtChangedBlockRangeTO> coalesceChangedBlocks(List<VmwareCbtChangedBlockRangeTO> changedBlocks) {
+            if (CollectionUtils.isEmpty(changedBlocks)) {
+                return Collections.emptyList();
+            }
+
+            List<VmwareCbtChangedBlockRangeTO> sortedBlocks = new ArrayList<>(changedBlocks);
+            sortedBlocks.sort(Comparator.comparingLong(VmwareCbtChangedBlockRangeTO::getStartOffset)
+                    .thenComparingLong(VmwareCbtChangedBlockRangeTO::getLength));
+
+            List<VmwareCbtChangedBlockRangeTO> copyBlocks = new ArrayList<>();
+            String diskId = disk.getDiskId();
+            long currentStart = sortedBlocks.get(0).getStartOffset();
+            long currentEnd = currentStart + sortedBlocks.get(0).getLength();
+
+            for (int i = 1; i < sortedBlocks.size(); i++) {
+                VmwareCbtChangedBlockRangeTO changedBlock = sortedBlocks.get(i);
+                long blockStart = changedBlock.getStartOffset();
+                long blockEnd = blockStart + changedBlock.getLength();
+                if (blockStart <= currentEnd) {
+                    currentEnd = Math.max(currentEnd, blockEnd);
+                    continue;
+                }
+
+                copyBlocks.add(new VmwareCbtChangedBlockRangeTO(diskId, currentStart, currentEnd - currentStart));
+                currentStart = blockStart;
+                currentEnd = blockEnd;
+            }
+            copyBlocks.add(new VmwareCbtChangedBlockRangeTO(diskId, currentStart, currentEnd - currentStart));
+            return copyBlocks;
+        }
+
+        private long sumChangedBytes(List<VmwareCbtChangedBlockRangeTO> changedBlocks) {
+            long changedBytes = 0;
+            for (VmwareCbtChangedBlockRangeTO changedBlock : changedBlocks) {
+                changedBytes += changedBlock.getLength();
+            }
+            return changedBytes;
+        }
+    }
+
+    private static class ValidationResult {
+
+        private final boolean valid;
+        private final String error;
+
+        private ValidationResult(boolean valid, String error) {
+            this.valid = valid;
+            this.error = error;
+        }
+
+        static ValidationResult valid() {
+            return new ValidationResult(true, null);
+        }
+
+        static ValidationResult invalid(String error) {
+            return new ValidationResult(false, error);
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStoragePool.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStoragePool.java
index a8207cec3fa6..18aed95b0587 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStoragePool.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStoragePool.java
@@ -24,6 +24,7 @@
 import com.cloud.agent.properties.AgentPropertiesFileHandler;
 import com.cloud.hypervisor.kvm.resource.LibvirtVMDef;
 import org.apache.cloudstack.utils.qemu.QemuImg.PhysicalDiskFormat;
+import org.apache.cloudstack.storage.volume.VolumeOnStorageTO;
 import org.joda.time.Duration;
 
 import com.cloud.agent.api.to.HostTO;
@@ -56,6 +57,11 @@ default KVMPhysicalDisk createPhysicalDisk(String volumeUuid, PhysicalDiskFormat
 
     List<KVMPhysicalDisk> listPhysicalDisks();
 
+    /** Read-only backend import metadata; null path requests all volumes in this pool. */
+    default List<VolumeOnStorageTO> getVolumesForImport(String path) {
+        throw new UnsupportedOperationException("Backend import metadata is not supported by this storage pool");
+    }
+
     String getUuid();
 
     long getCapacity();
@@ -74,6 +80,43 @@ default Long getUsedIops() {
 
     boolean refresh();
 
+    /**
+     * Whether a freshly created volume on this pool is guaranteed to read back as
+     * all zeros. Callers that skip writing zero blocks into a pre-created target
+     * (e.g. qemu-img convert --target-is-zero / nbdcopy --destination-is-zero) must
+     * only do so when this returns true; block backends that do not zero-initialize
+     * new volumes (e.g. LVM-thick) return false so those callers write the zeros and
+     * do not leak stale data from previously deleted volumes into unwritten regions.
+     * Defaults to false so any backend that has not opted in is treated as unsafe.
+     */
+    default boolean isVolumeZeroInitialized(String volumeName) {
+        return false;
+    }
+
+    /**
+     * Returned by {@link #getVolumeInUseNode(String)} when the backend could not tell us
+     * whether the volume is in use. Callers must fail closed and treat it as "in use":
+     * adopting a clustered volume that is actually attached elsewhere would give it two writers.
+     */
+    String IN_USE_NODE_UNKNOWN = "<unknown>";
+
+    /**
+     * For clustered block storage whose host-local file lock is not authoritative
+     * (e.g. Linstor/DRBD), returns the node name on which the given volume is currently
+     * in use — attached to a running VM anywhere in the cluster — or null if not in use.
+     * Adoption/import callers treat a non-null result as "locked".
+     *
+     * Implementations that cannot establish the cluster-wide state (controller unreachable,
+     * empty or malformed response) must return {@link #IN_USE_NODE_UNKNOWN} rather than null,
+     * so the ambiguity is not silently read as "free".
+     *
+     * Defaults to null so the host-local qemu-img lock remains the sole in-use signal for
+     * other pool types.
+     */
+    default String getVolumeInUseNode(String volumeName) {
+        return null;
+    }
+
     boolean isExternalSnapshot();
 
     String getLocalPath();
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStoragePool.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStoragePool.java
index a8c32baa6ef3..7a70f2497cda 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStoragePool.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStoragePool.java
@@ -17,6 +17,7 @@
 package com.cloud.hypervisor.kvm.storage;
 
 import java.io.File;
+import java.io.IOException;
 import java.util.List;
 import java.util.Map;
 
@@ -173,9 +174,9 @@ public KVMPhysicalDisk getPhysicalDisk(String volumeUid) {
         logger.debug("find volume bypass libvirt volumeUid " + volumeUid);
         //For network file system or file system, try to use java file to find the volume, instead of through libvirt. BUG:CLOUDSTACK-4459
         String localPoolPath = this.getLocalPath();
-        File f = new File(localPoolPath + File.separator + volumeUuid);
+        File f = resolvePhysicalDiskFile(localPoolPath, volumeUid, volumeUuid);
         if (!f.exists()) {
-            logger.debug("volume: " + volumeUuid + " not exist on storage pool");
+            logger.debug("volume: " + volumeUid + " not exist on storage pool");
             throw new CloudRuntimeException("Can't find volume:" + volumeUuid);
         }
         disk = new KVMPhysicalDisk(f.getPath(), volumeUuid, this);
@@ -186,6 +187,32 @@ public KVMPhysicalDisk getPhysicalDisk(String volumeUid) {
         return disk;
     }
 
+    File resolvePhysicalDiskFile(String localPoolPath, String volumeUid, String volumeUuid) {
+        File poolPath = new File(localPoolPath);
+        if (volumeUid.contains("/") && !new File(volumeUid).isAbsolute()) {
+            File nestedVolume = new File(poolPath, volumeUid);
+            if (isFileInStoragePool(poolPath, nestedVolume)) {
+                return nestedVolume;
+            }
+            logger.warn(String.format("Relative volume path [%s] resolves outside storage pool [%s]. Falling back to volume name lookup.",
+                    volumeUid, localPoolPath));
+        }
+        return new File(poolPath, volumeUuid);
+    }
+
+    private boolean isFileInStoragePool(File poolPath, File volumePath) {
+        try {
+            String canonicalPoolPath = poolPath.getCanonicalPath();
+            String canonicalVolumePath = volumePath.getCanonicalPath();
+            return canonicalVolumePath.equals(canonicalPoolPath) ||
+                    canonicalVolumePath.startsWith(canonicalPoolPath + File.separator);
+        } catch (IOException e) {
+            logger.warn(String.format("Unable to resolve storage pool path [%s] or volume path [%s].",
+                    poolPath, volumePath), e);
+            return false;
+        }
+    }
+
     @Override
     public boolean connectPhysicalDisk(String name, Map<String, String> details) {
         return true;
diff --git a/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/utils/qemu/QemuImg.java b/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/utils/qemu/QemuImg.java
index 49f531ed7c11..655d0e19b173 100644
--- a/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/utils/qemu/QemuImg.java
+++ b/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/utils/qemu/QemuImg.java
@@ -134,28 +134,44 @@ public enum BitmapOperation {
      */
     public QemuImg(final long timeout, final boolean skipZeroIfSupported, final boolean noCache) throws LibvirtException {
         if (skipZeroIfSupported) {
-            final Script s = new Script(_qemuImgPath, timeout);
-            s.add("--help");
-
-            final OutputInterpreter.AllLinesParser parser = new OutputInterpreter.AllLinesParser();
-            final String result = s.execute(parser);
-
-            // Older Qemu returns output in result due to --help reporting error status
-            if (result != null) {
-                if (result.contains(TARGET_ZERO_FLAG)) {
-                    this.skipZero = true;
-                }
-            } else {
-                if (parser.getLines().contains(TARGET_ZERO_FLAG)) {
-                    this.skipZero = true;
-                }
-            }
+            this.skipZero = isTargetZeroFlagSupported(timeout);
         }
         this.timeout = timeout;
         this.noCache = noCache;
         this.version = LibvirtConnection.getConnection().getVersion();
     }
 
+    /**
+     * Detects support for the convert --target-is-zero flag. The flag used to be
+     * discovered via "qemu-img --help", but newer qemu (observed with 10.x on EL9)
+     * no longer lists it in the help text while still supporting it - which
+     * silently disabled zero-skipping and fully allocated thin block-device
+     * targets. Probe the option directly instead: a recognized option fails with
+     * "--target-is-zero requires use of -n flag", an unknown one with
+     * "unrecognized option".
+     */
+    private boolean isTargetZeroFlagSupported(final long timeout) {
+        // Fast path for older qemu that documents the flag in --help.
+        final Script help = new Script(_qemuImgPath, timeout);
+        help.add("--help");
+        final OutputInterpreter.AllLinesParser helpParser = new OutputInterpreter.AllLinesParser();
+        final String helpResult = help.execute(helpParser);
+        final String helpOutput = (helpResult != null ? helpResult : "") + StringUtils.defaultString(helpParser.getLines());
+        if (helpOutput.contains(TARGET_ZERO_FLAG)) {
+            return true;
+        }
+
+        final Script probe = new Script(_qemuImgPath, timeout);
+        probe.add("convert");
+        probe.add(TARGET_ZERO_FLAG);
+        final OutputInterpreter.AllLinesParser probeParser = new OutputInterpreter.AllLinesParser();
+        final String probeResult = probe.execute(probeParser);
+        final String probeOutput = (probeResult != null ? probeResult : "") + StringUtils.defaultString(probeParser.getLines());
+        return probeOutput.contains(TARGET_ZERO_FLAG)
+                && !probeOutput.contains("unrecognized option")
+                && !probeOutput.contains("invalid option");
+    }
+
     /**
      * Creates a QemuImg object.
      *
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java
index 008d9444fe5f..33fb377bc90e 100644
--- a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java
@@ -7244,6 +7244,38 @@ public void parseCpuFeaturesTestReturnListOfCpuFeaturesAndIgnoreMultipleWhitespa
         Assert.assertEquals("hle", cpuFeatures.get(3));
     }
 
+    @Test
+    public void parseVddkLibraryVersionFromDumpPluginOutputReturnsLibraryVersion() {
+        String output = "vddk_default_libdir=/usr/lib64/vmware-vix-disklib\n" +
+                "vddk_library_version=8\n" +
+                "vddk_transport_modes=file:san:hotadd:nbdssl:nbd\n";
+
+        Assert.assertEquals("8", libvirtComputingResourceSpy.parseVddkLibraryVersionFromDumpPluginOutput(output));
+    }
+
+    @Test
+    public void parseVddkLibraryVersionFromDumpPluginOutputIgnoresPluginVersionWithoutLoadedLibrary() {
+        String output = "nbdkit 1.24.0\n" +
+                "vddk 1.24.0\n" +
+                "vddk_default_libdir=/usr/lib64/vmware-vix-disklib\n";
+
+        Assert.assertNull(libvirtComputingResourceSpy.parseVddkLibraryVersionFromDumpPluginOutput(output));
+    }
+
+    @Test
+    public void isNbdkitVddkPluginUsableRequiresLoadedVddkLibrary() throws IOException {
+        Path vddkDir = Files.createTempDirectory("vddk-test");
+        Files.createDirectories(vddkDir.resolve("lib64"));
+        Files.createFile(vddkDir.resolve("lib64/libvixDiskLib.so.8"));
+        Mockito.doReturn("vddk_library_version=8\n").when(libvirtComputingResourceSpy).runNbdkitVddkDumpPlugin(vddkDir.toString());
+
+        Assert.assertTrue(libvirtComputingResourceSpy.isNbdkitVddkPluginUsable(vddkDir.toString()));
+
+        Mockito.doReturn("nbdkit: error: libssl.so.3: cannot open shared object file\n").when(libvirtComputingResourceSpy).runNbdkitVddkDumpPlugin(vddkDir.toString());
+
+        Assert.assertFalse(libvirtComputingResourceSpy.isNbdkitVddkPluginUsable(vddkDir.toString()));
+    }
+
     @Test
     public void defineDiskForDefaultPoolTypeSkipsForceDiskController() {
         Map<String, String> details = new HashMap<>();
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckConvertInstanceCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckConvertInstanceCommandWrapperTest.java
index 74090723331a..f918d85b2a06 100644
--- a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckConvertInstanceCommandWrapperTest.java
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckConvertInstanceCommandWrapperTest.java
@@ -78,6 +78,57 @@ public void testCheckInstanceCommand_vddkSuccess() {
         assertTrue(answer.getResult());
     }
 
+    @Test
+    public void testCheckInstanceCommand_vddkDirectRbdSuccess() {
+        Mockito.when(checkConvertInstanceCommandMock.isUseVddk()).thenReturn(true);
+        Mockito.when(checkConvertInstanceCommandMock.isCheckVddkRbdDirectImportSupport()).thenReturn(true);
+        Mockito.when(checkConvertInstanceCommandMock.getVddkLibDir()).thenReturn("/opt/vmware-vddk/vmware-vix-disklib-distrib");
+        Mockito.when(libvirtComputingResourceMock.hostSupportsVddkRbdDirectImport("/opt/vmware-vddk/vmware-vix-disklib-distrib")).thenReturn(true);
+        Mockito.when(libvirtComputingResourceMock.hostSupportsVddk("/opt/vmware-vddk/vmware-vix-disklib-distrib")).thenReturn(true);
+
+        Answer answer = checkConvertInstanceCommandWrapper.execute(checkConvertInstanceCommandMock, libvirtComputingResourceMock);
+
+        assertTrue(answer.getResult());
+    }
+
+    @Test
+    public void testCheckInstanceCommand_vddkDirectRbdFailure() {
+        Mockito.when(checkConvertInstanceCommandMock.isUseVddk()).thenReturn(true);
+        Mockito.when(checkConvertInstanceCommandMock.isCheckVddkRbdDirectImportSupport()).thenReturn(true);
+        Mockito.when(checkConvertInstanceCommandMock.getVddkLibDir()).thenReturn("/opt/vmware-vddk/vmware-vix-disklib-distrib");
+        Mockito.when(libvirtComputingResourceMock.hostSupportsVddkRbdDirectImport("/opt/vmware-vddk/vmware-vix-disklib-distrib")).thenReturn(false);
+
+        Answer answer = checkConvertInstanceCommandWrapper.execute(checkConvertInstanceCommandMock, libvirtComputingResourceMock);
+
+        assertFalse(answer.getResult());
+        assertTrue(StringUtils.isNotBlank(answer.getDetails()));
+    }
+
+    @Test
+    public void testCheckInstanceCommand_vddkInPlaceFinalizationSuccess() {
+        Mockito.when(checkConvertInstanceCommandMock.isUseVddk()).thenReturn(true);
+        Mockito.when(checkConvertInstanceCommandMock.isCheckVddkInPlaceFinalizationSupport()).thenReturn(true);
+        Mockito.when(checkConvertInstanceCommandMock.getVddkLibDir()).thenReturn("/opt/vmware-vddk/vmware-vix-disklib-distrib");
+        Mockito.when(libvirtComputingResourceMock.hostSupportsVirtV2vInPlace()).thenReturn(true);
+        Mockito.when(libvirtComputingResourceMock.hostSupportsVddk("/opt/vmware-vddk/vmware-vix-disklib-distrib")).thenReturn(true);
+
+        Answer answer = checkConvertInstanceCommandWrapper.execute(checkConvertInstanceCommandMock, libvirtComputingResourceMock);
+
+        assertTrue(answer.getResult());
+    }
+
+    @Test
+    public void testCheckInstanceCommand_vddkInPlaceFinalizationFailure() {
+        Mockito.when(checkConvertInstanceCommandMock.isUseVddk()).thenReturn(true);
+        Mockito.when(checkConvertInstanceCommandMock.isCheckVddkInPlaceFinalizationSupport()).thenReturn(true);
+        Mockito.when(libvirtComputingResourceMock.hostSupportsVirtV2vInPlace()).thenReturn(false);
+
+        Answer answer = checkConvertInstanceCommandWrapper.execute(checkConvertInstanceCommandMock, libvirtComputingResourceMock);
+
+        assertFalse(answer.getResult());
+        assertTrue(StringUtils.isNotBlank(answer.getDetails()));
+    }
+
     @Test
     public void testCheckInstanceCommand_vddkFailure() {
         Mockito.when(checkConvertInstanceCommandMock.isUseVddk()).thenReturn(true);
@@ -89,4 +140,18 @@ public void testCheckInstanceCommand_vddkFailure() {
         assertFalse(answer.getResult());
         assertTrue(StringUtils.isNotBlank(answer.getDetails()));
     }
+
+    @Test
+    public void testCheckInstanceCommand_windowsGuestConversionFailure() {
+        Mockito.when(checkConvertInstanceCommandMock.isUseVddk()).thenReturn(true);
+        Mockito.when(checkConvertInstanceCommandMock.getVddkLibDir()).thenReturn("/opt/vmware-vddk/vmware-vix-disklib-distrib");
+        Mockito.when(checkConvertInstanceCommandMock.getCheckWindowsGuestConversionSupport()).thenReturn(true);
+        Mockito.when(libvirtComputingResourceMock.hostSupportsVddk("/opt/vmware-vddk/vmware-vix-disklib-distrib")).thenReturn(true);
+        Mockito.when(libvirtComputingResourceMock.hostSupportsWindowsGuestConversion()).thenReturn(false);
+
+        Answer answer = checkConvertInstanceCommandWrapper.execute(checkConvertInstanceCommandMock, libvirtComputingResourceMock);
+
+        assertFalse(answer.getResult());
+        assertTrue(answer.getDetails().contains("virtio-win"));
+    }
 }
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckVolumeCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckVolumeCommandWrapperTest.java
new file mode 100644
index 000000000000..5c113bdb4915
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckVolumeCommandWrapperTest.java
@@ -0,0 +1,238 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.CheckVolumeAnswer;
+import com.cloud.agent.api.CheckVolumeCommand;
+import com.cloud.agent.api.to.StorageFilerTO;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.storage.Storage;
+import org.apache.cloudstack.storage.volume.VolumeOnStorageTO;
+import org.apache.cloudstack.utils.qemu.QemuImg;
+import org.apache.cloudstack.utils.qemu.QemuImgFile;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.MockedConstruction;
+import org.mockito.Mockito;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import java.util.HashMap;
+import java.util.Map;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtCheckVolumeCommandWrapperTest {
+
+    @Mock
+    LibvirtComputingResource libvirtComputingResource;
+    @Mock
+    KVMStoragePoolManager storagePoolMgr;
+    @Mock
+    KVMStoragePool storagePool;
+    @Mock
+    StorageFilerTO storageFilerTO;
+    @Mock
+    KVMPhysicalDisk disk;
+
+    @Spy
+    LibvirtCheckVolumeCommandWrapper wrapper = new LibvirtCheckVolumeCommandWrapper();
+
+    MockedConstruction<QemuImg> qemuImg;
+
+    private final String poolUuid = "pool-uuid";
+    private final String srcFile = "rbd-volume-uuid";
+    private final long virtualSize = 21474836480L; // 20 GiB
+
+    private Map<String, String> qemuInfo;
+
+    @Before
+    public void setUp() {
+        qemuInfo = new HashMap<>();
+        qemuInfo.put(QemuImg.FILE_FORMAT, "raw");
+        Mockito.when(libvirtComputingResource.getStoragePoolMgr()).thenReturn(storagePoolMgr);
+    }
+
+    @After
+    public void tearDown() {
+        if (qemuImg != null) {
+            qemuImg.close();
+        }
+    }
+
+    private void mockRbdPool() {
+        Mockito.when(storageFilerTO.getType()).thenReturn(Storage.StoragePoolType.RBD);
+        Mockito.when(storageFilerTO.getUuid()).thenReturn(poolUuid);
+        Mockito.when(storagePoolMgr.getStoragePool(Storage.StoragePoolType.RBD, poolUuid)).thenReturn(storagePool);
+        Mockito.when(storagePool.getType()).thenReturn(Storage.StoragePoolType.RBD);
+        Mockito.when(storagePool.getPhysicalDisk(srcFile)).thenReturn(disk);
+        Mockito.when(disk.getPath()).thenReturn(srcFile);
+        Mockito.when(disk.getFormat()).thenReturn(QemuImg.PhysicalDiskFormat.RAW);
+        // values consumed by KVMPhysicalDisk.RBDStringBuilder when building the RBD URI
+        Mockito.when(storagePool.getSourceHost()).thenReturn("10.0.0.10");
+        Mockito.when(storagePool.getSourcePort()).thenReturn(6789);
+        Mockito.when(storagePool.getAuthUserName()).thenReturn(null);
+        Mockito.when(storagePool.getDetails()).thenReturn(null);
+    }
+
+    private void mockLinstorPool() {
+        Mockito.when(storageFilerTO.getType()).thenReturn(Storage.StoragePoolType.Linstor);
+        Mockito.when(storageFilerTO.getUuid()).thenReturn(poolUuid);
+        Mockito.when(storagePoolMgr.getStoragePool(Storage.StoragePoolType.Linstor, poolUuid)).thenReturn(storagePool);
+
+    }
+
+    private CheckVolumeCommand buildCommand() {
+        CheckVolumeCommand command = new CheckVolumeCommand();
+        command.setSrcFile(srcFile);
+        command.setStorageFilerTO(storageFilerTO);
+        return command;
+    }
+
+    @Test
+    public void testRbdVolumeReturnsSuccessWithVirtualSizeAndDetails() {
+        mockRbdPool();
+        Mockito.when(disk.getVirtualSize()).thenReturn(virtualSize);
+        qemuImg = Mockito.mockConstruction(QemuImg.class, (mock, context) ->
+                Mockito.when(mock.info(Mockito.any(QemuImgFile.class), Mockito.anyBoolean())).thenReturn(qemuInfo));
+
+        Answer answer = wrapper.execute(buildCommand(), libvirtComputingResource);
+
+        Assert.assertTrue(answer instanceof CheckVolumeAnswer);
+        Assert.assertTrue(answer.getResult());
+        CheckVolumeAnswer checkVolumeAnswer = (CheckVolumeAnswer) answer;
+        Assert.assertEquals(virtualSize, checkVolumeAnswer.getSize());
+        Map<VolumeOnStorageTO.Detail, String> details = checkVolumeAnswer.getVolumeDetails();
+        Assert.assertNotNull(details);
+        Assert.assertEquals("raw", details.get(VolumeOnStorageTO.Detail.FILE_FORMAT));
+        Assert.assertEquals("false", details.get(VolumeOnStorageTO.Detail.IS_LOCKED));
+    }
+
+    @Test
+    public void testRbdVolumeInspectedThroughRbdUri() throws Exception {
+        mockRbdPool();
+        Mockito.when(disk.getVirtualSize()).thenReturn(virtualSize);
+        qemuImg = Mockito.mockConstruction(QemuImg.class, (mock, context) ->
+                Mockito.when(mock.info(Mockito.any(QemuImgFile.class), Mockito.anyBoolean())).thenReturn(qemuInfo));
+
+        wrapper.execute(buildCommand(), libvirtComputingResource);
+
+        ArgumentCaptor<QemuImgFile> fileCaptor = ArgumentCaptor.forClass(QemuImgFile.class);
+        Mockito.verify(qemuImg.constructed().get(0), Mockito.atLeastOnce())
+                .info(fileCaptor.capture(), Mockito.anyBoolean());
+        Assert.assertTrue("qemu-img should be pointed at the RBD URI",
+                fileCaptor.getValue().getFileName().startsWith("rbd:" + srcFile));
+    }
+
+    @Test
+    public void testLinstorVolumeUsesControllerMetadataWithoutConnecting() throws Exception {
+        mockLinstorPool();
+        VolumeOnStorageTO volume = new VolumeOnStorageTO(null, srcFile, srcFile, "/dev/drbd/by-res/cs-x/0", "RAW", virtualSize, virtualSize);
+        volume.addDetail(VolumeOnStorageTO.Detail.IS_LOCKED, "false");
+        Mockito.when(storagePool.getVolumesForImport(srcFile)).thenReturn(java.util.Collections.singletonList(volume));
+        qemuImg = Mockito.mockConstruction(QemuImg.class);
+
+        Answer answer = wrapper.execute(buildCommand(), libvirtComputingResource);
+
+        Assert.assertTrue(answer.getResult());
+        Assert.assertEquals(virtualSize, ((CheckVolumeAnswer) answer).getSize());
+        Assert.assertTrue(qemuImg.constructed().isEmpty());
+        Mockito.verify(storagePoolMgr, Mockito.never()).connectPhysicalDisk(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
+        Mockito.verify(storagePoolMgr, Mockito.never()).disconnectPhysicalDisk(Mockito.any(), Mockito.any(), Mockito.any());
+        Mockito.verify(storagePool, Mockito.never()).getPhysicalDisk(Mockito.any());
+    }
+
+    @Test
+    public void testLinstorVolumeInUseOnAnotherNodeIsReportedLocked() {
+        mockLinstorPool();
+        VolumeOnStorageTO volume = new VolumeOnStorageTO(null, srcFile, srcFile, "", "RAW", virtualSize, virtualSize);
+        volume.addDetail(VolumeOnStorageTO.Detail.IS_LOCKED, "true");
+        Mockito.when(storagePool.getVolumesForImport(srcFile)).thenReturn(java.util.Collections.singletonList(volume));
+
+        CheckVolumeAnswer answer = (CheckVolumeAnswer) wrapper.execute(buildCommand(), libvirtComputingResource);
+
+        Assert.assertEquals("true", answer.getVolumeDetails().get(VolumeOnStorageTO.Detail.IS_LOCKED));
+        Mockito.verify(storagePoolMgr, Mockito.never()).disconnectPhysicalDisk(Mockito.any(), Mockito.any(), Mockito.any());
+    }
+
+    @Test
+    public void testLinstorInvalidGroupReturnsActionableFailure() {
+        mockLinstorPool();
+        Mockito.when(storagePool.getVolumesForImport(srcFile)).thenThrow(
+                new com.cloud.utils.exception.CloudRuntimeException("Resource group mismatch: rg-ssd vs rg-hdd"));
+        Answer answer = wrapper.execute(buildCommand(), libvirtComputingResource);
+        Assert.assertFalse(answer.getResult());
+        Assert.assertTrue(answer.getDetails().contains("rg-ssd"));
+        Mockito.verify(storagePoolMgr, Mockito.never()).connectPhysicalDisk(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
+    }
+
+    @Test
+    public void testRbdVolumeReportsLockedWhenInfoProbeFails() {
+        mockRbdPool();
+        Mockito.when(disk.getVirtualSize()).thenReturn(virtualSize);
+        qemuImg = Mockito.mockConstruction(QemuImg.class, (mock, context) -> {
+            // secure=true uses force-share and succeeds; secure=false is the lock probe
+            Mockito.when(mock.info(Mockito.any(QemuImgFile.class), Mockito.eq(true))).thenReturn(qemuInfo);
+            Mockito.when(mock.info(Mockito.any(QemuImgFile.class), Mockito.eq(false))).thenReturn(null);
+        });
+
+        Answer answer = wrapper.execute(buildCommand(), libvirtComputingResource);
+
+        Assert.assertTrue(answer instanceof CheckVolumeAnswer);
+        Assert.assertTrue(answer.getResult());
+        Map<VolumeOnStorageTO.Detail, String> details = ((CheckVolumeAnswer) answer).getVolumeDetails();
+        Assert.assertEquals("true", details.get(VolumeOnStorageTO.Detail.IS_LOCKED));
+    }
+
+    @Test
+    public void testRbdVolumeWithoutInfoReturnsInvalid() {
+        mockRbdPool();
+        qemuImg = Mockito.mockConstruction(QemuImg.class, (mock, context) ->
+                Mockito.when(mock.info(Mockito.any(QemuImgFile.class), Mockito.anyBoolean())).thenReturn(null));
+
+        Answer answer = wrapper.execute(buildCommand(), libvirtComputingResource);
+
+        Assert.assertTrue(answer instanceof CheckVolumeAnswer);
+        Assert.assertFalse(answer.getResult());
+        CheckVolumeAnswer checkVolumeAnswer = (CheckVolumeAnswer) answer;
+        Assert.assertEquals(0, checkVolumeAnswer.getSize());
+        Assert.assertNull(checkVolumeAnswer.getVolumeDetails());
+    }
+
+    @Test
+    public void testUnsupportedStoragePoolReturnsPlainAnswer() {
+        Mockito.when(storageFilerTO.getType()).thenReturn(Storage.StoragePoolType.PowerFlex);
+        Mockito.when(storageFilerTO.getUuid()).thenReturn(poolUuid);
+
+        Answer answer = wrapper.execute(buildCommand(), libvirtComputingResource);
+
+        Assert.assertFalse(answer instanceof CheckVolumeAnswer);
+        Assert.assertFalse(answer.getResult());
+        Assert.assertEquals("Unsupported Storage Pool", answer.getDetails());
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtConvertInstanceCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtConvertInstanceCommandWrapperTest.java
index c30fa2f49482..810d3028ea97 100644
--- a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtConvertInstanceCommandWrapperTest.java
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtConvertInstanceCommandWrapperTest.java
@@ -19,6 +19,7 @@
 package com.cloud.hypervisor.kvm.resource.wrapper;
 
 import java.nio.file.Files;
+import java.nio.file.Path;
 import java.util.List;
 import java.util.UUID;
 
@@ -44,6 +45,7 @@
 import com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk;
 import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
 import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.storage.Storage;
 import com.cloud.utils.script.Script;
 
 @RunWith(MockitoJUnitRunner.class)
@@ -151,6 +153,26 @@ public void testExecuteConvertUnsupportedHypervisors() {
         Assert.assertFalse(answer.getResult());
     }
 
+    @Test
+    public void testExecuteDirectRbdVddkFailsWhenHostLacksDirectRbdSupport() {
+        RemoteInstanceTO remoteInstanceTO = getRemoteInstanceTO(Hypervisor.HypervisorType.VMware);
+        ConvertInstanceCommand cmd = getConvertInstanceCommand(remoteInstanceTO, Hypervisor.HypervisorType.KVM, false);
+        Mockito.when(cmd.isUseVddk()).thenReturn(true);
+        Mockito.when(cmd.getVddkLibDir()).thenReturn("/opt/vddk");
+        Mockito.when(cmd.getConversionTemporaryLocation()).thenReturn(primaryDataStore);
+        Mockito.when(primaryDataStore.getPoolType()).thenReturn(Storage.StoragePoolType.RBD);
+        Mockito.when(primaryDataStore.getUuid()).thenReturn("rbd-pool-uuid");
+        Mockito.when(storagePoolManager.getStoragePool(Storage.StoragePoolType.RBD, "rbd-pool-uuid")).thenReturn(destinationPool);
+        Mockito.when(destinationPool.getLocalPath()).thenReturn("/rbd");
+        Mockito.when(libvirtComputingResourceMock.getVddkLibDir()).thenReturn("/opt/vddk");
+        Mockito.when(libvirtComputingResourceMock.hostSupportsVddkRbdDirectImport("/opt/vddk")).thenReturn(false);
+
+        Answer answer = convertInstanceCommandWrapper.execute(cmd, libvirtComputingResourceMock);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertTrue(answer.getDetails().contains("Direct RBD VDDK import requires"));
+    }
+
     @Test
     public void testExecuteConvertFailure() {
         RemoteInstanceTO remoteInstanceTO = getRemoteInstanceTO(Hypervisor.HypervisorType.VMware);
@@ -169,7 +191,7 @@ public void testExecuteConvertFailure() {
             Answer answer = convertInstanceCommandWrapper.execute(cmd, libvirtComputingResourceMock);
             Assert.assertFalse(answer.getResult());
             Mockito.verify(convertInstanceCommandWrapper).performInstanceConversion(Mockito.anyString(), Mockito.anyString(),
-                    Mockito.anyString(), Mockito.anyString(), Mockito.anyLong(), Mockito.anyBoolean(), Mockito.nullable(String.class), Mockito.any(LibvirtComputingResource.class));
+                    Mockito.anyString(), Mockito.anyString(), Mockito.anyLong(), Mockito.anyBoolean(), Mockito.nullable(String.class), Mockito.any(LibvirtComputingResource.class), Mockito.anyBoolean());
         }
     }
 
@@ -214,7 +236,7 @@ public void testPerformInstanceConversionUsingVddkUsesConfiguredLibguestfsBacken
                     .thenReturn(true);
 
             boolean result = convertInstanceCommandWrapper.performInstanceConversionUsingVddk(
-                    remoteInstanceTO, vmName, "/tmp/convert", "/opt/vddk", "libvirt", null, null, 1000L, false, null, "tmp-uuid", "-ip");
+                    remoteInstanceTO, vmName, "/tmp/convert", "/opt/vddk", "libvirt", null, null, 1000L, false, null, "tmp-uuid", "-ip", false);
 
             Assert.assertTrue(result);
             Script scriptMock = ignored.constructed().get(0);
@@ -249,7 +271,7 @@ public void testPerformInstanceConversionUsingVddkUsesConfiguredTransportsOrder(
                     .thenReturn(true);
 
             boolean result = convertInstanceCommandWrapper.performInstanceConversionUsingVddk(
-                    remoteInstanceTO, vmName, "/tmp/convert", "/opt/vddk", "direct", "nbd:nbdssl", null, 1000L, false, null, "tmp-uuid", "-ip");
+                    remoteInstanceTO, vmName, "/tmp/convert", "/opt/vddk", "direct", "nbd:nbdssl", null, 1000L, false, null, "tmp-uuid", "-ip", false);
 
             Assert.assertTrue(result);
             Script scriptMock = ignored.constructed().get(0);
@@ -276,7 +298,7 @@ public void testPerformInstanceConversionUsingVddkFailsWhenThumbprintUnavailable
                     .thenReturn(true);
 
             boolean result = convertInstanceCommandWrapper.performInstanceConversionUsingVddk(
-                    remoteInstanceTO, vmName, "/tmp/convert", "/opt/vddk", "direct", null, null, 1000L, false, null, "tmp-uuid", "-ip");
+                    remoteInstanceTO, vmName, "/tmp/convert", "/opt/vddk", "direct", null, null, 1000L, false, null, "tmp-uuid", "-ip", false);
 
             Assert.assertFalse(result);
         }
@@ -304,7 +326,7 @@ public void testPerformInstanceConversionUsingVddkUsesConfiguredThumbprintFromAg
 
             boolean result = convertInstanceCommandWrapper.performInstanceConversionUsingVddk(
                     remoteInstanceTO, vmName, "/tmp/convert", "/opt/vddk", "direct", null,
-                    "AA:BB:CC:DD:EE", 1000L, false, null, "tmp-uuid", "-ip");
+                    "AA:BB:CC:DD:EE", 1000L, false, null, "tmp-uuid", "-ip", false);
 
             Assert.assertTrue(result);
             Script scriptMock = ignored.constructed().get(0);
@@ -313,4 +335,95 @@ public void testPerformInstanceConversionUsingVddkUsesConfiguredThumbprintFromAg
                     .getVcenterThumbprint(Mockito.anyString(), Mockito.anyLong(), Mockito.anyString());
         }
     }
+
+    @Test
+    public void testBuildDirectRbdNbdLibvirtXmlUsesLocalhostNbdSourcesWithoutSecrets() {
+        // virt-v2v's "-i libvirtxml" input runs without a libvirt connection: a native
+        // rbd network disk with a <secret> auth reference attaches zero drives there,
+        // so the finalization XML must use localhost qemu-nbd bridge endpoints.
+        String xml = convertInstanceCommandWrapper.buildDirectRbdNbdLibvirtXml("tmp-uuid", List.of(10809, 10810));
+
+        Assert.assertTrue(xml, xml.contains("<source protocol='nbd'>"));
+        Assert.assertTrue(xml, xml.contains("<host name='localhost' port='10809'/>"));
+        Assert.assertTrue(xml, xml.contains("<host name='localhost' port='10810'/>"));
+        Assert.assertTrue(xml, xml.contains("<target dev='sda' bus='scsi'/>"));
+        Assert.assertTrue(xml, xml.contains("<target dev='sdb' bus='scsi'/>"));
+        Assert.assertFalse(xml, xml.contains("protocol='rbd'"));
+        Assert.assertFalse(xml, xml.contains("<secret"));
+        Assert.assertFalse(xml, xml.contains("<auth"));
+    }
+
+    @Test
+    public void testWindowsOnlineDisksFirstbootScriptContent() {
+        String script = LibvirtConvertInstanceCommandWrapper.WINDOWS_ONLINE_DISKS_FIRSTBOOT;
+        Assert.assertTrue("should set SAN policy OnlineAll", script.contains("OnlineAll"));
+        Assert.assertTrue("should clear the offline flag", script.contains("-IsOffline $false"));
+        Assert.assertTrue("should clear the read-only flag", script.contains("-IsReadOnly $false"));
+        Assert.assertTrue("should iterate the disks", script.contains("Get-Disk"));
+    }
+
+    @Test
+    public void testWriteWindowsOnlineDisksFirstbootScriptWritesFile() throws Exception {
+        Path firstboot = convertInstanceCommandWrapper.writeWindowsOnlineDisksFirstbootScript(vmName);
+        try {
+            Assert.assertNotNull(firstboot);
+            Assert.assertTrue(Files.exists(firstboot));
+            Assert.assertEquals(LibvirtConvertInstanceCommandWrapper.WINDOWS_ONLINE_DISKS_FIRSTBOOT, Files.readString(firstboot));
+        } finally {
+            if (firstboot != null) {
+                Files.deleteIfExists(firstboot);
+            }
+        }
+    }
+
+    @Test
+    public void testVddkConversionInjectsFirstbootForWindowsGuest() {
+        RemoteInstanceTO remoteInstanceTO = Mockito.mock(RemoteInstanceTO.class);
+        Mockito.when(remoteInstanceTO.getVcenterHost()).thenReturn("vcenter.local");
+        Mockito.when(remoteInstanceTO.getVcenterUsername()).thenReturn("administrator@vsphere.local");
+        Mockito.when(remoteInstanceTO.getVcenterPassword()).thenReturn("secret");
+        Mockito.when(remoteInstanceTO.getDatacenterName()).thenReturn("dc1");
+        Mockito.when(remoteInstanceTO.getClusterName()).thenReturn("cluster1");
+        Mockito.when(remoteInstanceTO.getHostName()).thenReturn("host1");
+        Mockito.doReturn("AA:BB:CC").when(convertInstanceCommandWrapper).getVcenterThumbprint(Mockito.anyString(), Mockito.anyLong(), Mockito.anyString());
+        Mockito.doReturn(Path.of("/tmp/cs-fb.bat")).when(convertInstanceCommandWrapper).writeWindowsOnlineDisksFirstbootScript(Mockito.anyString());
+        try (MockedStatic<Files> filesMock = Mockito.mockStatic(Files.class);
+             MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class, (mock, context) -> {
+                 Mockito.when(mock.execute(Mockito.any())).thenReturn("");
+                 Mockito.when(mock.getExitValue()).thenReturn(0);
+             })) {
+            filesMock.when(() -> Files.writeString(Mockito.any(), Mockito.eq("secret"))).thenAnswer(invocation -> invocation.getArgument(0));
+            filesMock.when(() -> Files.deleteIfExists(Mockito.any())).thenReturn(true);
+            boolean result = convertInstanceCommandWrapper.performInstanceConversionUsingVddk(
+                    remoteInstanceTO, vmName, "/tmp/convert", "/opt/vddk", "direct", null, null, 1000L, false, null, "tmp-uuid", "-ip", true);
+            Assert.assertTrue(result);
+            Script scriptMock = ignored.constructed().get(0);
+            // Path.toString() is platform-dependent on the test host; assert the flag is injected.
+            Mockito.verify(scriptMock).add(Mockito.contains("--firstboot "));
+        }
+    }
+
+    @Test
+    public void testVddkConversionSkipsFirstbootForNonWindowsGuest() {
+        RemoteInstanceTO remoteInstanceTO = Mockito.mock(RemoteInstanceTO.class);
+        Mockito.when(remoteInstanceTO.getVcenterHost()).thenReturn("vcenter.local");
+        Mockito.when(remoteInstanceTO.getVcenterUsername()).thenReturn("administrator@vsphere.local");
+        Mockito.when(remoteInstanceTO.getVcenterPassword()).thenReturn("secret");
+        Mockito.when(remoteInstanceTO.getDatacenterName()).thenReturn("dc1");
+        Mockito.when(remoteInstanceTO.getClusterName()).thenReturn("cluster1");
+        Mockito.when(remoteInstanceTO.getHostName()).thenReturn("host1");
+        Mockito.doReturn("AA:BB:CC").when(convertInstanceCommandWrapper).getVcenterThumbprint(Mockito.anyString(), Mockito.anyLong(), Mockito.anyString());
+        try (MockedStatic<Files> filesMock = Mockito.mockStatic(Files.class);
+             MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class, (mock, context) -> {
+                 Mockito.when(mock.execute(Mockito.any())).thenReturn("");
+                 Mockito.when(mock.getExitValue()).thenReturn(0);
+             })) {
+            filesMock.when(() -> Files.writeString(Mockito.any(), Mockito.eq("secret"))).thenAnswer(invocation -> invocation.getArgument(0));
+            filesMock.when(() -> Files.deleteIfExists(Mockito.any())).thenReturn(true);
+            boolean result = convertInstanceCommandWrapper.performInstanceConversionUsingVddk(
+                    remoteInstanceTO, vmName, "/tmp/convert", "/opt/vddk", "direct", null, null, 1000L, false, null, "tmp-uuid", "-ip", false);
+            Assert.assertTrue(result);
+            Mockito.verify(convertInstanceCommandWrapper, Mockito.never()).writeWindowsOnlineDisksFirstbootScript(Mockito.anyString());
+        }
+    }
 }
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtImportConvertedInstanceCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtImportConvertedInstanceCommandWrapperTest.java
index a30168266c0c..9635243a21de 100644
--- a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtImportConvertedInstanceCommandWrapperTest.java
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtImportConvertedInstanceCommandWrapperTest.java
@@ -39,6 +39,7 @@
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.mockito.Mock;
+import org.mockito.MockedConstruction;
 import org.mockito.MockedStatic;
 import org.mockito.Mockito;
 import org.mockito.Spy;
@@ -167,6 +168,66 @@ public void testMoveTemporaryDisksToDestination() {
         Assert.assertEquals("xyz", movedDisks.get(0).getPath());
     }
 
+    @Test
+    public void testMoveTemporaryDisksToRbdDestinationUsesDestinationPoolType() {
+        KVMPhysicalDisk sourceDisk = Mockito.mock(KVMPhysicalDisk.class);
+        Mockito.lenient().when(sourceDisk.getPool()).thenReturn(temporaryPool);
+        List<KVMPhysicalDisk> disks = List.of(sourceDisk);
+        String destinationPoolUuid = UUID.randomUUID().toString();
+        List<String> destinationPools = List.of(destinationPoolUuid);
+        List<Storage.StoragePoolType> destinationPoolTypes = List.of(Storage.StoragePoolType.RBD);
+
+        KVMPhysicalDisk destDisk = Mockito.mock(KVMPhysicalDisk.class);
+        Mockito.when(destDisk.getPath()).thenReturn("rbd/image");
+        Mockito.when(storagePoolManager.getStoragePool(Storage.StoragePoolType.RBD, destinationPoolUuid))
+                .thenReturn(destinationPool);
+        Mockito.when(destinationPool.getType()).thenReturn(Storage.StoragePoolType.RBD);
+        Mockito.when(destinationPool.getSourceDir()).thenReturn("cloudstack");
+        Mockito.when(destinationPool.getSourceHost()).thenReturn("10.0.0.1,10.0.0.2");
+        Mockito.when(destinationPool.getSourcePort()).thenReturn(6789);
+        Mockito.when(storagePoolManager.copyPhysicalDisk(Mockito.eq(sourceDisk), Mockito.anyString(), Mockito.eq(destinationPool), Mockito.anyInt()))
+                .thenReturn(destDisk);
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class, (mock, context) -> {
+            Mockito.when(mock.execute()).thenReturn("");
+            Mockito.when(mock.getExitValue()).thenReturn(0);
+        })) {
+            List<KVMPhysicalDisk> movedDisks = importInstanceCommandWrapper.moveTemporaryDisksToDestination(disks,
+                    destinationPools, destinationPoolTypes, storagePoolManager);
+
+            Assert.assertEquals(1, movedDisks.size());
+            Assert.assertEquals("rbd/image", movedDisks.get(0).getPath());
+            Mockito.verify(storagePoolManager).getStoragePool(Storage.StoragePoolType.RBD, destinationPoolUuid);
+            Mockito.verify(destinationPool).deletePhysicalDisk(Mockito.endsWith("-probe"), Mockito.eq(Storage.ImageFormat.RAW));
+        }
+    }
+
+    @Test
+    public void testMoveTemporaryDisksToLinstorDestinationUsesDestinationPoolType() {
+        KVMPhysicalDisk sourceDisk = Mockito.mock(KVMPhysicalDisk.class);
+        Mockito.lenient().when(sourceDisk.getPool()).thenReturn(temporaryPool);
+        List<KVMPhysicalDisk> disks = List.of(sourceDisk);
+        String destinationPoolUuid = UUID.randomUUID().toString();
+        List<String> destinationPools = List.of(destinationPoolUuid);
+        List<Storage.StoragePoolType> destinationPoolTypes = List.of(Storage.StoragePoolType.Linstor);
+
+        KVMPhysicalDisk destDisk = Mockito.mock(KVMPhysicalDisk.class);
+        Mockito.when(destDisk.getPath()).thenReturn("/dev/drbd/by-res/cs-volume/0");
+        Mockito.when(storagePoolManager.getStoragePool(Storage.StoragePoolType.Linstor, destinationPoolUuid))
+                .thenReturn(destinationPool);
+        Mockito.when(destinationPool.getType()).thenReturn(Storage.StoragePoolType.Linstor);
+        Mockito.when(storagePoolManager.copyPhysicalDisk(Mockito.eq(sourceDisk), Mockito.anyString(), Mockito.eq(destinationPool), Mockito.anyInt()))
+                .thenReturn(destDisk);
+
+        List<KVMPhysicalDisk> movedDisks = importInstanceCommandWrapper.moveTemporaryDisksToDestination(disks,
+                destinationPools, destinationPoolTypes, storagePoolManager);
+
+        Assert.assertEquals(1, movedDisks.size());
+        Assert.assertEquals("/dev/drbd/by-res/cs-volume/0", movedDisks.get(0).getPath());
+        Mockito.verify(storagePoolManager).getStoragePool(Storage.StoragePoolType.Linstor, destinationPoolUuid);
+        Mockito.verify(destinationPool, Mockito.never()).deletePhysicalDisk(Mockito.anyString(), Mockito.any());
+    }
+
     @Test
     public void testGetUnmanagedInstanceDisks() {
         try (MockedStatic<Script> ignored = Mockito.mockStatic(Script.class)) {
@@ -196,6 +257,55 @@ public void testGetUnmanagedInstanceDisks() {
         }
     }
 
+    @Test
+    public void testGetUnmanagedInstanceDisksForRbdDoesNotParseNfsMount() {
+        KVMPhysicalDisk sourceDisk = Mockito.mock(KVMPhysicalDisk.class);
+        Mockito.when(sourceDisk.getName()).thenReturn("rbd-image");
+        Mockito.when(sourceDisk.getVirtualSize()).thenReturn(5242880L);
+        Mockito.when(sourceDisk.getPool()).thenReturn(destinationPool);
+        Mockito.when(destinationPool.getType()).thenReturn(Storage.StoragePoolType.RBD);
+        Mockito.when(destinationPool.getUuid()).thenReturn("rbd-pool-uuid");
+        Mockito.when(destinationPool.getSourceHost()).thenReturn("10.0.0.1,10.0.0.2");
+        Mockito.when(destinationPool.getSourceDir()).thenReturn("cloudstack");
+
+        List<UnmanagedInstanceTO.Disk> unmanagedInstanceDisks = importInstanceCommandWrapper.getUnmanagedInstanceDisks(List.of(sourceDisk), null);
+
+        Assert.assertEquals(1, unmanagedInstanceDisks.size());
+        UnmanagedInstanceTO.Disk disk = unmanagedInstanceDisks.get(0);
+        Assert.assertEquals("rbd-image", disk.getFileBaseName());
+        Assert.assertEquals("rbd-image", disk.getImagePath());
+        Assert.assertEquals("rbd-pool-uuid", disk.getDatastoreName());
+        Assert.assertEquals(Storage.StoragePoolType.RBD.name(), disk.getDatastoreType());
+        Assert.assertEquals("10.0.0.1,10.0.0.2", disk.getDatastoreHost());
+        Assert.assertEquals("cloudstack", disk.getDatastorePath());
+        Assert.assertEquals(LibvirtVMDef.DiskDef.DiskBus.VIRTIO.toString(), disk.getController());
+        Mockito.verify(importInstanceCommandWrapper, Mockito.never()).getNfsStoragePoolHostAndPath(destinationPool);
+    }
+
+    @Test
+    public void testGetUnmanagedInstanceDisksForLinstorDoesNotParseNfsMount() {
+        KVMPhysicalDisk sourceDisk = Mockito.mock(KVMPhysicalDisk.class);
+        Mockito.when(sourceDisk.getName()).thenReturn("linstor-volume");
+        Mockito.when(sourceDisk.getVirtualSize()).thenReturn(5242880L);
+        Mockito.when(sourceDisk.getPool()).thenReturn(destinationPool);
+        Mockito.when(destinationPool.getType()).thenReturn(Storage.StoragePoolType.Linstor);
+        Mockito.when(destinationPool.getUuid()).thenReturn("linstor-pool-uuid");
+        Mockito.when(destinationPool.getSourceHost()).thenReturn("linstor-controller");
+
+        List<UnmanagedInstanceTO.Disk> unmanagedInstanceDisks = importInstanceCommandWrapper.getUnmanagedInstanceDisks(List.of(sourceDisk), null);
+
+        Assert.assertEquals(1, unmanagedInstanceDisks.size());
+        UnmanagedInstanceTO.Disk disk = unmanagedInstanceDisks.get(0);
+        Assert.assertEquals("linstor-volume", disk.getFileBaseName());
+        Assert.assertEquals("linstor-volume", disk.getImagePath());
+        Assert.assertEquals("linstor-pool-uuid", disk.getDatastoreName());
+        Assert.assertEquals(Storage.StoragePoolType.Linstor.name(), disk.getDatastoreType());
+        Assert.assertEquals("linstor-controller", disk.getDatastoreHost());
+        Assert.assertNull(disk.getDatastorePath());
+        Assert.assertEquals(LibvirtVMDef.DiskDef.DiskBus.VIRTIO.toString(), disk.getController());
+        Mockito.verify(importInstanceCommandWrapper, Mockito.never()).getNfsStoragePoolHostAndPath(destinationPool);
+    }
+
     @Test
     public void testGetNfsStoragePoolHostAndPath() {
         try (MockedStatic<Script> ignored = Mockito.mockStatic(Script.class)) {
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtLinstorImportListingTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtLinstorImportListingTest.java
new file mode 100644
index 000000000000..48b844ac9ceb
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtLinstorImportListingTest.java
@@ -0,0 +1,123 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.util.Arrays;
+import java.util.Collections;
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.GetVolumesOnStorageAnswer;
+import com.cloud.agent.api.GetVolumesOnStorageCommand;
+import com.cloud.agent.api.to.StorageFilerTO;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.storage.Storage;
+import com.cloud.utils.exception.CloudRuntimeException;
+import org.apache.cloudstack.storage.volume.VolumeOnStorageTO;
+import org.apache.cloudstack.utils.qemu.QemuImg;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.MockedConstruction;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.mockConstruction;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+public class LibvirtLinstorImportListingTest {
+    private KVMStoragePool pool;
+    private KVMStoragePoolManager manager;
+    private LibvirtComputingResource resource;
+    private StorageFilerTO filer;
+    private final LibvirtGetVolumesOnStorageCommandWrapper wrapper = new LibvirtGetVolumesOnStorageCommandWrapper();
+
+    @Before
+    public void setup() {
+        pool = mock(KVMStoragePool.class);
+        manager = mock(KVMStoragePoolManager.class);
+        resource = mock(LibvirtComputingResource.class);
+        filer = mock(StorageFilerTO.class);
+        when(filer.getType()).thenReturn(Storage.StoragePoolType.Linstor);
+        when(filer.getUuid()).thenReturn("pool");
+        when(resource.getStoragePoolMgr()).thenReturn(manager);
+        when(manager.getStoragePool(Storage.StoragePoolType.Linstor, "pool", true, true)).thenReturn(pool);
+    }
+
+    private VolumeOnStorageTO volume(String name, boolean locked) {
+        VolumeOnStorageTO volume = new VolumeOnStorageTO(null, name, name, "/dev/drbd/by-res/cs-" + name + "/0", "RAW", 1024, 1024);
+        volume.addDetail(VolumeOnStorageTO.Detail.IS_LOCKED, Boolean.toString(locked));
+        return volume;
+    }
+
+    private void verifyNoStorageMutation() {
+        verify(manager, never()).connectPhysicalDisk(any(), any(), any(), any());
+        verify(manager, never()).disconnectPhysicalDisk(any(), any(), any());
+        verify(pool, never()).getPhysicalDisk(any());
+        verify(pool, never()).listPhysicalDisks();
+    }
+
+    @Test
+    public void listingUsesMetadataWithoutQemuOrConnectingAndKeepsKeyword() {
+        when(pool.getVolumesForImport(null)).thenReturn(Arrays.asList(volume("alpha", false), volume("beta", true)));
+        try (MockedConstruction<QemuImg> qemu = mockConstruction(QemuImg.class)) {
+            GetVolumesOnStorageAnswer answer = (GetVolumesOnStorageAnswer) wrapper.execute(
+                    new GetVolumesOnStorageCommand(filer, null, "beta"), resource);
+            assertTrue(answer.getResult());
+            assertEquals(1, answer.getVolumes().size());
+            assertEquals("beta", answer.getVolumes().get(0).getName());
+            assertEquals("true", answer.getVolumes().get(0).getDetails().get(VolumeOnStorageTO.Detail.IS_LOCKED));
+            assertTrue(qemu.constructed().isEmpty());
+        }
+        verifyNoStorageMutation();
+    }
+
+    @Test
+    public void singlePathAlsoUsesReadOnlyMetadata() {
+        when(pool.getVolumesForImport("alpha")).thenReturn(Collections.singletonList(volume("alpha", false)));
+        try (MockedConstruction<QemuImg> qemu = mockConstruction(QemuImg.class)) {
+            GetVolumesOnStorageAnswer answer = (GetVolumesOnStorageAnswer) wrapper.execute(
+                    new GetVolumesOnStorageCommand(filer, "alpha", null), resource);
+            assertTrue(answer.getResult());
+            assertEquals("alpha", answer.getVolumes().get(0).getPath());
+            assertTrue(qemu.constructed().isEmpty());
+        }
+        verifyNoStorageMutation();
+    }
+
+    @Test
+    public void wrongGroupDoesNotConnectOrDisconnect() {
+        when(pool.getVolumesForImport("alpha")).thenThrow(new CloudRuntimeException("resource group mismatch"));
+        Answer answer = wrapper.execute(new GetVolumesOnStorageCommand(filer, "alpha", null), resource);
+        assertFalse(answer.getResult());
+        assertEquals("resource group mismatch", answer.getDetails());
+        verifyNoStorageMutation();
+    }
+
+    @Test
+    public void controllerFailureDoesNotReturnSuccessfulEmptyList() {
+        when(pool.getVolumesForImport(null)).thenThrow(new CloudRuntimeException("controller unavailable"));
+        Answer answer = wrapper.execute(new GetVolumesOnStorageCommand(filer, null, null), resource);
+        assertFalse(answer.getResult());
+        assertEquals("controller unavailable", answer.getDetails());
+        verifyNoStorageMutation();
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtCleanupCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtCleanupCommandWrapperTest.java
new file mode 100644
index 000000000000..a6bc6cc25f40
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtCleanupCommandWrapperTest.java
@@ -0,0 +1,239 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.List;
+
+import org.junit.Assert;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.rules.TemporaryFolder;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.VmwareCbtCleanupCommand;
+import com.cloud.agent.api.to.VmwareCbtDiskTO;
+import com.cloud.agent.api.to.VmwareCbtTargetStorageType;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.storage.Storage;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtVmwareCbtCleanupCommandWrapperTest {
+
+    private static final String MIGRATION_UUID = "migration-uuid";
+
+    private final TestLibvirtVmwareCbtCleanupCommandWrapper wrapper = new TestLibvirtVmwareCbtCleanupCommandWrapper();
+
+    @Rule
+    public TemporaryFolder temporaryFolder = new TemporaryFolder();
+
+    @Mock
+    private LibvirtComputingResource libvirtComputingResource;
+    @Mock
+    private KVMStoragePoolManager storagePoolManager;
+    @Mock
+    private KVMStoragePool rbdStoragePool;
+
+    @Test
+    public void testExecuteDeletesOnlyMigrationDirectory() throws IOException {
+        Path root = temporaryFolder.newFolder("primary").toPath();
+        Path migrationDirectory = root.resolve("cloudstack-cbt").resolve(MIGRATION_UUID);
+        Path targetDisk = migrationDirectory.resolve("disk.qcow2");
+        Path siblingDisk = root.resolve("cloudstack-cbt").resolve("other-migration").resolve("disk.qcow2");
+        Files.createDirectories(targetDisk.getParent());
+        Files.createDirectories(siblingDisk.getParent());
+        Files.writeString(targetDisk, "partial target");
+        Files.writeString(siblingDisk, "do not delete");
+
+        Answer answer = wrapper.execute(createCommand(targetDisk.toString()), libvirtComputingResource);
+
+        Assert.assertTrue(answer.getResult());
+        Assert.assertFalse(Files.exists(migrationDirectory));
+        Assert.assertTrue(Files.exists(siblingDisk));
+        Assert.assertEquals(List.of("/cloudstack-cbt/migration-uuid/"), wrapper.killedProcessMarkers);
+    }
+
+    @Test
+    public void testCleanupDoesNotWaitBehindInFlightCopyCommand() throws IOException {
+        Path targetDisk = temporaryFolder.newFile("sequential-copy.qcow2").toPath();
+
+        Assert.assertFalse(createCommand(targetDisk.toString()).executeInSequence());
+    }
+
+    @Test
+    public void testExecuteSkipsPathsOutsideMigrationDirectory() throws IOException {
+        Path targetDisk = temporaryFolder.newFile("disk.qcow2").toPath();
+
+        Answer answer = wrapper.execute(createCommand(targetDisk.toString()), libvirtComputingResource);
+
+        Assert.assertTrue(answer.getResult());
+        Assert.assertTrue(Files.exists(targetDisk));
+    }
+
+    @Test
+    public void testExecuteDeletesOnlyMarkedRbdTargetImages() {
+        Mockito.when(libvirtComputingResource.getStoragePoolMgr()).thenReturn(storagePoolManager);
+        Mockito.when(storagePoolManager.getStoragePool(Storage.StoragePoolType.RBD, "rbd-pool-uuid")).thenReturn(rbdStoragePool);
+        Mockito.when(rbdStoragePool.getType()).thenReturn(Storage.StoragePoolType.RBD);
+        Mockito.when(rbdStoragePool.deletePhysicalDisk(Mockito.eq("cloudstack-cbt-migration-uuid-disk-1"), Mockito.eq(Storage.ImageFormat.RAW))).thenReturn(true);
+        VmwareCbtCleanupCommand command = new VmwareCbtCleanupCommand(MIGRATION_UUID,
+                List.of(new VmwareCbtDiskTO("disk-1", 2000, "[datastore] vm/disk.vmdk", "datastore",
+                                "cloudstack-cbt-migration-uuid-disk-1", "raw", null, null, 8192),
+                        new VmwareCbtDiskTO("disk-2", 2001, "[datastore] vm/disk2.vmdk", "datastore",
+                                "live-volume-that-must-not-be-removed", "raw", null, null, 8192)),
+                true, true, true);
+        command.setTargetStorageType(VmwareCbtTargetStorageType.RBD_RAW);
+        command.setDestinationStoragePoolType(Storage.StoragePoolType.RBD);
+        command.setDestinationStoragePoolUuid("rbd-pool-uuid");
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getResult());
+        Mockito.verify(rbdStoragePool).deletePhysicalDisk("cloudstack-cbt-migration-uuid-disk-1", Storage.ImageFormat.RAW);
+        Mockito.verify(rbdStoragePool, Mockito.never()).deletePhysicalDisk("live-volume-that-must-not-be-removed", Storage.ImageFormat.RAW);
+    }
+
+    @Test
+    public void testExecuteDeletesOnlyMarkedBlockDeviceTargetVolumes() {
+        KVMStoragePool linstorStoragePool = Mockito.mock(KVMStoragePool.class);
+        Mockito.when(libvirtComputingResource.getStoragePoolMgr()).thenReturn(storagePoolManager);
+        Mockito.when(storagePoolManager.getStoragePool(Storage.StoragePoolType.Linstor, "linstor-pool-uuid")).thenReturn(linstorStoragePool);
+        Mockito.when(linstorStoragePool.getType()).thenReturn(Storage.StoragePoolType.Linstor);
+        Mockito.when(linstorStoragePool.deletePhysicalDisk(Mockito.eq("cbt-migratio-2000"), Mockito.eq(Storage.ImageFormat.RAW))).thenReturn(true);
+        VmwareCbtCleanupCommand command = new VmwareCbtCleanupCommand(MIGRATION_UUID,
+                List.of(new VmwareCbtDiskTO("disk-1", 2000, "[datastore] vm/disk.vmdk", "datastore",
+                                "cbt-migratio-2000", "raw", null, null, 8192),
+                        new VmwareCbtDiskTO("disk-2", 2001, "[datastore] vm/disk2.vmdk", "datastore",
+                                "live-volume-that-must-not-be-removed", "raw", null, null, 8192)),
+                true, true, true);
+        command.setTargetStorageType(VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE);
+        command.setDestinationStoragePoolType(Storage.StoragePoolType.Linstor);
+        command.setDestinationStoragePoolUuid("linstor-pool-uuid");
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getDetails(), answer.getResult());
+        Mockito.verify(linstorStoragePool).deletePhysicalDisk("cbt-migratio-2000", Storage.ImageFormat.RAW);
+        Mockito.verify(linstorStoragePool, Mockito.never()).deletePhysicalDisk("live-volume-that-must-not-be-removed", Storage.ImageFormat.RAW);
+    }
+
+    @Test
+    public void testExecuteFailsWhenMarkedRbdTargetImageCannotBeDeleted() {
+        Mockito.when(libvirtComputingResource.getStoragePoolMgr()).thenReturn(storagePoolManager);
+        Mockito.when(storagePoolManager.getStoragePool(Storage.StoragePoolType.RBD, "rbd-pool-uuid")).thenReturn(rbdStoragePool);
+        Mockito.when(rbdStoragePool.getType()).thenReturn(Storage.StoragePoolType.RBD);
+        Mockito.when(rbdStoragePool.getUuid()).thenReturn("rbd-pool-uuid");
+        Mockito.when(rbdStoragePool.deletePhysicalDisk(Mockito.eq("cloudstack-cbt-migration-uuid-disk-1"), Mockito.eq(Storage.ImageFormat.RAW))).thenReturn(false);
+        // The image is still listed on the pool, so the deletion genuinely failed and cleanup must say so
+        // rather than treating the target as already removed.
+        KVMPhysicalDisk stillPresent = Mockito.mock(KVMPhysicalDisk.class);
+        Mockito.when(stillPresent.getName()).thenReturn("cloudstack-cbt-migration-uuid-disk-1");
+        Mockito.when(rbdStoragePool.listPhysicalDisks()).thenReturn(List.of(stillPresent));
+        VmwareCbtCleanupCommand command = new VmwareCbtCleanupCommand(MIGRATION_UUID,
+                List.of(new VmwareCbtDiskTO("disk-1", 2000, "[datastore] vm/disk.vmdk", "datastore",
+                        "cloudstack-cbt-migration-uuid-disk-1", "raw", null, null, 8192)),
+                true, true, true);
+        command.setTargetStorageType(VmwareCbtTargetStorageType.RBD_RAW);
+        command.setDestinationStoragePoolType(Storage.StoragePoolType.RBD);
+        command.setDestinationStoragePoolUuid("rbd-pool-uuid");
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertTrue(answer.getDetails().contains("Unable to clean up VMware CBT migration"));
+    }
+
+    /**
+     * A cancelled migration has already had its targets released, so the delete that follows (whose
+     * cleanup parameter defaults to true) runs cleanup a second time. Cleanup has to be idempotent: a
+     * target the pool no longer lists is the intended end state, not a failure.
+     */
+    @Test
+    public void testExecuteSucceedsWhenRbdTargetImageIsAlreadyGone() {
+        Mockito.when(libvirtComputingResource.getStoragePoolMgr()).thenReturn(storagePoolManager);
+        Mockito.when(storagePoolManager.getStoragePool(Storage.StoragePoolType.RBD, "rbd-pool-uuid")).thenReturn(rbdStoragePool);
+        Mockito.when(rbdStoragePool.getType()).thenReturn(Storage.StoragePoolType.RBD);
+        Mockito.when(rbdStoragePool.getUuid()).thenReturn("rbd-pool-uuid");
+        Mockito.when(rbdStoragePool.deletePhysicalDisk(Mockito.eq("cloudstack-cbt-migration-uuid-disk-1"), Mockito.eq(Storage.ImageFormat.RAW))).thenReturn(false);
+        // The pool is reachable and simply no longer holds the image.
+        KVMPhysicalDisk unrelated = Mockito.mock(KVMPhysicalDisk.class);
+        Mockito.when(unrelated.getName()).thenReturn("some-other-image");
+        Mockito.when(rbdStoragePool.listPhysicalDisks()).thenReturn(List.of(unrelated));
+        VmwareCbtCleanupCommand command = new VmwareCbtCleanupCommand(MIGRATION_UUID,
+                List.of(new VmwareCbtDiskTO("disk-1", 2000, "[datastore] vm/disk.vmdk", "datastore",
+                        "cloudstack-cbt-migration-uuid-disk-1", "raw", null, null, 8192)),
+                true, true, true);
+        command.setTargetStorageType(VmwareCbtTargetStorageType.RBD_RAW);
+        command.setDestinationStoragePoolType(Storage.StoragePoolType.RBD);
+        command.setDestinationStoragePoolUuid("rbd-pool-uuid");
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getDetails(), answer.getResult());
+    }
+
+    /**
+     * If the pool cannot be inspected, absence cannot be proven, so a failed deletion must still be
+     * reported as a failure rather than masked.
+     */
+    @Test
+    public void testExecuteFailsWhenPoolCannotBeInspected() {
+        Mockito.when(libvirtComputingResource.getStoragePoolMgr()).thenReturn(storagePoolManager);
+        Mockito.when(storagePoolManager.getStoragePool(Storage.StoragePoolType.RBD, "rbd-pool-uuid")).thenReturn(rbdStoragePool);
+        Mockito.when(rbdStoragePool.getType()).thenReturn(Storage.StoragePoolType.RBD);
+        Mockito.when(rbdStoragePool.getUuid()).thenReturn("rbd-pool-uuid");
+        Mockito.when(rbdStoragePool.deletePhysicalDisk(Mockito.eq("cloudstack-cbt-migration-uuid-disk-1"), Mockito.eq(Storage.ImageFormat.RAW))).thenReturn(false);
+        Mockito.when(rbdStoragePool.listPhysicalDisks()).thenThrow(new RuntimeException("pool unreachable"));
+        VmwareCbtCleanupCommand command = new VmwareCbtCleanupCommand(MIGRATION_UUID,
+                List.of(new VmwareCbtDiskTO("disk-1", 2000, "[datastore] vm/disk.vmdk", "datastore",
+                        "cloudstack-cbt-migration-uuid-disk-1", "raw", null, null, 8192)),
+                true, true, true);
+        command.setTargetStorageType(VmwareCbtTargetStorageType.RBD_RAW);
+        command.setDestinationStoragePoolType(Storage.StoragePoolType.RBD);
+        command.setDestinationStoragePoolUuid("rbd-pool-uuid");
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertFalse(answer.getResult());
+    }
+
+    private VmwareCbtCleanupCommand createCommand(String targetPath) {
+        return new VmwareCbtCleanupCommand(MIGRATION_UUID,
+                List.of(new VmwareCbtDiskTO("disk-1", 2000, "[datastore] vm/disk.vmdk", "datastore",
+                        targetPath, "qcow2", null, null, 8192)),
+                true, true, true);
+    }
+
+    private static class TestLibvirtVmwareCbtCleanupCommandWrapper extends LibvirtVmwareCbtCleanupCommandWrapper {
+        private final List<String> killedProcessMarkers = new ArrayList<>();
+
+        @Override
+        protected void killInFlightCopyProcesses(String marker, String migrationUuid) {
+            killedProcessMarkers.add(marker);
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtCutoverCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtCutoverCommandWrapperTest.java
new file mode 100644
index 000000000000..a287c81b16c8
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtCutoverCommandWrapperTest.java
@@ -0,0 +1,412 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.rules.TemporaryFolder;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.VmwareCbtCutoverCommand;
+import com.cloud.agent.api.VmwareCbtMigrationAnswer;
+import com.cloud.agent.api.to.RemoteInstanceTO;
+import com.cloud.agent.api.to.VmwareCbtDiskTO;
+import com.cloud.agent.api.to.VmwareCbtTargetStorageType;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.storage.Storage;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtVmwareCbtCutoverCommandWrapperTest {
+
+    private final TestLibvirtVmwareCbtCutoverCommandWrapper wrapper = new TestLibvirtVmwareCbtCutoverCommandWrapper();
+
+    @Rule
+    public TemporaryFolder temporaryFolder = new TemporaryFolder();
+
+    @Mock
+    private LibvirtComputingResource libvirtComputingResource;
+    @Mock
+    private KVMStoragePoolManager storagePoolManager;
+    @Mock
+    private KVMStoragePool rbdStoragePool;
+
+    @Before
+    public void setUp() {
+        Mockito.when(libvirtComputingResource.hostSupportsVddkBlockCopy(Mockito.nullable(String.class))).thenReturn(true);
+        Mockito.when(libvirtComputingResource.getLibguestfsBackend()).thenReturn("direct");
+        Mockito.when(libvirtComputingResource.getStoragePoolMgr()).thenReturn(storagePoolManager);
+        Mockito.when(storagePoolManager.getStoragePool(Storage.StoragePoolType.RBD, "rbd-pool-uuid")).thenReturn(rbdStoragePool);
+        Mockito.when(rbdStoragePool.getType()).thenReturn(Storage.StoragePoolType.RBD);
+        Mockito.when(rbdStoragePool.getSourceDir()).thenReturn("cloudstack");
+        Mockito.when(rbdStoragePool.getSourceHost()).thenReturn("10.0.0.10,10.0.0.11");
+        Mockito.when(rbdStoragePool.getSourcePort()).thenReturn(6789);
+        Mockito.when(rbdStoragePool.getAuthUserName()).thenReturn("client.admin");
+    }
+
+    @Test
+    public void testExecuteRunsVirtV2vInPlaceForSyncedQcow2Disks() throws IOException {
+        VmwareCbtCutoverCommand command = createCommand(List.of(
+                createDisk("disk-1", temporaryFolder.newFile("disk-1.qcow2").getAbsolutePath()),
+                createDisk("disk-2", temporaryFolder.newFile("disk-2.qcow2").getAbsolutePath())));
+        command.setWait(1);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getResult());
+        Assert.assertTrue(answer.getDetails().contains("virt-v2v-in-place conversion completed"));
+        Assert.assertTrue(wrapper.lastCommand.contains("virt-v2v-in-place --root first -i libvirtxml"));
+        Assert.assertTrue(wrapper.lastCommand.contains("export LIBGUESTFS_BACKEND='direct'"));
+        Assert.assertTrue(wrapper.lastSourceXml.contains("<driver name='qemu' type='qcow2'/>"));
+        Assert.assertTrue(wrapper.lastSourceXml.contains("<target dev='sda' bus='scsi'/>"));
+        Assert.assertTrue(wrapper.lastSourceXml.contains("<target dev='sdb' bus='scsi'/>"));
+        Assert.assertEquals(2, ((VmwareCbtMigrationAnswer) answer).getDiskResults().size());
+    }
+
+    @Test
+    public void testExecuteRelocatesInPlaceFinalizedDiskToStoragePoolRoot() throws IOException {
+        Path poolRoot = temporaryFolder.newFolder("pool-root").toPath();
+        Path migrationDir = poolRoot.resolve("cloudstack-cbt").resolve("migration-uuid");
+        Files.createDirectories(migrationDir);
+        Path sourceDisk = migrationDir.resolve("disk-1.qcow2");
+        Files.writeString(sourceDisk, "synced disk");
+        VmwareCbtCutoverCommand command = createCommand(List.of(createDisk("disk-1", sourceDisk.toString())));
+        command.setWait(1);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getResult());
+        VmwareCbtMigrationAnswer migrationAnswer = (VmwareCbtMigrationAnswer) answer;
+        Path relocatedPath = Path.of(migrationAnswer.getDiskResults().get(0).getTargetPath());
+        Assert.assertEquals(poolRoot, relocatedPath.getParent());
+        Assert.assertTrue(Files.exists(relocatedPath));
+        Assert.assertFalse(Files.exists(sourceDisk));
+        Assert.assertFalse(Files.exists(migrationDir));
+    }
+
+    @Test
+    public void testExecutePreservesNonEmptyMigrationDirectoryAfterRelocation() throws IOException {
+        Path poolRoot = temporaryFolder.newFolder("pool-root-with-marker").toPath();
+        Path migrationDir = poolRoot.resolve("cloudstack-cbt").resolve("migration-uuid");
+        Files.createDirectories(migrationDir);
+        Path sourceDisk = migrationDir.resolve("disk-1.qcow2");
+        Path marker = migrationDir.resolve("keep.marker");
+        Files.writeString(sourceDisk, "synced disk");
+        Files.writeString(marker, "keep");
+        VmwareCbtCutoverCommand command = createCommand(List.of(createDisk("disk-1", sourceDisk.toString())));
+        command.setWait(1);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getResult());
+        Assert.assertTrue(Files.isDirectory(migrationDir));
+        Assert.assertTrue(Files.exists(marker));
+        Assert.assertFalse(Files.exists(sourceDisk));
+    }
+
+    @Test
+    public void testExecuteRunsVirtV2vCoreInPlaceOptionForSyncedQcow2Disks() throws IOException {
+        wrapper.finalizationMode = LibvirtVmwareCbtCutoverCommandWrapper.VirtV2vFinalizationMode.VIRT_V2V_IN_PLACE_OPTION;
+        VmwareCbtCutoverCommand command = createCommand(List.of(createDisk("disk-1",
+                temporaryFolder.newFile("disk-1.qcow2").getAbsolutePath())));
+        command.setWait(1);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getResult());
+        Assert.assertTrue(answer.getDetails().contains("virt-v2v --in-place conversion completed"));
+        Assert.assertTrue(wrapper.lastCommand.contains("virt-v2v --root first -i libvirtxml"));
+        Assert.assertTrue(wrapper.lastCommand.contains("--in-place -v"));
+        Assert.assertFalse(wrapper.lastCommand.contains("virt-v2v-in-place"));
+        Assert.assertFalse(wrapper.lastCommand.contains("-O "));
+        Assert.assertEquals(1, ((VmwareCbtMigrationAnswer) answer).getDiskResults().size());
+    }
+
+    @Test
+    public void testExecuteRunsVirtV2vInPlaceForRawRbdDisks() {
+        VmwareCbtDiskTO disk = createDisk("disk-1", "cloudstack-cbt-migration-uuid-disk-1-disk-1", "raw");
+        VmwareCbtCutoverCommand command = createCommand(List.of(disk));
+        command.setTargetStorageType(VmwareCbtTargetStorageType.RBD_RAW);
+        command.setDestinationStoragePoolType(Storage.StoragePoolType.RBD);
+        command.setDestinationStoragePoolUuid("rbd-pool-uuid");
+        command.setWait(1);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getResult());
+        Assert.assertTrue(wrapper.lastCommand.startsWith("bash '"));
+        Assert.assertTrue(wrapper.lastScript.contains("qemu-nbd --fork --persistent --shared=1 --format=raw"));
+        Assert.assertTrue(wrapper.lastSourceXml.contains("<disk type='network' device='disk'>"));
+        Assert.assertTrue(wrapper.lastSourceXml.contains("<driver name='qemu' type='raw'/>"));
+        Assert.assertTrue(wrapper.lastSourceXml.contains("<source protocol='nbd'>"));
+        Assert.assertTrue(wrapper.lastSourceXml.contains("<host name='localhost' port='"));
+        Assert.assertFalse(wrapper.lastSourceXml.contains("protocol='rbd'"));
+        Assert.assertEquals("cloudstack-cbt-migration-uuid-disk-1-disk-1",
+                ((VmwareCbtMigrationAnswer) answer).getDiskResults().get(0).getTargetPath());
+    }
+
+    @Test
+    public void testExecuteRunsVirtV2vInPlaceForRawBlockDeviceDisks() {
+        KVMStoragePool linstorStoragePool = Mockito.mock(KVMStoragePool.class);
+        com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk targetDisk = Mockito.mock(com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk.class);
+        Mockito.when(storagePoolManager.getStoragePool(Storage.StoragePoolType.Linstor, "linstor-pool-uuid")).thenReturn(linstorStoragePool);
+        Mockito.when(linstorStoragePool.getType()).thenReturn(Storage.StoragePoolType.Linstor);
+        Mockito.when(targetDisk.getPath()).thenReturn("/dev/drbd/by-res/cs-cbt-migratio-2000/0");
+        Mockito.when(linstorStoragePool.getPhysicalDisk("cbt-migratio-2000")).thenReturn(targetDisk);
+
+        VmwareCbtDiskTO disk = createDisk("disk-1", "cbt-migratio-2000", "raw");
+        VmwareCbtCutoverCommand command = createCommand(List.of(disk));
+        command.setTargetStorageType(VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE);
+        command.setDestinationStoragePoolType(Storage.StoragePoolType.Linstor);
+        command.setDestinationStoragePoolUuid("linstor-pool-uuid");
+        command.setWait(1);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getDetails(), answer.getResult());
+        Assert.assertTrue(wrapper.lastSourceXml.contains("<disk type='block' device='disk'>"));
+        Assert.assertTrue(wrapper.lastSourceXml.contains("<source dev='/dev/drbd/by-res/cs-cbt-migratio-2000/0'/>"));
+        Assert.assertFalse(wrapper.lastSourceXml.contains("protocol='nbd'"));
+        Assert.assertFalse(wrapper.lastCommand.contains("qemu-nbd"));
+        Assert.assertEquals("cbt-migratio-2000",
+                ((VmwareCbtMigrationAnswer) answer).getDiskResults().get(0).getTargetPath());
+    }
+
+    @Test
+    public void testExecuteRejectsBlockDeviceWhenInPlaceFinalizationIsUnavailable() {
+        wrapper.finalizationMode = LibvirtVmwareCbtCutoverCommandWrapper.VirtV2vFinalizationMode.VIRT_V2V_FALLBACK;
+        KVMStoragePool linstorStoragePool = Mockito.mock(KVMStoragePool.class);
+        Mockito.when(storagePoolManager.getStoragePool(Storage.StoragePoolType.Linstor, "linstor-pool-uuid")).thenReturn(linstorStoragePool);
+        Mockito.when(linstorStoragePool.getType()).thenReturn(Storage.StoragePoolType.Linstor);
+        VmwareCbtDiskTO disk = createDisk("disk-1", "cbt-migratio-2000", "raw");
+        VmwareCbtCutoverCommand command = createCommand(List.of(disk));
+        command.setTargetStorageType(VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE);
+        command.setDestinationStoragePoolType(Storage.StoragePoolType.Linstor);
+        command.setDestinationStoragePoolUuid("linstor-pool-uuid");
+        command.setAllowNonInPlaceFinalization(true);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertTrue(answer.getDetails().contains("Block device target finalization requires virt-v2v in-place support"));
+    }
+
+    @Test
+    public void testExecuteRejectsRbdWhenInPlaceFinalizationIsUnavailable() {
+        wrapper.finalizationMode = LibvirtVmwareCbtCutoverCommandWrapper.VirtV2vFinalizationMode.VIRT_V2V_FALLBACK;
+        VmwareCbtDiskTO disk = createDisk("disk-1", "cloudstack-cbt-migration-uuid-disk-1-disk-1", "raw");
+        VmwareCbtCutoverCommand command = createCommand(List.of(disk));
+        command.setTargetStorageType(VmwareCbtTargetStorageType.RBD_RAW);
+        command.setDestinationStoragePoolType(Storage.StoragePoolType.RBD);
+        command.setDestinationStoragePoolUuid("rbd-pool-uuid");
+        command.setAllowNonInPlaceFinalization(true);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertTrue(answer.getDetails().contains("RBD target finalization requires virt-v2v in-place support"));
+    }
+
+    @Test
+    public void testExecuteRejectsMissingTargetDisk() {
+        VmwareCbtCutoverCommand command = createCommand(List.of(createDisk("disk-1", "/path/that/does/not/exist.qcow2")));
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertTrue(answer.getDetails().contains("does not exist"));
+    }
+
+    @Test
+    public void testExecuteFallsBackToRegularVirtV2vWhenInPlaceIsMissing() throws IOException {
+        wrapper.finalizationMode = LibvirtVmwareCbtCutoverCommandWrapper.VirtV2vFinalizationMode.VIRT_V2V_FALLBACK;
+        Path sourceDisk = temporaryFolder.newFile("disk-1.qcow2").toPath();
+        VmwareCbtCutoverCommand command = createCommand(List.of(createDisk("disk-1", sourceDisk.toString())));
+        command.setAllowNonInPlaceFinalization(true);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getResult());
+        Assert.assertTrue(answer.getDetails().contains("virt-v2v fallback conversion completed"));
+        Assert.assertTrue(wrapper.lastCommand.contains("virt-v2v --root first -i libvirtxml"));
+        Assert.assertTrue(wrapper.lastCommand.contains("-o local"));
+        Assert.assertTrue(wrapper.lastCommand.contains("export TMPDIR="));
+        Assert.assertEquals(1, ((VmwareCbtMigrationAnswer) answer).getDiskResults().size());
+        Assert.assertTrue(((VmwareCbtMigrationAnswer) answer).getDiskResults().get(0).getTargetPath().contains("virt-v2v-output"));
+        Assert.assertFalse(Files.exists(sourceDisk));
+    }
+
+    @Test
+    public void testExecuteRelocatesFallbackFinalizedDiskToStoragePoolRoot() throws IOException {
+        wrapper.finalizationMode = LibvirtVmwareCbtCutoverCommandWrapper.VirtV2vFinalizationMode.VIRT_V2V_FALLBACK;
+        Path poolRoot = temporaryFolder.newFolder("pool-root-fallback").toPath();
+        Path migrationDir = poolRoot.resolve("cloudstack-cbt").resolve("migration-uuid");
+        Files.createDirectories(migrationDir);
+        Path sourceDisk = migrationDir.resolve("disk-1.qcow2");
+        Files.writeString(sourceDisk, "synced disk");
+        VmwareCbtCutoverCommand command = createCommand(List.of(createDisk("disk-1", sourceDisk.toString())));
+        command.setAllowNonInPlaceFinalization(true);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getResult());
+        VmwareCbtMigrationAnswer migrationAnswer = (VmwareCbtMigrationAnswer) answer;
+        Path relocatedPath = Path.of(migrationAnswer.getDiskResults().get(0).getTargetPath());
+        Assert.assertEquals(poolRoot, relocatedPath.getParent());
+        Assert.assertTrue(Files.exists(relocatedPath));
+        Assert.assertFalse(relocatedPath.toString().contains("virt-v2v-output"));
+        Assert.assertFalse(Files.exists(sourceDisk));
+        Assert.assertFalse(Files.exists(migrationDir));
+    }
+
+    @Test
+    public void testExecuteRejectsRegularVirtV2vFallbackWhenNotAllowed() throws IOException {
+        wrapper.finalizationMode = LibvirtVmwareCbtCutoverCommandWrapper.VirtV2vFinalizationMode.VIRT_V2V_FALLBACK;
+        VmwareCbtCutoverCommand command = createCommand(List.of(createDisk("disk-1",
+                temporaryFolder.newFile("disk-1.qcow2").getAbsolutePath())));
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertTrue(answer.getDetails().contains("cannot finalize VMware CBT migration in-place"));
+    }
+
+    @Test
+    public void testExecuteReturnsLastCommandOutputOnVirtV2vFailure() throws IOException {
+        wrapper.exitValue = 1;
+        wrapper.lastCommandOutput = "virt-v2v: error: internal error: assertion failed at linux_kernels.ml, line 185, char 13";
+        VmwareCbtCutoverCommand command = createCommand(List.of(createDisk("disk-1",
+                temporaryFolder.newFile("disk-1.qcow2").getAbsolutePath())));
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertTrue(answer.getDetails().contains("Last command output: virt-v2v: error"));
+    }
+
+    private VmwareCbtCutoverCommand createCommand(List<VmwareCbtDiskTO> disks) {
+        return new VmwareCbtCutoverCommand("migration-uuid", createRemoteInstance(), disks, 2, true);
+    }
+
+    private RemoteInstanceTO createRemoteInstance() {
+        return new RemoteInstanceTO("source-vm", null, "vcenter.example.com", "administrator@vsphere.local",
+                "password", "Datacenter", "Cluster", "esxi.example.com", "VirtualMachine:vm-1");
+    }
+
+    private VmwareCbtDiskTO createDisk(String diskId, String targetPath) {
+        return createDisk(diskId, targetPath, "qcow2");
+    }
+
+    private VmwareCbtDiskTO createDisk(String diskId, String targetPath, String targetFormat) {
+        return new VmwareCbtDiskTO(diskId, 2000, String.format("[%s] vm/%s.vmdk", diskId, diskId),
+                "datastore1", targetPath, targetFormat, "*", null, 8192);
+    }
+
+    private static class TestLibvirtVmwareCbtCutoverCommandWrapper extends LibvirtVmwareCbtCutoverCommandWrapper {
+        private VirtV2vFinalizationMode finalizationMode = VirtV2vFinalizationMode.VIRT_V2V_IN_PLACE_BINARY;
+        private String lastCommand;
+        private String lastScript = "";
+        private String lastSourceXml;
+        private int exitValue;
+        private String lastCommandOutput;
+
+        @Override
+        protected VirtV2vFinalizationMode getVirtV2vFinalizationMode(LibvirtComputingResource serverResource) {
+            return finalizationMode;
+        }
+
+        @Override
+        protected VmwareCbtCommandResult executeLoggedBash(String command, long timeout, String logPrefix) {
+            lastCommand = command;
+            lastScript = readScript(command);
+            String commandToInspect = lastScript.isEmpty() ? command : lastScript;
+            lastSourceXml = readSourceXml(commandToInspect);
+            if (exitValue == 0 && commandToInspect.contains("virt-v2v --root first")) {
+                createFallbackOutputDisk(commandToInspect);
+            }
+            return new VmwareCbtCommandResult(exitValue, lastCommandOutput);
+        }
+
+        private void createFallbackOutputDisk(String command) {
+            String marker = "-os '";
+            int start = command.indexOf(marker);
+            if (start < 0) {
+                return;
+            }
+            start += marker.length();
+            int end = command.indexOf("'", start);
+            if (end < 0) {
+                return;
+            }
+            try {
+                Path outputDir = Path.of(command.substring(start, end));
+                Files.createDirectories(outputDir);
+                Files.writeString(outputDir.resolve("migration-uuid-sda"), "converted disk");
+            } catch (IOException e) {
+                throw new RuntimeException(e);
+            }
+        }
+
+        private String readSourceXml(String command) {
+            String marker = "-i libvirtxml '";
+            int start = command.indexOf(marker);
+            if (start < 0) {
+                return "";
+            }
+            start += marker.length();
+            int end = command.indexOf("'", start);
+            if (end < 0) {
+                return "";
+            }
+            try {
+                return Files.readString(Path.of(command.substring(start, end)));
+            } catch (IOException e) {
+                return "";
+            }
+        }
+
+        private String readScript(String command) {
+            String marker = "bash '";
+            int start = command.indexOf(marker);
+            if (start < 0) {
+                return "";
+            }
+            start += marker.length();
+            int end = command.indexOf("'", start);
+            if (end < 0) {
+                return "";
+            }
+            try {
+                return Files.readString(Path.of(command.substring(start, end)));
+            } catch (IOException e) {
+                return "";
+            }
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtPrepareCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtPrepareCommandWrapperTest.java
new file mode 100644
index 000000000000..782df2fab4a4
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtPrepareCommandWrapperTest.java
@@ -0,0 +1,254 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.util.List;
+
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.rules.TemporaryFolder;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.VmwareCbtPrepareCommand;
+import com.cloud.agent.api.to.RemoteInstanceTO;
+import com.cloud.agent.api.to.VmwareCbtDiskTO;
+import com.cloud.agent.api.to.VmwareCbtTargetStorageType;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.storage.Storage;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtVmwareCbtPrepareCommandWrapperTest {
+
+    private static final String MIGRATION_UUID = "migration-uuid";
+
+    private final TestLibvirtVmwareCbtPrepareCommandWrapper wrapper = new TestLibvirtVmwareCbtPrepareCommandWrapper();
+
+    @Rule
+    public TemporaryFolder temporaryFolder = new TemporaryFolder();
+
+    @Mock
+    private LibvirtComputingResource libvirtComputingResource;
+    @Mock
+    private KVMStoragePoolManager storagePoolManager;
+    @Mock
+    private KVMStoragePool storagePool;
+    @Mock
+    private KVMStoragePool rbdStoragePool;
+
+    @Before
+    public void setUp() {
+        Mockito.when(libvirtComputingResource.hostSupportsVddkBlockCopy(Mockito.nullable(String.class))).thenReturn(true);
+        Mockito.when(libvirtComputingResource.getStoragePoolMgr()).thenReturn(storagePoolManager);
+        Mockito.when(storagePoolManager.getStoragePool(Storage.StoragePoolType.NetworkFilesystem, "pool-uuid")).thenReturn(storagePool);
+        Mockito.when(storagePool.getLocalPath()).thenReturn(temporaryFolder.getRoot().getAbsolutePath());
+        Mockito.when(storagePoolManager.getStoragePool(Storage.StoragePoolType.RBD, "rbd-pool-uuid")).thenReturn(rbdStoragePool);
+        Mockito.when(rbdStoragePool.getType()).thenReturn(Storage.StoragePoolType.RBD);
+        Mockito.when(rbdStoragePool.getSourceDir()).thenReturn("cloudstack");
+        Mockito.when(rbdStoragePool.getSourceHost()).thenReturn("10.0.0.10,10.0.0.11");
+        Mockito.when(rbdStoragePool.getSourcePort()).thenReturn(6789);
+    }
+
+    @Test
+    public void testExecuteReturnsLastCommandOutputOnInitialSyncFailure() {
+        wrapper.exitValue = 1;
+        wrapper.lastCommandOutput = "qemu-img: nbd+unix://?socket=/tmp/nbdkit/socket: error while reading at byte 1048576";
+        VmwareCbtPrepareCommand command = createCommand();
+        command.setVddkLibDir("/opt/vmware-vddk");
+        command.setVddkThumbprint("AA:BB:CC");
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertTrue(answer.getDetails(), answer.getDetails().contains("Last command output: qemu-img"));
+        Assert.assertTrue(answer.getDetails(), answer.getDetails().contains("error while reading"));
+    }
+
+    @Test
+    public void testExecuteCopiesInitialSyncDirectlyToRbdRawImage() {
+        Mockito.when(libvirtComputingResource.hostSupportsNbdcopy()).thenReturn(false);
+        VmwareCbtPrepareCommand command = createRbdCommand();
+        command.setVddkLibDir("/opt/vmware-vddk");
+        command.setVddkThumbprint("AA:BB:CC");
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getResult());
+        Assert.assertTrue(wrapper.lastCommand, wrapper.lastCommand.matches("(?s).*qemu-img convert -f raw -O .*raw.*\\\"\\$uri\\\".*"));
+        Assert.assertTrue(wrapper.lastCommand.contains("rbd:cloudstack/cloudstack-cbt-migration-uuid-disk-1-disk-1"));
+        Assert.assertFalse(wrapper.lastCommand.contains("-O qcow2"));
+        Assert.assertFalse(wrapper.lastCommand, wrapper.lastCommand.contains("nbdcopy"));
+    }
+
+    @Test
+    public void testExecuteUsesNbdcopyBridgeForRbdWhenAvailable() {
+        Mockito.when(libvirtComputingResource.hostSupportsNbdcopy()).thenReturn(true);
+        VmwareCbtPrepareCommand command = createRbdCommand();
+        command.setVddkLibDir("/opt/vmware-vddk");
+        command.setVddkThumbprint("AA:BB:CC");
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getDetails(), answer.getResult());
+        // pre-create the raw RBD image (nbdcopy/qemu-nbd cannot create it), bridge it over
+        // localhost qemu-nbd, and copy NBD-to-NBD keeping the fresh image sparse.
+        Assert.assertTrue(wrapper.lastCommand, wrapper.lastCommand.contains("qemu-img create -f raw "));
+        Assert.assertTrue(wrapper.lastCommand, wrapper.lastCommand.contains("rbd:cloudstack/cloudstack-cbt-migration-uuid-disk-1-disk-1"));
+        Assert.assertTrue(wrapper.lastCommand, wrapper.lastCommand.matches("(?s).*qemu-nbd --fork --persistent --shared=8 --format=raw --bind=127.0.0.1 --port=[0-9]+.*"));
+        Assert.assertTrue(wrapper.lastCommand, wrapper.lastCommand.matches("(?s).*nbdcopy --destination-is-zero \\\"\\$uri\\\" nbd://localhost:[0-9]+.*"));
+        Assert.assertFalse(wrapper.lastCommand, wrapper.lastCommand.contains("qemu-img convert"));
+    }
+
+    @Test
+    public void testAppliesVddkNbdCompressionToFullCopy() {
+        Mockito.when(libvirtComputingResource.getVddkNbdCompression()).thenReturn("fastlz");
+        VmwareCbtPrepareCommand command = createRbdCommand();
+        command.setVddkLibDir("/opt/vmware-vddk");
+        command.setVddkThumbprint("AA:BB:CC");
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getResult());
+        Assert.assertTrue(wrapper.lastCommand, wrapper.lastCommand.contains("compression='fastlz'"));
+    }
+
+    @Test
+    public void testExecuteCopiesInitialSyncDirectlyToBlockDevice() {
+        KVMStoragePool linstorStoragePool = Mockito.mock(KVMStoragePool.class);
+        com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk targetDisk = Mockito.mock(com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk.class);
+        Mockito.when(storagePoolManager.getStoragePool(Storage.StoragePoolType.Linstor, "linstor-pool-uuid")).thenReturn(linstorStoragePool);
+        Mockito.when(linstorStoragePool.getType()).thenReturn(Storage.StoragePoolType.Linstor);
+        Mockito.when(targetDisk.getPath()).thenReturn("/dev/drbd/by-res/cs-cbt-abc12345-2000/0");
+        Mockito.when(linstorStoragePool.createPhysicalDisk(Mockito.eq("cbt-abc12345-2000"), Mockito.any(), Mockito.any(),
+                Mockito.eq(8192L), Mockito.isNull())).thenReturn(targetDisk);
+        Mockito.when(linstorStoragePool.isVolumeZeroInitialized("cbt-abc12345-2000")).thenReturn(true);
+
+        VmwareCbtDiskTO disk = new VmwareCbtDiskTO("disk-1", 2000, "[datastore1] vm/disk-1.vmdk",
+                "datastore1", "cbt-abc12345-2000", "raw", "*", null, 8192);
+        VmwareCbtPrepareCommand command = new VmwareCbtPrepareCommand(MIGRATION_UUID, createRemoteInstance(), List.of(disk),
+                Storage.StoragePoolType.Linstor, "linstor-pool-uuid", VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE,
+                "VirtualMachineSnapshot:snapshot-1");
+        command.setVddkLibDir("/opt/vmware-vddk");
+        command.setVddkThumbprint("AA:BB:CC");
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getDetails(), answer.getResult());
+        Assert.assertTrue(wrapper.lastCommand, wrapper.lastCommand.contains("qemu-img convert -n --target-is-zero -f raw -O "));
+        Assert.assertTrue(wrapper.lastCommand, wrapper.lastCommand.matches("(?s).*qemu-img convert -n --target-is-zero -f raw -O .*raw.*\\\"\\$uri\\\".*"));
+        Assert.assertTrue(wrapper.lastCommand, wrapper.lastCommand.contains("/dev/drbd/by-res/cs-cbt-abc12345-2000/0"));
+        Mockito.verify(linstorStoragePool).createPhysicalDisk(Mockito.eq("cbt-abc12345-2000"), Mockito.any(), Mockito.any(),
+                Mockito.eq(8192L), Mockito.isNull());
+    }
+
+    @Test
+    public void testExecuteUsesNbdcopyForBlockDeviceWhenAvailable() {
+        Mockito.when(libvirtComputingResource.hostSupportsNbdcopy()).thenReturn(true);
+        KVMStoragePool linstorStoragePool = Mockito.mock(KVMStoragePool.class);
+        com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk targetDisk = Mockito.mock(com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk.class);
+        Mockito.when(storagePoolManager.getStoragePool(Storage.StoragePoolType.Linstor, "linstor-pool-uuid")).thenReturn(linstorStoragePool);
+        Mockito.when(linstorStoragePool.getType()).thenReturn(Storage.StoragePoolType.Linstor);
+        Mockito.when(targetDisk.getPath()).thenReturn("/dev/drbd/by-res/cs-cbt-abc12345-2000/0");
+        Mockito.when(linstorStoragePool.createPhysicalDisk(Mockito.eq("cbt-abc12345-2000"), Mockito.any(), Mockito.any(),
+                Mockito.eq(8192L), Mockito.isNull())).thenReturn(targetDisk);
+        Mockito.when(linstorStoragePool.isVolumeZeroInitialized("cbt-abc12345-2000")).thenReturn(true);
+
+        VmwareCbtDiskTO disk = new VmwareCbtDiskTO("disk-1", 2000, "[datastore1] vm/disk-1.vmdk",
+                "datastore1", "cbt-abc12345-2000", "raw", "*", null, 8192);
+        VmwareCbtPrepareCommand command = new VmwareCbtPrepareCommand(MIGRATION_UUID, createRemoteInstance(), List.of(disk),
+                Storage.StoragePoolType.Linstor, "linstor-pool-uuid", VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE,
+                "VirtualMachineSnapshot:snapshot-1");
+        command.setVddkLibDir("/opt/vmware-vddk");
+        command.setVddkThumbprint("AA:BB:CC");
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getDetails(), answer.getResult());
+        Assert.assertTrue(wrapper.lastCommand, wrapper.lastCommand.matches("(?s).*nbdcopy --destination-is-zero \\\"\\$uri\\\" .*/dev/drbd/by-res/cs-cbt-abc12345-2000/0.*"));
+        Assert.assertFalse(wrapper.lastCommand, wrapper.lastCommand.contains("qemu-img convert"));
+    }
+
+    @Test
+    public void testExecuteWritesZerosForNonZeroInitializedBlockDevice() {
+        // LVM-thick (or any provider that does not zero-initialize new volumes): the copy must
+        // NOT skip zeros, or stale data from a previously deleted volume would leak into the disk.
+        KVMStoragePool linstorStoragePool = Mockito.mock(KVMStoragePool.class);
+        com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk targetDisk = Mockito.mock(com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk.class);
+        Mockito.when(storagePoolManager.getStoragePool(Storage.StoragePoolType.Linstor, "linstor-pool-uuid")).thenReturn(linstorStoragePool);
+        Mockito.when(linstorStoragePool.getType()).thenReturn(Storage.StoragePoolType.Linstor);
+        Mockito.when(targetDisk.getPath()).thenReturn("/dev/drbd/by-res/cs-cbt-abc12345-2000/0");
+        Mockito.when(linstorStoragePool.createPhysicalDisk(Mockito.eq("cbt-abc12345-2000"), Mockito.any(), Mockito.any(),
+                Mockito.eq(8192L), Mockito.isNull())).thenReturn(targetDisk);
+        Mockito.when(linstorStoragePool.isVolumeZeroInitialized("cbt-abc12345-2000")).thenReturn(false);
+
+        VmwareCbtDiskTO disk = new VmwareCbtDiskTO("disk-1", 2000, "[datastore1] vm/disk-1.vmdk",
+                "datastore1", "cbt-abc12345-2000", "raw", "*", null, 8192);
+        VmwareCbtPrepareCommand command = new VmwareCbtPrepareCommand(MIGRATION_UUID, createRemoteInstance(), List.of(disk),
+                Storage.StoragePoolType.Linstor, "linstor-pool-uuid", VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE,
+                "VirtualMachineSnapshot:snapshot-1");
+        command.setVddkLibDir("/opt/vmware-vddk");
+        command.setVddkThumbprint("AA:BB:CC");
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getDetails(), answer.getResult());
+        // still no-create (-n) into the pre-created device, but zeros ARE written (no --target-is-zero)
+        Assert.assertTrue(wrapper.lastCommand, wrapper.lastCommand.contains("qemu-img convert -n -f raw -O "));
+        Assert.assertFalse(wrapper.lastCommand, wrapper.lastCommand.contains("--target-is-zero"));
+        Assert.assertFalse(wrapper.lastCommand, wrapper.lastCommand.contains("--destination-is-zero"));
+    }
+
+    private VmwareCbtPrepareCommand createCommand() {
+        VmwareCbtDiskTO disk = new VmwareCbtDiskTO("disk-1", 2000, "[datastore1] vm/disk-1.vmdk",
+                "datastore1", null, "qcow2", "*", null, 8192);
+        return new VmwareCbtPrepareCommand(MIGRATION_UUID, createRemoteInstance(), List.of(disk),
+                Storage.StoragePoolType.NetworkFilesystem, "pool-uuid", VmwareCbtTargetStorageType.QCOW2_FILE,
+                "VirtualMachineSnapshot:snapshot-1");
+    }
+
+    private VmwareCbtPrepareCommand createRbdCommand() {
+        VmwareCbtDiskTO disk = new VmwareCbtDiskTO("disk-1", 2000, "[datastore1] vm/disk-1.vmdk",
+                "datastore1", null, "raw", "*", null, 8192);
+        return new VmwareCbtPrepareCommand(MIGRATION_UUID, createRemoteInstance(), List.of(disk),
+                Storage.StoragePoolType.RBD, "rbd-pool-uuid", VmwareCbtTargetStorageType.RBD_RAW,
+                "VirtualMachineSnapshot:snapshot-1");
+    }
+
+    private RemoteInstanceTO createRemoteInstance() {
+        return new RemoteInstanceTO("source-vm", null, "vcenter.example.com", "administrator@vsphere.local",
+                "password", "Datacenter", "Cluster", "esxi.example.com", "VirtualMachine:vm-1");
+    }
+
+    private static class TestLibvirtVmwareCbtPrepareCommandWrapper extends LibvirtVmwareCbtPrepareCommandWrapper {
+        private int exitValue;
+        private String lastCommandOutput;
+        private String lastCommand;
+
+        @Override
+        protected VmwareCbtCommandResult executeLoggedBash(String command, long timeout, String logPrefix) {
+            lastCommand = command;
+            return new VmwareCbtCommandResult(exitValue, lastCommandOutput);
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtRbdProbeCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtRbdProbeCommandWrapperTest.java
new file mode 100644
index 000000000000..88ace50c991a
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtRbdProbeCommandWrapperTest.java
@@ -0,0 +1,167 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.VmwareCbtRbdProbeCommand;
+import com.cloud.agent.api.to.VmwareCbtTargetStorageType;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.storage.Storage;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtVmwareCbtRbdProbeCommandWrapperTest {
+
+    private static final String POOL_UUID = "rbd-pool-uuid";
+    private static final String PROBE_IMAGE = "cloudstack-cbt-probe-11111111-2222-3333-4444-555555555555";
+
+    private final TestLibvirtVmwareCbtRbdProbeCommandWrapper wrapper = new TestLibvirtVmwareCbtRbdProbeCommandWrapper();
+
+    @Mock
+    private LibvirtComputingResource libvirtComputingResource;
+    @Mock
+    private KVMStoragePoolManager storagePoolManager;
+    @Mock
+    private KVMStoragePool rbdStoragePool;
+
+    @Before
+    public void setUp() {
+        Mockito.when(libvirtComputingResource.getPrivateIp()).thenReturn("10.0.0.10");
+        Mockito.when(libvirtComputingResource.getStoragePoolMgr()).thenReturn(storagePoolManager);
+        Mockito.when(storagePoolManager.getStoragePool(Storage.StoragePoolType.RBD, POOL_UUID)).thenReturn(rbdStoragePool);
+        Mockito.when(rbdStoragePool.getType()).thenReturn(Storage.StoragePoolType.RBD);
+        Mockito.when(rbdStoragePool.getUuid()).thenReturn(POOL_UUID);
+        Mockito.when(rbdStoragePool.getSourceDir()).thenReturn("cloudstack");
+        Mockito.when(rbdStoragePool.getSourceHost()).thenReturn("10.0.0.20,10.0.0.21");
+        Mockito.when(rbdStoragePool.getSourcePort()).thenReturn(6789);
+        Mockito.when(rbdStoragePool.getAuthUserName()).thenReturn("cloudstack");
+        Mockito.when(rbdStoragePool.getAuthSecret()).thenReturn("secret");
+    }
+
+    @Test
+    public void testExecuteCreatesWritesReadsAndCleansTemporaryRbdImage() {
+        Answer answer = wrapper.execute(createCommand(), libvirtComputingResource);
+
+        Assert.assertTrue(answer.getDetails(), answer.getResult());
+        Assert.assertEquals(2, wrapper.commands.size());
+        Assert.assertTrue(wrapper.commands.get(0), wrapper.commands.get(0).contains("qemu-img create -f raw"));
+        Assert.assertTrue(wrapper.commands.get(0), wrapper.commands.get(0).contains("rbd:cloudstack/" + PROBE_IMAGE));
+        Assert.assertTrue(wrapper.commands.get(1), wrapper.commands.get(1).contains("qemu-io -f raw"));
+        Assert.assertTrue(wrapper.cleanedImages.contains(PROBE_IMAGE));
+    }
+
+    @Test
+    public void testExecuteFailsForNonRbdCommand() {
+        VmwareCbtRbdProbeCommand command = new VmwareCbtRbdProbeCommand(Storage.StoragePoolType.NetworkFilesystem,
+                POOL_UUID, PROBE_IMAGE);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertTrue(answer.getDetails(), answer.getDetails().contains("requires an RBD destination storage pool"));
+    }
+
+    @Test
+    public void testExecuteFailsForUnsafeProbeImageName() {
+        VmwareCbtRbdProbeCommand command = new VmwareCbtRbdProbeCommand(Storage.StoragePoolType.RBD,
+                POOL_UUID, "not-cloudstack-owned");
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertTrue(answer.getDetails(), answer.getDetails().contains("probe image name must match"));
+    }
+
+    @Test
+    public void testExecuteCreatesWritesReadsAndCleansTemporaryBlockDeviceVolume() {
+        KVMStoragePool linstorStoragePool = Mockito.mock(KVMStoragePool.class);
+        com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk probeDisk = Mockito.mock(com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk.class);
+        Mockito.when(storagePoolManager.getStoragePool(Storage.StoragePoolType.Linstor, "linstor-pool-uuid")).thenReturn(linstorStoragePool);
+        Mockito.when(linstorStoragePool.getType()).thenReturn(Storage.StoragePoolType.Linstor);
+        Mockito.when(probeDisk.getPath()).thenReturn("/dev/drbd/by-res/cs-cbt-probe-1234abcd/0");
+        Mockito.when(linstorStoragePool.createPhysicalDisk(Mockito.eq("cbt-probe-1234abcd"), Mockito.any(), Mockito.any(),
+                Mockito.anyLong(), Mockito.isNull())).thenReturn(probeDisk);
+
+        VmwareCbtRbdProbeCommand command = new VmwareCbtRbdProbeCommand(Storage.StoragePoolType.Linstor,
+                "linstor-pool-uuid", "cbt-probe-1234abcd");
+        command.setTargetStorageType(VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getDetails(), answer.getResult());
+        Assert.assertEquals(1, wrapper.commands.size());
+        Assert.assertTrue(wrapper.commands.get(0), wrapper.commands.get(0).contains("qemu-io -f raw"));
+        Assert.assertTrue(wrapper.commands.get(0), wrapper.commands.get(0).contains("/dev/drbd/by-res/cs-cbt-probe-1234abcd/0"));
+        Assert.assertTrue(wrapper.cleanedImages.contains("cbt-probe-1234abcd"));
+    }
+
+    @Test
+    public void testExecuteBlockDeviceProbeFailsForUnsafeName() {
+        VmwareCbtRbdProbeCommand command = new VmwareCbtRbdProbeCommand(Storage.StoragePoolType.Linstor,
+                "linstor-pool-uuid", "not-cloudstack-owned");
+        command.setTargetStorageType(VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertTrue(answer.getDetails(), answer.getDetails().contains("probe volume name must match"));
+    }
+
+    @Test
+    public void testExecuteReportsQemuFailureAndStillAttemptsCleanup() {
+        wrapper.exitValue = 1;
+
+        Answer answer = wrapper.execute(createCommand(), libvirtComputingResource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertTrue(answer.getDetails(), answer.getDetails().contains("qemu RBD probe create failed"));
+        Assert.assertTrue(wrapper.cleanedImages.contains(PROBE_IMAGE));
+    }
+
+    private VmwareCbtRbdProbeCommand createCommand() {
+        return new VmwareCbtRbdProbeCommand(Storage.StoragePoolType.RBD, POOL_UUID, PROBE_IMAGE);
+    }
+
+    private static class TestLibvirtVmwareCbtRbdProbeCommandWrapper extends LibvirtVmwareCbtRbdProbeCommandWrapper {
+        private final List<String> commands = new ArrayList<>();
+        private final List<String> cleanedImages = new ArrayList<>();
+        private int exitValue;
+
+        @Override
+        protected int runBashCommand(String command, long timeout) {
+            commands.add(command);
+            return exitValue;
+        }
+
+        @Override
+        protected void cleanupProbeImage(KVMStoragePool targetPool, String probeImageName) {
+            cleanedImages.add(probeImageName);
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtSyncCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtSyncCommandWrapperTest.java
new file mode 100644
index 000000000000..4499b501a26f
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtVmwareCbtSyncCommandWrapperTest.java
@@ -0,0 +1,246 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Collections;
+import java.util.List;
+
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.rules.TemporaryFolder;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.VmwareCbtMigrationAnswer;
+import com.cloud.agent.api.VmwareCbtSyncCommand;
+import com.cloud.agent.api.to.RemoteInstanceTO;
+import com.cloud.agent.api.to.VmwareCbtChangedBlockRangeTO;
+import com.cloud.agent.api.to.VmwareCbtDiskTO;
+import com.cloud.agent.api.to.VmwareCbtTargetStorageType;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.storage.Storage;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtVmwareCbtSyncCommandWrapperTest {
+
+    private final TestLibvirtVmwareCbtSyncCommandWrapper wrapper = new TestLibvirtVmwareCbtSyncCommandWrapper();
+
+    @Rule
+    public TemporaryFolder temporaryFolder = new TemporaryFolder();
+
+    @Mock
+    private LibvirtComputingResource libvirtComputingResource;
+    @Mock
+    private KVMStoragePoolManager storagePoolManager;
+    @Mock
+    private KVMStoragePool rbdStoragePool;
+
+    @Before
+    public void setUp() {
+        Mockito.when(libvirtComputingResource.hostSupportsVddkBlockCopy(Mockito.nullable(String.class))).thenReturn(true);
+        Mockito.when(libvirtComputingResource.getStoragePoolMgr()).thenReturn(storagePoolManager);
+        Mockito.when(storagePoolManager.getStoragePool(Storage.StoragePoolType.RBD, "rbd-pool-uuid")).thenReturn(rbdStoragePool);
+        Mockito.when(rbdStoragePool.getType()).thenReturn(Storage.StoragePoolType.RBD);
+        Mockito.when(rbdStoragePool.getSourceDir()).thenReturn("cloudstack");
+        Mockito.when(rbdStoragePool.getSourceHost()).thenReturn("10.0.0.10");
+        Mockito.when(rbdStoragePool.getSourcePort()).thenReturn(6789);
+    }
+
+    @Test
+    public void testExecuteNoChangedBlocksReturnsReadyForCutover() {
+        VmwareCbtSyncCommand command = createCommand(Collections.emptyList(), Collections.emptyList());
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getResult());
+        Assert.assertTrue(((VmwareCbtMigrationAnswer) answer).getReadyForCutover());
+    }
+
+    @Test
+    public void testExecuteRejectsChangedBlocksWithoutTargetPath() {
+        VmwareCbtDiskTO disk = createDisk("disk-1", null, 8192);
+        VmwareCbtSyncCommand command = createCommand(List.of(disk),
+                List.of(new VmwareCbtChangedBlockRangeTO("disk-1", 0, 1024)));
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertTrue(answer.getDetails().contains("no target path"));
+    }
+
+    @Test
+    public void testExecuteCopiesValidatedChangedBlocks() throws IOException {
+        VmwareCbtDiskTO disk = createDisk("disk-1", temporaryFolder.newFile("disk-1.qcow2").getAbsolutePath(), 8192);
+        VmwareCbtSyncCommand command = createCommand(List.of(disk),
+                List.of(new VmwareCbtChangedBlockRangeTO("disk-1", 0, 1024)));
+        command.setVddkLibDir("/opt/vmware-vddk");
+        command.setVddkThumbprint("AA:BB:CC");
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getResult());
+        Assert.assertEquals(1024, ((VmwareCbtMigrationAnswer) answer).getChangedBytes());
+        Assert.assertTrue(answer.getDetails().contains("copied 1 changed block range"));
+        Assert.assertTrue(wrapper.lastCommand.contains("nbdkit -r -U - vddk"));
+        Assert.assertTrue(wrapper.lastCommand.contains("export uri; bash "));
+        Assert.assertTrue(wrapper.lastDiskSyncScript.contains("qemu-img convert --image-opts -O raw"));
+        Assert.assertTrue(wrapper.lastDiskSyncScript.contains("file.driver=nbd,file.server.type=unix,file.server.path=$nbd_socket_path"));
+        Assert.assertFalse(wrapper.lastDiskSyncScript.contains("qemu-img dd"));
+        Assert.assertFalse(wrapper.lastDiskSyncScript.contains("dd if=\"$source_nbd\""));
+    }
+
+    @Test
+    public void testExecuteWritesChangedBlocksToRawRbdTarget() {
+        VmwareCbtDiskTO disk = createDisk("disk-1", "cloudstack-cbt-migration-uuid-disk-1-disk-1", 8192, "raw");
+        VmwareCbtSyncCommand command = createCommand(List.of(disk),
+                List.of(new VmwareCbtChangedBlockRangeTO("disk-1", 0, 1024)));
+        command.setTargetStorageType(VmwareCbtTargetStorageType.RBD_RAW);
+        command.setDestinationStoragePoolType(Storage.StoragePoolType.RBD);
+        command.setDestinationStoragePoolUuid("rbd-pool-uuid");
+        command.setVddkLibDir("/opt/vmware-vddk");
+        command.setVddkThumbprint("AA:BB:CC");
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getResult());
+        Assert.assertTrue(wrapper.lastDiskSyncScript.contains("target_format='raw'"));
+        Assert.assertTrue(wrapper.lastDiskSyncScript.contains("rbd:cloudstack/cloudstack-cbt-migration-uuid-disk-1-disk-1"));
+        Assert.assertTrue(wrapper.lastDiskSyncScript.contains("qemu-img convert --image-opts -O raw"));
+        Assert.assertTrue(wrapper.lastDiskSyncScript.contains("qemu-io -f \"$target_format\""));
+    }
+
+    @Test
+    public void testExecuteWritesChangedBlocksToRawBlockDeviceTarget() {
+        KVMStoragePool linstorStoragePool = Mockito.mock(KVMStoragePool.class);
+        com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk targetDisk = Mockito.mock(com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk.class);
+        Mockito.when(storagePoolManager.getStoragePool(Storage.StoragePoolType.Linstor, "linstor-pool-uuid")).thenReturn(linstorStoragePool);
+        Mockito.when(linstorStoragePool.getType()).thenReturn(Storage.StoragePoolType.Linstor);
+        Mockito.when(targetDisk.getPath()).thenReturn("/dev/drbd/by-res/cs-cbt-abc12345-2000/0");
+        Mockito.when(linstorStoragePool.getPhysicalDisk("cbt-abc12345-2000")).thenReturn(targetDisk);
+
+        VmwareCbtDiskTO disk = createDisk("disk-1", "cbt-abc12345-2000", 8192, "raw");
+        VmwareCbtSyncCommand command = createCommand(List.of(disk),
+                List.of(new VmwareCbtChangedBlockRangeTO("disk-1", 0, 1024)));
+        command.setTargetStorageType(VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE);
+        command.setDestinationStoragePoolType(Storage.StoragePoolType.Linstor);
+        command.setDestinationStoragePoolUuid("linstor-pool-uuid");
+        command.setVddkLibDir("/opt/vmware-vddk");
+        command.setVddkThumbprint("AA:BB:CC");
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getDetails(), answer.getResult());
+        Assert.assertTrue(wrapper.lastDiskSyncScript.contains("target_format='raw'"));
+        Assert.assertTrue(wrapper.lastDiskSyncScript.contains("target_path='/dev/drbd/by-res/cs-cbt-abc12345-2000/0'"));
+        // Block device deltas copy each changed extent directly (no temp-file round-trip):
+        // a single qemu-img convert from the nbd source window into the target device window.
+        Assert.assertTrue(wrapper.lastDiskSyncScript.contains("qemu-img convert -n -S 0 --image-opts --target-image-opts"));
+        Assert.assertTrue(wrapper.lastDiskSyncScript.contains("file.driver=host_device,file.filename=$target_path"));
+        Assert.assertFalse(wrapper.lastDiskSyncScript.contains("qemu-io -f \"$target_format\""));
+        Assert.assertFalse(wrapper.lastDiskSyncScript.contains("mktemp"));
+    }
+
+    @Test
+    public void testExecuteUsesCommandVddkLibDirOverrideForSupportCheck() throws IOException {
+        VmwareCbtDiskTO disk = createDisk("disk-1", temporaryFolder.newFile("disk-1.qcow2").getAbsolutePath(), 8192);
+        VmwareCbtSyncCommand command = createCommand(List.of(disk),
+                List.of(new VmwareCbtChangedBlockRangeTO("disk-1", 0, 1024)));
+        command.setVddkLibDir("/opt/vmware-vddk/override");
+        command.setVddkThumbprint("AA:BB:CC");
+        Mockito.when(libvirtComputingResource.hostSupportsVddkBlockCopy("/opt/vmware-vddk/override"))
+                .thenReturn(true);
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertTrue(answer.getResult());
+        Assert.assertTrue(answer.getDetails().contains("copied 1 changed block range"));
+        Mockito.verify(libvirtComputingResource).hostSupportsVddkBlockCopy("/opt/vmware-vddk/override");
+    }
+
+    @Test
+    public void testExecuteReturnsLastCommandOutputOnDeltaFailure() throws IOException {
+        wrapper.exitValue = 1;
+        wrapper.lastCommandOutput = "qemu-nbd: Failed to blk_new_open 'nbd+unix://?socket=/tmp/nbdkit/socket': Could not open image: Permission denied";
+        VmwareCbtDiskTO disk = createDisk("disk-1", temporaryFolder.newFile("disk-1.qcow2").getAbsolutePath(), 8192);
+        VmwareCbtSyncCommand command = createCommand(List.of(disk),
+                List.of(new VmwareCbtChangedBlockRangeTO("disk-1", 0, 1024)));
+        command.setVddkLibDir("/opt/vmware-vddk");
+        command.setVddkThumbprint("AA:BB:CC");
+
+        Answer answer = wrapper.execute(command, libvirtComputingResource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertTrue(answer.getDetails(), answer.getDetails().contains("Last command output: qemu-nbd"));
+        Assert.assertTrue(answer.getDetails(), answer.getDetails().contains("Permission denied"));
+    }
+
+    private VmwareCbtSyncCommand createCommand(List<VmwareCbtDiskTO> disks, List<VmwareCbtChangedBlockRangeTO> changedBlocks) {
+        return new VmwareCbtSyncCommand("migration-uuid", createRemoteInstance(), disks, changedBlocks, 1,
+                "VirtualMachineSnapshot:snapshot-1", false);
+    }
+
+    private RemoteInstanceTO createRemoteInstance() {
+        return new RemoteInstanceTO("source-vm", null, "vcenter.example.com", "administrator@vsphere.local",
+                "password", "Datacenter", "Cluster", "esxi.example.com", "VirtualMachine:vm-1");
+    }
+
+    private VmwareCbtDiskTO createDisk(String diskId, String targetPath, long capacityBytes) {
+        return createDisk(diskId, targetPath, capacityBytes, "qcow2");
+    }
+
+    private VmwareCbtDiskTO createDisk(String diskId, String targetPath, long capacityBytes, String targetFormat) {
+        return new VmwareCbtDiskTO(diskId, 2000, String.format("[%s] vm/%s.vmdk", diskId, diskId),
+                "datastore1", targetPath, targetFormat, "*", null, capacityBytes);
+    }
+
+    private static class TestLibvirtVmwareCbtSyncCommandWrapper extends LibvirtVmwareCbtSyncCommandWrapper {
+        private String lastCommand;
+        private String lastDiskSyncScript;
+        private int exitValue;
+        private String lastCommandOutput;
+
+        @Override
+        protected VmwareCbtCommandResult executeLoggedBash(String command, long timeout, String logPrefix) {
+            lastCommand = command;
+            return new VmwareCbtCommandResult(exitValue, lastCommandOutput);
+        }
+
+        @Override
+        protected String writeDiskSyncScript(VmwareCbtSyncCommand cmd, VmwareCbtSyncPlan.DiskPlan diskPlan,
+                                             KVMStoragePool targetPool) throws Exception {
+            String scriptPath = super.writeDiskSyncScript(cmd, diskPlan, targetPool);
+            lastDiskSyncScript = Files.readString(Path.of(scriptPath));
+            return scriptPath;
+        }
+
+        @Override
+        protected String getVcenterThumbprint(String vcenterHost, long timeout, String sourceVmName) {
+            return "AA:BB:CC";
+        }
+
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/VmwareCbtSyncPlanTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/VmwareCbtSyncPlanTest.java
new file mode 100644
index 000000000000..16cc6c4d2530
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/VmwareCbtSyncPlanTest.java
@@ -0,0 +1,98 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.util.List;
+
+import org.junit.Assert;
+import org.junit.Test;
+
+import com.cloud.agent.api.to.VmwareCbtChangedBlockRangeTO;
+import com.cloud.agent.api.to.VmwareCbtDiskTO;
+
+public class VmwareCbtSyncPlanTest {
+
+    @Test
+    public void testCreateGroupsChangedBlocksByDisk() {
+        VmwareCbtDiskTO disk1 = createDisk("disk-1", "/var/lib/libvirt/images/disk-1.qcow2", 8192);
+        VmwareCbtDiskTO disk2 = createDisk("disk-2", "/var/lib/libvirt/images/disk-2.qcow2", 8192);
+
+        VmwareCbtSyncPlan syncPlan = VmwareCbtSyncPlan.create(List.of(disk1, disk2), List.of(
+                new VmwareCbtChangedBlockRangeTO("disk-1", 0, 1024),
+                new VmwareCbtChangedBlockRangeTO("disk-1", 4096, 512),
+                new VmwareCbtChangedBlockRangeTO("disk-2", 2048, 2048)));
+
+        Assert.assertTrue(syncPlan.isValid());
+        Assert.assertEquals(3, syncPlan.getChangedRangeCount());
+        Assert.assertEquals(3, syncPlan.getCopyRangeCount());
+        Assert.assertEquals(3584, syncPlan.getChangedBytes());
+        Assert.assertEquals(2, syncPlan.getDiskPlans().size());
+        Assert.assertEquals(1536, syncPlan.getDiskPlans().get(0).getChangedBytes());
+        Assert.assertEquals(2048, syncPlan.getDiskPlans().get(1).getChangedBytes());
+    }
+
+    @Test
+    public void testCreateCoalescesAdjacentAndOverlappingRanges() {
+        VmwareCbtSyncPlan syncPlan = VmwareCbtSyncPlan.create(List.of(createDisk("disk-1", "/target", 8192)), List.of(
+                new VmwareCbtChangedBlockRangeTO("disk-1", 4096, 512),
+                new VmwareCbtChangedBlockRangeTO("disk-1", 0, 1024),
+                new VmwareCbtChangedBlockRangeTO("disk-1", 1024, 1024),
+                new VmwareCbtChangedBlockRangeTO("disk-1", 4352, 1024)));
+
+        Assert.assertTrue(syncPlan.isValid());
+        Assert.assertEquals(4, syncPlan.getChangedRangeCount());
+        Assert.assertEquals(2, syncPlan.getCopyRangeCount());
+        Assert.assertEquals(3328, syncPlan.getChangedBytes());
+        Assert.assertEquals(2, syncPlan.getDiskPlans().get(0).getChangedBlocks().size());
+        Assert.assertEquals(0, syncPlan.getDiskPlans().get(0).getChangedBlocks().get(0).getStartOffset());
+        Assert.assertEquals(2048, syncPlan.getDiskPlans().get(0).getChangedBlocks().get(0).getLength());
+        Assert.assertEquals(4096, syncPlan.getDiskPlans().get(0).getChangedBlocks().get(1).getStartOffset());
+        Assert.assertEquals(1280, syncPlan.getDiskPlans().get(0).getChangedBlocks().get(1).getLength());
+    }
+
+    @Test
+    public void testCreateRejectsUnknownDisk() {
+        VmwareCbtSyncPlan syncPlan = VmwareCbtSyncPlan.create(List.of(createDisk("disk-1", "/target", 8192)),
+                List.of(new VmwareCbtChangedBlockRangeTO("disk-2", 0, 1024)));
+
+        Assert.assertFalse(syncPlan.isValid());
+        Assert.assertTrue(syncPlan.getValidationError().contains("unknown disk disk-2"));
+    }
+
+    @Test
+    public void testCreateRejectsMissingTargetPath() {
+        VmwareCbtSyncPlan syncPlan = VmwareCbtSyncPlan.create(List.of(createDisk("disk-1", null, 8192)),
+                List.of(new VmwareCbtChangedBlockRangeTO("disk-1", 0, 1024)));
+
+        Assert.assertFalse(syncPlan.isValid());
+        Assert.assertTrue(syncPlan.getValidationError().contains("no target path"));
+    }
+
+    @Test
+    public void testCreateRejectsOutOfBoundsRange() {
+        VmwareCbtSyncPlan syncPlan = VmwareCbtSyncPlan.create(List.of(createDisk("disk-1", "/target", 1024)),
+                List.of(new VmwareCbtChangedBlockRangeTO("disk-1", 512, 1024)));
+
+        Assert.assertFalse(syncPlan.isValid());
+        Assert.assertTrue(syncPlan.getValidationError().contains("exceeds disk capacity"));
+    }
+
+    private VmwareCbtDiskTO createDisk(String diskId, String targetPath, long capacityBytes) {
+        return new VmwareCbtDiskTO(diskId, 2000, String.format("[%s] vm/%s.vmdk", diskId, diskId),
+                "datastore1", targetPath, "qcow2", "*", null, capacityBytes);
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/storage/LibvirtStoragePoolTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/storage/LibvirtStoragePoolTest.java
index 88d4daa2dabc..ea5df8e741c4 100644
--- a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/storage/LibvirtStoragePoolTest.java
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/storage/LibvirtStoragePoolTest.java
@@ -16,6 +16,9 @@
 // under the License.
 package com.cloud.hypervisor.kvm.storage;
 
