From 6e5d78a8a78feec31a6dfa893137b65fed5f7677 Mon Sep 17 00:00:00 2001
From: Harikrishna <harikrishna.patnala@gmail.com>
Date: Thu, 22 Jan 2026 12:46:16 +0530
Subject: [PATCH 001/117] Fix NPE on adding new columns in the tables (#12464)

* Fix NPE on adding new columns in the tables

* Remove assert
---
 .../java/com/cloud/utils/db/GenericDaoBase.java   | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/framework/db/src/main/java/com/cloud/utils/db/GenericDaoBase.java b/framework/db/src/main/java/com/cloud/utils/db/GenericDaoBase.java
index 301803aab9b6..c3a4d2c2487c 100644
--- a/framework/db/src/main/java/com/cloud/utils/db/GenericDaoBase.java
+++ b/framework/db/src/main/java/com/cloud/utils/db/GenericDaoBase.java
@@ -89,6 +89,7 @@
 import net.sf.ehcache.Cache;
 import net.sf.ehcache.CacheManager;
 import net.sf.ehcache.Element;
+import org.springframework.util.ClassUtils;
 
 /**
  *  GenericDaoBase is a simple way to implement DAOs.  It DOES NOT
@@ -2047,16 +2048,22 @@ public boolean unremove(ID id) {
 
     @DB()
     protected void setField(final Object entity, final ResultSet rs, ResultSetMetaData meta, final int index) throws SQLException {
-        Attribute attr = _allColumns.get(new Pair<String, String>(meta.getTableName(index), meta.getColumnName(index)));
+        String tableName = meta.getTableName(index);
+        String columnName = meta.getColumnName(index);
+        Attribute attr = _allColumns.get(new Pair<>(tableName, columnName));
         if (attr == null) {
             // work around for mysql bug to return original table name instead of view name in db view case
             Table tbl = entity.getClass().getSuperclass().getAnnotation(Table.class);
             if (tbl != null) {
-                attr = _allColumns.get(new Pair<String, String>(tbl.name(), meta.getColumnLabel(index)));
+                attr = _allColumns.get(new Pair<>(tbl.name(), meta.getColumnLabel(index)));
             }
         }
-        assert (attr != null) : "How come I can't find " + meta.getCatalogName(index) + "." + meta.getColumnName(index);
-        setField(entity, attr.field, rs, index);
+        if(attr == null) {
+            logger.warn(String.format("Failed to find attribute in the entity %s to map column %s.%s (%s)",
+                    ClassUtils.getUserClass(entity).getSimpleName(), tableName, columnName));
+        } else {
+            setField(entity, attr.field, rs, index);
+        }
     }
 
     @Override

From b5e9178078f0efac75fdb3eb5b07459228da471d Mon Sep 17 00:00:00 2001
From: Wei Zhou <weizhou@apache.org>
Date: Thu, 22 Jan 2026 10:56:03 +0100
Subject: [PATCH 002/117] UI: fix issues when deploy VNF applicance on network
 with SG (#12436)

---
 ui/public/locales/en.json                   | 2 +-
 ui/src/config/section/network.js            | 5 ++++-
 ui/src/views/compute/DeployVnfAppliance.vue | 2 +-
 ui/src/views/network/VnfAppliancesTab.vue   | 2 +-
 4 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index aaf499d2f954..64437a4d07c1 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -2527,7 +2527,7 @@
 "label.vnf.app.action.reinstall": "Reinstall VNF Appliance",
 "label.vnf.cidr.list": "CIDR from which access to the VNF appliance's Management interface should be allowed from",
 "label.vnf.cidr.list.tooltip": "the CIDR list to forward traffic from to the VNF management interface. Multiple entries must be separated by a single comma character (,). The default value is 0.0.0.0/0.",
-"label.vnf.configure.management": "Configure Firewall and Port Forwarding rules for VNF's management interfaces",
+"label.vnf.configure.management": "Configure network rules for VNF's management interfaces",
 "label.vnf.configure.management.tooltip": "True by default, security group or network rules (source nat and firewall rules) will be configured for VNF management interfaces. False otherwise. Learn what rules are configured at http://docs.cloudstack.apache.org/en/latest/adminguide/networking/vnf_templates_appliances.html#deploying-vnf-appliances",
 "label.vnf.detail.add": "Add VNF detail",
 "label.vnf.detail.remove": "Remove VNF detail",
diff --git a/ui/src/config/section/network.js b/ui/src/config/section/network.js
index 30aae3a8deb3..fbc044ff5006 100644
--- a/ui/src/config/section/network.js
+++ b/ui/src/config/section/network.js
@@ -356,7 +356,10 @@ export default {
       permission: ['listVnfAppliances'],
       resourceType: 'UserVm',
       params: () => {
-        return { details: 'servoff,tmpl,nics', isvnf: true }
+        return {
+          details: 'group,nics,secgrp,tmpl,servoff,diskoff,iso,volume,affgrp,backoff,vnfnics',
+          isvnf: true
+        }
       },
       columns: () => {
         const fields = ['name', 'state', 'ipaddress']
diff --git a/ui/src/views/compute/DeployVnfAppliance.vue b/ui/src/views/compute/DeployVnfAppliance.vue
index 1117413d7102..fec1139ab9b6 100644