+import java.io.File;
+import java.nio.file.Files;
+
 import org.apache.cloudstack.utils.qemu.QemuImg.PhysicalDiskFormat;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -98,4 +101,57 @@ public void testExternalSnapshot() {
         LibvirtStoragePool clvmPool = new LibvirtStoragePool(uuid, name, StoragePoolType.CLVM, adapter, storage);
         assertTrue(clvmPool.isExternalSnapshot());
     }
+
+    @Test
+    public void testResolvePhysicalDiskFileUsesNestedRelativePathInsidePool() throws Exception {
+        File poolPath = Files.createTempDirectory("libvirt-storage-pool").toFile();
+        try {
+            LibvirtStoragePool pool = createNetworkFilesystemPool();
+            String volumeUid = "cloudstack-cbt/migration/virt-v2v-output/disk.qcow2";
+            File expectedVolume = new File(poolPath, volumeUid);
+            assertTrue(expectedVolume.getParentFile().mkdirs());
+            assertTrue(expectedVolume.createNewFile());
+
+            File resolvedVolume = pool.resolvePhysicalDiskFile(poolPath.getAbsolutePath(), volumeUid, "disk.qcow2");
+
+            assertEquals(expectedVolume.getCanonicalPath(), resolvedVolume.getCanonicalPath());
+        } finally {
+            deleteRecursively(poolPath);
+        }
+    }
+
+    @Test
+    public void testResolvePhysicalDiskFileRejectsRelativePathOutsidePool() throws Exception {
+        File poolPath = Files.createTempDirectory("libvirt-storage-pool").toFile();
+        try {
+            LibvirtStoragePool pool = createNetworkFilesystemPool();
+
+            File resolvedVolume = pool.resolvePhysicalDiskFile(poolPath.getAbsolutePath(), "../disk.qcow2", "disk.qcow2");
+
+            assertEquals(new File(poolPath, "disk.qcow2").getCanonicalPath(), resolvedVolume.getCanonicalPath());
+        } finally {
+            deleteRecursively(poolPath);
+        }
+    }
+
+    private LibvirtStoragePool createNetworkFilesystemPool() {
+        StorageAdaptor adapter = Mockito.mock(LibvirtStorageAdaptor.class);
+        StoragePool storage = Mockito.mock(StoragePool.class);
+        return new LibvirtStoragePool("pool-uuid", "pool-name", StoragePoolType.NetworkFilesystem, adapter, storage);
+    }
+
+    private void deleteRecursively(File file) {
+        if (file == null || !file.exists()) {
+            return;
+        }
+        if (file.isDirectory()) {
+            File[] children = file.listFiles();
+            if (children != null) {
+                for (File child : children) {
+                    deleteRecursively(child);
+                }
+            }
+        }
+        file.delete();
+    }
 }
diff --git a/plugins/hypervisors/vmware/src/main/java/com/cloud/hypervisor/vmware/manager/VmwareCbtMigrationServiceImpl.java b/plugins/hypervisors/vmware/src/main/java/com/cloud/hypervisor/vmware/manager/VmwareCbtMigrationServiceImpl.java
new file mode 100644
index 000000000000..0a164a2af6bb
--- /dev/null
+++ b/plugins/hypervisors/vmware/src/main/java/com/cloud/hypervisor/vmware/manager/VmwareCbtMigrationServiceImpl.java
@@ -0,0 +1,602 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.vmware.manager;
+
+import java.lang.reflect.Method;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.vm.UnmanagedInstanceTO;
+import org.apache.cloudstack.vm.VmwareCbtChangedBlockInfo;
+import org.apache.cloudstack.vm.VmwareCbtChangedDiskInfo;
+import org.apache.cloudstack.vm.VmwareCbtDiskInfo;
+import org.apache.cloudstack.vm.VmwareCbtMigrationService;
+import org.apache.cloudstack.vm.VmwareCbtPreflightDiskInfo;
+import org.apache.cloudstack.vm.VmwareCbtPreflightInfo;
+import org.apache.cloudstack.vm.VmwareCbtPreflightNicInfo;
+import org.apache.cloudstack.vm.VmwareCbtSnapshotInfo;
+import org.apache.commons.collections4.CollectionUtils;
+import org.apache.commons.lang3.BooleanUtils;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import com.cloud.hypervisor.vmware.mo.DatacenterMO;
+import com.cloud.hypervisor.vmware.mo.HostMO;
+import com.cloud.hypervisor.vmware.mo.VirtualMachineMO;
+import com.cloud.hypervisor.vmware.mo.VmwareHypervisorHost;
+import com.cloud.hypervisor.vmware.resource.VmwareContextFactory;
+import com.cloud.hypervisor.vmware.util.VmwareContext;
+import com.cloud.hypervisor.vmware.util.VmwareHelper;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.vmware.vim25.ManagedObjectReference;
+import com.vmware.vim25.VirtualDevice;
+import com.vmware.vim25.VirtualDeviceBackingInfo;
+import com.vmware.vim25.VirtualDisk;
+import com.vmware.vim25.VirtualMachineCapability;
+import com.vmware.vim25.VirtualMachineConfigInfo;
+import com.vmware.vim25.VirtualMachineConfigSpec;
+import com.vmware.vim25.VirtualMachineConfigSummary;
+import com.vmware.vim25.VirtualMachinePowerState;
+import com.vmware.vim25.VirtualMachineRuntimeInfo;
+import com.vmware.vim25.VirtualMachineSnapshotInfo;
+import com.vmware.vim25.VirtualMachineSnapshotTree;
+
+public class VmwareCbtMigrationServiceImpl implements VmwareCbtMigrationService {
+
+    private static final Logger LOGGER = LogManager.getLogger(VmwareCbtMigrationServiceImpl.class);
+
+    @Override
+    public VmwareCbtPreflightInfo getPreflightInfo(String vcenter, String datacenterName, String username,
+                                                   String password, String sourceHost, String sourceVmName) {
+        try {
+            VmwareContext context = VmwareContextFactory.getContext(vcenter, username, password);
+            VmwareVmLookup lookup = lookupVirtualMachine(context, vcenter, datacenterName, sourceHost, sourceVmName);
+            VirtualMachineCapability capability = (VirtualMachineCapability)context.getVimClient()
+                    .getDynamicProperty(lookup.vmMO.getMor(), "capability");
+            VirtualMachineConfigInfo configInfo = lookup.vmMO.getConfigInfo();
+            VirtualMachineConfigSummary configSummary = lookup.vmMO.getConfigSummary();
+            VirtualMachineRuntimeInfo runtimeInfo = lookup.vmMO.getRuntimeInfo();
+            VirtualMachineSnapshotInfo snapshotInfo = lookup.vmMO.getSnapshotInfo();
+            UnmanagedInstanceTO unmanagedInstance = VmwareHelper.getUnmanagedInstance(lookup.hyperHost, lookup.vmMO);
+
+            VmwareCbtPreflightInfo preflightInfo = new VmwareCbtPreflightInfo(sourceVmName, getManagedObjectReferenceValue(lookup.vmMO.getMor()),
+                    capability == null ? null : capability.isChangeTrackingSupported(),
+                    configInfo == null ? null : configInfo.isChangeTrackingEnabled(),
+                    runtimeInfo == null ? null : runtimeInfo.isConsolidationNeeded(),
+                    countSnapshots(snapshotInfo),
+                    toVmwareCbtPreflightDiskInfo(unmanagedInstance, collectDiskDeviceInfo(lookup.vmMO)),
+                    toVmwareCbtPreflightNicInfo(unmanagedInstance),
+                    configSummary == null ? null : configSummary.getNumCpu(),
+                    configSummary == null ? null : configSummary.getCpuReservation(),
+                    configSummary == null ? null : configSummary.getMemorySizeMB(),
+                    unmanagedInstance == null ? null : unmanagedInstance.getOperatingSystemId(),
+                    unmanagedInstance == null ? null : unmanagedInstance.getOperatingSystem());
+            if (unmanagedInstance != null) {
+                preflightInfo.setBootType(unmanagedInstance.getBootType());
+                preflightInfo.setBootMode(unmanagedInstance.getBootMode());
+            }
+            return preflightInfo;
+        } catch (Exception e) {
+            String message = String.format("Unable to check VMware CBT prerequisites for VM %s in vCenter %s: %s",
+                    sourceVmName, vcenter, e.getMessage());
+            LOGGER.error(message, e);
+            throw new CloudRuntimeException(message, e);
+        }
+    }
+
+    @Override
+    public List<VmwareCbtDiskInfo> listSourceDisks(String vcenter, String datacenterName, String username, String password,
+                                                   String sourceHost, String sourceVmName) {
+        try {
+            VmwareContext context = VmwareContextFactory.getContext(vcenter, username, password);
+            VmwareVmLookup lookup = lookupVirtualMachine(context, vcenter, datacenterName, sourceHost, sourceVmName);
+            UnmanagedInstanceTO unmanagedInstance = VmwareHelper.getUnmanagedInstance(lookup.hyperHost, lookup.vmMO);
+            return toVmwareCbtDiskInfo(unmanagedInstance, collectDiskDeviceInfo(lookup.vmMO));
+        } catch (Exception e) {
+            String message = String.format("Unable to discover VMware CBT source disks for VM %s in vCenter %s: %s",
+                    sourceVmName, vcenter, e.getMessage());
+            LOGGER.error(message, e);
+            throw new CloudRuntimeException(message, e);
+        }
+    }
+
+    @Override
+    public List<VmwareCbtDiskInfo> listSnapshotDisks(String vcenter, String datacenterName, String username, String password,
+                                                     String sourceHost, String sourceVmName, String snapshotMor) {
+        try {
+            VmwareContext context = VmwareContextFactory.getContext(vcenter, username, password);
+            VmwareVmLookup lookup = lookupVirtualMachine(context, vcenter, datacenterName, sourceHost, sourceVmName);
+            UnmanagedInstanceTO unmanagedInstance = VmwareHelper.getUnmanagedInstance(lookup.hyperHost, lookup.vmMO);
+            ManagedObjectReference snapshot = toManagedObjectReference("VirtualMachineSnapshot", snapshotMor);
+            List<VirtualDevice> snapshotDevices = context.getVimClient().getDynamicProperty(snapshot,
+                    "config.hardware.device");
+            return toVmwareCbtDiskInfo(unmanagedInstance, collectDiskDeviceInfo(snapshotDevices));
+        } catch (Exception e) {
+            String message = String.format("Unable to discover VMware CBT snapshot disks for VM %s snapshot %s in vCenter %s: %s",
+                    sourceVmName, snapshotMor, vcenter, e.getMessage());
+            LOGGER.error(message, e);
+            throw new CloudRuntimeException(message, e);
+        }
+    }
+
+    @Override
+    public void ensureChangeTrackingEnabled(String vcenter, String datacenterName, String username, String password,
+                                            String sourceHost, String sourceVmName) {
+        try {
+            VmwareContext context = VmwareContextFactory.getContext(vcenter, username, password);
+            VmwareVmLookup lookup = lookupVirtualMachine(context, vcenter, datacenterName, sourceHost, sourceVmName);
+            ensureChangeTrackingEnabled(context, lookup.vmMO, sourceVmName);
+        } catch (Exception e) {
+            String message = String.format("Unable to enable VMware CBT for VM %s in vCenter %s: %s",
+                    sourceVmName, vcenter, e.getMessage());
+            LOGGER.error(message, e);
+            throw new CloudRuntimeException(message, e);
+        }
+    }
+
+    @Override
+    public VmwareCbtSnapshotInfo createSnapshot(String vcenter, String datacenterName, String username, String password,
+                                                String sourceHost, String sourceVmName, String snapshotName,
+                                                String snapshotDescription, boolean quiesce) {
+        try {
+            VmwareContext context = VmwareContextFactory.getContext(vcenter, username, password);
+            VmwareVmLookup lookup = lookupVirtualMachine(context, vcenter, datacenterName, sourceHost, sourceVmName);
+            ensureChangeTrackingEnabled(context, lookup.vmMO, sourceVmName);
+            ManagedObjectReference snapshot = lookup.vmMO.createSnapshotGetReference(snapshotName,
+                    snapshotDescription, false, quiesce);
+            if (snapshot == null) {
+                throw new CloudRuntimeException(String.format("Unable to create VMware snapshot %s for VM %s",
+                        snapshotName, sourceVmName));
+            }
+            return new VmwareCbtSnapshotInfo(snapshotName, formatManagedObjectReference(snapshot),
+                    getManagedObjectReferenceValue(lookup.vmMO.getMor()));
+        } catch (Exception e) {
+            String message = String.format("Unable to create VMware CBT snapshot for VM %s in vCenter %s: %s",
+                    sourceVmName, vcenter, e.getMessage());
+            LOGGER.error(message, e);
+            throw new CloudRuntimeException(message, e);
+        }
+    }
+
+    @Override
+    public List<VmwareCbtChangedDiskInfo> queryChangedDiskAreas(String vcenter, String datacenterName, String username,
+                                                                String password, String sourceHost, String sourceVmName,
+                                                                List<VmwareCbtDiskInfo> disks, String snapshotMor) {
+        try {
+            VmwareContext context = VmwareContextFactory.getContext(vcenter, username, password);
+            VmwareVmLookup lookup = lookupVirtualMachine(context, vcenter, datacenterName, sourceHost, sourceVmName);
+            ManagedObjectReference snapshot = toManagedObjectReference("VirtualMachineSnapshot", snapshotMor);
+            List<VmwareCbtChangedDiskInfo> changedDisks = new ArrayList<>();
+            if (CollectionUtils.isEmpty(disks)) {
+                return changedDisks;
+            }
+            List<VirtualDevice> snapshotDevices = context.getVimClient().getDynamicProperty(snapshot,
+                    "config.hardware.device");
+            for (VmwareCbtDiskInfo disk : disks) {
+                // DiskChangeInfo has no change ID; the next checkpoint is on this snapshot's disk backing.
+                String nextChangeId = getSnapshotDiskChangeId(snapshotDevices, disk);
+                changedDisks.add(queryChangedDiskAreas(context, lookup.vmMO, snapshot, disk, nextChangeId));
+            }
+            return changedDisks;
+        } catch (Exception e) {
+            String message = String.format("Unable to query VMware CBT changed areas for VM %s in vCenter %s: %s",
+                    sourceVmName, vcenter, e.getMessage());
+            LOGGER.error(message, e);
+            throw new CloudRuntimeException(message, e);
+        }
+    }
+
+    @Override
+    public UnmanagedInstanceTO.PowerState getPowerState(String vcenter, String datacenterName, String username,
+                                                        String password, String sourceHost, String sourceVmName) {
+        try {
+            VmwareContext context = VmwareContextFactory.getContext(vcenter, username, password);
+            VmwareVmLookup lookup = lookupVirtualMachine(context, vcenter, datacenterName, sourceHost, sourceVmName);
+            return toUnmanagedPowerState(lookup.vmMO.getPowerState());
+        } catch (Exception e) {
+            String message = String.format("Unable to check VMware power state for VM %s in vCenter %s: %s",
+                    sourceVmName, vcenter, e.getMessage());
+            LOGGER.error(message, e);
+            throw new CloudRuntimeException(message, e);
+        }
+    }
+
+    @Override
+    public void removeSnapshot(String vcenter, String datacenterName, String username, String password,
+                               String sourceHost, String sourceVmName, String snapshotMor) {
+        if (StringUtils.isBlank(snapshotMor)) {
+            return;
+        }
+
+        try {
+            VmwareContext context = VmwareContextFactory.getContext(vcenter, username, password);
+            lookupVirtualMachine(context, vcenter, datacenterName, sourceHost, sourceVmName);
+            ManagedObjectReference snapshot = toManagedObjectReference("VirtualMachineSnapshot", snapshotMor);
+            ManagedObjectReference task = context.getService().removeSnapshotTask(snapshot, false, true);
+            if (!context.getVimClient().waitForTask(task)) {
+                throw new CloudRuntimeException(String.format("Unable to remove VMware snapshot %s for VM %s",
+                        snapshotMor, sourceVmName));
+            }
+            context.waitForTaskProgressDone(task);
+        } catch (Exception e) {
+            String message = String.format("Unable to remove VMware CBT snapshot %s for VM %s in vCenter %s: %s",
+                    snapshotMor, sourceVmName, vcenter, e.getMessage());
+            LOGGER.error(message, e);
+            throw new CloudRuntimeException(message, e);
+        }
+    }
+
+    private VmwareVmLookup lookupVirtualMachine(VmwareContext context, String vcenter, String datacenterName,
+                                                String sourceHost, String sourceVmName) throws Exception {
+        DatacenterMO datacenterMO = new DatacenterMO(context, datacenterName);
+        if (datacenterMO.getMor() == null) {
+            throw new CloudRuntimeException(String.format("Unable to find VMware datacenter %s in vCenter %s",
+                    datacenterName, vcenter));
+        }
+
+        VmwareHypervisorHost hyperHost;
+        VirtualMachineMO vmMO;
+        if (StringUtils.isNotBlank(sourceHost)) {
+            ManagedObjectReference hostMor = datacenterMO.findHost(sourceHost);
+            if (hostMor == null) {
+                throw new CloudRuntimeException(String.format("Unable to find VMware host %s in vCenter %s",
+                        sourceHost, vcenter));
+            }
+            HostMO hostMO = new HostMO(context, hostMor);
+            vmMO = hostMO.findVmOnHyperHost(sourceVmName);
+            hyperHost = hostMO;
+        } else {
+            vmMO = datacenterMO.findVm(sourceVmName);
+            hyperHost = vmMO != null ? vmMO.getRunningHost() : null;
+        }
+
+        if (vmMO == null) {
+            throw new CloudRuntimeException(String.format("Unable to find VMware VM %s in datacenter %s",
+                    sourceVmName, datacenterName));
+        }
+        return new VmwareVmLookup(hyperHost, vmMO);
+    }
+
+    private List<VmwareCbtDiskInfo> toVmwareCbtDiskInfo(UnmanagedInstanceTO unmanagedInstance,
+                                                        Map<String, DiskDeviceInfo> diskDeviceInfo) {
+        List<VmwareCbtDiskInfo> disks = new ArrayList<>();
+        if (unmanagedInstance == null || CollectionUtils.isEmpty(unmanagedInstance.getDisks())) {
+            return disks;
+        }
+
+        for (UnmanagedInstanceTO.Disk disk : unmanagedInstance.getDisks()) {
+            String sourceDiskId = StringUtils.defaultIfBlank(disk.getDiskId(), disk.getLabel());
+            String sourceDiskPath = StringUtils.defaultIfBlank(disk.getImagePath(), disk.getFileBaseName());
+            DiskDeviceInfo deviceInfo = diskDeviceInfo.get(sourceDiskId);
+            if (deviceInfo == null) {
+                deviceInfo = diskDeviceInfo.get(sourceDiskPath);
+            }
+            if (deviceInfo == null) {
+                deviceInfo = diskDeviceInfo.get(disk.getLabel());
+            }
+            disks.add(new VmwareCbtDiskInfo(sourceDiskId, deviceInfo != null ? deviceInfo.deviceKey : null,
+                    disk.getLabel(), sourceDiskPath, disk.getDatastoreName(), disk.getCapacity(),
+                    deviceInfo != null ? deviceInfo.changeId : null));
+        }
+        return disks;
+    }
+
+    private List<VmwareCbtPreflightDiskInfo> toVmwareCbtPreflightDiskInfo(UnmanagedInstanceTO unmanagedInstance,
+                                                                          Map<String, DiskDeviceInfo> diskDeviceInfo) {
+        List<VmwareCbtPreflightDiskInfo> disks = new ArrayList<>();
+        if (unmanagedInstance == null || CollectionUtils.isEmpty(unmanagedInstance.getDisks())) {
+            return disks;
+        }
+
+        for (UnmanagedInstanceTO.Disk disk : unmanagedInstance.getDisks()) {
+            String sourceDiskId = StringUtils.defaultIfBlank(disk.getDiskId(), disk.getLabel());
+            String sourceDiskPath = StringUtils.defaultIfBlank(disk.getImagePath(), disk.getFileBaseName());
+            DiskDeviceInfo deviceInfo = diskDeviceInfo.get(sourceDiskId);
+            if (deviceInfo == null) {
+                deviceInfo = diskDeviceInfo.get(sourceDiskPath);
+            }
+            if (deviceInfo == null) {
+                deviceInfo = diskDeviceInfo.get(disk.getLabel());
+            }
+            disks.add(new VmwareCbtPreflightDiskInfo(sourceDiskId, deviceInfo != null ? deviceInfo.deviceKey : null,
+                    disk.getLabel(), sourceDiskPath, disk.getDatastoreName(), disk.getCapacity(),
+                    deviceInfo != null ? deviceInfo.changeId : null,
+                    deviceInfo != null ? deviceInfo.backingType : null,
+                    deviceInfo != null ? deviceInfo.diskMode : null,
+                    deviceInfo != null ? deviceInfo.rdmCompatibilityMode : null,
+                    deviceInfo != null && deviceInfo.independentDisk,
+                    deviceInfo != null && deviceInfo.physicalRdm));
+        }
+        return disks;
+    }
+
+    private List<VmwareCbtPreflightNicInfo> toVmwareCbtPreflightNicInfo(UnmanagedInstanceTO unmanagedInstance) {
+        List<VmwareCbtPreflightNicInfo> nics = new ArrayList<>();
+        if (unmanagedInstance == null || CollectionUtils.isEmpty(unmanagedInstance.getNics())) {
+            return nics;
+        }
+        for (UnmanagedInstanceTO.Nic nic : unmanagedInstance.getNics()) {
+            VmwareCbtPreflightNicInfo nicInfo = new VmwareCbtPreflightNicInfo(nic.getNicId(), nic.getAdapterType(),
+                    nic.getMacAddress(), nic.getVlan());
+            // Older or limited Tools versions report only the bare address list without
+            // ipConfig - carry those addresses too (without prefix), IP preservation only
+            // needs the address itself.
+            nicInfo.setIpv4Cidrs(CollectionUtils.isNotEmpty(nic.getIpv4Cidrs()) ? nic.getIpv4Cidrs() : nic.getIpAddress());
+            nicInfo.setIpv4Gateway(nic.getIpv4Gateway());
+            nicInfo.setDnsServers(nic.getDnsServers());
+            nics.add(nicInfo);
+        }
+        return nics;
+    }
+
+    private Map<String, DiskDeviceInfo> collectDiskDeviceInfo(VirtualMachineMO vmMO) throws Exception {
+        VirtualDisk[] disks = vmMO.getAllDiskDevice();
+        return collectDiskDeviceInfo(disks == null ? null : Arrays.asList(disks));
+    }
+
+    private Map<String, DiskDeviceInfo> collectDiskDeviceInfo(List<? extends VirtualDevice> devices) {
+        Map<String, DiskDeviceInfo> diskDeviceInfo = new HashMap<>();
+        if (devices == null) {
+            return diskDeviceInfo;
+        }
+
+        for (VirtualDevice device : devices) {
+            if (!(device instanceof VirtualDisk)) {
+                continue;
+            }
+            VirtualDisk disk = (VirtualDisk) device;
+            VirtualDeviceBackingInfo backing = disk.getBacking();
+            String diskMode = getBackingStringValue(backing, "getDiskMode");
+            String rdmCompatibilityMode = getBackingStringValue(backing, "getCompatibilityMode");
+            DiskDeviceInfo deviceInfo = new DiskDeviceInfo(disk.getKey(), getBackingStringValue(backing, "getChangeId"),
+                    backing == null ? null : backing.getClass().getSimpleName(), diskMode, rdmCompatibilityMode,
+                    StringUtils.containsIgnoreCase(diskMode, "independent"),
+                    StringUtils.containsIgnoreCase(rdmCompatibilityMode, "physical"));
+            if (StringUtils.isNotBlank(disk.getDiskObjectId())) {
+                diskDeviceInfo.put(disk.getDiskObjectId(), deviceInfo);
+            }
+            diskDeviceInfo.put(String.valueOf(disk.getKey()), deviceInfo);
+            if (disk.getDeviceInfo() != null && StringUtils.isNotBlank(disk.getDeviceInfo().getLabel())) {
+                diskDeviceInfo.put(disk.getDeviceInfo().getLabel(), deviceInfo);
+            }
+            String fileName = getBackingStringValue(backing, "getFileName");
+            if (StringUtils.isNotBlank(fileName)) {
+                diskDeviceInfo.put(fileName, deviceInfo);
+            }
+        }
+        return diskDeviceInfo;
+    }
+
+    private int countSnapshots(VirtualMachineSnapshotInfo snapshotInfo) {
+        if (snapshotInfo == null || CollectionUtils.isEmpty(snapshotInfo.getRootSnapshotList())) {
+            return 0;
+        }
+        return countSnapshotTrees(snapshotInfo.getRootSnapshotList());
+    }
+
+    private int countSnapshotTrees(List<VirtualMachineSnapshotTree> snapshotTrees) {
+        int count = 0;
+        for (VirtualMachineSnapshotTree snapshotTree : snapshotTrees) {
+            count++;
+            if (CollectionUtils.isNotEmpty(snapshotTree.getChildSnapshotList())) {
+                count += countSnapshotTrees(snapshotTree.getChildSnapshotList());
+            }
+        }
+        return count;
+    }
+
+    private UnmanagedInstanceTO.PowerState toUnmanagedPowerState(VirtualMachinePowerState powerState) {
+        if (powerState == VirtualMachinePowerState.POWERED_OFF) {
+            return UnmanagedInstanceTO.PowerState.PowerOff;
+        }
+        if (powerState == VirtualMachinePowerState.POWERED_ON) {
+            return UnmanagedInstanceTO.PowerState.PowerOn;
+        }
+        return UnmanagedInstanceTO.PowerState.PowerUnknown;
+    }
+
+    private VmwareCbtChangedDiskInfo queryChangedDiskAreas(VmwareContext context, VirtualMachineMO vmMO,
+                                                           ManagedObjectReference snapshot, VmwareCbtDiskInfo disk,
+                                                           String nextChangeId)
+            throws ReflectiveOperationException {
+        if (disk.getSourceDiskDeviceKey() == null) {
+            throw new CloudRuntimeException(String.format("VMware disk device key is missing for source disk %s",
+                    disk.getSourceDiskId()));
+        }
+        if (StringUtils.isBlank(disk.getChangeId())) {
+            throw new CloudRuntimeException(String.format("VMware CBT change ID is missing for source disk %s",
+                    disk.getSourceDiskId()));
+        }
+
+        List<VmwareCbtChangedBlockInfo> changedBlocks = new ArrayList<>();
+        long startOffset = 0L;
+        long capacityBytes = disk.getCapacityBytes() == null ? 0L : disk.getCapacityBytes();
+        do {
+            Object diskChangeInfo = invokeQueryChangedDiskAreas(context, vmMO, snapshot, disk, startOffset);
+            for (Object changedArea : getObjectListValue(diskChangeInfo, "getChangedArea")) {
+                Long areaStart = getObjectLongValue(changedArea, "getStart");
+                Long areaLength = getObjectLongValue(changedArea, "getLength");
+                if (areaStart != null && areaLength != null && areaLength > 0L) {
+                    changedBlocks.add(new VmwareCbtChangedBlockInfo(areaStart, areaLength));
+                }
+            }
+
+            Long responseStart = getObjectLongValue(diskChangeInfo, "getStartOffset");
+            Long responseLength = getObjectLongValue(diskChangeInfo, "getLength");
+            if (responseStart == null || responseLength == null || responseLength <= 0L) {
+                break;
+            }
+            startOffset = responseStart + responseLength;
+        } while (capacityBytes > 0L && startOffset < capacityBytes);
+
+        return new VmwareCbtChangedDiskInfo(disk.getSourceDiskId(), nextChangeId, changedBlocks);
+    }
+
+    String getSnapshotDiskChangeId(List<? extends VirtualDevice> snapshotDevices, VmwareCbtDiskInfo disk) {
+        if (disk.getSourceDiskDeviceKey() == null || snapshotDevices == null) {
+            throw new CloudRuntimeException(String.format("Unable to find VMware CBT snapshot disk %s",
+                    disk.getSourceDiskId()));
+        }
+        for (VirtualDevice device : snapshotDevices) {
+            if (device instanceof VirtualDisk && disk.getSourceDiskDeviceKey().equals(device.getKey())) {
+                String changeId = getBackingStringValue(((VirtualDisk) device).getBacking(), "getChangeId");
+                if (StringUtils.isBlank(changeId)) {
+                    throw new CloudRuntimeException(String.format("VMware CBT snapshot change ID is missing for source disk %s",
+                            disk.getSourceDiskId()));
+                }
+                return changeId;
+            }
+        }
+        throw new CloudRuntimeException(String.format("Unable to find VMware CBT snapshot disk %s",
+                disk.getSourceDiskId()));
+    }
+
+    private Object invokeQueryChangedDiskAreas(VmwareContext context, VirtualMachineMO vmMO,
+                                               ManagedObjectReference snapshot, VmwareCbtDiskInfo disk,
+                                               long startOffset) throws ReflectiveOperationException {
+        Method method = context.getService().getClass().getMethod("queryChangedDiskAreas",
+                ManagedObjectReference.class, ManagedObjectReference.class, int.class, long.class, String.class);
+        return method.invoke(context.getService(), vmMO.getMor(), snapshot, disk.getSourceDiskDeviceKey(),
+                startOffset, disk.getChangeId());
+    }
+
+    private void ensureChangeTrackingEnabled(VmwareContext context, VirtualMachineMO vmMO, String sourceVmName)
+            throws Exception {
+        VirtualMachineCapability capability = (VirtualMachineCapability)context.getVimClient()
+                .getDynamicProperty(vmMO.getMor(), "capability");
+        if (capability != null && BooleanUtils.isFalse(capability.isChangeTrackingSupported())) {
+            throw new CloudRuntimeException(String.format("VMware CBT is not supported for VM %s", sourceVmName));
+        }
+
+        VirtualMachineConfigInfo configInfo = vmMO.getConfigInfo();
+        if (configInfo != null && BooleanUtils.isTrue(configInfo.isChangeTrackingEnabled())) {
+            return;
+        }
+
+        VirtualMachineConfigSpec configSpec = new VirtualMachineConfigSpec();
+        configSpec.setChangeTrackingEnabled(true);
+        if (!vmMO.configureVm(configSpec)) {
+            throw new CloudRuntimeException(String.format("Unable to enable VMware CBT for VM %s", sourceVmName));
+        }
+    }
+
+    private ManagedObjectReference toManagedObjectReference(String defaultType, String mor) {
+        if (StringUtils.isBlank(mor)) {
+            return null;
+        }
+
+        ManagedObjectReference reference = new ManagedObjectReference();
+        if (mor.contains(":")) {
+            String[] parts = mor.split(":", 2);
+            reference.setType(parts[0]);
+            reference.setValue(parts[1]);
+        } else {
+            reference.setType(defaultType);
+            reference.setValue(mor);
+        }
+        return reference;
+    }
+
+    private String formatManagedObjectReference(ManagedObjectReference mor) {
+        if (mor == null) {
+            return null;
+        }
+        return String.format("%s:%s", mor.getType(), mor.getValue());
+    }
+
+    private String getManagedObjectReferenceValue(ManagedObjectReference mor) {
+        return mor == null ? null : mor.getValue();
+    }
+
+    private String getBackingStringValue(Object backing, String methodName) {
+        if (backing == null) {
+            return null;
+        }
+
+        try {
+            Method method = backing.getClass().getMethod(methodName);
+            Object value = method.invoke(backing);
+            return value != null ? value.toString() : null;
+        } catch (ReflectiveOperationException e) {
+            return null;
+        }
+    }
+
+    private Long getObjectLongValue(Object object, String methodName) {
+        Object value = invokeGetter(object, methodName);
+        if (value instanceof Number) {
+            return ((Number)value).longValue();
+        }
+        return null;
+    }
+
+    private List<?> getObjectListValue(Object object, String methodName) {
+        Object value = invokeGetter(object, methodName);
+        if (value instanceof List) {
+            return (List<?>)value;
+        }
+        return new ArrayList<>();
+    }
+
+    private Object invokeGetter(Object object, String methodName) {
+        if (object == null) {
+            return null;
+        }
+
+        try {
+            Method method = object.getClass().getMethod(methodName);
+            return method.invoke(object);
+        } catch (ReflectiveOperationException e) {
+            return null;
+        }
+    }
+
+    private static class DiskDeviceInfo {
+        private final Integer deviceKey;
+        private final String changeId;
+        private final String backingType;
+        private final String diskMode;
+        private final String rdmCompatibilityMode;
+        private final boolean independentDisk;
+        private final boolean physicalRdm;
+
+        private DiskDeviceInfo(Integer deviceKey, String changeId, String backingType, String diskMode,
+                               String rdmCompatibilityMode, boolean independentDisk, boolean physicalRdm) {
+            this.deviceKey = deviceKey;
+            this.changeId = changeId;
+            this.backingType = backingType;
+            this.diskMode = diskMode;
+            this.rdmCompatibilityMode = rdmCompatibilityMode;
+            this.independentDisk = independentDisk;
+            this.physicalRdm = physicalRdm;
+        }
+    }
+
+    private static class VmwareVmLookup {
+        private final VmwareHypervisorHost hyperHost;
+        private final VirtualMachineMO vmMO;
+
+        private VmwareVmLookup(VmwareHypervisorHost hyperHost, VirtualMachineMO vmMO) {
+            this.hyperHost = hyperHost;
+            this.vmMO = vmMO;
+        }
+    }
+}
diff --git a/plugins/hypervisors/vmware/src/main/resources/META-INF/cloudstack/core/spring-vmware-core-context.xml b/plugins/hypervisors/vmware/src/main/resources/META-INF/cloudstack/core/spring-vmware-core-context.xml
index d955ede30254..28825e987dd8 100644
--- a/plugins/hypervisors/vmware/src/main/resources/META-INF/cloudstack/core/spring-vmware-core-context.xml
+++ b/plugins/hypervisors/vmware/src/main/resources/META-INF/cloudstack/core/spring-vmware-core-context.xml
@@ -29,6 +29,8 @@
 
     <bean id="VmwareManager"
         class="com.cloud.hypervisor.vmware.manager.VmwareManagerImpl" />
+    <bean id="VmwareCbtMigrationService"
+        class="com.cloud.hypervisor.vmware.manager.VmwareCbtMigrationServiceImpl" />
     <bean id="vmwareContextFactory"
         class="com.cloud.hypervisor.vmware.resource.VmwareContextFactory" />
     <bean id="VmwareDatacenterZoneMapDaoImpl"
diff --git a/plugins/hypervisors/vmware/src/test/java/com/cloud/hypervisor/vmware/manager/VmwareCbtMigrationServiceImplTest.java b/plugins/hypervisors/vmware/src/test/java/com/cloud/hypervisor/vmware/manager/VmwareCbtMigrationServiceImplTest.java
new file mode 100644
index 000000000000..bc4e37212de3
--- /dev/null
+++ b/plugins/hypervisors/vmware/src/test/java/com/cloud/hypervisor/vmware/manager/VmwareCbtMigrationServiceImplTest.java
@@ -0,0 +1,70 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.vmware.manager;
+
+import java.util.Arrays;
+import java.util.Collections;
+
+import org.apache.cloudstack.vm.VmwareCbtDiskInfo;
+import org.junit.Assert;
+import org.junit.Test;
+
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.vmware.vim25.VirtualDevice;
+import com.vmware.vim25.VirtualDisk;
+import com.vmware.vim25.VirtualDiskFlatVer2BackingInfo;
+
+public class VmwareCbtMigrationServiceImplTest {
+
+    private final VmwareCbtMigrationServiceImpl service = new VmwareCbtMigrationServiceImpl();
+
+    @Test
+    public void getSnapshotDiskChangeIdUsesMatchingDiskBacking() {
+        VirtualDisk otherDisk = createDisk(2001, "other-snapshot");
+        VirtualDisk sourceDisk = createDisk(2000, "cycle-2-snapshot");
+        VmwareCbtDiskInfo diskInfo = createDiskInfo(2000);
+
+        String changeId = service.getSnapshotDiskChangeId(Arrays.<VirtualDevice>asList(otherDisk, sourceDisk), diskInfo);
+
+        Assert.assertEquals("cycle-2-snapshot", changeId);
+        Assert.assertNotEquals(diskInfo.getChangeId(), changeId);
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void getSnapshotDiskChangeIdRejectsMissingDisk() {
+        service.getSnapshotDiskChangeId(Collections.singletonList(createDisk(2001, "other-snapshot")),
+                createDiskInfo(2000));
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void getSnapshotDiskChangeIdRejectsBlankChangeId() {
+        service.getSnapshotDiskChangeId(Collections.singletonList(createDisk(2000, null)), createDiskInfo(2000));
+    }
+
+    private VmwareCbtDiskInfo createDiskInfo(int key) {
+        return new VmwareCbtDiskInfo("disk-1", key, null, null, null, 1024L, "baseline");
+    }
+
+    private VirtualDisk createDisk(int key, String changeId) {
+        VirtualDisk disk = new VirtualDisk();
+        disk.setKey(key);
+        VirtualDiskFlatVer2BackingInfo backing = new VirtualDiskFlatVer2BackingInfo();
+        backing.setChangeId(changeId);
+        disk.setBacking(backing);
+        return disk;
+    }
+}
diff --git a/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStorageAdaptor.java b/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStorageAdaptor.java
index 7153519caf8b..48a990363c0f 100644
--- a/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStorageAdaptor.java
+++ b/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStorageAdaptor.java
@@ -31,7 +31,9 @@
 import com.cloud.utils.exception.CloudRuntimeException;
 import com.cloud.utils.script.Script;
 import org.apache.cloudstack.storage.datastore.util.LinstorConfigurationManager;
+import org.apache.cloudstack.storage.datastore.util.LinstorImportHelper;
 import org.apache.cloudstack.storage.datastore.util.LinstorUtil;
+import org.apache.cloudstack.storage.volume.VolumeOnStorageTO;
 import org.apache.cloudstack.utils.qemu.QemuImg;
 import org.apache.cloudstack.utils.qemu.QemuImgException;
 import org.apache.cloudstack.utils.qemu.QemuImgFile;
@@ -170,6 +172,12 @@ public KVMPhysicalDisk getPhysicalDisk(String name, KVMStoragePool pool)
         }
     }
 
+    public List<VolumeOnStorageTO> getVolumesForImport(
+            LinstorStoragePool pool, String path) {
+        return LinstorImportHelper.getVolumesForImport(
+                getLinstorAPI(pool), pool.getResourceGroup(), path);
+    }
+
     @Override
     public KVMStoragePool createStoragePool(String name, String host, int port, String path, String userInfo,
                                             Storage.StoragePoolType type, Map<String, String> details, boolean isPrimaryStorage)
@@ -593,7 +601,30 @@ public KVMPhysicalDisk createDiskFromTemplate(
     @Override
     public List<KVMPhysicalDisk> listPhysicalDisks(String storagePoolUuid, KVMStoragePool pool)
     {
-        throw new UnsupportedOperationException("Listing disks is not supported for this configuration.");
+        logger.debug("Linstor: listPhysicalDisks for pool {}", storagePoolUuid);
+        final DevelopersApi api = getLinstorAPI(pool);
+        final LinstorStoragePool linstorPool = (LinstorStoragePool) pool;
+        final String rscGroup = linstorPool.getResourceGroup();
+        List<KVMPhysicalDisk> disks = new ArrayList<>();
+        try {
+            List<ResourceDefinition> rscDfns = LinstorUtil.getRDListStartingWith(api, LinstorUtil.RSC_PREFIX);
+            for (ResourceDefinition rscDfn : rscDfns) {
+                if (rscGroup != null && !rscGroup.equalsIgnoreCase(rscDfn.getResourceGroupName())) {
+                    continue;
+                }
+                String name = rscDfn.getName().substring(LinstorUtil.RSC_PREFIX.length());
+                try {
+                    disks.add(getPhysicalDisk(name, pool));
+                } catch (Exception e) {
+                    logger.warn("Linstor: skipping resource {} while listing pool {}: {}",
+                            rscDfn.getName(), storagePoolUuid, e.getMessage());
+                }
+            }
+        } catch (ApiException apiEx) {
+            logger.error("Linstor: ApiEx - " + apiEx.getMessage());
+            throw new CloudRuntimeException(apiEx.getBestMessage(), apiEx);
+        }
+        return disks;
     }
 
     @Override
diff --git a/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStoragePool.java b/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStoragePool.java
index 8a02560fd464..79d564f99d99 100644
--- a/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStoragePool.java
+++ b/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStoragePool.java
@@ -27,6 +27,8 @@
 import com.cloud.utils.exception.CloudRuntimeException;
 import com.cloud.utils.script.OutputInterpreter;
 import com.cloud.utils.script.Script;
+import org.apache.cloudstack.storage.datastore.util.LinstorUtil;
+import org.apache.cloudstack.storage.volume.VolumeOnStorageTO;
 import com.google.gson.JsonArray;
 import com.google.gson.JsonElement;
 import com.google.gson.JsonIOException;
@@ -104,6 +106,11 @@ public List<KVMPhysicalDisk> listPhysicalDisks()
         return _storageAdaptor.listPhysicalDisks(_uuid, this);
     }
 
+    @Override
+    public List<VolumeOnStorageTO> getVolumesForImport(String path) {
+        return ((LinstorStorageAdaptor) _storageAdaptor).getVolumesForImport(this, path);
+    }
+
     @Override
     public String getUuid()
     {
@@ -215,6 +222,27 @@ public String getResourceGroup() {
         return _resourceGroup;
     }
 
+    /**
+     * A freshly spawned Linstor resource reads back as zeros only on providers that
+     * zero-initialize new volumes (LVM-thin, ZFS, and diskless). Thick providers
+     * (e.g. plain LVM) may expose stale data from previously deleted volumes, so the
+     * caller must write the zeros rather than skip them.
+     */
+    @Override
+    public boolean isVolumeZeroInitialized(String volumeName) {
+        return LinstorUtil.resourceSupportZeroBlocks(this, LinstorUtil.RSC_PREFIX + volumeName);
+    }
+
+    /**
+     * A DRBD resource can be in use (Primary/open) on any node in the cluster, which a
+     * host-local qemu-img lock cannot see. Report the node it is in use on so adoption
+     * refuses a volume still attached to a running VM elsewhere.
+     */
+    @Override
+    public String getVolumeInUseNode(String volumeName) {
+        return LinstorUtil.isResourceInUse(this, LinstorUtil.RSC_PREFIX + volumeName);
+    }
+
     public boolean isInsecureSsl() {
         return _insecureSsl;
     }
diff --git a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImpl.java b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImpl.java
index bc0e0a897065..f60dbddbc5bb 100644
--- a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImpl.java
+++ b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImpl.java
@@ -17,6 +17,7 @@
 package org.apache.cloudstack.storage.datastore.driver;
 
 import com.linbit.linstor.api.ApiException;
+import org.apache.cloudstack.storage.datastore.util.LinstorImportHelper;
 import com.linbit.linstor.api.CloneWaiter;
 import com.linbit.linstor.api.DevelopersApi;
 import com.linbit.linstor.api.model.ApiCallRc;
@@ -223,6 +224,12 @@ private DevelopersApi getLinstorAPI(StoragePool pool) {
                 Boolean.TRUE.equals(LinstorConfigurationManager.InsecureSsl.valueIn(pool.getId())));
     }
 
+    @Override
+    public void validateVolumeForImport(StoragePool pool, String path) {
+        LinstorImportHelper.validateResourceGroup(
+                getLinstorAPI(pool), pool.getPath(), path);
+    }
+
     private void deleteResourceDefinition(StoragePoolVO storagePoolVO, String rscDefName)
     {
         DevelopersApi linstorApi = getLinstorAPI(storagePoolVO);
diff --git a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorImportHelper.java b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorImportHelper.java
new file mode 100644
index 000000000000..4fe3a288dc65
--- /dev/null
+++ b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorImportHelper.java
@@ -0,0 +1,201 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.storage.datastore.util;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.stream.Collectors;
+
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.linbit.linstor.api.ApiException;
+import com.linbit.linstor.api.DevelopersApi;
+import com.linbit.linstor.api.model.Node;
+import com.linbit.linstor.api.model.ResourceDefinition;
+import com.linbit.linstor.api.model.ResourceWithVolumes;
+import com.linbit.linstor.api.model.VolumeDefinition;
+import org.apache.cloudstack.storage.volume.VolumeOnStorageTO;
+import org.apache.commons.lang3.StringUtils;
+
+/**
+ * Import validation must not change resource placement or live-migration properties.
+ * Both single-volume inspection and listing use controller metadata, never local DRBD devices.
+ */
+public final class LinstorImportHelper {
+    static final int PAGE_SIZE = 1000;
+
+    private LinstorImportHelper() {
+    }
+
+    private static String resourceName(String path) {
+        // CloudStack volume paths are the resource name without the cs- prefix, not device paths.
+        if (StringUtils.isBlank(path) || !path.matches("[a-zA-Z0-9_-]+")) {
+            throw new CloudRuntimeException("Invalid LINSTOR volume path: expected a resource name without a device path");
+        }
+        return LinstorUtil.RSC_PREFIX + path;
+    }
+
+    private static void requireGroup(String group) {
+        if (StringUtils.isBlank(group)) {
+            throw new CloudRuntimeException("Cannot validate LINSTOR import: the storage pool has no resource group");
+        }
+    }
+
+    private static List<ResourceDefinition> definitions(DevelopersApi api, String path) throws ApiException {
+        List<String> names = path == null ? Collections.emptyList() : Collections.singletonList(resourceName(path));
+        List<ResourceDefinition> result = new ArrayList<>();
+        for (int offset = 0; ; offset += PAGE_SIZE) {
+            List<ResourceDefinition> page = api.resourceDefinitionList(names, true, null, offset, PAGE_SIZE);
+            if (page == null) {
+                throw new CloudRuntimeException("Cannot read LINSTOR resource definitions");
+            }
+            result.addAll(page);
+            if (page.size() < PAGE_SIZE) {
+                return result;
+            }
+        }
+    }
+
+    private static ResourceDefinition findDefinition(List<ResourceDefinition> definitions, String path) {
+        String name = resourceName(path);
+        return definitions.stream().filter(rd -> name.equals(rd.getName())).findFirst()
+                .orElseThrow(() -> new CloudRuntimeException("LINSTOR resource not found: " + name));
+    }
+
+    private static void checkGroup(ResourceDefinition definition, String group) {
+        if (!group.equalsIgnoreCase(definition.getResourceGroupName())) {
+            throw new CloudRuntimeException(String.format(
+                    "Cannot import resource %s: it belongs to resource group %s, but the selected storage pool uses %s",
+                    definition.getName(), definition.getResourceGroupName(), group));
+        }
+    }
+
+    public static void validateResourceGroup(DevelopersApi api, String group, String path) {
+        requireGroup(group);
+        try {
+            checkGroup(findDefinition(definitions(api, path), path), group);
+        } catch (ApiException e) {
+            throw new CloudRuntimeException("Cannot verify LINSTOR resource ownership: " + e.getBestMessage(), e);
+        }
+    }
+
+    private static List<ResourceWithVolumes> resources(DevelopersApi api, String path) throws ApiException {
+        List<String> names = path == null ? Collections.emptyList() : Collections.singletonList(resourceName(path));
+        List<ResourceWithVolumes> result = new ArrayList<>();
+        for (int offset = 0; ; offset += PAGE_SIZE) {
+            List<ResourceWithVolumes> page = api.viewResources(Collections.emptyList(), names,
+                    Collections.emptyList(), null, offset, PAGE_SIZE);
+            if (page == null) {
+                throw new CloudRuntimeException("Cannot read LINSTOR resource usage");
+            }
+            result.addAll(page);
+            if (page.size() < PAGE_SIZE) {
+                return result;
+            }
+        }
+    }
+
+    private static boolean unavailable(List<String> flags) {
+        return flags != null && flags.stream().anyMatch(flag ->
+                "DELETE".equals(flag) || "DELETING".equals(flag) || "INACTIVE".equals(flag));
+    }
+
+    private static Set<String> onlineNodes(DevelopersApi api) throws ApiException {
+        Set<String> result = new HashSet<>();
+        for (int offset = 0; ; offset += PAGE_SIZE) {
+            List<Node> page = api.nodeList(Collections.emptyList(), Collections.emptyList(), offset, PAGE_SIZE);
+            if (page == null) {
+                throw new CloudRuntimeException("Cannot verify LINSTOR satellite connectivity");
+            }
+            for (Node node : page) {
+                if (Node.ConnectionStatusEnum.ONLINE.equals(node.getConnectionStatus())) {
+                    result.add(node.getName());
+                }
+            }
+            if (page.size() < PAGE_SIZE) {
+                return result;
+            }
+        }
+    }
+
+    private static boolean locked(ResourceDefinition definition, List<ResourceWithVolumes> resources, Set<String> onlineNodes) {
+        if (unavailable(definition.getFlags()) || resources == null || resources.isEmpty()) {
+            return true;
+        }
+        // Missing/unknown state is not evidence that a resource is free.
+        return resources.stream().anyMatch(r -> !onlineNodes.contains(r.getNodeName())
+                || unavailable(r.getFlags()) || r.getState() == null
+                || r.getVolumes() == null || r.getVolumes().isEmpty()
+                || !Boolean.FALSE.equals(r.getState().isInUse()));
+    }
+
+    private static String devicePath(String name, List<ResourceWithVolumes> resources) {
+        if (resources != null) {
+            for (ResourceWithVolumes resource : resources) {
+                if (resource.getLayerObject() != null && resource.getVolumes() != null && !resource.getVolumes().isEmpty()) {
+                    return LinstorUtil.getDevicePathFromResource(resource);
+                }
+            }
+        }
+        // No deployment information: useful for display only; locked() prevents adoption.
+        return LinstorUtil.formatDrbdByResDevicePath(name);
+    }
+
+    public static List<VolumeOnStorageTO> getVolumesForImport(DevelopersApi api, String group, String path) {
+        requireGroup(group);
+        try {
+            List<ResourceDefinition> definitions = definitions(api, path);
+            if (path != null) {
+                ResourceDefinition definition = findDefinition(definitions, path);
+                checkGroup(definition, group);
+                definitions = Collections.singletonList(definition);
+            }
+            Map<String, List<ResourceWithVolumes>> resources = resources(api, path).stream()
+                    .collect(Collectors.groupingBy(ResourceWithVolumes::getName));
+            Set<String> onlineNodes = onlineNodes(api);
+            List<VolumeOnStorageTO> result = new ArrayList<>();
+            for (ResourceDefinition definition : definitions) {
+                if (definition.getName() == null || !definition.getName().startsWith(LinstorUtil.RSC_PREFIX)
+                        || !group.equalsIgnoreCase(definition.getResourceGroupName())) {
+                    continue;
+                }
+                List<VolumeDefinition> volumes = definition.getVolumeDefinitions();
+                if (volumes == null || volumes.size() != 1 || !Integer.valueOf(0).equals(volumes.get(0).getVolumeNumber())
+                        || volumes.get(0).getSizeKib() == null || volumes.get(0).getSizeKib() <= 0) {
+                    throw new CloudRuntimeException("Invalid LINSTOR volume definition for " + definition.getName());
+                }
+                long size = Math.multiplyExact(volumes.get(0).getSizeKib(), 1024L);
+                String name = definition.getName().substring(LinstorUtil.RSC_PREFIX.length());
+                VolumeOnStorageTO volume = new VolumeOnStorageTO(Hypervisor.HypervisorType.KVM, name, name,
+                        devicePath(definition.getName(), resources.get(definition.getName())), "RAW", size, size);
+                volume.addDetail(VolumeOnStorageTO.Detail.FILE_FORMAT, "RAW");
+                volume.addDetail(VolumeOnStorageTO.Detail.IS_LOCKED,
+                        Boolean.toString(locked(definition, resources.get(definition.getName()), onlineNodes)));
+                result.add(volume);
+            }
+            result.sort(Comparator.comparing(VolumeOnStorageTO::getName));
+            return result;
+        } catch (ApiException e) {
+            throw new CloudRuntimeException("Cannot inspect LINSTOR volumes for import: " + e.getBestMessage(), e);
+        }
+    }
+}
diff --git a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java
index ae12490f10f5..9175b6c44aa7 100644
--- a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java
+++ b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java
@@ -302,6 +302,40 @@ public static String isResourceInUse(DevelopersApi api, String rscName) throws A
         return null;
     }
 
+    /**
+     * Cluster-wide in-use check by pool (builds the API from the pool, mirroring
+     * {@link #resourceSupportZeroBlocks}). Unlike a host-local qemu-img file lock, this
+     * reflects the DRBD InUse state across every node, so a volume attached to a running
+     * VM on another host is detected.
+     *
+     * Fails closed: if the controller cannot be reached, or returns nothing, the state is
+     * unknown rather than "free", and {@link KVMStoragePool#IN_USE_NODE_UNKNOWN} is returned.
+     *
+     * @return the node the resource is in use on, {@code null} if it is provably not in use,
+     *         or {@link KVMStoragePool#IN_USE_NODE_UNKNOWN} if that could not be determined.
+     */
+    public static String isResourceInUse(KVMStoragePool pool, String resName) {
+        final boolean insecureSsl = pool instanceof LinstorStoragePool && ((LinstorStoragePool) pool).isInsecureSsl();
+        final DevelopersApi api = getLinstorAPI(pool.getSourceHost(), null, insecureSsl);
+        try {
+            List<Resource> rscs = api.resourceList(resName, null, null);
+            if (rscs == null) {
+                LOGGER.error("isResourceInUse: null returned from resourceList for {}; treating in-use state as unknown",
+                        resName);
+                return KVMStoragePool.IN_USE_NODE_UNKNOWN;
+            }
+            return rscs.stream()
+                    .filter(rsc -> rsc.getState() != null && Boolean.TRUE.equals(rsc.getState().isInUse()))
+                    .map(Resource::getNodeName)
+                    .findFirst()
+                    .orElse(null);
+        } catch (ApiException apiExc) {
+            LOGGER.error("isResourceInUse: {}; treating in-use state of {} as unknown",
+                    apiExc.getBestMessage(), resName);
+            return KVMStoragePool.IN_USE_NODE_UNKNOWN;
+        }
+    }
+
     /**
      * Check if the given resources are diskless.
      *
@@ -588,10 +622,17 @@ public static boolean isRscDiskless(ResourceWithVolumes rsc) {
     }
 
     /**
-     * Checks if all diskful resource are on a zeroed block device.
+     * Checks if all diskful resources are on a zeroed block device.
+     *
+     * Fails closed: this result enables skipping zero writes (nbdcopy --destination-is-zero /
+     * qemu-img --target-is-zero), so anything we cannot positively prove must return false.
+     * An unknown, empty or malformed answer is not proof, and a purely diskless view says
+     * nothing about the backing storage of its diskful peers.
+     *
      * @param pool Linstor pool to use
      * @param resName Linstor resource name
-     * @return true if all resources are on a provider with zeroed blocks.
+     * @return true only if at least one diskful volume was seen and every diskful volume is on a
+     *         provider that hands out zeroed blocks.
      */
     public static boolean resourceSupportZeroBlocks(KVMStoragePool pool, String resName) {
         final boolean insecureSsl = pool instanceof LinstorStoragePool && ((LinstorStoragePool) pool).isInsecureSsl();
@@ -605,16 +646,38 @@ public static boolean resourceSupportZeroBlocks(KVMStoragePool pool, String resN
                     null,
                     null);
 
-            if (resWithVols != null) {
-                return resWithVols.stream()
-                        .allMatch(res -> {
-                            Volume vol0 = res.getVolumes().get(0);
-                            return vol0 != null && (vol0.getProviderKind() == ProviderKind.LVM_THIN ||
-                                    vol0.getProviderKind() == ProviderKind.ZFS ||
-                                    vol0.getProviderKind() == ProviderKind.ZFS_THIN ||
-                                    vol0.getProviderKind() == ProviderKind.DISKLESS);
-                        } );
+            if (resWithVols == null || resWithVols.isEmpty()) {
+                LOGGER.warn("resourceSupportZeroBlocks: no resource view returned for {}; assuming blocks are not zeroed",
+                        resName);
+                return false;
+            }
+
+            boolean sawDiskful = false;
+            for (ResourceWithVolumes res : resWithVols) {
+                List<Volume> volumes = res.getVolumes();
+                if (volumes == null || volumes.isEmpty()) {
+                    LOGGER.warn("resourceSupportZeroBlocks: resource {} reported no volumes; assuming blocks are not zeroed",
+                            resName);
+                    return false;
+                }
+                Volume vol0 = volumes.get(0);
+                ProviderKind kind = vol0 == null ? null : vol0.getProviderKind();
+                if (kind == null) {
+                    LOGGER.warn("resourceSupportZeroBlocks: resource {} reported no provider kind; assuming blocks are not zeroed",
+                            resName);
+                    return false;
+                }
+                if (kind == ProviderKind.DISKLESS) {
+                    // A diskless replica stores nothing locally, so it neither proves nor
+                    // disproves anything about the data; the diskful peers decide.
+                    continue;
+                }
+                if (kind != ProviderKind.LVM_THIN && kind != ProviderKind.ZFS && kind != ProviderKind.ZFS_THIN) {
+                    return false;
+                }
+                sawDiskful = true;
             }
+            return sawDiskful;
         } catch (ApiException apiExc) {
             LOGGER.error(apiExc.getMessage());
         }
diff --git a/plugins/storage/volume/linstor/src/test/java/org/apache/cloudstack/storage/datastore/util/LinstorApiPaginationContractTest.java b/plugins/storage/volume/linstor/src/test/java/org/apache/cloudstack/storage/datastore/util/LinstorApiPaginationContractTest.java
new file mode 100644
index 000000000000..6ddc7f0c0d9a
--- /dev/null
+++ b/plugins/storage/volume/linstor/src/test/java/org/apache/cloudstack/storage/datastore/util/LinstorApiPaginationContractTest.java
@@ -0,0 +1,74 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.storage.datastore.util;
+
+import java.util.Collections;
+
+import com.linbit.linstor.api.ApiClient;
+import com.linbit.linstor.api.DevelopersApi;
+import org.junit.Before;
+import org.junit.Test;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+/**
+ * Check pagination parameter names using the real SDK, without contacting a controller.
+ * Helper mocks alone cannot detect a mistaken interpretation of the SDK argument order.
+ */
+public class LinstorApiPaginationContractTest {
+    private ApiClient client;
+    private DevelopersApi api;
+
+    @Before
+    public void setup() {
+        client = mock(ApiClient.class);
+        when(client.parameterToPairs(anyString(), anyString(), any())).thenReturn(Collections.emptyList());
+        api = new DevelopersApi(client);
+    }
+
+    private void verifyPaginationQueryParameters() {
+        verify(client).parameterToPairs("", "offset", 0);
+        verify(client).parameterToPairs("", "offset", 2000);
+        verify(client, times(2)).parameterToPairs("", "limit", 1000);
+    }
+
+    @Test
+    public void resourceDefinitionListUsesOffsetThenLimit() throws Exception {
+        api.resourceDefinitionList(Collections.emptyList(), true, null, 0, 1000);
+        api.resourceDefinitionList(Collections.emptyList(), true, null, 2000, 1000);
+        verifyPaginationQueryParameters();
+    }
+
+    @Test
+    public void viewResourcesUsesOffsetThenLimit() throws Exception {
+        api.viewResources(Collections.emptyList(), Collections.emptyList(), Collections.emptyList(), null, 0, 1000);
+        api.viewResources(Collections.emptyList(), Collections.emptyList(), Collections.emptyList(), null, 2000, 1000);
+        verifyPaginationQueryParameters();
+    }
+
+    @Test
+    public void nodeListUsesOffsetThenLimit() throws Exception {
+        api.nodeList(Collections.emptyList(), Collections.emptyList(), 0, 1000);
+        api.nodeList(Collections.emptyList(), Collections.emptyList(), 2000, 1000);
+        verifyPaginationQueryParameters();
+    }
+}
diff --git a/plugins/storage/volume/linstor/src/test/java/org/apache/cloudstack/storage/datastore/util/LinstorImportHelperTest.java b/plugins/storage/volume/linstor/src/test/java/org/apache/cloudstack/storage/datastore/util/LinstorImportHelperTest.java
new file mode 100644
index 000000000000..a69eec92cefd
--- /dev/null
+++ b/plugins/storage/volume/linstor/src/test/java/org/apache/cloudstack/storage/datastore/util/LinstorImportHelperTest.java
@@ -0,0 +1,306 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.storage.datastore.util;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.linbit.linstor.api.ApiException;
+import com.linbit.linstor.api.DevelopersApi;
+import com.linbit.linstor.api.model.Node;
+import com.linbit.linstor.api.model.ResourceDefinition;
+import com.linbit.linstor.api.model.ResourceState;
+import com.linbit.linstor.api.model.ResourceWithVolumes;
+import com.linbit.linstor.api.model.VolumeDefinition;
+import org.apache.cloudstack.storage.volume.VolumeOnStorageTO;
+import org.junit.Before;
+import org.junit.Test;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertThrows;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.anyList;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.ArgumentMatchers.isNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.verifyNoMoreInteractions;
+import static org.mockito.Mockito.when;
+
+public class LinstorImportHelperTest {
+    private DevelopersApi api;
+
+    @Before
+    public void setup() throws Exception {
+        api = mock(DevelopersApi.class);
+        when(api.nodeList(Collections.emptyList(), Collections.emptyList(), 0, 1000))
+                .thenReturn(Collections.singletonList(new Node().name("remote-node").connectionStatus(Node.ConnectionStatusEnum.ONLINE)));
+    }
+
+    private ResourceDefinition definition(String name, String group) {
+        return new ResourceDefinition().name("cs-" + name).resourceGroupName(group)
+                .volumeDefinitions(Collections.singletonList(new VolumeDefinition().volumeNumber(0).sizeKib(1024L)));
+    }
+
+    private ResourceWithVolumes resource(String name, Boolean inUse) {
+        ResourceWithVolumes resource = new ResourceWithVolumes();
+        resource.setName("cs-" + name);
+        resource.setNodeName("remote-node");
+        resource.setState(new ResourceState().inUse(inUse));
+        resource.setVolumes(Collections.singletonList(new com.linbit.linstor.api.model.Volume().volumeNumber(0)));
+        return resource;
+    }
+
+    private void respond(List<ResourceDefinition> definitions, List<ResourceWithVolumes> resources) throws Exception {
+        when(api.resourceDefinitionList(anyList(), eq(true), isNull(), eq(0), eq(1000))).thenReturn(definitions);
+        when(api.viewResources(anyList(), anyList(), anyList(), isNull(), eq(0), eq(1000))).thenReturn(resources);
+    }
+
+    private List<VolumeOnStorageTO> list(String path) {
+        return LinstorImportHelper.getVolumesForImport(api, "rg-ssd", path);
+    }
+
+    @Test
+    public void listingIncludesRemoteVolumesDeduplicatesReplicasAndFiltersGroup() throws Exception {
+        respond(Arrays.asList(definition("z", "rg-ssd"), definition("a", "rg-ssd"), definition("foreign", "rg-hdd")),
+                Arrays.asList(resource("z", false), resource("z", false), resource("a", false)));
+        List<VolumeOnStorageTO> volumes = list(null);
+        assertEquals(2, volumes.size());
+        assertEquals("a", volumes.get(0).getPath());
+        assertEquals("z", volumes.get(1).getPath());
+        assertEquals("RAW", volumes.get(0).getFormat());
+        assertEquals(1024L * 1024L, volumes.get(0).getVirtualSize());
+        assertEquals("false", volumes.get(0).getDetails().get(VolumeOnStorageTO.Detail.IS_LOCKED));
+        verify(api).resourceDefinitionList(Collections.emptyList(), true, null, 0, 1000);
+        verify(api).viewResources(Collections.emptyList(), Collections.emptyList(), Collections.emptyList(), null, 0, 1000);
+        verify(api).nodeList(Collections.emptyList(), Collections.emptyList(), 0, 1000);
+        verifyNoMoreInteractions(api); // In particular: no make-available, delete or property changes.
+    }
+
+    @Test
+    public void singleVolumeIsReadOnlyAndUsesExactResourceName() throws Exception {
+        respond(Collections.singletonList(definition("x", "rg-ssd")), Collections.singletonList(resource("x", false)));
+        assertEquals("x", list("x").get(0).getPath());
+        verify(api).resourceDefinitionList(Collections.singletonList("cs-x"), true, null, 0, 1000);
+        verify(api).viewResources(Collections.emptyList(), Collections.singletonList("cs-x"), Collections.emptyList(), null, 0, 1000);
+        verify(api).nodeList(Collections.emptyList(), Collections.emptyList(), 0, 1000);
+        verifyNoMoreInteractions(api);
+    }
+
+    @Test
+    public void busyReplicaLocksVolumeEvenIfOtherReplicaIsFree() throws Exception {
+        respond(Collections.singletonList(definition("x", "rg-ssd")), Arrays.asList(resource("x", false), resource("x", true)));
+        assertEquals("true", list("x").get(0).getDetails().get(VolumeOnStorageTO.Detail.IS_LOCKED));
+    }
+
+    @Test
+    public void unknownReplicaStateLocksVolume() throws Exception {
+        respond(Collections.singletonList(definition("x", "rg-ssd")), Arrays.asList(resource("x", false), resource("x", null)));
+        assertEquals("true", list("x").get(0).getDetails().get(VolumeOnStorageTO.Detail.IS_LOCKED));
+    }
+
+    @Test
+    public void absentStateLocksVolume() throws Exception {
+        ResourceWithVolumes resource = resource("x", false);
+        resource.setState(null);
+        respond(Collections.singletonList(definition("x", "rg-ssd")), Collections.singletonList(resource));
+        assertEquals("true", list("x").get(0).getDetails().get(VolumeOnStorageTO.Detail.IS_LOCKED));
+    }
+
+    @Test
+    public void noReplicasLocksVolume() throws Exception {
+        respond(Collections.singletonList(definition("x", "rg-ssd")), Collections.emptyList());
+        assertEquals("true", list("x").get(0).getDetails().get(VolumeOnStorageTO.Detail.IS_LOCKED));
+    }
+
+    @Test
+    public void offlineSatelliteCannotReportAFreeVolume() throws Exception {
+        respond(Collections.singletonList(definition("x", "rg-ssd")), Collections.singletonList(resource("x", false)));
+        when(api.nodeList(Collections.emptyList(), Collections.emptyList(), 0, 1000)).thenReturn(Collections.emptyList());
+        assertEquals("true", list("x").get(0).getDetails().get(VolumeOnStorageTO.Detail.IS_LOCKED));
+    }
+
+    @Test
+    public void incompleteResourceCannotBeAdopted() throws Exception {
+        ResourceWithVolumes resource = resource("x", false);
+        resource.setVolumes(Collections.emptyList());
+        respond(Collections.singletonList(definition("x", "rg-ssd")), Collections.singletonList(resource));
+        assertEquals("true", list("x").get(0).getDetails().get(VolumeOnStorageTO.Detail.IS_LOCKED));
+    }
+
+    @Test
+    public void deletingResourceIsNotImportable() throws Exception {
+        respond(Collections.singletonList(definition("x", "rg-ssd").flags(Collections.singletonList("DELETE"))),
+                Collections.singletonList(resource("x", false)));
+        assertEquals("true", list("x").get(0).getDetails().get(VolumeOnStorageTO.Detail.IS_LOCKED));
+    }
+
+    @Test
+    public void wrongGroupIsRejectedBeforeReadingUsage() throws Exception {
+        when(api.resourceDefinitionList(anyList(), eq(true), isNull(), eq(0), eq(1000)))
+                .thenReturn(Collections.singletonList(definition("x", "rg-hdd")));
+        CloudRuntimeException error = assertThrows(CloudRuntimeException.class, () -> list("x"));
+        assertTrue(error.getMessage().contains("rg-hdd"));
+        assertTrue(error.getMessage().contains("rg-ssd"));
+        verify(api).resourceDefinitionList(Collections.singletonList("cs-x"), true, null, 0, 1000);
+        verifyNoMoreInteractions(api);
+    }
+
+    @Test
+    public void managerValidationRejectsWrongGroupEvenWithoutRunningVm() throws Exception {
+        when(api.resourceDefinitionList(anyList(), eq(true), isNull(), eq(0), eq(1000)))
+                .thenReturn(Collections.singletonList(definition("x", "rg-hdd")));
+        assertThrows(CloudRuntimeException.class, () -> LinstorImportHelper.validateResourceGroup(api, "rg-ssd", "x"));
+        verify(api).resourceDefinitionList(Collections.singletonList("cs-x"), true, null, 0, 1000);
+        verifyNoMoreInteractions(api);
+    }
+
+    @Test
+    public void managerValidationAcceptsMatchingGroup() throws Exception {
+        when(api.resourceDefinitionList(anyList(), eq(true), isNull(), eq(0), eq(1000)))
+                .thenReturn(Collections.singletonList(definition("x", "rg-ssd")));
+        LinstorImportHelper.validateResourceGroup(api, "rg-ssd", "x");
+        verify(api).resourceDefinitionList(Collections.singletonList("cs-x"), true, null, 0, 1000);
+        verifyNoMoreInteractions(api);
+    }
+
+    @Test
+    public void missingDefinitionIsRejected() throws Exception {
+        when(api.resourceDefinitionList(anyList(), eq(true), isNull(), eq(0), eq(1000))).thenReturn(Collections.emptyList());
+        assertThrows(CloudRuntimeException.class, () -> list("x"));
+    }
+
+    @Test
+    public void unavailableControllerFailsClosed() throws Exception {
+        when(api.resourceDefinitionList(anyList(), eq(true), isNull(), eq(0), eq(1000)))
+                .thenThrow(new ApiException("unreachable"));
+        assertThrows(CloudRuntimeException.class, () -> list("x"));
+        assertThrows(CloudRuntimeException.class, () -> LinstorImportHelper.validateResourceGroup(api, "rg-ssd", "x"));
+    }
+
+    @Test
+    public void nullUsageResponseIsAnErrorNotAnEmptySuccessfulListing() throws Exception {
+        respond(Collections.singletonList(definition("x", "rg-ssd")), null);
+        assertThrows(CloudRuntimeException.class, () -> list(null));
+    }
+
+    @Test
+    public void nullDefinitionsFailClosed() throws Exception {
+        when(api.resourceDefinitionList(anyList(), eq(true), isNull(), eq(0), eq(1000))).thenReturn(null);
+        assertThrows(CloudRuntimeException.class, () -> list("x"));
+    }
+
+    @Test
+    public void missingPoolGroupFailsClosed() {
+        assertThrows(CloudRuntimeException.class, () -> LinstorImportHelper.getVolumesForImport(api, null, "x"));
+        verifyNoInteractions(api);
+    }
+
+    @Test
+    public void devicePathCannotBypassResourceNameValidation() {
+        assertThrows(CloudRuntimeException.class, () -> list("/dev/drbd/by-res/cs-x/0"));
+        verifyNoInteractions(api);
+    }
+
+    @Test
+    public void malformedVolumeDefinitionsFailClosed() throws Exception {
+        ResourceDefinition definition = definition("x", "rg-ssd");
+        definition.setVolumeDefinitions(Collections.emptyList());
+        respond(Collections.singletonList(definition), Collections.singletonList(resource("x", false)));
+        assertThrows(CloudRuntimeException.class, () -> list("x"));
+    }
+
+    @Test
+    public void sizeOverflowFailsClosed() throws Exception {
+        ResourceDefinition definition = definition("x", "rg-ssd");
+        definition.getVolumeDefinitions().get(0).setSizeKib(Long.MAX_VALUE);
+        respond(Collections.singletonList(definition), Collections.singletonList(resource("x", false)));
+        assertThrows(ArithmeticException.class, () -> list("x"));
+    }
+
+    @Test
+    public void batchReadsFollowThreePagesWithConstantLimit() throws Exception {
+        when(api.resourceDefinitionList(anyList(), eq(true), isNull(), eq(0), eq(1000)))
+                .thenReturn(Collections.nCopies(1000, definition("foreign", "rg-hdd")));
+        when(api.resourceDefinitionList(anyList(), eq(true), isNull(), eq(1000), eq(1000)))
+                .thenReturn(Collections.nCopies(1000, definition("foreign", "rg-hdd")));
+        when(api.resourceDefinitionList(anyList(), eq(true), isNull(), eq(2000), eq(1000)))
+                .thenReturn(Collections.singletonList(definition("x", "rg-ssd")));
+        when(api.viewResources(anyList(), anyList(), anyList(), isNull(), eq(0), eq(1000)))
+                .thenReturn(Collections.nCopies(1000, resource("foreign", false)));
+        when(api.viewResources(anyList(), anyList(), anyList(), isNull(), eq(1000), eq(1000)))
+                .thenReturn(Collections.nCopies(1000, resource("foreign", false)));
+        when(api.viewResources(anyList(), anyList(), anyList(), isNull(), eq(2000), eq(1000)))
+                .thenReturn(Collections.singletonList(resource("x", false)));
+
+        List<VolumeOnStorageTO> volumes = list(null);
+        assertEquals(1, volumes.size());
+        assertEquals("x", volumes.get(0).getPath());
+        assertEquals("false", volumes.get(0).getDetails().get(VolumeOnStorageTO.Detail.IS_LOCKED));
+        verify(api).resourceDefinitionList(Collections.emptyList(), true, null, 0, 1000);
+        verify(api).resourceDefinitionList(Collections.emptyList(), true, null, 1000, 1000);
+        verify(api).resourceDefinitionList(Collections.emptyList(), true, null, 2000, 1000);
+        verify(api).viewResources(Collections.emptyList(), Collections.emptyList(), Collections.emptyList(), null, 0, 1000);
+        verify(api).viewResources(Collections.emptyList(), Collections.emptyList(), Collections.emptyList(), null, 1000, 1000);
+        verify(api).viewResources(Collections.emptyList(), Collections.emptyList(), Collections.emptyList(), null, 2000, 1000);
+        verify(api).nodeList(Collections.emptyList(), Collections.emptyList(), 0, 1000);
+        verifyNoMoreInteractions(api);
+    }
+
+    @Test
+    public void onlineSatelliteOnThirdPageAllowsImport() throws Exception {
+        respond(Collections.singletonList(definition("x", "rg-ssd")), Collections.singletonList(resource("x", false)));
+        Node unrelatedNode = new Node().name("unrelated-node").connectionStatus(Node.ConnectionStatusEnum.ONLINE);
+        when(api.nodeList(Collections.emptyList(), Collections.emptyList(), 0, 1000))
+                .thenReturn(Collections.nCopies(1000, unrelatedNode));
+        when(api.nodeList(Collections.emptyList(), Collections.emptyList(), 1000, 1000))
+                .thenReturn(Collections.nCopies(1000, unrelatedNode));
+        when(api.nodeList(Collections.emptyList(), Collections.emptyList(), 2000, 1000))
+                .thenReturn(Collections.singletonList(new Node().name("remote-node").connectionStatus(Node.ConnectionStatusEnum.ONLINE)));
+
+        assertEquals("false", list("x").get(0).getDetails().get(VolumeOnStorageTO.Detail.IS_LOCKED));
+        verify(api).resourceDefinitionList(Collections.singletonList("cs-x"), true, null, 0, 1000);
+        verify(api).viewResources(Collections.emptyList(), Collections.singletonList("cs-x"), Collections.emptyList(), null, 0, 1000);
+        verify(api).nodeList(Collections.emptyList(), Collections.emptyList(), 0, 1000);
+        verify(api).nodeList(Collections.emptyList(), Collections.emptyList(), 1000, 1000);
+        verify(api).nodeList(Collections.emptyList(), Collections.emptyList(), 2000, 1000);
+        verifyNoMoreInteractions(api);
+    }
+
+    @Test
+    public void busyReplicaOnThirdPageStillLocksVolume() throws Exception {
+        when(api.resourceDefinitionList(anyList(), eq(true), isNull(), eq(0), eq(1000)))
+                .thenReturn(Collections.singletonList(definition("x", "rg-ssd")));
+        when(api.viewResources(anyList(), anyList(), anyList(), isNull(), eq(0), eq(1000)))
+                .thenReturn(Collections.nCopies(1000, resource("x", false)));
+        when(api.viewResources(anyList(), anyList(), anyList(), isNull(), eq(1000), eq(1000)))
+                .thenReturn(Collections.nCopies(1000, resource("x", false)));
+        when(api.viewResources(anyList(), anyList(), anyList(), isNull(), eq(2000), eq(1000)))
+                .thenReturn(Collections.singletonList(resource("x", true)));
+
+        assertEquals("true", list("x").get(0).getDetails().get(VolumeOnStorageTO.Detail.IS_LOCKED));
+        verify(api).resourceDefinitionList(Collections.singletonList("cs-x"), true, null, 0, 1000);
+        verify(api).viewResources(Collections.emptyList(), Collections.singletonList("cs-x"), Collections.emptyList(), null, 0, 1000);
+        verify(api).viewResources(Collections.emptyList(), Collections.singletonList("cs-x"), Collections.emptyList(), null, 1000, 1000);
+        verify(api).viewResources(Collections.emptyList(), Collections.singletonList("cs-x"), Collections.emptyList(), null, 2000, 1000);
+        verify(api).nodeList(Collections.emptyList(), Collections.emptyList(), 0, 1000);
+        verifyNoMoreInteractions(api);
+    }
+}
diff --git a/server/src/main/java/com/cloud/server/ManagementServerImpl.java b/server/src/main/java/com/cloud/server/ManagementServerImpl.java
index f32857d7cf04..e48cf112806a 100644
--- a/server/src/main/java/com/cloud/server/ManagementServerImpl.java
+++ b/server/src/main/java/com/cloud/server/ManagementServerImpl.java
@@ -3101,10 +3101,11 @@ public Pair<List<? extends GuestOSHypervisor>, Integer> listGuestOSMappingByCrit
 
         if (osDisplayName != null) {
             List<GuestOSVO> guestOSVOS = _guestOSDao.listLikeDisplayName(osDisplayName);
-            if (CollectionUtils.isNotEmpty(guestOSVOS)) {
-                List<Long> guestOSids = guestOSVOS.stream().map(mo -> mo.getId()).collect(Collectors.toList());
-                sc.addAnd(guestOsId, SearchCriteria.Op.IN, guestOSids.toArray());
+            if (CollectionUtils.isEmpty(guestOSVOS)) {
+                return new Pair<>(Collections.emptyList(), 0);
             }
+            List<Long> guestOSids = guestOSVOS.stream().map(mo -> mo.getId()).collect(Collectors.toList());
+            sc.addAnd(guestOsId, SearchCriteria.Op.IN, guestOSids.toArray());
         }
 
         final Pair<List<GuestOSHypervisorVO>, Integer> result = _guestOSHypervisorDao.searchAndCount(sc, searchFilter);
diff --git a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
index 83a63da529e9..eff44a0c7fdb 100644
--- a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
+++ b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
@@ -9898,11 +9898,10 @@ public UserVm importVM(final DataCenter zone, final Host host, final VirtualMach
             }
 
             // Ensure template details are loaded so that commitUserVm can copy them into the VM's details map
-            VMTemplateVO vmTemplateVO = _templateDao.findById(template.getId());
-            if (vmTemplateVO == null) {
-                throw new InvalidParameterValueException("Unable to find template with id " + template.getId() + " for virtual machine import");
+            if (template instanceof VMTemplateVO) {
+                VMTemplateVO vmTemplateVO = (VMTemplateVO) template;
+                _templateDao.loadDetails(vmTemplateVO);
             }
-            _templateDao.loadDetails(vmTemplateVO);
 
             final long id = _vmDao.getNextInSequence(Long.class, "id");
             String instanceName = StringUtils.isBlank(instanceNameInternal) ?
@@ -9916,8 +9915,8 @@ public UserVm importVM(final DataCenter zone, final Host host, final VirtualMach
 
             final String uuidName = _uuidMgr.generateUuid(UserVm.class, null);
             final Host lastHost = powerState != VirtualMachine.PowerState.PowerOn ? host : null;
-            final boolean dynamicScalingEnabled = checkIfDynamicScalingCanBeEnabled(null, serviceOffering, vmTemplateVO, zone.getId());
-            return commitUserVm(true, zone, host, lastHost, vmTemplateVO, hostName, displayName, owner,
+            final boolean dynamicScalingEnabled = checkIfDynamicScalingCanBeEnabled(null, serviceOffering, template, zone.getId());
+            return commitUserVm(true, zone, host, lastHost, template, hostName, displayName, owner,
                     null, null, userData, null, null, isDisplayVm, keyboard,
                     accountId, userId, serviceOffering, template.getFormat().equals(ImageFormat.ISO), guestOsId, sshPublicKeys, networkNicMap,
                     id, instanceName, uuidName, hypervisorType, customParameters,
diff --git a/server/src/main/java/org/apache/cloudstack/storage/volume/VolumeImportUnmanageManagerImpl.java b/server/src/main/java/org/apache/cloudstack/storage/volume/VolumeImportUnmanageManagerImpl.java
index abc2e5ca2255..1e1632a4ae05 100644
--- a/server/src/main/java/org/apache/cloudstack/storage/volume/VolumeImportUnmanageManagerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/storage/volume/VolumeImportUnmanageManagerImpl.java
@@ -69,6 +69,8 @@
 import org.apache.cloudstack.api.response.VolumeResponse;
 import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.engine.orchestration.service.VolumeOrchestrationService;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreManager;
+import org.apache.cloudstack.engine.subsystem.api.storage.PrimaryDataStoreDriver;
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.resourcelimit.Reserver;
 import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
@@ -120,6 +122,8 @@ public class VolumeImportUnmanageManagerImpl implements VolumeImportUnmanageServ
     private VolumeApiService volumeApiService;
     @Inject
     private SnapshotDataStoreDao snapshotDataStoreDao;
+    @Inject
+    private DataStoreManager dataStoreManager;
 
     static final String DEFAULT_DISK_OFFERING_NAME = "Default Custom Offering for Volume Import";
     static final String DEFAULT_DISK_OFFERING_UNIQUE_NAME = "Volume-Import";
@@ -250,6 +254,10 @@ protected VolumeOnStorageTO getVolumeOnStorageAndCheck(StoragePoolVO pool, Strin
     }
 
     protected List<VolumeOnStorageTO> listVolumesForImportInternal(StoragePoolVO pool, String volumePath, String keyword) {
+        if (pool.getPoolType() == Storage.StoragePoolType.Linstor && StringUtils.isNotBlank(volumePath)) {
+            ((PrimaryDataStoreDriver) dataStoreManager.getPrimaryDataStore(pool.getId()).getDriver())
+                    .validateVolumeForImport(pool, volumePath);
+        }
         Pair<HostVO, String> hostAndLocalPath = findHostAndLocalPathForVolumeImport(pool);
         HostVO host = hostAndLocalPath.first();
         checkIfHostAndPoolSupported(host, pool);
diff --git a/server/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImpl.java b/server/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImpl.java
index 840a1de45962..6b437b362271 100644
--- a/server/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImpl.java
@@ -39,6 +39,7 @@
 import com.cloud.agent.api.to.DataStoreTO;
 import com.cloud.agent.api.to.RemoteInstanceTO;
 import com.cloud.agent.api.to.StorageFilerTO;
+import com.cloud.agent.api.to.VmwareVddkSourceDiskTO;
 import com.cloud.configuration.Config;
 import com.cloud.configuration.Resource;
 import com.cloud.dc.DataCenter;
@@ -108,6 +109,8 @@
 import com.cloud.storage.VolumeApiService;
 import com.cloud.storage.VolumeVO;
 import com.cloud.storage.dao.DiskOfferingDao;
+import com.cloud.storage.GuestOSVO;
+import com.cloud.storage.GuestOSHypervisorVO;
 import com.cloud.storage.dao.GuestOSDao;
 import com.cloud.storage.dao.GuestOSHypervisorDao;
 import com.cloud.storage.dao.SnapshotDao;
@@ -165,6 +168,7 @@
 import org.apache.cloudstack.engine.orchestration.service.VolumeOrchestrationService;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreManager;
+import org.apache.cloudstack.engine.subsystem.api.storage.PrimaryDataStoreDriver;
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
 import org.apache.cloudstack.reservation.dao.ReservationDao;
@@ -189,6 +193,8 @@
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.HashSet;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
@@ -213,6 +219,13 @@ public class UnmanagedVMsManagerImpl implements UnmanagedVMsManager {
     private static final List<Storage.StoragePoolType> forceConvertToPoolAllowedTypes =
             Arrays.asList(Storage.StoragePoolType.NetworkFilesystem, Storage.StoragePoolType.Filesystem,
                     Storage.StoragePoolType.SharedMountPoint);
+    private static final List<Storage.StoragePoolType> vddkDirectConvertToPoolAllowedTypes =
+            Arrays.asList(Storage.StoragePoolType.NetworkFilesystem, Storage.StoragePoolType.Filesystem,
+                    Storage.StoragePoolType.SharedMountPoint, Storage.StoragePoolType.RBD,
+                    Storage.StoragePoolType.Linstor);
+    private static final List<Storage.StoragePoolType> stagedConversionDestinationPoolTypes =
+            Arrays.asList(Storage.StoragePoolType.NetworkFilesystem, Storage.StoragePoolType.RBD,
+                    Storage.StoragePoolType.Linstor);
     private static final String DETAIL_VDDK_TRANSPORTS = "vddk.transports";
     private static final String DETAIL_VDDK_THUMBPRINT = "vddk.thumbprint";
 
@@ -515,6 +528,27 @@ private Map<String, Network.IpAddresses> getNicIpAddresses(final List<UnmanagedI
     }
 
     private StoragePool getStoragePool(final UnmanagedInstanceTO.Disk disk, final DataCenter zone, final Cluster cluster, DiskOffering diskOffering) {
+        return getStoragePool(disk, zone, cluster, diskOffering, null);
+    }
+
+    private StoragePool getStoragePool(final UnmanagedInstanceTO.Disk disk, final DataCenter zone, final Cluster cluster, DiskOffering diskOffering, Long storagePoolId) {
+        if (storagePoolId != null) {
+            StoragePoolVO storagePool = primaryDataStoreDao.findById(storagePoolId);
+            if (storagePool == null) {
+                throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, String.format("Storage pool ID %s for disk %s(%s) not found", storagePoolId, disk.getLabel(), disk.getDiskId()));
+            }
+            if (storagePool.getDataCenterId() != zone.getId()) {
+                throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, String.format("Storage pool %s does not belong to zone %s", storagePool.getUuid(), zone.getUuid()));
+            }
+            if (storagePool.getClusterId() != null && !storagePool.getClusterId().equals(cluster.getId())) {
+                throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, String.format("Storage pool %s does not belong to cluster %s", storagePool.getUuid(), cluster.getUuid()));
+            }
+            if (!volumeApiService.doesStoragePoolSupportDiskOffering(storagePool, diskOffering)) {
+                throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, String.format("Storage pool %s does not support disk offering %s for disk %s(%s)",
+                        storagePool.getUuid(), diskOffering.getUuid(), disk.getLabel(), disk.getDiskId()));
+            }
+            return storagePool;
+        }
         StoragePool storagePool = null;
         final String dsHost = disk.getDatastoreHost();
         final String dsPath = disk.getDatastorePath();
@@ -586,6 +620,11 @@ private Pair<UnmanagedInstanceTO.Disk, List<UnmanagedInstanceTO.Disk>> getRootAn
 
     private void checkUnmanagedDiskAndOfferingForImport(String instanceName, UnmanagedInstanceTO.Disk disk, DiskOffering diskOffering, ServiceOffering serviceOffering, final Account owner, final DataCenter zone, final Cluster cluster, final boolean migrateAllowed, List<Reserver> reservations)
             throws ServerApiException, PermissionDeniedException, ResourceAllocationException {
+        checkUnmanagedDiskAndOfferingForImport(instanceName, disk, diskOffering, serviceOffering, owner, zone, cluster, migrateAllowed, reservations, null);
+    }
+
+    private void checkUnmanagedDiskAndOfferingForImport(String instanceName, UnmanagedInstanceTO.Disk disk, DiskOffering diskOffering, ServiceOffering serviceOffering, final Account owner, final DataCenter zone, final Cluster cluster, final boolean migrateAllowed, List<Reserver> reservations, Long storagePoolId)
+            throws ServerApiException, PermissionDeniedException, ResourceAllocationException {
         if (serviceOffering == null && diskOffering == null) {
             throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, String.format("Disk offering for disk ID [%s] not found during VM [%s] import.", disk.getDiskId(), instanceName));
         }
@@ -602,7 +641,7 @@ private void checkUnmanagedDiskAndOfferingForImport(String instanceName, Unmanag
             throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, String.format("Size of disk offering(ID: %s) %dGB is found less than the size of disk(ID: %s) %dGB during VM import", diskOffering.getUuid(), (diskOffering.getDiskSize() / Resource.ResourceType.bytesToGiB), disk.getDiskId(), (disk.getCapacity() / (Resource.ResourceType.bytesToGiB))));
         }
         diskOffering = diskOffering != null ? diskOffering : diskOfferingDao.findById(serviceOffering.getDiskOfferingId());
-        StoragePool storagePool = getStoragePool(disk, zone, cluster, diskOffering);
+        StoragePool storagePool = getStoragePool(disk, zone, cluster, diskOffering, storagePoolId);
         if (diskOffering != null && !migrateAllowed && !storagePoolSupportsDiskOffering(storagePool, diskOffering)) {
             throw new InvalidParameterValueException(String.format("Disk offering: %s is not compatible with storage pool: %s of unmanaged disk: %s", diskOffering.getUuid(), storagePool.getUuid(), disk.getDiskId()));
         }
@@ -611,6 +650,11 @@ private void checkUnmanagedDiskAndOfferingForImport(String instanceName, Unmanag
 
     private void checkUnmanagedDiskAndOfferingForImport(String intanceName, List<UnmanagedInstanceTO.Disk> disks, final Map<String, Long> diskOfferingMap, final Account owner, final DataCenter zone, final Cluster cluster, final boolean migrateAllowed, List<Reserver> reservations)
             throws ServerApiException, PermissionDeniedException, ResourceAllocationException {
+        checkUnmanagedDiskAndOfferingForImport(intanceName, disks, diskOfferingMap, owner, zone, cluster, migrateAllowed, reservations, null);
+    }
+
+    private void checkUnmanagedDiskAndOfferingForImport(String intanceName, List<UnmanagedInstanceTO.Disk> disks, final Map<String, Long> diskOfferingMap, final Account owner, final DataCenter zone, final Cluster cluster, final boolean migrateAllowed, List<Reserver> reservations, Long storagePoolId)
+            throws ServerApiException, PermissionDeniedException, ResourceAllocationException {
         String diskController = null;
         for (UnmanagedInstanceTO.Disk disk : disks) {
             if (disk == null) {
@@ -626,7 +670,7 @@ private void checkUnmanagedDiskAndOfferingForImport(String intanceName, List<Unm
                     throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, String.format("Multiple data disk controllers of different type (%s, %s) are not supported for import. Please make sure that all data disk controllers are of the same type", diskController, disk.getController()));
                 }
             }
-            checkUnmanagedDiskAndOfferingForImport(intanceName, disk, diskOfferingDao.findById(diskOfferingMap.get(disk.getDiskId())), null, owner, zone, cluster, migrateAllowed, reservations);
+            checkUnmanagedDiskAndOfferingForImport(intanceName, disk, diskOfferingDao.findById(diskOfferingMap.get(disk.getDiskId())), null, owner, zone, cluster, migrateAllowed, reservations, storagePoolId);
         }
     }
 
@@ -832,6 +876,12 @@ private Pair<DiskProfile, StoragePool> importKVMSharedDisk(VirtualMachine vm, Di
     private Pair<DiskProfile, StoragePool> importDisk(UnmanagedInstanceTO.Disk disk, VirtualMachine vm, Cluster cluster, DiskOffering diskOffering,
                                                       Volume.Type type, String name, Long diskSize, Long minIops, Long maxIops, VirtualMachineTemplate template,
                                                       Account owner, Long deviceId) {
+        return importDisk(disk, vm, cluster, diskOffering, type, name, diskSize, minIops, maxIops, template, owner, deviceId, null);
+    }
+
+    private Pair<DiskProfile, StoragePool> importDisk(UnmanagedInstanceTO.Disk disk, VirtualMachine vm, Cluster cluster, DiskOffering diskOffering,
+                                                      Volume.Type type, String name, Long diskSize, Long minIops, Long maxIops, VirtualMachineTemplate template,
+                                                      Account owner, Long deviceId, Long storagePoolId) {
         final DataCenter zone = dataCenterDao.findById(vm.getDataCenterId());
         final String path = StringUtils.isEmpty(disk.getFileBaseName()) ? disk.getImagePath() : disk.getFileBaseName();
         String chainInfo = disk.getChainInfo();
@@ -841,7 +891,7 @@ private Pair<DiskProfile, StoragePool> importDisk(UnmanagedInstanceTO.Disk disk,
             diskInfo.setDiskChain(new String[]{disk.getImagePath()});
             chainInfo = gson.toJson(diskInfo);
         }
-        StoragePool storagePool = getStoragePool(disk, zone, cluster, diskOffering);
+        StoragePool storagePool = getStoragePool(disk, zone, cluster, diskOffering, storagePoolId);
         DiskProfile profile = volumeManager.importVolume(type, name, diskOffering, diskSize,
                 minIops, maxIops, vm.getDataCenterId(), vm.getHypervisorType(), vm, template, owner, deviceId, storagePool.getId(), storagePool.getPoolType(), path, chainInfo);
 
@@ -1058,6 +1108,17 @@ private UserVm importVirtualMachineInternal(final UnmanagedInstanceTO unmanagedI
                                                 final ServiceOfferingVO serviceOffering, final Map<String, Long> dataDiskOfferingMap,
                                                 final Map<String, Long> nicNetworkMap, final Map<String, Network.IpAddresses> callerNicIpAddressMap, final Long guestOsId,
                                                 final Map<String, String> details, final boolean migrateAllowed, final boolean forced, final boolean isImportUnmanagedFromSameHypervisor) {
+        return importVirtualMachineInternal(unmanagedInstance, instanceNameInternal, zone, cluster, host, template, displayName, hostName, caller, owner,
+                userId, serviceOffering, dataDiskOfferingMap, nicNetworkMap, callerNicIpAddressMap, guestOsId, details, migrateAllowed,
+                forced, isImportUnmanagedFromSameHypervisor, null);
+    }
+
+    private UserVm importVirtualMachineInternal(final UnmanagedInstanceTO unmanagedInstance, final String instanceNameInternal, final DataCenter zone, final Cluster cluster, final HostVO host,
+                                                final VirtualMachineTemplate template, final String displayName, final String hostName, final Account caller, final Account owner, final Long userId,
+                                                final ServiceOfferingVO serviceOffering, final Map<String, Long> dataDiskOfferingMap,
+                                                final Map<String, Long> nicNetworkMap, final Map<String, Network.IpAddresses> callerNicIpAddressMap, final Long guestOsId,
+                                                final Map<String, String> details, final boolean migrateAllowed, final boolean forced, final boolean isImportUnmanagedFromSameHypervisor,
+                                                final Long storagePoolId) {
         logger.debug(LogUtils.logGsonWithoutException("Trying to import VM [%s] with name [%s], in zone [%s], cluster [%s], and host [%s], using template [%s], service offering [%s], disks map [%s], NICs map [%s] and details [%s].",
                 unmanagedInstance, displayName, zone, cluster, host, template, serviceOffering, dataDiskOfferingMap, nicNetworkMap, details));
         UserVm userVm = null;
@@ -1112,9 +1173,9 @@ private UserVm importVirtualMachineInternal(final UnmanagedInstanceTO unmanagedI
 
         List<Reserver> reservations = new ArrayList<>();
         try {
-            checkUnmanagedDiskAndOfferingForImport(unmanagedInstance.getName(), rootDisk, null, validatedServiceOffering, owner, zone, cluster, migrateAllowed, reservations);
+            checkUnmanagedDiskAndOfferingForImport(unmanagedInstance.getName(), rootDisk, null, validatedServiceOffering, owner, zone, cluster, migrateAllowed, reservations, storagePoolId);
             if (CollectionUtils.isNotEmpty(dataDisks)) { // Data disk(s) present
-                checkUnmanagedDiskAndOfferingForImport(unmanagedInstance.getName(), dataDisks, dataDiskOfferingMap, owner, zone, cluster, migrateAllowed, reservations);
+                checkUnmanagedDiskAndOfferingForImport(unmanagedInstance.getName(), dataDisks, dataDiskOfferingMap, owner, zone, cluster, migrateAllowed, reservations, storagePoolId);
                 allDetails.put(VmDetailConstants.DATA_DISK_CONTROLLER, dataDisks.get(0).getController());
             }
 
@@ -1165,7 +1226,7 @@ private UserVm importVirtualMachineInternal(final UnmanagedInstanceTO unmanagedI
                 }
                 DiskOfferingVO diskOffering = diskOfferingDao.findById(serviceOffering.getDiskOfferingId());
                 diskProfileStoragePoolList.add(importDisk(rootDisk, userVm, cluster, diskOffering, Volume.Type.ROOT, String.format("ROOT-%d", userVm.getId()),
-                        rootDisk.getCapacity(), minIops, maxIops, template, owner, null));
+                        rootDisk.getCapacity(), minIops, maxIops, template, owner, null, storagePoolId));
                 long deviceId = 1L;
                 for (UnmanagedInstanceTO.Disk disk : dataDisks) {
                     if (disk.getCapacity() == null || disk.getCapacity() == 0) {
@@ -1174,7 +1235,7 @@ private UserVm importVirtualMachineInternal(final UnmanagedInstanceTO unmanagedI
                     DiskOffering offering = diskOfferingDao.findById(dataDiskOfferingMap.get(disk.getDiskId()));
                     diskProfileStoragePoolList.add(importDisk(disk, userVm, cluster, offering, Volume.Type.DATADISK, String.format("DATA-%d-%s", userVm.getId(), disk.getDiskId()),
                             disk.getCapacity(), offering.getMinIops(), offering.getMaxIops(),
-                            template, owner, deviceId));
+                            template, owner, deviceId, storagePoolId));
                     deviceId++;
                 }
             } catch (Exception e) {
@@ -1252,6 +1313,13 @@ protected Cluster basicAccessChecks(Long clusterId) {
         return cluster;
     }
 
+    protected void validateStorageVolumeForImport(StoragePool pool, String path) {
+        if (pool.getPoolType() == Storage.StoragePoolType.Linstor) {
+            ((PrimaryDataStoreDriver) dataStoreManager.getPrimaryDataStore(pool.getId()).getDriver())
+                    .validateVolumeForImport(pool, path);
+        }
+    }
+
     @Override
     public ListResponse<UnmanagedInstanceResponse> listUnmanagedInstances(ListUnmanagedInstancesCmd cmd) {
         Long clusterId = cmd.getClusterId();
@@ -1595,12 +1663,13 @@ protected void checkVmResourceLimitsForUnmanagedInstanceImport(Account owner, Un
 
     private Pair<UnmanagedInstanceTO, Boolean> getSourceVmwareUnmanagedInstance(String vcenter, String datacenterName, String username,
                                                                                 String password, String clusterName, String sourceHostName,
-                                                                                String sourceVM, ServiceOfferingVO serviceOffering) {
+                                                                                String sourceVM, ServiceOfferingVO serviceOffering,
+                                                                                Map<String, String> details) {
         HypervisorGuru vmwareGuru = hypervisorGuruManager.getGuru(Hypervisor.HypervisorType.VMware);
 
         Map<String, String> params = createParamsForTemplateFromVmwareVmMigration(vcenter, datacenterName,
                 username, password, clusterName, sourceHostName, sourceVM);
-        addServiceOfferingDetailsToParams(params, serviceOffering);
+        addServiceOfferingDetailsToParams(params, serviceOffering, details);
 
         return vmwareGuru.getHypervisorVMOutOfBandAndCloneIfRequired(sourceHostName, sourceVM, params);
     }
@@ -1611,22 +1680,33 @@ private Pair<UnmanagedInstanceTO, Boolean> getSourceVmwareUnmanagedInstance(Stri
      * @param serviceOffering service offering for the converted VM
      */
     protected void addServiceOfferingDetailsToParams(Map<String, String> params, ServiceOfferingVO serviceOffering) {
+        addServiceOfferingDetailsToParams(params, serviceOffering, null);
+    }
+
+    protected void addServiceOfferingDetailsToParams(Map<String, String> params, ServiceOfferingVO serviceOffering, Map<String, String> callerDetails) {
         if (serviceOffering != null) {
             serviceOfferingDao.loadDetails(serviceOffering);
             Map<String, String> serviceOfferingDetails = serviceOffering.getDetails();
+            Map<String, String> details = MapUtils.isEmpty(callerDetails) ? new HashMap<>() : callerDetails;
 
             if (serviceOffering.getCpu() != null) {
                 params.put(VmDetailConstants.CPU_NUMBER, String.valueOf(serviceOffering.getCpu()));
+            } else if (details.containsKey(VmDetailConstants.CPU_NUMBER)) {
+                params.put(VmDetailConstants.CPU_NUMBER, details.get(VmDetailConstants.CPU_NUMBER));
             } else if (MapUtils.isNotEmpty(serviceOfferingDetails) && serviceOfferingDetails.containsKey(ApiConstants.MIN_CPU_NUMBER)) {
                 params.put(VmDetailConstants.CPU_NUMBER, serviceOfferingDetails.get(ApiConstants.MIN_CPU_NUMBER));
             }
 
             if (serviceOffering.getSpeed() != null) {
                 params.put(VmDetailConstants.CPU_SPEED, String.valueOf(serviceOffering.getSpeed()));
+            } else if (details.containsKey(VmDetailConstants.CPU_SPEED)) {
+                params.put(VmDetailConstants.CPU_SPEED, details.get(VmDetailConstants.CPU_SPEED));
             }
 
             if (serviceOffering.getRamSize() != null) {
                 params.put(VmDetailConstants.MEMORY, String.valueOf(serviceOffering.getRamSize()));
+            } else if (details.containsKey(VmDetailConstants.MEMORY)) {
+                params.put(VmDetailConstants.MEMORY, details.get(VmDetailConstants.MEMORY));
             } else if (MapUtils.isNotEmpty(serviceOfferingDetails) && serviceOfferingDetails.containsKey(ApiConstants.MIN_MEMORY)) {
                 params.put(VmDetailConstants.MEMORY, serviceOfferingDetails.get(ApiConstants.MIN_MEMORY));
             }
@@ -1664,7 +1744,12 @@ protected UserVm importUnmanagedInstanceFromVmwareToKvm(DataCenter zone, Cluster
         boolean forceConvertToPool = cmd.getForceConvertToPool();
         Long guestOsId = cmd.getGuestOsId();
         boolean forceMsToImportVmFiles = Boolean.TRUE.equals(cmd.getForceMsToImportVmFiles());
-        boolean useVddk = cmd.getUseVddk();
+        ImportVmCmd.VmwareMigrationMode vmwareMigrationMode = getVmwareMigrationMode(cmd, cmd.getUseVddk());
+        if (ImportVmCmd.VmwareMigrationMode.CBT == vmwareMigrationMode) {
+            throw new ServerApiException(ApiErrorCode.UNSUPPORTED_ACTION_ERROR,
+                    "VMware CBT warm migration is not executable yet. Use OVF or VDDK migration mode until CBT replication support is implemented.");
+        }
+        boolean useVddk = ImportVmCmd.VmwareMigrationMode.VDDK == vmwareMigrationMode;
 
         if ((existingVcenterId == null && vcenter == null) || (existingVcenterId != null && vcenter != null)) {
             throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
@@ -1680,8 +1765,15 @@ protected UserVm importUnmanagedInstanceFromVmwareToKvm(DataCenter zone, Cluster
                             ApiConstants.FORCE_MS_TO_IMPORT_VM_FILES, ApiConstants.USE_VDDK));
         }
 
-        checkConversionStoragePool(convertStoragePoolId, forceConvertToPool);
-        validateSelectedConversionStoragePoolForVddk(useVddk, convertStoragePoolId, serviceOffering, dataDiskOfferingMap);
+        StoragePoolVO selectedConversionStoragePool = convertStoragePoolId == null ? null : primaryDataStoreDao.findById(convertStoragePoolId);
+        boolean directRbdVddkImport = useVddk && forceConvertToPool && selectedConversionStoragePool != null &&
+                selectedConversionStoragePool.getPoolType() == Storage.StoragePoolType.RBD;
+        StoragePoolVO directLinstorVddkImportPool = (useVddk && forceConvertToPool && selectedConversionStoragePool != null &&
+                selectedConversionStoragePool.getPoolType() == Storage.StoragePoolType.Linstor) ? selectedConversionStoragePool : null;
+        boolean directLinstorVddkImport = directLinstorVddkImportPool != null;
+
+        checkConversionStoragePool(convertStoragePoolId, forceConvertToPool, useVddk);
+        validateSelectedConversionStoragePoolForVddk(useVddk, forceConvertToPool, convertStoragePoolId, serviceOffering, dataDiskOfferingMap);
 
         checkExtraParamsAllowed(extraParams);
 
@@ -1705,13 +1797,13 @@ protected UserVm importUnmanagedInstanceFromVmwareToKvm(DataCenter zone, Cluster
         ImportVmTask importVMTask = null;
         List<Reserver> reservations = new ArrayList<>();
         try {
-            HostVO convertHost = selectKVMHostForConversionInCluster(destinationCluster, convertInstanceHostId, useVddk);
+            HostVO convertHost = selectKVMHostForConversionInCluster(destinationCluster, convertInstanceHostId, useVddk, directRbdVddkImport, directLinstorVddkImportPool);
             HostVO importHost = (useVddk && importInstanceHostId == null)
                     ? convertHost
                     : selectKVMHostForImportingInCluster(destinationCluster, importInstanceHostId);
 
             boolean isOvfExportSupported = false;
-            CheckConvertInstanceAnswer conversionSupportAnswer = checkConversionSupportOnHost(convertHost, sourceVMName, false, useVddk, details);
+            CheckConvertInstanceAnswer conversionSupportAnswer = checkConversionSupportOnHost(convertHost, sourceVMName, false, useVddk, details, directRbdVddkImport, directLinstorVddkImport);
             if (!useVddk) {
                 isOvfExportSupported = conversionSupportAnswer.isOvfExportSupported();
             }
@@ -1731,18 +1823,21 @@ protected UserVm importUnmanagedInstanceFromVmwareToKvm(DataCenter zone, Cluster
             // sourceVMwareInstance could be a cloned instance from sourceVMName, of the sourceVMName itself if its powered off.
             // isClonedInstance indicates if the VM is a clone of sourceVMName
 
-            Pair<UnmanagedInstanceTO, Boolean> sourceInstanceDetails = getSourceVmwareUnmanagedInstance(vcenter, datacenterName, username, password, clusterName, sourceHostName, sourceVMName, serviceOffering);
+            Pair<UnmanagedInstanceTO, Boolean> sourceInstanceDetails = getSourceVmwareUnmanagedInstance(vcenter, datacenterName, username, password, clusterName, sourceHostName, sourceVMName, serviceOffering, details);
             sourceVMwareInstance = sourceInstanceDetails.first();
             isClonedInstance = sourceInstanceDetails.second();
+            validateDirectVddkImportSourceVm(directRbdVddkImport || directLinstorVddkImport, sourceVMName, sourceVMwareInstance, isClonedInstance);
+            checkDataDiskOfferingsBeforeConvertingVmwareInstance(sourceVMName, sourceVMwareInstance, dataDiskOfferingMap);
 
             // Ensure that the configured resource limits will not be exceeded before beginning the conversion process
             checkVmResourceLimitsForUnmanagedInstanceImport(owner, sourceVMwareInstance, serviceOffering, template, reservations);
 
-            boolean isWindowsVm = sourceVMwareInstance.getOperatingSystem().toLowerCase().contains("windows");
+            boolean isWindowsVm = isWindowsGuest(sourceVMwareInstance);
             if (isWindowsVm) {
-                checkConversionSupportOnHost(convertHost, sourceVMName, true, useVddk, details);
+                checkConversionSupportOnHost(convertHost, sourceVMName, true, useVddk, details, directRbdVddkImport, directLinstorVddkImport);
             }
 
+            nicIpAddressMap = autoFillStaticNicIpAddresses(nicNetworkMap, nicIpAddressMap, buildSourceNicCidrMap(sourceVMwareInstance));
             checkNetworkingBeforeConvertingVmwareInstance(zone, owner, displayName, hostName, sourceVMwareInstance, nicNetworkMap, nicIpAddressMap, forced);
             UnmanagedInstanceTO convertedInstance;
             if (!useVddk && (forceMsToImportVmFiles || !isOvfExportSupported)) {
@@ -1767,11 +1862,14 @@ protected UserVm importUnmanagedInstanceFromVmwareToKvm(DataCenter zone, Cluster
 
             sanitizeConvertedInstance(convertedInstance, sourceVMwareInstance);
             importVmTasksManager.updateImportVMTaskStep(importVMTask, zone, owner, convertHost, importHost, null, Importing);
+            if (guestOsId == null) {
+                guestOsId = resolveGuestOsIdForVmwareImport(sourceVMwareInstance.getOperatingSystem(), sourceVMwareInstance.getOperatingSystemId());
+            }
             UserVm userVm = importVirtualMachineInternal(convertedInstance, null, zone, destinationCluster, null,
                     template, displayName, hostName, caller, owner, userId,
                     serviceOffering, dataDiskOfferingMap,
                     nicNetworkMap, nicIpAddressMap, guestOsId,
-                    details, false, forced, false);
+                    applyVmwareSourceHardwareDetails(details, sourceVMwareInstance), false, forced, false);
             long timeElapsedInSecs = (System.currentTimeMillis() - importStartTime) / 1000;
             logger.debug(String.format("VMware VM %s imported successfully to CloudStack instance %s (%s), Time taken: %d secs, OVF files imported from %s, Source VMware VM details - OS: %s, PowerState: %s, Disks: %s, NICs: %s",
                     sourceVMName, displayName, displayName, timeElapsedInSecs, (ovfTemplateOnConvertLocation != null)? "MS" : "KVM Host", sourceVMwareInstance.getOperatingSystem(), sourceVMwareInstance.getPowerState(), sourceVMwareInstance.getDisks(), sourceVMwareInstance.getNics()));
@@ -1779,7 +1877,9 @@ protected UserVm importUnmanagedInstanceFromVmwareToKvm(DataCenter zone, Cluster
             return userVm;
         } catch (CloudRuntimeException e) {
             logger.error(String.format("Error importing VM: %s", e.getMessage()), e);
-            importVmTasksManager.updateImportVMTaskErrorState(importVMTask, ImportVmTask.TaskState.Failed, e.getMessage());
+            if (importVMTask != null) {
+                importVmTasksManager.updateImportVMTaskErrorState(importVMTask, ImportVmTask.TaskState.Failed, e.getMessage());
+            }
             ActionEventUtils.onCompletedActionEvent(userId, owner.getId(), EventVO.LEVEL_ERROR, EventTypes.EVENT_VM_IMPORT,
                     cmd.getEventDescription(), null, null, 0);
             throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, e.getMessage());
@@ -1794,6 +1894,68 @@ protected UserVm importUnmanagedInstanceFromVmwareToKvm(DataCenter zone, Cluster
         }
     }
 
+    @Override
+    public UserVm importConvertedVmwareCbtInstanceToKvm(String vcenter, String datacenterName, String username, String password,
+                                                        String clusterName, String sourceHostName, String sourceVMName,
+                                                        UnmanagedInstanceTO convertedInstance, DataCenter zone,
+                                                        Cluster destinationCluster, String displayName, String hostName,
+                                                        Account caller, Account owner, long userId, Long templateId,
+                                                        Long serviceOfferingId, Map<String, Long> dataDiskOfferingMap,
+                                                        Map<String, Long> nicNetworkMap,
+                                                        Map<String, Network.IpAddresses> nicIpAddressMap,
+                                                        Long guestOsId, Map<String, String> details, boolean forced,
+                                                        Long storagePoolId) {
+        VMTemplateVO template = getTemplateForImportInstance(templateId, Hypervisor.HypervisorType.KVM);
+        ServiceOfferingVO serviceOffering = getServiceOfferingForImportInstance(serviceOfferingId, owner, zone);
+        String resolvedDisplayName = getDisplayNameForImportInstance(displayName, sourceVMName);
+        String resolvedHostName = getHostNameForImportInstance(hostName, Hypervisor.HypervisorType.KVM,
+                sourceVMName, resolvedDisplayName);
+        checkVmwareInstanceNameForImportInstance(Hypervisor.HypervisorType.KVM, sourceVMName, resolvedHostName, zone);
+
+        boolean isClonedInstance = false;
+        UnmanagedInstanceTO sourceVMwareInstance = null;
+        List<Reserver> reservations = new ArrayList<>();
+        try {
+            Pair<UnmanagedInstanceTO, Boolean> sourceInstanceDetails = getSourceVmwareUnmanagedInstance(vcenter, datacenterName,
+                    username, password, clusterName, sourceHostName, sourceVMName, serviceOffering, details);
+            sourceVMwareInstance = sourceInstanceDetails.first();
+            isClonedInstance = sourceInstanceDetails.second();
+
+            checkVmResourceLimitsForUnmanagedInstanceImport(owner, sourceVMwareInstance, serviceOffering, template, reservations);
+            Map<String, Network.IpAddresses> effectiveNicIpAddressMap = autoFillStaticNicIpAddresses(nicNetworkMap,
+                    nicIpAddressMap, buildSourceNicCidrMap(sourceVMwareInstance));
+            checkNetworkingBeforeConvertingVmwareInstance(zone, owner, resolvedDisplayName, resolvedHostName,
+                    sourceVMwareInstance, nicNetworkMap, effectiveNicIpAddressMap, forced);
+
+            sanitizeConvertedInstance(convertedInstance, sourceVMwareInstance);
+            if (guestOsId == null) {
+                guestOsId = resolveGuestOsIdForVmwareImport(sourceVMwareInstance.getOperatingSystem(), sourceVMwareInstance.getOperatingSystemId());
+            }
+            return importVirtualMachineInternal(convertedInstance, null, zone, destinationCluster, null, template,
+                    resolvedDisplayName, resolvedHostName, caller, owner, userId, serviceOffering, dataDiskOfferingMap,
+                    nicNetworkMap, effectiveNicIpAddressMap, guestOsId,
+                    applyVmwareSourceHardwareDetails(details, sourceVMwareInstance), false, forced, false, storagePoolId);
+        } catch (CloudRuntimeException e) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, e.getMessage());
+        } catch (ResourceAllocationException e) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, StringUtils.defaultString(e.getMessage()));
+        } finally {
+            if (isClonedInstance && sourceVMwareInstance != null) {
+                removeClonedInstance(vcenter, datacenterName, username, password, sourceHostName,
+                        sourceVMwareInstance.getName(), sourceVMName);
+            }
+            ReservationHelper.closeAll(reservations);
+        }
+    }
+
+    protected ImportVmCmd.VmwareMigrationMode getVmwareMigrationMode(ImportVmCmd cmd, boolean useVddkFallback) {
+        try {
+            return ImportVmCmd.VmwareMigrationMode.fromValue(cmd.getVmwareMigrationMode(), useVddkFallback);
+        } catch (IllegalArgumentException e) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, e.getMessage());
+        }
+    }
+
     /**
      * Check whether the conversion storage pool exists and is suitable for the conversion or not.
      * Secondary storage is only allowed when forceConvertToPool is false.
@@ -1802,6 +1964,10 @@ protected UserVm importUnmanagedInstanceFromVmwareToKvm(DataCenter zone, Cluster
      * @throws CloudRuntimeException in case these requirements are not met
      */
     protected void checkConversionStoragePool(Long convertStoragePoolId, boolean forceConvertToPool) {
+        checkConversionStoragePool(convertStoragePoolId, forceConvertToPool, false);
+    }
+
+    protected void checkConversionStoragePool(Long convertStoragePoolId, boolean forceConvertToPool, boolean useVddk) {
         if (forceConvertToPool && convertStoragePoolId == null) {
             String msg = "The parameter forceconverttopool is set to true, but a primary storage pool has not been provided for conversion";
             logFailureAndThrowException(msg);
@@ -1811,16 +1977,27 @@ protected void checkConversionStoragePool(Long convertStoragePoolId, boolean for
             if (selectedStoragePool == null) {
                 logFailureAndThrowException(String.format("Cannot find a storage pool with ID %s", convertStoragePoolId));
             }
-            if (forceConvertToPool && !forceConvertToPoolAllowedTypes.contains(selectedStoragePool.getPoolType())) {
+            List<Storage.StoragePoolType> allowedTypes = useVddk ? vddkDirectConvertToPoolAllowedTypes : forceConvertToPoolAllowedTypes;
+            if (forceConvertToPool && !allowedTypes.contains(selectedStoragePool.getPoolType())) {
                 logFailureAndThrowException(String.format("The selected storage pool %s does not support direct conversion " +
                         "as its type %s", selectedStoragePool.getName(), selectedStoragePool.getPoolType().name()));
             }
+            if (forceConvertToPool && !useVddk &&
+                    (selectedStoragePool.getPoolType() == Storage.StoragePoolType.RBD || selectedStoragePool.getPoolType() == Storage.StoragePoolType.Linstor)) {
+                logFailureAndThrowException(String.format("The selected %s storage pool %s can be used for direct conversion only with %s=true",
+                        selectedStoragePool.getPoolType().name(), selectedStoragePool.getName(), ApiConstants.USE_VDDK));
+            }
         }
     }
 
     protected void validateSelectedConversionStoragePoolForVddk(boolean useVddk, Long convertStoragePoolId,
                                                                 ServiceOfferingVO serviceOffering, Map<String, Long> dataDiskOfferingMap) {
-        if (!useVddk || convertStoragePoolId == null) {
+        validateSelectedConversionStoragePoolForVddk(useVddk, true, convertStoragePoolId, serviceOffering, dataDiskOfferingMap);
+    }
+
+    protected void validateSelectedConversionStoragePoolForVddk(boolean useVddk, boolean forceConvertToPool, Long convertStoragePoolId,
+                                                                ServiceOfferingVO serviceOffering, Map<String, Long> dataDiskOfferingMap) {
+        if (!useVddk || !forceConvertToPool || convertStoragePoolId == null) {
             return;
         }
 
@@ -1901,6 +2078,222 @@ private void checkUnmanagedNicAndNetworkMacAddressForImport(NetworkVO network, U
         }
     }
 
+    protected boolean isWindowsGuest(UnmanagedInstanceTO sourceVMwareInstance) {
+        return sourceVMwareInstance != null
+                && StringUtils.isNotBlank(sourceVMwareInstance.getOperatingSystem())
+                && sourceVMwareInstance.getOperatingSystem().toLowerCase().contains("windows");
+    }
+
+    private static final Pattern OS_RELEASE_YEAR_PATTERN = Pattern.compile("(19|20)\\d{2}");
+
+    @Override
+    public Long resolveGuestOsIdForVmwareImport(String osName, String osId) {
+        if (StringUtils.isNotBlank(osName)) {
+            // VMware reports e.g. "Microsoft Windows Server 2022 (64-bit)" while the CloudStack
+            // guest OS catalog names it "Windows Server 2022 (64-bit)" - try both forms.
+            for (String candidate : new String[] {osName, osName.replaceFirst("(?i)^Microsoft\\s+", "")}) {
+                GuestOSVO guestOS = guestOSDao.findOneByDisplayName(candidate);
+                if (guestOS != null) {
+                    return guestOS.getId();
+                }
+            }
+        }
+        if (StringUtils.isNotBlank(osId)) {
+            GuestOSHypervisorVO mapping = guestOSHypervisorDao.findByOsNameAndHypervisorOrderByCreatedDesc(osId,
+                    Hypervisor.HypervisorType.VMware.toString(), null);
+            if (mapping != null) {
+                return mapping.getGuestOsId();
+            }
+        }
+        return resolveWindowsGuestOsIdByYear(osName, osId);
+    }
+
+    /**
+     * Last-resort match for Windows guests whose exact release is newer than the guest OS catalog
+     * (e.g. "Microsoft Windows Server 2025 ..." on a catalog that ends at 2022): pick the newest
+     * catalog entry of the same family not newer than the source. The returned display name must
+     * start with "Windows" - the KVM agent keys Windows guest behaviour (localtime clock, hyperv
+     * enlightenments) off that prefix, and a generic non-Windows type would break the guest clock.
+     */
+    private Long resolveWindowsGuestOsIdByYear(String osName, String osId) {
+        String reference = StringUtils.isNotBlank(osName) ? osName : StringUtils.defaultString(osId);
+        if (!reference.toLowerCase().contains("win")) {
+            return null;
+        }
+        boolean server = reference.toLowerCase().contains("server") || reference.toLowerCase().contains("srv");
+        Matcher yearMatcher = OS_RELEASE_YEAR_PATTERN.matcher(reference);
+        int sourceYear = yearMatcher.find() ? Integer.parseInt(yearMatcher.group()) : Integer.MAX_VALUE;
+        List<GuestOSVO> candidates = guestOSDao.listLikeDisplayName(server ? "Windows Server" : "Windows");
+        GuestOSVO best = null;
+        int bestYear = -1;
+        for (GuestOSVO candidate : candidates) {
+            String name = candidate.getDisplayName();
+            if (name == null || !name.startsWith("Windows") || !name.contains("64-bit")) {
+                continue;
+            }
+            Matcher candidateYear = OS_RELEASE_YEAR_PATTERN.matcher(name);
+            if (!candidateYear.find()) {
+                continue;
+            }
+            int year = Integer.parseInt(candidateYear.group());
+            if (year <= sourceYear && year > bestYear) {
+                bestYear = year;
+                best = candidate;
+            }
+        }
+        if (best != null) {
+            logger.info("Mapped VMware guest OS [{} / {}] to nearest catalog entry [{}] for import", osName, osId, best.getDisplayName());
+            return best.getId();
+        }
+        return null;
+    }
+
+    /**
+     * Copies the source VM's firmware and (for Windows) console-hardware requirements into the
+     * imported VM's details, so the guest boots the way it booted on VMware. Without this every
+     * import lands on the KVM defaults - BIOS firmware and libvirt's legacy cirrus video - which
+     * leaves a UEFI source unbootable and a Windows Server Core console blank. Caller-provided
+     * details always win; only absent keys are filled in.
+     */
+    @Override
+    public Map<String, String> applyVmwareImportHardwareDetails(Map<String, String> details, String bootType, String bootMode, String osName) {
+        Map<String, String> merged = details == null ? new HashMap<>() : new HashMap<>(details);
+        if ("UEFI".equalsIgnoreCase(bootType)) {
+            merged.putIfAbsent("UEFI", "SECURE".equalsIgnoreCase(bootMode) ? "SECURE" : "LEGACY");
+            merged.putIfAbsent(VmDetailConstants.KVM_GUEST_OS_MACHINE_TYPE, "q35");
+        }
+        if (StringUtils.isNotBlank(osName) && osName.toLowerCase().contains("windows")) {
+            merged.putIfAbsent(VmDetailConstants.VIDEO_HARDWARE, "vga");
+            merged.putIfAbsent(VmDetailConstants.VIDEO_RAM, "32768");
+        }
+        return merged;
+    }
+
+    protected Map<String, String> applyVmwareSourceHardwareDetails(Map<String, String> details, UnmanagedInstanceTO sourceVMwareInstance) {
+        if (sourceVMwareInstance == null) {
+            return details == null ? new HashMap<>() : new HashMap<>(details);
+        }
+        return applyVmwareImportHardwareDetails(details, sourceVMwareInstance.getBootType(),
+                sourceVMwareInstance.getBootMode(), sourceVMwareInstance.getOperatingSystem());
+    }
+
+    protected Map<String, List<String>> buildSourceNicCidrMap(UnmanagedInstanceTO sourceVMwareInstance) {
+        Map<String, List<String>> nicIdToCidrs = new HashMap<>();
+        if (sourceVMwareInstance == null || CollectionUtils.isEmpty(sourceVMwareInstance.getNics())) {
+            return nicIdToCidrs;
+        }
+        for (UnmanagedInstanceTO.Nic nic : sourceVMwareInstance.getNics()) {
+            if (StringUtils.isBlank(nic.getNicId())) {
+                continue;
+            }
+            if (CollectionUtils.isNotEmpty(nic.getIpv4Cidrs())) {
+                nicIdToCidrs.put(nic.getNicId(), nic.getIpv4Cidrs());
+            } else if (CollectionUtils.isNotEmpty(nic.getIpAddress())) {
+                // Older or limited VMware Tools report only the bare address list without
+                // ipConfig; there is no prefix, but IP preservation only needs the address
+                // itself (the fit test runs against the target network's CIDR).
+                nicIdToCidrs.put(nic.getNicId(), nic.getIpAddress());
+            }
+        }
+        return nicIdToCidrs;
+    }
+
+    @Override
+    public Map<String, Network.IpAddresses> autoFillStaticNicIpAddresses(Map<String, Long> nicNetworkMap,
+            Map<String, Network.IpAddresses> nicIpAddressMap, Map<String, List<String>> nicIdToIpv4Cidrs) {
+        Map<String, Network.IpAddresses> effective = nicIpAddressMap == null ? new HashMap<>() : new HashMap<>(nicIpAddressMap);
+        if (MapUtils.isEmpty(nicNetworkMap)) {
+            return effective;
+        }
+        for (Map.Entry<String, Long> mapping : nicNetworkMap.entrySet()) {
+            String nicId = mapping.getKey();
+            if (effective.containsKey(nicId)) {
+                continue;
+            }
+            NetworkVO network = networkDao.findById(mapping.getValue());
+            if (network == null || network.getGuestType() == Network.GuestType.L2 || StringUtils.isBlank(network.getCidr())) {
+                continue;
+            }
+            String preservedIp = null;
+            List<String> sourceCidrs = nicIdToIpv4Cidrs == null ? null : nicIdToIpv4Cidrs.get(nicId);
+            if (CollectionUtils.isNotEmpty(sourceCidrs)) {
+                for (String sourceCidr : sourceCidrs) {
+                    String sourceIp = sourceCidr.contains("/") ? sourceCidr.substring(0, sourceCidr.indexOf('/')) : sourceCidr;
+                    if (!NetUtils.isValidIp4(sourceIp) || !NetUtils.isIpWithInCidrRange(sourceIp, network.getCidr())) {
+                        continue;
+                    }
+                    if (sourceIp.equals(network.getGateway())) {
+                        logger.warn("Not preserving source IP {} for NIC {}: it is the gateway of network {}", sourceIp, nicId, network.getUuid());
+                        continue;
+                    }
+                    if (nicDao.findByIp4AddressAndNetworkId(sourceIp, network.getId()) != null) {
+                        logger.warn("Not preserving source IP {} for NIC {}: it is already in use in network {}; the NIC falls back to automatic allocation",
+                                sourceIp, nicId, network.getUuid());
+                        continue;
+                    }
+                    preservedIp = sourceIp;
+                    break;
+                }
+            }
+            if (preservedIp != null) {
+                logger.info("Preserving static source IP {} for NIC {} in network {}", preservedIp, nicId, network.getUuid());
+                effective.put(nicId, new Network.IpAddresses(preservedIp, null));
+            } else {
+                // Isolated/shared networks reject import NICs without an IP; "auto" makes the
+                // network orchestrator pick a free address instead (see allocateNic import path).
+                logger.info("No preservable source IP for NIC {}; falling back to automatic allocation in network {}", nicId, network.getUuid());
+                effective.put(nicId, new Network.IpAddresses("auto", null));
+            }
+        }
+        return effective;
+    }
+
+    // Matches the creation position embedded in a direct-to-pool converted disk image name:
+    // RBD "<uuid>-disk-NNN" (see buildRbdImageName) and Linstor "<uuid>-dNN" (see buildLinstorDiskName).
+    private static final Pattern CONVERTED_POOL_DISK_POSITION_PATTERN = Pattern.compile("-(?:disk-|d)(\\d+)");
+
+    /**
+     * Extracts the creation position encoded in a direct-to-pool converted disk's image path, or
+     * {@code null} when the path carries no such position (e.g. OVF-converted qcow2 images). When a
+     * path contains multiple candidate matches, the last one wins so that digits inside the conversion
+     * UUID are not mistaken for the position.
+     */
+    protected Integer extractConvertedPoolDiskPosition(String imagePath) {
+        if (StringUtils.isBlank(imagePath)) {
+            return null;
+        }
+        Matcher matcher = CONVERTED_POOL_DISK_POSITION_PATTERN.matcher(imagePath);
+        Integer position = null;
+        while (matcher.find()) {
+            position = Integer.parseInt(matcher.group(1));
+        }
+        return position;
+    }
+
+    /**
+     * Resolves, for each converted disk, the index of the source VMware disk whose ID it should adopt.
+     * Direct-to-pool (RBD/Linstor) converted disks are matched to source disks by the creation position
+     * embedded in their image name; this is used only when every converted disk yields a distinct, valid
+     * position for the given source disk count. Otherwise (OVF path) it falls back to list-index pairing.
+     */
+    protected int[] resolveConvertedToSourceDiskIndexes(List<UnmanagedInstanceTO.Disk> convertedDisks, int sourceDiskCount) {
+        int[] indexes = new int[convertedDisks.size()];
+        Integer[] positions = new Integer[convertedDisks.size()];
+        boolean usePositions = convertedDisks.size() == sourceDiskCount;
+        Set<Integer> seenPositions = new HashSet<>();
+        for (int i = 0; i < convertedDisks.size(); i++) {
+            Integer position = extractConvertedPoolDiskPosition(convertedDisks.get(i).getImagePath());
+            positions[i] = position;
+            if (position == null || position < 0 || position >= sourceDiskCount || !seenPositions.add(position)) {
+                usePositions = false;
+            }
+        }
+        for (int i = 0; i < convertedDisks.size(); i++) {
+            indexes[i] = usePositions ? positions[i] : i;
+        }
+        return indexes;
+    }
+
     private void sanitizeConvertedInstance(UnmanagedInstanceTO convertedInstance, UnmanagedInstanceTO sourceVMwareInstance) {
         convertedInstance.setCpuCores(sourceVMwareInstance.getCpuCores());
         convertedInstance.setCpuSpeed(sourceVMwareInstance.getCpuSpeed());
@@ -1909,9 +2302,17 @@ private void sanitizeConvertedInstance(UnmanagedInstanceTO convertedInstance, Un
         convertedInstance.setPowerState(UnmanagedInstanceTO.PowerState.PowerOff);
         List<UnmanagedInstanceTO.Disk> convertedInstanceDisks = convertedInstance.getDisks();
         List<UnmanagedInstanceTO.Disk> sourceVMwareInstanceDisks = sourceVMwareInstance.getDisks();
+        // The source disk IDs (which drive the root-vs-data classification during import) must be
+        // copied onto the matching converted disk. Direct-to-pool conversions (RBD/Linstor) discover
+        // the converted disks from the finalized libvirt domain, whose device order (vda, vdb, ...) need
+        // not match the source disk order, so pairing purely by list index would swap root and data on
+        // multi-disk imports. Their image names embed the creation position (<uuid>-disk-NNN for RBD,
+        // <uuid>-dNN for Linstor), which follows the source order, so pair by that position when present
+        // and fall back to index pairing for OVF conversions (whose image names carry no such position).
+        int[] sourceIndexForConvertedDisk = resolveConvertedToSourceDiskIndexes(convertedInstanceDisks, sourceVMwareInstanceDisks.size());
         for (int i = 0; i < convertedInstanceDisks.size(); i++) {
             UnmanagedInstanceTO.Disk disk = convertedInstanceDisks.get(i);
-            disk.setDiskId(sourceVMwareInstanceDisks.get(i).getDiskId());
+            disk.setDiskId(sourceVMwareInstanceDisks.get(sourceIndexForConvertedDisk[i]).getDiskId());
         }
         List<UnmanagedInstanceTO.Nic> convertedInstanceNics = convertedInstance.getNics();
         List<UnmanagedInstanceTO.Nic> sourceVMwareInstanceNics = sourceVMwareInstance.getNics();
@@ -2020,6 +2421,15 @@ HostVO selectKVMHostForImportingInCluster(Cluster destinationCluster, Long impor
     }
 
     HostVO selectKVMHostForConversionInCluster(Cluster destinationCluster, Long convertInstanceHostId, boolean useVddk) {
+        return selectKVMHostForConversionInCluster(destinationCluster, convertInstanceHostId, useVddk, false);
+    }
+
+    HostVO selectKVMHostForConversionInCluster(Cluster destinationCluster, Long convertInstanceHostId, boolean useVddk, boolean requireVddkRbdDirectImportSupport) {
+        return selectKVMHostForConversionInCluster(destinationCluster, convertInstanceHostId, useVddk, requireVddkRbdDirectImportSupport, null);
+    }
+
+    HostVO selectKVMHostForConversionInCluster(Cluster destinationCluster, Long convertInstanceHostId, boolean useVddk, boolean requireVddkRbdDirectImportSupport,
+                                               StoragePoolVO linstorDirectImportPool) {
         if (convertInstanceHostId != null) {
             HostVO selectedHost = hostDao.findById(convertInstanceHostId);
             String err = null;
@@ -2042,6 +2452,12 @@ HostVO selectKVMHostForConversionInCluster(Cluster destinationCluster, Long conv
                 err = String.format(
                         "Cannot perform the conversion on the host %s as it is not in the same zone as the destination cluster",
                         selectedHost);
+            } else if (linstorDirectImportPool != null &&
+                    storagePoolHostDao.findByPoolHost(linstorDirectImportPool.getId(), selectedHost.getId()) == null) {
+                err = String.format(
+                        "Cannot perform the direct Linstor VDDK import on the host %s as it does not have access to " +
+                        "the Linstor storage pool %s. The host must be a LINSTOR satellite connected to the pool.",
+                        selectedHost, linstorDirectImportPool.getName());
             }
             if (err != null) {
                 logger.error(err);
@@ -2059,6 +2475,13 @@ HostVO selectKVMHostForConversionInCluster(Cluster destinationCluster, Long conv
                     hosts = vddkHosts;
                 }
             }
+            if (requireVddkRbdDirectImportSupport) {
+                List<HostVO> directRbdHosts = filterHostsWithVddkRbdDirectImportSupport(hosts);
+                hosts = directRbdHosts;
+            }
+            if (linstorDirectImportPool != null) {
+                hosts = filterHostsForLinstorDirectImport(hosts, linstorDirectImportPool);
+            }
             if (CollectionUtils.isNotEmpty(hosts)) {
                 return hosts.get(new Random().nextInt(hosts.size()));
             }
@@ -2073,20 +2496,46 @@ HostVO selectKVMHostForConversionInCluster(Cluster destinationCluster, Long conv
                     hosts = vddkHosts;
                 }
             }
+            if (requireVddkRbdDirectImportSupport) {
+                List<HostVO> directRbdHosts = filterHostsWithVddkRbdDirectImportSupport(hosts);
+                hosts = directRbdHosts;
+            }
+            if (linstorDirectImportPool != null) {
+                hosts = filterHostsForLinstorDirectImport(hosts, linstorDirectImportPool);
+            }
             if (CollectionUtils.isNotEmpty(hosts)) {
                 return hosts.get(new Random().nextInt(hosts.size()));
             }
         }
 
-        String err = useVddk
-                ? String.format("Could not find any suitable %s host in cluster %s with '%s' configured to perform the VDDK-based instance conversion",
-                destinationCluster.getHypervisorType(), destinationCluster, Host.HOST_VDDK_SUPPORT)
-                : String.format("Could not find any suitable %s host in cluster %s to perform the instance conversion",
-                destinationCluster.getHypervisorType(), destinationCluster);
+        String err;
+        if (requireVddkRbdDirectImportSupport) {
+            err = String.format("Could not find any suitable %s host in cluster %s with '%s' enabled, which is required to perform direct RBD VDDK import. " +
+                    "This usually means the host is missing VDDK, qemu-img RBD support, or in-place virt-v2v support through the virt-v2v-in-place binary or virt-v2v --in-place option.",
+                    destinationCluster.getHypervisorType(), destinationCluster, Host.HOST_VDDK_RBD_DIRECT_IMPORT_SUPPORT);
+        } else if (linstorDirectImportPool != null) {
+            err = String.format("Could not find any suitable %s host in cluster %s to perform direct Linstor VDDK import. " +
+                    "The host must have VDDK, in-place virt-v2v support ('%s'), and access to the Linstor storage pool %s.",
+                    destinationCluster.getHypervisorType(), destinationCluster, Host.HOST_VIRTV2V_INPLACE_SUPPORT, linstorDirectImportPool.getName());
+        } else if (useVddk) {
+            err = String.format("Could not find any suitable %s host in cluster %s with '%s' configured to perform the VDDK-based instance conversion",
+                    destinationCluster.getHypervisorType(), destinationCluster, Host.HOST_VDDK_SUPPORT);
+        } else {
+            err = String.format("Could not find any suitable %s host in cluster %s to perform the instance conversion",
+                    destinationCluster.getHypervisorType(), destinationCluster);
+        }
         logger.error(err);
         throw new CloudRuntimeException(err);
     }
 
+    private List<HostVO> filterHostsForLinstorDirectImport(List<HostVO> hosts, StoragePoolVO linstorPool) {
+        return hosts.stream().filter(h -> {
+            hostDao.loadDetails(h);
+            return Boolean.parseBoolean(h.getDetail(Host.HOST_VIRTV2V_INPLACE_SUPPORT)) &&
+                    storagePoolHostDao.findByPoolHost(linstorPool.getId(), h.getId()) != null;
+        }).collect(Collectors.toList());
+    }
+
     private List<HostVO> filterHostsWithVddkSupport(List<HostVO> hosts) {
         return hosts.stream().filter(h -> {
             hostDao.loadDetails(h);
@@ -2094,14 +2543,31 @@ private List<HostVO> filterHostsWithVddkSupport(List<HostVO> hosts) {
         }).collect(Collectors.toList());
     }
 
+    private List<HostVO> filterHostsWithVddkRbdDirectImportSupport(List<HostVO> hosts) {
+        return hosts.stream().filter(h -> {
+            hostDao.loadDetails(h);
+            return Boolean.parseBoolean(h.getDetail(Host.HOST_VDDK_RBD_DIRECT_IMPORT_SUPPORT));
+        }).collect(Collectors.toList());
+    }
+
     private CheckConvertInstanceAnswer checkConversionSupportOnHost(HostVO convertHost, String sourceVM,
                                                                     boolean checkWindowsGuestConversionSupport,
                                                                     boolean useVddk, Map<String, String> details) {
+        return checkConversionSupportOnHost(convertHost, sourceVM, checkWindowsGuestConversionSupport, useVddk, details, false, false);
+    }
+
+    private CheckConvertInstanceAnswer checkConversionSupportOnHost(HostVO convertHost, String sourceVM,
+                                                                    boolean checkWindowsGuestConversionSupport,
+                                                                    boolean useVddk, Map<String, String> details,
+                                                                    boolean checkVddkRbdDirectImportSupport,
+                                                                    boolean checkVddkInPlaceFinalizationSupport) {
         logger.debug(String.format("Checking the %s%s conversion support on the host %s",
                 useVddk ? "VDDK " : "",
                 checkWindowsGuestConversionSupport ? "windows guest " : "",
                 convertHost));
         CheckConvertInstanceCommand cmd = new CheckConvertInstanceCommand(checkWindowsGuestConversionSupport, useVddk);
+        cmd.setCheckVddkRbdDirectImportSupport(checkVddkRbdDirectImportSupport);
+        cmd.setCheckVddkInPlaceFinalizationSupport(checkVddkInPlaceFinalizationSupport);
         if (MapUtils.isNotEmpty(details)) {
             cmd.setVddkLibDir(StringUtils.trimToNull(details.get(Host.HOST_VDDK_LIB_DIR)));
         }
@@ -2139,18 +2605,21 @@ private UnmanagedInstanceTO convertVmwareInstanceToKVMWithOVFOnConvertLocation(
                 sourceVM, convertHost, ovfTemplateDirConvertLocation);
 
         RemoteInstanceTO remoteInstanceTO = new RemoteInstanceTO(sourceVM, sourceVMwareInstance.getClusterName(), sourceVMwareInstance.getHostName());
-        List<String> destinationStoragePools = selectInstanceConversionStoragePools(convertStoragePools, sourceVMwareInstance.getDisks(), serviceOffering, dataDiskOfferingMap);
+        List<StoragePoolVO> destinationStoragePools = selectInstanceConversionDestinationStoragePools(convertStoragePools, sourceVMwareInstance.getDisks(), serviceOffering, dataDiskOfferingMap);
+        validateStagedImportHostSupport(forceConvertToPool, destinationStoragePools, importHost);
         ConvertInstanceCommand cmd = new ConvertInstanceCommand(remoteInstanceTO,
                 Hypervisor.HypervisorType.KVM, temporaryConvertLocation,
                 ovfTemplateDirConvertLocation, false, false, sourceVM);
         if (StringUtils.isNotBlank(extraParams)) {
             cmd.setExtraParams(extraParams);
         }
+        cmd.setWindowsGuest(isWindowsGuest(sourceVMwareInstance));
         int timeoutSeconds = UnmanagedVMsManager.ConvertVmwareInstanceToKvmTimeout.value() * 60 * 60;
         cmd.setWait(timeoutSeconds);
 
         return convertAndImportToKVM(cmd, convertHost, importHost, sourceVM,
-                remoteInstanceTO, destinationStoragePools, temporaryConvertLocation, forceConvertToPool);
+                remoteInstanceTO, getStoragePoolUuids(destinationStoragePools), getStoragePoolTypes(destinationStoragePools),
+                temporaryConvertLocation, forceConvertToPool);
     }
 
     private UnmanagedInstanceTO convertVmwareInstanceToKVMUsingVDDKOrAfterExportingOVFToConvertLocation(
@@ -2163,7 +2632,9 @@ private UnmanagedInstanceTO convertVmwareInstanceToKVMUsingVDDKOrAfterExportingO
         logger.debug("Delegating the conversion of instance {} from VMware to KVM to the host {} after OVF export through ovftool", sourceVM, convertHost);
 
         RemoteInstanceTO remoteInstanceTO = new RemoteInstanceTO(sourceVMwareInstance.getName(), sourceVMwareInstance.getPath(), vcenterHost, vcenterUsername, vcenterPassword, datacenterName, sourceVMwareInstance.getClusterName(), sourceVMwareInstance.getHostName());
-        List<String> destinationStoragePools = selectInstanceConversionStoragePools(convertStoragePools, sourceVMwareInstance.getDisks(), serviceOffering, dataDiskOfferingMap);
+        remoteInstanceTO.setVmwareMoref(sourceVMwareInstance.getVmwareMoref());
+        List<StoragePoolVO> destinationStoragePools = selectInstanceConversionDestinationStoragePools(convertStoragePools, sourceVMwareInstance.getDisks(), serviceOffering, dataDiskOfferingMap);
+        validateStagedImportHostSupport(forceConvertToPool, destinationStoragePools, importHost);
         ConvertInstanceCommand cmd = new ConvertInstanceCommand(remoteInstanceTO,
                 Hypervisor.HypervisorType.KVM, temporaryConvertLocation, null, false, true, sourceVM);
         int timeoutSeconds = UnmanagedVMsManager.ConvertVmwareInstanceToKvmTimeout.value() * 60 * 60;
@@ -2178,9 +2649,27 @@ private UnmanagedInstanceTO convertVmwareInstanceToKVMUsingVDDKOrAfterExportingO
             cmd.setExtraParams(extraParams);
         }
         cmd.setUseVddk(useVddk);
+        if (useVddk) {
+            cmd.setVmwareVddkSourceDisks(toVmwareVddkSourceDisks(sourceVMwareInstance.getDisks()));
+        }
+        cmd.setWindowsGuest(isWindowsGuest(sourceVMwareInstance));
         applyVddkOverridesFromDetails(cmd, details);
         return convertAndImportToKVM(cmd, convertHost, importHost, sourceVM,
-                remoteInstanceTO, destinationStoragePools, temporaryConvertLocation, forceConvertToPool);
+                remoteInstanceTO, getStoragePoolUuids(destinationStoragePools), getStoragePoolTypes(destinationStoragePools),
+                temporaryConvertLocation, forceConvertToPool);
+    }
+
+    private List<VmwareVddkSourceDiskTO> toVmwareVddkSourceDisks(List<UnmanagedInstanceTO.Disk> disks) {
+        if (CollectionUtils.isEmpty(disks)) {
+            return Collections.emptyList();
+        }
+        List<VmwareVddkSourceDiskTO> sourceDisks = new ArrayList<>(disks.size());
+        for (int i = 0; i < disks.size(); i++) {
+            UnmanagedInstanceTO.Disk disk = disks.get(i);
+            sourceDisks.add(new VmwareVddkSourceDiskTO(disk.getDiskId(), disk.getImagePath(),
+                    disk.getCapacity() == null ? 0L : disk.getCapacity(), i));
+        }
+        return sourceDisks;
     }
 
     private void applyVddkOverridesFromDetails(ConvertInstanceCommand cmd, Map<String, String> details) {
@@ -2193,10 +2682,65 @@ private void applyVddkOverridesFromDetails(ConvertInstanceCommand cmd, Map<Strin
         cmd.setVddkThumbprint(StringUtils.trimToNull(details.get(DETAIL_VDDK_THUMBPRINT)));
     }
 
+    /**
+     * Pre-conversion twin of the getRootAndDataDisks() disk-offering requirement:
+     * the same mismatch used to surface only AFTER every byte of the source disks
+     * had been copied and converted. Fail before the conversion starts instead.
+     */
+    protected void checkDataDiskOfferingsBeforeConvertingVmwareInstance(String sourceVMName, UnmanagedInstanceTO sourceVMwareInstance,
+                                                                        Map<String, Long> dataDiskOfferingMap) {
+        int diskCount = sourceVMwareInstance == null || CollectionUtils.isEmpty(sourceVMwareInstance.getDisks()) ?
+                0 : sourceVMwareInstance.getDisks().size();
+        int mappedCount = dataDiskOfferingMap == null ? 0 : dataDiskOfferingMap.size();
+        if (diskCount > 0 && mappedCount != diskCount - 1) {
+            String msg = String.format("Source VM %s has total %d disks for which %d disk offering mappings were provided; %d disk(s) need a disk offering. " +
+                    "%s parameter can be used to provide disk offerings for the data disks", sourceVMName, diskCount, mappedCount, diskCount - 1,
+                    ApiConstants.DATADISK_OFFERING_LIST);
+            logger.error(msg);
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, msg);
+        }
+    }
+
+    private void validateDirectVddkImportSourceVm(boolean directBlockVddkImport, String sourceVM,
+                                               UnmanagedInstanceTO sourceVMwareInstance, boolean isClonedInstance) {
+        if (!directBlockVddkImport) {
+            return;
+        }
+        if (isClonedInstance || sourceVMwareInstance == null || sourceVMwareInstance.getPowerState() != UnmanagedInstanceTO.PowerState.PowerOff) {
+            throw new CloudRuntimeException(String.format("Direct VDDK import to a block storage pool is supported only for powered-off VMware VMs. " +
+                    "Please power off VM %s, or disable %s and use staged import with temporary conversion storage.",
+                    sourceVM, ApiConstants.FORCE_CONVERT_TO_POOL));
+        }
+    }
+
+    protected void validateStagedImportHostSupport(boolean forceConvertToPool, List<StoragePoolVO> destinationStoragePools, HostVO importHost) {
+        if (forceConvertToPool) {
+            return;
+        }
+        if (destinationStoragePools.stream().anyMatch(pool -> pool.getPoolType() == Storage.StoragePoolType.RBD)) {
+            hostDao.loadDetails(importHost);
+            if (!Boolean.parseBoolean(importHost.getDetail(Host.HOST_QEMU_RBD_SUPPORT))) {
+                throw new CloudRuntimeException(String.format("Import host %s cannot copy converted qcow2 disks to RBD. " +
+                        "Please select an import host with %s=true, or use a non-RBD destination pool.",
+                        importHost.getName(), Host.HOST_QEMU_RBD_SUPPORT));
+            }
+        }
+        for (StoragePoolVO pool : destinationStoragePools) {
+            if (pool.getPoolType() == Storage.StoragePoolType.Linstor &&
+                    storagePoolHostDao.findByPoolHost(pool.getId(), importHost.getId()) == null) {
+                throw new CloudRuntimeException(String.format("Import host %s does not have access to the Linstor " +
+                        "destination storage pool %s. Please select an import host that is a LINSTOR satellite " +
+                        "connected to the pool, or use a different destination pool.",
+                        importHost.getName(), pool.getName()));
+            }
+        }
+    }
+
     private UnmanagedInstanceTO convertAndImportToKVM(ConvertInstanceCommand convertInstanceCommand, HostVO convertHost, HostVO importHost,
                                                       String sourceVM,
                                                       RemoteInstanceTO remoteInstanceTO,
                                                       List<String> destinationStoragePools,
+                                                      List<Storage.StoragePoolType> destinationStoragePoolTypes,
                                                       DataStoreTO temporaryConvertLocation,
                                                       boolean forceConvertToPool) {
         Answer convertAnswer;
@@ -2222,7 +2766,7 @@ private UnmanagedInstanceTO convertAndImportToKVM(ConvertInstanceCommand convert
         try {
             convertedDisksPrefix = ((ConvertInstanceAnswer)convertAnswer).getTemporaryConvertUuid();
             ImportConvertedInstanceCommand importCmd = new ImportConvertedInstanceCommand(
-                    remoteInstanceTO, destinationStoragePools, temporaryConvertLocation,
+                    remoteInstanceTO, destinationStoragePools, destinationStoragePoolTypes, temporaryConvertLocation,
                     convertedDisksPrefix, forceConvertToPool);
             importAnswer = agentManager.send(importHost.getId(), importCmd);
 
@@ -2272,8 +2816,12 @@ private List<StoragePoolVO> findInstanceConversionDestinationStoragePoolsInClust
             DataStoreTO temporaryConvertLocation, boolean forceConvertToPool) {
         List<StoragePoolVO> poolsList;
         if (!forceConvertToPool) {
-            Set<StoragePoolVO> pools = new HashSet<>(primaryDataStoreDao.findClusterWideStoragePoolsByHypervisorAndPoolType(destinationCluster.getId(), Hypervisor.HypervisorType.KVM, Storage.StoragePoolType.NetworkFilesystem));
-            pools.addAll(primaryDataStoreDao.findZoneWideStoragePoolsByHypervisorAndPoolType(destinationCluster.getDataCenterId(), Hypervisor.HypervisorType.KVM, Storage.StoragePoolType.NetworkFilesystem));
+            List<StoragePoolVO> pools = new ArrayList<>();
+            for (Storage.StoragePoolType poolType : stagedConversionDestinationPoolTypes) {
+                Set<StoragePoolVO> poolsForType = new HashSet<>(primaryDataStoreDao.findClusterWideStoragePoolsByHypervisorAndPoolType(destinationCluster.getId(), Hypervisor.HypervisorType.KVM, poolType));
+                poolsForType.addAll(primaryDataStoreDao.findZoneWideStoragePoolsByHypervisorAndPoolType(destinationCluster.getDataCenterId(), Hypervisor.HypervisorType.KVM, poolType));
+                pools.addAll(poolsForType);
+            }
             if (pools.isEmpty()) {
                 String msg = String.format("Cannot find suitable storage pools in the cluster %s for the conversion", destinationCluster.getName());
                 logger.error(msg);
@@ -2293,7 +2841,8 @@ private List<StoragePoolVO> findInstanceConversionDestinationStoragePoolsInClust
                 throw new CloudRuntimeException(msg);
             }
             if (getStoragePoolWithTags(poolsList, diskOffering.getTags()) == null) {
-                String msg = String.format("Cannot find suitable storage pool for disk offering %s that belongs to the service offering %s", diskOffering.getName(), serviceOffering.getName());
+                String msg = String.format("Cannot find an Up destination primary storage pool matching storage tags '%s' required by service offering %s",
+                        diskOffering.getTags(), serviceOffering.getName());
                 logger.error(msg);
                 throw new CloudRuntimeException(msg);
             }
@@ -2306,7 +2855,8 @@ private List<StoragePoolVO> findInstanceConversionDestinationStoragePoolsInClust
                 throw new CloudRuntimeException(msg);
             }
             if (getStoragePoolWithTags(poolsList, diskOffering.getTags()) == null) {
-                String msg = String.format("Cannot find suitable storage pool for disk offering %s", diskOffering.getName());
+                String msg = String.format("Cannot find an Up destination primary storage pool matching storage tags '%s' required by data disk offering %s",
+                        diskOffering.getTags(), diskOffering.getName());
                 logger.error(msg);
                 throw new CloudRuntimeException(msg);
             }
@@ -2331,7 +2881,14 @@ private List<String> selectInstanceConversionStoragePools(
             List<StoragePoolVO> pools, List<UnmanagedInstanceTO.Disk> disks,
             ServiceOfferingVO serviceOffering, Map<String, Long> dataDiskOfferingMap
     ) {
-        List<String> storagePools = new ArrayList<>(disks.size());
+        return getStoragePoolUuids(selectInstanceConversionDestinationStoragePools(pools, disks, serviceOffering, dataDiskOfferingMap));
+    }
+
+    private List<StoragePoolVO> selectInstanceConversionDestinationStoragePools(
+            List<StoragePoolVO> pools, List<UnmanagedInstanceTO.Disk> disks,
+            ServiceOfferingVO serviceOffering, Map<String, Long> dataDiskOfferingMap
+    ) {
+        List<StoragePoolVO> storagePools = new ArrayList<>(disks.size());
         Set<String> dataDiskIds = dataDiskOfferingMap.keySet();
         for (UnmanagedInstanceTO.Disk disk : disks) {
             Long diskOfferingId = null;
@@ -2343,16 +2900,24 @@ private List<String> selectInstanceConversionStoragePools(
 
             //TODO: Choose pools by capacity
             if (diskOfferingId == null) {
-                storagePools.add(pools.get(0).getUuid());
+                storagePools.add(pools.get(0));
             } else {
                 DiskOfferingVO diskOffering = diskOfferingDao.findById(diskOfferingId);
                 StoragePoolVO pool = getStoragePoolWithTags(pools, diskOffering.getTags());
-                storagePools.add(pool.getUuid());
+                storagePools.add(pool);
             }
         }
         return storagePools;
     }
 
+    private List<String> getStoragePoolUuids(List<StoragePoolVO> pools) {
+        return pools.stream().map(StoragePoolVO::getUuid).collect(Collectors.toList());
+    }
+
+    private List<Storage.StoragePoolType> getStoragePoolTypes(List<StoragePoolVO> pools) {
+        return pools.stream().map(StoragePoolVO::getPoolType).collect(Collectors.toList());
+    }
+
     private void logFailureAndThrowException(String msg) {
         logger.error(msg);
         throw new CloudRuntimeException(msg);
@@ -2657,6 +3222,13 @@ private UserVmResponse importKvmInstance(ImportVmCmd cmd) {
                 throw new InvalidParameterValueException("Disk Path is required for Import from shared/local storage");
             }
 
+            if (MapUtils.isNotEmpty(dataDiskOfferingMap)) {
+                // The shared/local path only ever adopts the single root disk; silently accepting
+                // the parameter would let callers believe their data disks were imported.
+                throw new InvalidParameterValueException("datadiskofferinglist is not supported for Import from shared/local storage. " +
+                        "Import the root disk first, then adopt each data disk with importVolume and attach it to the imported instance.");
+            }
+
             if (networkId == null) {
                 throw new InvalidParameterValueException("Network is required for Import from shared/local storage");
             }
@@ -2674,6 +3246,8 @@ private UserVmResponse importKvmInstance(ImportVmCmd cmd) {
                 throw new InvalidParameterValueException("Disk image is already in use");
             }
 
+            validateStorageVolumeForImport(storagePool, diskPath);
+
             DiskOffering diskOffering = diskOfferingDao.findById(serviceOffering.getDiskOfferingId());
 
             if (diskOffering != null && !storagePoolSupportsDiskOffering(storagePool, diskOffering)) {
@@ -2966,6 +3540,12 @@ private UserVm importKvmVirtualMachineFromDisk(final ImportSource importSource,
             Map<Volume, StoragePool> storage = dest.getStorageForDisks();
             Volume volume = volumeDao.findById(diskProfile.getVolumeId());
             StoragePool storagePool = storage.get(volume);
+            try {
+                validateStorageVolumeForImport(storagePool, diskPath);
+            } catch (RuntimeException e) {
+                cleanupFailedImportVM(userVm);
+                throw e;
+            }
             CheckVolumeCommand checkVolumeCommand = new CheckVolumeCommand();
             checkVolumeCommand.setSrcFile(diskPath);
             StorageFilerTO storageTO = new StorageFilerTO(storagePool);
diff --git a/server/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationCutoverPolicy.java b/server/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationCutoverPolicy.java
new file mode 100644
index 000000000000..f6fd7d5c7ff7
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationCutoverPolicy.java
@@ -0,0 +1,81 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+public class VmwareCbtMigrationCutoverPolicy {
+
+    public enum Decision {
+        CONTINUE,
+        READY_FOR_CUTOVER,
+        READY_FOR_CUTOVER_MAX_CYCLES
+    }
+
+    private final int minCycles;
+    private final int maxCycles;
+    private final int quietCyclesRequired;
+    private final long quietDirtyBytesThreshold;
+    private final long quietDirtyRateBytesPerSecondThreshold;
+
+    public VmwareCbtMigrationCutoverPolicy(int minCycles, int maxCycles, int quietCyclesRequired,
+                                           long quietDirtyBytesThreshold, long quietDirtyRateBytesPerSecondThreshold) {
+        if (minCycles < 1) {
+            throw new IllegalArgumentException("Minimum CBT migration cycles must be at least 1");
+        }
+        if (maxCycles < minCycles) {
+            throw new IllegalArgumentException("Maximum CBT migration cycles must be greater than or equal to minimum cycles");
+        }
+        if (quietCyclesRequired < 1) {
+            throw new IllegalArgumentException("Required quiet CBT migration cycles must be at least 1");
+        }
+        this.minCycles = minCycles;
+        this.maxCycles = maxCycles;
+        this.quietCyclesRequired = quietCyclesRequired;
+        this.quietDirtyBytesThreshold = quietDirtyBytesThreshold;
+        this.quietDirtyRateBytesPerSecondThreshold = quietDirtyRateBytesPerSecondThreshold;
+    }
+
+    public Decision decide(int completedCycles, int quietCycles, long lastChangedBytes, long lastCycleDurationSeconds) {
+        if (completedCycles >= maxCycles) {
+            return Decision.READY_FOR_CUTOVER_MAX_CYCLES;
+        }
+        if (completedCycles < minCycles) {
+            return Decision.CONTINUE;
+        }
+        if (lastChangedBytes == 0) {
+            return Decision.READY_FOR_CUTOVER;
+        }
+        int updatedQuietCycles = isQuietCycle(lastChangedBytes, lastCycleDurationSeconds) ? quietCycles + 1 : 0;
+        if (updatedQuietCycles >= quietCyclesRequired) {
+            return Decision.READY_FOR_CUTOVER;
+        }
+        return Decision.CONTINUE;
+    }
+
+    public boolean isQuietCycle(long changedBytes, long cycleDurationSeconds) {
+        boolean withinChangedBytes = quietDirtyBytesThreshold <= 0 || changedBytes <= quietDirtyBytesThreshold;
+        boolean withinDirtyRate = quietDirtyRateBytesPerSecondThreshold <= 0 ||
+                getDirtyRateBytesPerSecond(changedBytes, cycleDurationSeconds) <= quietDirtyRateBytesPerSecondThreshold;
+        return withinChangedBytes && withinDirtyRate;
+    }
+
+    protected long getDirtyRateBytesPerSecond(long changedBytes, long cycleDurationSeconds) {
+        if (cycleDurationSeconds <= 0) {
+            return changedBytes;
+        }
+        return changedBytes / cycleDurationSeconds;
+    }
+}
diff --git a/server/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationManagerImpl.java b/server/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationManagerImpl.java
new file mode 100644
index 000000000000..e148081e72ef
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/vm/VmwareCbtMigrationManagerImpl.java
@@ -0,0 +1,3008 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.LinkedHashMap;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.UUID;
+import java.util.concurrent.TimeUnit;
+import java.util.stream.Collectors;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.command.admin.vm.CancelVmwareCbtMigrationCmd;
+import org.apache.cloudstack.api.command.admin.vm.CheckVmwareCbtMigrationPrerequisitesCmd;
+import org.apache.cloudstack.api.command.admin.vm.CutoverVmwareCbtMigrationCmd;
+import org.apache.cloudstack.api.command.admin.vm.DeleteVmwareCbtMigrationCmd;
+import org.apache.cloudstack.api.command.admin.vm.ListVmwareCbtMigrationsCmd;
+import org.apache.cloudstack.api.command.admin.vm.StartVmwareCbtMigrationCmd;
+import org.apache.cloudstack.api.command.admin.vm.SyncVmwareCbtMigrationCmd;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.api.response.VmwareCbtMigrationPreflightDiskResponse;
+import org.apache.cloudstack.api.response.VmwareCbtMigrationPreflightFindingResponse;
+import org.apache.cloudstack.api.response.VmwareCbtMigrationPreflightResponse;
+import org.apache.cloudstack.api.response.VmwareCbtMigrationCycleResponse;
+import org.apache.cloudstack.api.response.VmwareCbtMigrationDiskResponse;
+import org.apache.cloudstack.api.response.VmwareCbtMigrationResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.config.Configurable;
+import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.apache.commons.collections4.MapUtils;
+import org.apache.commons.collections4.CollectionUtils;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.springframework.beans.factory.annotation.Autowired;
+
+import com.cloud.agent.AgentManager;
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.CheckConvertInstanceAnswer;
+import com.cloud.agent.api.CheckConvertInstanceCommand;
+import com.cloud.agent.api.Command;
+import com.cloud.agent.api.VmwareCbtCleanupCommand;
+import com.cloud.agent.api.VmwareCbtCutoverCommand;
+import com.cloud.agent.api.VmwareCbtMigrationAnswer;
+import com.cloud.agent.api.VmwareCbtPrepareCommand;
+import com.cloud.agent.api.VmwareCbtRbdProbeCommand;
+import com.cloud.agent.api.VmwareCbtSyncCommand;
+import com.cloud.agent.api.to.RemoteInstanceTO;
+import com.cloud.agent.api.to.VmwareCbtChangedBlockRangeTO;
+import com.cloud.agent.api.to.VmwareCbtDiskSyncResultTO;
+import com.cloud.agent.api.to.VmwareCbtDiskTO;
+import com.cloud.agent.api.to.VmwareCbtTargetStorageType;
+import com.cloud.dc.ClusterVO;
+import com.cloud.dc.DataCenterVO;
+import com.cloud.dc.VmwareDatacenterVO;
+import com.cloud.dc.dao.ClusterDao;
+import com.cloud.dc.dao.DataCenterDao;
+import com.cloud.dc.dao.VmwareDatacenterDao;
+import com.cloud.storage.DiskOfferingVO;
+import com.cloud.storage.dao.DiskOfferingDao;
+import com.cloud.exception.AgentUnavailableException;
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.exception.OperationTimedoutException;
+import com.cloud.host.Host;
+import com.cloud.host.HostVO;
+import com.cloud.host.Status;
+import com.cloud.host.dao.HostDao;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.resource.ResourceState;
+import com.cloud.network.Network;
+import com.cloud.service.ServiceOfferingVO;
+import com.cloud.service.dao.ServiceOfferingDao;
+import com.cloud.storage.Storage;
+import com.cloud.storage.dao.StoragePoolHostDao;
+import com.cloud.user.Account;
+import com.cloud.user.AccountService;
+import com.cloud.user.UserVO;
+import com.cloud.utils.Pair;
+import com.cloud.vm.VmDetailConstants;
+import com.cloud.user.dao.UserDao;
+import com.cloud.uservm.UserVm;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VmwareCbtMigrationCycleVO;
+import com.cloud.vm.VmwareCbtMigrationDiskVO;
+import com.cloud.vm.VmwareCbtMigrationVO;
+import com.cloud.vm.dao.UserVmDao;
+import com.cloud.vm.dao.VmwareCbtMigrationCycleDao;
+import com.cloud.vm.dao.VmwareCbtMigrationDao;
+import com.cloud.vm.dao.VmwareCbtMigrationDiskDao;
+import com.google.gson.Gson;
+import com.google.gson.reflect.TypeToken;
+
+public class VmwareCbtMigrationManagerImpl implements VmwareCbtMigrationManager, Configurable {
+
+    /** vCenter refuses snapshot removal while the source is still busy right after a cancel;
+     *  retry rather than orphaning the snapshot on the customer's VM. */
+    private static final int SNAPSHOT_REMOVAL_ATTEMPTS = 4;
+    private static final long SNAPSHOT_REMOVAL_RETRY_INTERVAL_MS = 15000L;
+
+    private static final String OBJECT_NAME = "vmwarecbtmigration";
+    private static final String DETAIL_VDDK_TRANSPORTS = "vddk.transports";
+    private static final String DETAIL_VDDK_THUMBPRINT = "vddk.thumbprint";
+    private static final String REDACTED_SECRET = "******";
+    private static final String DEFAULT_CBT_DISK_BASE_PATH = "/var/lib/libvirt/images/cloudstack-cbt";
+    private static final String KVM_STORAGE_POOL_MOUNT_BASE_PATH = "/mnt";
+    static final String CBT_FINALIZED_DISK_CONTROLLER = "virtio";
+    private static final String RBD_PROBE_IMAGE_PREFIX = "cloudstack-cbt-probe-";
+    private static final List<Storage.StoragePoolType> CBT_COMPATIBLE_STORAGE_POOL_TYPES = Arrays.asList(
+            Storage.StoragePoolType.NetworkFilesystem,
+            Storage.StoragePoolType.Filesystem,
+            Storage.StoragePoolType.SharedMountPoint,
+            Storage.StoragePoolType.RBD,
+            Storage.StoragePoolType.Linstor);
+    private static final int CLEANUP_WAIT_SECONDS = 300;
+    private static final int DELETE_CLEANUP_WAIT_SECONDS = 30;
+    private static final Logger LOGGER = LogManager.getLogger(VmwareCbtMigrationManagerImpl.class);
+    private static final Gson GSON = new Gson();
+
+    static final ConfigKey<Integer> VmwareCbtMigrationMinCycles = new ConfigKey<>(Integer.class,
+            "vmware.cbt.migration.min.cycles",
+            "Advanced",
+            "1",
+            "Minimum number of CBT delta synchronization cycles to run before CloudStack can recommend final VMware to KVM cutover",
+            true,
+            ConfigKey.Scope.Global,
+            null);
+
+    static final ConfigKey<Integer> VmwareCbtMigrationMaxCycles = new ConfigKey<>(Integer.class,
+            "vmware.cbt.migration.max.cycles",
+            "Advanced",
+            "5",
+            "Maximum number of CBT delta synchronization cycles to run before CloudStack recommends final VMware to KVM cutover",
+            true,
+            ConfigKey.Scope.Global,
+            null);
+
+    static final ConfigKey<Integer> VmwareCbtMigrationQuietCycles = new ConfigKey<>(Integer.class,
+            "vmware.cbt.migration.quiet.cycles",
+            "Advanced",
+            "2",
+            "Number of consecutive quiet CBT delta synchronization cycles required before CloudStack recommends final VMware to KVM cutover",
+            true,
+            ConfigKey.Scope.Global,
+            null);
+
+    static final ConfigKey<Long> VmwareCbtMigrationQuietBytes = new ConfigKey<>(Long.class,
+            "vmware.cbt.migration.quiet.bytes",
+            "Advanced",
+            "1073741824",
+            "Maximum changed bytes in a CBT delta synchronization cycle for the cycle to be considered quiet",
+            true,
+            ConfigKey.Scope.Global,
+            null);
+
+    static final ConfigKey<Long> VmwareCbtMigrationQuietDirtyRate = new ConfigKey<>(Long.class,
+            "vmware.cbt.migration.quiet.dirty.rate",
+            "Advanced",
+            "16777216",
+            "Maximum changed bytes per second in a CBT delta synchronization cycle for the cycle to be considered quiet",
+            true,
+            ConfigKey.Scope.Global,
+            null);
+
+    static final ConfigKey<Boolean> VmwareCbtAllowNonInPlaceFinalization = new ConfigKey<>(Boolean.class,
+            "vmware.cbt.allow.non.inplace.finalization",
+            "Advanced",
+            "false",
+            "If true, VMware CBT cutover may fall back to regular virt-v2v finalization for qcow2 file targets when true in-place finalization is unavailable. The fallback stages temporary data on the selected primary storage and requires additional free space.",
+            true,
+            ConfigKey.Scope.Global,
+            null);
+
+    static final ConfigKey<Integer> VmwareCbtMigrationAgentCommandTimeout = new ConfigKey<>(Integer.class,
+            "vmware.cbt.migration.agent.command.timeout",
+            "Advanced",
+            "86400",
+            "Timeout in seconds for long-running VMware CBT data-plane commands dispatched to the KVM agent, including initial full sync, delta sync, final delta sync, and cutover finalization.",
+            true,
+            ConfigKey.Scope.Global,
+            null);
+
+    @Inject
+    private VmwareCbtMigrationDao vmwareCbtMigrationDao;
+    @Inject
+    private DataCenterDao dataCenterDao;
+    @Inject
+    private ClusterDao clusterDao;
+    @Inject
+    private HostDao hostDao;
+    @Inject
+    private PrimaryDataStoreDao primaryDataStoreDao;
+    @Inject
+    private VmwareDatacenterDao vmwareDatacenterDao;
+    @Inject
+    private AccountService accountService;
+    @Inject
+    private UserDao userDao;
+    @Inject
+    private ServiceOfferingDao serviceOfferingDao;
+    @Inject
+    private DiskOfferingDao diskOfferingDao;
+    @Inject
+    private UserVmDao userVmDao;
+    @Inject
+    private VmwareCbtMigrationDiskDao vmwareCbtMigrationDiskDao;
+    @Inject
+    private VmwareCbtMigrationCycleDao vmwareCbtMigrationCycleDao;
+    @Inject
+    private StoragePoolHostDao storagePoolHostDao;
+    @Inject
+    private AgentManager agentManager;
+    @Inject
+    private UnmanagedVMsManager unmanagedVMsManager;
+    @Autowired(required = false)
+    private VmwareCbtMigrationService vmwareCbtMigrationService;
+
+    @Override
+    public List<Class<?>> getCommands() {
+        final List<Class<?>> cmdList = new ArrayList<>();
+        cmdList.add(CheckVmwareCbtMigrationPrerequisitesCmd.class);
+        cmdList.add(StartVmwareCbtMigrationCmd.class);
+        cmdList.add(ListVmwareCbtMigrationsCmd.class);
+        cmdList.add(SyncVmwareCbtMigrationCmd.class);
+        cmdList.add(CutoverVmwareCbtMigrationCmd.class);
+        cmdList.add(CancelVmwareCbtMigrationCmd.class);
+        cmdList.add(DeleteVmwareCbtMigrationCmd.class);
+        return cmdList;
+    }
+
+    @Override
+    public VmwareCbtMigrationPreflightResponse checkVmwareCbtMigrationPrerequisites(CheckVmwareCbtMigrationPrerequisitesCmd cmd) {
+        PreflightFindingCollector findings = new PreflightFindingCollector();
+        VmwareCbtMigrationPreflightResponse response = new VmwareCbtMigrationPreflightResponse();
+        response.setObjectName("vmwarecbtmigrationpreflight");
+
+        DataCenterVO zone = getPreflightZone(cmd.getZoneId(), findings);
+        if (zone != null) {
+            response.setZoneId(zone.getUuid());
+            response.setZoneName(zone.getName());
+        }
+
+        ClusterVO destinationCluster = getPreflightDestinationCluster(cmd.getClusterId(), zone, findings);
+        if (destinationCluster != null) {
+            response.setClusterId(destinationCluster.getUuid());
+            response.setClusterName(destinationCluster.getName());
+        }
+
+        StoragePoolVO storagePool = getPreflightStoragePool(cmd.getStoragePoolId(), zone, destinationCluster, findings);
+        VmwareCbtStorageTarget storageTarget = null;
+        if (storagePool != null) {
+            storageTarget = VmwareCbtStorageTarget.forPool(storagePool);
+            populateStorageTargetResponse(response, storageTarget);
+            addStorageTargetFinding(storageTarget, findings);
+        }
+
+        HostVO cbtHost = getPreflightCbtHost(cmd.getConvertInstanceHostId(), destinationCluster, storageTarget, findings);
+        if (cbtHost != null) {
+            response.setConvertInstanceHostId(cbtHost.getUuid());
+            response.setConvertInstanceHostName(cbtHost.getName());
+            response.setConvertInstanceHostInPlaceFinalizationSupported(hostSupportsInPlaceFinalization(cbtHost));
+        }
+        addStorageTargetFinalizationFinding(storageTarget, cbtHost, findings);
+        addRbdStorageAccessFinding(storageTarget, cbtHost, findings);
+
+        String sourceVmName = StringUtils.trimToNull(cmd.getSourceVmName());
+        if (sourceVmName == null) {
+            findings.fail("sourceVm.name.present", "vmware", null, "Source VM name is required.");
+        } else {
+            response.setSourceVmName(sourceVmName);
+        }
+
+        VmwareSource source = getPreflightVmwareSource(cmd, findings);
+        if (source != null) {
+            response.setVcenter(source.vcenter);
+            response.setDatacenterName(source.datacenterName);
+            response.setSourceHost(source.sourceHost);
+        }
+
+        if (source != null && sourceVmName != null) {
+            populateSourceVmPreflight(response, source, sourceVmName, cbtHost, cmd.getServiceOfferingId(),
+                    cmd.getDetails(), zone, findings);
+        }
+
+        response.setFindings(findings.getFindings());
+        response.setReady(!findings.hasFailures());
+        return response;
+    }
+
+    private VmwareCbtPreflightInfo validateSourceVmPreflightForStart(VmwareSource source, String sourceVmName) {
+        VmwareCbtPreflightInfo preflightInfo;
+        try {
+            preflightInfo = getVmwareCbtMigrationService().getPreflightInfo(source.vcenter, source.datacenterName,
+                    source.username, source.password, source.sourceHost, sourceVmName);
+        } catch (RuntimeException e) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("Unable to validate VMware CBT prerequisites for source VM %s: %s",
+                            sourceVmName, sanitizeSensitiveMessage(StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()), source)));
+        }
+
+        if (Boolean.FALSE.equals(preflightInfo.getChangeTrackingSupported())) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("Source VM %s does not report VMware CBT support", sourceVmName));
+        }
+        if (Boolean.TRUE.equals(preflightInfo.getConsolidationNeeded())) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("Source VM %s reports pending disk consolidation; consolidate VMware disks before starting CBT migration",
+                            sourceVmName));
+        }
+        if (CollectionUtils.isEmpty(preflightInfo.getDisks())) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("No source VMware disks were discovered for VM %s", sourceVmName));
+        }
+        for (VmwareCbtPreflightDiskInfo disk : preflightInfo.getDisks()) {
+            validateSourceDiskPreflightForStart(disk);
+        }
+        return preflightInfo;
+    }
+
+    private void ensureSourceVmChangeTrackingEnabledForStart(VmwareSource source, String sourceVmName,
+                                                             VmwareCbtPreflightInfo preflightInfo) {
+        if (Boolean.TRUE.equals(preflightInfo.getChangeTrackingEnabled())) {
+            return;
+        }
+        try {
+            getVmwareCbtMigrationService().ensureChangeTrackingEnabled(source.vcenter, source.datacenterName,
+                    source.username, source.password, source.sourceHost, sourceVmName);
+        } catch (RuntimeException e) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("Unable to enable VMware CBT on source VM %s before initial full sync: %s",
+                            sourceVmName, sanitizeSensitiveMessage(StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()), source)));
+        }
+    }
+
+    private void validateSourceDiskPreflightForStart(VmwareCbtPreflightDiskInfo disk) {
+        String diskId = StringUtils.defaultIfBlank(disk.getSourceDiskId(), disk.getSourceDiskPath());
+        if (disk.getSourceDiskDeviceKey() == null) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("Source disk %s does not expose a VMware device key required for CBT delta queries",
+                            diskId));
+        }
+        if (StringUtils.isBlank(disk.getSourceDiskPath())) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("Source disk %s does not expose a VMware backing path", diskId));
+        }
+        if (disk.isIndependentDisk()) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("Source disk %s uses independent disk mode %s, which is not supported for VMware CBT migration",
+                            diskId, disk.getDiskMode()));
+        }
+        if (disk.isPhysicalRdm()) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("Source disk %s is a physical-mode RDM, which is not supported for VMware CBT migration",
+                            diskId));
+        }
+    }
+
+    private ServiceOfferingVO getServiceOfferingForVmwareCbtMigration(Long serviceOfferingId, Account owner, DataCenterVO zone) {
+        if (serviceOfferingId == null) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "Service offering ID cannot be null");
+        }
+        ServiceOfferingVO serviceOffering = serviceOfferingDao.findById(serviceOfferingId);
+        if (serviceOffering == null) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("Service offering ID: %d cannot be found", serviceOfferingId));
+        }
+        accountService.checkAccess(owner, serviceOffering, zone);
+        serviceOfferingDao.loadDetails(serviceOffering);
+        return serviceOffering;
+    }
+
+    static VmwareCbtOfferingResources resolveRequestedOfferingResources(ServiceOfferingVO serviceOffering, Map<String, String> details) {
+        if (serviceOffering == null) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "Service offering cannot be null");
+        }
+        Map<String, String> callerDetails = details == null ? new HashMap<>() : details;
+        Map<String, String> offeringDetails = serviceOffering.getDetails();
+        Integer cpu = firstInteger(VmDetailConstants.CPU_NUMBER, callerDetails,
+                serviceOffering.getCpu(), ApiConstants.MIN_CPU_NUMBER, offeringDetails);
+        Integer cpuSpeed = firstInteger(VmDetailConstants.CPU_SPEED, callerDetails,
+                serviceOffering.getSpeed(), null, offeringDetails);
+        Integer memory = firstInteger(VmDetailConstants.MEMORY, callerDetails,
+                serviceOffering.getRamSize(), ApiConstants.MIN_MEMORY, offeringDetails);
+        return new VmwareCbtOfferingResources(cpu, cpuSpeed, memory);
+    }
+
+    private static Integer firstInteger(String callerDetailKey, Map<String, String> callerDetails,
+                                        Integer offeringValue, String offeringDetailKey,
+                                        Map<String, String> offeringDetails) {
+        if (offeringValue != null) {
+            return offeringValue;
+        }
+        Integer callerValue = parseIntegerDetail(callerDetails, callerDetailKey);
+        if (callerValue != null) {
+            return callerValue;
+        }
+        return StringUtils.isBlank(offeringDetailKey) ? null : parseIntegerDetail(offeringDetails, offeringDetailKey);
+    }
+
+    private static Integer parseIntegerDetail(Map<String, String> details, String key) {
+        if (MapUtils.isEmpty(details) || StringUtils.isBlank(key) || StringUtils.isBlank(details.get(key))) {
+            return null;
+        }
+        try {
+            return Integer.valueOf(details.get(key));
+        } catch (NumberFormatException e) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("Please provide a valid integer value for detail '%s'.", key));
+        }
+    }
+
+    static void validateSelectedServiceOfferingResourcesForSourceVm(VmwareCbtPreflightInfo preflightInfo,
+                                                                    ServiceOfferingVO serviceOffering,
+                                                                    Map<String, String> details) {
+        VmwareCbtOfferingResources requestedResources = resolveRequestedOfferingResources(serviceOffering, details);
+        validateRequestedResourceAtLeastSource(preflightInfo.getCpuCores(), requestedResources.cpuNumber, "CPU number");
+        validateRequestedResourceAtLeastSource(preflightInfo.getCpuSpeed(), requestedResources.cpuSpeed, "CPU speed");
+        validateRequestedResourceAtLeastSource(preflightInfo.getMemoryMb(), requestedResources.memoryMb, "Memory");
+    }
+
+    private static void validateRequestedResourceAtLeastSource(Integer sourceResource, Integer requestedResource, String resourceName) {
+        if (sourceResource == null || requestedResource == null || sourceResource <= 0 || requestedResource <= 0) {
+            return;
+        }
+        if (requestedResource < sourceResource) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("The requested %s (%d) is less than the source VM %s (%d)",
+                            resourceName, requestedResource, resourceName, sourceResource));
+        }
+    }
+
+    @Override
+    public VmwareCbtMigrationResponse startVmwareCbtMigration(StartVmwareCbtMigrationCmd cmd) {
+        Account caller = CallContext.current().getCallingAccount();
+        if (caller == null) {
+            throw new ServerApiException(ApiErrorCode.ACCOUNT_ERROR, "Unable to determine calling account");
+        }
+        Account owner = accountService.getActiveAccountById(cmd.getEntityOwnerId());
+        if (owner == null) {
+            throw new ServerApiException(ApiErrorCode.ACCOUNT_ERROR, "Unable to determine target account");
+        }
+
+        DataCenterVO zone = getZone(cmd.getZoneId());
+        ClusterVO destinationCluster = getDestinationCluster(cmd.getClusterId(), zone.getId());
+        StoragePoolVO storagePool = getStoragePool(cmd.getStoragePoolId(), zone, destinationCluster);
+        VmwareCbtStorageTarget storageTarget = VmwareCbtStorageTarget.forPool(storagePool);
+        if (!storageTarget.isSupported()) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, storageTarget.getSupportMessage());
+        }
+        HostVO convertHost = selectCbtHost(cmd.getConvertInstanceHostId(), destinationCluster, storageTarget);
+        validateStorageTargetFinalizationSupport(storageTarget, convertHost);
+        validateRbdStorageAccessForStart(storageTarget, convertHost);
+
+        String sourceVmName = StringUtils.trimToNull(cmd.getSourceVmName());
+        if (sourceVmName == null) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "Source VM name is required");
+        }
+
+        VmwareSource source = resolveVmwareSource(cmd);
+        VmwareCbtPreflightInfo preflightInfo = validateSourceVmPreflightForStart(source, sourceVmName);
+        ServiceOfferingVO serviceOffering = getServiceOfferingForVmwareCbtMigration(cmd.getServiceOfferingId(), owner, zone);
+        validateSelectedServiceOfferingResourcesForSourceVm(preflightInfo, serviceOffering, cmd.getDetails());
+        validateWindowsGuestConversionSupportForStart(convertHost, sourceVmName, preflightInfo, cmd.getDetails());
+        ensureSourceVmChangeTrackingEnabledForStart(source, sourceVmName, preflightInfo);
+        List<VmwareCbtDiskInfo> sourceDisks = discoverSourceDisks(source, sourceVmName);
+        validateDataDiskOfferingMappingsForStart(sourceVmName, sourceDisks, cmd.getDataDiskToDiskOfferingList(), owner, zone);
+        validateNicMappingsForStart(sourceVmName, preflightInfo.getNics(), cmd.getNicNetworkList(), cmd.getNicIpAddressList());
+        String displayName = StringUtils.defaultIfBlank(cmd.getDisplayName(), sourceVmName);
+
+        VmwareCbtMigrationVO migration = new VmwareCbtMigrationVO(zone.getId(), owner.getId(), getUserIdForOwner(owner),
+                destinationCluster.getId(), displayName, source.vcenter, source.datacenterName, cmd.getSourceHost(), cmd.getSourceCluster(), sourceVmName);
+        migration.setExistingVcenterId(source.existingVcenterId);
+        storeExternalVmwareSourceCredentials(migration, source);
+        if (convertHost != null) {
+            migration.setConvertHostId(convertHost.getId());
+        }
+        if (storagePool != null) {
+            migration.setStoragePoolId(storagePool.getId());
+        }
+        migration.setHostName(StringUtils.trimToNull(cmd.getHostName()));
+        migration.setTemplateId(cmd.getTemplateId());
+        migration.setServiceOfferingId(cmd.getServiceOfferingId());
+        // Derive the guest OS and hardware details from the source VM's configuration when the
+        // caller did not choose them: without this the cutover import inherits the dummy import
+        // template's generic OS type and the KVM defaults (BIOS firmware, cirrus video), which
+        // leaves a UEFI source unbootable and gives Windows guests Linux clock semantics.
+        migration.setGuestOsId(cmd.getGuestOsId() != null ? cmd.getGuestOsId()
+                : unmanagedVMsManager.resolveGuestOsIdForVmwareImport(preflightInfo.getOperatingSystem(), preflightInfo.getOperatingSystemId()));
+        migration.setDataDiskOfferingMap(serializeMap(cmd.getDataDiskToDiskOfferingList()));
+        migration.setNicNetworkMap(serializeMap(cmd.getNicNetworkList()));
+        // Preserve static source IPs captured during preflight: NICs mapped to a network but
+        // given no explicit IP keep their guest-configured address when it fits the target
+        // network. The source is running at this point, so Tools data is available.
+        Map<String, List<String>> sourceNicCidrs = new HashMap<>();
+        for (VmwareCbtPreflightNicInfo nic : preflightInfo.getNics()) {
+            if (StringUtils.isNotBlank(nic.getSourceNicId()) && CollectionUtils.isNotEmpty(nic.getIpv4Cidrs())) {
+                sourceNicCidrs.put(nic.getSourceNicId(), nic.getIpv4Cidrs());
+            }
+        }
+        migration.setNicIpAddressMap(serializeNicIpAddressMap(unmanagedVMsManager.autoFillStaticNicIpAddresses(
+                cmd.getNicNetworkList(), cmd.getNicIpAddressList(), sourceNicCidrs)));
+        migration.setImportDetails(serializeMap(unmanagedVMsManager.applyVmwareImportHardwareDetails(cmd.getDetails(),
+                preflightInfo.getBootType(), preflightInfo.getBootMode(), preflightInfo.getOperatingSystem())));
+        migration.setForced(cmd.isForced());
+        applyVddkDetails(migration, cmd.getDetails());
+        migration.setState(VmwareCbtMigration.State.InitialSync);
+        migration.setCurrentStep(String.format("Discovered %s source disk(s); preparing initial VDDK full sync", sourceDisks.size()));
+        migration.setUpdated(new Date());
+        migration = vmwareCbtMigrationDao.persist(migration);
+        persistSourceDisks(migration, sourceDisks);
+        return runInitialFullSync(source, migration, storageTarget);
+    }
+
+    @Override
+    public ListResponse<VmwareCbtMigrationResponse> listVmwareCbtMigrations(ListVmwareCbtMigrationsCmd cmd) {
+        VmwareCbtMigration.State state = parseState(cmd.getState());
+        Pair<List<VmwareCbtMigrationVO>, Integer> result = vmwareCbtMigrationDao.listMigrations(cmd.getId(), cmd.getZoneId(), cmd.getAccountId(),
+                cmd.getVcenter(), cmd.getSourceVmName(), state, cmd.getStartIndex(), cmd.getPageSizeVal());
+
+        List<VmwareCbtMigrationResponse> responses = new ArrayList<>();
+        for (VmwareCbtMigrationVO migration : result.first()) {
+            responses.add(createVmwareCbtMigrationResponse(migration));
+        }
+        ListResponse<VmwareCbtMigrationResponse> listResponse = new ListResponse<>();
+        listResponse.setResponses(responses, result.second());
+        return listResponse;
+    }
+
+    @Override
+    public VmwareCbtMigrationResponse syncVmwareCbtMigration(SyncVmwareCbtMigrationCmd cmd) {
+        VmwareCbtMigrationVO migration = getMigration(cmd.getId());
+        rejectTerminalMigration(migration, "synchronize");
+        requireMigrationState(migration, "synchronize", VmwareCbtMigration.State.Replicating,
+                VmwareCbtMigration.State.ReadyForCutover);
+        VmwareSource source = resolveVmwareSource(migration, cmd.getUsername(), cmd.getPassword());
+        validateInitialSyncTargetDisks(migration);
+        HostVO cbtHost = getCbtHostForMigration(migration);
+        int cycleNumber = migration.getCompletedCycles() + 1;
+        VmwareCbtMigrationCycleVO cycle = new VmwareCbtMigrationCycleVO(migration.getId(), cycleNumber);
+        cycle.setState(VmwareCbtMigrationCycle.State.CopyingChangedBlocks);
+        cycle.setDescription("Dispatching CBT delta synchronization to KVM agent");
+        cycle.setUpdated(new Date());
+        cycle = vmwareCbtMigrationCycleDao.persist(cycle);
+
+        migration.setState(VmwareCbtMigration.State.Replicating);
+        migration.setCurrentStep(String.format("Running CBT delta synchronization cycle %s", cycleNumber));
+        migration.setLastError(null);
+        migration.setUpdated(new Date());
+        migration = persistMigrationProgress(migration, String.format("start of CBT delta cycle %s", cycleNumber));
+
+        VmwareCbtSnapshotInfo snapshot = null;
+        try {
+            snapshot = createDeltaSnapshot(source, migration, cycleNumber);
+            cycle.setState(VmwareCbtMigrationCycle.State.QueryingChangedAreas);
+            cycle.setSnapshotMor(snapshot.getSnapshotMor());
+            cycle.setDescription("Querying VMware CBT changed disk areas");
+            cycle.setUpdated(new Date());
+            vmwareCbtMigrationCycleDao.update(cycle.getId(), cycle);
+
+            VmwareCbtChangedBlockQueryResult changedBlockQuery = queryChangedBlocks(source, migration,
+                    snapshot.getSnapshotMor());
+
+            cycle.setState(VmwareCbtMigrationCycle.State.CopyingChangedBlocks);
+            cycle.setDescription(String.format("Dispatching %s VMware CBT changed block range(s) to KVM agent",
+                    changedBlockQuery.changedBlocks.size()));
+            cycle.setUpdated(new Date());
+            vmwareCbtMigrationCycleDao.update(cycle.getId(), cycle);
+
+            VmwareCbtSyncCommand syncCommand = new VmwareCbtSyncCommand(migration.getUuid(),
+                    createRemoteInstance(source, migration, snapshot.getSourceVmMor()), getDiskTransferObjects(migration),
+                    changedBlockQuery.changedBlocks, cycleNumber, snapshot.getSnapshotMor(), false);
+            applyVddkDetails(syncCommand, migration);
+            applyTargetStorageDetails(syncCommand, migration);
+            syncCommand.setWait(getVmwareCbtMigrationAgentCommandTimeout());
+
+            VmwareCbtMigrationAnswer answer = sendVmwareCbtCommand(cbtHost, syncCommand, "synchronize",
+                    migration.getUuid());
+            if (!answer.getResult()) {
+                String details = sanitizeSensitiveMessage(answer.getDetails(), source);
+                markCycleFailed(cycle, details);
+                markMigrationFailed(migration, "CBT delta synchronization failed", details);
+                return createVmwareCbtMigrationResponse(vmwareCbtMigrationDao.findById(migration.getId()));
+            }
+
+            applyDiskResults(migration, answer.getDiskResults());
+            updateDiskChangeIds(migration, changedBlockQuery.changedDisks);
+            long changedBytes = answer.getChangedBytes();
+            long durationSeconds = answer.getDurationSeconds();
+            long dirtyRate = getDirtyRateBytesPerSecond(changedBytes, durationSeconds, answer.getDirtyRateBytesPerSecond());
+            VmwareCbtMigrationCutoverPolicy cutoverPolicy = getCutoverPolicy();
+            VmwareCbtMigrationCutoverPolicy.Decision cutoverDecision = cutoverPolicy.decide(cycleNumber,
+                    migration.getQuietCycles(), changedBytes, durationSeconds);
+            int quietCycles = cutoverPolicy.isQuietCycle(changedBytes, durationSeconds) ?
+                    migration.getQuietCycles() + 1 : 0;
+
+            cycle.setState(VmwareCbtMigrationCycle.State.Completed);
+            cycle.setChangedBytes(changedBytes);
+            cycle.setDirtyRate(dirtyRate);
+            cycle.setDuration(durationSeconds * 1000);
+            cycle.setDescription(sanitizeSensitiveMessage(answer.getDetails(), source));
+            cycle.setUpdated(new Date());
+            vmwareCbtMigrationCycleDao.update(cycle.getId(), cycle);
+
+            migration.setCompletedCycles(cycleNumber);
+            migration.setQuietCycles(quietCycles);
+            migration.setTotalChangedBytes(migration.getTotalChangedBytes() + changedBytes);
+            migration.setLastChangedBytes(changedBytes);
+            migration.setLastDirtyRate(dirtyRate);
+            migration.setState(cutoverDecision == VmwareCbtMigrationCutoverPolicy.Decision.CONTINUE ?
+                    VmwareCbtMigration.State.Replicating : VmwareCbtMigration.State.ReadyForCutover);
+            migration.setCurrentStep(getCutoverDecisionStep(cutoverDecision));
+            migration.setUpdated(new Date());
+            migration = persistMigrationProgress(migration, "CBT delta synchronization progress");
+            return createVmwareCbtMigrationResponse(migration);
+        } catch (RuntimeException e) {
+            String error = sanitizeSensitiveMessage(StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()), source);
+            markCycleFailed(cycle, error);
+            markMigrationFailed(migration, "CBT delta synchronization failed", error);
+            return createVmwareCbtMigrationResponse(vmwareCbtMigrationDao.findById(migration.getId()));
+        } finally {
+            removeDeltaSnapshotIfPossible(source, migration, snapshot);
+        }
+    }
+
+    @Override
+    public VmwareCbtMigrationResponse cutoverVmwareCbtMigration(CutoverVmwareCbtMigrationCmd cmd) {
+        VmwareCbtMigrationVO migration = getMigration(cmd.getId());
+        rejectTerminalMigration(migration, "cut over");
+        requireMigrationState(migration, "cut over", VmwareCbtMigration.State.ReadyForCutover,
+                VmwareCbtMigration.State.ReadyForImport);
+        VmwareSource source = resolveVmwareSource(migration, cmd.getUsername(), cmd.getPassword());
+        validateInitialSyncTargetDisks(migration);
+        if (migration.getState() == VmwareCbtMigration.State.ReadyForImport) {
+            return importCutoverMigration(source, migration);
+        }
+        HostVO cbtHost = getCbtHostForMigration(migration);
+        VmwareCbtStorageTarget storageTarget = getStorageTargetForMigration(migration);
+        validateStorageTargetFinalizationSupport(storageTarget, cbtHost);
+        requireSourceVmPoweredOff(source, migration);
+
+        migration.setState(VmwareCbtMigration.State.CuttingOver);
+        migration.setCurrentStep("Running final CBT delta synchronization before cutover");
+        migration.setLastError(null);
+        migration.setUpdated(new Date());
+        if (!vmwareCbtMigrationDao.updateIfNotTerminal(migration)) {
+            // Cancelled between the state check above and here: refuse rather than cut over a
+            // migration whose target disks the cancellation has already removed.
+            VmwareCbtMigrationVO current = vmwareCbtMigrationDao.findById(migration.getId());
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("Cannot cut over VMware CBT migration %s: it reached state %s while the cutover was starting.",
+                            migration.getUuid(), current == null ? "unknown" : current.getState()));
+        }
+
+        int finalCycleNumber = migration.getCompletedCycles() + 1;
+        if (!runFinalDeltaSync(source, migration, cbtHost, finalCycleNumber)) {
+            return createVmwareCbtMigrationResponse(vmwareCbtMigrationDao.findById(migration.getId()));
+        }
+
+        migration = vmwareCbtMigrationDao.findById(migration.getId());
+        boolean inPlaceFinalization = hostSupportsInPlaceFinalization(cbtHost);
+        String finalizationDescription = inPlaceFinalization ? "in-place conversion" : "virt-v2v fallback conversion";
+        migration.setCurrentStep(String.format("Final CBT delta synchronization completed; running %s",
+                finalizationDescription));
+        migration.setUpdated(new Date());
+        migration = persistMigrationProgress(migration, "final delta synchronization progress");
+
+        VmwareCbtCutoverCommand cutoverCommand = new VmwareCbtCutoverCommand(migration.getUuid(), createRemoteInstance(source, migration),
+                getDiskTransferObjects(migration), finalCycleNumber, true);
+        applyVddkDetails(cutoverCommand, migration);
+        applyTargetStorageDetails(cutoverCommand, migration);
+        cutoverCommand.setAllowNonInPlaceFinalization(isNonInPlaceFinalizationFallbackAllowed(storageTarget));
+        cutoverCommand.setWait(getVmwareCbtMigrationAgentCommandTimeout());
+
+        VmwareCbtMigrationAnswer answer = sendFinalCutoverCommand(cbtHost, cutoverCommand, migration, source);
+        if (!answer.getResult()) {
+            markMigrationFailed(migration, "CBT cutover failed", sanitizeSensitiveMessage(answer.getDetails(), source));
+            return createVmwareCbtMigrationResponse(vmwareCbtMigrationDao.findById(migration.getId()));
+        }
+
+        applyDiskResults(migration, answer.getDiskResults());
+        migration = vmwareCbtMigrationDao.findById(migration.getId());
+        migration.setState(VmwareCbtMigration.State.ReadyForImport);
+        migration.setCurrentStep(String.format("Final %s completed; importing VM into CloudStack",
+                finalizationDescription));
+        migration.setUpdated(new Date());
+        if (!vmwareCbtMigrationDao.updateIfNotTerminal(migration)) {
+            // Cancelled while the final conversion ran: do not import disks the cancellation
+            // has already scheduled for removal.
+            LOGGER.info("Not importing VMware CBT migration {}: it reached a terminal state while the final conversion was running.",
+                    migration.getUuid());
+            return createVmwareCbtMigrationResponse(vmwareCbtMigrationDao.findById(migration.getId()));
+        }
+        return importCutoverMigration(source, migration);
+    }
+
+    private VmwareCbtMigrationResponse importCutoverMigration(VmwareSource source, VmwareCbtMigrationVO migration) {
+        VmwareCbtMigrationVO stored = vmwareCbtMigrationDao.findById(migration.getId());
+        if (stored != null && stored.getState() != null && stored.getState().isTerminal()) {
+            // Importing is expensive and creates a real VM, so re-check right before starting it:
+            // a cancel may have landed while the preceding conversion was running.
+            LOGGER.info("Not importing VMware CBT migration {}: it is already in terminal state {}.",
+                    migration.getUuid(), stored.getState());
+            return createVmwareCbtMigrationResponse(stored);
+        }
+        if (migration.getServiceOfferingId() == null) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    "Cannot import VMware CBT migration because serviceofferingid was not recorded when the migration was started");
+        }
+        Account caller = CallContext.current().getCallingAccount();
+        Account owner = accountService.getActiveAccountById(migration.getAccountId());
+        if (caller == null || owner == null) {
+            throw new ServerApiException(ApiErrorCode.ACCOUNT_ERROR, "Unable to resolve caller or target account for VMware CBT import");
+        }
+        try {
+            UserVm userVm = unmanagedVMsManager.importConvertedVmwareCbtInstanceToKvm(source.vcenter, source.datacenterName,
+                    source.username, source.password, migration.getSourceCluster(), migration.getSourceHost(),
+                    migration.getSourceVmName(), createConvertedInstanceForImport(migration), getZone(migration.getZoneId()),
+                    getDestinationCluster(migration.getDestinationClusterId(), migration.getZoneId()), migration.getDisplayName(),
+                    migration.getHostName(), caller, owner, migration.getUserId(), migration.getTemplateId(),
+                    migration.getServiceOfferingId(), deserializeLongMap(migration.getDataDiskOfferingMap()),
+                    deserializeLongMap(migration.getNicNetworkMap()), deserializeNicIpAddressMap(migration.getNicIpAddressMap()),
+                    migration.getGuestOsId(), deserializeStringMap(migration.getImportDetails()), migration.isForced(),
+                    migration.getStoragePoolId());
+
+            if (!persistImportedVmResult(migration, userVm)) {
+                // The VM does exist, so surface it rather than losing the reference: the operator
+                // cancelled during the import and now has to reconcile the imported VM by hand.
+                LOGGER.warn("VMware CBT migration {} was cancelled while its import was running, but the import completed and created VM {}. "
+                                + "The migration record keeps its cancelled state; the imported VM must be reviewed manually.",
+                        migration.getUuid(), userVm.getUuid());
+            }
+        } catch (RuntimeException e) {
+            String error = sanitizeSensitiveMessage(StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()), source);
+            migration = vmwareCbtMigrationDao.findById(migration.getId());
+            migration.setState(VmwareCbtMigration.State.ReadyForImport);
+            migration.setCurrentStep("CloudStack VM import failed; retry cutover to import the converted disks");
+            migration.setLastError(error);
+            migration.setUpdated(new Date());
+            migration = persistMigrationProgress(migration, "failed CloudStack VM import");
+        }
+        return createVmwareCbtMigrationResponse(vmwareCbtMigrationDao.findById(migration.getId()));
+    }
+
+    boolean persistImportedVmResult(VmwareCbtMigrationVO migration, UserVm userVm) {
+        Date updated = new Date();
+        if (vmwareCbtMigrationDao.completeImportIfNotTerminal(migration.getId(), userVm.getId(), updated)) {
+            return true;
+        }
+        vmwareCbtMigrationDao.recordImportedVmAndClearCredentials(migration.getId(), userVm.getId(), updated);
+        return false;
+    }
+
+    private UnmanagedInstanceTO createConvertedInstanceForImport(VmwareCbtMigrationVO migration) {
+        List<VmwareCbtMigrationDiskVO> migrationDisks = vmwareCbtMigrationDiskDao.listByMigrationId(migration.getId());
+        if (CollectionUtils.isEmpty(migrationDisks)) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR,
+                    String.format("No synchronized disks were found for VMware CBT migration %s", migration.getUuid()));
+        }
+        UnmanagedInstanceTO convertedInstance = new UnmanagedInstanceTO();
+        convertedInstance.setName(migration.getSourceVmName());
+        convertedInstance.setHypervisorType(Hypervisor.HypervisorType.KVM.name());
+        convertedInstance.setPowerState(UnmanagedInstanceTO.PowerState.PowerOff);
+
+        StoragePoolVO storagePool = primaryDataStoreDao.findById(migration.getStoragePoolId());
+        Storage.StoragePoolType storagePoolType = storagePool == null ? null : storagePool.getPoolType();
+        List<UnmanagedInstanceTO.Disk> disks = new ArrayList<>();
+        int position = 0;
+        for (VmwareCbtMigrationDiskVO migrationDisk : migrationDisks) {
+            if (StringUtils.isBlank(migrationDisk.getTargetPath())) {
+                throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR,
+                        String.format("Target disk path is missing for source disk %s in VMware CBT migration %s",
+                                migrationDisk.getSourceDiskId(), migration.getUuid()));
+            }
+            UnmanagedInstanceTO.Disk disk = new UnmanagedInstanceTO.Disk();
+            disk.setDiskId(migrationDisk.getSourceDiskId());
+            disk.setLabel(migrationDisk.getSourceDiskPath());
+            disk.setCapacity(migrationDisk.getCapacityBytes());
+            disk.setPosition(position);
+            disk.setControllerUnit(position);
+            disk.setController(CBT_FINALIZED_DISK_CONTROLLER);
+            disk.setImagePath(migrationDisk.getTargetPath());
+            disk.setFileBaseName(getVolumePathForCbtTarget(migrationDisk.getTargetPath(), migration.getUuid(), storagePoolType));
+            if (storagePool != null) {
+                disk.setDatastoreName(storagePool.getUuid());
+                disk.setDatastoreType(storagePool.getPoolType().name());
+            }
+            disks.add(disk);
+            position++;
+        }
+        convertedInstance.setDisks(disks);
+        convertedInstance.setNics(new ArrayList<>());
+        return convertedInstance;
+    }
+
+    private String getVolumePathForCbtTarget(String targetPath, String migrationUuid, Storage.StoragePoolType storagePoolType) {
+        String normalizedPath = StringUtils.defaultString(targetPath).replace('\\', '/');
+        if (storagePoolType == Storage.StoragePoolType.RBD || storagePoolType == Storage.StoragePoolType.Linstor) {
+            return StringUtils.contains(normalizedPath, "/") ? StringUtils.substringAfterLast(normalizedPath, "/") : normalizedPath;
+        }
+        String marker = String.format("/cloudstack-cbt/%s/", migrationUuid);
+        int markerIndex = normalizedPath.indexOf(marker);
+        if (markerIndex >= 0) {
+            return String.format("cloudstack-cbt/%s/%s", migrationUuid,
+                    normalizedPath.substring(markerIndex + marker.length()));
+        }
+        return StringUtils.substringAfterLast(normalizedPath, "/");
+    }
+
+    private Map<String, Long> deserializeLongMap(String json) {
+        if (StringUtils.isBlank(json)) {
+            return new HashMap<>();
+        }
+        try {
+            return GSON.fromJson(json, new TypeToken<Map<String, Long>>() {
+            }.getType());
+        } catch (RuntimeException e) {
+            throw new InvalidParameterValueException("Unable to parse stored VMware CBT import ID map");
+        }
+    }
+
+    private Map<String, String> deserializeStringMap(String json) {
+        if (StringUtils.isBlank(json)) {
+            return new HashMap<>();
+        }
+        try {
+            return GSON.fromJson(json, new TypeToken<Map<String, String>>() {
+            }.getType());
+        } catch (RuntimeException e) {
+            throw new InvalidParameterValueException("Unable to parse stored VMware CBT import details");
+        }
+    }
+
+    private Map<String, Network.IpAddresses> deserializeNicIpAddressMap(String json) {
+        Map<String, Network.IpAddresses> nicIpAddressMap = new HashMap<>();
+        for (Map.Entry<String, String> entry : deserializeStringMap(json).entrySet()) {
+            nicIpAddressMap.put(entry.getKey(), new Network.IpAddresses(entry.getValue(), null));
+        }
+        return nicIpAddressMap;
+    }
+
+    private boolean runFinalDeltaSync(VmwareSource source, VmwareCbtMigrationVO migration, HostVO cbtHost,
+                                      int cycleNumber) {
+        VmwareCbtMigrationCycleVO cycle = new VmwareCbtMigrationCycleVO(migration.getId(), cycleNumber);
+        cycle.setState(VmwareCbtMigrationCycle.State.Created);
+        cycle.setDescription("Creating final VMware CBT snapshot for cutover");
+        cycle.setUpdated(new Date());
+
+        VmwareCbtSnapshotInfo snapshot = null;
+        boolean cyclePersisted = false;
+        try {
+            cycle = vmwareCbtMigrationCycleDao.persist(cycle);
+            cyclePersisted = true;
+            snapshot = createDeltaSnapshot(source, migration, cycleNumber);
+            cycle.setState(VmwareCbtMigrationCycle.State.QueryingChangedAreas);
+            cycle.setSnapshotMor(snapshot.getSnapshotMor());
+            cycle.setDescription("Querying final VMware CBT changed disk areas");
+            cycle.setUpdated(new Date());
+            vmwareCbtMigrationCycleDao.update(cycle.getId(), cycle);
+
+            VmwareCbtChangedBlockQueryResult changedBlockQuery = queryChangedBlocks(source, migration,
+                    snapshot.getSnapshotMor());
+
+            cycle.setState(VmwareCbtMigrationCycle.State.CopyingChangedBlocks);
+            cycle.setDescription(String.format("Dispatching %s final VMware CBT changed block range(s) to KVM agent",
+                    changedBlockQuery.changedBlocks.size()));
+            cycle.setUpdated(new Date());
+            vmwareCbtMigrationCycleDao.update(cycle.getId(), cycle);
+
+            VmwareCbtSyncCommand syncCommand = new VmwareCbtSyncCommand(migration.getUuid(),
+                    createRemoteInstance(source, migration, snapshot.getSourceVmMor()), getDiskTransferObjects(migration),
+                    changedBlockQuery.changedBlocks, cycleNumber, snapshot.getSnapshotMor(), true);
+            applyVddkDetails(syncCommand, migration);
+            applyTargetStorageDetails(syncCommand, migration);
+            syncCommand.setWait(getVmwareCbtMigrationAgentCommandTimeout());
+
+            VmwareCbtMigrationAnswer answer = sendVmwareCbtCommand(cbtHost, syncCommand, "perform final synchronization",
+                    migration.getUuid());
+            if (!answer.getResult()) {
+                String details = sanitizeSensitiveMessage(answer.getDetails(), source);
+                markCycleFailed(cycle, details);
+                markMigrationFailed(migration, "Final CBT delta synchronization failed", details);
+                return false;
+            }
+
+            applyDiskResults(migration, answer.getDiskResults());
+            updateDiskChangeIds(migration, changedBlockQuery.changedDisks);
+            long changedBytes = answer.getChangedBytes();
+            long durationSeconds = answer.getDurationSeconds();
+            long dirtyRate = getDirtyRateBytesPerSecond(changedBytes, durationSeconds, answer.getDirtyRateBytesPerSecond());
+
+            cycle.setState(VmwareCbtMigrationCycle.State.Completed);
+            cycle.setChangedBytes(changedBytes);
+            cycle.setDirtyRate(dirtyRate);
+            cycle.setDuration(durationSeconds * 1000);
+            cycle.setDescription(sanitizeSensitiveMessage(answer.getDetails(), source));
+            cycle.setUpdated(new Date());
+            vmwareCbtMigrationCycleDao.update(cycle.getId(), cycle);
+
+            migration.setCompletedCycles(cycleNumber);
+            migration.setQuietCycles(0);
+            migration.setTotalChangedBytes(migration.getTotalChangedBytes() + changedBytes);
+            migration.setLastChangedBytes(changedBytes);
+            migration.setLastDirtyRate(dirtyRate);
+            migration.setCurrentStep("Final CBT delta synchronization completed");
+            migration.setUpdated(new Date());
+            persistMigrationProgress(migration, "final CBT delta synchronization result");
+            return true;
+        } catch (RuntimeException e) {
+            String error = sanitizeSensitiveMessage(StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()), source);
+            if (cyclePersisted) {
+                markCycleFailed(cycle, error);
+            }
+            markMigrationFailed(migration, "Final CBT delta synchronization failed", error);
+            return false;
+        } finally {
+            removeDeltaSnapshotIfPossible(source, migration, snapshot);
+        }
+    }
+
+    private void requireSourceVmPoweredOff(VmwareSource source, VmwareCbtMigrationVO migration) {
+        UnmanagedInstanceTO.PowerState powerState = getVmwareCbtMigrationService().getPowerState(source.vcenter,
+                source.datacenterName, source.username, source.password, source.sourceHost,
+                migration.getSourceVmName());
+        if (powerState != UnmanagedInstanceTO.PowerState.PowerOff) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("Cannot cut over VMware CBT migration %s while source VM %s is in power state %s. Gracefully shut down the source VM, then retry cutover.",
+                            migration.getUuid(), migration.getSourceVmName(), powerState));
+        }
+    }
+
+    @Override
+    public VmwareCbtMigrationResponse cancelVmwareCbtMigration(CancelVmwareCbtMigrationCmd cmd) {
+        VmwareCbtMigrationVO migration = getMigration(cmd.getId());
+        if (!migration.getState().isTerminal()) {
+            // Mark the migration cancelled before removing the target disks, not after: an
+            // in-flight replication or cutover job only persists its progress while the record is
+            // non-terminal, so winning this conditional update is what stops it from writing a
+            // replicating state back over the cancellation once its disks are already gone.
+            migration.setState(VmwareCbtMigration.State.Cancelled);
+            migration.setCurrentStep("Cancelled");
+            migration.setUpdated(new Date());
+            if (vmwareCbtMigrationDao.updateIfNotTerminal(migration)) {
+                sendCleanupCommandIfPossible(migration);
+                // Only after the cleanup command has returned: it is what stops the nbdkit/VDDK
+                // readers still streaming from the snapshot. While one of those holds the disk open
+                // vCenter answers "The operation is not allowed in the current state" and the
+                // snapshot would be orphaned on the source VM.
+                removeLingeringSourceSnapshots(migration);
+            } else {
+                LOGGER.info("VMware CBT migration {} reached a terminal state concurrently; leaving it as is and skipping target cleanup.",
+                        migration.getUuid());
+            }
+            migration = vmwareCbtMigrationDao.findById(migration.getId());
+        }
+        clearStoredSourceCredentials(migration);
+        return createVmwareCbtMigrationResponse(migration);
+    }
+
+    @Override
+    public boolean deleteVmwareCbtMigration(DeleteVmwareCbtMigrationCmd cmd) {
+        VmwareCbtMigrationVO migration = getMigration(cmd.getId());
+        if (!canDeleteMigrationState(migration.getState())) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("Only failed, cancelled or completed VMware CBT migrations can be deleted. Migration %s is in state %s.",
+                            migration.getUuid(), migration.getState()));
+        }
+        if (shouldCleanupDeletedMigration(migration.getState(), cmd.getCleanup())) {
+            sendCleanupCommandForDelete(migration);
+            // Last chance to drop a snapshot vCenter refused earlier, and it has to happen here:
+            // the source credentials are cleared immediately below, and the disk rows carrying the
+            // snapshot MORs are deleted at the end of this method - after either, the snapshot can
+            // no longer be found or authenticated for.
+            removeLingeringSourceSnapshots(migration);
+        } else if (migration.getState() == VmwareCbtMigration.State.Completed && cmd.getCleanup()) {
+            LOGGER.debug("Skipping target disk cleanup for completed VMware CBT migration {}. Completed migration deletion is record-only.",
+                    migration.getUuid());
+        }
+        clearStoredSourceCredentials(migration);
+        for (VmwareCbtMigrationCycleVO cycle : vmwareCbtMigrationCycleDao.listByMigrationId(migration.getId())) {
+            vmwareCbtMigrationCycleDao.remove(cycle.getId());
+        }
+        for (VmwareCbtMigrationDiskVO disk : vmwareCbtMigrationDiskDao.listByMigrationId(migration.getId())) {
+            vmwareCbtMigrationDiskDao.remove(disk.getId());
+        }
+        return vmwareCbtMigrationDao.remove(migration.getId());
+    }
+
+    boolean canDeleteMigrationState(VmwareCbtMigration.State state) {
+        return state == VmwareCbtMigration.State.Failed || state == VmwareCbtMigration.State.Cancelled ||
+                state == VmwareCbtMigration.State.Completed;
+    }
+
+    boolean shouldCleanupDeletedMigration(VmwareCbtMigration.State state, boolean cleanupRequested) {
+        return cleanupRequested && (state == VmwareCbtMigration.State.Failed || state == VmwareCbtMigration.State.Cancelled);
+    }
+
+    private long getUserIdForOwner(Account owner) {
+        long userId = CallContext.current().getCallingUserId();
+        List<UserVO> users = userDao.listByAccount(owner.getAccountId());
+        if (CollectionUtils.isNotEmpty(users)) {
+            userId = users.get(0).getId();
+        }
+        return userId;
+    }
+
+    private String serializeMap(Map<?, ?> map) {
+        if (map == null || map.isEmpty()) {
+            return null;
+        }
+        return GSON.toJson(map);
+    }
+
+    private String serializeNicIpAddressMap(Map<String, Network.IpAddresses> nicIpAddressMap) {
+        if (nicIpAddressMap == null || nicIpAddressMap.isEmpty()) {
+            return null;
+        }
+        Map<String, String> ip4AddressMap = new HashMap<>();
+        for (Map.Entry<String, Network.IpAddresses> entry : nicIpAddressMap.entrySet()) {
+            if (entry.getValue() != null && StringUtils.isNotBlank(entry.getValue().getIp4Address())) {
+                ip4AddressMap.put(entry.getKey(), entry.getValue().getIp4Address());
+            }
+        }
+        return serializeMap(ip4AddressMap);
+    }
+
+    private DataCenterVO getZone(Long zoneId) {
+        DataCenterVO zone = dataCenterDao.findById(zoneId);
+        if (zone == null) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, String.format("Unable to find zone with ID %s", zoneId));
+        }
+        return zone;
+    }
+
+    private ClusterVO getDestinationCluster(Long clusterId, long zoneId) {
+        ClusterVO cluster = clusterDao.findById(clusterId);
+        if (cluster == null) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, String.format("Unable to find cluster with ID %s", clusterId));
+        }
+        if (cluster.getDataCenterId() != zoneId) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "Destination cluster does not belong to the requested zone");
+        }
+        if (Hypervisor.HypervisorType.KVM != cluster.getHypervisorType()) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "Destination cluster must be a KVM cluster for VMware CBT migration");
+        }
+        return cluster;
+    }
+
+    private HostVO selectCbtHost(Long hostId, ClusterVO destinationCluster, VmwareCbtStorageTarget storageTarget) {
+        boolean requireInPlaceFinalization = requiresInPlaceFinalizationSupport(storageTarget);
+        boolean requireRbdSupport = requiresRbdStorageSupport(storageTarget);
+        if (hostId == null) {
+            String hostCapability = getRequiredHostCapability(requireInPlaceFinalization, requireRbdSupport);
+            List<HostVO> hosts = hostDao.listByClusterHypervisorTypeAndHostCapability(destinationCluster.getId(),
+                    destinationCluster.getHypervisorType(), hostCapability);
+            if (requiresBlockDeviceStorageSupport(storageTarget) && CollectionUtils.isNotEmpty(hosts)) {
+                StoragePoolVO pool = storageTarget.getPool();
+                hosts = hosts.stream()
+                        .filter(h -> pool != null && storagePoolHostDao.findByPoolHost(pool.getId(), h.getId()) != null)
+                        .collect(Collectors.toList());
+            }
+            if (CollectionUtils.isEmpty(hosts)) {
+                throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                        getNoSuitableCbtHostMessage(destinationCluster, requireInPlaceFinalization, requireRbdSupport));
+            }
+            HostVO host = hosts.get(0);
+            hostDao.loadDetails(host);
+            return host;
+        }
+        HostVO host = hostDao.findById(hostId);
+        if (host == null) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, String.format("Unable to find CBT migration host with ID %s", hostId));
+        }
+        if (host.getClusterId() == null || host.getClusterId() != destinationCluster.getId()) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "CBT migration host must belong to the destination KVM cluster");
+        }
+        if (Hypervisor.HypervisorType.KVM != host.getHypervisorType()) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "CBT migration host must be a KVM host");
+        }
+        if (host.getType() != Host.Type.Routing || host.getStatus() != Status.Up || host.getResourceState() != ResourceState.Enabled) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "CBT migration host must be an enabled, running routing host");
+        }
+        hostDao.loadDetails(host);
+        if (!Boolean.parseBoolean(host.getDetail(Host.HOST_VDDK_BLOCKCOPY_SUPPORT))) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("CBT migration host %s does not report VMware CBT migration support", host.getName()));
+        }
+        validateStorageTargetFinalizationSupport(storageTarget, host);
+        validateRbdHostSupport(storageTarget, host);
+        validateBlockDeviceHostSupport(storageTarget, host);
+        return host;
+    }
+
+    private String getRequiredHostCapability(boolean requireInPlaceFinalization, boolean requireRbdSupport) {
+        if (requireRbdSupport) {
+            return Host.HOST_VDDK_BLOCKCOPY_RBD_SUPPORT;
+        }
+        if (requireInPlaceFinalization) {
+            return Host.HOST_VDDK_BLOCKCOPY_INPLACE_FINALIZATION_SUPPORT;
+        }
+        return Host.HOST_VDDK_BLOCKCOPY_SUPPORT;
+    }
+
+    private String getRequiredHostCapabilityDescription(boolean requireInPlaceFinalization, boolean requireRbdSupport) {
+        if (requireRbdSupport) {
+            return "VMware CBT migration, in-place finalization and qemu RBD support";
+        }
+        if (requireInPlaceFinalization) {
+            return "VMware CBT migration and in-place finalization support";
+        }
+        return "VMware CBT migration support";
+    }
+
+    private String getNoSuitableCbtHostMessage(ClusterVO destinationCluster, boolean requireInPlaceFinalization,
+                                               boolean requireRbdSupport) {
+        if (requireRbdSupport) {
+            return String.format("Could not find an enabled KVM host in cluster %s with '%s' enabled, which is required to perform VMware CBT migration to RBD storage. " +
+                            "This usually means the host is missing VMware CBT migration support, qemu-img RBD support, or in-place virt-v2v support through the virt-v2v-in-place binary or virt-v2v --in-place option.",
+                    destinationCluster.getName(), Host.HOST_VDDK_BLOCKCOPY_RBD_SUPPORT);
+        }
+        if (requireInPlaceFinalization) {
+            return String.format("Could not find an enabled KVM host in cluster %s with '%s' enabled, which is required to perform VMware CBT in-place finalization. " +
+                            "This usually means the host is missing virt-v2v-in-place or virt-v2v --in-place support.",
+                    destinationCluster.getName(), Host.HOST_VDDK_BLOCKCOPY_INPLACE_FINALIZATION_SUPPORT);
+        }
+        return String.format("Could not find an enabled KVM host in cluster %s that reports %s",
+                destinationCluster.getName(), getRequiredHostCapabilityDescription(requireInPlaceFinalization, false));
+    }
+
+    void validateStorageTargetFinalizationSupport(VmwareCbtStorageTarget storageTarget, HostVO host) {
+        if (storageTarget == null || hostSupportsInPlaceFinalization(host)) {
+            return;
+        }
+        if (isNonInPlaceFinalizationFallbackAllowed(storageTarget)) {
+            return;
+        }
+        String hostName = host == null ? "selected KVM host" : host.getName();
+        if (storageTarget.supportsNonInPlaceFinalizationFallback()) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("Selected KVM host %s cannot finalize VMware CBT migration in-place. Enable virt-v2v in-place support or explicitly allow non-in-place fallback finalization with %s.",
+                            hostName, VmwareCbtAllowNonInPlaceFinalization.key()));
+        }
+        throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                String.format("Destination storage requires virt-v2v in-place finalization, but %s does not report '%s=true'. " +
+                                "Ensure virt-v2v-in-place or virt-v2v --in-place is available on the conversion host.",
+                        hostName, Host.HOST_VDDK_BLOCKCOPY_INPLACE_FINALIZATION_SUPPORT));
+    }
+
+    private boolean hostSupportsInPlaceFinalization(HostVO host) {
+        return host != null && Boolean.parseBoolean(host.getDetail(Host.HOST_VDDK_BLOCKCOPY_INPLACE_FINALIZATION_SUPPORT));
+    }
+
+    private boolean requiresInPlaceFinalizationSupport(VmwareCbtStorageTarget storageTarget) {
+        if (storageTarget == null) {
+            return false;
+        }
+        return storageTarget.requiresInPlaceFinalization() || !isNonInPlaceFinalizationFallbackAllowed(storageTarget);
+    }
+
+    private boolean requiresRbdStorageSupport(VmwareCbtStorageTarget storageTarget) {
+        return storageTarget != null && storageTarget.getTargetStorageType() == VmwareCbtTargetStorageType.RBD_RAW;
+    }
+
+    private boolean requiresBlockDeviceStorageSupport(VmwareCbtStorageTarget storageTarget) {
+        return storageTarget != null && storageTarget.getTargetStorageType() == VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE;
+    }
+
+    private boolean requiresStorageAccessProbe(VmwareCbtStorageTarget storageTarget) {
+        return requiresRbdStorageSupport(storageTarget) || requiresBlockDeviceStorageSupport(storageTarget);
+    }
+
+    private void validateBlockDeviceHostSupport(VmwareCbtStorageTarget storageTarget, HostVO host) {
+        if (!requiresBlockDeviceStorageSupport(storageTarget)) {
+            return;
+        }
+        StoragePoolVO pool = storageTarget.getPool();
+        if (host == null || pool == null || storagePoolHostDao.findByPoolHost(pool.getId(), host.getId()) == null) {
+            String hostName = host == null ? "selected KVM host" : host.getName();
+            String poolName = pool == null ? "selected storage pool" : pool.getName();
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("Destination block device storage requires the conversion host to have access to the storage pool, " +
+                                    "but %s does not have access to %s. For Linstor the host must be a LINSTOR satellite connected to the pool.",
+                            hostName, poolName));
+        }
+    }
+
+    private void validateRbdHostSupport(VmwareCbtStorageTarget storageTarget, HostVO host) {
+        if (!requiresRbdStorageSupport(storageTarget)) {
+            return;
+        }
+        if (host == null || !Boolean.parseBoolean(host.getDetail(Host.HOST_VDDK_BLOCKCOPY_RBD_SUPPORT))) {
+            String hostName = host == null ? "selected KVM host" : host.getName();
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("Destination RBD storage requires qemu RBD support on the conversion host, but %s does not report '%s=true'. " +
+                                    "This usually means the host is missing VMware CBT migration support, qemu-img RBD support, or in-place virt-v2v support through the virt-v2v-in-place binary or virt-v2v --in-place option.",
+                            hostName, Host.HOST_VDDK_BLOCKCOPY_RBD_SUPPORT));
+        }
+    }
+
+    private boolean isNonInPlaceFinalizationFallbackAllowed(VmwareCbtStorageTarget storageTarget) {
+        return storageTarget != null && storageTarget.supportsNonInPlaceFinalizationFallback() &&
+                Boolean.TRUE.equals(VmwareCbtAllowNonInPlaceFinalization.value());
+    }
+
+    private StoragePoolVO getStoragePool(Long storagePoolId, DataCenterVO zone, ClusterVO destinationCluster) {
+        if (storagePoolId == null) {
+            return getImplicitStoragePool(zone, destinationCluster);
+        }
+        StoragePoolVO pool = primaryDataStoreDao.findById(storagePoolId);
+        if (pool == null) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, String.format("Unable to find storage pool with ID %s", storagePoolId));
+        }
+        if (pool.getDataCenterId() != zone.getId()) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "Storage pool does not belong to the requested zone");
+        }
+        if (pool.getClusterId() != null && !pool.getClusterId().equals(destinationCluster.getId())) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "Cluster-scoped storage pool must belong to the destination KVM cluster");
+        }
+        return pool;
+    }
+
+    private StoragePoolVO getImplicitStoragePool(DataCenterVO zone, ClusterVO destinationCluster) {
+        List<StoragePoolVO> pools = listCbtCompatibleStoragePools(zone, destinationCluster);
+        if (CollectionUtils.isEmpty(pools)) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("Cannot find a suitable CBT-compatible primary storage pool in cluster %s for VMware CBT migration. Supported target pool types are NetworkFilesystem, Filesystem, SharedMountPoint, RBD and Linstor.",
+                            destinationCluster.getName()));
+        }
+        if (pools.size() > 1) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("Multiple CBT-compatible primary storage pools are available in cluster %s. Please provide storagepoolid.",
+                            destinationCluster.getName()));
+        }
+        return pools.get(0);
+    }
+
+    List<StoragePoolVO> listCbtCompatibleStoragePools(DataCenterVO zone, ClusterVO destinationCluster) {
+        Map<Long, StoragePoolVO> poolsById = new LinkedHashMap<>();
+        for (Storage.StoragePoolType poolType : CBT_COMPATIBLE_STORAGE_POOL_TYPES) {
+            for (StoragePoolVO pool : CollectionUtils.emptyIfNull(primaryDataStoreDao.findClusterWideStoragePoolsByHypervisorAndPoolType(destinationCluster.getId(),
+                    Hypervisor.HypervisorType.KVM, poolType))) {
+                poolsById.put(pool.getId(), pool);
+            }
+            for (StoragePoolVO pool : CollectionUtils.emptyIfNull(primaryDataStoreDao.findZoneWideStoragePoolsByHypervisorAndPoolType(zone.getId(),
+                    Hypervisor.HypervisorType.KVM, poolType))) {
+                poolsById.put(pool.getId(), pool);
+            }
+        }
+        return new ArrayList<>(poolsById.values());
+    }
+
+    private DataCenterVO getPreflightZone(Long zoneId, PreflightFindingCollector findings) {
+        try {
+            DataCenterVO zone = getZone(zoneId);
+            findings.pass("destination.zone.exists", "cloudstack", zone.getUuid(),
+                    String.format("Destination zone %s was found.", zone.getName()));
+            return zone;
+        } catch (ServerApiException e) {
+            findings.fail("destination.zone.exists", "cloudstack", String.valueOf(zoneId), e.getDescription());
+            return null;
+        }
+    }
+
+    private ClusterVO getPreflightDestinationCluster(Long clusterId, DataCenterVO zone,
+                                                     PreflightFindingCollector findings) {
+        if (zone == null) {
+            return null;
+        }
+        try {
+            ClusterVO cluster = getDestinationCluster(clusterId, zone.getId());
+            findings.pass("destination.cluster.kvm", "cloudstack", cluster.getUuid(),
+                    String.format("Destination cluster %s is a KVM cluster in the selected zone.", cluster.getName()));
+            return cluster;
+        } catch (ServerApiException e) {
+            findings.fail("destination.cluster.kvm", "cloudstack", String.valueOf(clusterId), e.getDescription());
+            return null;
+        }
+    }
+
+    private HostVO getPreflightCbtHost(Long hostId, ClusterVO destinationCluster, VmwareCbtStorageTarget storageTarget,
+                                       PreflightFindingCollector findings) {
+        if (destinationCluster == null) {
+            return null;
+        }
+        try {
+            HostVO host = selectCbtHost(hostId, destinationCluster, storageTarget);
+            findings.pass("destinationHost.vmwareCbtSupport", "kvm", host.getUuid(),
+                    String.format("KVM host %s reports VMware CBT migration support.", host.getName()));
+            return host;
+        } catch (ServerApiException e) {
+            findings.fail("destinationHost.vmwareCbtSupport", "kvm",
+                    hostId == null ? destinationCluster.getUuid() : String.valueOf(hostId), e.getDescription());
+            return null;
+        }
+    }
+
+    private StoragePoolVO getPreflightStoragePool(Long storagePoolId, DataCenterVO zone, ClusterVO destinationCluster,
+                                                  PreflightFindingCollector findings) {
+        if (zone == null || destinationCluster == null) {
+            return null;
+        }
+        try {
+            StoragePoolVO pool = getStoragePool(storagePoolId, zone, destinationCluster);
+            findings.pass("destinationStorage.poolSelected", "storage", pool.getUuid(),
+                    String.format("Destination storage pool %s was selected.", pool.getName()));
+            return pool;
+        } catch (ServerApiException e) {
+            findings.fail("destinationStorage.poolSelected", "storage",
+                    storagePoolId == null ? destinationCluster.getUuid() : String.valueOf(storagePoolId),
+                    e.getDescription());
+            return null;
+        }
+    }
+
+    private VmwareSource getPreflightVmwareSource(CheckVmwareCbtMigrationPrerequisitesCmd cmd,
+                                                  PreflightFindingCollector findings) {
+        try {
+            VmwareSource source = resolveVmwareSource(cmd.getExistingVcenterId(), cmd.getVcenter(),
+                    cmd.getDatacenterName(), cmd.getUsername(), cmd.getPassword(), cmd.getSourceHost());
+            findings.pass("sourceVcenter.credentialsResolved", "vmware", source.vcenter,
+                    "Source vCenter credentials were resolved.");
+            return source;
+        } catch (ServerApiException e) {
+            findings.fail("sourceVcenter.credentialsResolved", "vmware", cmd.getVcenter(), e.getDescription());
+            return null;
+        }
+    }
+
+    private void populateStorageTargetResponse(VmwareCbtMigrationPreflightResponse response,
+                                               VmwareCbtStorageTarget storageTarget) {
+        if (storageTarget == null) {
+            return;
+        }
+        StoragePoolVO pool = storageTarget.getPool();
+        if (pool != null) {
+            response.setStoragePoolId(pool.getUuid());
+            response.setStoragePoolName(pool.getName());
+            response.setStoragePoolType(pool.getPoolType().name());
+        }
+        response.setStorageWriterType(storageTarget.getTargetStorageType().name());
+        response.setStorageWriterSupported(storageTarget.isSupported());
+        response.setStorageRequiresInPlaceFinalization(storageTarget.requiresInPlaceFinalization());
+        response.setNonInPlaceFinalizationFallbackAllowed(isNonInPlaceFinalizationFallbackAllowed(storageTarget));
+        response.setNonInPlaceFinalizationFallbackSupported(storageTarget.supportsNonInPlaceFinalizationFallback());
+    }
+
+    private void addStorageTargetFinding(VmwareCbtStorageTarget storageTarget, PreflightFindingCollector findings) {
+        if (storageTarget == null) {
+            return;
+        }
+        StoragePoolVO pool = storageTarget.getPool();
+        String resource = pool == null ? null : pool.getUuid();
+        if (storageTarget.isSupported()) {
+            findings.pass("destinationStorage.writerSupported", "storage", resource, storageTarget.getSupportMessage());
+        } else {
+            findings.fail("destinationStorage.writerSupported", "storage", resource, storageTarget.getSupportMessage());
+        }
+    }
+
+    private void addStorageTargetFinalizationFinding(VmwareCbtStorageTarget storageTarget, HostVO cbtHost,
+                                                     PreflightFindingCollector findings) {
+        if (storageTarget == null || !storageTarget.isSupported()) {
+            return;
+        }
+        StoragePoolVO pool = storageTarget.getPool();
+        String resource = pool == null ? null : pool.getUuid();
+        if (hostSupportsInPlaceFinalization(cbtHost)) {
+            findings.pass("destinationStorage.finalizationSupported", "storage", resource,
+                    String.format("KVM host %s reports VMware CBT in-place finalization support.",
+                            cbtHost.getName()));
+            return;
+        }
+        if (cbtHost == null) {
+            findings.fail("destinationStorage.finalizationSupported", "storage", resource,
+                    "No suitable KVM host was selected for VMware CBT finalization.");
+            return;
+        }
+        if (isNonInPlaceFinalizationFallbackAllowed(storageTarget)) {
+            findings.pass("destinationStorage.finalizationSupported", "storage", resource,
+                    String.format("KVM host %s does not report VMware CBT in-place finalization support, but non-in-place fallback is explicitly enabled for qcow2 file targets. CloudStack will stage fallback temporary data on the selected primary storage and verify free space before cutover.",
+                            cbtHost.getName()));
+            return;
+        }
+        if (storageTarget.supportsNonInPlaceFinalizationFallback()) {
+            findings.fail("destinationStorage.finalizationSupported", "storage", resource,
+                    String.format("KVM host %s does not report '%s=true'. Ensure virt-v2v-in-place or virt-v2v --in-place is available, or explicitly allow non-in-place fallback finalization with %s.",
+                            cbtHost.getName(), Host.HOST_VDDK_BLOCKCOPY_INPLACE_FINALIZATION_SUPPORT,
+                            VmwareCbtAllowNonInPlaceFinalization.key()));
+        } else {
+            findings.fail("destinationStorage.finalizationSupported", "storage", resource,
+                    String.format("Destination storage requires virt-v2v in-place finalization, but KVM host %s does not report '%s=true'. Ensure virt-v2v-in-place or virt-v2v --in-place is available on the conversion host.",
+                            cbtHost.getName(), Host.HOST_VDDK_BLOCKCOPY_INPLACE_FINALIZATION_SUPPORT));
+        }
+    }
+
+    private void addRbdStorageAccessFinding(VmwareCbtStorageTarget storageTarget, HostVO cbtHost,
+                                            PreflightFindingCollector findings) {
+        if (!requiresStorageAccessProbe(storageTarget)) {
+            return;
+        }
+        StoragePoolVO pool = storageTarget.getPool();
+        String resource = pool == null ? null : pool.getUuid();
+        String targetDescription = requiresRbdStorageSupport(storageTarget) ? "RBD image" : "block device volume";
+        if (cbtHost == null) {
+            findings.fail("destinationStorage.rbdAccess", "storage", resource,
+                    "No suitable KVM host was selected for the destination storage access probe.");
+            return;
+        }
+        Answer answer = probeTargetStorageAccess(storageTarget, cbtHost);
+        if (answer != null && answer.getResult()) {
+            findings.pass("destinationStorage.rbdAccess", "storage", resource,
+                    String.format("KVM host %s can create, write, read and delete a temporary %s in storage pool %s.",
+                            cbtHost.getName(), targetDescription, pool.getName()));
+        } else {
+            findings.fail("destinationStorage.rbdAccess", "storage", resource, getStorageProbeFailureMessage(storageTarget, answer, cbtHost, pool));
+        }
+    }
+
+    private void validateRbdStorageAccessForStart(VmwareCbtStorageTarget storageTarget, HostVO cbtHost) {
+        if (!requiresStorageAccessProbe(storageTarget)) {
+            return;
+        }
+        Answer answer = probeTargetStorageAccess(storageTarget, cbtHost);
+        if (answer == null || !answer.getResult()) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    getStorageProbeFailureMessage(storageTarget, answer, cbtHost, storageTarget.getPool()));
+        }
+    }
+
+    private Answer probeTargetStorageAccess(VmwareCbtStorageTarget storageTarget, HostVO cbtHost) {
+        StoragePoolVO pool = storageTarget.getPool();
+        String probeName = requiresBlockDeviceStorageSupport(storageTarget)
+                ? getBlockDeviceProbeVolumeName()
+                : RBD_PROBE_IMAGE_PREFIX + UUID.randomUUID();
+        VmwareCbtRbdProbeCommand command = new VmwareCbtRbdProbeCommand(pool.getPoolType(), pool.getUuid(), probeName);
+        command.setTargetStorageType(storageTarget.getTargetStorageType());
+        command.setWait(getVmwareCbtMigrationAgentCommandTimeout());
+        try {
+            return agentManager.send(cbtHost.getId(), command);
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            String details = String.format("Unable to run VMware CBT destination storage probe on host %s for storage pool %s: %s",
+                    cbtHost.getName(), pool.getName(), StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()));
+            LOGGER.warn(details, e);
+            return new Answer(command, false, details);
+        }
+    }
+
+    /**
+     * Probe volume names on block-device pools become LINSTOR resource names with a
+     * "cs-" prefix; LINSTOR caps resource names at 48 characters, so a short random
+     * suffix is used instead of the full RBD-style probe name.
+     */
+    private String getBlockDeviceProbeVolumeName() {
+        return "cbt-probe-" + UUID.randomUUID().toString().substring(0, 8);
+    }
+
+    private String getStorageProbeFailureMessage(VmwareCbtStorageTarget storageTarget, Answer answer, HostVO cbtHost, StoragePoolVO pool) {
+        String details = answer == null ? null : answer.getDetails();
+        if (StringUtils.isNotBlank(details)) {
+            return details;
+        }
+        String hostName = cbtHost == null ? "selected KVM host" : cbtHost.getName();
+        if (requiresBlockDeviceStorageSupport(storageTarget)) {
+            String poolName = pool == null ? "selected block device storage pool" : pool.getName();
+            return String.format("KVM host %s cannot verify access to block device storage pool %s. Verify the CloudStack primary-storage configuration, " +
+                            "that the host is a LINSTOR satellite connected to the pool, controller connectivity and qemu-io availability.",
+                    hostName, poolName);
+        }
+        String poolName = pool == null ? "selected RBD storage pool" : pool.getName();
+        return String.format("KVM host %s cannot verify access to RBD storage pool %s. Verify CloudStack RBD primary-storage configuration, Ceph monitor connectivity, qemu RBD block-driver support, librados/librbd client library versions, Java RADOS/RBD bindings and Ceph authentication.",
+                hostName, poolName);
+    }
+
+    private void populateSourceVmPreflight(VmwareCbtMigrationPreflightResponse response, VmwareSource source,
+                                           String sourceVmName, HostVO cbtHost, Long serviceOfferingId,
+                                           Map<String, String> details, DataCenterVO zone,
+                                           PreflightFindingCollector findings) {
+        try {
+            VmwareCbtPreflightInfo preflightInfo = getVmwareCbtMigrationService().getPreflightInfo(source.vcenter,
+                    source.datacenterName, source.username, source.password, source.sourceHost, sourceVmName);
+            response.setSourceVmMor(preflightInfo.getSourceVmMor());
+            response.setChangeTrackingSupported(preflightInfo.getChangeTrackingSupported());
+            response.setChangeTrackingEnabled(preflightInfo.getChangeTrackingEnabled());
+            response.setConsolidationNeeded(preflightInfo.getConsolidationNeeded());
+            response.setExistingSnapshotCount(preflightInfo.getExistingSnapshotCount());
+            response.setSourceCpuNumber(preflightInfo.getCpuCores());
+            response.setSourceCpuSpeed(preflightInfo.getCpuSpeed());
+            response.setSourceMemory(preflightInfo.getMemoryMb());
+            response.setSourceGuestOsId(preflightInfo.getOperatingSystemId());
+            response.setSourceGuestOs(preflightInfo.getOperatingSystem());
+            response.setDisks(createPreflightDiskResponses(preflightInfo.getDisks()));
+            addSourceVmFindings(preflightInfo, findings);
+            addWindowsGuestConversionSupportFinding(cbtHost, sourceVmName, preflightInfo, details, findings);
+            addServiceOfferingResourceFindings(preflightInfo, serviceOfferingId, details, zone, findings);
+        } catch (RuntimeException e) {
+            findings.fail("sourceVm.inspect", "vmware", sourceVmName,
+                    sanitizeSensitiveMessage(StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()), source));
+        }
+    }
+
+    private void validateWindowsGuestConversionSupportForStart(HostVO cbtHost, String sourceVmName,
+                                                               VmwareCbtPreflightInfo preflightInfo,
+                                                               Map<String, String> details) {
+        if (!isWindowsSourceVm(preflightInfo)) {
+            return;
+        }
+        CheckConvertInstanceAnswer answer = checkWindowsGuestConversionSupportOnHost(cbtHost, sourceVmName, details);
+        if (!answer.getResult()) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    getWindowsGuestConversionSupportError(cbtHost, sourceVmName, answer));
+        }
+    }
+
+    private void addWindowsGuestConversionSupportFinding(HostVO cbtHost, String sourceVmName,
+                                                         VmwareCbtPreflightInfo preflightInfo,
+                                                         Map<String, String> details,
+                                                         PreflightFindingCollector findings) {
+        if (!isWindowsSourceVm(preflightInfo)) {
+            return;
+        }
+        if (cbtHost == null) {
+            findings.fail("destinationHost.windowsGuestConversionSupport", "host", null,
+                    "No suitable KVM host was selected to validate Windows guest conversion support.");
+            return;
+        }
+        try {
+            CheckConvertInstanceAnswer answer = checkWindowsGuestConversionSupportOnHost(cbtHost, sourceVmName, details);
+            if (answer.getResult()) {
+                findings.pass("destinationHost.windowsGuestConversionSupport", "host", cbtHost.getUuid(),
+                        String.format("KVM host %s reports Windows guest conversion support.", cbtHost.getName()));
+                return;
+            }
+            findings.fail("destinationHost.windowsGuestConversionSupport", "host", cbtHost.getUuid(),
+                    getWindowsGuestConversionSupportError(cbtHost, sourceVmName, answer));
+        } catch (ServerApiException e) {
+            findings.fail("destinationHost.windowsGuestConversionSupport", "host", cbtHost.getUuid(),
+                    e.getDescription());
+        }
+    }
+
+    private CheckConvertInstanceAnswer checkWindowsGuestConversionSupportOnHost(HostVO cbtHost, String sourceVmName,
+                                                                               Map<String, String> details) {
+        CheckConvertInstanceCommand command = new CheckConvertInstanceCommand(true, true);
+        if (MapUtils.isNotEmpty(details)) {
+            command.setVddkLibDir(StringUtils.trimToNull(details.get(Host.HOST_VDDK_LIB_DIR)));
+        }
+        command.setWait(60);
+        try {
+            return (CheckConvertInstanceAnswer) agentManager.send(cbtHost.getId(), command);
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            String error = String.format("Failed to check windows guest conversion support on host %s for VMware CBT migration of source VM %s due to: %s",
+                    cbtHost, sourceVmName, e.getMessage());
+            LOGGER.error(error, e);
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, error);
+        }
+    }
+
+    private String getWindowsGuestConversionSupportError(HostVO cbtHost, String sourceVmName,
+                                                         CheckConvertInstanceAnswer answer) {
+        return String.format("The host %s doesn't support conversion of instance %s from VMware to KVM due to: %s",
+                cbtHost, sourceVmName, StringUtils.defaultIfBlank(answer.getDetails(), "unknown reason"));
+    }
+
+    static boolean isWindowsSourceVm(VmwareCbtPreflightInfo preflightInfo) {
+        return preflightInfo != null &&
+                (StringUtils.containsIgnoreCase(preflightInfo.getOperatingSystemId(), "windows") ||
+                        StringUtils.containsIgnoreCase(preflightInfo.getOperatingSystem(), "windows"));
+    }
+
+    private void addSourceVmFindings(VmwareCbtPreflightInfo preflightInfo, PreflightFindingCollector findings) {
+        String sourceVmName = preflightInfo.getSourceVmName();
+        findings.pass("sourceVm.found", "vmware", sourceVmName, "Source VM was found in vCenter.");
+
+        if (Boolean.FALSE.equals(preflightInfo.getChangeTrackingSupported())) {
+            findings.fail("vmCapability.changeTrackingSupported", "vmware", sourceVmName,
+                    "Source VM does not report VMware CBT support.");
+        } else if (Boolean.TRUE.equals(preflightInfo.getChangeTrackingSupported())) {
+            findings.pass("vmCapability.changeTrackingSupported", "vmware", sourceVmName,
+                    "Source VM reports VMware CBT support.");
+        } else {
+            findings.warn("vmCapability.changeTrackingSupported", "vmware", sourceVmName,
+                    "Source VM CBT capability could not be determined.");
+        }
+
+        if (Boolean.TRUE.equals(preflightInfo.getChangeTrackingEnabled())) {
+            findings.pass("vmConfig.changeTrackingEnabled", "vmware", sourceVmName,
+                    "CBT is already enabled on the source VM.");
+        } else if (Boolean.FALSE.equals(preflightInfo.getChangeTrackingEnabled())) {
+            findings.warn("vmConfig.changeTrackingEnabled", "vmware", sourceVmName,
+                    "CBT is not currently enabled; startVmwareCbtMigration will enable it before creating the baseline snapshot.");
+        } else {
+            findings.warn("vmConfig.changeTrackingEnabled", "vmware", sourceVmName,
+                    "CBT enabled state could not be determined.");
+        }
+
+        if (Boolean.TRUE.equals(preflightInfo.getConsolidationNeeded())) {
+            findings.fail("vmRuntime.consolidationNeeded", "vmware", sourceVmName,
+                    "Source VM reports that disk consolidation is needed.");
+        } else if (Boolean.FALSE.equals(preflightInfo.getConsolidationNeeded())) {
+            findings.pass("vmRuntime.consolidationNeeded", "vmware", sourceVmName,
+                    "Source VM does not report pending disk consolidation.");
+        } else {
+            findings.warn("vmRuntime.consolidationNeeded", "vmware", sourceVmName,
+                    "Source VM consolidation state could not be determined.");
+        }
+
+        if (preflightInfo.getExistingSnapshotCount() != null && preflightInfo.getExistingSnapshotCount() > 0) {
+            findings.warn("vmSnapshot.existingSnapshots", "vmware", sourceVmName,
+                    String.format("Source VM has %s existing VMware snapshot(s). Initial full copy may still work, but CBT migration is safer after snapshot consolidation.",
+                            preflightInfo.getExistingSnapshotCount()));
+        } else {
+            findings.pass("vmSnapshot.existingSnapshots", "vmware", sourceVmName,
+                    "Source VM has no existing VMware snapshots.");
+        }
+
+        if (CollectionUtils.isEmpty(preflightInfo.getDisks())) {
+            findings.fail("sourceVm.disks.present", "vmware", sourceVmName,
+                    "No source VMware disks were discovered.");
+            return;
+        }
+        for (VmwareCbtPreflightDiskInfo disk : preflightInfo.getDisks()) {
+            addSourceDiskFindings(disk, findings);
+        }
+    }
+
+    private void addServiceOfferingResourceFindings(VmwareCbtPreflightInfo preflightInfo, Long serviceOfferingId,
+                                                    Map<String, String> details, DataCenterVO zone,
+                                                    PreflightFindingCollector findings) {
+        if (serviceOfferingId == null) {
+            findings.warn("serviceOffering.present", "serviceoffering", null,
+                    "No service offering was provided; source VM CPU and memory sizing was not validated.");
+            return;
+        }
+
+        Account caller = CallContext.current().getCallingAccount();
+        ServiceOfferingVO serviceOffering = getPreflightServiceOffering(serviceOfferingId, caller, zone, findings);
+        if (serviceOffering == null) {
+            return;
+        }
+
+        VmwareCbtOfferingResources requestedResources;
+        try {
+            requestedResources = resolveRequestedOfferingResources(serviceOffering, details);
+        } catch (ServerApiException e) {
+            findings.fail("serviceOffering.resources.valid", "serviceoffering", serviceOffering.getUuid(), e.getDescription());
+            return;
+        }
+
+        addServiceOfferingResourceFinding(preflightInfo.getCpuCores(), requestedResources.getCpuNumber(),
+                "serviceOffering.cpuNumber", "CPU number", serviceOffering, findings);
+        addServiceOfferingResourceFinding(preflightInfo.getCpuSpeed(), requestedResources.getCpuSpeed(),
+                "serviceOffering.cpuSpeed", "CPU speed", serviceOffering, findings);
+        addServiceOfferingResourceFinding(preflightInfo.getMemoryMb(), requestedResources.getMemoryMb(),
+                "serviceOffering.memory", "Memory", serviceOffering, findings);
+    }
+
+    private ServiceOfferingVO getPreflightServiceOffering(Long serviceOfferingId, Account caller, DataCenterVO zone,
+                                                          PreflightFindingCollector findings) {
+        ServiceOfferingVO serviceOffering = serviceOfferingDao.findById(serviceOfferingId);
+        if (serviceOffering == null) {
+            findings.fail("serviceOffering.present", "serviceoffering", String.valueOf(serviceOfferingId),
+                    String.format("Service offering ID %d cannot be found.", serviceOfferingId));
+            return null;
+        }
+        try {
+            if (caller != null && zone != null) {
+                accountService.checkAccess(caller, serviceOffering, zone);
+            }
+            serviceOfferingDao.loadDetails(serviceOffering);
+            findings.pass("serviceOffering.present", "serviceoffering", serviceOffering.getUuid(),
+                    "Service offering was found.");
+            return serviceOffering;
+        } catch (RuntimeException e) {
+            findings.fail("serviceOffering.access", "serviceoffering", serviceOffering.getUuid(),
+                    StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()));
+            return null;
+        }
+    }
+
+    private void addServiceOfferingResourceFinding(Integer sourceResource, Integer requestedResource,
+                                                   String code, String resourceName, ServiceOfferingVO serviceOffering,
+                                                   PreflightFindingCollector findings) {
+        if (sourceResource == null || sourceResource <= 0) {
+            findings.warn(code, "serviceoffering", serviceOffering.getUuid(),
+                    String.format("Source VM %s could not be determined.", resourceName));
+            return;
+        }
+        if (requestedResource == null || requestedResource <= 0) {
+            findings.warn(code, "serviceoffering", serviceOffering.getUuid(),
+                    String.format("Selected service offering %s could not be determined.", resourceName));
+            return;
+        }
+        if (requestedResource < sourceResource) {
+            findings.fail(code, "serviceoffering", serviceOffering.getUuid(),
+                    String.format("The requested %s (%d) is less than the source VM %s (%d).",
+                            resourceName, requestedResource, resourceName, sourceResource));
+            return;
+        }
+        findings.pass(code, "serviceoffering", serviceOffering.getUuid(),
+                String.format("The requested %s (%d) is sufficient for the source VM %s (%d).",
+                        resourceName, requestedResource, resourceName, sourceResource));
+    }
+
+    private void addSourceDiskFindings(VmwareCbtPreflightDiskInfo disk, PreflightFindingCollector findings) {
+        String diskId = StringUtils.defaultIfBlank(disk.getSourceDiskId(), disk.getSourceDiskPath());
+        if (disk.getSourceDiskDeviceKey() == null) {
+            findings.fail("disk.deviceKey.present", "vmware", diskId,
+                    "Source disk device key is missing; CBT changed-area queries require a disk device key.");
+        } else {
+            findings.pass("disk.deviceKey.present", "vmware", diskId,
+                    "Source disk device key is available.");
+        }
+        if (StringUtils.isBlank(disk.getSourceDiskPath())) {
+            findings.fail("disk.backing.path.present", "vmware", diskId,
+                    "Source disk backing path is missing.");
+        } else {
+            findings.pass("disk.backing.path.present", "vmware", diskId,
+                    "Source disk backing path is available.");
+        }
+        if (disk.isIndependentDisk()) {
+            findings.fail("disk.mode.independent", "vmware", diskId,
+                    String.format("Source disk mode %s is independent; independent disks are not supported for VMware CBT migration.",
+                            disk.getDiskMode()));
+        } else {
+            findings.pass("disk.mode.independent", "vmware", diskId,
+                    "Source disk is not configured as independent.");
+        }
+        if (disk.isPhysicalRdm()) {
+            findings.fail("disk.rdm.physical", "vmware", diskId,
+                    "Source disk is a physical-mode RDM; physical RDM disks are not supported for VMware CBT migration.");
+        } else {
+            findings.pass("disk.rdm.physical", "vmware", diskId,
+                    "Source disk is not a physical-mode RDM.");
+        }
+        if (StringUtils.isBlank(disk.getChangeId())) {
+            findings.warn("disk.changeId.present", "vmware", diskId,
+                    "A current CBT changeId is not visible for this disk. This can be normal before CloudStack enables CBT and creates the baseline snapshot; startVmwareCbtMigration will validate the baseline snapshot changeId after the initial full sync.");
+        } else {
+            findings.pass("disk.changeId.present", "vmware", diskId,
+                    "A current CBT changeId is visible for this disk.");
+        }
+    }
+
+    private List<VmwareCbtMigrationPreflightDiskResponse> createPreflightDiskResponses(List<VmwareCbtPreflightDiskInfo> disks) {
+        List<VmwareCbtMigrationPreflightDiskResponse> responses = new ArrayList<>();
+        if (CollectionUtils.isEmpty(disks)) {
+            return responses;
+        }
+        for (VmwareCbtPreflightDiskInfo disk : disks) {
+            VmwareCbtMigrationPreflightDiskResponse response = new VmwareCbtMigrationPreflightDiskResponse();
+            response.setObjectName("disk");
+            response.setSourceDiskId(disk.getSourceDiskId());
+            response.setSourceDiskDeviceKey(disk.getSourceDiskDeviceKey());
+            response.setSourceDiskPath(disk.getSourceDiskPath());
+            response.setDatastoreName(disk.getDatastoreName());
+            response.setCapacityBytes(disk.getCapacityBytes());
+            response.setBackingType(disk.getBackingType());
+            response.setDiskMode(disk.getDiskMode());
+            response.setRdmCompatibilityMode(disk.getRdmCompatibilityMode());
+            response.setIndependentDisk(disk.isIndependentDisk());
+            response.setPhysicalRdm(disk.isPhysicalRdm());
+            response.setChangeIdPresent(StringUtils.isNotBlank(disk.getChangeId()));
+            responses.add(response);
+        }
+        return responses;
+    }
+
+    private VmwareSource resolveVmwareSource(StartVmwareCbtMigrationCmd cmd) {
+        return resolveVmwareSource(cmd.getExistingVcenterId(), cmd.getVcenter(), cmd.getDatacenterName(),
+                cmd.getUsername(), cmd.getPassword(), cmd.getSourceHost());
+    }
+
+    private VmwareSource resolveVmwareSource(Long existingVcenterId, String vcenter, String datacenterName,
+                                             String username, String password, String sourceHost) {
+        if ((existingVcenterId == null && StringUtils.isBlank(vcenter)) ||
+                (existingVcenterId != null && StringUtils.isNotBlank(vcenter))) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "Please provide an existing vCenter ID or a vCenter IP/Name, parameters are mutually exclusive");
+        }
+
+        if (existingVcenterId != null) {
+            VmwareDatacenterVO existingDc = vmwareDatacenterDao.findById(existingVcenterId);
+            if (existingDc == null) {
+                throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                        String.format("Cannot find any existing VMware datacenter with ID %s", existingVcenterId));
+            }
+            return new VmwareSource(existingDc.getId(), existingDc.getVcenterHost(), existingDc.getVmwareDatacenterName(),
+                    existingDc.getUser(), existingDc.getPassword(), sourceHost);
+        }
+
+        if (StringUtils.isAnyBlank(vcenter, datacenterName, username, password)) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    "Please set all the information for a vCenter IP/Name, datacenter, username and password");
+        }
+        return new VmwareSource(null, vcenter, datacenterName, username, password, sourceHost);
+    }
+
+    private VmwareSource resolveVmwareSource(VmwareCbtMigrationVO migration, String username, String password) {
+        if (migration.getExistingVcenterId() != null) {
+            VmwareDatacenterVO existingDc = vmwareDatacenterDao.findById(migration.getExistingVcenterId());
+            if (existingDc == null) {
+                throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                        String.format("Cannot find any existing VMware datacenter with ID %s",
+                                migration.getExistingVcenterId()));
+            }
+            return new VmwareSource(existingDc.getId(), existingDc.getVcenterHost(), existingDc.getVmwareDatacenterName(),
+                    existingDc.getUser(), existingDc.getPassword(), migration.getSourceHost());
+        }
+
+        boolean usernameOverrideProvided = StringUtils.isNotBlank(username);
+        boolean passwordOverrideProvided = StringUtils.isNotBlank(password);
+        if (usernameOverrideProvided != passwordOverrideProvided) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    "Please provide both source vCenter username and password when overriding stored VMware CBT migration credentials");
+        }
+
+        String resolvedUsername = usernameOverrideProvided ? username : migration.getSourceUsername();
+        String resolvedPassword = passwordOverrideProvided ? password : migration.getSourcePassword();
+        if (StringUtils.isAnyBlank(migration.getVcenter(), migration.getDatacenter(), resolvedUsername, resolvedPassword)) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    "Please provide source vCenter username and password for this VMware CBT migration");
+        }
+
+        if (usernameOverrideProvided) {
+            migration.setSourceUsername(resolvedUsername);
+            migration.setSourcePassword(resolvedPassword);
+            migration.setUpdated(new Date());
+            vmwareCbtMigrationDao.update(migration.getId(), migration);
+        }
+        return new VmwareSource(null, migration.getVcenter(), migration.getDatacenter(), resolvedUsername, resolvedPassword,
+                migration.getSourceHost());
+    }
+
+    private void storeExternalVmwareSourceCredentials(VmwareCbtMigrationVO migration, VmwareSource source) {
+        if (source.existingVcenterId != null) {
+            return;
+        }
+        migration.setSourceUsername(source.username);
+        migration.setSourcePassword(source.password);
+    }
+
+    private void clearStoredSourceCredentials(VmwareCbtMigrationVO migration) {
+        if (migration == null ||
+                (StringUtils.isBlank(migration.getSourceUsername()) && StringUtils.isBlank(migration.getSourcePassword()))) {
+            return;
+        }
+        migration.setSourceUsername(null);
+        migration.setSourcePassword(null);
+        migration.setUpdated(new Date());
+        vmwareCbtMigrationDao.update(migration.getId(), migration);
+    }
+
+    private VmwareCbtMigration.State parseState(String state) {
+        if (StringUtils.isBlank(state)) {
+            return null;
+        }
+        try {
+            return VmwareCbtMigration.State.getValue(state);
+        } catch (IllegalArgumentException e) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, e.getMessage());
+        }
+    }
+
+    private VmwareCbtMigrationVO getMigration(Long id) {
+        VmwareCbtMigrationVO migration = vmwareCbtMigrationDao.findById(id);
+        if (migration == null) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, String.format("Unable to find VMware CBT migration with ID %s", id));
+        }
+        return migration;
+    }
+
+    private void rejectTerminalMigration(VmwareCbtMigrationVO migration, String action) {
+        if (migration.getState().isTerminal()) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("Cannot %s VMware CBT migration %s because it is already in state %s",
+                            action, migration.getUuid(), migration.getState()));
+        }
+    }
+
+    private void requireMigrationState(VmwareCbtMigrationVO migration, String action,
+                                       VmwareCbtMigration.State... allowedStates) {
+        for (VmwareCbtMigration.State allowedState : allowedStates) {
+            if (migration.getState() == allowedState) {
+                return;
+            }
+        }
+        throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                String.format("Cannot %s VMware CBT migration %s while it is in state %s. Expected state: %s",
+                        action, migration.getUuid(), migration.getState(), StringUtils.join(allowedStates, ", ")));
+    }
+
+    private List<VmwareCbtDiskInfo> discoverSourceDisks(VmwareSource source, String sourceVmName) {
+        List<VmwareCbtDiskInfo> sourceDisks = getVmwareCbtMigrationService().listSourceDisks(source.vcenter, source.datacenterName,
+                source.username, source.password, source.sourceHost, sourceVmName);
+        if (CollectionUtils.isEmpty(sourceDisks)) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR,
+                    String.format("No source disks were discovered for VMware VM %s", sourceVmName));
+        }
+        return sourceDisks;
+    }
+
+    private void persistSourceDisks(VmwareCbtMigrationVO migration, List<VmwareCbtDiskInfo> sourceDisks) {
+        for (VmwareCbtDiskInfo sourceDisk : sourceDisks) {
+            VmwareCbtMigrationDiskVO disk = new VmwareCbtMigrationDiskVO(migration.getId(),
+                    StringUtils.defaultIfBlank(sourceDisk.getSourceDiskId(), sourceDisk.getLabel()),
+                    sourceDisk.getSourceDiskDeviceKey(), sourceDisk.getSourceDiskPath(), sourceDisk.getDatastoreName(),
+                    sourceDisk.getCapacityBytes());
+            disk.setChangeId(sourceDisk.getChangeId());
+            disk.setTargetFormat("qcow2");
+            disk.setUpdated(new Date());
+            vmwareCbtMigrationDiskDao.persist(disk);
+        }
+    }
+
+    private void prepareInitialSyncDiskTargets(VmwareCbtMigrationVO migration, VmwareCbtStorageTarget storageTarget) {
+        if (storageTarget == null) {
+            return;
+        }
+
+        String targetBasePath = storageTarget.getTargetStorageType() == VmwareCbtTargetStorageType.QCOW2_FILE ?
+                getQcow2InitialSyncTargetBasePath(migration, storageTarget) : null;
+        for (VmwareCbtMigrationDiskVO disk : vmwareCbtMigrationDiskDao.listByMigrationId(migration.getId())) {
+            String targetFormat = getInitialSyncTargetFormat(storageTarget);
+            disk.setTargetFormat(targetFormat);
+            if (StringUtils.isBlank(disk.getTargetPath())) {
+                switch (storageTarget.getTargetStorageType()) {
+                    case RBD_RAW:
+                        disk.setTargetPath(getRbdInitialSyncTargetImageName(migration, disk));
+                        break;
+                    case RAW_BLOCK_DEVICE:
+                        disk.setTargetPath(getBlockDeviceInitialSyncTargetName(migration, disk));
+                        break;
+                    default:
+                        disk.setTargetPath(String.format("%s/%s", targetBasePath, getTargetDiskFileName(disk, targetFormat)));
+                        break;
+                }
+            }
+            disk.setState(VmwareCbtMigrationDisk.State.Syncing);
+            disk.setUpdated(new Date());
+            vmwareCbtMigrationDiskDao.update(disk.getId(), disk);
+        }
+    }
+
+    private String getInitialSyncTargetFormat(VmwareCbtStorageTarget storageTarget) {
+        if (storageTarget.getTargetStorageType() == VmwareCbtTargetStorageType.RBD_RAW ||
+                storageTarget.getTargetStorageType() == VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE) {
+            return "raw";
+        }
+        return "qcow2";
+    }
+
+    private String getQcow2InitialSyncTargetBasePath(VmwareCbtMigrationVO migration, VmwareCbtStorageTarget storageTarget) {
+        StoragePoolVO storagePool = storageTarget == null ? null : storageTarget.getPool();
+        if (storagePool == null) {
+            return String.format("%s/%s", DEFAULT_CBT_DISK_BASE_PATH, migration.getUuid());
+        }
+        return String.format("%s/%s/cloudstack-cbt/%s", KVM_STORAGE_POOL_MOUNT_BASE_PATH, storagePool.getUuid(),
+                migration.getUuid());
+    }
+
+    private String getTargetDiskFileName(VmwareCbtMigrationDiskVO disk, String targetFormat) {
+        String sourceName = StringUtils.substringAfterLast(StringUtils.defaultIfBlank(disk.getSourceDiskPath(), disk.getSourceDiskId()), "/");
+        sourceName = StringUtils.substringBeforeLast(StringUtils.defaultIfBlank(sourceName, disk.getSourceDiskId()), ".");
+        return String.format("%s-%s.%s", sanitizeFileName(disk.getSourceDiskId()), sanitizeFileName(sourceName),
+                sanitizeFileName(targetFormat));
+    }
+
+    private String getRbdInitialSyncTargetImageName(VmwareCbtMigrationVO migration, VmwareCbtMigrationDiskVO disk) {
+        String sourceName = StringUtils.substringAfterLast(StringUtils.defaultIfBlank(disk.getSourceDiskPath(), disk.getSourceDiskId()), "/");
+        sourceName = StringUtils.substringBeforeLast(StringUtils.defaultIfBlank(sourceName, disk.getSourceDiskId()), ".");
+        return String.format("cloudstack-cbt-%s-%s-%s", sanitizeFileName(migration.getUuid()),
+                sanitizeFileName(disk.getSourceDiskId()), sanitizeFileName(sourceName));
+    }
+
+    /**
+     * Block-device target names become LINSTOR resource names with a "cs-" prefix and
+     * LINSTOR caps resource names at 48 characters, so the RBD-style naming scheme with
+     * the full migration UUID does not fit. A short migration marker plus the source
+     * disk ID keeps the name unique, identifiable for cleanup and within the limit.
+     */
+    private String getBlockDeviceInitialSyncTargetName(VmwareCbtMigrationVO migration, VmwareCbtMigrationDiskVO disk) {
+        String name = String.format("%s%s", getBlockDeviceTargetMarker(migration.getUuid()),
+                sanitizeFileName(disk.getSourceDiskId()));
+        return name.length() > 44 ? name.substring(0, 44) : name;
+    }
+
+    static String getBlockDeviceTargetMarker(String migrationUuid) {
+        return String.format("cbt-%s-", StringUtils.defaultString(migrationUuid).replace("-", "").substring(0, 8));
+    }
+
+    private String sanitizeFileName(String value) {
+        String sanitized = StringUtils.defaultIfBlank(value, "disk").replaceAll("[^A-Za-z0-9._-]", "-");
+        return StringUtils.defaultIfBlank(sanitized, "disk");
+    }
+
+    private VmwareCbtMigrationResponse runInitialFullSync(VmwareSource source, VmwareCbtMigrationVO migration,
+                                                          VmwareCbtStorageTarget storageTarget) {
+        VmwareCbtSnapshotInfo baselineSnapshot = null;
+        try {
+            migration.setCurrentStep("Creating VMware CBT baseline snapshot");
+            migration.setUpdated(new Date());
+            migration = persistMigrationProgress(migration, "baseline snapshot progress");
+
+            baselineSnapshot = createBaselineSnapshot(source, migration);
+            prepareInitialSyncDiskTargets(migration, storageTarget);
+
+            migration.setCurrentStep("Initial VDDK full sync is running on KVM agent");
+            migration.setLastError(null);
+            migration.setUpdated(new Date());
+            migration = persistMigrationProgress(migration, "initial full sync progress");
+
+            HostVO cbtHost = getCbtHostForMigration(migration);
+            StoragePoolVO storagePool = storageTarget == null ? null : storageTarget.getPool();
+            VmwareCbtPrepareCommand prepareCommand = new VmwareCbtPrepareCommand(migration.getUuid(),
+                    createRemoteInstance(source, migration, baselineSnapshot.getSourceVmMor()), getDiskTransferObjects(migration),
+                    storagePool == null ? null : storagePool.getPoolType(),
+                    storagePool == null ? null : storagePool.getUuid(),
+                    storageTarget == null ? null : storageTarget.getTargetStorageType(),
+                    baselineSnapshot.getSnapshotMor());
+            applyVddkDetails(prepareCommand, migration);
+            prepareCommand.setWait(getVmwareCbtMigrationAgentCommandTimeout());
+
+            VmwareCbtMigrationAnswer answer = sendVmwareCbtCommand(cbtHost, prepareCommand, "prepare",
+                    migration.getUuid());
+            if (!answer.getResult()) {
+                markInitialSyncDisksFailed(migration);
+                markMigrationFailed(migration, "Initial VDDK full sync failed", sanitizeSensitiveMessage(answer.getDetails(), source));
+                return createVmwareCbtMigrationResponse(vmwareCbtMigrationDao.findById(migration.getId()));
+            }
+
+            applyDiskResults(migration, answer.getDiskResults());
+            migration.setCurrentStep("Recording VMware CBT baseline metadata");
+            migration.setUpdated(new Date());
+            migration = persistMigrationProgress(migration, "baseline metadata progress");
+
+            refreshBaselineDiskChangeIds(source, migration, baselineSnapshot.getSnapshotMor());
+            validateInitialSyncTargetDisks(migration);
+            migration = vmwareCbtMigrationDao.findById(migration.getId());
+            migration.setState(VmwareCbtMigration.State.Replicating);
+            migration.setCurrentStep("Initial VDDK full sync completed; ready for CBT delta synchronization");
+            migration.setLastError(null);
+            migration.setUpdated(new Date());
+            migration = persistMigrationProgress(migration, "initial full sync result");
+            return createVmwareCbtMigrationResponse(migration);
+        } catch (RuntimeException e) {
+            String error = sanitizeSensitiveMessage(StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()), source);
+            markInitialSyncDisksFailed(migration);
+            markMigrationFailed(migration, "Initial VDDK full sync failed", error);
+            return createVmwareCbtMigrationResponse(vmwareCbtMigrationDao.findById(migration.getId()));
+        } finally {
+            removeDeltaSnapshotIfPossible(source, migration, baselineSnapshot);
+        }
+    }
+
+    private VmwareCbtSnapshotInfo createBaselineSnapshot(VmwareSource source, VmwareCbtMigrationVO migration) {
+        String snapshotName = String.format("cloudstack-cbt-%s-baseline", migration.getUuid());
+        String description = String.format("CloudStack VMware CBT migration %s baseline", migration.getUuid());
+        return getVmwareCbtMigrationService().createSnapshot(source.vcenter, source.datacenterName, source.username,
+                source.password, source.sourceHost, migration.getSourceVmName(), snapshotName, description, false);
+    }
+
+    private void refreshBaselineDiskChangeIds(VmwareSource source, VmwareCbtMigrationVO migration,
+                                              String snapshotMor) {
+        List<VmwareCbtDiskInfo> sourceDisks = getVmwareCbtMigrationService().listSnapshotDisks(source.vcenter,
+                source.datacenterName, source.username, source.password, source.sourceHost,
+                migration.getSourceVmName(), snapshotMor);
+        if (CollectionUtils.isEmpty(sourceDisks)) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR,
+                    String.format("No source disks were discovered in VMware CBT baseline snapshot %s for VM %s",
+                            snapshotMor, migration.getSourceVmName()));
+        }
+        for (VmwareCbtMigrationDiskVO disk : vmwareCbtMigrationDiskDao.listByMigrationId(migration.getId())) {
+            VmwareCbtDiskInfo sourceDisk = findSourceDisk(sourceDisks, disk);
+            if (sourceDisk == null) {
+                throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR,
+                        String.format("Unable to refresh VMware CBT baseline metadata for source disk %s",
+                                disk.getSourceDiskId()));
+            }
+            if (sourceDisk.getSourceDiskDeviceKey() != null) {
+                disk.setSourceDiskDeviceKey(sourceDisk.getSourceDiskDeviceKey());
+            }
+            if (StringUtils.isNotBlank(sourceDisk.getChangeId())) {
+                disk.setChangeId(sourceDisk.getChangeId());
+            }
+            disk.setSnapshotMor(snapshotMor);
+            disk.setUpdated(new Date());
+            vmwareCbtMigrationDiskDao.update(disk.getId(), disk);
+        }
+    }
+
+    private VmwareCbtDiskInfo findSourceDisk(List<VmwareCbtDiskInfo> sourceDisks, VmwareCbtMigrationDiskVO disk) {
+        for (VmwareCbtDiskInfo sourceDisk : sourceDisks) {
+            if (StringUtils.equals(sourceDisk.getSourceDiskId(), disk.getSourceDiskId()) ||
+                    StringUtils.equals(sourceDisk.getSourceDiskPath(), disk.getSourceDiskPath()) ||
+                    (sourceDisk.getSourceDiskDeviceKey() != null &&
+                            sourceDisk.getSourceDiskDeviceKey().equals(disk.getSourceDiskDeviceKey()))) {
+                return sourceDisk;
+            }
+        }
+        return null;
+    }
+
+    private void validateInitialSyncTargetDisks(VmwareCbtMigrationVO migration) {
+        List<VmwareCbtMigrationDiskVO> disks = vmwareCbtMigrationDiskDao.listByMigrationId(migration.getId());
+        if (CollectionUtils.isEmpty(disks)) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    String.format("VMware CBT migration %s has no discovered source disks", migration.getUuid()));
+        }
+        for (VmwareCbtMigrationDiskVO disk : disks) {
+            if (StringUtils.isBlank(disk.getTargetPath())) {
+                throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                        String.format("VMware CBT migration %s cannot run delta sync before initial full sync registers target disk path for source disk %s",
+                                migration.getUuid(), disk.getSourceDiskId()));
+            }
+            if (StringUtils.isBlank(disk.getChangeId())) {
+                throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                        String.format("VMware CBT migration %s completed initial full sync but cannot run delta sync before CloudStack records a baseline change ID for source disk %s",
+                                migration.getUuid(), disk.getSourceDiskId()));
+            }
+        }
+    }
+
+    private VmwareCbtSnapshotInfo createDeltaSnapshot(VmwareSource source, VmwareCbtMigrationVO migration,
+                                                      int cycleNumber) {
+        String snapshotName = String.format("cloudstack-cbt-%s-%s", migration.getUuid(), cycleNumber);
+        String description = String.format("CloudStack VMware CBT migration %s cycle %s", migration.getUuid(),
+                cycleNumber);
+        return getVmwareCbtMigrationService().createSnapshot(source.vcenter, source.datacenterName, source.username,
+                source.password, source.sourceHost, migration.getSourceVmName(), snapshotName, description, false);
+    }
+
+    private VmwareCbtChangedBlockQueryResult queryChangedBlocks(VmwareSource source, VmwareCbtMigrationVO migration,
+                                                                String snapshotMor) {
+        List<VmwareCbtMigrationDiskVO> disks = vmwareCbtMigrationDiskDao.listByMigrationId(migration.getId());
+        List<VmwareCbtDiskInfo> sourceDisks = new ArrayList<>();
+        for (VmwareCbtMigrationDiskVO disk : disks) {
+            sourceDisks.add(new VmwareCbtDiskInfo(disk.getSourceDiskId(), disk.getSourceDiskDeviceKey(), null,
+                    disk.getSourceDiskPath(), disk.getDatastoreName(), disk.getCapacityBytes(), disk.getChangeId()));
+            disk.setSnapshotMor(snapshotMor);
+            disk.setUpdated(new Date());
+            vmwareCbtMigrationDiskDao.update(disk.getId(), disk);
+        }
+
+        List<VmwareCbtChangedDiskInfo> changedDisks = getVmwareCbtMigrationService().queryChangedDiskAreas(source.vcenter,
+                source.datacenterName, source.username, source.password, source.sourceHost,
+                migration.getSourceVmName(), sourceDisks, snapshotMor);
+        List<VmwareCbtChangedBlockRangeTO> changedBlocks = new ArrayList<>();
+        for (VmwareCbtChangedDiskInfo changedDisk : changedDisks) {
+            for (VmwareCbtChangedBlockInfo changedBlock : changedDisk.getChangedBlocks()) {
+                changedBlocks.add(new VmwareCbtChangedBlockRangeTO(changedDisk.getSourceDiskId(),
+                        changedBlock.getStartOffset(), changedBlock.getLength()));
+            }
+        }
+        return new VmwareCbtChangedBlockQueryResult(changedBlocks, changedDisks);
+    }
+
+    private void updateDiskChangeIds(VmwareCbtMigrationVO migration, List<VmwareCbtChangedDiskInfo> changedDisks) {
+        List<VmwareCbtMigrationDiskVO> disks = vmwareCbtMigrationDiskDao.listByMigrationId(migration.getId());
+        for (VmwareCbtMigrationDiskVO disk : disks) {
+            for (VmwareCbtChangedDiskInfo changedDisk : changedDisks) {
+                if (StringUtils.isNotBlank(changedDisk.getNextChangeId()) &&
+                        StringUtils.equals(disk.getSourceDiskId(), changedDisk.getSourceDiskId())) {
+                    disk.setChangeId(changedDisk.getNextChangeId());
+                    disk.setUpdated(new Date());
+                    vmwareCbtMigrationDiskDao.update(disk.getId(), disk);
+                    break;
+                }
+            }
+        }
+    }
+
+    private VmwareCbtMigrationCutoverPolicy getCutoverPolicy() {
+        return new VmwareCbtMigrationCutoverPolicy(VmwareCbtMigrationMinCycles.value(),
+                VmwareCbtMigrationMaxCycles.value(), VmwareCbtMigrationQuietCycles.value(),
+                VmwareCbtMigrationQuietBytes.value(), VmwareCbtMigrationQuietDirtyRate.value());
+    }
+
+    private int getVmwareCbtMigrationAgentCommandTimeout() {
+        Integer timeout = VmwareCbtMigrationAgentCommandTimeout.value();
+        if (timeout == null || timeout <= 0) {
+            return Integer.parseInt(VmwareCbtMigrationAgentCommandTimeout.defaultValue());
+        }
+        return timeout;
+    }
+
+    private long getDirtyRateBytesPerSecond(long changedBytes, long durationSeconds, long reportedDirtyRate) {
+        if (reportedDirtyRate > 0) {
+            return reportedDirtyRate;
+        }
+        if (durationSeconds <= 0) {
+            return changedBytes;
+        }
+        return changedBytes / durationSeconds;
+    }
+
+    private String getCutoverDecisionStep(VmwareCbtMigrationCutoverPolicy.Decision cutoverDecision) {
+        switch (cutoverDecision) {
+            case READY_FOR_CUTOVER:
+                return "Ready for final cutover";
+            case READY_FOR_CUTOVER_MAX_CYCLES:
+                return "Ready for final cutover after reaching maximum CBT delta cycles";
+            case CONTINUE:
+            default:
+                return "CBT delta synchronization completed; continue replication cycles";
+        }
+    }
+
+    private void applyDiskResults(VmwareCbtMigrationVO migration, List<VmwareCbtDiskSyncResultTO> diskResults) {
+        if (CollectionUtils.isEmpty(diskResults)) {
+            return;
+        }
+
+        List<VmwareCbtMigrationDiskVO> disks = vmwareCbtMigrationDiskDao.listByMigrationId(migration.getId());
+        for (VmwareCbtDiskSyncResultTO diskResult : diskResults) {
+            for (VmwareCbtMigrationDiskVO disk : disks) {
+                if (StringUtils.equals(disk.getSourceDiskId(), diskResult.getDiskId())) {
+                    applyDiskResult(disk, diskResult);
+                    break;
+                }
+            }
+        }
+    }
+
+    private void applyDiskResult(VmwareCbtMigrationDiskVO disk, VmwareCbtDiskSyncResultTO diskResult) {
+        if (StringUtils.isNotBlank(diskResult.getTargetPath())) {
+            disk.setTargetPath(diskResult.getTargetPath());
+        }
+        if (StringUtils.isNotBlank(diskResult.getChangeId())) {
+            disk.setChangeId(diskResult.getChangeId());
+        }
+        if (StringUtils.isNotBlank(diskResult.getSnapshotMor())) {
+            disk.setSnapshotMor(diskResult.getSnapshotMor());
+        }
+        disk.setState(diskResult.getResult() ? VmwareCbtMigrationDisk.State.Ready : VmwareCbtMigrationDisk.State.Failed);
+        disk.setUpdated(new Date());
+        vmwareCbtMigrationDiskDao.update(disk.getId(), disk);
+    }
+
+    private void removeDeltaSnapshotIfPossible(VmwareSource source, VmwareCbtMigrationVO migration,
+                                               VmwareCbtSnapshotInfo snapshot) {
+        if (snapshot == null) {
+            return;
+        }
+        removeSnapshotByMorIfPossible(source, migration, snapshot.getSnapshotMor());
+    }
+
+    /**
+     * Remove a snapshot we created on the source VM, retrying while vCenter reports the source is
+     * busy. A single attempt is not enough: right after a cancellation the source is still finishing
+     * the transfer it was serving, vCenter answers "The operation is not allowed in the current
+     * state", and a snapshot dropped at that moment is never retried - it stays on the customer's
+     * production VM growing a delta disk, with nothing in CloudStack showing it exists.
+     */
+    private void removeSnapshotByMorIfPossible(VmwareSource source, VmwareCbtMigrationVO migration, String snapshotMor) {
+        if (source == null || StringUtils.isBlank(snapshotMor)) {
+            return;
+        }
+
+        String lastMessage = null;
+        for (int attempt = 1; attempt <= SNAPSHOT_REMOVAL_ATTEMPTS; attempt++) {
+            try {
+                getVmwareCbtMigrationService().removeSnapshot(source.vcenter, source.datacenterName, source.username,
+                        source.password, source.sourceHost, migration.getSourceVmName(), snapshotMor);
+                clearDiskSnapshotMor(migration, snapshotMor);
+                if (attempt > 1) {
+                    LOGGER.info("Removed VMware CBT snapshot {} for migration {} on attempt {}.",
+                            snapshotMor, migration.getUuid(), attempt);
+                }
+                return;
+            } catch (RuntimeException e) {
+                lastMessage = sanitizeSensitiveMessage(StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()), source);
+                if (attempt == SNAPSHOT_REMOVAL_ATTEMPTS) {
+                    break;
+                }
+                LOGGER.debug("Snapshot {} for migration {} could not be removed yet (attempt {}/{}): {}",
+                        snapshotMor, migration.getUuid(), attempt, SNAPSHOT_REMOVAL_ATTEMPTS, lastMessage);
+                try {
+                    Thread.sleep(SNAPSHOT_REMOVAL_RETRY_INTERVAL_MS);
+                } catch (InterruptedException ie) {
+                    Thread.currentThread().interrupt();
+                    break;
+                }
+            }
+        }
+        LOGGER.warn(String.format("Unable to remove VMware CBT snapshot %s for migration %s after %d attempt(s): %s. "
+                        + "It is still present on source VM %s and must be removed manually.",
+                snapshotMor, migration.getUuid(), SNAPSHOT_REMOVAL_ATTEMPTS, lastMessage, migration.getSourceVmName()));
+    }
+
+    /**
+     * Best-effort removal of every snapshot still recorded against a migration's disks. Called when a
+     * migration is cancelled or deleted, after the target-side cleanup has been requested, so that a
+     * snapshot vCenter refused to drop mid-flight does not outlive the migration record.
+     */
+    void removeLingeringSourceSnapshots(VmwareCbtMigrationVO migration) {
+        VmwareSource source;
+        try {
+            source = resolveVmwareSource(migration, null, null);
+        } catch (RuntimeException e) {
+            LOGGER.debug("Cannot resolve the VMware source for migration {}; skipping source snapshot cleanup.",
+                    migration.getUuid());
+            return;
+        }
+        if (source == null) {
+            return;
+        }
+        Set<String> mors = new LinkedHashSet<>();
+        for (VmwareCbtMigrationDiskVO disk : vmwareCbtMigrationDiskDao.listByMigrationId(migration.getId())) {
+            if (StringUtils.isNotBlank(disk.getSnapshotMor())) {
+                mors.add(disk.getSnapshotMor());
+            }
+        }
+        for (String mor : mors) {
+            removeSnapshotByMorIfPossible(source, migration, mor);
+        }
+    }
+
+    private void clearDiskSnapshotMor(VmwareCbtMigrationVO migration, String snapshotMor) {
+        List<VmwareCbtMigrationDiskVO> disks = vmwareCbtMigrationDiskDao.listByMigrationId(migration.getId());
+        for (VmwareCbtMigrationDiskVO disk : disks) {
+            if (StringUtils.equals(disk.getSnapshotMor(), snapshotMor)) {
+                disk.setSnapshotMor(null);
+                disk.setUpdated(new Date());
+                vmwareCbtMigrationDiskDao.update(disk.getId(), disk);
+            }
+        }
+    }
+
+    private VmwareCbtMigrationService getVmwareCbtMigrationService() {
+        if (vmwareCbtMigrationService == null) {
+            throw new ServerApiException(ApiErrorCode.UNSUPPORTED_ACTION_ERROR,
+                    "VMware CBT migration service is unavailable. Please enable the VMware hypervisor plugin.");
+        }
+        return vmwareCbtMigrationService;
+    }
+
+    private HostVO getCbtHostForMigration(VmwareCbtMigrationVO migration) {
+        ClusterVO destinationCluster = clusterDao.findById(migration.getDestinationClusterId());
+        if (destinationCluster == null) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "Unable to find destination cluster for VMware CBT migration");
+        }
+        VmwareCbtStorageTarget storageTarget = getStorageTargetForMigration(migration);
+        if (migration.getConvertHostId() != null) {
+            return selectCbtHost(migration.getConvertHostId(), destinationCluster, storageTarget);
+        }
+        return selectCbtHost(null, destinationCluster, storageTarget);
+    }
+
+    private VmwareCbtStorageTarget getStorageTargetForMigration(VmwareCbtMigrationVO migration) {
+        StoragePoolVO storagePool = migration.getStoragePoolId() == null ? null :
+                primaryDataStoreDao.findById(migration.getStoragePoolId());
+        return VmwareCbtStorageTarget.forPool(storagePool);
+    }
+
+    private RemoteInstanceTO createRemoteInstance(VmwareSource source, VmwareCbtMigrationVO migration) {
+        return createRemoteInstance(source, migration, null);
+    }
+
+    private RemoteInstanceTO createRemoteInstance(VmwareSource source, VmwareCbtMigrationVO migration,
+                                                  String vmwareMoref) {
+        return new RemoteInstanceTO(migration.getSourceVmName(), null, source.vcenter, source.username, source.password,
+                source.datacenterName, migration.getSourceCluster(), migration.getSourceHost(), vmwareMoref);
+    }
+
+    private void applyVddkDetails(VmwareCbtMigrationVO migration, Map<String, String> details) {
+        if (details == null) {
+            return;
+        }
+        migration.setVddkLibDir(StringUtils.trimToNull(details.get(Host.HOST_VDDK_LIB_DIR)));
+        migration.setVddkTransports(StringUtils.trimToNull(details.get(DETAIL_VDDK_TRANSPORTS)));
+        migration.setVddkThumbprint(StringUtils.trimToNull(details.get(DETAIL_VDDK_THUMBPRINT)));
+    }
+
+    private void applyVddkDetails(VmwareCbtSyncCommand command, VmwareCbtMigrationVO migration) {
+        command.setVddkLibDir(migration.getVddkLibDir());
+        command.setVddkTransports(migration.getVddkTransports());
+        command.setVddkThumbprint(migration.getVddkThumbprint());
+    }
+
+    private void applyVddkDetails(VmwareCbtPrepareCommand command, VmwareCbtMigrationVO migration) {
+        command.setVddkLibDir(migration.getVddkLibDir());
+        command.setVddkTransports(migration.getVddkTransports());
+        command.setVddkThumbprint(migration.getVddkThumbprint());
+    }
+
+    private void applyVddkDetails(VmwareCbtCutoverCommand command, VmwareCbtMigrationVO migration) {
+        command.setVddkLibDir(migration.getVddkLibDir());
+        command.setVddkTransports(migration.getVddkTransports());
+        command.setVddkThumbprint(migration.getVddkThumbprint());
+    }
+
+    private void applyTargetStorageDetails(VmwareCbtSyncCommand command, VmwareCbtMigrationVO migration) {
+        VmwareCbtStorageTarget storageTarget = getStorageTargetForMigration(migration);
+        StoragePoolVO storagePool = storageTarget == null ? null : storageTarget.getPool();
+        command.setDestinationStoragePoolType(storagePool == null ? null : storagePool.getPoolType());
+        command.setDestinationStoragePoolUuid(storagePool == null ? null : storagePool.getUuid());
+        command.setTargetStorageType(storageTarget == null ? null : storageTarget.getTargetStorageType());
+    }
+
+    private void applyTargetStorageDetails(VmwareCbtCutoverCommand command, VmwareCbtMigrationVO migration) {
+        VmwareCbtStorageTarget storageTarget = getStorageTargetForMigration(migration);
+        StoragePoolVO storagePool = storageTarget == null ? null : storageTarget.getPool();
+        command.setDestinationStoragePoolType(storagePool == null ? null : storagePool.getPoolType());
+        command.setDestinationStoragePoolUuid(storagePool == null ? null : storagePool.getUuid());
+        command.setTargetStorageType(storageTarget == null ? null : storageTarget.getTargetStorageType());
+    }
+
+    private void applyTargetStorageDetails(VmwareCbtCleanupCommand command, VmwareCbtMigrationVO migration) {
+        VmwareCbtStorageTarget storageTarget = getStorageTargetForMigration(migration);
+        StoragePoolVO storagePool = storageTarget == null ? null : storageTarget.getPool();
+        command.setDestinationStoragePoolType(storagePool == null ? null : storagePool.getPoolType());
+        command.setDestinationStoragePoolUuid(storagePool == null ? null : storagePool.getUuid());
+        command.setTargetStorageType(storageTarget == null ? null : storageTarget.getTargetStorageType());
+    }
+
+    private List<VmwareCbtDiskTO> getDiskTransferObjects(VmwareCbtMigrationVO migration) {
+        List<VmwareCbtMigrationDiskVO> disks = vmwareCbtMigrationDiskDao.listByMigrationId(migration.getId());
+        List<VmwareCbtDiskTO> diskTOs = new ArrayList<>();
+        for (VmwareCbtMigrationDiskVO disk : disks) {
+            diskTOs.add(new VmwareCbtDiskTO(disk.getSourceDiskId(), disk.getSourceDiskDeviceKey(),
+                    disk.getSourceDiskPath(), disk.getDatastoreName(), disk.getTargetPath(), disk.getTargetFormat(),
+                    disk.getChangeId(), disk.getSnapshotMor(), disk.getCapacityBytes() == null ? 0L : disk.getCapacityBytes()));
+        }
+        return diskTOs;
+    }
+
+    private VmwareCbtMigrationAnswer sendFinalCutoverCommand(HostVO host, VmwareCbtCutoverCommand command,
+                                                             VmwareCbtMigrationVO migration, VmwareSource source) {
+        try {
+            return sendVmwareCbtCommand(host, command, "cut over", migration.getUuid());
+        } catch (RuntimeException e) {
+            String details = sanitizeSensitiveMessage(StringUtils.defaultIfBlank(e.getMessage(), e.getClass().getSimpleName()), source);
+            return new VmwareCbtMigrationAnswer(command, false, details, migration.getUuid());
+        }
+    }
+
+    private VmwareCbtMigrationAnswer sendVmwareCbtCommand(HostVO host, Command command, String action, String migrationUuid) {
+        try {
+            Answer answer = agentManager.send(host.getId(), command);
+            if (answer instanceof VmwareCbtMigrationAnswer) {
+                return (VmwareCbtMigrationAnswer) answer;
+            }
+            return new VmwareCbtMigrationAnswer(command, answer.getResult(), answer.getDetails(), migrationUuid);
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            String message = String.format("Failed to %s VMware CBT migration %s on host %s due to: %s",
+                    action, migrationUuid, host.getName(), e.getMessage());
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, message, e);
+        }
+    }
+
+    /**
+     * Pre-flight for the cutover-time data-disk offering requirement: the final
+     * import needs one disk offering per data disk, but without this check the
+     * mismatch only surfaced AFTER the full initial sync and delta cycles were
+     * paid for. Fail at start instead, while nothing has been copied yet.
+     */
+    protected void validateDataDiskOfferingMappingsForStart(String sourceVmName, List<VmwareCbtDiskInfo> sourceDisks,
+                                                            Map<String, Long> dataDiskOfferingMap,
+                                                            Account owner, DataCenterVO zone) {
+        int dataDiskCount = sourceDisks == null ? 0 : Math.max(0, sourceDisks.size() - 1);
+        int mappedCount = dataDiskOfferingMap == null ? 0 : dataDiskOfferingMap.size();
+        if (dataDiskCount > mappedCount) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, String.format(
+                    "Source VM %s has %d data disk(s) but %d disk offering mapping(s) were provided. " +
+                    "Provide one datadiskofferinglist entry per data disk so the cutover import can place every disk.",
+                    sourceVmName, dataDiskCount, mappedCount));
+        }
+        if (mappedCount > dataDiskCount) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, String.format(
+                    "Source VM %s has %d data disk(s) but %d disk offering mapping(s) were provided. " +
+                    "Remove the extra datadiskofferinglist entries.",
+                    sourceVmName, dataDiskCount, mappedCount));
+        }
+        if (mappedCount == 0) {
+            return;
+        }
+
+        // A matching count is not enough: the import resolves the ROOT disk by elimination, as the
+        // single source disk that carries no mapping. So a mapping naming a disk that does not exist
+        // (a typo, or a stale id) still passes a count check, and worse, mapping the real root while
+        // omitting a genuine data disk leaves that data disk as the "unmapped" one and it silently
+        // becomes ROOT. Validate the identities, not just how many there are.
+        Set<String> sourceDiskIds = sourceDisks.stream()
+                .map(VmwareCbtDiskInfo::getSourceDiskId)
+                .filter(StringUtils::isNotBlank)
+                .collect(Collectors.toSet());
+        List<String> unknownDiskIds = dataDiskOfferingMap.keySet().stream()
+                .filter(diskId -> !sourceDiskIds.contains(diskId))
+                .sorted()
+                .collect(Collectors.toList());
+        if (!unknownDiskIds.isEmpty()) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, String.format(
+                    "Source VM %s has no disk(s) with id %s. Each datadiskofferinglist entry must name a disk of " +
+                    "the source VM; valid ids are %s.",
+                    sourceVmName, StringUtils.join(unknownDiskIds, ", "), StringUtils.join(sourceDiskIds, ", ")));
+        }
+
+        // Resolve every offering now, and check the owner may actually use it, rather than
+        // discovering an unusable or inaccessible offering at cutover after the whole copy is done.
+        for (Map.Entry<String, Long> entry : dataDiskOfferingMap.entrySet()) {
+            DiskOfferingVO diskOffering = diskOfferingDao.findById(entry.getValue());
+            if (diskOffering == null) {
+                throw new ServerApiException(ApiErrorCode.PARAM_ERROR, String.format(
+                        "Disk offering %s mapped to disk %s of source VM %s does not exist.",
+                        entry.getValue(), entry.getKey(), sourceVmName));
+            }
+            accountService.checkAccess(owner, diskOffering, zone);
+        }
+    }
+
+    /**
+     * Validates the caller's NIC-to-network mappings against the NICs the preflight discovered on
+     * the source VM, so a wrong or missing mapping fails at start instead of at cutover import,
+     * after the whole replication has already run. Mirrors the import-side rules in
+     * {@code UnmanagedVMsManagerImpl#getUnmanagedNicNetworkMap}: a source NIC without an explicit
+     * mapping is acceptable only when it carries a VLAN id the import can auto-match a network by,
+     * mappings must name NICs that exist, and mixed adapter types are rejected.
+     */
+    protected void validateNicMappingsForStart(String sourceVmName, List<VmwareCbtPreflightNicInfo> sourceNics,
+                                               Map<String, Long> nicNetworkMap,
+                                               Map<String, Network.IpAddresses> nicIpAddressMap) {
+        if (CollectionUtils.isEmpty(sourceNics)) {
+            return;
+        }
+        Set<String> sourceNicIds = sourceNics.stream()
+                .map(VmwareCbtPreflightNicInfo::getSourceNicId)
+                .filter(StringUtils::isNotBlank)
+                .collect(Collectors.toSet());
+
+        String adapterType = null;
+        for (VmwareCbtPreflightNicInfo nic : sourceNics) {
+            if (StringUtils.isBlank(nic.getAdapterType())) {
+                continue;
+            }
+            if (adapterType == null) {
+                adapterType = nic.getAdapterType();
+            } else if (!adapterType.equals(nic.getAdapterType())) {
+                throw new ServerApiException(ApiErrorCode.PARAM_ERROR, String.format(
+                        "Source VM %s has network adapters of different types (%s, %s), which the cutover import " +
+                        "does not support. Make all source network adapters the same type before starting the migration.",
+                        sourceVmName, adapterType, nic.getAdapterType()));
+            }
+        }
+
+        List<String> unmappedNicIds = new ArrayList<>();
+        for (VmwareCbtPreflightNicInfo nic : sourceNics) {
+            String nicId = nic.getSourceNicId();
+            if (StringUtils.isBlank(nicId) || (nicNetworkMap != null && nicNetworkMap.containsKey(nicId))) {
+                continue;
+            }
+            // The import can still auto-match a network by VLAN id for an unmapped NIC.
+            if (nic.getVlan() == null || nic.getVlan() == 0) {
+                unmappedNicIds.add(nicId);
+            }
+        }
+        if (!unmappedNicIds.isEmpty()) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, String.format(
+                    "Source VM %s has %d NIC(s) but NIC(s) %s have no network mapping and no VLAN to auto-match a " +
+                    "network by. Provide a nicnetworklist entry per source NIC so the cutover import can connect every NIC.",
+                    sourceVmName, sourceNics.size(), StringUtils.join(unmappedNicIds, ", ")));
+        }
+
+        List<String> unknownMappedNicIds = new ArrayList<>();
+        if (nicNetworkMap != null) {
+            nicNetworkMap.keySet().stream().filter(nicId -> !sourceNicIds.contains(nicId)).forEach(unknownMappedNicIds::add);
+        }
+        if (nicIpAddressMap != null) {
+            nicIpAddressMap.keySet().stream()
+                    .filter(nicId -> !sourceNicIds.contains(nicId) && !unknownMappedNicIds.contains(nicId))
+                    .forEach(unknownMappedNicIds::add);
+        }
+        if (!unknownMappedNicIds.isEmpty()) {
+            Collections.sort(unknownMappedNicIds);
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, String.format(
+                    "Source VM %s has no NIC(s) with id %s. Each nicnetworklist and nicipaddresslist entry must name " +
+                    "a NIC of the source VM; valid ids are %s.",
+                    sourceVmName, StringUtils.join(unknownMappedNicIds, ", "), StringUtils.join(sourceNicIds, ", ")));
+        }
+    }
+
+    private void markCycleFailed(VmwareCbtMigrationCycleVO cycle, String details) {
+        cycle.setState(VmwareCbtMigrationCycle.State.Failed);
+        cycle.setDescription(details);
+        cycle.setUpdated(new Date());
+        vmwareCbtMigrationCycleDao.update(cycle.getId(), cycle);
+    }
+
+    private void markMigrationFailed(VmwareCbtMigrationVO migration, String currentStep, String details) {
+        migration.setState(VmwareCbtMigration.State.Failed);
+        migration.setCurrentStep(currentStep);
+        migration.setLastError(details);
+        migration.setUpdated(new Date());
+        if (!vmwareCbtMigrationDao.updateIfNotTerminal(migration)) {
+            // e.g. a cancel raced with an in-flight sync: keep the operator-driven
+            // terminal state (Cancelled) instead of overwriting it when the aborted
+            // sync's failure lands afterwards.
+            LOGGER.debug("Not marking VMware CBT migration {} as Failed: it already reached a terminal state",
+                    migration.getUuid());
+        }
+    }
+
+    /**
+     * Persists a progress update from a long-running job, unless the migration reached a terminal
+     * state meanwhile - typically an operator cancelling it while this job was still in flight.
+     * Cancelling removes the target disks, so writing a non-terminal state back afterwards would
+     * leave a record that claims to be replicating onto disks that no longer exist and that can no
+     * longer be deleted.
+     *
+     * @return the record as it now stands: the caller's update when it was applied, otherwise the
+     *         stored terminal record, so responses reflect what is actually persisted.
+     */
+    private VmwareCbtMigrationVO persistMigrationProgress(VmwareCbtMigrationVO migration, String progressDescription) {
+        if (vmwareCbtMigrationDao.updateIfNotTerminal(migration)) {
+            return migration;
+        }
+        VmwareCbtMigrationVO current = vmwareCbtMigrationDao.findById(migration.getId());
+        LOGGER.info("Not recording {} for VMware CBT migration {}: it already reached terminal state {}.",
+                progressDescription, migration.getUuid(), current == null ? "unknown" : current.getState());
+        return current == null ? migration : current;
+    }
+
+    private void markInitialSyncDisksFailed(VmwareCbtMigrationVO migration) {
+        for (VmwareCbtMigrationDiskVO disk : vmwareCbtMigrationDiskDao.listByMigrationId(migration.getId())) {
+            if (disk.getState() == VmwareCbtMigrationDisk.State.Syncing || disk.getState() == VmwareCbtMigrationDisk.State.Created) {
+                disk.setState(VmwareCbtMigrationDisk.State.Failed);
+                disk.setUpdated(new Date());
+                vmwareCbtMigrationDiskDao.update(disk.getId(), disk);
+            }
+        }
+    }
+
+    private String sanitizeSensitiveMessage(String message, VmwareSource source) {
+        String sanitized = StringUtils.defaultString(message);
+        if (source == null) {
+            return sanitized;
+        }
+        return redactValue(sanitized, source.password);
+    }
+
+    private String redactValue(String message, String sensitiveValue) {
+        if (StringUtils.isAnyBlank(message, sensitiveValue)) {
+            return message;
+        }
+        return StringUtils.replace(message, sensitiveValue, REDACTED_SECRET);
+    }
+
+    private void sendCleanupCommandIfPossible(VmwareCbtMigrationVO migration) {
+        sendCleanupCommand(migration, false, CLEANUP_WAIT_SECONDS);
+    }
+
+    private void sendCleanupCommandForDelete(VmwareCbtMigrationVO migration) {
+        if (hasActiveMigrationOnSameConvertHost(migration)) {
+            LOGGER.warn("Skipping immediate cleanup for VMware CBT migration {} because conversion host {} is busy with another active VMware CBT migration. " +
+                    "The migration record will be removed; any leftover temporary files under cloudstack-cbt can be cleaned later.",
+                    migration.getUuid(), migration.getConvertHostId());
+            return;
+        }
+        sendCleanupCommand(migration, true, DELETE_CLEANUP_WAIT_SECONDS);
+    }
+
+    private boolean hasActiveMigrationOnSameConvertHost(VmwareCbtMigrationVO migration) {
+        if (migration.getConvertHostId() == null) {
+            return false;
+        }
+        for (VmwareCbtMigrationVO otherMigration : vmwareCbtMigrationDao.listByConvertHostId(migration.getConvertHostId())) {
+            if (otherMigration.getId() != migration.getId() && !otherMigration.getState().isTerminal()) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private void sendCleanupCommand(VmwareCbtMigrationVO migration, boolean failOnCleanupError, int waitSeconds) {
+        // Import may finish after cancellation and record the VM without changing the Cancelled state.
+        // Its target disks now belong to that VM, so neither cancel nor delete may remove them.
+        // This does not prevent source snapshot cleanup or deletion of the migration record.
+        Long importedVmId = migration.getVmId();
+        if (importedVmId == null) {
+            // Re-read before cleanup: an import may have recorded its VM since this caller loaded the migration.
+            VmwareCbtMigrationVO storedMigration = vmwareCbtMigrationDao.findById(migration.getId());
+            if (storedMigration != null) {
+                importedVmId = storedMigration.getVmId();
+            }
+        }
+        if (importedVmId != null) {
+            LOGGER.info("Skipping target disk cleanup for VMware CBT migration {} because it references imported VM {}.",
+                    migration.getUuid(), importedVmId);
+            return;
+        }
+        if (!hasCleanupTargetDisks(migration)) {
+            return;
+        }
+        try {
+            HostVO cbtHost = getCbtHostForMigration(migration);
+            VmwareCbtCleanupCommand cleanupCommand = new VmwareCbtCleanupCommand(migration.getUuid(), getDiskTransferObjects(migration),
+                    true, true, true);
+            applyTargetStorageDetails(cleanupCommand, migration);
+            cleanupCommand.setWait(waitSeconds);
+            VmwareCbtMigrationAnswer answer = sendVmwareCbtCommand(cbtHost, cleanupCommand, "clean up", migration.getUuid());
+            if (!answer.getResult()) {
+                handleCleanupFailure(migration, failOnCleanupError, answer.getDetails());
+            }
+        } catch (ServerApiException e) {
+            handleCleanupFailure(migration, failOnCleanupError, e.getDescription());
+        }
+    }
+
+    private boolean hasCleanupTargetDisks(VmwareCbtMigrationVO migration) {
+        String migrationMarker = String.format("/cloudstack-cbt/%s/", migration.getUuid());
+        String rbdMigrationMarker = String.format("cloudstack-cbt-%s-", migration.getUuid());
+        VmwareCbtStorageTarget storageTarget = getStorageTargetForMigration(migration);
+        for (VmwareCbtMigrationDiskVO disk : vmwareCbtMigrationDiskDao.listByMigrationId(migration.getId())) {
+            String targetPath = StringUtils.defaultString(disk.getTargetPath()).replace('\\', '/');
+            if (StringUtils.contains(targetPath, migrationMarker)) {
+                return true;
+            }
+            if (storageTarget != null && storageTarget.getTargetStorageType() == VmwareCbtTargetStorageType.RBD_RAW &&
+                    StringUtils.contains(targetPath, rbdMigrationMarker)) {
+                return true;
+            }
+            if (storageTarget != null && storageTarget.getTargetStorageType() == VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE &&
+                    targetPath.startsWith(getBlockDeviceTargetMarker(migration.getUuid()))) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private void handleCleanupFailure(VmwareCbtMigrationVO migration, boolean failOnCleanupError, String details) {
+        String error = StringUtils.defaultIfBlank(details,
+                String.format("Unable to clean up VMware CBT migration %s target disks", migration.getUuid()));
+        migration.setLastError(error);
+        migration.setUpdated(new Date());
+        vmwareCbtMigrationDao.update(migration.getId(), migration);
+        if (failOnCleanupError) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, error);
+        }
+    }
+
+    private VmwareCbtMigrationResponse createVmwareCbtMigrationResponse(VmwareCbtMigrationVO migration) {
+        VmwareCbtMigrationResponse response = new VmwareCbtMigrationResponse();
+        response.setId(migration.getUuid());
+
+        DataCenterVO zone = dataCenterDao.findById(migration.getZoneId());
+        if (zone != null) {
+            response.setZoneId(zone.getUuid());
+            response.setZoneName(zone.getName());
+        }
+
+        Account account = accountService.getAccount(migration.getAccountId());
+        if (account != null) {
+            response.setAccountId(account.getUuid());
+            response.setAccountName(account.getAccountName());
+        }
+
+        ClusterVO cluster = clusterDao.findById(migration.getDestinationClusterId());
+        if (cluster != null) {
+            response.setClusterId(cluster.getUuid());
+            response.setClusterName(cluster.getName());
+        }
+
+        if (migration.getConvertHostId() != null) {
+            HostVO host = hostDao.findById(migration.getConvertHostId());
+            if (host != null) {
+                response.setConvertInstanceHostId(host.getUuid());
+                response.setConvertInstanceHostName(host.getName());
+            }
+        }
+
+        if (migration.getStoragePoolId() != null) {
+            StoragePoolVO pool = primaryDataStoreDao.findById(migration.getStoragePoolId());
+            if (pool != null) {
+                response.setStoragePoolId(pool.getUuid());
+                response.setStoragePoolName(pool.getName());
+            }
+        }
+
+        if (migration.getVmId() != null) {
+            UserVmVO vm = userVmDao.findById(migration.getVmId());
+            if (vm != null) {
+                response.setVirtualMachineId(vm.getUuid());
+            }
+        }
+
+        response.setDisplayName(migration.getDisplayName());
+        response.setVcenter(migration.getVcenter());
+        if (migration.getExistingVcenterId() != null) {
+            VmwareDatacenterVO existingDc = vmwareDatacenterDao.findById(migration.getExistingVcenterId());
+            if (existingDc != null) {
+                response.setExistingVcenterId(existingDc.getUuid());
+            }
+        }
+        response.setDatacenterName(migration.getDatacenter());
+        response.setSourceHost(migration.getSourceHost());
+        response.setSourceCluster(migration.getSourceCluster());
+        response.setSourceVmName(migration.getSourceVmName());
+        response.setState(migration.getState().name());
+        response.setCurrentStep(migration.getCurrentStep());
+        response.setCurrentStepDuration(getCurrentStepDuration(migration));
+        response.setLastError(migration.getLastError());
+        response.setCompletedCycles(migration.getCompletedCycles());
+        response.setQuietCycles(migration.getQuietCycles());
+        response.setTotalChangedBytes(migration.getTotalChangedBytes());
+        response.setLastChangedBytes(migration.getLastChangedBytes());
+        response.setLastDirtyRate(migration.getLastDirtyRate());
+        response.setDisks(createVmwareCbtMigrationDiskResponses(migration));
+        response.setCycles(createVmwareCbtMigrationCycleResponses(migration));
+        response.setCreated(migration.getCreated());
+        response.setLastUpdated(migration.getUpdated());
+        response.setObjectName(OBJECT_NAME);
+        return response;
+    }
+
+    String getCurrentStepDuration(VmwareCbtMigrationVO migration) {
+        if (migration == null || migration.getUpdated() == null || migration.getState() == null ||
+                migration.getState().isTerminal()) {
+            return null;
+        }
+        long elapsedSeconds = Math.max(0L,
+                TimeUnit.MILLISECONDS.toSeconds(new Date().getTime() - migration.getUpdated().getTime()));
+        return formatDuration(elapsedSeconds);
+    }
+
+    String formatDuration(long totalSeconds) {
+        long seconds = Math.max(0L, totalSeconds);
+        if (seconds < 60L) {
+            return String.format("%s sec%s", seconds, seconds == 1L ? "" : "s");
+        }
+        long minutes = seconds / 60L;
+        seconds = seconds % 60L;
+        if (minutes < 60L) {
+            return String.format("%s min %s sec%s", minutes, seconds, seconds == 1L ? "" : "s");
+        }
+        long hours = minutes / 60L;
+        minutes = minutes % 60L;
+        return String.format("%s hr %s min %s sec%s", hours, minutes, seconds, seconds == 1L ? "" : "s");
+    }
+
+    private List<VmwareCbtMigrationDiskResponse> createVmwareCbtMigrationDiskResponses(VmwareCbtMigrationVO migration) {
+        List<VmwareCbtMigrationDiskResponse> diskResponses = new ArrayList<>();
+        List<VmwareCbtMigrationDiskVO> disks = vmwareCbtMigrationDiskDao.listByMigrationId(migration.getId());
+        for (VmwareCbtMigrationDiskVO disk : disks) {
+            VmwareCbtMigrationDiskResponse diskResponse = new VmwareCbtMigrationDiskResponse();
+            diskResponse.setId(disk.getUuid());
+            diskResponse.setSourceDiskId(disk.getSourceDiskId());
+            diskResponse.setSourceDiskDeviceKey(disk.getSourceDiskDeviceKey());
+            diskResponse.setSourceDiskPath(disk.getSourceDiskPath());
+            diskResponse.setDatastoreName(disk.getDatastoreName());
+            diskResponse.setCapacityBytes(disk.getCapacityBytes());
+            diskResponse.setTargetPath(disk.getTargetPath());
+            diskResponse.setTargetFormat(disk.getTargetFormat());
+            diskResponse.setChangeId(disk.getChangeId());
+            diskResponse.setSnapshotMor(disk.getSnapshotMor());
+            diskResponse.setState(disk.getState().name());
+            diskResponse.setObjectName("vmwarecbtmigrationdisk");
+            diskResponses.add(diskResponse);
+        }
+        return diskResponses;
+    }
+
+    private List<VmwareCbtMigrationCycleResponse> createVmwareCbtMigrationCycleResponses(VmwareCbtMigrationVO migration) {
+        List<VmwareCbtMigrationCycleResponse> cycleResponses = new ArrayList<>();
+        List<VmwareCbtMigrationCycleVO> cycles = vmwareCbtMigrationCycleDao.listByMigrationId(migration.getId());
+        for (VmwareCbtMigrationCycleVO cycle : cycles) {
+            VmwareCbtMigrationCycleResponse cycleResponse = new VmwareCbtMigrationCycleResponse();
+            cycleResponse.setId(cycle.getUuid());
+            cycleResponse.setCycleNumber(cycle.getCycleNumber());
+            cycleResponse.setSnapshotMor(cycle.getSnapshotMor());
+            cycleResponse.setChangedBytes(cycle.getChangedBytes());
+            cycleResponse.setDirtyRate(cycle.getDirtyRate());
+            cycleResponse.setDuration(cycle.getDuration());
+            cycleResponse.setState(cycle.getState().name());
+            cycleResponse.setDescription(cycle.getDescription());
+            cycleResponse.setCreated(cycle.getCreated());
+            cycleResponse.setLastUpdated(cycle.getUpdated());
+            cycleResponse.setObjectName("vmwarecbtmigrationcycle");
+            cycleResponses.add(cycleResponse);
+        }
+        return cycleResponses;
+    }
+
+    @Override
+    public String getConfigComponentName() {
+        return VmwareCbtMigrationManagerImpl.class.getSimpleName();
+    }
+
+    @Override
+    public ConfigKey<?>[] getConfigKeys() {
+        return new ConfigKey<?>[] {
+                VmwareCbtMigrationMinCycles,
+                VmwareCbtMigrationMaxCycles,
+                VmwareCbtMigrationQuietCycles,
+                VmwareCbtMigrationQuietBytes,
+                VmwareCbtMigrationQuietDirtyRate,
+                VmwareCbtAllowNonInPlaceFinalization,
+                VmwareCbtMigrationAgentCommandTimeout
+        };
+    }
+
+    private static class VmwareSource {
+        private final Long existingVcenterId;
+        private final String vcenter;
+        private final String datacenterName;
+        private final String username;
+        private final String password;
+        private final String sourceHost;
+
+        private VmwareSource(Long existingVcenterId, String vcenter, String datacenterName, String username,
+                             String password, String sourceHost) {
+            this.existingVcenterId = existingVcenterId;
+            this.vcenter = vcenter;
+            this.datacenterName = datacenterName;
+            this.username = username;
+            this.password = password;
+            this.sourceHost = sourceHost;
+        }
+    }
+
+    private static class VmwareCbtChangedBlockQueryResult {
+        private final List<VmwareCbtChangedBlockRangeTO> changedBlocks;
+        private final List<VmwareCbtChangedDiskInfo> changedDisks;
+
+        private VmwareCbtChangedBlockQueryResult(List<VmwareCbtChangedBlockRangeTO> changedBlocks,
+                                                 List<VmwareCbtChangedDiskInfo> changedDisks) {
+            this.changedBlocks = changedBlocks;
+            this.changedDisks = changedDisks;
+        }
+    }
+
+    static class VmwareCbtOfferingResources {
+        private final Integer cpuNumber;
+        private final Integer cpuSpeed;
+        private final Integer memoryMb;
+
+        VmwareCbtOfferingResources(Integer cpuNumber, Integer cpuSpeed, Integer memoryMb) {
+            this.cpuNumber = cpuNumber;
+            this.cpuSpeed = cpuSpeed;
+            this.memoryMb = memoryMb;
+        }
+
+        Integer getCpuNumber() {
+            return cpuNumber;
+        }
+
+        Integer getCpuSpeed() {
+            return cpuSpeed;
+        }
+
+        Integer getMemoryMb() {
+            return memoryMb;
+        }
+    }
+
+    private static class PreflightFindingCollector {
+        private final List<VmwareCbtMigrationPreflightFindingResponse> findings = new ArrayList<>();
+        private boolean hasFailures;
+
+        void pass(String code, String component, String resource, String message) {
+            add("PASS", code, component, resource, message);
+        }
+
+        void warn(String code, String component, String resource, String message) {
+            add("WARN", code, component, resource, message);
+        }
+
+        void fail(String code, String component, String resource, String message) {
+            hasFailures = true;
+            add("FAIL", code, component, resource, message);
+        }
+
+        private void add(String severity, String code, String component, String resource, String message) {
+            findings.add(new VmwareCbtMigrationPreflightFindingResponse(severity, code, component,
+                    resource, message));
+        }
+
+        List<VmwareCbtMigrationPreflightFindingResponse> getFindings() {
+            return findings;
+        }
+
+        boolean hasFailures() {
+            return hasFailures;
+        }
+    }
+}
diff --git a/server/src/main/java/org/apache/cloudstack/vm/VmwareCbtStorageTarget.java b/server/src/main/java/org/apache/cloudstack/vm/VmwareCbtStorageTarget.java
new file mode 100644
index 000000000000..cbf0c1b279ad
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/vm/VmwareCbtStorageTarget.java
@@ -0,0 +1,89 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+
+import com.cloud.agent.api.to.VmwareCbtTargetStorageType;
+import com.cloud.storage.Storage;
+
+class VmwareCbtStorageTarget {
+
+    private final StoragePoolVO pool;
+    private final VmwareCbtTargetStorageType targetStorageType;
+    private final boolean supported;
+    private final boolean requiresInPlaceFinalization;
+    private final String supportMessage;
+
+    private VmwareCbtStorageTarget(StoragePoolVO pool, VmwareCbtTargetStorageType targetStorageType,
+                                   boolean supported, boolean requiresInPlaceFinalization, String supportMessage) {
+        this.pool = pool;
+        this.targetStorageType = targetStorageType;
+        this.supported = supported;
+        this.requiresInPlaceFinalization = requiresInPlaceFinalization;
+        this.supportMessage = supportMessage;
+    }
+
+    static VmwareCbtStorageTarget forPool(StoragePoolVO pool) {
+        if (pool == null) {
+            return new VmwareCbtStorageTarget(null, VmwareCbtTargetStorageType.QCOW2_FILE, true, false,
+                    "No explicit pool selected; CloudStack will use the default filesystem target path.");
+        }
+
+        Storage.StoragePoolType poolType = pool.getPoolType();
+        if (poolType == Storage.StoragePoolType.NetworkFilesystem ||
+                poolType == Storage.StoragePoolType.Filesystem ||
+                poolType == Storage.StoragePoolType.SharedMountPoint) {
+            return new VmwareCbtStorageTarget(pool, VmwareCbtTargetStorageType.QCOW2_FILE, true, false,
+                    "Filesystem-like primary storage will use qcow2 file targets.");
+        }
+        if (poolType == Storage.StoragePoolType.RBD) {
+            return new VmwareCbtStorageTarget(pool, VmwareCbtTargetStorageType.RBD_RAW, true, true,
+                    "Ceph/RBD primary storage will use raw RBD targets and requires in-place finalization.");
+        }
+        if (poolType == Storage.StoragePoolType.Linstor) {
+            return new VmwareCbtStorageTarget(pool, VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE, true, true,
+                    "Linstor primary storage will use raw block device targets and requires in-place finalization.");
+        }
+        return new VmwareCbtStorageTarget(pool, VmwareCbtTargetStorageType.QCOW2_FILE, false, true,
+                String.format("Storage pool type %s is not supported for VMware CBT migration targets.", poolType));
+    }
+
+    StoragePoolVO getPool() {
+        return pool;
+    }
+
+    VmwareCbtTargetStorageType getTargetStorageType() {
+        return targetStorageType;
+    }
+
+    boolean isSupported() {
+        return supported;
+    }
+
+    boolean requiresInPlaceFinalization() {
+        return requiresInPlaceFinalization;
+    }
+
+    boolean supportsNonInPlaceFinalizationFallback() {
+        return supported && targetStorageType == VmwareCbtTargetStorageType.QCOW2_FILE;
+    }
+
+    String getSupportMessage() {
+        return supportMessage;
+    }
+}
diff --git a/server/src/main/resources/META-INF/cloudstack/server-compute/spring-server-compute-context.xml b/server/src/main/resources/META-INF/cloudstack/server-compute/spring-server-compute-context.xml
index 3afae7676b7b..adca6ac7b001 100644
--- a/server/src/main/resources/META-INF/cloudstack/server-compute/spring-server-compute-context.xml
+++ b/server/src/main/resources/META-INF/cloudstack/server-compute/spring-server-compute-context.xml
@@ -39,4 +39,6 @@
 
     <bean id="importVmTasksManager" class="org.apache.cloudstack.vm.ImportVmTasksManagerImpl" />
 
+    <bean id="vmwareCbtMigrationManager" class="org.apache.cloudstack.vm.VmwareCbtMigrationManagerImpl" />
+
 </beans>
diff --git a/server/src/test/java/com/cloud/vm/UserVmImportTemplateTest.java b/server/src/test/java/com/cloud/vm/UserVmImportTemplateTest.java
new file mode 100644
index 000000000000..ef545d31e593
--- /dev/null
+++ b/server/src/test/java/com/cloud/vm/UserVmImportTemplateTest.java
@@ -0,0 +1,206 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.vm;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertThrows;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.doAnswer;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.mockStatic;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.verifyNoMoreInteractions;
+import static org.mockito.Mockito.when;
+
+import java.util.Collections;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.LinkedHashMap;
+import java.util.Map;
+
+import org.apache.cloudstack.context.CallContext;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.MockedStatic;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import com.cloud.dc.DataCenter;
+import com.cloud.exception.InsufficientCapacityException;
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.hypervisor.Hypervisor.HypervisorType;
+import com.cloud.offering.ServiceOffering;
+import com.cloud.storage.GuestOSCategoryVO;
+import com.cloud.storage.GuestOSVO;
+import com.cloud.storage.Storage.ImageFormat;
+import com.cloud.storage.VMTemplateVO;
+import com.cloud.storage.dao.GuestOSCategoryDao;
+import com.cloud.storage.dao.GuestOSDao;
+import com.cloud.storage.dao.VMTemplateDao;
+import com.cloud.template.VirtualMachineTemplate;
+import com.cloud.user.Account;
+import com.cloud.uservm.UserVm;
+import com.cloud.utils.db.Transaction;
+import com.cloud.utils.db.TransactionCallbackWithException;
+import com.cloud.utils.db.UUIDManager;
+import com.cloud.vm.dao.UserVmDao;
+
+public class UserVmImportTemplateTest {
+    private final UserVmManagerImpl manager = new UserVmManagerImpl();
+    private final VMTemplateDao templateDao = mock(VMTemplateDao.class);
+    private final UserVmDao vmDao = mock(UserVmDao.class);
+    private final DataCenter zone = mock(DataCenter.class);
+    private final Account owner = mock(Account.class);
+    private final ServiceOffering offering = mock(ServiceOffering.class);
+
+    @Before
+    public void setUp() {
+        UUIDManager uuidManager = mock(UUIDManager.class);
+        GuestOSDao guestOSDao = mock(GuestOSDao.class);
+        GuestOSCategoryDao categoryDao = mock(GuestOSCategoryDao.class);
+        GuestOSVO guestOS = mock(GuestOSVO.class);
+        ReflectionTestUtils.setField(manager, "_templateDao", templateDao);
+        ReflectionTestUtils.setField(manager, "_vmDao", vmDao);
+        ReflectionTestUtils.setField(manager, "_uuidMgr", uuidManager);
+        ReflectionTestUtils.setField(manager, "_itMgr", mock(VirtualMachineManager.class));
+        ReflectionTestUtils.setField(manager, "_guestOSDao", guestOSDao);
+        ReflectionTestUtils.setField(manager, "_guestOSCategoryDao", categoryDao);
+        when(zone.getId()).thenReturn(1L);
+        when(owner.getId()).thenReturn(10L);
+        when(owner.getDomainId()).thenReturn(11L);
+        when(offering.getId()).thenReturn(12L);
+        when(vmDao.getNextInSequence(Long.class, "id")).thenReturn(42L);
+        when(uuidManager.generateUuid(UserVm.class, null)).thenReturn("b90b3f01-bbbd-4129-af59-d628c92d935f");
+        when(guestOSDao.findById(5L)).thenReturn(guestOS);
+        when(guestOS.getCategoryId()).thenReturn(6L);
+        when(categoryDao.findById(6L)).thenReturn(mock(GuestOSCategoryVO.class));
+    }
+
+    @Test
+    public void importsSoftDeletedDummyTemplateWithoutReloadingIt() throws InsufficientCapacityException {
+        VMTemplateVO template = createTemplate();
+        template.setRemoved(new Date());
+        template.setState(VirtualMachineTemplate.State.Inactive);
+        doAnswer(invocation -> {
+            template.setDetails(new HashMap<>());
+            return null;
+        }).when(templateDao).loadDetails(template);
+
+        UserVmVO vm = importTemplate(template);
+
+        assertNotNull(vm);
+        assertEquals(203L, vm.getTemplateId());
+        assertNotNull(template.getRemoved());
+        verify(templateDao).loadDetails(template);
+        verifyNoMoreInteractions(templateDao);
+        verify(vmDao).persist(vm);
+    }
+
+    @Test
+    public void copiesLoadedCpuModeFromActiveTemplateIntoImportedVm() throws InsufficientCapacityException {
+        VMTemplateVO template = createTemplate();
+        template.setState(VirtualMachineTemplate.State.Active);
+        doAnswer(invocation -> {
+            template.setDetails(Collections.singletonMap("guest.cpu.mode", "host-passthrough"));
+            return null;
+        }).when(templateDao).loadDetails(template);
+
+        UserVmVO vm = importTemplate(template);
+
+        assertEquals("host-passthrough", vm.getDetail("guest.cpu.mode"));
+        verify(templateDao).loadDetails(template);
+        verifyNoMoreInteractions(templateDao);
+        verify(vmDao).saveDetails(vm, Collections.emptyList());
+    }
+
+    @Test
+    public void importsNonVoTemplateUsingItsExistingDetails() throws InsufficientCapacityException {
+        VirtualMachineTemplate template = mock(VirtualMachineTemplate.class);
+        when(template.getId()).thenReturn(204L);
+        when(template.getFormat()).thenReturn(ImageFormat.QCOW2);
+        when(template.getDetails()).thenReturn(Collections.singletonMap("guest.cpu.mode", "host-model"));
+
+        UserVmVO vm = importTemplate(template);
+
+        assertEquals(204L, vm.getTemplateId());
+        assertEquals("host-model", vm.getDetail("guest.cpu.mode"));
+        verifyNoInteractions(templateDao);
+    }
+
+    @Test
+    public void explicitVmCpuDetailsOverrideTemplateDefaults() throws InsufficientCapacityException {
+        VMTemplateVO template = createTemplate();
+        doAnswer(invocation -> {
+            template.setDetails(Map.of(VmDetailConstants.GUEST_CPU_MODE, "custom",
+                    VmDetailConstants.GUEST_CPU_MODEL, "Skylake-Client"));
+            return null;
+        }).when(templateDao).loadDetails(template);
+        Map<String, String> vmDetails = Map.of(VmDetailConstants.GUEST_CPU_MODE, "custom",
+                VmDetailConstants.GUEST_CPU_MODEL, "EPYC");
+
+        UserVmVO vm = importTemplate(template, vmDetails);
+
+        assertEquals("custom", vm.getDetail(VmDetailConstants.GUEST_CPU_MODE));
+        assertEquals("EPYC", vm.getDetail(VmDetailConstants.GUEST_CPU_MODEL));
+        assertEquals("Skylake-Client", template.getDetails().get(VmDetailConstants.GUEST_CPU_MODEL));
+    }
+
+    @Test
+    public void explicitVmCpuModeOverridesTemplateMode() throws InsufficientCapacityException {
+        VMTemplateVO template = createTemplate();
+        doAnswer(invocation -> {
+            template.setDetails(Collections.singletonMap(VmDetailConstants.GUEST_CPU_MODE, "host-passthrough"));
+            return null;
+        }).when(templateDao).loadDetails(template);
+
+        UserVmVO vm = importTemplate(template, Collections.singletonMap(VmDetailConstants.GUEST_CPU_MODE, "host-model"));
+
+        assertEquals("host-model", vm.getDetail(VmDetailConstants.GUEST_CPU_MODE));
+    }
+
+    @Test
+    public void stillRejectsMissingTemplate() {
+        InvalidParameterValueException exception = assertThrows(InvalidParameterValueException.class, () -> importTemplate(null));
+
+        assertEquals("Unable to import virtual machine without a template", exception.getMessage());
+        verifyNoInteractions(templateDao, vmDao);
+    }
+
+    private VMTemplateVO createTemplate() {
+        return VMTemplateVO.createSystemIso(203L, "import-test-template", "import-test-template", false,
+                "", true, 64, Account.ACCOUNT_ID_SYSTEM, "", "Import test template", false, 5L);
+    }
+
+    private UserVmVO importTemplate(VirtualMachineTemplate template) throws InsufficientCapacityException {
+        return importTemplate(template, new HashMap<>());
+    }
+
+    private UserVmVO importTemplate(VirtualMachineTemplate template, Map<String, String> vmDetails) throws InsufficientCapacityException {
+        try (MockedStatic<Transaction> transaction = mockStatic(Transaction.class);
+                MockedStatic<CallContext> context = mockStatic(CallContext.class)) {
+            transaction.when(() -> Transaction.execute(any(TransactionCallbackWithException.class))).thenAnswer(invocation -> {
+                TransactionCallbackWithException<UserVm, InsufficientCapacityException> callback = invocation.getArgument(0);
+                return callback.doInTransaction(null);
+            });
+            context.when(CallContext::current).thenReturn(mock(CallContext.class));
+            return (UserVmVO) manager.importVM(zone, null, template, "import-test-vm", "Import test VM", owner,
+                    null, owner, true, null, 10L, 20L, offering, null, 5L, null, HypervisorType.KVM,
+                    vmDetails, VirtualMachine.PowerState.PowerOff, new LinkedHashMap<>());
+        }
+    }
+}
diff --git a/server/src/test/java/org/apache/cloudstack/storage/volume/VolumeImportUnmanageManagerImplTest.java b/server/src/test/java/org/apache/cloudstack/storage/volume/VolumeImportUnmanageManagerImplTest.java
index f3ed13c3d6ba..7cb3f7b6cfa3 100644
--- a/server/src/test/java/org/apache/cloudstack/storage/volume/VolumeImportUnmanageManagerImplTest.java
+++ b/server/src/test/java/org/apache/cloudstack/storage/volume/VolumeImportUnmanageManagerImplTest.java
@@ -62,6 +62,9 @@
 import org.apache.cloudstack.api.response.VolumeResponse;
 import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.engine.orchestration.service.VolumeOrchestrationService;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreManager;
+import org.apache.cloudstack.engine.subsystem.api.storage.PrimaryDataStoreDriver;
 import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
@@ -134,6 +137,26 @@ public class VolumeImportUnmanageManagerImplTest {
     private VolumeApiService volumeApiService;
     @Mock
     private SnapshotDataStoreDao snapshotDataStoreDao;
+    @Mock
+    private DataStoreManager dataStoreManager;
+
+    @Test
+    public void linstorWrongGroupIsRejectedBeforeAgentInspection() {
+        StoragePoolVO pool = mock(StoragePoolVO.class);
+        DataStore store = mock(DataStore.class);
+        PrimaryDataStoreDriver driver = mock(PrimaryDataStoreDriver.class);
+        when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.Linstor);
+        when(pool.getId()).thenReturn(42L);
+        when(dataStoreManager.getPrimaryDataStore(42L)).thenReturn(store);
+        when(store.getDriver()).thenReturn(driver);
+        doThrow(new CloudRuntimeException("resource group mismatch")).when(driver).validateVolumeForImport(pool, "disk");
+
+        Assert.assertThrows(CloudRuntimeException.class,
+                () -> volumeImportUnmanageManager.listVolumesForImportInternal(pool, "disk", null));
+
+        verify(driver).validateVolumeForImport(pool, "disk");
+        Mockito.verifyNoInteractions(agentManager, volumeManager);
+    }
 
     @Mock
     StoragePoolVO storagePoolVO;
@@ -290,6 +313,55 @@ public void testImportVolumeAllGood() throws ResourceAllocationException {
         }
     }
 
+    @Test
+    public void testImportVolumeForwardsRbdPoolTypeToOrchestrator() throws ResourceAllocationException {
+        ImportVolumeCmd cmd = mock(ImportVolumeCmd.class);
+        when(cmd.getPath()).thenReturn(path);
+        when(cmd.getStorageId()).thenReturn(poolId);
+        when(cmd.getDiskOfferingId()).thenReturn(diskOfferingId);
+        when(volumeDao.findByPoolIdAndPath(poolId, path)).thenReturn(null);
+        when(templatePoolDao.findByPoolPath(poolId, path)).thenReturn(null);
+
+        // Import a KVM volume residing on an RBD (Ceph) pool
+        when(storagePoolVO.getPoolType()).thenReturn(Storage.StoragePoolType.RBD);
+
+        VolumeOnStorageTO volumeOnStorageTO = new VolumeOnStorageTO(Hypervisor.HypervisorType.KVM, path, name, fullPath,
+                "raw", size, virtualSize);
+        List<VolumeOnStorageTO> volumesOnStorageTO = new ArrayList<>();
+        volumesOnStorageTO.add(volumeOnStorageTO);
+        doReturn(volumesOnStorageTO).when(volumeImportUnmanageManager).listVolumesForImportInternal(storagePoolVO, path, null);
+
+        doNothing().when(volumeImportUnmanageManager).checkIfVolumeIsLocked(volumeOnStorageTO);
+        doNothing().when(volumeImportUnmanageManager).checkIfVolumeIsEncrypted(volumeOnStorageTO);
+        doNothing().when(volumeImportUnmanageManager).checkIfVolumeHasBackingFile(volumeOnStorageTO);
+
+        DiskOfferingVO diskOffering = mock(DiskOfferingVO.class);
+        when(diskOffering.isCustomized()).thenReturn(true);
+        doReturn(diskOffering).when(volumeImportUnmanageManager).getOrCreateDiskOffering(account, diskOfferingId, zoneId, isLocal);
+        doNothing().when(volumeApiService).validateCustomDiskOfferingSizeRange(anyLong());
+        doReturn(true).when(volumeApiService).doesStoragePoolSupportDiskOffering(any(), any());
+        doReturn(diskProfile).when(volumeManager).importVolume(any(), anyString(), any(), eq(virtualSize), isNull(), isNull(), anyLong(),
+                any(), isNull(), isNull(), any(), isNull(), anyLong(), any(), anyString(), isNull());
+        when(diskProfile.getVolumeId()).thenReturn(volumeId);
+        when(volumeDao.findById(volumeId)).thenReturn(volumeVO);
+
+        doNothing().when(resourceLimitService).incrementResourceCount(accountId, Resource.ResourceType.volume);
+        doNothing().when(resourceLimitService).incrementResourceCount(accountId, Resource.ResourceType.primary_storage, virtualSize);
+
+        VolumeResponse response = mock(VolumeResponse.class);
+        doReturn(response).when(responseGenerator).createVolumeResponse(ResponseObject.ResponseView.Full, volumeVO);
+        try (MockedStatic<UsageEventUtils> ignored = Mockito.mockStatic(UsageEventUtils.class);
+             MockedStatic<ActionEventUtils> ignoredtoo = Mockito.mockStatic(ActionEventUtils.class)) {
+            volumeImportUnmanageManager.importVolume(cmd);
+        }
+
+        // The RBD pool type and KVM hypervisor are forwarded to the orchestrator, which is what makes the
+        // imported volume be recorded with RAW format (see VolumeOrchestrator.getSupportedImageFormatForCluster).
+        verify(volumeManager).importVolume(eq(Volume.Type.DATADISK), anyString(), any(), eq(virtualSize), isNull(), isNull(),
+                anyLong(), eq(Hypervisor.HypervisorType.KVM), isNull(), isNull(), any(), isNull(), anyLong(),
+                eq(Storage.StoragePoolType.RBD), anyString(), isNull());
+    }
+
     @Test
     public void testListVolumesForImportInternal() {
         Pair<HostVO, String> hostAndLocalPath = mock(Pair.class);
diff --git a/server/src/test/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImplTest.java b/server/src/test/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImplTest.java
index dbc05ec99f39..ec8270a2b79b 100644
--- a/server/src/test/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImplTest.java
+++ b/server/src/test/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImplTest.java
@@ -181,6 +181,34 @@
 @RunWith(MockitoJUnitRunner.class)
 public class UnmanagedVMsManagerImplTest {
 
+    @Test
+    public void linstorRootImportRejectsWrongGroupThroughDriver() {
+        com.cloud.storage.StoragePool pool = Mockito.mock(com.cloud.storage.StoragePool.class);
+        org.apache.cloudstack.engine.subsystem.api.storage.DataStore store = Mockito.mock(
+                org.apache.cloudstack.engine.subsystem.api.storage.DataStore.class);
+        org.apache.cloudstack.engine.subsystem.api.storage.PrimaryDataStoreDriver driver = Mockito.mock(
+                org.apache.cloudstack.engine.subsystem.api.storage.PrimaryDataStoreDriver.class);
+        Mockito.when(pool.getPoolType()).thenReturn(com.cloud.storage.Storage.StoragePoolType.Linstor);
+        Mockito.when(pool.getId()).thenReturn(42L);
+        Mockito.when(dataStoreManager.getPrimaryDataStore(42L)).thenReturn(store);
+        Mockito.when(store.getDriver()).thenReturn(driver);
+        Mockito.doThrow(new com.cloud.utils.exception.CloudRuntimeException("resource group mismatch"))
+                .when(driver).validateVolumeForImport(pool, "disk");
+
+        Assert.assertThrows(com.cloud.utils.exception.CloudRuntimeException.class,
+                () -> unmanagedVMsManager.validateStorageVolumeForImport(pool, "disk"));
+
+        Mockito.verify(driver).validateVolumeForImport(pool, "disk");
+    }
+
+    @Test
+    public void nonLinstorRootImportDoesNotInvokeBackendOwnershipValidation() {
+        com.cloud.storage.StoragePool pool = Mockito.mock(com.cloud.storage.StoragePool.class);
+        Mockito.when(pool.getPoolType()).thenReturn(com.cloud.storage.Storage.StoragePoolType.RBD);
+        unmanagedVMsManager.validateStorageVolumeForImport(pool, "disk");
+        Mockito.verifyNoInteractions(dataStoreManager);
+    }
+
     @Spy
     @InjectMocks
     private UnmanagedVMsManagerImpl unmanagedVMsManager;
@@ -188,6 +216,10 @@ public class UnmanagedVMsManagerImplTest {
     @Mock
     private UserVmManager userVmManager;
     @Mock
+    private com.cloud.storage.dao.GuestOSDao guestOSDao;
+    @Mock
+    private com.cloud.storage.dao.GuestOSHypervisorDao guestOSHypervisorDao;
+    @Mock
     private ClusterDao clusterDao;
     @Mock
     private ResourceManager resourceManager;
@@ -730,6 +762,27 @@ public void testGetTemplateForImportInstanceDefaultTemplate() {
         Assert.assertEquals(defaultTemplateName, templateForImportInstance.getName());
     }
 
+    @Test
+    public void testGetVmwareMigrationModeFallsBackToUseVddk() {
+        ImportVmCmd cmd = Mockito.mock(ImportVmCmd.class);
+        Assert.assertEquals(ImportVmCmd.VmwareMigrationMode.OVF, unmanagedVMsManager.getVmwareMigrationMode(cmd, false));
+        Assert.assertEquals(ImportVmCmd.VmwareMigrationMode.VDDK, unmanagedVMsManager.getVmwareMigrationMode(cmd, true));
+    }
+
+    @Test
+    public void testGetVmwareMigrationModeParsesCbt() {
+        ImportVmCmd cmd = Mockito.mock(ImportVmCmd.class);
+        when(cmd.getVmwareMigrationMode()).thenReturn("cbt");
+        Assert.assertEquals(ImportVmCmd.VmwareMigrationMode.CBT, unmanagedVMsManager.getVmwareMigrationMode(cmd, false));
+    }
+
+    @Test(expected = ServerApiException.class)
+    public void testGetVmwareMigrationModeRejectsUnknownMode() {
+        ImportVmCmd cmd = Mockito.mock(ImportVmCmd.class);
+        when(cmd.getVmwareMigrationMode()).thenReturn("not-a-mode");
+        unmanagedVMsManager.getVmwareMigrationMode(cmd, false);
+    }
+
     private enum VcenterParameter {
         EXISTING,
         EXTERNAL,
@@ -1075,6 +1128,19 @@ public void testValidateSelectedConversionStoragePoolForVddkPassesWhenPoolSuppor
                 serviceOffering, Map.of("1000-2", 32L));
     }
 
+    @Test
+    public void testValidateSelectedConversionStoragePoolForVddkSkipsTemporaryPoolForStagedImport() {
+        long poolId = 12L;
+        ServiceOfferingVO serviceOffering = mock(ServiceOfferingVO.class);
+
+        Mockito.reset(primaryDataStoreDao, diskOfferingDao, volumeApiService);
+
+        unmanagedVMsManager.validateSelectedConversionStoragePoolForVddk(true, false, poolId,
+                serviceOffering, Map.of("1000-2", 32L));
+
+        Mockito.verifyNoInteractions(primaryDataStoreDao, diskOfferingDao, volumeApiService);
+    }
+
     private ClusterVO getClusterForTests() {
         ClusterVO cluster = mock(ClusterVO.class);
         when(cluster.getId()).thenReturn(1L);
@@ -1394,6 +1460,40 @@ public void testSelectKVMHostForConversionInClusterVddkAutoSelectsHostWithVddkSu
         Assert.assertEquals(hostWithVddk, returnedHost);
     }
 
+    @Test
+    public void testSelectKVMHostForConversionInClusterDirectRbdAutoSelectsHostWithDirectSupport() {
+        ClusterVO cluster = getClusterForTests();
+        HostVO hostWithVddkOnly = Mockito.mock(HostVO.class);
+        HostVO hostWithDirectRbd = Mockito.mock(HostVO.class);
+        when(hostWithVddkOnly.getDetail(Host.HOST_VDDK_SUPPORT)).thenReturn("true");
+        when(hostWithVddkOnly.getDetail(Host.HOST_VDDK_RBD_DIRECT_IMPORT_SUPPORT)).thenReturn(null);
+        when(hostWithDirectRbd.getDetail(Host.HOST_VDDK_SUPPORT)).thenReturn("true");
+        when(hostWithDirectRbd.getDetail(Host.HOST_VDDK_RBD_DIRECT_IMPORT_SUPPORT)).thenReturn("true");
+
+        when(hostDao.listByClusterHypervisorTypeAndHostCapability(cluster.getId(),
+                cluster.getHypervisorType(), Host.HOST_INSTANCE_CONVERSION))
+                .thenReturn(List.of(hostWithVddkOnly, hostWithDirectRbd));
+
+        HostVO returnedHost = unmanagedVMsManager.selectKVMHostForConversionInCluster(cluster, null, true, true);
+        Assert.assertEquals(hostWithDirectRbd, returnedHost);
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testSelectKVMHostForConversionInClusterDirectRbdFailsWithoutDirectSupport() {
+        ClusterVO cluster = getClusterForTests();
+        HostVO hostWithVddkOnly = Mockito.mock(HostVO.class);
+        when(hostWithVddkOnly.getDetail(Host.HOST_VDDK_SUPPORT)).thenReturn("true");
+        when(hostWithVddkOnly.getDetail(Host.HOST_VDDK_RBD_DIRECT_IMPORT_SUPPORT)).thenReturn(null);
+
+        when(hostDao.listByClusterHypervisorTypeAndHostCapability(cluster.getId(),
+                cluster.getHypervisorType(), Host.HOST_INSTANCE_CONVERSION))
+                .thenReturn(List.of(hostWithVddkOnly));
+        when(hostDao.listByClusterAndHypervisorType(cluster.getId(), cluster.getHypervisorType()))
+                .thenReturn(List.of(hostWithVddkOnly));
+
+        unmanagedVMsManager.selectKVMHostForConversionInCluster(cluster, null, true, true);
+    }
+
     @Test
     public void testCheckConversionStoragePoolSecondaryStorageStaging() {
         unmanagedVMsManager.checkConversionStoragePool(null, false);
@@ -1422,6 +1522,110 @@ public void testCheckConversionStoragePoolPrimaryStagingPoolTypeAllowedForce() {
         unmanagedVMsManager.checkConversionStoragePool(destPoolId, true);
     }
 
+    @Test
+    public void testCheckConversionStoragePoolRbdAllowedForVddkForceConvertToPool() {
+        StoragePoolVO destPool = mock(StoragePoolVO.class);
+        Mockito.when(destPool.getPoolType()).thenReturn(Storage.StoragePoolType.RBD);
+        long destPoolId = 1L;
+        Mockito.when(primaryDataStoreDao.findById(destPoolId)).thenReturn(destPool);
+        unmanagedVMsManager.checkConversionStoragePool(destPoolId, true, true);
+    }
+
+    @Test
+    public void testCheckConversionStoragePoolLinstorAllowedForVddkForceConvertToPool() {
+        StoragePoolVO destPool = mock(StoragePoolVO.class);
+        Mockito.when(destPool.getPoolType()).thenReturn(Storage.StoragePoolType.Linstor);
+        long destPoolId = 1L;
+        Mockito.when(primaryDataStoreDao.findById(destPoolId)).thenReturn(destPool);
+        unmanagedVMsManager.checkConversionStoragePool(destPoolId, true, true);
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testCheckConversionStoragePoolLinstorNotAllowedWithoutVddk() {
+        StoragePoolVO destPool = mock(StoragePoolVO.class);
+        Mockito.when(destPool.getPoolType()).thenReturn(Storage.StoragePoolType.Linstor);
+        long destPoolId = 1L;
+        Mockito.when(primaryDataStoreDao.findById(destPoolId)).thenReturn(destPool);
+        unmanagedVMsManager.checkConversionStoragePool(destPoolId, true, false);
+    }
+
+    @Test
+    public void testSelectKVMHostForConversionInClusterDirectLinstorAutoSelectsHostWithSupport() {
+        ClusterVO cluster = getClusterForTests();
+        HostVO hostWithoutInPlace = Mockito.mock(HostVO.class);
+        HostVO hostWithInPlace = Mockito.mock(HostVO.class);
+        when(hostWithoutInPlace.getDetail(Host.HOST_VDDK_SUPPORT)).thenReturn("true");
+        when(hostWithoutInPlace.getDetail(Host.HOST_VIRTV2V_INPLACE_SUPPORT)).thenReturn(null);
+        when(hostWithInPlace.getDetail(Host.HOST_VDDK_SUPPORT)).thenReturn("true");
+        when(hostWithInPlace.getDetail(Host.HOST_VIRTV2V_INPLACE_SUPPORT)).thenReturn("true");
+        when(hostWithInPlace.getId()).thenReturn(7L);
+
+        StoragePoolVO linstorPool = mock(StoragePoolVO.class);
+        when(linstorPool.getId()).thenReturn(10L);
+        StoragePoolHostVO storagePoolHost = Mockito.mock(StoragePoolHostVO.class);
+        when(storagePoolHostDao.findByPoolHost(10L, 7L)).thenReturn(storagePoolHost);
+
+        when(hostDao.listByClusterHypervisorTypeAndHostCapability(cluster.getId(),
+                cluster.getHypervisorType(), Host.HOST_INSTANCE_CONVERSION))
+                .thenReturn(List.of(hostWithoutInPlace, hostWithInPlace));
+
+        HostVO returnedHost = unmanagedVMsManager.selectKVMHostForConversionInCluster(cluster, null, true, false, linstorPool);
+        Assert.assertEquals(hostWithInPlace, returnedHost);
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testSelectKVMHostForConversionInClusterDirectLinstorFailsWithoutSupport() {
+        ClusterVO cluster = getClusterForTests();
+        HostVO hostWithoutInPlace = Mockito.mock(HostVO.class);
+        when(hostWithoutInPlace.getDetail(Host.HOST_VDDK_SUPPORT)).thenReturn("true");
+        when(hostWithoutInPlace.getDetail(Host.HOST_VIRTV2V_INPLACE_SUPPORT)).thenReturn(null);
+
+        StoragePoolVO linstorPool = mock(StoragePoolVO.class);
+
+        when(hostDao.listByClusterHypervisorTypeAndHostCapability(cluster.getId(),
+                cluster.getHypervisorType(), Host.HOST_INSTANCE_CONVERSION))
+                .thenReturn(List.of(hostWithoutInPlace));
+        when(hostDao.listByClusterAndHypervisorType(cluster.getId(), cluster.getHypervisorType()))
+                .thenReturn(List.of(hostWithoutInPlace));
+
+        unmanagedVMsManager.selectKVMHostForConversionInCluster(cluster, null, true, false, linstorPool);
+    }
+
+    @Test
+    public void testValidateStagedImportHostSupportLinstorPoolAccessibleFromImportHost() {
+        StoragePoolVO destPool = mock(StoragePoolVO.class);
+        Mockito.when(destPool.getPoolType()).thenReturn(Storage.StoragePoolType.Linstor);
+        Mockito.when(destPool.getId()).thenReturn(10L);
+        HostVO importHost = mock(HostVO.class);
+        Mockito.when(importHost.getId()).thenReturn(5L);
+        StoragePoolHostVO storagePoolHost = Mockito.mock(StoragePoolHostVO.class);
+        Mockito.when(storagePoolHostDao.findByPoolHost(10L, 5L)).thenReturn(storagePoolHost);
+
+        unmanagedVMsManager.validateStagedImportHostSupport(false, List.of(destPool), importHost);
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testValidateStagedImportHostSupportLinstorPoolNotOnImportHost() {
+        StoragePoolVO destPool = mock(StoragePoolVO.class);
+        Mockito.when(destPool.getPoolType()).thenReturn(Storage.StoragePoolType.Linstor);
+        Mockito.when(destPool.getId()).thenReturn(10L);
+        HostVO importHost = mock(HostVO.class);
+        Mockito.when(importHost.getId()).thenReturn(5L);
+        Mockito.when(storagePoolHostDao.findByPoolHost(10L, 5L)).thenReturn(null);
+
+        unmanagedVMsManager.validateStagedImportHostSupport(false, List.of(destPool), importHost);
+    }
+
+    @Test
+    public void testValidateStagedImportHostSupportSkippedForForceConvertToPool() {
+        StoragePoolVO destPool = mock(StoragePoolVO.class);
+        HostVO importHost = mock(HostVO.class);
+
+        unmanagedVMsManager.validateStagedImportHostSupport(true, List.of(destPool), importHost);
+
+        Mockito.verifyNoInteractions(storagePoolHostDao);
+    }
+
     @Test(expected = CloudRuntimeException.class)
     public void testCheckConversionStoragePoolPrimaryStagingPoolTypeNotAllowedForce() {
         StoragePoolVO destPool = mock(StoragePoolVO.class);
@@ -1499,6 +1703,29 @@ public void testAddServiceOfferingDetailsToParamsCustomConstrainedOffering() {
         Assert.assertEquals("1024", params.get(VmDetailConstants.MEMORY));
     }
 
+    @Test
+    public void testAddServiceOfferingDetailsToParamsUsesCallerDetailsForCustomOffering() {
+        Map<String, String> params = new HashMap<>();
+        ServiceOfferingVO serviceOfferingVO = mock(ServiceOfferingVO.class);
+        Map<String, String> offeringDetails = new HashMap<>();
+        offeringDetails.put(ApiConstants.MIN_CPU_NUMBER, "1");
+        offeringDetails.put(ApiConstants.MIN_MEMORY, "1024");
+        Map<String, String> callerDetails = new HashMap<>();
+        callerDetails.put(VmDetailConstants.CPU_NUMBER, "4");
+        callerDetails.put(VmDetailConstants.CPU_SPEED, "2200");
+        callerDetails.put(VmDetailConstants.MEMORY, "8192");
+        Mockito.when(serviceOfferingVO.getDetails()).thenReturn(offeringDetails);
+        Mockito.when(serviceOfferingVO.getCpu()).thenReturn(null);
+        Mockito.when(serviceOfferingVO.getSpeed()).thenReturn(null);
+        Mockito.when(serviceOfferingVO.getRamSize()).thenReturn(null);
+
+        unmanagedVMsManager.addServiceOfferingDetailsToParams(params, serviceOfferingVO, callerDetails);
+
+        Assert.assertEquals("4", params.get(VmDetailConstants.CPU_NUMBER));
+        Assert.assertEquals("2200", params.get(VmDetailConstants.CPU_SPEED));
+        Assert.assertEquals("8192", params.get(VmDetailConstants.MEMORY));
+    }
+
     @Test
     public void testAddServiceOfferingDetailsToParamsCustomUnconstrainedOffering() {
         Map<String, String> params = new HashMap<>();
@@ -1609,4 +1836,193 @@ public void getDetailAsIntegerTestThrowsInvalidParameterValueExceptionWhenValueI
         details.put("key", "not-a-number");
         unmanagedVMsManager.getDetailAsInteger("key", details);
     }
+
+    private UnmanagedInstanceTO.Disk diskWithImagePath(String imagePath) {
+        UnmanagedInstanceTO.Disk disk = new UnmanagedInstanceTO.Disk();
+        disk.setImagePath(imagePath);
+        return disk;
+    }
+
+    @Test
+    public void testExtractConvertedPoolDiskPosition() {
+        String uuid = "4ee0d2a1-080d-4377-b209-9f3479678dcc";
+        Assert.assertEquals(Integer.valueOf(0), unmanagedVMsManager.extractConvertedPoolDiskPosition("pr13656/" + uuid + "-disk-000"));
+        Assert.assertEquals(Integer.valueOf(1), unmanagedVMsManager.extractConvertedPoolDiskPosition("pr13656/" + uuid + "-disk-001"));
+        Assert.assertEquals(Integer.valueOf(2), unmanagedVMsManager.extractConvertedPoolDiskPosition("linstorpool/" + uuid + "-d02"));
+        // OVF-converted images carry no position -> null (falls back to index pairing)
+        Assert.assertNull(unmanagedVMsManager.extractConvertedPoolDiskPosition("/mnt/nfs/" + uuid + "-sda"));
+        Assert.assertNull(unmanagedVMsManager.extractConvertedPoolDiskPosition(null));
+    }
+
+    @Test
+    public void testResolveConvertedToSourceDiskIndexesRbdReversedDomainOrder() {
+        // Converted disks discovered from the finalized domain in reversed order: [disk-001, disk-000]
+        java.util.List<UnmanagedInstanceTO.Disk> converted = java.util.List.of(
+                diskWithImagePath("pr13656/uuid-disk-001"),
+                diskWithImagePath("pr13656/uuid-disk-000"));
+        int[] idx = unmanagedVMsManager.resolveConvertedToSourceDiskIndexes(converted, 2);
+        // converted[0]=disk-001 -> source idx 1 (data); converted[1]=disk-000 -> source idx 0 (root)
+        Assert.assertArrayEquals(new int[]{1, 0}, idx);
+    }
+
+    @Test
+    public void testResolveConvertedToSourceDiskIndexesOvfFallsBackToIndex() {
+        java.util.List<UnmanagedInstanceTO.Disk> converted = java.util.List.of(
+                diskWithImagePath("/mnt/nfs/uuid-sda"),
+                diskWithImagePath("/mnt/nfs/uuid-sdb"));
+        int[] idx = unmanagedVMsManager.resolveConvertedToSourceDiskIndexes(converted, 2);
+        Assert.assertArrayEquals(new int[]{0, 1}, idx);
+    }
+
+    @Test
+    public void testResolveConvertedToSourceDiskIndexesInSourceOrder() {
+        java.util.List<UnmanagedInstanceTO.Disk> converted = java.util.List.of(
+                diskWithImagePath("pr13656/uuid-disk-000"),
+                diskWithImagePath("pr13656/uuid-disk-001"));
+        int[] idx = unmanagedVMsManager.resolveConvertedToSourceDiskIndexes(converted, 2);
+        Assert.assertArrayEquals(new int[]{0, 1}, idx);
+    }
+
+    private com.cloud.storage.GuestOSVO guestOsVO(long id, String displayName) {
+        com.cloud.storage.GuestOSVO vo = new com.cloud.storage.GuestOSVO();
+        try {
+            java.lang.reflect.Field idField = com.cloud.storage.GuestOSVO.class.getDeclaredField("id");
+            idField.setAccessible(true);
+            idField.setLong(vo, id);
+        } catch (ReflectiveOperationException e) {
+            throw new RuntimeException(e);
+        }
+        vo.setDisplayName(displayName);
+        return vo;
+    }
+
+    @Test
+    public void testResolveGuestOsIdMatchesDisplayNameWithoutVendorPrefix() {
+        Mockito.when(guestOSDao.findOneByDisplayName("Microsoft Windows Server 2022 (64-bit)")).thenReturn(null);
+        Mockito.when(guestOSDao.findOneByDisplayName("Windows Server 2022 (64-bit)")).thenReturn(guestOsVO(77L, "Windows Server 2022 (64-bit)"));
+        Assert.assertEquals(Long.valueOf(77L),
+                unmanagedVMsManager.resolveGuestOsIdForVmwareImport("Microsoft Windows Server 2022 (64-bit)", "windows2019srv_64Guest"));
+    }
+
+    @Test
+    public void testResolveGuestOsIdFallsBackToNearestWindowsServerYear() {
+        Mockito.when(guestOSDao.findOneByDisplayName(Mockito.anyString())).thenReturn(null);
+        Mockito.when(guestOSHypervisorDao.findByOsNameAndHypervisorOrderByCreatedDesc(Mockito.anyString(), Mockito.anyString(), Mockito.any())).thenReturn(null);
+        Mockito.when(guestOSDao.listLikeDisplayName("Windows Server")).thenReturn(java.util.List.of(
+                guestOsVO(70L, "Windows Server 2019 (64-bit)"),
+                guestOsVO(71L, "Windows Server 2022 (64-bit)"),
+                guestOsVO(60L, "Windows Server 2016 (64-bit)")));
+        Assert.assertEquals(Long.valueOf(71L),
+                unmanagedVMsManager.resolveGuestOsIdForVmwareImport("Microsoft Windows Server 2025 Standard Evaluation", "windows2025srv_64Guest"));
+    }
+
+    @Test
+    public void testResolveGuestOsIdReturnsNullForUnknownNonWindows() {
+        Mockito.when(guestOSDao.findOneByDisplayName(Mockito.anyString())).thenReturn(null);
+        Mockito.when(guestOSHypervisorDao.findByOsNameAndHypervisorOrderByCreatedDesc(Mockito.anyString(), Mockito.anyString(), Mockito.any())).thenReturn(null);
+        Assert.assertNull(unmanagedVMsManager.resolveGuestOsIdForVmwareImport("SomeExotic OS 9", "exotic9_64Guest"));
+    }
+
+    @Test
+    public void testApplyVmwareImportHardwareDetailsForUefiWindows() {
+        Map<String, String> details = unmanagedVMsManager.applyVmwareImportHardwareDetails(new HashMap<>(),
+                "UEFI", "SECURE", "Microsoft Windows Server 2025 Standard Evaluation");
+        Assert.assertEquals("SECURE", details.get("UEFI"));
+        Assert.assertEquals("q35", details.get(VmDetailConstants.KVM_GUEST_OS_MACHINE_TYPE));
+        Assert.assertEquals("vga", details.get(VmDetailConstants.VIDEO_HARDWARE));
+        Assert.assertEquals("32768", details.get(VmDetailConstants.VIDEO_RAM));
+    }
+
+    @Test
+    public void testApplyVmwareImportHardwareDetailsKeepsCallerChoices() {
+        Map<String, String> callerDetails = new HashMap<>();
+        callerDetails.put("UEFI", "LEGACY");
+        callerDetails.put(VmDetailConstants.VIDEO_HARDWARE, "virtio");
+        Map<String, String> details = unmanagedVMsManager.applyVmwareImportHardwareDetails(callerDetails,
+                "UEFI", "SECURE", "Microsoft Windows Server 2022 (64-bit)");
+        Assert.assertEquals("LEGACY", details.get("UEFI"));
+        Assert.assertEquals("virtio", details.get(VmDetailConstants.VIDEO_HARDWARE));
+    }
+
+    @Test
+    public void testApplyVmwareImportHardwareDetailsNoopForBiosLinux() {
+        Map<String, String> details = unmanagedVMsManager.applyVmwareImportHardwareDetails(null,
+                "BIOS", "LEGACY", "Ubuntu Linux (64-bit)");
+        Assert.assertFalse(details.containsKey("UEFI"));
+        Assert.assertFalse(details.containsKey(VmDetailConstants.KVM_GUEST_OS_MACHINE_TYPE));
+        Assert.assertFalse(details.containsKey(VmDetailConstants.VIDEO_HARDWARE));
+    }
+
+    private NetworkVO staticIpTestNetwork(long id, String cidr, String gateway) {
+        NetworkVO network = Mockito.mock(NetworkVO.class);
+        Mockito.lenient().when(network.getId()).thenReturn(id);
+        Mockito.lenient().when(network.getCidr()).thenReturn(cidr);
+        Mockito.lenient().when(network.getGateway()).thenReturn(gateway);
+        Mockito.lenient().when(network.getUuid()).thenReturn("net-" + id);
+        Mockito.lenient().when(networkDao.findById(id)).thenReturn(network);
+        return network;
+    }
+
+    @Test
+    public void testAutoFillPreservesStaticIpThatFitsTargetCidr() {
+        staticIpTestNetwork(200L, "10.1.1.0/24", "10.1.1.1");
+        Map<String, com.cloud.network.Network.IpAddresses> result = unmanagedVMsManager.autoFillStaticNicIpAddresses(
+                Map.of("Network adapter 1", 200L), null,
+                Map.of("Network adapter 1", java.util.List.of("10.1.1.150/24")));
+        Assert.assertEquals("10.1.1.150", result.get("Network adapter 1").getIp4Address());
+    }
+
+    @Test
+    public void testAutoFillKeepsCallerProvidedIp() {
+        staticIpTestNetwork(200L, "10.1.1.0/24", "10.1.1.1");
+        Map<String, com.cloud.network.Network.IpAddresses> caller = new HashMap<>();
+        caller.put("Network adapter 1", new com.cloud.network.Network.IpAddresses("10.1.1.99", null));
+        Map<String, com.cloud.network.Network.IpAddresses> result = unmanagedVMsManager.autoFillStaticNicIpAddresses(
+                Map.of("Network adapter 1", 200L), caller,
+                Map.of("Network adapter 1", java.util.List.of("10.1.1.150/24")));
+        Assert.assertEquals("10.1.1.99", result.get("Network adapter 1").getIp4Address());
+    }
+
+    @Test
+    public void testAutoFillFallsBackToAutoForIpOutsideTargetCidr() {
+        staticIpTestNetwork(200L, "10.1.1.0/24", "10.1.1.1");
+        Map<String, com.cloud.network.Network.IpAddresses> result = unmanagedVMsManager.autoFillStaticNicIpAddresses(
+                Map.of("Network adapter 2", 200L), null,
+                Map.of("Network adapter 2", java.util.List.of("192.168.77.5/24")));
+        Assert.assertEquals("auto", result.get("Network adapter 2").getIp4Address());
+    }
+
+    @Test
+    public void testAutoFillFallsBackToAutoForGatewayAndInUseIps() {
+        NetworkVO network = staticIpTestNetwork(200L, "10.1.1.0/24", "10.1.1.1");
+        Mockito.when(nicDao.findByIp4AddressAndNetworkId("10.1.1.151", 200L)).thenReturn(Mockito.mock(com.cloud.vm.NicVO.class));
+        Map<String, com.cloud.network.Network.IpAddresses> result = unmanagedVMsManager.autoFillStaticNicIpAddresses(
+                Map.of("Network adapter 1", 200L, "Network adapter 2", 200L), null,
+                Map.of("Network adapter 1", java.util.List.of("10.1.1.1/24"),
+                       "Network adapter 2", java.util.List.of("10.1.1.151/24")));
+        Assert.assertEquals("auto", result.get("Network adapter 1").getIp4Address());
+        Assert.assertEquals("auto", result.get("Network adapter 2").getIp4Address());
+        Mockito.verify(network, Mockito.atLeastOnce()).getCidr();
+    }
+
+    @Test
+    public void testAutoFillFallsBackToAutoWhenSourceReportsNoAddresses() {
+        // A NIC with no Tools-reported address at all (DHCP guest before lease, Tools down)
+        // must still be importable into an isolated network - via automatic allocation.
+        staticIpTestNetwork(200L, "10.1.1.0/24", "10.1.1.1");
+        Map<String, com.cloud.network.Network.IpAddresses> result = unmanagedVMsManager.autoFillStaticNicIpAddresses(
+                Map.of("Network adapter 1", 200L), null, new HashMap<>());
+        Assert.assertEquals("auto", result.get("Network adapter 1").getIp4Address());
+    }
+
+    @Test
+    public void testAutoFillAcceptsBareAddressWithoutPrefix() {
+        // Older or limited VMware Tools report addresses without ipConfig, so the captured
+        // entry has no prefix - preservation must still work from the bare address.
+        staticIpTestNetwork(200L, "10.1.1.0/24", "10.1.1.1");
+        Map<String, com.cloud.network.Network.IpAddresses> result = unmanagedVMsManager.autoFillStaticNicIpAddresses(
+                Map.of("Network adapter 1", 200L), null,
+                Map.of("Network adapter 1", java.util.List.of("10.1.1.151")));
+        Assert.assertEquals("10.1.1.151", result.get("Network adapter 1").getIp4Address());
+    }
 }
diff --git a/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationCheckpointTest.java b/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationCheckpointTest.java
new file mode 100644
index 000000000000..ebfbc984e801
--- /dev/null
+++ b/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationCheckpointTest.java
@@ -0,0 +1,52 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+import java.util.Collections;
+
+import org.junit.Assert;
+import org.junit.Test;
+import org.mockito.Mockito;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import com.cloud.vm.VmwareCbtMigrationDiskVO;
+import com.cloud.vm.VmwareCbtMigrationVO;
+import com.cloud.vm.dao.VmwareCbtMigrationDiskDao;
+
+public class VmwareCbtMigrationCheckpointTest {
+
+    @Test
+    public void successfulCyclePersistsSnapshotChangeIdForNextCycle() {
+        VmwareCbtMigrationManagerImpl manager = new VmwareCbtMigrationManagerImpl();
+        VmwareCbtMigrationVO migration = Mockito.mock(VmwareCbtMigrationVO.class);
+        Mockito.when(migration.getId()).thenReturn(42L);
+        VmwareCbtMigrationDiskVO disk = new VmwareCbtMigrationDiskVO(42L, "disk-1", 2000,
+                "[datastore] vm/disk.vmdk", "datastore", 1024L);
+        disk.setChangeId("baseline");
+        VmwareCbtMigrationDiskDao diskDao = Mockito.mock(VmwareCbtMigrationDiskDao.class);
+        Mockito.when(diskDao.listByMigrationId(42L)).thenReturn(Collections.singletonList(disk));
+        ReflectionTestUtils.setField(manager, "vmwareCbtMigrationDiskDao", diskDao);
+
+        VmwareCbtChangedDiskInfo changedDisk = new VmwareCbtChangedDiskInfo("disk-1", "cycle-1-snapshot",
+                Collections.emptyList());
+        ReflectionTestUtils.invokeMethod(manager, "updateDiskChangeIds", migration,
+                Collections.singletonList(changedDisk));
+
+        Assert.assertEquals("cycle-1-snapshot", disk.getChangeId());
+        Mockito.verify(diskDao).update(disk.getId(), disk);
+    }
+}
diff --git a/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationCutoverFailureTest.java b/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationCutoverFailureTest.java
new file mode 100644
index 000000000000..a13780b4b6f3
--- /dev/null
+++ b/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationCutoverFailureTest.java
@@ -0,0 +1,78 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+import org.junit.Assert;
+import org.junit.Test;
+import org.mockito.Mockito;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import com.cloud.agent.AgentManager;
+import com.cloud.agent.api.VmwareCbtCutoverCommand;
+import com.cloud.agent.api.VmwareCbtMigrationAnswer;
+import com.cloud.host.HostVO;
+import com.cloud.vm.VmwareCbtMigrationCycleVO;
+import com.cloud.vm.VmwareCbtMigrationVO;
+import com.cloud.vm.dao.VmwareCbtMigrationCycleDao;
+import com.cloud.vm.dao.VmwareCbtMigrationDao;
+
+public class VmwareCbtMigrationCutoverFailureTest {
+
+    @Test
+    public void finalCutoverAgentExceptionUsesFailureAnswerPath() throws Exception {
+        VmwareCbtMigrationManagerImpl manager = new VmwareCbtMigrationManagerImpl();
+        VmwareCbtMigrationVO migration = Mockito.mock(VmwareCbtMigrationVO.class);
+        Mockito.when(migration.getUuid()).thenReturn("migration-1");
+        HostVO host = Mockito.mock(HostVO.class);
+        Mockito.when(host.getId()).thenReturn(7L);
+        VmwareCbtCutoverCommand command = Mockito.mock(VmwareCbtCutoverCommand.class);
+        AgentManager agentManager = Mockito.mock(AgentManager.class);
+        Mockito.when(agentManager.send(7L, command)).thenThrow(new IllegalStateException("agent disconnected"));
+        ReflectionTestUtils.setField(manager, "agentManager", agentManager);
+
+        VmwareCbtMigrationAnswer answer = ReflectionTestUtils.invokeMethod(manager,
+                "sendFinalCutoverCommand", host, command, migration, null);
+
+        Assert.assertNotNull(answer);
+        Assert.assertFalse(answer.getResult());
+        Assert.assertTrue(answer.getDetails().contains("agent disconnected"));
+    }
+
+    @Test
+    public void finalCycleInsertFailureDoesNotTryToUpdateMissingCycle() {
+        VmwareCbtMigrationManagerImpl manager = new VmwareCbtMigrationManagerImpl();
+        VmwareCbtMigrationVO migration = Mockito.mock(VmwareCbtMigrationVO.class);
+        Mockito.when(migration.getId()).thenReturn(42L);
+        VmwareCbtMigrationCycleDao cycleDao = Mockito.mock(VmwareCbtMigrationCycleDao.class);
+        Mockito.when(cycleDao.persist(Mockito.any(VmwareCbtMigrationCycleVO.class)))
+                .thenThrow(new IllegalStateException("cycle insert failed"));
+        VmwareCbtMigrationDao migrationDao = Mockito.mock(VmwareCbtMigrationDao.class);
+        Mockito.when(migrationDao.updateIfNotTerminal(migration)).thenReturn(true);
+        ReflectionTestUtils.setField(manager, "vmwareCbtMigrationCycleDao", cycleDao);
+        ReflectionTestUtils.setField(manager, "vmwareCbtMigrationDao", migrationDao);
+
+        Boolean result = ReflectionTestUtils.invokeMethod(manager, "runFinalDeltaSync",
+                null, migration, null, 3);
+
+        Assert.assertNotNull(result);
+        Assert.assertFalse(result);
+        Mockito.verify(migration).setState(VmwareCbtMigration.State.Failed);
+        Mockito.verify(migration).setLastError("cycle insert failed");
+        Mockito.verify(migrationDao).updateIfNotTerminal(migration);
+        Mockito.verify(cycleDao, Mockito.never()).update(Mockito.anyLong(), Mockito.any());
+    }
+}
diff --git a/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationCutoverPolicyTest.java b/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationCutoverPolicyTest.java
new file mode 100644
index 000000000000..2bda129483e0
--- /dev/null
+++ b/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationCutoverPolicyTest.java
@@ -0,0 +1,75 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+import org.junit.Assert;
+import org.junit.Test;
+
+public class VmwareCbtMigrationCutoverPolicyTest {
+
+    @Test
+    public void testContinuesUntilMinimumCyclesAreReached() {
+        VmwareCbtMigrationCutoverPolicy policy = new VmwareCbtMigrationCutoverPolicy(2, 5, 1, 1024, 0);
+
+        Assert.assertEquals(VmwareCbtMigrationCutoverPolicy.Decision.CONTINUE,
+                policy.decide(1, 0, 512, 10));
+    }
+
+    @Test
+    public void testReadyForCutoverAfterRequiredQuietCycles() {
+        VmwareCbtMigrationCutoverPolicy policy = new VmwareCbtMigrationCutoverPolicy(1, 5, 2, 1024, 0);
+
+        Assert.assertEquals(VmwareCbtMigrationCutoverPolicy.Decision.READY_FOR_CUTOVER,
+                policy.decide(3, 1, 512, 10));
+    }
+
+    @Test
+    public void testReadyForCutoverAfterMinimumCyclesWhenNoBlocksChanged() {
+        VmwareCbtMigrationCutoverPolicy policy = new VmwareCbtMigrationCutoverPolicy(2, 5, 2, 1024, 0);
+
+        Assert.assertEquals(VmwareCbtMigrationCutoverPolicy.Decision.CONTINUE,
+                policy.decide(1, 0, 0, 10));
+        Assert.assertEquals(VmwareCbtMigrationCutoverPolicy.Decision.READY_FOR_CUTOVER,
+                policy.decide(2, 0, 0, 10));
+    }
+
+    @Test
+    public void testDirtyRateCanKeepReplicationRunning() {
+        VmwareCbtMigrationCutoverPolicy policy = new VmwareCbtMigrationCutoverPolicy(1, 5, 1, 0, 1024);
+
+        Assert.assertFalse(policy.isQuietCycle(2048, 1));
+        Assert.assertTrue(policy.isQuietCycle(2048, 2));
+    }
+
+    @Test
+    public void testReadyForCutoverWhenMaxCyclesReached() {
+        VmwareCbtMigrationCutoverPolicy policy = new VmwareCbtMigrationCutoverPolicy(1, 5, 2, 1024, 1024);
+
+        Assert.assertEquals(VmwareCbtMigrationCutoverPolicy.Decision.READY_FOR_CUTOVER_MAX_CYCLES,
+                policy.decide(5, 0, 4096, 1));
+    }
+
+    @Test
+    public void testLongRunningAgentCommandTimeoutDefaultIsOneDay() {
+        Assert.assertEquals("86400", VmwareCbtMigrationManagerImpl.VmwareCbtMigrationAgentCommandTimeout.defaultValue());
+    }
+
+    @Test(expected = IllegalArgumentException.class)
+    public void testRejectsMaxCyclesBelowMinCycles() {
+        new VmwareCbtMigrationCutoverPolicy(3, 2, 1, 1024, 1024);
+    }
+}
diff --git a/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationDeletePolicyTest.java b/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationDeletePolicyTest.java
new file mode 100644
index 000000000000..fa1ae59c102f
--- /dev/null
+++ b/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationDeletePolicyTest.java
@@ -0,0 +1,179 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+import java.util.Collections;
+
+import org.apache.cloudstack.api.command.admin.vm.DeleteVmwareCbtMigrationCmd;
+import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
+import org.junit.Assert;
+import org.junit.Test;
+import org.mockito.Mockito;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import com.cloud.agent.AgentManager;
+import com.cloud.vm.VmwareCbtMigrationDiskVO;
+import com.cloud.vm.VmwareCbtMigrationVO;
+import com.cloud.vm.dao.VmwareCbtMigrationCycleDao;
+import com.cloud.vm.dao.VmwareCbtMigrationDao;
+import com.cloud.vm.dao.VmwareCbtMigrationDiskDao;
+
+public class VmwareCbtMigrationDeletePolicyTest {
+
+    private final VmwareCbtMigrationManagerImpl manager = new VmwareCbtMigrationManagerImpl();
+
+    @Test
+    public void testCompletedMigrationDeleteIsAllowedButNeverCleansTargetDisks() {
+        Assert.assertTrue(manager.canDeleteMigrationState(VmwareCbtMigration.State.Completed));
+        Assert.assertFalse(manager.shouldCleanupDeletedMigration(VmwareCbtMigration.State.Completed, true));
+    }
+
+    @Test
+    public void testFailedAndCancelledMigrationsCanCleanTargetDisksWhenRequested() {
+        Assert.assertTrue(manager.canDeleteMigrationState(VmwareCbtMigration.State.Failed));
+        Assert.assertTrue(manager.canDeleteMigrationState(VmwareCbtMigration.State.Cancelled));
+        Assert.assertTrue(manager.shouldCleanupDeletedMigration(VmwareCbtMigration.State.Failed, true));
+        Assert.assertTrue(manager.shouldCleanupDeletedMigration(VmwareCbtMigration.State.Cancelled, true));
+        Assert.assertFalse(manager.shouldCleanupDeletedMigration(VmwareCbtMigration.State.Failed, false));
+        Assert.assertFalse(manager.shouldCleanupDeletedMigration(VmwareCbtMigration.State.Cancelled, false));
+    }
+
+    @Test
+    public void testActiveMigrationsCannotBeDeleted() {
+        Assert.assertFalse(manager.canDeleteMigrationState(VmwareCbtMigration.State.Created));
+        Assert.assertFalse(manager.canDeleteMigrationState(VmwareCbtMigration.State.InitialSync));
+        Assert.assertFalse(manager.canDeleteMigrationState(VmwareCbtMigration.State.Replicating));
+        Assert.assertFalse(manager.canDeleteMigrationState(VmwareCbtMigration.State.ReadyForCutover));
+        Assert.assertFalse(manager.canDeleteMigrationState(VmwareCbtMigration.State.CuttingOver));
+        Assert.assertFalse(manager.canDeleteMigrationState(VmwareCbtMigration.State.ReadyForImport));
+    }
+
+    @Test
+    public void testCancelAndDeleteCleanupProtectRecordedImportedVmInEveryState() {
+        VmwareCbtMigrationManagerImpl cleanupManager = new VmwareCbtMigrationManagerImpl();
+        AgentManager agentManager = Mockito.mock(AgentManager.class);
+        VmwareCbtMigrationDiskDao diskDao = Mockito.mock(VmwareCbtMigrationDiskDao.class);
+        PrimaryDataStoreDao poolDao = Mockito.mock(PrimaryDataStoreDao.class);
+        ReflectionTestUtils.setField(cleanupManager, "agentManager", agentManager);
+        ReflectionTestUtils.setField(cleanupManager, "vmwareCbtMigrationDiskDao", diskDao);
+        ReflectionTestUtils.setField(cleanupManager, "primaryDataStoreDao", poolDao);
+
+        for (VmwareCbtMigration.State state : VmwareCbtMigration.State.values()) {
+            VmwareCbtMigrationVO migration = Mockito.mock(VmwareCbtMigrationVO.class);
+            Mockito.when(migration.getState()).thenReturn(state);
+            Mockito.when(migration.getVmId()).thenReturn(73L);
+            Mockito.when(migration.getConvertHostId()).thenReturn(null);
+
+            ReflectionTestUtils.invokeMethod(cleanupManager, "sendCleanupCommandIfPossible", migration);
+            ReflectionTestUtils.invokeMethod(cleanupManager, "sendCleanupCommandForDelete", migration);
+        }
+
+        Mockito.verifyNoInteractions(agentManager, diskDao, poolDao);
+    }
+
+    @Test
+    public void testRecordedImportedVmDoesNotPreventMigrationRecordDeletionOrSourceCleanup() {
+        for (VmwareCbtMigration.State state : new VmwareCbtMigration.State[] {
+                VmwareCbtMigration.State.Cancelled, VmwareCbtMigration.State.Failed, VmwareCbtMigration.State.Completed }) {
+            VmwareCbtMigrationManagerImpl deleteManager = Mockito.spy(new VmwareCbtMigrationManagerImpl());
+            VmwareCbtMigrationVO migration = Mockito.mock(VmwareCbtMigrationVO.class);
+            Mockito.when(migration.getId()).thenReturn(41L);
+            Mockito.when(migration.getState()).thenReturn(state);
+            Mockito.when(migration.getVmId()).thenReturn(73L);
+            Mockito.when(migration.getConvertHostId()).thenReturn(null);
+            VmwareCbtMigrationDao migrationDao = Mockito.mock(VmwareCbtMigrationDao.class);
+            Mockito.when(migrationDao.findById(41L)).thenReturn(migration);
+            Mockito.when(migrationDao.remove(41L)).thenReturn(true);
+            VmwareCbtMigrationCycleDao cycleDao = Mockito.mock(VmwareCbtMigrationCycleDao.class);
+            Mockito.when(cycleDao.listByMigrationId(41L)).thenReturn(Collections.emptyList());
+            VmwareCbtMigrationDiskVO disk = Mockito.mock(VmwareCbtMigrationDiskVO.class);
+            Mockito.when(disk.getId()).thenReturn(17L);
+            VmwareCbtMigrationDiskDao diskDao = Mockito.mock(VmwareCbtMigrationDiskDao.class);
+            Mockito.when(diskDao.listByMigrationId(41L)).thenReturn(Collections.singletonList(disk));
+            AgentManager agentManager = Mockito.mock(AgentManager.class);
+            ReflectionTestUtils.setField(deleteManager, "vmwareCbtMigrationDao", migrationDao);
+            ReflectionTestUtils.setField(deleteManager, "vmwareCbtMigrationCycleDao", cycleDao);
+            ReflectionTestUtils.setField(deleteManager, "vmwareCbtMigrationDiskDao", diskDao);
+            ReflectionTestUtils.setField(deleteManager, "agentManager", agentManager);
+            Mockito.doNothing().when(deleteManager).removeLingeringSourceSnapshots(migration);
+            DeleteVmwareCbtMigrationCmd cmd = Mockito.mock(DeleteVmwareCbtMigrationCmd.class);
+            Mockito.when(cmd.getId()).thenReturn(41L);
+            Mockito.when(cmd.getCleanup()).thenReturn(true);
+
+            Assert.assertTrue(deleteManager.deleteVmwareCbtMigration(cmd));
+
+            Mockito.verifyNoInteractions(agentManager);
+            Mockito.verify(diskDao, Mockito.times(1)).listByMigrationId(41L);
+            Mockito.verify(diskDao).remove(17L);
+            Mockito.verify(migrationDao).remove(41L);
+            Mockito.verify(deleteManager, Mockito.times(state == VmwareCbtMigration.State.Completed ? 0 : 1))
+                    .removeLingeringSourceSnapshots(migration);
+        }
+    }
+
+    @Test
+    public void testMigrationWithoutImportedVmStillExaminesCleanupTargets() {
+        VmwareCbtMigrationManagerImpl cleanupManager = new VmwareCbtMigrationManagerImpl();
+        VmwareCbtMigrationVO migration = Mockito.mock(VmwareCbtMigrationVO.class);
+        Mockito.when(migration.getId()).thenReturn(41L);
+        Mockito.when(migration.getVmId()).thenReturn(null);
+        VmwareCbtMigrationDao migrationDao = Mockito.mock(VmwareCbtMigrationDao.class);
+        Mockito.when(migrationDao.findById(41L)).thenReturn(migration);
+        VmwareCbtMigrationDiskDao diskDao = Mockito.mock(VmwareCbtMigrationDiskDao.class);
+        Mockito.when(diskDao.listByMigrationId(41L)).thenReturn(Collections.emptyList());
+        ReflectionTestUtils.setField(cleanupManager, "vmwareCbtMigrationDiskDao", diskDao);
+        ReflectionTestUtils.setField(cleanupManager, "vmwareCbtMigrationDao", migrationDao);
+        ReflectionTestUtils.setField(cleanupManager, "primaryDataStoreDao", Mockito.mock(PrimaryDataStoreDao.class));
+
+        ReflectionTestUtils.invokeMethod(cleanupManager, "sendCleanupCommandIfPossible", migration);
+
+        Mockito.verify(diskDao).listByMigrationId(41L);
+    }
+
+    @Test
+    public void testCleanupProtectsImportedVmRecordedAfterCallerLoadedMigration() {
+        VmwareCbtMigrationManagerImpl cleanupManager = new VmwareCbtMigrationManagerImpl();
+        VmwareCbtMigrationVO staleMigration = Mockito.mock(VmwareCbtMigrationVO.class);
+        Mockito.when(staleMigration.getId()).thenReturn(41L);
+        Mockito.when(staleMigration.getVmId()).thenReturn(null);
+        Mockito.when(staleMigration.getConvertHostId()).thenReturn(null);
+        VmwareCbtMigrationVO storedMigration = Mockito.mock(VmwareCbtMigrationVO.class);
+        Mockito.when(storedMigration.getVmId()).thenReturn(73L);
+        VmwareCbtMigrationDao migrationDao = Mockito.mock(VmwareCbtMigrationDao.class);
+        Mockito.when(migrationDao.findById(41L)).thenReturn(storedMigration);
+        VmwareCbtMigrationDiskDao diskDao = Mockito.mock(VmwareCbtMigrationDiskDao.class);
+        AgentManager agentManager = Mockito.mock(AgentManager.class);
+        ReflectionTestUtils.setField(cleanupManager, "vmwareCbtMigrationDao", migrationDao);
+        ReflectionTestUtils.setField(cleanupManager, "vmwareCbtMigrationDiskDao", diskDao);
+        ReflectionTestUtils.setField(cleanupManager, "agentManager", agentManager);
+
+        ReflectionTestUtils.invokeMethod(cleanupManager, "sendCleanupCommandIfPossible", staleMigration);
+        ReflectionTestUtils.invokeMethod(cleanupManager, "sendCleanupCommandForDelete", staleMigration);
+
+        Mockito.verify(migrationDao, Mockito.times(2)).findById(41L);
+        Mockito.verifyNoInteractions(diskDao, agentManager);
+    }
+
+    @Test
+    public void testCurrentStepDurationFormattingMatchesImportTaskStyle() {
+        Assert.assertEquals("0 secs", manager.formatDuration(0));
+        Assert.assertEquals("1 sec", manager.formatDuration(1));
+        Assert.assertEquals("59 secs", manager.formatDuration(59));
+        Assert.assertEquals("2 min 9 secs", manager.formatDuration(129));
+        Assert.assertEquals("1 hr 1 min 1 sec", manager.formatDuration(3661));
+    }
+}
diff --git a/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationImportTest.java b/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationImportTest.java
new file mode 100644
index 000000000000..3213ea2cf427
--- /dev/null
+++ b/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationImportTest.java
@@ -0,0 +1,126 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+import java.util.Collections;
+
+import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.junit.Assert;
+import org.junit.Test;
+import org.mockito.Mockito;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import com.cloud.storage.Storage;
+import com.cloud.uservm.UserVm;
+import com.cloud.vm.VmwareCbtMigrationDiskVO;
+import com.cloud.vm.VmwareCbtMigrationVO;
+import com.cloud.vm.dao.VmwareCbtMigrationDao;
+import com.cloud.vm.dao.VmwareCbtMigrationDiskDao;
+
+public class VmwareCbtMigrationImportTest {
+
+    @Test
+    public void testConvertedInstanceUsesVirtioDiskControllerForImport() {
+        VmwareCbtMigrationManagerImpl manager = new VmwareCbtMigrationManagerImpl();
+        VmwareCbtMigrationVO migration = new VmwareCbtMigrationVO(1L, 2L, 3L, 4L,
+                "display-name", "vcenter", "datacenter", "source-host", "source-cluster", "source-vm");
+
+        VmwareCbtMigrationDiskVO disk = new VmwareCbtMigrationDiskVO(migration.getId(), "619-2000", 2000,
+                "[datastore] source-vm/ROOT.vmdk", "datastore", 64424509440L);
+        disk.setTargetPath(String.format("/mnt/pool/cloudstack-cbt/%s/virt-v2v-output-1/%s-sda",
+                migration.getUuid(), migration.getUuid()));
+        disk.setTargetFormat("qcow2");
+
+        VmwareCbtMigrationDiskDao diskDao = Mockito.mock(VmwareCbtMigrationDiskDao.class);
+        Mockito.when(diskDao.listByMigrationId(migration.getId())).thenReturn(Collections.singletonList(disk));
+        ReflectionTestUtils.setField(manager, "vmwareCbtMigrationDiskDao", diskDao);
+        ReflectionTestUtils.setField(manager, "primaryDataStoreDao", Mockito.mock(PrimaryDataStoreDao.class));
+
+        UnmanagedInstanceTO convertedInstance = ReflectionTestUtils.invokeMethod(manager,
+                "createConvertedInstanceForImport", migration);
+
+        Assert.assertNotNull(convertedInstance);
+        Assert.assertEquals("virtio", convertedInstance.getDisks().get(0).getController());
+    }
+
+    @Test
+    public void testConvertedInstanceUsesRbdImageNameAsFileBaseName() {
+        VmwareCbtMigrationManagerImpl manager = new VmwareCbtMigrationManagerImpl();
+        VmwareCbtMigrationVO migration = new VmwareCbtMigrationVO(1L, 2L, 3L, 4L,
+                "display-name", "vcenter", "datacenter", "source-host", "source-cluster", "source-vm");
+
+        VmwareCbtMigrationDiskVO disk = new VmwareCbtMigrationDiskVO(migration.getId(), "619-2000", 2000,
+                "[datastore] source-vm/ROOT.vmdk", "datastore", 64424509440L);
+        disk.setTargetPath(String.format("cloudstack-cbt-%s-619-2000-ROOT-545", migration.getUuid()));
+        disk.setTargetFormat("raw");
+
+        VmwareCbtMigrationDiskDao diskDao = Mockito.mock(VmwareCbtMigrationDiskDao.class);
+        Mockito.when(diskDao.listByMigrationId(migration.getId())).thenReturn(Collections.singletonList(disk));
+        PrimaryDataStoreDao primaryDataStoreDao = Mockito.mock(PrimaryDataStoreDao.class);
+        StoragePoolVO storagePool = Mockito.mock(StoragePoolVO.class);
+        Mockito.when(primaryDataStoreDao.findById(migration.getStoragePoolId())).thenReturn(storagePool);
+        Mockito.when(storagePool.getUuid()).thenReturn("rbd-pool-uuid");
+        Mockito.when(storagePool.getPoolType()).thenReturn(Storage.StoragePoolType.RBD);
+        ReflectionTestUtils.setField(manager, "vmwareCbtMigrationDiskDao", diskDao);
+        ReflectionTestUtils.setField(manager, "primaryDataStoreDao", primaryDataStoreDao);
+
+        UnmanagedInstanceTO convertedInstance = ReflectionTestUtils.invokeMethod(manager,
+                "createConvertedInstanceForImport", migration);
+
+        Assert.assertNotNull(convertedInstance);
+        Assert.assertEquals(disk.getTargetPath(), convertedInstance.getDisks().get(0).getFileBaseName());
+        Assert.assertEquals("RBD", convertedInstance.getDisks().get(0).getDatastoreType());
+        Assert.assertEquals("rbd-pool-uuid", convertedInstance.getDisks().get(0).getDatastoreName());
+    }
+
+    @Test
+    public void testSuccessfulImportIsCompletedWithOneConditionalUpdate() {
+        VmwareCbtMigrationManagerImpl manager = new VmwareCbtMigrationManagerImpl();
+        VmwareCbtMigrationVO migration = Mockito.mock(VmwareCbtMigrationVO.class);
+        Mockito.when(migration.getId()).thenReturn(41L);
+        UserVm userVm = Mockito.mock(UserVm.class);
+        Mockito.when(userVm.getId()).thenReturn(73L);
+        VmwareCbtMigrationDao migrationDao = Mockito.mock(VmwareCbtMigrationDao.class);
+        Mockito.when(migrationDao.completeImportIfNotTerminal(Mockito.eq(41L), Mockito.eq(73L), Mockito.any()))
+                .thenReturn(true);
+        ReflectionTestUtils.setField(manager, "vmwareCbtMigrationDao", migrationDao);
+
+        Assert.assertTrue(manager.persistImportedVmResult(migration, userVm));
+
+        Mockito.verify(migrationDao).completeImportIfNotTerminal(Mockito.eq(41L), Mockito.eq(73L), Mockito.any());
+        Mockito.verify(migrationDao, Mockito.never()).recordImportedVmAndClearCredentials(
+                Mockito.anyLong(), Mockito.anyLong(), Mockito.any());
+    }
+
+    @Test
+    public void testImportThatRacesWithCancellationPreservesTerminalStateAndRecordsVm() {
+        VmwareCbtMigrationManagerImpl manager = new VmwareCbtMigrationManagerImpl();
+        VmwareCbtMigrationVO migration = Mockito.mock(VmwareCbtMigrationVO.class);
+        Mockito.when(migration.getId()).thenReturn(41L);
+        UserVm userVm = Mockito.mock(UserVm.class);
+        Mockito.when(userVm.getId()).thenReturn(73L);
+        VmwareCbtMigrationDao migrationDao = Mockito.mock(VmwareCbtMigrationDao.class);
+        Mockito.when(migrationDao.completeImportIfNotTerminal(Mockito.eq(41L), Mockito.eq(73L), Mockito.any()))
+                .thenReturn(false);
+        ReflectionTestUtils.setField(manager, "vmwareCbtMigrationDao", migrationDao);
+
+        Assert.assertFalse(manager.persistImportedVmResult(migration, userVm));
+
+        Mockito.verify(migrationDao).recordImportedVmAndClearCredentials(Mockito.eq(41L), Mockito.eq(73L), Mockito.any());
+    }
+}
diff --git a/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationNicValidationTest.java b/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationNicValidationTest.java
new file mode 100644
index 000000000000..0ed1a4e3dabd
--- /dev/null
+++ b/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationNicValidationTest.java
@@ -0,0 +1,144 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.api.ServerApiException;
+import org.junit.Assert;
+import org.junit.Test;
+
+import com.cloud.network.Network;
+
+public class VmwareCbtMigrationNicValidationTest {
+
+    private final VmwareCbtMigrationManagerImpl manager = new VmwareCbtMigrationManagerImpl();
+
+    private static VmwareCbtPreflightNicInfo nic(String id, String adapterType, Integer vlan) {
+        return new VmwareCbtPreflightNicInfo(id, adapterType, "00:50:56:00:00:01", vlan);
+    }
+
+    private static Map<String, Long> networkMap(String... nicIds) {
+        Map<String, Long> map = new HashMap<>();
+        long networkId = 100L;
+        for (String nicId : nicIds) {
+            map.put(nicId, networkId++);
+        }
+        return map;
+    }
+
+    @Test
+    public void testAcceptsFullyMappedNics() {
+        List<VmwareCbtPreflightNicInfo> nics = Arrays.asList(
+                nic("Network adapter 1", "Vmxnet3", null),
+                nic("Network adapter 2", "Vmxnet3", null));
+
+        manager.validateNicMappingsForStart("source-vm", nics,
+                networkMap("Network adapter 1", "Network adapter 2"), null);
+    }
+
+    @Test
+    public void testAcceptsNoSourceNics() {
+        manager.validateNicMappingsForStart("source-vm", Collections.emptyList(), null, null);
+    }
+
+    @Test
+    public void testRejectsUnmappedNicWithoutVlan() {
+        List<VmwareCbtPreflightNicInfo> nics = Arrays.asList(
+                nic("Network adapter 1", "Vmxnet3", null),
+                nic("Network adapter 2", "Vmxnet3", null));
+
+        try {
+            manager.validateNicMappingsForStart("source-vm", nics, networkMap("Network adapter 1"), null);
+            Assert.fail("Expected NIC mapping validation to fail");
+        } catch (ServerApiException e) {
+            Assert.assertTrue(e.getDescription().contains("Network adapter 2"));
+            Assert.assertTrue(e.getDescription().contains("no network mapping"));
+        }
+    }
+
+    @Test
+    public void testAcceptsUnmappedNicWithVlanForAutoMatch() {
+        List<VmwareCbtPreflightNicInfo> nics = Arrays.asList(
+                nic("Network adapter 1", "Vmxnet3", null),
+                nic("Network adapter 2", "Vmxnet3", 120));
+
+        manager.validateNicMappingsForStart("source-vm", nics, networkMap("Network adapter 1"), null);
+    }
+
+    @Test
+    public void testRejectsAllNicsUnmappedWithoutVlan() {
+        List<VmwareCbtPreflightNicInfo> nics = Collections.singletonList(
+                nic("Network adapter 1", "Vmxnet3", 0));
+
+        try {
+            manager.validateNicMappingsForStart("source-vm", nics, null, null);
+            Assert.fail("Expected NIC mapping validation to fail");
+        } catch (ServerApiException e) {
+            Assert.assertTrue(e.getDescription().contains("Network adapter 1"));
+        }
+    }
+
+    @Test
+    public void testRejectsNetworkMappingForUnknownNic() {
+        List<VmwareCbtPreflightNicInfo> nics = Collections.singletonList(
+                nic("Network adapter 1", "Vmxnet3", null));
+
+        try {
+            manager.validateNicMappingsForStart("source-vm", nics,
+                    networkMap("Network adapter 1", "Network adapter 9"), null);
+            Assert.fail("Expected NIC mapping validation to fail");
+        } catch (ServerApiException e) {
+            Assert.assertTrue(e.getDescription().contains("Network adapter 9"));
+            Assert.assertTrue(e.getDescription().contains("has no NIC(s)"));
+        }
+    }
+
+    @Test
+    public void testRejectsIpAddressMappingForUnknownNic() {
+        List<VmwareCbtPreflightNicInfo> nics = Collections.singletonList(
+                nic("Network adapter 1", "Vmxnet3", null));
+        Map<String, Network.IpAddresses> ipMap = new HashMap<>();
+        ipMap.put("Network adapter 7", new Network.IpAddresses("10.1.1.10", null));
+
+        try {
+            manager.validateNicMappingsForStart("source-vm", nics, networkMap("Network adapter 1"), ipMap);
+            Assert.fail("Expected NIC mapping validation to fail");
+        } catch (ServerApiException e) {
+            Assert.assertTrue(e.getDescription().contains("Network adapter 7"));
+        }
+    }
+
+    @Test
+    public void testRejectsMixedAdapterTypes() {
+        List<VmwareCbtPreflightNicInfo> nics = Arrays.asList(
+                nic("Network adapter 1", "Vmxnet3", null),
+                nic("Network adapter 2", "E1000", null));
+
+        try {
+            manager.validateNicMappingsForStart("source-vm", nics,
+                    networkMap("Network adapter 1", "Network adapter 2"), null);
+            Assert.fail("Expected NIC mapping validation to fail");
+        } catch (ServerApiException e) {
+            Assert.assertTrue(e.getDescription().contains("different types"));
+        }
+    }
+}
diff --git a/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationOfferingValidationTest.java b/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationOfferingValidationTest.java
new file mode 100644
index 000000000000..1bbd3cd2ca21
--- /dev/null
+++ b/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtMigrationOfferingValidationTest.java
@@ -0,0 +1,135 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ServerApiException;
+import org.junit.Assert;
+import org.junit.Test;
+import org.mockito.Mockito;
+
+import com.cloud.service.ServiceOfferingVO;
+import com.cloud.vm.VmDetailConstants;
+
+public class VmwareCbtMigrationOfferingValidationTest {
+
+    @Test
+    public void testRejectsServiceOfferingWithTooFewCpus() {
+        VmwareCbtPreflightInfo preflightInfo = createPreflightInfo(3, 0, 4096);
+        ServiceOfferingVO serviceOffering = createServiceOffering(1, 1000, 4096, Collections.emptyMap());
+
+        try {
+            VmwareCbtMigrationManagerImpl.validateSelectedServiceOfferingResourcesForSourceVm(
+                    preflightInfo, serviceOffering, Collections.emptyMap());
+            Assert.fail("Expected service offering validation to fail");
+        } catch (ServerApiException e) {
+            Assert.assertTrue(e.getDescription().contains("The requested CPU number (1) is less than the source VM CPU number (3)"));
+        }
+    }
+
+    @Test
+    public void testRejectsServiceOfferingWithTooLittleMemory() {
+        VmwareCbtPreflightInfo preflightInfo = createPreflightInfo(2, 0, 4096);
+        ServiceOfferingVO serviceOffering = createServiceOffering(2, 1000, 1024, Collections.emptyMap());
+
+        try {
+            VmwareCbtMigrationManagerImpl.validateSelectedServiceOfferingResourcesForSourceVm(
+                    preflightInfo, serviceOffering, Collections.emptyMap());
+            Assert.fail("Expected service offering validation to fail");
+        } catch (ServerApiException e) {
+            Assert.assertTrue(e.getDescription().contains("The requested Memory (1024) is less than the source VM Memory (4096)"));
+        }
+    }
+
+    @Test
+    public void testAcceptsServiceOfferingWithSufficientCpuAndMemory() {
+        VmwareCbtPreflightInfo preflightInfo = createPreflightInfo(2, 0, 4096);
+        ServiceOfferingVO serviceOffering = createServiceOffering(4, 1000, 8192, Collections.emptyMap());
+
+        VmwareCbtMigrationManagerImpl.validateSelectedServiceOfferingResourcesForSourceVm(
+                preflightInfo, serviceOffering, Collections.emptyMap());
+    }
+
+    @Test
+    public void testUsesCallerDetailsForCustomizedServiceOffering() {
+        VmwareCbtPreflightInfo preflightInfo = createPreflightInfo(3, 0, 4096);
+        Map<String, String> offeringDetails = new HashMap<>();
+        offeringDetails.put(ApiConstants.MIN_CPU_NUMBER, "1");
+        offeringDetails.put(ApiConstants.MIN_MEMORY, "1024");
+        ServiceOfferingVO serviceOffering = createServiceOffering(null, 1000, null, offeringDetails);
+        Map<String, String> callerDetails = new HashMap<>();
+        callerDetails.put(VmDetailConstants.CPU_NUMBER, "4");
+        callerDetails.put(VmDetailConstants.MEMORY, "8192");
+
+        VmwareCbtMigrationManagerImpl.validateSelectedServiceOfferingResourcesForSourceVm(
+                preflightInfo, serviceOffering, callerDetails);
+    }
+
+    @Test
+    public void testFallsBackToOfferingMinimumsWhenCallerDetailsAreMissing() {
+        Map<String, String> offeringDetails = new HashMap<>();
+        offeringDetails.put(ApiConstants.MIN_CPU_NUMBER, "2");
+        offeringDetails.put(ApiConstants.MIN_MEMORY, "2048");
+        ServiceOfferingVO serviceOffering = createServiceOffering(null, 1000, null, offeringDetails);
+
+        VmwareCbtMigrationManagerImpl.VmwareCbtOfferingResources resources =
+                VmwareCbtMigrationManagerImpl.resolveRequestedOfferingResources(serviceOffering, Collections.emptyMap());
+
+        Assert.assertEquals(Integer.valueOf(2), resources.getCpuNumber());
+        Assert.assertEquals(Integer.valueOf(1000), resources.getCpuSpeed());
+        Assert.assertEquals(Integer.valueOf(2048), resources.getMemoryMb());
+    }
+
+    @Test
+    public void testDetectsWindowsSourceVmFromVmwareGuestOsName() {
+        VmwareCbtPreflightInfo preflightInfo = createPreflightInfo("windows9Server64Guest", "Microsoft Windows Server 2016 (64-bit)");
+
+        Assert.assertTrue(VmwareCbtMigrationManagerImpl.isWindowsSourceVm(preflightInfo));
+    }
+
+    @Test
+    public void testDoesNotRequireWindowsConversionSupportForLinuxSourceVm() {
+        VmwareCbtPreflightInfo preflightInfo = createPreflightInfo("ubuntu64Guest", "Ubuntu Linux (64-bit)");
+
+        Assert.assertFalse(VmwareCbtMigrationManagerImpl.isWindowsSourceVm(preflightInfo));
+    }
+
+    private VmwareCbtPreflightInfo createPreflightInfo(Integer cpuCores, Integer cpuSpeed, Integer memoryMb) {
+        return new VmwareCbtPreflightInfo("source-vm", "vm-1", true, true, false, 0,
+                Collections.emptyList(), cpuCores, cpuSpeed, memoryMb);
+    }
+
+    private VmwareCbtPreflightInfo createPreflightInfo(String operatingSystemId, String operatingSystem) {
+        return new VmwareCbtPreflightInfo("source-vm", "vm-1", true, true, false, 0,
+                Collections.emptyList(), Collections.emptyList(), 2, 1000, 2048, operatingSystemId, operatingSystem);
+    }
+
+    private ServiceOfferingVO createServiceOffering(Integer cpu, Integer cpuSpeed, Integer memory,
+                                                    Map<String, String> details) {
+        ServiceOfferingVO serviceOffering = Mockito.mock(ServiceOfferingVO.class);
+        Mockito.when(serviceOffering.getCpu()).thenReturn(cpu);
+        Mockito.when(serviceOffering.getSpeed()).thenReturn(cpuSpeed);
+        Mockito.when(serviceOffering.getRamSize()).thenReturn(memory);
+        Mockito.when(serviceOffering.getDetails()).thenReturn(details);
+        Mockito.when(serviceOffering.getUuid()).thenReturn("service-offering-uuid");
+        return serviceOffering;
+    }
+}
diff --git a/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtStorageTargetTest.java b/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtStorageTargetTest.java
new file mode 100644
index 000000000000..014acaba3405
--- /dev/null
+++ b/server/src/test/java/org/apache/cloudstack/vm/VmwareCbtStorageTargetTest.java
@@ -0,0 +1,205 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.vm;
+
+import java.util.List;
+
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.junit.Assert;
+import org.junit.Test;
+import org.mockito.Mockito;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import com.cloud.agent.api.to.VmwareCbtTargetStorageType;
+import com.cloud.dc.ClusterVO;
+import com.cloud.dc.DataCenterVO;
+import com.cloud.host.Host;
+import com.cloud.host.HostVO;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.storage.Storage;
+
+public class VmwareCbtStorageTargetTest {
+
+    private final VmwareCbtMigrationManagerImpl manager = new VmwareCbtMigrationManagerImpl();
+
+    @Test
+    public void testFilesystemTargetDoesNotRequireInPlaceFinalization() {
+        VmwareCbtStorageTarget target = VmwareCbtStorageTarget.forPool(createStoragePool(Storage.StoragePoolType.NetworkFilesystem));
+
+        Assert.assertTrue(target.isSupported());
+        Assert.assertEquals(VmwareCbtTargetStorageType.QCOW2_FILE, target.getTargetStorageType());
+        Assert.assertFalse(target.requiresInPlaceFinalization());
+        Assert.assertTrue(target.supportsNonInPlaceFinalizationFallback());
+    }
+
+    @Test
+    public void testRbdTargetRequiresInPlaceFinalization() {
+        VmwareCbtStorageTarget target = VmwareCbtStorageTarget.forPool(createStoragePool(Storage.StoragePoolType.RBD));
+
+        Assert.assertTrue(target.isSupported());
+        Assert.assertEquals(VmwareCbtTargetStorageType.RBD_RAW, target.getTargetStorageType());
+        Assert.assertTrue(target.requiresInPlaceFinalization());
+        Assert.assertFalse(target.supportsNonInPlaceFinalizationFallback());
+    }
+
+    @Test
+    public void testLinstorTargetUsesRawBlockDeviceAndRequiresInPlaceFinalization() {
+        VmwareCbtStorageTarget target = VmwareCbtStorageTarget.forPool(createStoragePool(Storage.StoragePoolType.Linstor));
+
+        Assert.assertTrue(target.isSupported());
+        Assert.assertEquals(VmwareCbtTargetStorageType.RAW_BLOCK_DEVICE, target.getTargetStorageType());
+        Assert.assertTrue(target.requiresInPlaceFinalization());
+        Assert.assertFalse(target.supportsNonInPlaceFinalizationFallback());
+    }
+
+    @Test
+    public void testBlockDeviceTargetMarkerIsShortAndStable() {
+        String marker = VmwareCbtMigrationManagerImpl.getBlockDeviceTargetMarker("12345678-9abc-def0-1234-56789abcdef0");
+
+        Assert.assertEquals("cbt-12345678-", marker);
+    }
+
+    @Test
+    public void testListCbtCompatibleStoragePoolsIncludesLinstorPools() {
+        PrimaryDataStoreDao primaryDataStoreDao = Mockito.mock(PrimaryDataStoreDao.class);
+        ReflectionTestUtils.setField(manager, "primaryDataStoreDao", primaryDataStoreDao);
+        DataCenterVO zone = createZone(1L);
+        ClusterVO cluster = createCluster(2L);
+        StoragePoolVO linstorPool = createStoragePool(11L, Storage.StoragePoolType.Linstor);
+
+        Mockito.when(primaryDataStoreDao.findClusterWideStoragePoolsByHypervisorAndPoolType(2L,
+                Hypervisor.HypervisorType.KVM, Storage.StoragePoolType.Linstor)).thenReturn(List.of(linstorPool));
+
+        List<StoragePoolVO> pools = manager.listCbtCompatibleStoragePools(zone, cluster);
+
+        Assert.assertEquals(1, pools.size());
+        Assert.assertSame(linstorPool, pools.get(0));
+    }
+
+    @Test
+    public void testValidateStorageTargetFinalizationFailsWhenHostDoesNotSupportInPlace() {
+        VmwareCbtStorageTarget target = VmwareCbtStorageTarget.forPool(createStoragePool(Storage.StoragePoolType.RBD));
+        HostVO host = createHost("kvm1", "false");
+
+        try {
+            manager.validateStorageTargetFinalizationSupport(target, host);
+            Assert.fail("Expected validation failure");
+        } catch (ServerApiException e) {
+            Assert.assertTrue(e.getDescription().contains("requires virt-v2v in-place finalization"));
+            Assert.assertTrue(e.getDescription().contains("kvm1"));
+        }
+    }
+
+    @Test
+    public void testValidateStorageTargetFinalizationPassesWhenHostSupportsInPlace() {
+        VmwareCbtStorageTarget target = VmwareCbtStorageTarget.forPool(createStoragePool(Storage.StoragePoolType.RBD));
+        HostVO host = createHost("kvm1", "true");
+
+        manager.validateStorageTargetFinalizationSupport(target, host);
+    }
+
+    @Test
+    public void testValidateFilesystemTargetFinalizationFailsWhenHostDoesNotSupportInPlaceByDefault() {
+        VmwareCbtStorageTarget target = VmwareCbtStorageTarget.forPool(createStoragePool(Storage.StoragePoolType.NetworkFilesystem));
+        HostVO host = createHost("kvm1", "false");
+
+        try {
+            manager.validateStorageTargetFinalizationSupport(target, host);
+            Assert.fail("Expected validation failure");
+        } catch (ServerApiException e) {
+            Assert.assertTrue(e.getDescription().contains("cannot finalize VMware CBT migration in-place"));
+            Assert.assertTrue(e.getDescription().contains("kvm1"));
+        }
+    }
+
+    @Test
+    public void testValidateFilesystemTargetFinalizationPassesWhenHostSupportsInPlace() {
+        VmwareCbtStorageTarget target = VmwareCbtStorageTarget.forPool(createStoragePool(Storage.StoragePoolType.NetworkFilesystem));
+        HostVO host = createHost("kvm1", "true");
+
+        manager.validateStorageTargetFinalizationSupport(target, host);
+    }
+
+    @Test
+    public void testListCbtCompatibleStoragePoolsIncludesRbdPools() {
+        PrimaryDataStoreDao primaryDataStoreDao = Mockito.mock(PrimaryDataStoreDao.class);
+        ReflectionTestUtils.setField(manager, "primaryDataStoreDao", primaryDataStoreDao);
+        DataCenterVO zone = createZone(1L);
+        ClusterVO cluster = createCluster(2L);
+        StoragePoolVO rbdPool = createStoragePool(10L, Storage.StoragePoolType.RBD);
+
+        Mockito.when(primaryDataStoreDao.findClusterWideStoragePoolsByHypervisorAndPoolType(2L,
+                Hypervisor.HypervisorType.KVM, Storage.StoragePoolType.RBD)).thenReturn(List.of(rbdPool));
+
+        List<StoragePoolVO> pools = manager.listCbtCompatibleStoragePools(zone, cluster);
+
+        Assert.assertEquals(1, pools.size());
+        Assert.assertSame(rbdPool, pools.get(0));
+    }
+
+    @Test
+    public void testListCbtCompatibleStoragePoolsDeduplicatesClusterAndZoneScope() {
+        PrimaryDataStoreDao primaryDataStoreDao = Mockito.mock(PrimaryDataStoreDao.class);
+        ReflectionTestUtils.setField(manager, "primaryDataStoreDao", primaryDataStoreDao);
+        DataCenterVO zone = createZone(1L);
+        ClusterVO cluster = createCluster(2L);
+        StoragePoolVO pool = createStoragePool(10L, Storage.StoragePoolType.NetworkFilesystem);
+
+        Mockito.when(primaryDataStoreDao.findClusterWideStoragePoolsByHypervisorAndPoolType(2L,
+                Hypervisor.HypervisorType.KVM, Storage.StoragePoolType.NetworkFilesystem)).thenReturn(List.of(pool));
+        Mockito.when(primaryDataStoreDao.findZoneWideStoragePoolsByHypervisorAndPoolType(1L,
+                Hypervisor.HypervisorType.KVM, Storage.StoragePoolType.NetworkFilesystem)).thenReturn(List.of(pool));
+
+        List<StoragePoolVO> pools = manager.listCbtCompatibleStoragePools(zone, cluster);
+
+        Assert.assertEquals(1, pools.size());
+        Assert.assertSame(pool, pools.get(0));
+    }
+
+    private StoragePoolVO createStoragePool(Storage.StoragePoolType poolType) {
+        StoragePoolVO pool = Mockito.mock(StoragePoolVO.class);
+        Mockito.when(pool.getPoolType()).thenReturn(poolType);
+        return pool;
+    }
+
+    private StoragePoolVO createStoragePool(long id, Storage.StoragePoolType poolType) {
+        StoragePoolVO pool = createStoragePool(poolType);
+        Mockito.when(pool.getId()).thenReturn(id);
+        return pool;
+    }
+
+    private HostVO createHost(String name, String inPlaceSupported) {
+        HostVO host = Mockito.mock(HostVO.class);
+        Mockito.when(host.getName()).thenReturn(name);
+        Mockito.when(host.getDetail(Host.HOST_VDDK_BLOCKCOPY_INPLACE_FINALIZATION_SUPPORT)).thenReturn(inPlaceSupported);
+        return host;
+    }
+
+    private DataCenterVO createZone(long id) {
+        DataCenterVO zone = Mockito.mock(DataCenterVO.class);
+        Mockito.when(zone.getId()).thenReturn(id);
+        return zone;
+    }
+
+    private ClusterVO createCluster(long id) {
+        ClusterVO cluster = Mockito.mock(ClusterVO.class);
+        Mockito.when(cluster.getId()).thenReturn(id);
+        return cluster;
+    }
+}
diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index f51f6f56126b..2e7da882f391 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -772,6 +772,7 @@
 "label.current": "Current",
 "label.currentstep": "Current step",
 "label.currentstep.duration": "Current step duration",
+"label.completedcycles": "Completed cycles",
 "label.current.storage": "Current storage",
 "label.currentpassword": "Current password",
 "label.custom": "Custom",
@@ -895,8 +896,8 @@
 "label.desc.db.stats": "Database Statistics",
 "label.desc.importexportinstancewizard": "Import and export Instances to/from an existing VMware or KVM Cluster.",
 "label.desc.import.ext.kvm.wizard": "Import Instance from remote KVM host",
-"label.desc.import.local.kvm.wizard": "Import QCOW2 image from Local Storage",
-"label.desc.import.shared.kvm.wizard": "Import QCOW2 image from Shared Storage",
+"label.desc.import.local.kvm.wizard": "Import Instance using existing ROOT disk from Local Storage",
+"label.desc.import.shared.kvm.wizard": "Import Instance using existing ROOT disk from Shared Storage",
 "label.desc.import.unmanage.volume": "Import and unmanage volume on Storage Pools",
 "label.desc.ingesttinstancewizard": "Ingest instances from an external KVM host",
 "label.desc.importmigratefromvmwarewizard": "Import instances from VMware into a KVM Cluster",
@@ -1324,10 +1325,20 @@
 "label.host.alerts": "Hosts in alert state",
 "label.host.name": "Host name",
 "label.host.ovftool.version": "OVFTool Version",
+"label.host.qemu.img.version": "QEMU Image Version",
+"label.host.qemu.io.version": "QEMU I/O Version",
+"label.host.qemu.nbd.version": "QEMU NBD Version",
+"label.host.qemu.rbd.support": "QEMU RBD Support",
+"label.host.vddk.blockcopy.inplace.finalization.support": "VDDK Block Copy In-Place Finalization Support",
+"label.host.vddk.blockcopy.rbd.support": "VDDK Block Copy to RBD Support",
+"label.host.vddk.rbd.direct.import.support": "VDDK Direct Import to RBD Support",
 "label.host.vddk.support": "VDDK Support",
 "label.host.vddk.version": "VDDK Version",
 "label.host.tag": "Host tag",
+"label.host.virtv2v.inplace.support": "Virt-v2v In-Place Support",
+"label.host.virtv2v.inplace.version": "Virt-v2v In-Place Version",
 "label.host.virtv2v.version": "Virt-v2v Version",
+"label.host.vmware.cbt.data.copy.support": "VMware CBT Data-Copy Support",
 "label.hostcontrolstate": "Compute Resource Status",
 "label.hostid": "Host",
 "label.hostname": "Host",
@@ -2137,6 +2148,7 @@
 "label.quickview": "Quick view",
 "label.quiescevm": "Quiesce Instance",
 "label.quiettime": "Quiet time (in sec)",
+"label.quietcycles": "Quiet cycles",
 "label.quota": "Quota",
 "label.quota.add.credits": "Add credits",
 "label.quota.configuration": "Quota configuration",
@@ -2517,6 +2529,7 @@
 "label.sourcecidr": "Source CIDR",
 "label.sourcecidrlist": "Source CIDR list",
 "label.sourcehost": "Source host",
+"label.sourcecluster": "Source cluster",
 "label.sourceipaddress": "Source IP address",
 "label.sourceipaddressnetworkid": "Network ID of source IP address",
 "label.sourcenat": "Source NAT",
@@ -2567,6 +2580,26 @@
 "label.user.data": "User Data",
 "label.user.data.library": "User Data Library",
 "label.use.vddk": "Use VDDK",
+"label.vmware.migration.mode": "VMware migration mode",
+"label.vmware.migration.mode.ovf": "OVF",
+"label.vmware.migration.mode.vddk": "VDDK",
+"label.vmware.migration.mode.cbt": "CBT",
+"label.vmware.cbt.migrations": "VMware CBT Migrations",
+"label.sync.delta": "Sync delta",
+"label.cutover": "Cutover",
+"label.cyclenumber": "Cycle",
+"label.changedbytes": "Changed bytes",
+"label.dirtyrate": "Dirty rate",
+"label.lastchangedbytes": "Last changed bytes",
+"label.lastdirtyrate": "Last dirty rate",
+"label.totalchangedbytes": "Total changed bytes",
+"label.lasterror": "Last error",
+"label.source.disk": "Source disk",
+"label.source.disk.path": "Source disk path",
+"label.target.path": "Target path",
+"label.target.format": "Target format",
+"label.change.id": "Change ID",
+"label.snapshot.mor": "Snapshot MOR",
 "label.ssh.port": "SSH port",
 "label.sshkeypair": "New SSH key pair",
 "label.sshkeypairs": "SSH key pairs",
@@ -3271,6 +3304,7 @@
 "message.action.vmsnapshot.delete": "Please confirm that you want to delete this Instance Snapshot. <br>Please notice that the Instance will be paused before the Snapshot deletion, and resumed after deletion, if it runs on KVM.",
 "message.action.vmsnapshot.disk-only.delete": "Please confirm that you want to delete this Instance Snapshot.",
 "message.activate.project": "Are you sure you want to activate this project?",
+"message.api.not.available": "API is not available.",
 "message.add.custom.action.parameters": "Parameters to be made available while running the custom action.",
 "message.add.egress.rule.failed": "Adding new egress rule failed.",
 "message.add.egress.rule.processing": "Adding new egress rule...",
@@ -3414,6 +3448,10 @@
 "message.confirm.archive.selected.alerts": "Please confirm you would like to archive the selected alerts",
 "message.confirm.archive.selected.events": "Please confirm you would like to archive the selected events",
 "message.confirm.attach.disk": "Are you sure you want to attach disk?",
+"message.confirm.cancel.vmware.cbt.migration": "Please confirm that you want to cancel this VMware CBT migration.",
+"message.confirm.delete.vmware.cbt.migration": "Please confirm that you want to delete this VMware CBT migration record. Failed and cancelled migrations also clean up replicated target disks; completed migrations keep the imported VM and volumes.",
+"message.confirm.sync.vmware.cbt.migration": "Please confirm that you want to run the next VMware CBT delta synchronization cycle.",
+"message.confirm.cutover.vmware.cbt.migration": "Before cutover, gracefully shut down the source VMware VM and confirm it is powered off in vCenter. CloudStack will not power off the source VM automatically. Continue with final cutover?",
 "message.confirm.change.disk.offering.for.sharedfs": "Please confirm that you want to change the disk offering for the Shared FileSystem. This might migrate the underlying volume to a different storage pool if required.",
 "message.confirm.change.offering.for.volume": "Please confirm that you want to change disk offering for the volume",
 "message.confirm.change.service.offering.for.sharedfs": "Please confirm that you want to change the service offering for the Shared FileSystem.",
@@ -3575,8 +3613,8 @@
 "message.desc.created.ssh.key.pair": "Created a SSH key pair.",
 "message.desc.host": "Each Cluster must contain at least one host (computer) for guest Instances to run on. We will add the first host now. For a host to function in CloudStack, you must install hypervisor software on the host, assign an IP address to the host, and ensure the host is connected to the CloudStack management server.<br/><br/>Give the host's DNS or IP address, the user name (usually root) and password, and any labels you use to categorize hosts.",
 "message.desc.import.ext.kvm.wizard": "Import libvirt domain from External KVM Host not managed by CloudStack",
-"message.desc.import.local.kvm.wizard": "Import QCOW2 image from Local Storage of selected KVM Host",
-"message.desc.import.shared.kvm.wizard": "Import QCOW2 image from selected Primary Storage Pool",
+"message.desc.import.local.kvm.wizard": "Import an Instance using an existing ROOT disk from the Local Storage of the selected KVM host",
+"message.desc.import.shared.kvm.wizard": "Import an Instance using an existing ROOT disk from the selected Primary Storage pool",
 "message.desc.import.unmanage.volume": "Please choose a storage pool that you want to import or unmanage volumes. The storage pool should be in Up status. <br>This feature only supports KVM.",
 "message.desc.importexportinstancewizard": "By choosing to manage an Instance, CloudStack takes over the orchestration of that Instance. Unmanaging an Instance removes CloudStack ability to manage it. In both cases, the Instance is left running and no changes are done to the VM on the hypervisor.<br><br>For KVM, managing a VM is an experimental feature.",
 "message.desc.importingestinstancewizard": "This feature only applies to libvirt based KVM instances. Only Stopped instances can be ingested",
@@ -3818,6 +3856,7 @@
 "message.host.external.datadisk": "Usage of data disks for the selected template is not applicable",
 "message.import.running.instance.warning": "The selected VM is powered-on on the VMware Datacenter. The recommended state to convert a VMware VM into KVM is powered-off after a graceful shutdown of the guest OS.",
 "message.import.vm.tasks": "Import from VMware to KVM tasks",
+"message.vmware.cbt.migrations": "CBT incremental migration sessions from VMware to KVM",
 "message.import.volume": "Please specify the domain, account or project name. <br>If not set, the volume will be imported for the caller.",
 "message.inherited.readiness.rule": "This rule is inherited from the instance group; delete it from the group's readiness rules instead.",
 "message.info.cloudian.console": "Cloudian Management Console should open in another window.",
diff --git a/ui/public/locales/pt_BR.json b/ui/public/locales/pt_BR.json
index 8fba779b1d12..1efd99f40d16 100644
--- a/ui/public/locales/pt_BR.json
+++ b/ui/public/locales/pt_BR.json
@@ -796,8 +796,8 @@
 "label.deploymentplanner": "Planejador de implanta\u00e7\u00e3o",
 "label.desc.db.stats": "Estat\u00edsticas do Banco de Dados",
 "label.desc.import.ext.kvm.wizard": "Importar Inst\u00e2ncia de host KVM remoto",
-"label.desc.import.local.kvm.wizard": "Importar imagem QCOW2 do Armazenamento Local",
-"label.desc.import.shared.kvm.wizard": "Importar imagem QCOW2 do Armazenamento Compartilhado",
+"label.desc.import.local.kvm.wizard": "Importar Instância usando disco ROOT existente do Armazenamento Local",
+"label.desc.import.shared.kvm.wizard": "Importar Instância usando disco ROOT existente do Armazenamento Compartilhado",
 "label.desc.import.unmanage.volume": "Importar e parar de gerenciar volume em Pools de Armazenamento",
 "label.desc.importexportinstancewizard": "Importar e exportar inst\u00e2ncias para/de um cluster VMWare existente",
 "label.desc.importmigratefromvmwarewizard": "Importar inst\u00e2ncias do VMware para um cluster KVM",
@@ -3076,8 +3076,8 @@
 "message.desc.edge.zone": "Zonas Edge s\u00e3o zonas leves, projetadas para implanta\u00e7\u00e3o em cen\u00e1rios de computa\u00e7\u00e3o de borda. Elas s\u00e3o limitadas em funcionalidade, mas t\u00eam muito menos pr\u00e9-requisitos do que zonas core.<br><br>Por favor, consulte a documenta\u00e7\u00e3o do Apache CloudStack para mais informa\u00e7\u00f5es sobre Tipos de Zona<br><a href='http://docs.cloudstack.apache.org/en/latest/installguide/configuration.html#adding-a-zone'>http://docs.cloudstack.apache.org/en/latest/installguide/configuration.html#adding-a-zone</a>",
 "message.desc.host": "Cada cluster deve conter pelo menos um host (computador) para as VMs guest serem executadas e iremos adicionar o primeira host agora. Para um host funcionar no CloudStack, voc\u00ea deve instalar um virtualizador no host, atribuir um endere\u00e7o IP e garantir que o host est\u00e1 conectado ao Management Server do CloudStack.<br/><br/>Forne\u00e7a o hostname ou o endere\u00e7o IP do host, o nome de usu\u00e1rio (geralmente root) e a senha e qualquer label que voc\u00ea utiliza para categorizar os hosts.",
 "message.desc.import.ext.kvm.wizard": "Importar dom\u00ednio libvirt de Host KVM Externo n\u00e3o gerenciado pelo CloudStack",
-"message.desc.import.local.kvm.wizard": "Importar imagem QCOW2 do Armazenamento Local do Host KVM selecionado",
-"message.desc.import.shared.kvm.wizard": "Importar imagem QCOW2 do Pool de Armazenamento Prim\u00e1rio selecionado",
+"message.desc.import.local.kvm.wizard": "Importar uma Instância usando um disco ROOT existente do Armazenamento Local do Host KVM selecionado",
+"message.desc.import.shared.kvm.wizard": "Importar uma Inst\u00e2ncia usando um disco ROOT existente do Pool de Armazenamento Prim\u00e1rio selecionado",
 "message.desc.import.unmanage.volume": "Por favor, escolha um pool de armazenamento do qual voc\u00ea deseja importar ou parar de gerenciar volumes. O pool de armazenamento deve estar no status Up. <br>Este recurso suporta apenas KVM.",
 "message.desc.importexportinstancewizard": "Testa caracter\u00edstica s\u00f3 se aplica aos clusters Cloudstack VMware. Ao optar por gerenciar uma inst\u00e2ncia, o CloudStack assume a orquestra\u00e7\u00e3o dessa inst\u00e2ncia. A inst\u00e2ncia \u00e9 deixada em funcionamento e n\u00e3o movida fisicamente. Desagrupar inst\u00e2ncias, remove a capacidade do CloudStack de gerenci\u00e1-las (mas elas s\u00e3o deixadas em funcionamento e n\u00e3o s\u00e3o destru\u00eddas).",
 "message.desc.importingestinstancewizard": "Este recurso aplica-se apenas a inst\u00e2ncias KVM baseadas em libvirt. Apenas inst\u00e2ncias Paradas podem ser ingeridas",
diff --git a/ui/public/locales/te.json b/ui/public/locales/te.json
index dbbda2d99c08..0c332af53aee 100644
--- a/ui/public/locales/te.json
+++ b/ui/public/locales/te.json
@@ -752,8 +752,8 @@
   "label.desc.db.stats": "డేటాబేస్ గణాంకాలు",
   "label.desc.importexportinstancewizard": "ఇప్పటికే ఉన్న VMware లేదా KVM క్లస్టర్‌కు/నుండి ఉదంతాలను దిగుమతి చేయండి మరియు ఎగుమతి చేయండి.",
   "label.desc.import.ext.kvm.wizard": "రిమోట్ KVM హోస్ట్ నుండి ఉదాహరణను దిగుమతి చేయండి",
-  "label.desc.import.local.kvm.wizard": "స్థానిక నిల్వ నుండి QCOW2 చిత్రాన్ని దిగుమతి చేయండి",
-  "label.desc.import.shared.kvm.wizard": "షేర్డ్ స్టోరేజ్ నుండి QCOW2 చిత్రాన్ని దిగుమతి చేయండి",
+  "label.desc.import.local.kvm.wizard": "స్థానిక నిల్వ నుండి ఇప్పటికే ఉన్న ROOT డిస్క్‌ను ఉపయోగించి ఇన్‌స్టాన్స్‌ను దిగుమతి చేయండి",
+  "label.desc.import.shared.kvm.wizard": "షేర్డ్ స్టోరేజ్ నుండి ఇప్పటికే ఉన్న ROOT డిస్క్‌ను ఉపయోగించి ఇన్‌స్టాన్స్‌ను దిగుమతి చేయండి",
   "label.desc.import.unmanage.volume": "స్టోరేజ్ పూల్స్‌లో వాల్యూమ్‌ను దిగుమతి చేయండి మరియు నిర్వహించవద్దు",
   "label.desc.ingesttinstancewizard": "బాహ్య KVM హోస్ట్ నుండి ఇన్‌జెస్ట్ ఇన్‌స్టాన్స్",
   "label.desc.importmigratefromvmwarewizard": "VMware నుండి KVM క్లస్టర్‌లోకి ఇన్‌స్టాన్స్‌లను దిగుమతి చేయండి",
@@ -2965,8 +2965,8 @@
   "message.desc.host": "అతిథి ఉదంతాలు అమలు కావడానికి ప్రతి క్లస్టర్ తప్పనిసరిగా కనీసం ఒక హోస్ట్ (కంప్యూటర్)ని కలిగి ఉండాలి. <br/><br/>హోస్ట్ యొక్క DNS లేదా IP చిరునామా, వినియోగదారు పేరు (సాధారణంగా రూట్) మరియు పాస్‌వర్డ్ మరియు హోస్ట్‌లను వర్గీకరించడానికి మీరు ఉపయోగించే ఏవైనా లేబుల్‌లను ఇవ్వండి.",
   "message.desc.importingestinstancewizard": "ఈ ఫీచర్ కేవలం libvirt ఆధారిత KVM ఉదంతాలకు మాత్రమే వర్తిస్తుంది. ",
   "message.desc.import.ext.kvm.wizard": "CloudStack ద్వారా నిర్వహించబడని బాహ్య KVM హోస్ట్ నుండి libvirt డొమైన్‌ను దిగుమతి చేయండి",
-  "message.desc.import.local.kvm.wizard": "ఎంచుకున్న KVM హోస్ట్ యొక్క స్థానిక నిల్వ నుండి QCOW2 చిత్రాన్ని దిగుమతి చేయండి",
-  "message.desc.import.shared.kvm.wizard": "ఎంచుకున్న ప్రాథమిక నిల్వ పూల్ నుండి QCOW2 చిత్రాన్ని దిగుమతి చేయండి",
+  "message.desc.import.local.kvm.wizard": "ఎంచుకున్న KVM హోస్ట్ యొక్క స్థానిక నిల్వ నుండి ఇప్పటికే ఉన్న ROOT డిస్క్‌ను ఉపయోగించి ఇన్‌స్టాన్స్‌ను దిగుమతి చేయండి",
+  "message.desc.import.shared.kvm.wizard": "ఎంచుకున్న ప్రాథమిక నిల్వ పూల్ నుండి ఇప్పటికే ఉన్న ROOT డిస్క్‌ను ఉపయోగించి ఇన్‌స్టాన్స్‌ను దిగుమతి చేయండి",
   "message.desc.import.unmanage.volume": "దయచేసి మీరు వాల్యూమ్‌లను దిగుమతి చేయాలనుకునే లేదా నిర్వహించాలనుకుంటున్న స్టోరేజ్ పూల్‌ను ఎంచుకోండి.  <br>ఈ ఫీచర్ KVMకి మాత్రమే మద్దతు ఇస్తుంది.",
   "message.desc.importexportinstancewizard": "ఒక ఉదాహరణను నిర్వహించడాన్ని ఎంచుకోవడం ద్వారా, క్లౌడ్‌స్టాక్ ఆ సంఘటన యొక్క ఆర్కెస్ట్రేషన్‌ను తీసుకుంటుంది. <br><br>KVM కోసం, VMని నిర్వహించడం అనేది ఒక ప్రయోగాత్మక లక్షణం.",
   "message.desc.importmigratefromvmwarewizard": "ఇప్పటికే ఉన్న లేదా బాహ్య VMware డేటాసెంటర్‌ను మరియు దిగుమతి చేయడానికి ఒక ఉదాహరణను ఎంచుకోవడం ద్వారా, CloudStack ఎంచుకున్న ఉదాహరణను virt-v2vని ఉపయోగించి మార్పిడి హోస్ట్‌లో VMware నుండి KVMకి మారుస్తుంది మరియు దానిని KVM క్లస్టర్‌లోకి దిగుమతి చేస్తుంది.",
diff --git a/ui/src/config/section/tools.js b/ui/src/config/section/tools.js
index 5b7f4b9af325..a49a6b8b82f5 100644
--- a/ui/src/config/section/tools.js
+++ b/ui/src/config/section/tools.js
@@ -17,6 +17,20 @@
 import store from '@/store'
 import { shallowRef, defineAsyncComponent } from 'vue'
 
+const vmImportExportApis = [
+  'listUnmanagedInstances',
+  'importUnmanagedInstance',
+  'listVmwareDcVms',
+  'listVmsForImport',
+  'importVm',
+  'listImportVmTasks',
+  'listVmwareCbtMigrations',
+  'startVmwareCbtMigration'
+]
+
+const hasApi = apiName => Object.prototype.hasOwnProperty.call(store.getters.apis, apiName)
+const hasAnyApi = apiNames => apiNames.some(apiName => hasApi(apiName))
+
 export default {
   name: 'tools',
   title: 'label.tools',
@@ -75,7 +89,8 @@ export default {
       icon: 'interaction-outlined',
       docHelp: 'adminguide/virtual_machines.html#importing-and-unmanaging-virtual-machine',
       resourceType: 'UserVm',
-      permission: ['listInfrastructure', 'listUnmanagedInstances'],
+      show: () => hasAnyApi(vmImportExportApis),
+      permission: [],
       component: () => import('@/views/tools/ManageInstances.vue')
     },
     {
diff --git a/ui/src/utils/vmware.js b/ui/src/utils/vmware.js
new file mode 100644
index 000000000000..8f85426c3806
--- /dev/null
+++ b/ui/src/utils/vmware.js
@@ -0,0 +1,41 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+export const formatKvmConversionHostName = (host, migrationMode, yes, no) => {
+  const details = host.details || {}
+  const isSupported = value => value === true || value === 'true'
+  const hostParts = [host.name]
+  const capabilityParts = []
+
+  if (host.clustername) {
+    hostParts.push(`[${host.clustername}]`)
+  }
+
+  const virtV2vVersion = details['host.virtv2v.version']
+  capabilityParts.push(`virt-v2v=${virtV2vVersion || (isSupported(host.instanceconversionsupported) ? yes : no)}`)
+
+  if (migrationMode === 'cbt' || migrationMode === 'vddk') {
+    const vddkSupported = isSupported(details['host.vddk.support'])
+    const vddkVersion = details['host.vddk.version']
+    capabilityParts.push(`VDDK=${vddkSupported ? (vddkVersion || yes) : no}`)
+  }
+  if (migrationMode === 'cbt') {
+    capabilityParts.push(`CBT=${isSupported(details['host.vddk.blockcopy.support']) ? yes : no}`)
+  }
+
+  return `${hostParts.join(' ')} — ${capabilityParts.join(' / ')}`
+}
diff --git a/ui/src/views/infra/HostInfo.vue b/ui/src/views/infra/HostInfo.vue
index cb16a5a8bbee..111de8f131d5 100644
--- a/ui/src/views/infra/HostInfo.vue
+++ b/ui/src/views/infra/HostInfo.vue
@@ -48,7 +48,7 @@
           </div>
         </div>
       </a-list-item>
-      <a-list-item v-if="host.instanceconversionsupported">
+      <a-list-item v-if="host.instanceconversionsupported !== undefined && host.instanceconversionsupported !== null">
         <div>
           <strong>{{ $t('label.instance.conversion.support') }}</strong>
           <div>
@@ -64,7 +64,23 @@
           </div>
         </div>
       </a-list-item>
-      <a-list-item v-if="host.details && host.details['host.vddk.support']">
+      <a-list-item v-if="hasHostDetail('host.virtv2v.inplace.support')">
+        <div>
+          <strong>{{ $t('label.host.virtv2v.inplace.support') }}</strong>
+          <div>
+            {{ host.details['host.virtv2v.inplace.support'] }}
+          </div>
+        </div>
+      </a-list-item>
+      <a-list-item v-if="host.details && host.details['host.virtv2v.inplace.version']">
+        <div>
+          <strong>{{ $t('label.host.virtv2v.inplace.version') }}</strong>
+          <div>
+            {{ host.details['host.virtv2v.inplace.version'] }}
+          </div>
+        </div>
+      </a-list-item>
+      <a-list-item v-if="hasHostDetail('host.vddk.support')">
         <div>
           <strong>{{ $t('label.host.vddk.support') }}</strong>
           <div>
@@ -80,6 +96,70 @@
           </div>
         </div>
       </a-list-item>
+      <a-list-item v-if="hasHostDetail('host.vddk.blockcopy.support')">
+        <div>
+          <strong>{{ $t('label.host.vmware.cbt.data.copy.support') }}</strong>
+          <div>
+            {{ host.details['host.vddk.blockcopy.support'] }}
+          </div>
+        </div>
+      </a-list-item>
+      <a-list-item v-if="hasHostDetail('host.vddk.blockcopy.inplace.finalization.support')">
+        <div>
+          <strong>{{ $t('label.host.vddk.blockcopy.inplace.finalization.support') }}</strong>
+          <div>
+            {{ host.details['host.vddk.blockcopy.inplace.finalization.support'] }}
+          </div>
+        </div>
+      </a-list-item>
+      <a-list-item v-if="hasHostDetail('host.vddk.blockcopy.rbd.support')">
+        <div>
+          <strong>{{ $t('label.host.vddk.blockcopy.rbd.support') }}</strong>
+          <div>
+            {{ host.details['host.vddk.blockcopy.rbd.support'] }}
+          </div>
+        </div>
+      </a-list-item>
+      <a-list-item v-if="hasHostDetail('host.vddk.rbd.direct.import.support')">
+        <div>
+          <strong>{{ $t('label.host.vddk.rbd.direct.import.support') }}</strong>
+          <div>
+            {{ host.details['host.vddk.rbd.direct.import.support'] }}
+          </div>
+        </div>
+      </a-list-item>
+      <a-list-item v-if="host.details && host.details['host.qemu.img.version']">
+        <div>
+          <strong>{{ $t('label.host.qemu.img.version') }}</strong>
+          <div>
+            {{ host.details['host.qemu.img.version'] }}
+          </div>
+        </div>
+      </a-list-item>
+      <a-list-item v-if="host.details && host.details['host.qemu.io.version']">
+        <div>
+          <strong>{{ $t('label.host.qemu.io.version') }}</strong>
+          <div>
+            {{ host.details['host.qemu.io.version'] }}
+          </div>
+        </div>
+      </a-list-item>
+      <a-list-item v-if="host.details && host.details['host.qemu.nbd.version']">
+        <div>
+          <strong>{{ $t('label.host.qemu.nbd.version') }}</strong>
+          <div>
+            {{ host.details['host.qemu.nbd.version'] }}
+          </div>
+        </div>
+      </a-list-item>
+      <a-list-item v-if="hasHostDetail('host.qemu.rbd.support')">
+        <div>
+          <strong>{{ $t('label.host.qemu.rbd.support') }}</strong>
+          <div>
+            {{ host.details['host.qemu.rbd.support'] }}
+          </div>
+        </div>
+      </a-list-item>
       <a-list-item v-if="host.details && host.details['host.ovftool.version']">
         <div>
           <strong>{{ $t('label.host.ovftool.version') }}</strong>
@@ -242,6 +322,10 @@ export default {
     }
   },
   methods: {
+    hasHostDetail (key) {
+      return this.host.details && Object.prototype.hasOwnProperty.call(this.host.details, key) &&
+        this.host.details[key] !== null && this.host.details[key] !== ''
+    },
     fetchData () {
       this.fetchLoading = true
       getAPI('listHosts', { id: this.resource.id }).then(json => {
diff --git a/ui/src/views/tools/ImportUnmanagedInstance.vue b/ui/src/views/tools/ImportUnmanagedInstance.vue
index ffa0d9344335..14c06288f308 100644
--- a/ui/src/views/tools/ImportUnmanagedInstance.vue
+++ b/ui/src/views/tools/ImportUnmanagedInstance.vue
@@ -35,7 +35,7 @@
               @finish="handleSubmit"
               layout="vertical">
               <a-alert
-                v-if="selectedVmwareVcenter && isVmRunning"
+                v-if="selectedVmwareVcenter && isVmRunning && !isVmwareCbtSelected"
                 type="warning"
                 :showIcon="true"
                 :message="$t('message.import.running.instance.warning')"
@@ -152,11 +152,18 @@
                   </a-row>
                 </a-radio-group>
               </a-form-item>
-              <a-form-item name="usevddk" ref="usevddk" v-if="selectedVmwareVcenter">
+              <a-form-item name="vmwaremigrationmode" ref="vmwaremigrationmode" v-if="selectedVmwareVcenter">
                 <template #label>
-                  <tooltip-label :title="$t('label.use.vddk')" :tooltip="apiParams.usevddk ? apiParams.usevddk.description : ''"/>
+                  <tooltip-label :title="$t('label.vmware.migration.mode')" :tooltip="apiParams.vmwaremigrationmode ? apiParams.vmwaremigrationmode.description : ''"/>
                 </template>
-                <a-switch v-model:checked="form.usevddk" @change="onUseVddkChange" />
+                <a-radio-group
+                  v-model:value="form.vmwaremigrationmode"
+                  button-style="solid"
+                  @change="onVmwareMigrationModeChange">
+                  <a-radio-button value="ovf" :disabled="!canUseImportVm">{{ $t('label.vmware.migration.mode.ovf') }}</a-radio-button>
+                  <a-radio-button value="vddk" :disabled="!canUseImportVm">{{ $t('label.vmware.migration.mode.vddk') }}</a-radio-button>
+                  <a-radio-button value="cbt" :disabled="!canUseVmwareCbt">{{ $t('label.vmware.migration.mode.cbt') }}</a-radio-button>
+                </a-radio-group>
               </a-form-item>
               <a-form-item name="forceconverttopool" ref="forceconverttopool" v-if="selectedVmwareVcenter">
                 <template #label>
@@ -176,7 +183,7 @@
                   @handle-checkselectpair-change="updateSelectedKvmHostForConversion"
                 />
               </a-form-item>
-              <a-form-item name="importhostid" ref="importhostid" v-if="!form.usevddk">
+              <a-form-item name="importhostid" ref="importhostid" v-if="form.vmwaremigrationmode === 'ovf'">
                 <check-box-select-pair
                   layout="vertical"
                   v-if="cluster.hypervisortype === 'KVM' && selectedVmwareVcenter"
@@ -190,7 +197,7 @@
               </a-form-item>
               <a-form-item name="convertstorageoption" ref="convertstorageoption">
                 <check-box-select-pair
-                  :key="`convertstorageoption-${form.usevddk ? 'vddk' : 'default'}-${switches.forceConvertToPool ? 'pool' : 'tmp'}`"
+                  :key="`convertstorageoption-${form.vmwaremigrationmode}-${switches.forceConvertToPool ? 'pool' : 'tmp'}`"
                   layout="vertical"
                   v-if="cluster.hypervisortype === 'KVM' && selectedVmwareVcenter"
                   :resourceKey="cluster.id"
@@ -233,7 +240,7 @@
                   :placeholder="$t('label.extra')"
                 />
               </a-form-item>
-              <a-form-item name="forcemstoimportvmfiles" ref="forcemstoimportvmfiles" v-if="selectedVmwareVcenter && !form.usevddk">
+              <a-form-item name="forcemstoimportvmfiles" ref="forcemstoimportvmfiles" v-if="selectedVmwareVcenter && form.vmwaremigrationmode === 'ovf'">
                 <template #label>
                   <tooltip-label :title="$t('label.force.ms.to.import.vm.files')" :tooltip="apiParams.forcemstoimportvmfiles.description"/>
                 </template>
@@ -253,7 +260,7 @@
                     :filterOption="(input, option) => {
                       return option.label.toLowerCase().indexOf(input.toLowerCase()) >= 0
                     }">
-                    <a-select-option v-for="mapping in resource.guestOsMappings" :key="mapping.ostypeid" :label="mapping.osdisplayname">
+                    <a-select-option v-for="mapping in resource.guestOsMappings" :key="mapping.ostypeid" :value="mapping.ostypeid" :label="mapping.osdisplayname">
                       <span>
                         {{ mapping.osdisplayname }}
                       </span>
@@ -279,6 +286,7 @@
                   @select-compute-item="($event) => updateComputeOffering($event)"
                   @handle-search-filter="($event) => fetchComputeOfferings($event)" />
                 <compute-selection
+                  :key="computeSelectionKey"
                   class="row-element"
                   v-if="computeOffering && (computeOffering.iscustomized || computeOffering.iscustomizediops)"
                   :isCustomized="computeOffering.iscustomized"
@@ -287,7 +295,7 @@
                   :cpuSpeedInputDecorator="cpuSpeedKey"
                   :memoryInputDecorator="memoryKey"
                   :computeOfferingId="computeOffering.id"
-                  :preFillContent="resource"
+                  :preFillContent="computeOfferingPreFillContent"
                   :isConstrained="'serviceofferingdetails' in computeOffering"
                   :minCpu="getMinCpu()"
                   :maxCpu="getMaxCpu()"
@@ -427,7 +435,9 @@
               </a-row>
               <div :span="24" class="action-button">
                 <a-button @click="closeAction">{{ $t('label.cancel') }}</a-button>
-                <a-button :loading="loading" type="primary" @click="handleSubmit">{{ $t('label.ok') }}</a-button>
+                <a-button :loading="loading" type="primary" @click="handleSubmit">
+                  {{ form.vmwaremigrationmode === 'cbt' ? $t('label.start') : $t('label.ok') }}
+                </a-button>
               </div>
             </a-form>
           </a-card>
@@ -450,6 +460,7 @@ import MultiNetworkSelection from '@views/compute/wizard/MultiNetworkSelection'
 import OsLogo from '@/components/widgets/OsLogo'
 import ResourceIcon from '@/components/view/ResourceIcon'
 import CheckBoxSelectPair from '@/components/CheckBoxSelectPair'
+import { formatKvmConversionHostName } from '@/utils/vmware'
 
 export default {
   name: 'ImportUnmanagedInstances',
@@ -518,7 +529,7 @@ export default {
       required: false
     },
     selectedVmwareVcenter: {
-      type: Array,
+      type: Object,
       required: false
     },
     loadingGuestOsMappings: {
@@ -593,17 +604,47 @@ export default {
     }
   },
   beforeCreate () {
-    this.apiConfig = this.$store.getters.apis.importUnmanagedInstance || {}
+    this.apiConfig = this.$store.getters.apis.importUnmanagedInstance || { params: [] }
     this.apiParams = {}
-    this.apiConfig.params.forEach(param => {
+    const importUnmanagedParams = this.apiConfig.params || []
+    importUnmanagedParams.forEach(param => {
       this.apiParams[param.name] = param
     })
-    this.apiConfig = this.$store.getters.apis.importVm || {}
-    this.apiConfig.params.forEach(param => {
+    this.apiConfig = this.$store.getters.apis.importVm || { params: [] }
+    const importVmParams = this.apiConfig.params || []
+    importVmParams.forEach(param => {
+      if (!(param.name in this.apiParams)) {
+        this.apiParams[param.name] = param
+      }
+    })
+    this.apiConfig = this.$store.getters.apis.startVmwareCbtMigration || { params: [] }
+    const startVmwareCbtMigrationParams = this.apiConfig.params || []
+    startVmwareCbtMigrationParams.forEach(param => {
       if (!(param.name in this.apiParams)) {
         this.apiParams[param.name] = param
       }
     })
+    const apiParamDefaults = [
+      'account',
+      'datadiskofferinglist',
+      'displayname',
+      'domainid',
+      'forceconverttopool',
+      'forced',
+      'forcemstoimportvmfiles',
+      'hostname',
+      'migrateallowed',
+      'nicnetworklist',
+      'projectid',
+      'serviceofferingid',
+      'templateid',
+      'vmwaremigrationmode'
+    ]
+    apiParamDefaults.forEach(paramName => {
+      if (!(paramName in this.apiParams)) {
+        this.apiParams[paramName] = { description: '' }
+      }
+    })
   },
   created () {
     this.initForm()
@@ -658,6 +699,13 @@ export default {
       }
       return false
     },
+    isRunningWindowsVm () {
+      const osTypeName = (this.resource?.ostypename || this.resource?.osdisplayname || '').toLowerCase()
+      return this.isVmRunning && osTypeName.includes('windows')
+    },
+    isVmwareCbtSelected () {
+      return this.selectedVmwareVcenter && this.form.vmwaremigrationmode === 'cbt'
+    },
     isDiskImport () {
       if (this.importsource === 'local' || this.importsource === 'shared') {
         return true
@@ -673,6 +721,12 @@ export default {
     isKVMUnmanage () {
       return this.hypervisor && this.hypervisor === 'kvm' && (this.importsource === 'unmanaged' || this.importsource === 'external')
     },
+    canUseImportVm () {
+      return 'importVm' in this.$store.getters.apis
+    },
+    canUseVmwareCbt () {
+      return 'startVmwareCbtMigration' in this.$store.getters.apis
+    },
     domainSelectOptions () {
       var domains = this.options.domains.map((domain) => {
         return {
@@ -765,6 +819,23 @@ export default {
         }
       }
       return nics
+    },
+    computeOfferingPreFillContent () {
+      return {
+        ...this.resource,
+        cpunumber: this.getCustomCpuNumberDefault(),
+        cpuspeed: this.getCPUSpeed(),
+        memory: this.getCustomMemoryDefault()
+      }
+    },
+    computeSelectionKey () {
+      const preFill = this.computeOfferingPreFillContent
+      return [
+        this.computeOffering?.id || 'offering',
+        preFill.cpunumber || 'cpu',
+        preFill.cpuspeed || 'speed',
+        preFill.memory || 'memory'
+      ].join('-')
     }
   },
   watch: {
@@ -786,6 +857,7 @@ export default {
       this.formRef = ref()
       this.form = reactive({
         rootdiskid: 0,
+        vmwaremigrationmode: this.defaultVmwareMigrationMode(),
         usevddk: false,
         migrateallowed: this.switches.migrateAllowed,
         forced: this.switches.forced,
@@ -865,14 +937,26 @@ export default {
       }
       return 'serviceofferingdetails' in this.computeOffering ? this.computeOffering.serviceofferingdetails.maxmemory * 1 : Number.MAX_SAFE_INTEGER
     },
+    clampCustomValue (value, min, max) {
+      if (value === undefined || value === null || isNaN(value)) {
+        return min
+      }
+      return Math.min(Math.max(value * 1, min), max)
+    },
+    getCustomCpuNumberDefault () {
+      return this.clampCustomValue(this.resource?.cpunumber, this.getMinCpu(), this.getMaxCpu())
+    },
+    getCustomMemoryDefault () {
+      return this.clampCustomValue(this.resource?.memory, this.getMinMemory(), this.getMaxMemory())
+    },
     getCPUSpeed () {
       if (!this.computeOffering) {
-        return 0
+        return 2000
       }
       if (this.computeOffering.cpuspeed) {
         return this.computeOffering.cpuspeed * 1
       }
-      return this.resource.cpuspeed * 1 || 0
+      return this.resource.cpuspeed * 1 || 2000
     },
     fetchOptions (param, name, exclude) {
       if (exclude && exclude.length > 0) {
@@ -969,6 +1053,12 @@ export default {
       }
       return 'custom'
     },
+    defaultVmwareMigrationMode () {
+      if (!this.canUseImportVm && this.canUseVmwareCbt) {
+        return 'cbt'
+      }
+      return 'ovf'
+    },
     changeTemplateType (e) {
       this.templateType = e.target.value
       if (this.templateType === 'auto') {
@@ -1022,44 +1112,29 @@ export default {
         this.kvmHostsForConversion = this.kvmHostsForConversion.filter(host => ['Enabled', 'Disabled'].includes(host.resourcestate))
         // Check if any host has VDDK support
         let hasVddkSupport = false
-        this.kvmHostsForConversion.map(host => {
-          host.name = host.name + ' [Pod=' + host.podname + '] [Cluster=' + host.clustername + ']'
-          if (host.instanceconversionsupported !== null && host.instanceconversionsupported !== undefined && host.instanceconversionsupported) {
-            host.name = host.name + ' (' + this.$t('label.supported') + ')'
-          } else {
-            host.name = host.name + ' (' + this.$t('label.not.supported') + ')'
-          }
-          if (host.details['host.virtv2v.version']) {
-            host.name = host.name + ' (virt-v2v=' + host.details['host.virtv2v.version'] + ')'
-          }
-          if (host.details['host.ovftool.version']) {
-            host.name = host.name + ' (ovftool=' + host.details['host.ovftool.version'] + ')'
-          }
+        this.kvmHostsForConversion.forEach(host => {
+          const details = host.details || {}
           // Check for VDDK support
-          if (host.details['host.vddk.support'] === 'true' || host.details['host.vddk.support'] === true) {
+          if (details['host.vddk.support'] === 'true' || details['host.vddk.support'] === true) {
             hasVddkSupport = true
           }
-
-          if (this.form.usevddk) {
-            if (host.details['host.vddk.support'] === 'true' || host.details['host.vddk.support'] === true) {
-              host.name = host.name + ' (VDDK=' + this.$t('label.supported') + ')'
-            } else {
-              host.name = host.name + ' (VDDK=' + this.$t('label.not.supported') + ')'
-            }
-            if (host.details['host.vddk.version']) {
-              host.name = host.name + ' (vddk=' + host.details['host.vddk.version'] + ')'
-            }
-          }
+          host.name = this.formatKvmConversionHostName(host)
         })
 
         // Enable usevddk by default if at least one host has VDDK support
         // Only auto-enable if user hasn't manually modified the setting
         if (hasVddkSupport && !this.form.usevddk && !this.userModifiedVddkSetting) {
-          this.form.usevddk = true
-          this.onUseVddkChange(true, false)
+          this.setVmwareMigrationMode('vddk', false)
         }
       })
     },
+    formatKvmConversionHostName (host) {
+      return formatKvmConversionHostName(
+        host,
+        this.form.vmwaremigrationmode,
+        this.$t('label.yes'),
+        this.$t('label.no'))
+    },
     fetchKvmHostsForImporting () {
       getAPI('listHosts', {
         clusterid: this.cluster.id,
@@ -1163,6 +1238,13 @@ export default {
       this.showStoragePoolsForConversion = false
       this.resetStorageOptionsForConversion()
     },
+    onVmwareMigrationModeChange (event) {
+      this.setVmwareMigrationMode(event.target.value, true)
+    },
+    setVmwareMigrationMode (mode, isUserChange = true) {
+      this.form.vmwaremigrationmode = mode
+      this.onUseVddkChange(mode === 'vddk' || mode === 'cbt', isUserChange)
+    },
     onUseVddkChange (val, isUserChange = true) {
       if (isUserChange) {
         this.userModifiedVddkSetting = true
@@ -1230,6 +1312,16 @@ export default {
             params.networkid = values.networkid
           }
         }
+        if (this.isVmwareCbtStart(values)) {
+          return this.startVmwareCbtMigration(values)
+        }
+        if (this.selectedVmwareVcenter && this.isRunningWindowsVm) {
+          this.$notification.error({
+            message: this.$t('message.request.failed'),
+            description: 'Cannot import Running Windows VMs, please gracefully shutdown the source VM before importing or select CBT migration mode'
+          })
+          return
+        }
         if (!this.computeOffering || !this.computeOffering.id) {
           this.$notification.error({
             message: this.$t('message.request.failed'),
@@ -1306,12 +1398,16 @@ export default {
           if (this.vmwareToKvmExtraParams) {
             params.extraparams = this.vmwareToKvmExtraParams
           }
-          if (values.usevddk) {
+          const vmwareMigrationMode = values.vmwaremigrationmode || (values.usevddk ? 'vddk' : 'ovf')
+          params.vmwaremigrationmode = vmwareMigrationMode
+          if (vmwareMigrationMode === 'vddk') {
             params.usevddk = true
             params.forcemstoimportvmfiles = false
-          } else {
+          } else if (vmwareMigrationMode === 'ovf') {
             params.usevddk = false
             params.forcemstoimportvmfiles = values.forcemstoimportvmfiles
+          } else {
+            params.forcemstoimportvmfiles = false
           }
           if (values.forceconverttopool !== undefined) {
             params.forceconverttopool = values.forceconverttopool
@@ -1419,6 +1515,163 @@ export default {
         this.$emit('loading-changed', false)
       })
     },
+    isVmwareCbtStart (values) {
+      return this.selectedVmwareVcenter && (values.vmwaremigrationmode || 'ovf') === 'cbt'
+    },
+    startVmwareCbtMigration (values) {
+      if (!('startVmwareCbtMigration' in this.$store.getters.apis)) {
+        this.$notification.error({
+          message: this.$t('message.request.failed'),
+          description: this.$t('message.api.not.available')
+        })
+        return
+      }
+
+      const params = {
+        zoneid: this.zoneid,
+        clusterid: this.cluster.id,
+        displayname: values.displayname,
+        sourcevmname: this.resource.name,
+        hostip: this.resource.hostname,
+        clustername: this.resource.clustername
+      }
+      if (this.selectedVmwareVcenter.existingvcenterid) {
+        params.existingvcenterid = this.selectedVmwareVcenter.existingvcenterid
+      } else {
+        params.vcenter = this.selectedVmwareVcenter.vcenter
+        params.datacentername = this.selectedVmwareVcenter.datacentername
+        params.username = this.selectedVmwareVcenter.username
+        params.password = this.selectedVmwareVcenter.password
+      }
+      if (this.selectedKvmHostForConversion) {
+        params.convertinstancehostid = this.selectedKvmHostForConversion
+      }
+      const selectedPoolForConversion = values.convertstoragepoolid || this.selectedStoragePoolForConversion
+      if (selectedPoolForConversion) {
+        params.convertinstancepoolid = selectedPoolForConversion
+      }
+
+      if (!this.computeOffering || !this.computeOffering.id) {
+        this.$notification.error({
+          message: this.$t('message.request.failed'),
+          description: this.$t('message.step.2.continue')
+        })
+        return
+      }
+      params.serviceofferingid = values.computeofferingid
+      if (this.computeOffering.iscustomized) {
+        var details = [this.cpuNumberKey, this.cpuSpeedKey, this.memoryKey]
+        for (var detail of details) {
+          if (!(values[detail] || this.computeOffering[detail])) {
+            this.$notification.error({
+              message: this.$t('message.request.failed'),
+              description: this.$t('message.please.enter.valid.value') + ': ' + this.$t('label.' + detail.toLowerCase())
+            })
+            return
+          }
+          if (values[detail]) {
+            params['details[0].' + detail] = values[detail]
+          }
+        }
+      }
+      if (this.computeOffering.iscustomizediops) {
+        var iopsDetails = [this.minIopsKey, this.maxIopsKey]
+        for (var iopsDetail of iopsDetails) {
+          if (!values[iopsDetail] || values[iopsDetail] < 0) {
+            this.$notification.error({
+              message: this.$t('message.request.failed'),
+              description: this.$t('message.please.enter.valid.value') + ': ' + this.$t('label.' + iopsDetail.toLowerCase())
+            })
+            return
+          }
+          params['details[0].' + iopsDetail] = values[iopsDetail]
+        }
+        if (values[this.minIopsKey] > values[this.maxIopsKey]) {
+          this.$notification.error({
+            message: this.$t('message.request.failed'),
+            description: this.$t('error.form.message')
+          })
+          return
+        }
+      }
+      var keys = ['hostname', 'domainid', 'projectid', 'account', 'forced', 'osid']
+      if (this.templateType !== 'auto') {
+        keys.push('templateid')
+      }
+      for (var key of keys) {
+        if (values[key]) {
+          params[key] = values[key]
+        }
+      }
+      var diskOfferingIndex = 0
+      for (var diskId in this.dataDisksOfferingsMapping) {
+        if (!this.dataDisksOfferingsMapping[diskId]) {
+          this.$notification.error({
+            message: this.$t('message.request.failed'),
+            description: this.$t('message.select.disk.offering') + ': ' + diskId
+          })
+          return
+        }
+        params['datadiskofferinglist[' + diskOfferingIndex + '].disk'] = diskId
+        params['datadiskofferinglist[' + diskOfferingIndex + '].diskOffering'] = this.dataDisksOfferingsMapping[diskId]
+        diskOfferingIndex++
+      }
+      var nicNetworkIndex = 0
+      var nicIpIndex = 0
+      var networkcheck = new Set()
+      for (var nicId in this.nicsNetworksMapping) {
+        if (!this.nicsNetworksMapping[nicId].network) {
+          this.$notification.error({
+            message: this.$t('message.request.failed'),
+            description: this.$t('message.select.nic.network') + ': ' + nicId
+          })
+          return
+        }
+        params['nicnetworklist[' + nicNetworkIndex + '].nic'] = nicId
+        params['nicnetworklist[' + nicNetworkIndex + '].network'] = this.nicsNetworksMapping[nicId].network
+        var netId = this.nicsNetworksMapping[nicId].network
+        if (!networkcheck.has(netId)) {
+          networkcheck.add(netId)
+        } else {
+          this.$notification.error({
+            message: this.$t('message.request.failed'),
+            description: 'Same network cannot be assigned to multiple Nics'
+          })
+          return
+        }
+        nicNetworkIndex++
+        if ('ipAddress' in this.nicsNetworksMapping[nicId]) {
+          if (!this.nicsNetworksMapping[nicId].ipAddress) {
+            this.$notification.error({
+              message: this.$t('message.request.failed'),
+              description: this.$t('message.enter.valid.nic.ip') + ': ' + nicId
+            })
+            return
+          }
+          params['nicipaddresslist[' + nicIpIndex + '].nic'] = nicId
+          params['nicipaddresslist[' + nicIpIndex + '].ip4Address'] = this.nicsNetworksMapping[nicId].ipAddress
+          nicIpIndex++
+        }
+      }
+
+      this.updateLoading(true)
+      postAPI('startVmwareCbtMigration', params).then(response => {
+        this.$emit('vmware-cbt-migration-started', {
+          response,
+          responseKey: 'startvmwarecbtmigrationresponse',
+          migration: {
+            displayname: params.displayname,
+            sourcevmname: params.sourcevmname
+          },
+          actionLabel: 'VMware CBT initial sync'
+        })
+      }).catch(error => {
+        this.$notifyError(error)
+      }).finally(() => {
+        this.closeAction()
+        this.updateLoading(false)
+      })
+    },
     updateLoading (value) {
       this.loading = value
       this.$emit('loading-changed', value)
@@ -1431,6 +1684,7 @@ export default {
       this.templateType = this.defaultTemplateType()
       this.updateComputeOffering(undefined)
       this.switches = {}
+      this.form.vmwaremigrationmode = this.defaultVmwareMigrationMode()
       this.form.usevddk = false
       this.form.forceconverttopool = false
       this.form.forcemstoimportvmfiles = false
diff --git a/ui/src/views/tools/ManageInstances.vue b/ui/src/views/tools/ManageInstances.vue
index 6f625961ea8f..d506f3170851 100644
--- a/ui/src/views/tools/ManageInstances.vue
+++ b/ui/src/views/tools/ManageInstances.vue
@@ -78,15 +78,15 @@
                         v-model:value="form.sourceHypervisor"
                         @change="selected => { onSelectHypervisor(selected.target.value) }"
                         buttonStyle="solid">
-                        <a-radio-button value="vmware" style="width: 50%; text-align: center">
+                        <a-radio-button value="vmware" style="width: 50%; text-align: center" :disabled="!availableSourceHypervisors.includes('vmware')">
                           VMware
                         </a-radio-button>
-                        <a-radio-button value="kvm" style="width: 50%; text-align: center">
+                        <a-radio-button value="kvm" style="width: 50%; text-align: center" :disabled="!availableSourceHypervisors.includes('kvm')">
                           KVM
                         </a-radio-button>
                       </a-radio-group>
                     </a-form-item>
-                    <a-form-item name="sourceaction" ref="sourceaction" :label="$t('label.action')" v-if="sourceActions">
+                    <a-form-item name="sourceaction" ref="sourceaction" :label="$t('label.action')" v-if="sourceActions && sourceActions.length > 0">
                       <a-select
                         v-model:value="form.sourceAction"
                         showSearch
@@ -250,7 +250,7 @@
                       @change="onSelectClusterId"
                     ></a-select>
                   </a-form-item>
-                  <a-form-item v-if="isDestinationKVM && isMigrateFromVmware && clusterId != undefined">
+                  <a-form-item v-if="isDestinationKVM && isMigrateFromVmware && clusterId != undefined && hasApi('listVmwareDcVms')">
                     <SelectVmwareVcenter
                       @onVcenterTypeChanged="updateVmwareVcenterType"
                       @loadingVmwareUnmanagedInstances="() => this.unmanagedInstancesLoading = true"
@@ -311,6 +311,7 @@
                   <a-col v-if="showDiskPath" :md="24" :lg="8">
                     <a-button
                         type="primary"
+                        :disabled="!canImportDisk"
                         @click="onImportInstanceAction">
                       <template #icon><import-outlined /></template>
                       {{ $t('label.import.instance') }}
@@ -356,7 +357,7 @@
                         <search-view
                           :searchFilters="searchFilters.unmanaged"
                           :searchParams="searchParams.unmanaged"
-                          :apiName="listInstancesApi.unmanaged"
+                          :apiName="currentUnmanagedListApi"
                           @search="searchUnmanagedInstances"
                         />
                       </span>
@@ -414,7 +415,7 @@
                       <div :span="24" class="action-button-right">
                         <a-button
                           :loading="importUnmanagedInstanceLoading"
-                          :disabled="!(('importUnmanagedInstance' in $store.getters.apis) && unmanagedInstancesSelectedRowKeys.length > 0)"
+                          :disabled="!canOpenImportInstanceForm"
                           type="primary"
                           @click="onManageInstanceAction">
                           <template #icon><import-outlined /></template>
@@ -497,7 +498,7 @@
                 </a-col>
               </a-row>
             </a-tab-pane>
-            <a-tab-pane :key=2 :tab="$t('label.import.vm.tasks')" v-if="isMigrateFromVmware">
+            <a-tab-pane :key=2 :tab="$t('label.import.vm.tasks')" v-if="isMigrateFromVmware && ('listImportVmTasks' in $store.getters.apis)">
               <ImportVmTasks
                 :tasks="importVmTasks"
                 :loading="loadingImportVmTasks"
@@ -510,6 +511,23 @@
                 @change-filter="onChangeImportTasksFilter"
               />
             </a-tab-pane>
+            <a-tab-pane :key=3 :tab="$t('label.vmware.cbt.migrations')" v-if="isMigrateFromVmware && ('listVmwareCbtMigrations' in $store.getters.apis)">
+              <VmwareCbtMigrations
+                :migrations="vmwareCbtMigrations"
+                :loading="loadingVmwareCbtMigrations"
+                :filter="vmwareCbtMigrationsFilter"
+                :total="itemCount.vmwareCbtMigrations || 0"
+                :page="page.vmwareCbtMigrations"
+                :pageSize="pageSize.vmwareCbtMigrations"
+                @fetch-vmware-cbt-migrations="fetchVmwareCbtMigrations"
+                @change-pagination="onChangeVmwareCbtMigrationsPagination"
+                @change-filter="onChangeVmwareCbtMigrationsFilter"
+                @sync-vmware-cbt-migration="syncVmwareCbtMigration"
+                @cutover-vmware-cbt-migration="cutoverVmwareCbtMigration"
+                @cancel-vmware-cbt-migration="cancelVmwareCbtMigration"
+                @delete-vmware-cbt-migration="deleteVmwareCbtMigration"
+              />
+            </a-tab-pane>
           </a-tabs>
 
         </a-card>
@@ -547,6 +565,7 @@
             @close-action="closeImportUnmanagedInstanceForm"
             @loading-changed="updateManageInstanceActionLoading"
             @track-import-jobid="trackImportJobId"
+            @vmware-cbt-migration-started="onVmwareCbtMigrationStarted"
           />
         </a-modal>
       </div>
@@ -555,7 +574,6 @@
 </template>
 
 <script>
-import { message } from 'ant-design-vue'
 import { ref, reactive, toRaw } from 'vue'
 import { postAPI, getAPI } from '@/api'
 import _ from 'lodash'
@@ -567,6 +585,7 @@ import ResourceIcon from '@/components/view/ResourceIcon'
 import SelectVmwareVcenter from '@/views/tools/SelectVmwareVcenter'
 import TooltipLabel from '@/components/widgets/TooltipLabel.vue'
 import ImportVmTasks from '@/views/tools/ImportVmTasks.vue'
+import VmwareCbtMigrations from '@/views/tools/VmwareCbtMigrations.vue'
 
 export default {
   components: {
@@ -577,7 +596,8 @@ export default {
     ImportUnmanagedInstances,
     ResourceIcon,
     SelectVmwareVcenter,
-    ImportVmTasks
+    ImportVmTasks,
+    VmwareCbtMigrations
   },
   name: 'ManageVms',
   data () {
@@ -585,6 +605,7 @@ export default {
       {
         name: 'unmanaged',
         label: 'Manage/Unmanage existing instances',
+        anyApis: ['listUnmanagedInstances'],
         sourceDestHypervisors: {
           vmware: 'vmware',
           kvm: 'kvm'
@@ -595,6 +616,7 @@ export default {
       {
         name: 'vmware',
         label: 'Migrate existing instances to KVM',
+        anyApis: ['listVmwareDcVms', 'listImportVmTasks', 'listVmwareCbtMigrations'],
         sourceDestHypervisors: {
           vmware: 'kvm'
         },
@@ -604,6 +626,7 @@ export default {
       {
         name: 'external',
         label: 'Import Instance from remote KVM host',
+        anyApis: ['listVmsForImport'],
         sourceDestHypervisors: {
           kvm: 'kvm'
         },
@@ -612,7 +635,8 @@ export default {
       },
       {
         name: 'local',
-        label: 'Import QCOW2 image from Local Storage',
+        label: 'Import Instance using existing ROOT disk from Local Storage',
+        anyApis: ['importVm'],
         sourceDestHypervisors: {
           kvm: 'kvm'
         },
@@ -621,7 +645,8 @@ export default {
       },
       {
         name: 'shared',
-        label: 'Import QCOW2 image from Shared Storage',
+        label: 'Import Instance using existing ROOT disk from Shared Storage',
+        anyApis: ['importVm'],
         sourceDestHypervisors: {
           kvm: 'kvm'
         },
@@ -712,12 +737,14 @@ export default {
       page: {
         unmanaged: 1,
         managed: 1,
-        tasks: 1
+        tasks: 1,
+        vmwareCbtMigrations: 1
       },
       pageSize: {
         unmanaged: 10,
         managed: 10,
-        tasks: 10
+        tasks: 10,
+        vmwareCbtMigrations: 10
       },
       searchFilters: {
         unmanaged: [],
@@ -776,6 +803,11 @@ export default {
       loadingImportVmTasks: false,
       importVmTasks: [],
       importVmTasksFilter: 'running',
+      loadingVmwareCbtMigrations: false,
+      vmwareCbtMigrations: [],
+      vmwareCbtMigrationsFilter: 'all',
+      vmwareCbtMigrationsRefreshInterval: null,
+      activeVmwareCbtJobCount: 0,
       loadingGuestOsMappings: false
     }
   },
@@ -786,6 +818,9 @@ export default {
     this.initForm()
     this.fetchData()
   },
+  beforeUnmount () {
+    this.stopVmwareCbtMigrationsAutoRefresh()
+  },
   computed: {
     isPageAllowed () {
       if (this.$route.meta.permission) {
@@ -809,6 +844,30 @@ export default {
     isDestinationKVM () {
       return this.destinationHypervisor === 'kvm'
     },
+    availableSourceHypervisors () {
+      return this.getAvailableSourceHypervisors()
+    },
+    currentUnmanagedListApi () {
+      if (this.isMigrateFromVmware) {
+        return this.listInstancesApi.migratefromvmware
+      }
+      if (this.isExternal) {
+        return this.listInstancesApi.external
+      }
+      return this.listInstancesApi.unmanaged
+    },
+    canImportDisk () {
+      return this.hasApi('importVm')
+    },
+    canOpenImportInstanceForm () {
+      if (this.unmanagedInstancesSelectedRowKeys.length === 0) {
+        return false
+      }
+      if (this.isMigrateFromVmware) {
+        return this.hasAnyApi(['importVm', 'startVmwareCbtMigration'])
+      }
+      return this.hasApi('importUnmanagedInstance')
+    },
     showPod () {
       if (this.selectedSourceAction === 'shared') {
         return this.poolscope !== 'zone'
@@ -905,7 +964,8 @@ export default {
           return true
         }
       }
-      return this.unmanagedInstancesLoading || this.managedInstancesLoading
+      return this.unmanagedInstancesLoading || this.managedInstancesLoading ||
+        this.loadingImportVmTasks || this.loadingVmwareCbtMigrations
     },
     zoneSelectOptions () {
       return this.options.zones.map((zone) => {
@@ -992,6 +1052,22 @@ export default {
     }
   },
   methods: {
+    hasApi (apiName) {
+      return apiName in this.$store.getters.apis
+    },
+    hasAnyApi (apiNames) {
+      return apiNames.some(apiName => this.hasApi(apiName))
+    },
+    isSourceActionAvailable (action) {
+      return !action.anyApis || this.hasAnyApi(action.anyApis)
+    },
+    getAvailableSourceHypervisors () {
+      const hypervisors = new Set()
+      this.AllSourceActions.filter(action => this.isSourceActionAvailable(action)).forEach(action => {
+        Object.keys(action.sourceDestHypervisors).forEach(hypervisor => hypervisors.add(hypervisor))
+      })
+      return Array.from(hypervisors)
+    },
     initForm () {
       this.formRef = ref()
       this.form = reactive({
@@ -1006,6 +1082,11 @@ export default {
     fetchData () {
       this.unmanagedInstances = []
       this.managedInstances = []
+      const availableSourceHypervisors = this.getAvailableSourceHypervisors()
+      if (availableSourceHypervisors.length > 0 && !availableSourceHypervisors.includes(this.sourceHypervisor)) {
+        this.sourceHypervisor = availableSourceHypervisors[0]
+        this.form.sourceHypervisor = this.sourceHypervisor
+      }
       this.onSelectHypervisor(this.sourceHypervisor)
       _.each(this.params, (param, name) => {
         if (param.isLoad) {
@@ -1115,18 +1196,34 @@ export default {
       this.managedInstances = []
       this.managedInstancesSelectedRowKeys = []
       this.page.tasks = 1
+      this.page.vmwareCbtMigrations = 1
+      this.vmwareCbtMigrations = []
+      this.stopVmwareCbtMigrationsAutoRefresh()
       this.activeTabKey = 1
     },
     onSelectHypervisor (value) {
       this.sourceHypervisor = value
-      this.sourceActions = this.AllSourceActions.filter(x => x.sourceDestHypervisors[value])
-      this.form.sourceAction = this.sourceActions[0].name || ''
+      this.sourceActions = this.AllSourceActions.filter(x => x.sourceDestHypervisors[value] && this.isSourceActionAvailable(x))
+      if (this.sourceActions.length === 0) {
+        this.form.sourceAction = undefined
+        this.selectedSourceAction = undefined
+        this.destinationHypervisor = undefined
+        this.selectedVmwareVcenter = undefined
+        this.resetLists()
+        return
+      }
+      this.form.sourceAction = this.sourceActions[0].name
       this.selectedVmwareVcenter = undefined
       this.onSelectSourceAction(this.form.sourceAction)
     },
     onSelectSourceAction (value) {
       this.selectedSourceAction = value
       const selectedAction = _.find(this.AllSourceActions, (option) => option.name === value)
+      if (!selectedAction) {
+        this.destinationHypervisor = undefined
+        this.resetLists()
+        return
+      }
       this.destinationHypervisor = selectedAction.sourceDestHypervisors[this.sourceHypervisor]
       this.wizardTitle = selectedAction.wizardTitle
       this.wizardDescription = selectedAction.wizardDescription
@@ -1187,8 +1284,14 @@ export default {
       this.fetchOptions(this.params.pools, 'pools', value)
     },
     onTabChange (e) {
-      if (e === 2) {
+      const tabKey = String(e)
+      if (tabKey === '2') {
+        this.stopVmwareCbtMigrationsAutoRefresh()
         this.fetchImportVmTasks()
+      } else if (tabKey === '3') {
+        this.fetchVmwareCbtMigrations()
+      } else {
+        this.stopVmwareCbtMigrationsAutoRefresh()
       }
     },
     onChangeImportTasksPagination (page, pagesize) {
@@ -1201,6 +1304,9 @@ export default {
       this.fetchImportVmTasks()
     },
     fetchImportVmTasks () {
+      if (!this.hasApi('listImportVmTasks') || !this.zoneId) {
+        return
+      }
       this.loadingImportVmTasks = true
       const params = {
         zoneid: this.zoneId,
@@ -1217,12 +1323,150 @@ export default {
         this.loadingImportVmTasks = false
       })
     },
+    onChangeVmwareCbtMigrationsPagination (page, pagesize) {
+      this.page.vmwareCbtMigrations = page
+      this.pageSize.vmwareCbtMigrations = pagesize
+      this.fetchVmwareCbtMigrations()
+    },
+    onChangeVmwareCbtMigrationsFilter (filter) {
+      this.vmwareCbtMigrationsFilter = filter
+      this.fetchVmwareCbtMigrations()
+    },
+    fetchVmwareCbtMigrations (silent = false) {
+      if (!this.hasApi('listVmwareCbtMigrations')) {
+        return
+      }
+      if (!silent) {
+        this.loadingVmwareCbtMigrations = true
+      }
+      const params = {
+        zoneid: this.zoneId,
+        page: this.page.vmwareCbtMigrations,
+        pagesize: this.pageSize.vmwareCbtMigrations
+      }
+      if (this.vmwareCbtMigrationsFilter && this.vmwareCbtMigrationsFilter !== 'all') {
+        params.state = this.vmwareCbtMigrationsFilter
+      }
+      getAPI('listVmwareCbtMigrations', params).then(response => {
+        this.itemCount.vmwareCbtMigrations = response.listvmwarecbtmigrationsresponse.count
+        this.vmwareCbtMigrations = response.listvmwarecbtmigrationsresponse.vmwarecbtmigration || []
+        this.updateVmwareCbtMigrationsAutoRefresh()
+      }).catch(error => {
+        this.$notifyError(error)
+      }).finally(() => {
+        if (!silent) {
+          this.loadingVmwareCbtMigrations = false
+        }
+      })
+    },
+    cancelVmwareCbtMigration (migration) {
+      postAPI('cancelVmwareCbtMigration', { id: migration.id }).then(() => {
+        this.fetchVmwareCbtMigrations()
+      }).catch(error => {
+        this.$notifyError(error)
+      })
+    },
+    deleteVmwareCbtMigration (migration) {
+      const cleanup = ['Failed', 'Cancelled'].includes(migration.state)
+      postAPI('deleteVmwareCbtMigration', { id: migration.id, cleanup }).then(() => {
+        this.fetchVmwareCbtMigrations()
+      }).catch(error => {
+        this.$notifyError(error)
+      })
+    },
+    syncVmwareCbtMigration (migration) {
+      postAPI('syncVmwareCbtMigration', this.getVmwareCbtMigrationActionParams(migration)).then(response => {
+        this.fetchVmwareCbtMigrations()
+        this.pollVmwareCbtMigrationJob(response, 'syncvmwarecbtmigrationresponse', migration, 'VMware CBT delta sync')
+      }).catch(error => {
+        this.$notifyError(error)
+      })
+    },
+    cutoverVmwareCbtMigration (migration) {
+      postAPI('cutoverVmwareCbtMigration', this.getVmwareCbtMigrationActionParams(migration)).then(response => {
+        this.fetchVmwareCbtMigrations()
+        this.pollVmwareCbtMigrationJob(response, 'cutovervmwarecbtmigrationresponse', migration, 'VMware CBT cutover')
+      }).catch(error => {
+        this.$notifyError(error)
+      })
+    },
+    pollVmwareCbtMigrationJob (response, responseKey, migration, actionLabel) {
+      const jobId = response?.[responseKey]?.jobid
+      if (!jobId) {
+        return
+      }
+      this.activeVmwareCbtJobCount++
+      this.updateVmwareCbtMigrationsAutoRefresh()
+      const refreshAfterJob = () => {
+        this.activeVmwareCbtJobCount = Math.max(0, this.activeVmwareCbtJobCount - 1)
+        this.fetchVmwareCbtMigrations()
+      }
+      this.$pollJob({
+        jobId,
+        title: this.$t('label.vmware.cbt.migrations'),
+        description: migration.displayname || migration.sourcevmname,
+        loadingMessage: `${actionLabel} ${this.$t('label.in.progress')}`,
+        catchMessage: this.$t('error.fetching.async.job.result'),
+        successMessage: `${actionLabel} completed`,
+        successMethod: refreshAfterJob,
+        errorMethod: refreshAfterJob
+      })
+    },
+    updateVmwareCbtMigrationsAutoRefresh () {
+      const isCbtTabActive = String(this.activeTabKey) === '3'
+      const hasActiveMigrations = this.vmwareCbtMigrations.some(this.isVmwareCbtMigrationActive)
+      if (isCbtTabActive && (hasActiveMigrations || this.activeVmwareCbtJobCount > 0)) {
+        this.startVmwareCbtMigrationsAutoRefresh()
+      } else {
+        this.stopVmwareCbtMigrationsAutoRefresh()
+      }
+    },
+    startVmwareCbtMigrationsAutoRefresh () {
+      if (this.vmwareCbtMigrationsRefreshInterval) {
+        return
+      }
+      this.vmwareCbtMigrationsRefreshInterval = setInterval(() => {
+        this.fetchVmwareCbtMigrations(true)
+      }, 5000)
+    },
+    stopVmwareCbtMigrationsAutoRefresh () {
+      if (!this.vmwareCbtMigrationsRefreshInterval) {
+        return
+      }
+      clearInterval(this.vmwareCbtMigrationsRefreshInterval)
+      this.vmwareCbtMigrationsRefreshInterval = null
+    },
+    isVmwareCbtMigrationActive (migration) {
+      return ['Created', 'InitialSync', 'Replicating', 'CuttingOver'].includes(migration.state)
+    },
+    getVmwareCbtMigrationActionParams (migration) {
+      const params = { id: migration.id }
+      if (!migration.existingvcenterid && this.selectedVmwareVcenter &&
+        this.selectedVmwareVcenter.vcenter === migration.vcenter &&
+        this.selectedVmwareVcenter.datacentername === migration.datacentername) {
+        params.username = this.selectedVmwareVcenter.username
+        params.password = this.selectedVmwareVcenter.password
+      }
+      return params
+    },
+    onVmwareCbtMigrationStarted (details = {}) {
+      if (this.hasApi('listVmwareCbtMigrations')) {
+        this.activeTabKey = 3
+        this.fetchVmwareCbtMigrations()
+        if (details.response && details.responseKey) {
+          this.pollVmwareCbtMigrationJob(details.response, details.responseKey,
+            details.migration || {}, details.actionLabel || 'VMware CBT migration')
+        }
+      } else {
+        this.fetchInstances()
+      }
+    },
     fetchInstances () {
       this.fetchUnmanagedInstances()
       if (this.isUnmanaged) {
         this.fetchManagedInstances()
-      } else if (this.kvmOption === 'external') {
-        this.fetchExternalInstances()
+      } else if (this.isExternal) {
+        this.fetchExtKVMInstances()
       }
     },
     fetchUnmanagedInstances (page, pageSize) {
@@ -1262,6 +1506,9 @@ export default {
           params.existingvcenterid = this.selectedVmwareVcenter.existingvcenterid
         }
       }
+      if (!this.hasApi(apiName)) {
+        return
+      }
 
       getAPI(apiName, params).then(json => {
         const response = this.isMigrateFromVmware ? json.listvmwaredcvmsresponse : json.listunmanagedinstancesresponse
@@ -1275,6 +1522,9 @@ export default {
       })
     },
     fetchExtKVMInstances (page, pageSize) {
+      if (!this.hasApi(this.listInstancesApi.external)) {
+        return
+      }
       const params = {
         zoneid: this.zoneid
       }
@@ -1324,6 +1574,9 @@ export default {
       this.fetchUnmanagedInstances()
     },
     fetchManagedInstances (page, pageSize) {
+      if (!this.hasApi(this.listInstancesApi.managed)) {
+        return
+      }
       const params = {
         listall: true,
         clusterid: this.clusterId
@@ -1379,11 +1632,7 @@ export default {
         this.fetchInstances()
       }
     },
-    async fetchGuestOsMappings (osIdentifier, hypervisorVersion) {
-      const params = {}
-      params.hypervisor = 'VMware'
-      params.hypervisorversion = hypervisorVersion
-      params.osnameforhypervisor = osIdentifier
+    async fetchGuestOsMappingsByParams (params) {
       return await getAPI('listGuestOsMapping', params).then(json => {
         return json.listguestosmappingresponse?.guestosmapping || []
       }).catch(error => {
@@ -1391,6 +1640,111 @@ export default {
         return []
       })
     },
+    async fetchGuestOsTypesByDisplayName (osDisplayName) {
+      if (!osDisplayName) {
+        return []
+      }
+      const params = {
+        description: osDisplayName
+      }
+      return await getAPI('listOsTypes', params).then(json => {
+        const guestOsTypes = json.listostypesresponse?.ostype || []
+        return guestOsTypes.map(osType => ({
+          ostypeid: osType.id,
+          osdisplayname: osType.name || osType.description
+        })).filter(osType => this.guestOsDisplayNameMatches(osType.osdisplayname, osDisplayName))
+      }).catch(error => {
+        this.$notifyError(error)
+        return []
+      })
+    },
+    normalizeGuestOsDisplayName (name) {
+      return (name || '')
+        .toLowerCase()
+        .replace(/^microsoft\s+/, '')
+        .replace(/[^a-z0-9]+/g, ' ')
+        .replace(/\s+/g, ' ')
+        .trim()
+    },
+    guestOsDisplayNameMatches (candidate, expected) {
+      const normalizedCandidate = this.normalizeGuestOsDisplayName(candidate)
+      const normalizedExpected = this.normalizeGuestOsDisplayName(expected)
+      return normalizedCandidate && normalizedExpected && normalizedCandidate === normalizedExpected
+    },
+    filterGuestOsMappings (mappings, params, osDisplayName) {
+      if (!mappings || mappings.length === 0) {
+        return []
+      }
+
+      const osNameForHypervisor = (params.osnameforhypervisor || '').toLowerCase()
+      let filteredMappings = mappings
+      if (osNameForHypervisor) {
+        filteredMappings = mappings.filter(mapping => (mapping.osnameforhypervisor || '').toLowerCase() === osNameForHypervisor)
+      }
+
+      if (osDisplayName) {
+        const displayNameMatches = filteredMappings.filter(mapping => this.guestOsDisplayNameMatches(mapping.osdisplayname, osDisplayName))
+        if (displayNameMatches.length > 0) {
+          return displayNameMatches
+        }
+        if (params.osdisplayname) {
+          return []
+        }
+      }
+
+      return filteredMappings
+    },
+    async fetchGuestOsMappings (osIdentifier, hypervisorVersion, osDisplayName) {
+      const baseParams = {
+        hypervisor: 'VMware'
+      }
+      const queryCandidates = []
+      if (osIdentifier) {
+        queryCandidates.push({
+          ...baseParams,
+          hypervisorversion: hypervisorVersion,
+          osnameforhypervisor: osIdentifier
+        })
+      }
+      if (osIdentifier) {
+        queryCandidates.push({
+          ...baseParams,
+          osnameforhypervisor: osIdentifier
+        })
+      }
+      if (osDisplayName) {
+        queryCandidates.push({
+          ...baseParams,
+          hypervisorversion: hypervisorVersion,
+          osdisplayname: osDisplayName
+        })
+      }
+      if (osDisplayName) {
+        queryCandidates.push({
+          ...baseParams,
+          osdisplayname: osDisplayName
+        })
+      }
+
+      const seenQueries = new Set()
+      for (const params of queryCandidates) {
+        if (!params.hypervisorversion) {
+          delete params.hypervisorversion
+        }
+        const queryKey = JSON.stringify(params)
+        if (seenQueries.has(queryKey)) {
+          continue
+        }
+        seenQueries.add(queryKey)
+        const mappings = await this.fetchGuestOsMappingsByParams(params)
+        const filteredMappings = this.filterGuestOsMappings(mappings, params, osDisplayName)
+        if (filteredMappings.length > 0) {
+          return filteredMappings
+        }
+      }
+
+      return await this.fetchGuestOsTypesByDisplayName(osDisplayName)
+    },
     fetchVmwareInstanceForKVMMigration (vmname, hostname) {
       const params = {}
       this.loadingGuestOsMappings = true
@@ -1411,7 +1765,8 @@ export default {
         this.selectedUnmanagedInstance = response.unmanagedinstance[0]
         this.selectedUnmanagedInstance.ostypename = this.selectedUnmanagedInstance.osdisplayname
         this.selectedUnmanagedInstance.state = this.selectedUnmanagedInstance.powerstate
-        this.selectedUnmanagedInstance.guestOsMappings = await this.fetchGuestOsMappings(this.selectedUnmanagedInstance.osid, this.selectedUnmanagedInstance.hypervisorversion)
+        this.selectedUnmanagedInstance.guestOsMappings = await this.fetchGuestOsMappings(this.selectedUnmanagedInstance.osid,
+          this.selectedUnmanagedInstance.hypervisorversion, this.selectedUnmanagedInstance.osdisplayname)
       }).catch(error => {
         this.$notifyError(error)
       }).finally(() => {
@@ -1427,16 +1782,7 @@ export default {
         this.selectedUnmanagedInstance.ostypename = this.selectedUnmanagedInstance.osdisplayname
         this.selectedUnmanagedInstance.state = this.selectedUnmanagedInstance.powerstate
       }
-      if (this.isMigrateFromVmware && this.selectedUnmanagedInstance.state === 'PowerOn' && this.selectedUnmanagedInstance.ostypename.toLowerCase().includes('windows')) {
-        message.error({
-          content: () => 'Cannot import Running Windows VMs, please gracefully shutdown the source VM before importing',
-          style: {
-            marginTop: '20vh',
-            color: 'red'
-          }
-        })
-        this.showUnmanageForm = false
-      } else if (this.isMigrateFromVmware) {
+      if (this.isMigrateFromVmware) {
         this.fetchVmwareInstanceForKVMMigration(this.selectedUnmanagedInstance.name, this.selectedUnmanagedInstance.hostname)
         this.showUnmanageForm = true
       } else {
diff --git a/ui/src/views/tools/SelectVmwareVcenter.vue b/ui/src/views/tools/SelectVmwareVcenter.vue
index 7648b90c3e60..8fa4cbfc00a5 100644
--- a/ui/src/views/tools/SelectVmwareVcenter.vue
+++ b/ui/src/views/tools/SelectVmwareVcenter.vue
@@ -132,7 +132,7 @@
       <div class="card-footer">
         <a-button
           v-if="vcenterSelectedOption == 'existing' || vcenterSelectedOption == 'new'"
-          :disabled="(vcenterSelectedOption === 'new' && (vcenter === '' || datacentername === '' || username === '' || password === '')) ||
+          :disabled="(vcenterSelectedOption === 'new' && (vcenter === '' || datacenter === '' || username === '' || password === '')) ||
             (vcenterSelectedOption === 'existing' && selectedExistingVcenterId === '')"
           :loading="loading"
           type="primary"
@@ -268,7 +268,7 @@ export default {
       })
     },
     onSelectExternalVmwareDatacenter (value) {
-      if (this.vcenterSelectedOption === 'new' && !(this.vcenter === '' || this.datacentername === '' || this.username === '' || this.password === '')) {
+      if (this.vcenterSelectedOption === 'new' && !(this.vcenter === '' || this.datacenter === '' || this.username === '' || this.password === '')) {
         this.listVmwareDatacenterVms()
       }
     },
diff --git a/ui/src/views/tools/VmwareCbtMigrations.vue b/ui/src/views/tools/VmwareCbtMigrations.vue
new file mode 100644
index 000000000000..27652777df53
--- /dev/null
+++ b/ui/src/views/tools/VmwareCbtMigrations.vue
@@ -0,0 +1,493 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+<template>
+  <a-row :gutter="12">
+    <a-col :md="24" :lg="24">
+      <a-card class="instances-card">
+        <template #title>
+          {{ $t('label.vmware.cbt.migrations') }}
+          <a-tooltip :title="$t('message.vmware.cbt.migrations')">
+            <info-circle-outlined />
+          </a-tooltip>
+          <a-button
+            style="margin-left: 12px; margin-top: 4px"
+            :loading="loading"
+            size="small"
+            shape="round"
+            @click="this.$emit('fetch-vmware-cbt-migrations')" >
+            <template #icon><reload-outlined /></template>
+          </a-button>
+          <span style="float: right; width: 50%">
+            <a-select
+              :placeholder="$t('label.filterby')"
+              :value="filter"
+              style="min-width: 140px; margin-left: 10px; margin-bottom: 5px"
+              size=small
+              @change="onFilterChange"
+              showSearch
+              optionFilterProp="label"
+              :filterOption="(input, option) => {
+                return option.label.toLowerCase().indexOf(input.toLowerCase()) >= 0
+              }"
+            >
+              <template #suffixIcon><filter-outlined class="ant-select-suffix" /></template>
+              <a-select-option
+                v-for="filter in filters"
+                :key="filter"
+                :label="getFilterLabel(filter)">
+                {{ getFilterLabel(filter) }}
+              </a-select-option>
+            </a-select>
+          </span>
+        </template>
+        <a-table
+          :data-source="migrations"
+          class="instances-card-table"
+          size="middle"
+          :pagination="false"
+          :rowKey="record => record.id"
+          :columns="columns"
+          :rowExpandable="record => getDisks(record).length > 0 || getCycles(record).length > 0">
+          <template #bodyCell="{ column, record, text }">
+            <template v-if="column.key === 'displayname'">
+              <router-link v-if="record.virtualmachineid" :to="{ path: '/vm/' + record.virtualmachineid }">{{ record.displayname }}</router-link>
+              <span v-else>{{ record.displayname }}</span>
+            </template>
+            <template v-else-if="column.key === 'convertinstancehostid'">
+              <router-link v-if="record.convertinstancehostid" :to="{ path: '/host/' + record.convertinstancehostid }">{{ record.convertinstancehostname }}</router-link>
+              <span v-else>-</span>
+            </template>
+            <template v-else-if="column.key === 'created'">
+              <span>{{ $toLocaleDate(record.created) }}</span>
+            </template>
+            <template v-else-if="['lastchangedbytes', 'totalchangedbytes'].includes(column.key)">
+              <span v-if="text !== null && text !== undefined">{{ $bytesToHumanReadableSize(text) }}</span>
+              <span v-else>-</span>
+            </template>
+            <template v-else-if="column.key === 'lastdirtyrate'">
+              <span v-if="text !== null && text !== undefined">{{ $bytesToHumanReadableSize(text) }}/s</span>
+              <span v-else>-</span>
+            </template>
+            <template v-else-if="column.key === 'currentstepduration'">
+              <span>{{ text || '-' }}</span>
+            </template>
+            <template v-else-if="column.key === 'action'">
+              <a-space size="small">
+                <a-popconfirm
+                  v-if="canShowSync(record)"
+                  :title="$t('message.confirm.sync.vmware.cbt.migration')"
+                  :okText="$t('label.ok')"
+                  :cancelText="$t('label.cancel')"
+                  :disabled="isSyncDisabled(record)"
+                  @confirm="() => this.$emit('sync-vmware-cbt-migration', record)">
+                  <a-button
+                    size="small"
+                    :disabled="isSyncDisabled(record)">
+                    <template #icon><sync-outlined /></template>
+                    {{ $t('label.sync.delta') }}
+                  </a-button>
+                </a-popconfirm>
+                <a-popconfirm
+                  v-if="canCutover(record)"
+                  :title="$t('message.confirm.cutover.vmware.cbt.migration')"
+                  :okText="$t('label.ok')"
+                  :cancelText="$t('label.cancel')"
+                  @confirm="() => this.$emit('cutover-vmware-cbt-migration', record)">
+                  <a-button
+                    size="small"
+                    type="primary"
+                    :disabled="!('cutoverVmwareCbtMigration' in $store.getters.apis)">
+                    <template #icon><thunderbolt-outlined /></template>
+                    {{ $t('label.cutover') }}
+                  </a-button>
+                </a-popconfirm>
+                <a-popconfirm
+                  v-if="canCancel(record)"
+                  :title="$t('message.confirm.cancel.vmware.cbt.migration')"
+                  :okText="$t('label.ok')"
+                  :cancelText="$t('label.cancel')"
+                  @confirm="() => this.$emit('cancel-vmware-cbt-migration', record)">
+                  <a-button
+                    size="small"
+                    :danger="true"
+                    :disabled="!('cancelVmwareCbtMigration' in $store.getters.apis)">
+                    <template #icon><close-circle-outlined /></template>
+                    {{ $t('label.cancel') }}
+                  </a-button>
+                </a-popconfirm>
+                <a-popconfirm
+                  v-if="canDelete(record)"
+                  :title="$t('message.confirm.delete.vmware.cbt.migration')"
+                  :okText="$t('label.ok')"
+                  :cancelText="$t('label.cancel')"
+                  @confirm="() => this.$emit('delete-vmware-cbt-migration', record)">
+                  <a-button
+                    size="small"
+                    :danger="true"
+                    :disabled="!('deleteVmwareCbtMigration' in $store.getters.apis)">
+                    <template #icon><delete-outlined /></template>
+                    {{ $t('label.delete') }}
+                  </a-button>
+                </a-popconfirm>
+              </a-space>
+            </template>
+          </template>
+          <template #expandedRowRender="{ record }">
+            <div class="vmware-cbt-expanded-row">
+              <a-table
+                v-if="getDisks(record).length > 0"
+                size="small"
+                :columns="diskColumns"
+                :data-source="getDisks(record)"
+                :rowKey="diskRowKey"
+                :pagination="false">
+                <template #bodyCell="{ column, text }">
+                  <template v-if="column.key === 'capacity'">
+                    <span v-if="text !== null && text !== undefined">{{ $bytesToHumanReadableSize(text) }}</span>
+                    <span v-else>-</span>
+                  </template>
+                  <template v-else-if="column.key === 'targetpath' || column.key === 'changeid' || column.key === 'snapshotmor'">
+                    <span>{{ text || '-' }}</span>
+                  </template>
+                  <template v-else>
+                    <span>{{ text }}</span>
+                  </template>
+                </template>
+              </a-table>
+              <a-table
+                v-if="getCycles(record).length > 0"
+                size="small"
+                class="vmware-cbt-cycle-table"
+                :columns="cycleColumns"
+                :data-source="getCycles(record)"
+                :rowKey="cycleRowKey"
+                :pagination="false">
+                <template #bodyCell="{ column, text }">
+                  <template v-if="column.key === 'changedbytes'">
+                    <span v-if="text !== null && text !== undefined">{{ $bytesToHumanReadableSize(text) }}</span>
+                    <span v-else>-</span>
+                  </template>
+                  <template v-else-if="column.key === 'dirtyrate'">
+                    <span v-if="text !== null && text !== undefined">{{ $bytesToHumanReadableSize(text) }}/s</span>
+                    <span v-else>-</span>
+                  </template>
+                  <template v-else-if="column.key === 'duration'">
+                    <span>{{ formatDuration(text) }}</span>
+                  </template>
+                  <template v-else-if="column.key === 'created' || column.key === 'lastupdated'">
+                    <span v-if="text">{{ $toLocaleDate(text) }}</span>
+                    <span v-else>-</span>
+                  </template>
+                  <template v-else>
+                    <span>{{ text || '-' }}</span>
+                  </template>
+                </template>
+              </a-table>
+            </div>
+          </template>
+        </a-table>
+        <div class="instances-card-footer">
+          <a-pagination
+            class="row-element"
+            size="small"
+            :current="page"
+            :pageSize="pageSize"
+            :total="total"
+            :showTotal="total => `${$t('label.showing')} ${Math.min(total, 1+((page-1)*pageSize))}-${Math.min(page*pageSize, total)} ${$t('label.of')} ${total} ${$t('label.items')}`"
+            @change="onPaginationChange"
+            showQuickJumper>
+            <template #buildOptionText="props">
+              <span>{{ props.value }} / {{ $t('label.page') }}</span>
+            </template>
+          </a-pagination>
+        </div>
+      </a-card>
+    </a-col>
+  </a-row>
+</template>
+
+<script>
+export default {
+  name: 'VmwareCbtMigrations',
+  props: {
+    migrations: {
+      type: Array,
+      required: true
+    },
+    loading: {
+      type: Boolean,
+      required: false
+    },
+    filter: {
+      type: String,
+      required: false
+    },
+    total: {
+      type: Number,
+      required: true
+    },
+    page: {
+      type: Number,
+      required: true
+    },
+    pageSize: {
+      type: Number,
+      required: true
+    }
+  },
+  data () {
+    const columns = [
+      {
+        key: 'created',
+        title: this.$t('label.created'),
+        dataIndex: 'created'
+      },
+      {
+        key: 'displayname',
+        title: this.$t('label.displayname'),
+        dataIndex: 'displayname'
+      },
+      {
+        key: 'convertinstancehostid',
+        title: this.$t('label.conversionhost'),
+        dataIndex: 'convertinstancehostid'
+      },
+      {
+        key: 'sourcevmname',
+        title: this.$t('label.sourcevmname'),
+        dataIndex: 'sourcevmname'
+      },
+      {
+        key: 'state',
+        title: this.$t('label.state'),
+        dataIndex: 'state'
+      },
+      {
+        key: 'currentstep',
+        title: this.$t('label.currentstep'),
+        dataIndex: 'currentstep'
+      },
+      {
+        key: 'currentstepduration',
+        title: this.$t('label.currentstep.duration'),
+        dataIndex: 'currentstepduration'
+      },
+      {
+        key: 'completedcycles',
+        title: this.$t('label.completedcycles'),
+        dataIndex: 'completedcycles'
+      },
+      {
+        key: 'quietcycles',
+        title: this.$t('label.quietcycles'),
+        dataIndex: 'quietcycles'
+      },
+      {
+        key: 'lastchangedbytes',
+        title: this.$t('label.lastchangedbytes'),
+        dataIndex: 'lastchangedbytes'
+      },
+      {
+        key: 'lastdirtyrate',
+        title: this.$t('label.lastdirtyrate'),
+        dataIndex: 'lastdirtyrate'
+      },
+      {
+        key: 'totalchangedbytes',
+        title: this.$t('label.totalchangedbytes'),
+        dataIndex: 'totalchangedbytes'
+      },
+      {
+        key: 'vcenter',
+        title: this.$t('label.vcenter'),
+        dataIndex: 'vcenter'
+      },
+      {
+        key: 'datacentername',
+        title: this.$t('label.vcenter.datacenter'),
+        dataIndex: 'datacentername'
+      },
+      {
+        key: 'sourcehost',
+        title: this.$t('label.sourcehost'),
+        dataIndex: 'sourcehost'
+      },
+      {
+        key: 'sourcecluster',
+        title: this.$t('label.sourcecluster'),
+        dataIndex: 'sourcecluster'
+      },
+      {
+        key: 'lasterror',
+        title: this.$t('label.lasterror'),
+        dataIndex: 'lasterror'
+      },
+      {
+        key: 'action',
+        title: this.$t('label.action'),
+        dataIndex: 'action'
+      }
+    ]
+    const diskColumns = [
+      {
+        key: 'sourcediskid',
+        title: this.$t('label.source.disk'),
+        dataIndex: 'sourcediskid'
+      },
+      {
+        key: 'sourcediskpath',
+        title: this.$t('label.source.disk.path'),
+        dataIndex: 'sourcediskpath'
+      },
+      {
+        key: 'capacity',
+        title: this.$t('label.capacity'),
+        dataIndex: 'capacity'
+      },
+      {
+        key: 'targetpath',
+        title: this.$t('label.target.path'),
+        dataIndex: 'targetpath'
+      },
+      {
+        key: 'targetformat',
+        title: this.$t('label.target.format'),
+        dataIndex: 'targetformat'
+      },
+      {
+        key: 'changeid',
+        title: this.$t('label.change.id'),
+        dataIndex: 'changeid'
+      },
+      {
+        key: 'snapshotmor',
+        title: this.$t('label.snapshot.mor'),
+        dataIndex: 'snapshotmor'
+      },
+      {
+        key: 'state',
+        title: this.$t('label.state'),
+        dataIndex: 'state'
+      }
+    ]
+    const cycleColumns = [
+      {
+        key: 'cyclenumber',
+        title: this.$t('label.cyclenumber'),
+        dataIndex: 'cyclenumber'
+      },
+      {
+        key: 'state',
+        title: this.$t('label.state'),
+        dataIndex: 'state'
+      },
+      {
+        key: 'changedbytes',
+        title: this.$t('label.changedbytes'),
+        dataIndex: 'changedbytes'
+      },
+      {
+        key: 'dirtyrate',
+        title: this.$t('label.dirtyrate'),
+        dataIndex: 'dirtyrate'
+      },
+      {
+        key: 'duration',
+        title: this.$t('label.duration'),
+        dataIndex: 'duration'
+      },
+      {
+        key: 'description',
+        title: this.$t('label.description'),
+        dataIndex: 'description'
+      },
+      {
+        key: 'created',
+        title: this.$t('label.created'),
+        dataIndex: 'created'
+      },
+      {
+        key: 'lastupdated',
+        title: this.$t('label.last.updated'),
+        dataIndex: 'lastupdated'
+      }
+    ]
+    return {
+      columns,
+      diskColumns,
+      cycleColumns,
+      filters: ['all', 'Created', 'InitialSync', 'Replicating', 'ReadyForCutover', 'CuttingOver', 'ReadyForImport', 'Completed', 'Failed', 'Cancelled']
+    }
+  },
+  methods: {
+    canShowSync (record) {
+      return ['Replicating', 'ReadyForCutover'].includes(record.state)
+    },
+    isSyncDisabled (record) {
+      return !('syncVmwareCbtMigration' in this.$store.getters.apis) || this.hasActiveCycle(record)
+    },
+    hasActiveCycle (record) {
+      return this.getCycles(record).some(cycle => ['Created', 'QueryingChangedAreas', 'CopyingChangedBlocks'].includes(cycle.state))
+    },
+    canCutover (record) {
+      return record.state === 'ReadyForCutover'
+    },
+    canCancel (record) {
+      return !['Completed', 'Failed', 'Cancelled'].includes(record.state)
+    },
+    canDelete (record) {
+      return ['Completed', 'Failed', 'Cancelled'].includes(record.state)
+    },
+    getFilterLabel (filter) {
+      return filter === 'all' ? this.$t('label.all') : filter
+    },
+    getDisks (record) {
+      const disks = record?.disk || record?.disks || []
+      return Array.isArray(disks) ? disks : [disks]
+    },
+    getCycles (record) {
+      const cycles = record?.cycle || record?.cycles || []
+      return Array.isArray(cycles) ? cycles : [cycles]
+    },
+    diskRowKey (record, index) {
+      return record.id || record.sourcediskid || index
+    },
+    cycleRowKey (record, index) {
+      return record.id || record.cyclenumber || index
+    },
+    formatDuration (duration) {
+      if (!duration) {
+        return '-'
+      }
+      return Math.round(duration / 1000) + 's'
+    },
+    onFilterChange (e) {
+      this.$emit('change-filter', e)
+    },
+    onPaginationChange (page, size) {
+      this.$emit('change-pagination', page, size)
+    }
+  }
+}
+</script>
+
+<style scoped>
+.vmware-cbt-cycle-table {
+  margin-top: 12px;
+}
+</style>
diff --git a/ui/tests/unit/utils/vmware.spec.js b/ui/tests/unit/utils/vmware.spec.js
new file mode 100644
index 000000000000..a576e9f2658c
--- /dev/null
+++ b/ui/tests/unit/utils/vmware.spec.js
@@ -0,0 +1,51 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import { formatKvmConversionHostName } from '@/utils/vmware'
+
+const host = {
+  name: 'qa1-vmwarelab-576a1b2a-mix-host2',
+  podname: 'Pod',
+  clustername: 'KVM-Cluster',
+  instanceconversionsupported: true,
+  details: {
+    'host.virtv2v.version': '2.7.1rhel=9',
+    'host.vddk.support': 'true',
+    'host.vddk.version': '8',
+    'host.vddk.blockcopy.support': 'true',
+    'host.qemu.img.version': '7.0.0',
+    'host.qemu.nbd.version': 'qemu-nbd 7.0.0 (qemu-kvm-7.0.0-13.el9)'
+  }
+}
+
+describe('utils/vmware', () => {
+  describe('formatKvmConversionHostName()', () => {
+    it('shows a concise CBT conversion host label', () => {
+      expect(formatKvmConversionHostName(host, 'cbt', 'Yes', 'No')).toBe(
+        'qa1-vmwarelab-576a1b2a-mix-host2 [KVM-Cluster] — virt-v2v=2.7.1rhel=9 / VDDK=8 / CBT=Yes')
+    })
+
+    it('does not expose low-level QEMU or Pod details in the selector', () => {
+      const label = formatKvmConversionHostName(host, 'cbt', 'Yes', 'No')
+
+      expect(label).not.toContain('qemu-img')
+      expect(label).not.toContain('qemu-nbd')
+      expect(label).not.toContain('Pod')
+      expect(label).not.toContain('Supported')
+    })
+  })
+})
diff --git a/vmware-base/src/main/java/com/cloud/hypervisor/vmware/util/VmwareHelper.java b/vmware-base/src/main/java/com/cloud/hypervisor/vmware/util/VmwareHelper.java
index 89f6d7abd7d0..2a42d49898fd 100644
--- a/vmware-base/src/main/java/com/cloud/hypervisor/vmware/util/VmwareHelper.java
+++ b/vmware-base/src/main/java/com/cloud/hypervisor/vmware/util/VmwareHelper.java
@@ -55,6 +55,9 @@
 import com.vmware.vim25.DistributedVirtualSwitchPortCriteria;
 import com.vmware.vim25.GuestInfo;
 import com.vmware.vim25.GuestNicInfo;
+import com.vmware.vim25.GuestStackInfo;
+import com.vmware.vim25.NetIpConfigInfoIpAddress;
+import com.vmware.vim25.NetIpRouteConfigInfoIpRoute;
 import com.vmware.vim25.HostPortGroupSpec;
 import com.vmware.vim25.NasDatastoreInfo;
 import com.vmware.vim25.VMwareDVSPortSetting;
@@ -806,6 +809,7 @@ public static UnmanagedInstanceTO getUnmanagedInstance(VmwareHypervisorHost hype
             instance.setName(vmMo.getVmName());
             instance.setInternalCSName(vmMo.getInternalCSName());
             instance.setPath((vmMo.getPath()));
+            instance.setVmwareMoref(vmMo.getMor().getValue());
             instance.setCpuCoresPerSocket(vmMo.getCoresPerSocket());
             instance.setOperatingSystemId(vmMo.getVmGuestInfo().getGuestId());
             VirtualMachineConfigSummary configSummary = vmMo.getConfigSummary();
@@ -962,6 +966,9 @@ private static List<UnmanagedInstanceTO.Nic> getUnmanageInstanceNics(VmwareHyper
         List<UnmanagedInstanceTO.Nic> instanceNics = new ArrayList<>();
 
         HashMap<String, List<String>> guestNicMacIPAddressMap = new HashMap<>();
+        HashMap<String, List<String>> guestNicMacIpv4CidrMap = new HashMap<>();
+        List<String> guestDnsServers = new ArrayList<>();
+        List<String> guestDefaultGateways = new ArrayList<>();
         try {
             GuestInfo guestInfo = vmMo.getGuestInfo();
             if (guestInfo.getToolsStatus() == VirtualMachineToolsStatus.TOOLS_OK) {
@@ -975,6 +982,42 @@ private static List<UnmanagedInstanceTO.Nic> getUnmanageInstanceNics(VmwareHyper
                         }
                         guestNicMacIPAddressMap.put(nicInfo.getMacAddress(), ipAddresses);
                     }
+                    // The plain ipAddress list carries no prefix; ipConfig has address plus
+                    // prefix length, which static-IP preservation needs for the subnet.
+                    if (nicInfo.getIpConfig() != null && CollectionUtils.isNotEmpty(nicInfo.getIpConfig().getIpAddress())) {
+                        List<String> cidrs = new ArrayList<>();
+                        for (NetIpConfigInfoIpAddress configuredAddress : nicInfo.getIpConfig().getIpAddress()) {
+                            if (configuredAddress.getIpAddress() != null && NetUtils.isValidIp4(configuredAddress.getIpAddress())) {
+                                cidrs.add(configuredAddress.getIpAddress() + "/" + configuredAddress.getPrefixLength());
+                            }
+                        }
+                        if (!cidrs.isEmpty()) {
+                            guestNicMacIpv4CidrMap.put(nicInfo.getMacAddress(), cidrs);
+                        }
+                    }
+                }
+                // Default gateways and DNS servers are reported per IP stack rather than per
+                // NIC; each NIC gets the gateway inside one of its subnets further below.
+                if (CollectionUtils.isNotEmpty(guestInfo.getIpStack())) {
+                    for (GuestStackInfo stackInfo : guestInfo.getIpStack()) {
+                        if (stackInfo.getIpRouteConfig() != null && CollectionUtils.isNotEmpty(stackInfo.getIpRouteConfig().getIpRoute())) {
+                            for (NetIpRouteConfigInfoIpRoute route : stackInfo.getIpRouteConfig().getIpRoute()) {
+                                if ("0.0.0.0".equals(route.getNetwork()) && route.getPrefixLength() == 0
+                                        && route.getGateway() != null && route.getGateway().getIpAddress() != null
+                                        && NetUtils.isValidIp4(route.getGateway().getIpAddress())
+                                        && !guestDefaultGateways.contains(route.getGateway().getIpAddress())) {
+                                    guestDefaultGateways.add(route.getGateway().getIpAddress());
+                                }
+                            }
+                        }
+                        if (stackInfo.getDnsConfig() != null && CollectionUtils.isNotEmpty(stackInfo.getDnsConfig().getIpAddress())) {
+                            for (String dnsServer : stackInfo.getDnsConfig().getIpAddress()) {
+                                if (NetUtils.isValidIp4(dnsServer) && !guestDnsServers.contains(dnsServer)) {
+                                    guestDnsServers.add(dnsServer);
+                                }
+                            }
+                        }
+                    }
                 }
             } else {
                 LOGGER.info(String.format("Unable to retrieve guest nics for instance: %s from VMware tools as tools status: %s", vmMo.getName(), guestInfo.getToolsStatus().toString()));
@@ -1008,6 +1051,22 @@ private static List<UnmanagedInstanceTO.Nic> getUnmanageInstanceNics(VmwareHyper
                     if (guestNicMacIPAddressMap.containsKey(instanceNic.getMacAddress())) {
                         instanceNic.setIpAddress(guestNicMacIPAddressMap.get(instanceNic.getMacAddress()));
                     }
+                    if (guestNicMacIpv4CidrMap.containsKey(instanceNic.getMacAddress())) {
+                        List<String> nicCidrs = guestNicMacIpv4CidrMap.get(instanceNic.getMacAddress());
+                        instanceNic.setIpv4Cidrs(nicCidrs);
+                        // Attach the default gateway that lives inside one of this NIC's subnets;
+                        // gateways of other NICs' subnets do not apply to this NIC.
+                        for (String gateway : guestDefaultGateways) {
+                            boolean matchesNicSubnet = nicCidrs.stream().anyMatch(cidr -> NetUtils.isIpWithInCidrRange(gateway, cidr));
+                            if (matchesNicSubnet) {
+                                instanceNic.setIpv4Gateway(gateway);
+                                break;
+                            }
+                        }
+                        if (!guestDnsServers.isEmpty()) {
+                            instanceNic.setDnsServers(new ArrayList<>(guestDnsServers));
+                        }
+                    }
                     if (ethCardDevice.getSlotInfo() != null) {
                         instanceNic.setPciSlot(ethCardDevice.getSlotInfo().toString());
                     }

From c7667d8c1fb8ceb4ef5ee687fd85cc84a545c275 Mon Sep 17 00:00:00 2001
From: Daman Arora <61474540+Damans227@users.noreply.github.com>
Date: Fri, 16 Oct 2026 02:24:07 -0400
Subject: [PATCH 36/41] VR: fix passive ftp through the virtual router on newer
 system vm templates (#14330)

* fix passive ftp through the virtual router on newer system vm templates

* attach the ftp helper when a port forward sends another public port to port 21

* only attach the ftp helper on static nat and port forwarded public ips
---
 systemvm/debian/opt/cloud/bin/configure.py    | 17 +++++
 systemvm/debian/opt/cloud/bin/setup/common.sh |  4 +-
 systemvm/debian/opt/cloud/bin/setup/router.sh |  2 +-
 .../debian/opt/cloud/bin/setup/vpcrouter.sh   |  2 +-
 systemvm/test/TestCsForwardingRules.py        | 63 +++++++++++++++++++
 5 files changed, 85 insertions(+), 3 deletions(-)
 create mode 100644 systemvm/test/TestCsForwardingRules.py

diff --git a/systemvm/debian/opt/cloud/bin/configure.py b/systemvm/debian/opt/cloud/bin/configure.py
index 24195a11bff7..0575433ad00f 100755
--- a/systemvm/debian/opt/cloud/bin/configure.py
+++ b/systemvm/debian/opt/cloud/bin/configure.py
@@ -1411,6 +1411,22 @@ def processForwardRule(self, rule):
             self.forward_vpc(rule)
         else:
             self.forward_vr(rule)
+        self.forward_ftp_helper(rule)
+
+    def forward_ftp_helper(self, rule):
+        # Linux 6.0 no longer attaches the ftp helper after DNAT, so attach it
+        # to the public port that is forwarded to port 21
+        if rule["protocol"] != "tcp" or "any" in [rule["public_ports"], rule["internal_ports"]]:
+            return
+        public_start = int(rule["public_ports"].split(":")[0])
+        internal_ports = rule["internal_ports"].split(":")
+        internal_start = int(internal_ports[0])
+        internal_end = int(internal_ports[-1])
+        if not internal_start <= 21 <= internal_end:
+            return
+        public_port = public_start + 21 - internal_start
+        self.fw.append(["raw", "", "-A PREROUTING -d %s/32 -p tcp -m tcp --dport %s -j CT --helper ftp" %
+                        (rule["public_ip"], public_port)])
 
     def forward_vr(self, rule):
         # Prefetch iptables variables
@@ -1555,6 +1571,7 @@ def processStaticNatRule(self, rule):
             self.fw.append(["mangle", "front", "-A %s -d %s -j RETURN" %
                             (chain_name, static_route['network'])])
 
+        self.fw.append(["raw", "", "-A PREROUTING -d %s/32 -p tcp -m tcp --dport 21 -j CT --helper ftp" % rule["public_ip"]])
         self.fw.append(["nat", "front",
                         "-A PREROUTING -d %s/32 -j DNAT --to-destination %s" % (rule["public_ip"], rule["internal_ip"])])
         self.fw.append(["nat", "front",
diff --git a/systemvm/debian/opt/cloud/bin/setup/common.sh b/systemvm/debian/opt/cloud/bin/setup/common.sh
index ef1576ab588c..ef610c914079 100755
--- a/systemvm/debian/opt/cloud/bin/setup/common.sh
+++ b/systemvm/debian/opt/cloud/bin/setup/common.sh
@@ -164,7 +164,9 @@ enable_fwding() {
 
 enable_passive_ftp() {
   log_it "cloud: enabling passive FTP for guest VMs"
-  echo "$1" > /proc/sys/net/netfilter/nf_conntrack_helper
+  # Linux 6.0 removed the nf_conntrack_helper sysctl, the ftp helper is
+  # attached by raw table rules for static nat and port forwarding
+  modprobe nf_nat_ftp
 }
 
 disable_rpfilter() {
diff --git a/systemvm/debian/opt/cloud/bin/setup/router.sh b/systemvm/debian/opt/cloud/bin/setup/router.sh
index 5c72105f47a3..dc4fb9d0a691 100755
--- a/systemvm/debian/opt/cloud/bin/setup/router.sh
+++ b/systemvm/debian/opt/cloud/bin/setup/router.sh
@@ -70,7 +70,7 @@ setup_router() {
   disable_rpfilter_domR
   enable_fwding 1
   enable_rpsrfs 1
-  enable_passive_ftp 1
+  enable_passive_ftp
   restore_ipv6
 
   # Only allow DNS service for current network
diff --git a/systemvm/debian/opt/cloud/bin/setup/vpcrouter.sh b/systemvm/debian/opt/cloud/bin/setup/vpcrouter.sh
index 767f87848dd3..cf88e6cac480 100755
--- a/systemvm/debian/opt/cloud/bin/setup/vpcrouter.sh
+++ b/systemvm/debian/opt/cloud/bin/setup/vpcrouter.sh
@@ -82,7 +82,7 @@ setup_vpcrouter() {
   enable_vpc_rpsrfs 1
   disable_rpfilter
   enable_fwding 1
-  enable_passive_ftp 1
+  enable_passive_ftp
   cp /etc/iptables/iptables-vpcrouter /etc/iptables/rules.v4
   cp /etc/vpcdnsmasq.conf /etc/dnsmasq.conf
   cp /etc/cloud-nic.rules /etc/udev/rules.d/cloud-nic.rules
diff --git a/systemvm/test/TestCsForwardingRules.py b/systemvm/test/TestCsForwardingRules.py
new file mode 100644
index 000000000000..50ec370ea9d4
--- /dev/null
+++ b/systemvm/test/TestCsForwardingRules.py
@@ -0,0 +1,63 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+import unittest
+import mock
+from configure import CsForwardingRules
+
+
+class TestCsForwardingRules(unittest.TestCase):
+
+    def ftp_helper_rules(self, protocol, public_ports, internal_ports):
+        forwarding = CsForwardingRules.__new__(CsForwardingRules)
+        forwarding.fw = []
+        forwarding.forward_ftp_helper({"public_ip": "10.0.0.2", "internal_ip": "10.1.1.10", "protocol": protocol,
+                                       "public_ports": public_ports, "internal_ports": internal_ports})
+        return forwarding.fw
+
+    def test_ftp_helper_on_other_public_port(self):
+        self.assertEqual(self.ftp_helper_rules("tcp", "2121:2121", "21:21"),
+                         [["raw", "", "-A PREROUTING -d 10.0.0.2/32 -p tcp -m tcp --dport 2121 -j CT --helper ftp"]])
+
+    def test_ftp_helper_on_port_range(self):
+        self.assertEqual(self.ftp_helper_rules("tcp", "1020:1030", "20:30"),
+                         [["raw", "", "-A PREROUTING -d 10.0.0.2/32 -p tcp -m tcp --dport 1021 -j CT --helper ftp"]])
+
+    def test_ftp_helper_on_port_21(self):
+        self.assertEqual(self.ftp_helper_rules("tcp", "21:21", "21:21"),
+                         [["raw", "", "-A PREROUTING -d 10.0.0.2/32 -p tcp -m tcp --dport 21 -j CT --helper ftp"]])
+
+    def test_no_ftp_helper(self):
+        self.assertEqual(self.ftp_helper_rules("tcp", "2121:2121", "2121:2121"), [])
+        self.assertEqual(self.ftp_helper_rules("udp", "2121:2121", "21:21"), [])
+        self.assertEqual(self.ftp_helper_rules("tcp", "any", "any"), [])
+
+    @mock.patch.object(CsForwardingRules, 'getStaticRoutes', return_value=[])
+    @mock.patch.object(CsForwardingRules, 'getPrivateGatewayNetworks', return_value=[])
+    @mock.patch.object(CsForwardingRules, 'getGuestIpByIp', return_value="10.1.1.1")
+    @mock.patch.object(CsForwardingRules, 'getNetworkByIp', return_value="10.1.1.0/24")
+    @mock.patch.object(CsForwardingRules, 'getDeviceByIp', return_value="eth2")
+    def test_ftp_helper_on_static_nat(self, *_):
+        forwarding = CsForwardingRules.__new__(CsForwardingRules)
+        forwarding.fw = []
+        forwarding.processStaticNatRule({"public_ip": "10.0.0.2", "internal_ip": "10.1.1.10"})
+        self.assertIn(["raw", "", "-A PREROUTING -d 10.0.0.2/32 -p tcp -m tcp --dport 21 -j CT --helper ftp"],
+                      forwarding.fw)
+
+
+if __name__ == '__main__':
+    unittest.main()

From 1e69e3a709c2e53ffeced64365453ecad6e08e3f Mon Sep 17 00:00:00 2001
From: Nicolas Vazquez <nicovazquez90@gmail.com>
Date: Sun, 18 Oct 2026 19:29:05 -0300
Subject: [PATCH 37/41] Allow removing VMs from instance groups (#14395)

* Allow removing VMs from instance groups

* Address review comments
---
 .../api/command/user/vm/UpdateVMCmd.java      |  2 +-
 .../java/com/cloud/vm/UserVmManagerImpl.java  |  9 ++-
 .../com/cloud/vm/UserVmManagerImplTest.java   | 76 ++++++++++++++-----
 ui/src/views/compute/EditVM.vue               | 11 ++-
 4 files changed, 76 insertions(+), 22 deletions(-)

diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/UpdateVMCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/UpdateVMCmd.java
index cea18f4e8241..ead3a21605ac 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/UpdateVMCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/UpdateVMCmd.java
@@ -65,7 +65,7 @@ public class UpdateVMCmd extends BaseCustomIdCmd implements SecurityGroupAction,
     @Parameter(name = ApiConstants.DISPLAY_NAME, type = CommandType.STRING, description = "User generated name")
     private String displayName;
 
-    @Parameter(name = ApiConstants.GROUP, type = CommandType.STRING, description = "Group of the Instance")
+    @Parameter(name = ApiConstants.GROUP, type = CommandType.STRING, description = "Group of the Instance. To remove an Instance from its current Group, please pass an empty string as parameter")
     private String group;
 
     @Parameter(name = ApiConstants.HA_ENABLE, type = CommandType.BOOLEAN, description = "True if high-availability is enabled for the Instance, false otherwise")
diff --git a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
index 7636ef6b152c..ac3236fd7b8f 100644
--- a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
+++ b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
@@ -3208,8 +3208,11 @@ public UserVm updateVirtualMachine(long id, String displayName, String group, Bo
             osTypeId = vm.getGuestOSId();
         }
 
-        if (group != null) {
+        if (StringUtils.isNotBlank(group)) {
             addInstanceToGroup(id, group);
+        } else if (group != null) {
+            // Allow removing an instance from its group when passing an empty group on update
+            removeInstanceFromInstanceGroup(vm.getId());
         }
 
         if (isDynamicallyScalable == null) {
@@ -3791,6 +3794,10 @@ public InstanceGroupVO getGroupForVm(long vmId) {
     public void removeInstanceFromInstanceGroup(long vmId) {
         try {
             List<InstanceGroupVMMapVO> groupVmMaps = _groupVMMapDao.listByInstanceId(vmId);
+            if (CollectionUtils.isEmpty(groupVmMaps)) {
+                logger.debug("Vm id: {} does not belong to any group", vmId);
+                return;
+            }
             for (InstanceGroupVMMapVO groupMap : groupVmMaps) {
                 SearchCriteria<InstanceGroupVMMapVO> sc = _groupVMMapDao.createSearchCriteria();
                 sc.addAnd("instanceId", SearchCriteria.Op.EQ, groupMap.getInstanceId());
diff --git a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
index cc2dc1cc9efa..13abf17ed5db 100644
--- a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
+++ b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
@@ -60,6 +60,8 @@
 import java.util.TimeZone;
 import java.util.UUID;
 
+import com.cloud.utils.db.SearchCriteria;
+import com.cloud.vm.dao.InstanceGroupVMMapDao;
 import org.apache.cloudstack.acl.ControlledEntity;
 import org.apache.cloudstack.acl.SecurityChecker;
 import org.apache.cloudstack.api.ApiCommandResourceType;
@@ -471,6 +473,9 @@ public class UserVmManagerImplTest {
     @Mock
     ServiceOfferingDetailsDao serviceOfferingDetailsDao;
 
+    @Mock
+    InstanceGroupVMMapDao instanceGroupVMMapDao;
+
     private static final long vmId = 1L;
     private static final long zoneId = 2L;
     private static final long accountId = 3L;
@@ -583,7 +588,7 @@ public void validateInputsAndPermissionForUpdateVirtualMachineCommandTest() {
 
     @Test
     public void updateVirtualMachineTestDisplayChanged() throws ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
-        configureDoNothingForMethodsThatWeDoNotWantToTest();
+        configureDoNothingForMethodsThatWeDoNotWantToTest(true);
         ServiceOffering offering = getSvcoffering(512);
         Mockito.when(_serviceOfferingDao.findById(Mockito.anyLong(), Mockito.anyLong())).thenReturn((ServiceOfferingVO) offering);
         Mockito.when(userVmVoMock.isDisplay()).thenReturn(true);
@@ -598,7 +603,7 @@ public void updateVirtualMachineTestDisplayChanged() throws ResourceUnavailableE
 
     @Test
     public void updateVirtualMachineTestCleanUpTrue() throws ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
-        configureDoNothingForMethodsThatWeDoNotWantToTest();
+        configureDoNothingForMethodsThatWeDoNotWantToTest(true);
         ServiceOffering offering = getSvcoffering(512);
         Mockito.when(_serviceOfferingDao.findById(Mockito.anyLong(), Mockito.anyLong())).thenReturn((ServiceOfferingVO) offering);
         Mockito.when(updateVmCommand.isCleanupDetails()).thenReturn(true);
@@ -615,6 +620,41 @@ public void updateVirtualMachineTestCleanUpTrue() throws ResourceUnavailableExce
         Mockito.verify(userVmManagerImpl, times(0)).updateDisplayVmFlag(false, vmId, userVmVoMock);
     }
 
+    @Test
+    public void testUpdateVirtualMachineInstanceGroupNull() throws ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
+        configureDoNothingForMethodsThatWeDoNotWantToTest(false);
+        ServiceOffering offering = getSvcoffering(512);
+        Mockito.when(_serviceOfferingDao.findById(Mockito.anyLong(), Mockito.anyLong())).thenReturn((ServiceOfferingVO) offering);
+        Mockito.when(updateVmCommand.getUserdataId()).thenReturn(null);
+
+        userVmManagerImpl.updateVirtualMachine(updateVmCommand);
+        Mockito.verify(userVmManagerImpl, never()).removeInstanceFromInstanceGroup(Mockito.anyLong());
+    }
+
+    @Test
+    public void testUpdateVirtualMachineInstanceGroupEmptyValue() throws ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
+        configureDoNothingForMethodsThatWeDoNotWantToTest(false);
+        ServiceOffering offering = getSvcoffering(512);
+        Mockito.when(_serviceOfferingDao.findById(Mockito.anyLong(), Mockito.anyLong())).thenReturn((ServiceOfferingVO) offering);
+        Mockito.when(updateVmCommand.getUserdataId()).thenReturn(null);
+
+        Mockito.when(userVmVoMock.getId()).thenReturn(vmId);
+        InstanceGroupVMMapVO mapVO = Mockito.mock(InstanceGroupVMMapVO.class);
+        Mockito.when(mapVO.getInstanceId()).thenReturn(vmId);
+        Mockito.when(instanceGroupVMMapDao.listByInstanceId(vmId)).thenReturn(Collections.singletonList(mapVO));
+        SearchCriteria<InstanceGroupVMMapVO> searchCriteria = Mockito.mock(SearchCriteria.class);
+        Mockito.when(instanceGroupVMMapDao.createSearchCriteria()).thenReturn(searchCriteria);
+
+        // Set group = "" to reset/restore the instance group for a VM
+        Mockito.when(updateVmCommand.getGroup()).thenReturn("");
+
+        userVmManagerImpl.updateVirtualMachine(updateVmCommand);
+
+        verifyMethodsThatAreAlwaysExecuted();
+        Mockito.verify(userVmManagerImpl).removeInstanceFromInstanceGroup(vmId);
+        Mockito.verify(instanceGroupVMMapDao).expunge(searchCriteria);
+    }
+
     @Test
     public void updateVirtualMachineTestCleanUpTrueAndDetailEmpty() throws ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
         prepareAndExecuteMethodDealingWithDetails(true, true);
@@ -647,7 +687,7 @@ private List<VMInstanceDetailVO> prepareExistingDetails(Long vmId, String... exi
     }
 
     private void prepareAndExecuteMethodDealingWithDetails(boolean cleanUpDetails, boolean isDetailsEmpty) throws ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
-        configureDoNothingForMethodsThatWeDoNotWantToTest();
+        configureDoNothingForMethodsThatWeDoNotWantToTest(true);
 
         ServiceOffering offering = getSvcoffering(512);
         Mockito.when(_serviceOfferingDao.findById(Mockito.anyLong(), Mockito.anyLong())).thenReturn((ServiceOfferingVO) offering);
@@ -701,18 +741,20 @@ private void verifyMethodsThatAreAlwaysExecuted() throws ResourceUnavailableExce
 
     }
 
-    private void configureDoNothingForMethodsThatWeDoNotWantToTest() throws ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
+    private void configureDoNothingForMethodsThatWeDoNotWantToTest(boolean mockUpdateVM) throws ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
         Mockito.doNothing().when(userVmManagerImpl).validateInputsAndPermissionForUpdateVirtualMachineCommand(updateVmCommand);
         Mockito.doReturn(new ArrayList<Long>()).when(userVmManagerImpl).getSecurityGroupIdList(updateVmCommand);
 
-        Mockito.lenient().doReturn(Mockito.mock(UserVm.class)).when(userVmManagerImpl).updateVirtualMachine(Mockito.anyLong(), Mockito.anyString(), Mockito.anyString(), Mockito.anyBoolean(),
-                Mockito.anyBoolean(), Mockito.anyBoolean(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyBoolean(), Mockito.any(HTTPMethod.class), Mockito.anyString(), Mockito.anyString(),
-                Mockito.anyString(), anyList(), Mockito.any());
+        if (mockUpdateVM) {
+            Mockito.lenient().doReturn(Mockito.mock(UserVm.class)).when(userVmManagerImpl).updateVirtualMachine(Mockito.anyLong(), Mockito.anyString(), Mockito.anyString(), Mockito.anyBoolean(),
+                    Mockito.anyBoolean(), Mockito.anyBoolean(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyBoolean(), Mockito.any(HTTPMethod.class), Mockito.anyString(), Mockito.anyString(),
+                    Mockito.anyString(), anyList(), Mockito.any());
+            Mockito.doNothing().when(userVmManagerImpl).removeInstanceFromInstanceGroup(Mockito.anyLong());
+        }
 
         Mockito.doNothing().when(userVmManagerImpl).validateIfVmSupportsMigration(Mockito.any(), Mockito.anyLong());
         Mockito.doNothing().when(userVmManagerImpl).validateOldAndNewAccounts(Mockito.nullable(Account.class), Mockito.nullable(Account.class), Mockito.anyLong(), Mockito.nullable(String.class), Mockito.nullable(Long.class));
         Mockito.doNothing().when(userVmManagerImpl).validateIfVmHasNoRules(Mockito.any(), Mockito.anyLong());
-        Mockito.doNothing().when(userVmManagerImpl).removeInstanceFromInstanceGroup(Mockito.anyLong());
         Mockito.doNothing().when(userVmManagerImpl).validateIfNewOwnerHasAccessToTemplate(Mockito.any(), Mockito.any(), Mockito.any());
 
         Mockito.doNothing().when(userVmManagerImpl).updateVmOwner(Mockito.any(), Mockito.any());
@@ -3199,7 +3241,7 @@ public void moveVmToUserTestMovesVmWhenProjectIdIsProvidedAndDomainIdIsNull() th
         Mockito.doNothing().when(userVmManagerImpl).executeStepsToChangeOwnershipOfVm(Mockito.any(), Mockito.any(), Mockito.any(),
                 Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
 
-        configureDoNothingForMethodsThatWeDoNotWantToTest();
+        configureDoNothingForMethodsThatWeDoNotWantToTest(true);
 
         userVmManagerImpl.moveVmToUser(assignVmCmdMock);
 
@@ -3215,7 +3257,7 @@ public void moveVmToUserTestValidateIfVmHasNoRulesThrowsInvalidParameterValueExc
         Mockito.doReturn(userVmVoMock).when(userVmDao).findById(Mockito.anyLong());
         Mockito.doReturn(null).when(assignVmCmdMock).getProjectId();
 
-        configureDoNothingForMethodsThatWeDoNotWantToTest();
+        configureDoNothingForMethodsThatWeDoNotWantToTest(true);
 
         doThrow(InvalidParameterValueException.class).when(userVmManagerImpl).validateIfVmHasNoRules(Mockito.any(), Mockito.anyLong());
 
@@ -3234,7 +3276,7 @@ public void moveVmToUserTestSnapshotsForVolumeExistThrowsInvalidParameterValueEx
         Mockito.doReturn(null).when(assignVmCmdMock).getProjectId();
         Mockito.doReturn(volumes).when(volumeDaoMock).findByInstance(Mockito.anyLong());
 
-        configureDoNothingForMethodsThatWeDoNotWantToTest();
+        configureDoNothingForMethodsThatWeDoNotWantToTest(true);
 
         doThrow(InvalidParameterValueException.class).when(userVmManagerImpl).validateIfVolumesHaveNoSnapshots(Mockito.any());
 
@@ -3252,7 +3294,7 @@ public void moveVmToUserTestVerifyResourceLimitsForAccountAndStorageThrowsResour
         Mockito.doReturn(null).when(assignVmCmdMock).getProjectId();
         Mockito.doReturn(volumes).when(volumeDaoMock).findByInstance(Mockito.anyLong());
 
-        configureDoNothingForMethodsThatWeDoNotWantToTest();
+        configureDoNothingForMethodsThatWeDoNotWantToTest(true);
 
         doThrow(ResourceAllocationException.class).when(userVmManagerImpl).verifyResourceLimitsForAccountAndStorage(Mockito.any(), Mockito.any(),
                 Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
@@ -3271,7 +3313,7 @@ public void moveVmToUserTestVerifyValidateIfNewOwnerHasAccessToTemplateThrowsInv
         Mockito.doReturn(null).when(assignVmCmdMock).getProjectId();
         Mockito.doReturn(volumes).when(volumeDaoMock).findByInstance(Mockito.anyLong());
 
-        configureDoNothingForMethodsThatWeDoNotWantToTest();
+        configureDoNothingForMethodsThatWeDoNotWantToTest(true);
 
         doThrow(InvalidParameterValueException.class).when(userVmManagerImpl).validateIfNewOwnerHasAccessToTemplate(Mockito.any(), Mockito.any(), Mockito.any());
 
@@ -3287,7 +3329,7 @@ public void executeStepsToChangeOwnershipOfVmTestUpdateVmNetworkThrowsInsufficie
         try (MockedStatic<UsageEventUtils> ignored = mockStatic(UsageEventUtils.class)) {
             Mockito.doReturn(Hypervisor.HypervisorType.KVM).when(userVmVoMock).getHypervisorType();
 
-            configureDoNothingForMethodsThatWeDoNotWantToTest();
+            configureDoNothingForMethodsThatWeDoNotWantToTest(true);
 
             doThrow(InsufficientAddressCapacityException.class).when(userVmManagerImpl).updateVmNetwork(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(),
                     Mockito.any());
@@ -3310,7 +3352,7 @@ public void executeStepsToChangeOwnershipOfVmTestUpdateVmNetworkThrowsResourceAl
         try (MockedStatic<UsageEventUtils> ignored = mockStatic(UsageEventUtils.class)) {
             Mockito.doReturn(Hypervisor.HypervisorType.KVM).when(userVmVoMock).getHypervisorType();
 
-            configureDoNothingForMethodsThatWeDoNotWantToTest();
+            configureDoNothingForMethodsThatWeDoNotWantToTest(true);
 
             doThrow(ResourceAllocationException.class).when(userVmManagerImpl).updateVmNetwork(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(),
                     Mockito.any());
@@ -3335,7 +3377,7 @@ public void executeStepsToChangeOwnershipOfVmTestResourceCountRunningVmsOnlyEnab
             Mockito.doReturn(Hypervisor.HypervisorType.KVM).when(userVmVoMock).getHypervisorType();
             Mockito.doReturn(false).when(userVmManagerImpl).isResourceCountRunningVmsOnlyEnabled();
 
-            configureDoNothingForMethodsThatWeDoNotWantToTest();
+            configureDoNothingForMethodsThatWeDoNotWantToTest(true);
 
             userVmManagerImpl.executeStepsToChangeOwnershipOfVm(assignVmCmdMock, callerAccount, accountMock, accountMock, userVmVoMock, serviceOfferingVoMock, volumes,
                     virtualMachineTemplateMock);
@@ -3358,7 +3400,7 @@ public void executeStepsToChangeOwnershipOfVmTestResourceCountRunningVmsOnlyEnab
             Mockito.doReturn(Hypervisor.HypervisorType.KVM).when(userVmVoMock).getHypervisorType();
             Mockito.doReturn(true).when(userVmManagerImpl).isResourceCountRunningVmsOnlyEnabled();
 
-            configureDoNothingForMethodsThatWeDoNotWantToTest();
+            configureDoNothingForMethodsThatWeDoNotWantToTest(true);
 
             userVmManagerImpl.executeStepsToChangeOwnershipOfVm(assignVmCmdMock, callerAccount, accountMock, accountMock, userVmVoMock, serviceOfferingVoMock, volumes,
                     virtualMachineTemplateMock);
diff --git a/ui/src/views/compute/EditVM.vue b/ui/src/views/compute/EditVM.vue
index 0763303b24a4..449304e205ab 100644
--- a/ui/src/views/compute/EditVM.vue
+++ b/ui/src/views/compute/EditVM.vue
@@ -80,7 +80,8 @@
         <a-auto-complete
           v-model:value="form.group"
           :filterOption="(input, option) => {
-            return option.value.toLowerCase().indexOf(input.toLowerCase()) >= 0
+            return !option.value || !input || input === resource.group ||
+              option.value.toLowerCase().indexOf(input.toLowerCase()) >= 0
           }"
           :options="groups.opts" />
       </a-form-item>
@@ -338,6 +339,10 @@ export default {
     fetchInstaceGroups () {
       this.groups.loading = true
       this.groups.opts = []
+      this.groups.opts.push({
+        id: '',
+        value: ''
+      })
       const params = {
         domainid: this.$store.getters.userInfo.domainid,
         listall: true
@@ -411,8 +416,8 @@ export default {
         if (values.haenable !== undefined) {
           params.haenable = values.haenable
         }
-        if (values.group && values.group.length > 0) {
-          params.group = values.group
+        if ((values.group || '') !== (this.resource.group || '')) {
+          params.group = values.group || ''
         }
         if (values.userdata && values.userdata.length > 0) {
           params.userdata = this.$toBase64AndURIEncoded(values.userdata)

From 768298a21116c27a38f98db797896a322cf832e7 Mon Sep 17 00:00:00 2001
From: Vishesh <8760112+vishesh92@users.noreply.github.com>
Date: Mon, 19 Oct 2026 04:00:06 +0530
Subject: [PATCH 38/41] Batch VM and host lookups in StorageManagerImpl to
 eliminate N+1 queries during cleanup and pool connect (#13353)

* Batch VM and host lookups in StorageManagerImpl to eliminate N+1 queries during cleanup and pool connect

cleanupStorage: replaced per-volume _vmInstanceDao.findById(vol.getInstanceId())
with a single batch SELECT ... WHERE id IN (...) before the loop, using a
HashMap for O(1) lookups. Added null guard for volumes with null instanceId.

connectHostsToPool: replaced per-thread _hostDao.findById(hostId) with a
batch load before thread pool submission. Each thread now reads from a
pre-built HashMap instead of hitting the DB. Added null guard with warning
log for hosts removed between list assembly and batch read.

Added VMInstanceDao.listByIds(List<Long>) with empty-list guard and IN-clause
SearchBuilder, matching the established pattern in HostDao.

* Fix test failures

* Address comments

---------

Co-authored-by: Aaron Chung <aaron_chung@apple.com>
---
 .../java/com/cloud/vm/dao/VMInstanceDao.java  |  2 ++
 .../com/cloud/vm/dao/VMInstanceDaoImpl.java   | 16 ++++++++++++++
 ...tackPrimaryDataStoreLifeCycleImplTest.java |  2 ++
 .../ScaleIOPrimaryDataStoreLifeCycleTest.java |  3 +++
 .../com/cloud/storage/StorageManagerImpl.java | 21 +++++++++++++++++--
 5 files changed, 42 insertions(+), 2 deletions(-)

diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDao.java b/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDao.java
index 4fd3e729e0d2..fbc4ea669e51 100755
--- a/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDao.java
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDao.java
@@ -197,4 +197,6 @@ List<VMInstanceVO> searchRemovedByRemoveDate(final Date startDate, final Date en
     List<VMInstanceVO> listDeleteProtectedVmsByAccountId(long accountId);
 
     List<VMInstanceVO> listDeleteProtectedVmsByDomainIds(Set<Long> domainIds);
+
+    List<VMInstanceVO> listByIds(List<Long> ids);
 }
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDaoImpl.java b/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDaoImpl.java
index d8c9b9253c89..b22d7e0274a2 100755
--- a/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDaoImpl.java
@@ -21,6 +21,7 @@
 import java.sql.SQLException;
 import java.util.ArrayList;
 import java.util.Collection;
+import java.util.Collections;
 import java.util.Date;
 import java.util.HashMap;
 import java.util.List;
@@ -106,6 +107,7 @@ public class VMInstanceDaoImpl extends GenericDaoBase<VMInstanceVO, Long> implem
     protected SearchBuilder<VMInstanceVO> LastHostAndStatesSearch;
     protected SearchBuilder<VMInstanceVO> VmsNotInClusterUsingPool;
     protected SearchBuilder<VMInstanceVO> IdsPowerStateSelectSearch;
+    protected SearchBuilder<VMInstanceVO> IdsSearch;
     GenericSearchBuilder<VMInstanceVO, Integer> CountByOfferingId;
     GenericSearchBuilder<VMInstanceVO, Integer> CountUserVmNotInDomain;
     SearchBuilder<VMInstanceVO> DeleteProtectedVmSearchByAccount;
@@ -386,6 +388,10 @@ protected void init() {
         DeleteProtectedVmSearchByDomainIds.and(ApiConstants.DELETE_PROTECTION, DeleteProtectedVmSearchByDomainIds.entity().isDeleteProtection(), Op.EQ);
         DeleteProtectedVmSearchByDomainIds.and(ApiConstants.REMOVED, DeleteProtectedVmSearchByDomainIds.entity().getRemoved(), Op.NULL);
         DeleteProtectedVmSearchByDomainIds.done();
+
+        IdsSearch = createSearchBuilder();
+        IdsSearch.and("ids", IdsSearch.entity().getId(), Op.IN);
+        IdsSearch.done();
     }
 
     @Override
@@ -1336,4 +1342,14 @@ public List<VMInstanceVO> listDeleteProtectedVmsByDomainIds(Set<Long> domainIds)
         Filter filter = new Filter(VMInstanceVO.class, null, false, 0L, 10L);
         return listBy(sc, filter);
     }
+
+    @Override
+    public List<VMInstanceVO> listByIds(List<Long> ids) {
+        if (CollectionUtils.isEmpty(ids)) {
+            return Collections.emptyList();
+        }
+        SearchCriteria<VMInstanceVO> sc = IdsSearch.create();
+        sc.setParameters("ids", ids.toArray());
+        return listBy(sc);
+    }
 }
diff --git a/plugins/storage/volume/default/src/test/java/org/apache/cloudstack/storage/datastore/lifecycle/CloudStackPrimaryDataStoreLifeCycleImplTest.java b/plugins/storage/volume/default/src/test/java/org/apache/cloudstack/storage/datastore/lifecycle/CloudStackPrimaryDataStoreLifeCycleImplTest.java
index 3b533d588d38..5d765267178b 100644
--- a/plugins/storage/volume/default/src/test/java/org/apache/cloudstack/storage/datastore/lifecycle/CloudStackPrimaryDataStoreLifeCycleImplTest.java
+++ b/plugins/storage/volume/default/src/test/java/org/apache/cloudstack/storage/datastore/lifecycle/CloudStackPrimaryDataStoreLifeCycleImplTest.java
@@ -26,6 +26,7 @@
 import static org.mockito.Mockito.when;
 
 import java.util.Arrays;
+import java.util.List;
 
 import org.apache.cloudstack.engine.subsystem.api.storage.ClusterScope;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
@@ -153,6 +154,7 @@ public void initMocks() throws StorageConflictException {
                 .thenReturn(Arrays.asList(host1, host2));
 
         when(hostDao.findById(anyLong())).thenReturn(mock(HostVO.class));
+        when(hostDao.listByIds(List.of(1L, 2L))).thenReturn(List.of(host1, host2));
         when(agentMgr.easySend(anyLong(), Mockito.any(ModifyStoragePoolCommand.class))).thenReturn(answer);
         when(answer.getResult()).thenReturn(true);
 
diff --git a/plugins/storage/volume/scaleio/src/test/java/org/apache/cloudstack/storage/datastore/lifecycle/ScaleIOPrimaryDataStoreLifeCycleTest.java b/plugins/storage/volume/scaleio/src/test/java/org/apache/cloudstack/storage/datastore/lifecycle/ScaleIOPrimaryDataStoreLifeCycleTest.java
index 324f3c08cb8f..ac7075ee4621 100644
--- a/plugins/storage/volume/scaleio/src/test/java/org/apache/cloudstack/storage/datastore/lifecycle/ScaleIOPrimaryDataStoreLifeCycleTest.java
+++ b/plugins/storage/volume/scaleio/src/test/java/org/apache/cloudstack/storage/datastore/lifecycle/ScaleIOPrimaryDataStoreLifeCycleTest.java
@@ -151,6 +151,7 @@ public void testAttachZone() throws Exception {
 
         when(resourceManager.getEligibleUpAndEnabledHostsInZoneForStorageConnection(dataStore, scope.getScopeId(), Hypervisor.HypervisorType.KVM))
                 .thenReturn(Arrays.asList(host1, host2));
+        when(hostDao.listByIds(List.of(1L, 2L))).thenReturn(List.of(host1, host2));
 
         when(dataStoreMgr.getDataStore(anyLong(), eq(DataStoreRole.Primary))).thenReturn(store);
         when(store.isShared()).thenReturn(true);
@@ -164,6 +165,8 @@ public void testAttachZone() throws Exception {
 
         boolean result = scaleIOPrimaryDataStoreLifeCycleTest.attachZone(dataStore, scope, Hypervisor.HypervisorType.KVM);
         assertThat(result).isTrue();
+        Mockito.verify(hostListener).hostConnect(host1, store);
+        Mockito.verify(hostListener).hostConnect(host2, store);
     }
 
     @Test(expected = CloudRuntimeException.class)
diff --git a/server/src/main/java/com/cloud/storage/StorageManagerImpl.java b/server/src/main/java/com/cloud/storage/StorageManagerImpl.java
index 0b2aca08e084..587a5269cbad 100644
--- a/server/src/main/java/com/cloud/storage/StorageManagerImpl.java
+++ b/server/src/main/java/com/cloud/storage/StorageManagerImpl.java
@@ -1846,6 +1846,10 @@ public void connectHostsToPool(DataStore primaryStore, List<Long> hostIds, Scope
         if (CollectionUtils.isEmpty(hostIds)) {
             return;
         }
+        Map<Long, HostVO> hostMap = new HashMap<>();
+        for (HostVO h : _hostDao.listByIds(hostIds)) {
+            hostMap.put(h.getId(), h);
+        }
         CopyOnWriteArrayList<Long> poolHostIds = new CopyOnWriteArrayList<>();
         ExecutorService executorService = Executors.newFixedThreadPool(Math.max(1, Math.min(hostIds.size(),
                 StoragePoolHostConnectWorkers.value())));
@@ -1856,10 +1860,14 @@ public void connectHostsToPool(DataStore primaryStore, List<Long> hostIds, Scope
                 if (exceptionOccurred.get()) {
                     return null;
                 }
+                HostVO host = hostMap.get(hostId);
+                if (host == null) {
+                    logger.warn("Host [{}] not found, skipping pool connection for {}", hostId, primaryStore);
+                    return null;
+                }
                 Transaction.execute(new TransactionCallbackWithExceptionNoReturn<Exception>() {
                     @Override
                     public void doInTransactionWithoutResult(TransactionStatus status) throws Exception {
-                        HostVO host = _hostDao.findById(hostId);
                         try {
                             connectHostToSharedPool(host, primaryStore.getId());
                             poolHostIds.add(hostId);
@@ -2126,9 +2134,18 @@ public void cleanupStorage(boolean recurring) {
                     cleanupSecondaryStorage(recurring);
 
                     List<VolumeVO> vols = volumeDao.listVolumesToBeDestroyed(new Date(System.currentTimeMillis() - ((long)StorageCleanupDelay.value() << 10)));
+                    List<Long> rootVolumeVmIds = vols.stream()
+                            .filter(v -> Type.ROOT.equals(v.getVolumeType()) && v.getInstanceId() != null)
+                            .map(VolumeVO::getInstanceId)
+                            .distinct()
+                            .collect(Collectors.toList());
+                    Map<Long, VMInstanceVO> vmMap = new HashMap<>();
+                    for (VMInstanceVO vm : _vmInstanceDao.listByIds(rootVolumeVmIds)) {
+                        vmMap.put(vm.getId(), vm);
+                    }
                     for (VolumeVO vol : vols) {
                         if (Type.ROOT.equals(vol.getVolumeType())) {
-                             VMInstanceVO vmInstanceVO = _vmInstanceDao.findById(vol.getInstanceId());
+                            VMInstanceVO vmInstanceVO = vol.getInstanceId() != null ? vmMap.get(vol.getInstanceId()) : null;
                              if (vmInstanceVO != null && vmInstanceVO.getState() == State.Destroyed) {
                                  logger.debug("ROOT volume [{}] will not be expunged because the VM is [{}], therefore this volume will be expunged with the VM"
                                          + " cleanup job.", vol, vmInstanceVO.getState());

From 99f348e0f94681a35a03fcb885af61d0c61305f2 Mon Sep 17 00:00:00 2001
From: Vishesh <8760112+vishesh92@users.noreply.github.com>
Date: Mon, 19 Oct 2026 04:00:47 +0530
Subject: [PATCH 39/41] Batch network lookups per NIC in NetworkOrchestrator to
 eliminate N+1 queries during migration (#13354)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* Batch network lookups per NIC in NetworkOrchestrator to eliminate N+1 queries during migration

Three methods called _networksDao.findById(nic.getNetworkId()) per NIC in a loop:
setHypervisorHostname, prepareNicForMigration, prepareAllNicsForMigration.
Now batch-loads all networks for a VM's NICs in a single WHERE id IN (...) query.

- Add NetworkDao.listByIds(List<Long>) for batch ID lookup
- Add getNetworkMapForNics helper returning Map<Long, NetworkVO>
- Replace per-NIC findById with map lookup at 3 sites
- Add null guard for deleted networks (pre-existing NPE risk on all 3 sites)
- Site 2 (prepare) left unchanged — findById only on error path, not N+1

* Address comments

---------

Co-authored-by: Aaron Chung <aaron_chung@apple.com>
---
 .../orchestration/NetworkOrchestrator.java    | 29 +++++++++++++++++--
 .../com/cloud/network/dao/NetworkDao.java     |  2 ++
 .../com/cloud/network/dao/NetworkDaoImpl.java | 13 +++++++++
 .../cloud/network/dao/NetworkDaoImplTest.java | 24 +++++++++++++++
 .../com/cloud/vpc/dao/MockNetworkDaoImpl.java |  5 ++++
 5 files changed, 70 insertions(+), 3 deletions(-)

diff --git a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java
index 20b9bf125a4d..9b1609c669a5 100644
--- a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java
+++ b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java
@@ -2085,13 +2085,26 @@ public void finalizeUpdateInSequence(Network network, boolean success) {
         }
     }
 
+    private Map<Long, NetworkVO> batchLoadNetworksForNics(List<NicVO> nics) {
+        List<Long> networkIds = nics.stream().map(NicVO::getNetworkId).distinct().collect(Collectors.toList());
+        Map<Long, NetworkVO> result = new HashMap<>(networkIds.size());
+        for (NetworkVO network : _networksDao.listByIds(networkIds)) {
+            result.put(network.getId(), network);
+        }
+        return result;
+    }
+
     @Override
     public void setHypervisorHostname(VirtualMachineProfile vm, DeployDestination dest, boolean migrationSuccessful) throws ResourceUnavailableException {
         String hypervisorHostName = VirtualMachineManager.getHypervisorHostname(dest.getHost().getName());
         if (StringUtils.isNotEmpty(hypervisorHostName)) {
             final List<NicVO> nics = _nicDao.listByVmId(vm.getId());
+            final Map<Long, NetworkVO> networksById = batchLoadNetworksForNics(nics);
             for (final NicVO nic : nics) {
-                final NetworkVO network = _networksDao.findById(nic.getNetworkId());
+                final NetworkVO network = networksById.get(nic.getNetworkId());
+                if (network == null) {
+                    continue;
+                }
                 final Integer networkRate = _networkModel.getNetworkRate(network.getId(), vm.getId());
                 final NicProfile profile = new NicProfile(nic, network, nic.getBroadcastUri(), nic.getIsolationUri(), networkRate, _networkModel.isSecurityGroupSupportedInNetwork(network),
                         _networkModel.getNetworkTag(vm.getHypervisorType(), network));
@@ -2266,8 +2279,13 @@ public void prepareNicForMigration(final VirtualMachineProfile vm, final DeployD
         }
         final List<NicVO> nics = _nicDao.listByVmId(vm.getId());
         final ReservationContext context = new ReservationContextImpl(UUID.randomUUID().toString(), null, null);
+        final Map<Long, NetworkVO> networksById = batchLoadNetworksForNics(nics);
         for (final NicVO nic : nics) {
-            final NetworkVO network = _networksDao.findById(nic.getNetworkId());
+            final NetworkVO network = networksById.get(nic.getNetworkId());
+            if (network == null) {
+                logger.warn("Network {} not found for nic {} during migration prep, skipping", nic.getNetworkId(), nic);
+                continue;
+            }
             final Integer networkRate = _networkModel.getNetworkRate(network.getId(), vm.getId());
 
             final NetworkGuru guru = AdapterBase.getAdapterByName(networkGurus, network.getGuruName());
@@ -2316,9 +2334,14 @@ private boolean isReservedForExternalProvider(Long vlanId) {
     public void prepareAllNicsForMigration(final VirtualMachineProfile vm, final DeployDestination dest) {
         final List<NicVO> nics = _nicDao.listByVmId(vm.getId());
         final ReservationContext context = new ReservationContextImpl(UUID.randomUUID().toString(), null, null);
+        final Map<Long, NetworkVO> networksById = batchLoadNetworksForNics(nics);
         Long guestNetworkId = null;
         for (final NicVO nic : nics) {
-            final NetworkVO network = _networksDao.findById(nic.getNetworkId());
+            final NetworkVO network = networksById.get(nic.getNetworkId());
+            if (network == null) {
+                logger.warn("Network {} not found for nic {} during migration prep, skipping", nic.getNetworkId(), nic);
+                continue;
+            }
             if (network.getTrafficType().equals(TrafficType.Guest) && network.getGuestType().equals(GuestType.Isolated)) {
                 guestNetworkId = network.getId();
             }
diff --git a/engine/schema/src/main/java/com/cloud/network/dao/NetworkDao.java b/engine/schema/src/main/java/com/cloud/network/dao/NetworkDao.java
index fdca6e43f00f..4ef1489a25c9 100644
--- a/engine/schema/src/main/java/com/cloud/network/dao/NetworkDao.java
+++ b/engine/schema/src/main/java/com/cloud/network/dao/NetworkDao.java
@@ -32,6 +32,8 @@ public interface NetworkDao extends GenericDao<NetworkVO, Long>, StateDao<State,
 
     List<NetworkVO> listByOwner(long ownerId);
 
+    List<NetworkVO> listByIds(List<Long> ids);
+
     List<NetworkVO> listByGuestType(GuestType type);
 
     List<NetworkVO> listBy(long accountId, long offeringId, long dataCenterId);
diff --git a/engine/schema/src/main/java/com/cloud/network/dao/NetworkDaoImpl.java b/engine/schema/src/main/java/com/cloud/network/dao/NetworkDaoImpl.java
index 5887498e094c..1999a58fc845 100644
--- a/engine/schema/src/main/java/com/cloud/network/dao/NetworkDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/network/dao/NetworkDaoImpl.java
@@ -563,6 +563,19 @@ public List<NetworkVO> listByOwner(final long ownerId) {
         return listBy(sc);
     }
 
+    @Override
+    public List<NetworkVO> listByIds(List<Long> ids) {
+        if (ids == null || ids.isEmpty()) {
+            return new ArrayList<>();
+        }
+        SearchBuilder<NetworkVO> sb = createSearchBuilder();
+        sb.and("id", sb.entity().getId(), Op.IN);
+        sb.done();
+        SearchCriteria<NetworkVO> sc = sb.create();
+        sc.setParameters("id", ids.toArray());
+        return listBy(sc);
+    }
+
     @Override
     public void addDomainToNetwork(final long networkId, final long domainId, final Boolean subdomainAccess) {
         addDomainToNetworknetwork(networkId, domainId, subdomainAccess);
diff --git a/engine/schema/src/test/java/com/cloud/network/dao/NetworkDaoImplTest.java b/engine/schema/src/test/java/com/cloud/network/dao/NetworkDaoImplTest.java
index ab5f43521052..b92066dbd947 100644
--- a/engine/schema/src/test/java/com/cloud/network/dao/NetworkDaoImplTest.java
+++ b/engine/schema/src/test/java/com/cloud/network/dao/NetworkDaoImplTest.java
@@ -26,11 +26,13 @@
 import org.junit.Assert;
 import org.junit.Test;
 import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
 import org.mockito.Mock;
 import org.mockito.Mockito;
 import org.mockito.junit.MockitoJUnitRunner;
 
 
+import java.util.Collections;
 import java.util.List;
 
 @RunWith(MockitoJUnitRunner.class)
@@ -68,4 +70,26 @@ public void listByPhysicalNetworkTrafficTypeTestSetParametersValidation() throws
             txn.close();
         }
     }
+
+    @Test
+    public void listByIdsTestNullOrEmptyIdsReturnsEmptyList() {
+        NetworkDaoImpl networkDaoImplSpy = Mockito.spy(NetworkDaoImpl.class);
+
+        Assert.assertTrue(networkDaoImplSpy.listByIds(null).isEmpty());
+        Assert.assertTrue(networkDaoImplSpy.listByIds(Collections.emptyList()).isEmpty());
+        Mockito.verify(networkDaoImplSpy, Mockito.never()).listBy(Mockito.any(SearchCriteria.class));
+    }
+
+    @Test
+    public void listByIdsTestBuildsInClause() {
+        NetworkDaoImpl networkDaoImplSpy = Mockito.spy(NetworkDaoImpl.class);
+        Mockito.doReturn(listNetworkVoMock).when(networkDaoImplSpy).listBy(Mockito.any(SearchCriteria.class));
+
+        List<NetworkVO> result = networkDaoImplSpy.listByIds(List.of(1L, 2L, 3L));
+
+        Assert.assertEquals(listNetworkVoMock, result);
+        ArgumentCaptor<SearchCriteria> scCaptor = ArgumentCaptor.forClass(SearchCriteria.class);
+        Mockito.verify(networkDaoImplSpy).listBy(scCaptor.capture());
+        Assert.assertEquals("networks.id IN (?,?,?)", scCaptor.getValue().getWhereClause().trim());
+    }
 }
diff --git a/server/src/test/java/com/cloud/vpc/dao/MockNetworkDaoImpl.java b/server/src/test/java/com/cloud/vpc/dao/MockNetworkDaoImpl.java
index 8a0bec56df7b..b1d7e82839e1 100644
--- a/server/src/test/java/com/cloud/vpc/dao/MockNetworkDaoImpl.java
+++ b/server/src/test/java/com/cloud/vpc/dao/MockNetworkDaoImpl.java
@@ -280,4 +280,9 @@ public List<NetworkVO> listByNetworkDomainsAndAccountIds(Set<String> uniqueNtwkD
     public List<NetworkVO> listByNetworkDomainsAndDomainIds(Set<String> uniqueNtwkDomains, Set<Long> domainIds) {
         return List.of();
     }
+
+    @Override
+    public List<NetworkVO> listByIds(List<Long> ids) {
+        return List.of();
+    }
 }

From 2736abbeceb0b71c3489fbebe2139e56f15b4326 Mon Sep 17 00:00:00 2001
From: nvazquez <nicovazquez90@gmail.com>
Date: Mon, 19 Oct 2026 16:48:02 -0300
Subject: [PATCH 40/41] Fix build after merging 4.22

---
 .../framework/extensions/network/NetworkExtensionElement.java | 2 +-
 .../org/apache/cloudstack/backup/NASBackupProviderTest.java   | 4 ++--
 .../cloud/hypervisor/kvm/storage/LibvirtStorageAdaptor.java   | 1 +
 server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java  | 1 -
 .../java/org/apache/cloudstack/backup/BackupManagerTest.java  | 3 ++-
 5 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/network/NetworkExtensionElement.java b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/network/NetworkExtensionElement.java
index e98848c01f7d..ff2595d8e215 100644
--- a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/network/NetworkExtensionElement.java
+++ b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/network/NetworkExtensionElement.java
@@ -2014,7 +2014,7 @@ public boolean completeAggregatedExecution(Network network, DeployDestination de
         }
 
         // Query all active User-VM NICs on this network
-        List<NicVO> nics = nicDao.listByNetworkIdAndType(network.getId(), VirtualMachine.Type.User);
+        List<NicVO> nics = nicDao.listNonPlaceholderNicsByNetworkIdAndType(network.getId(), VirtualMachine.Type.User);
         if (CollectionUtils.isEmpty(nics)) {
             logger.debug("completeAggregatedExecution: no user VM NICs on network={}, skipping", network);
             return true;
diff --git a/plugins/backup/nas/src/test/java/org/apache/cloudstack/backup/NASBackupProviderTest.java b/plugins/backup/nas/src/test/java/org/apache/cloudstack/backup/NASBackupProviderTest.java
index 356081f7c623..9e3d7b77c152 100644
--- a/plugins/backup/nas/src/test/java/org/apache/cloudstack/backup/NASBackupProviderTest.java
+++ b/plugins/backup/nas/src/test/java/org/apache/cloudstack/backup/NASBackupProviderTest.java
@@ -291,7 +291,7 @@ public void takeBackupFailureNeedingCleanupReturnsErrorBackup() throws AgentUnav
 
         Mockito.when(backupDao.persist(Mockito.any(BackupVO.class))).thenAnswer(invocation -> invocation.getArgument(0));
 
-        Pair<Boolean, Backup> result = nasBackupProvider.takeBackup(vm, true);
+        Pair<Boolean, Backup> result = nasBackupProvider.takeBackup(vm, true, false);
 
         Assert.assertFalse(result.first());
         Assert.assertNotNull(result.second());
@@ -321,7 +321,7 @@ public void takeBackupFailureWithoutCleanupRemovesBackup() throws AgentUnavailab
 
         Mockito.when(backupDao.persist(Mockito.any(BackupVO.class))).thenAnswer(invocation -> invocation.getArgument(0));
 
-        Pair<Boolean, Backup> result = nasBackupProvider.takeBackup(vm, false);
+        Pair<Boolean, Backup> result = nasBackupProvider.takeBackup(vm, false, false);
 
         Assert.assertFalse(result.first());
         Assert.assertNull(result.second());
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptor.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptor.java
index 0dc739499a98..2c642efb9cfb 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptor.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptor.java
@@ -57,6 +57,7 @@
 
 import com.ceph.rados.IoCTX;
 import com.ceph.rados.Rados;
+import com.ceph.rados.exceptions.ErrorCode;
 import com.ceph.rados.exceptions.RadosException;
 import com.ceph.rbd.Rbd;
 import com.ceph.rbd.RbdException;
diff --git a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
index 343a73a1f8d0..62a8433c0550 100644
--- a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
+++ b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
@@ -214,7 +214,6 @@
 import com.cloud.utils.exception.ExceptionProxyObject;
 import com.cloud.utils.fsm.NoTransitionException;
 import com.cloud.vm.dao.InstanceGroupDao;
-import com.cloud.vm.dao.InstanceGroupVMMapDao;
 import com.cloud.vm.dao.NicDao;
 import com.cloud.vm.dao.UserVmDao;
 import com.cloud.vm.dao.VMInstanceDetailsDao;
diff --git a/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java b/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java
index 098f23e31f0c..1bb35463b866 100644
--- a/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java
+++ b/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java
@@ -22,6 +22,7 @@
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
 import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyBoolean;
 import static org.mockito.ArgumentMatchers.anyInt;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.atLeastOnce;
@@ -794,7 +795,7 @@ public void createBackupTestFailedScheduledBackupKeepsSchedule() throws Resource
         Backup backup = mock(Backup.class);
         when(backup.getId()).thenReturn(backupId);
         when(backupProvider.getName()).thenReturn("testbackupprovider");
-        when(backupProvider.takeBackup(vmInstanceVOMock, null)).thenReturn(new Pair<>(false, backup));
+        when(backupProvider.takeBackup(vmInstanceVOMock, null, anyBoolean())).thenReturn(new Pair<>(false, backup));
         Map<String, BackupProvider> backupProvidersMap = new HashMap<>();
         backupProvidersMap.put(backupProvider.getName().toLowerCase(), backupProvider);
         ReflectionTestUtils.setField(backupManager, "backupProvidersMap", backupProvidersMap);

From af9764b87a6901d4dce24c34573f5d76c0441cc4 Mon Sep 17 00:00:00 2001
From: nvazquez <nicovazquez90@gmail.com>
Date: Mon, 19 Oct 2026 19:11:32 -0300
Subject: [PATCH 41/41] Fix tests

---
 .../org/apache/cloudstack/backup/BackupManagerImpl.java  | 3 ---
 server/src/test/java/com/cloud/api/ApiServerTest.java    | 9 +++++----
 .../cloud/network/vpn/Site2SiteVpnManagerImplTest.java   | 1 +
 .../test/java/com/cloud/vm/UserVmManagerImplTest.java    | 9 +++------
 .../org/apache/cloudstack/backup/BackupManagerTest.java  | 3 +--
 5 files changed, 10 insertions(+), 15 deletions(-)

diff --git a/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java b/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
index e7a6ec309d5d..55f85ef2f23f 100644
--- a/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
@@ -1068,9 +1068,6 @@ private void createCheckedBackup(CreateBackupCmd cmd, Account owner, boolean isS
                      Resource.ResourceType.backup_storage, backupSize, reservationDao, resourceLimitMgr)) {
 
             Pair<Boolean, Backup> result = backupProvider.takeBackup(vm, cmd.getQuiesceVM(), cmd.isIsolated());
-            if (!result.first()) {
-                throw new CloudRuntimeException("Failed to create Instance Backup");
-            }
             Backup backup = result.second();
             if (backup != null) {
                 updateBackupFromCmd(backup.getId(), cmd, backupScheduleId);
diff --git a/server/src/test/java/com/cloud/api/ApiServerTest.java b/server/src/test/java/com/cloud/api/ApiServerTest.java
index 43802aaa24ca..c2c35440e123 100644
--- a/server/src/test/java/com/cloud/api/ApiServerTest.java
+++ b/server/src/test/java/com/cloud/api/ApiServerTest.java
@@ -29,6 +29,7 @@
 import com.cloud.user.UserVO;
 import com.cloud.utils.exception.CloudRuntimeException;
 
+import org.apache.cloudstack.acl.apikeypair.ApiKeyPairPermission;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.ResponseObject;
 import org.apache.cloudstack.api.response.LoginCmdResponse;
@@ -302,7 +303,7 @@ public void testCheckCommandAvailableSkipsCidrLookupWhenDisabled() throws Except
         overrideDefaultConfigValue(ApiServiceConfiguration.ApiSourceCidrChecksEnabled, "_defaultValue", "false");
         User user = Mockito.mock(User.class);
 
-        ReflectionTestUtils.invokeMethod(apiServer, "checkCommandAvailable", user, "listVirtualMachines", InetAddress.getByName("127.0.0.1"));
+        ReflectionTestUtils.invokeMethod(apiServer, "checkCommandAvailable", user, "listVirtualMachines", InetAddress.getByName("127.0.0.1"), null, new ApiKeyPairPermission[0]);
 
         Mockito.verify(accountManager, Mockito.never()).getAccount(Mockito.anyLong());
     }
@@ -317,7 +318,7 @@ public void testCheckCommandAvailableAllowsMatchingCidr() throws Exception {
         Mockito.when(account.getId()).thenReturn(1L);
         Mockito.when(accountManager.getAccount(1L)).thenReturn(account);
 
-        ReflectionTestUtils.invokeMethod(apiServer, "checkCommandAvailable", user, "listVirtualMachines", InetAddress.getByName("127.0.0.1"));
+        ReflectionTestUtils.invokeMethod(apiServer, "checkCommandAvailable", user, "listVirtualMachines", InetAddress.getByName("127.0.0.1"), null, new ApiKeyPairPermission[0]);
 
         Mockito.verify(accountManager).getAccount(1L);
     }
@@ -332,11 +333,11 @@ public void testCheckCommandAvailableDeniesNonMatchingCidr() throws Exception {
         Mockito.when(account.getId()).thenReturn(1L);
         Mockito.when(accountManager.getAccount(1L)).thenReturn(account);
 
-        ReflectionTestUtils.invokeMethod(apiServer, "checkCommandAvailable", user, "listVirtualMachines", InetAddress.getByName("127.0.0.1"));
+        ReflectionTestUtils.invokeMethod(apiServer, "checkCommandAvailable", user, "listVirtualMachines", InetAddress.getByName("127.0.0.1"), null, new ApiKeyPairPermission[0]);
     }
 
     @Test(expected = PermissionDeniedException.class)
     public void testCheckCommandAvailableThrowsWhenUserNull() throws Exception {
-        ReflectionTestUtils.invokeMethod(apiServer, "checkCommandAvailable", null, "listVirtualMachines", InetAddress.getByName("127.0.0.1"));
+        ReflectionTestUtils.invokeMethod(apiServer, "checkCommandAvailable", null, "listVirtualMachines", InetAddress.getByName("127.0.0.1"), null, new ApiKeyPairPermission[0]);
     }
 }
diff --git a/server/src/test/java/com/cloud/network/vpn/Site2SiteVpnManagerImplTest.java b/server/src/test/java/com/cloud/network/vpn/Site2SiteVpnManagerImplTest.java
index 291d3a4aa812..7e419e353f67 100644
--- a/server/src/test/java/com/cloud/network/vpn/Site2SiteVpnManagerImplTest.java
+++ b/server/src/test/java/com/cloud/network/vpn/Site2SiteVpnManagerImplTest.java
@@ -216,6 +216,7 @@ public void testCreateVpnGatewaySuccess() {
         when(cmd.isDisplay()).thenReturn(true);
 
         when(_vpcDao.findById(VPC_ID)).thenReturn(vpc);
+        when(vpcOfferingServiceMapDao.areServicesSupportedByVpcOffering(anyLong(), any())).thenReturn(true);
         when(_vpnGatewayDao.findByVpcId(VPC_ID)).thenReturn(null);
         when(_ipAddressDao.listByAssociatedVpc(VPC_ID, true)).thenReturn(List.of(ipAddress));
         when(_vpnGatewayDao.persist(any(Site2SiteVpnGatewayVO.class))).thenReturn(vpnGateway);
diff --git a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
index 62a8433c0550..6ad13bbd429e 100644
--- a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
+++ b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
@@ -503,9 +503,6 @@ public class UserVmManagerImplTest {
     @Mock
     ServiceOfferingDetailsDao serviceOfferingDetailsDao;
 
-    @Mock
-    InstanceGroupVMMapDao instanceGroupVMMapDao;
-
     private static final long vmId = 1L;
     private static final long zoneId = 2L;
     private static final long accountId = 3L;
@@ -694,9 +691,9 @@ public void testUpdateVirtualMachineInstanceGroupEmptyValue() throws ResourceUna
         Mockito.when(userVmVoMock.getId()).thenReturn(vmId);
         InstanceGroupVMMapVO mapVO = Mockito.mock(InstanceGroupVMMapVO.class);
         Mockito.when(mapVO.getInstanceId()).thenReturn(vmId);
-        Mockito.when(instanceGroupVMMapDao.listByInstanceId(vmId)).thenReturn(Collections.singletonList(mapVO));
+        Mockito.when(_groupVMMapDao.listByInstanceId(vmId)).thenReturn(Collections.singletonList(mapVO));
         SearchCriteria<InstanceGroupVMMapVO> searchCriteria = Mockito.mock(SearchCriteria.class);
-        Mockito.when(instanceGroupVMMapDao.createSearchCriteria()).thenReturn(searchCriteria);
+        Mockito.when(_groupVMMapDao.createSearchCriteria()).thenReturn(searchCriteria);
 
         // Set group = "" to reset/restore the instance group for a VM
         Mockito.when(updateVmCommand.getGroup()).thenReturn("");
@@ -705,7 +702,7 @@ public void testUpdateVirtualMachineInstanceGroupEmptyValue() throws ResourceUna
 
         verifyMethodsThatAreAlwaysExecuted();
         Mockito.verify(userVmManagerImpl).removeInstanceFromInstanceGroup(vmId);
-        Mockito.verify(instanceGroupVMMapDao).expunge(searchCriteria);
+        Mockito.verify(_groupVMMapDao).expunge(searchCriteria);
     }
 
     @Test
diff --git a/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java b/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java
index 1bb35463b866..b9d247ad4277 100644
--- a/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java
+++ b/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java
@@ -22,7 +22,6 @@
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
 import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.anyBoolean;
 import static org.mockito.ArgumentMatchers.anyInt;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.atLeastOnce;
@@ -795,7 +794,7 @@ public void createBackupTestFailedScheduledBackupKeepsSchedule() throws Resource
         Backup backup = mock(Backup.class);
         when(backup.getId()).thenReturn(backupId);
         when(backupProvider.getName()).thenReturn("testbackupprovider");
-        when(backupProvider.takeBackup(vmInstanceVOMock, null, anyBoolean())).thenReturn(new Pair<>(false, backup));
+        when(backupProvider.takeBackup(vmInstanceVOMock, null, false)).thenReturn(new Pair<>(false, backup));
         Map<String, BackupProvider> backupProvidersMap = new HashMap<>();
         backupProvidersMap.put(backupProvider.getName().toLowerCase(), backupProvider);
         ReflectionTestUtils.setField(backupManager, "backupProvidersMap", backupProvidersMap);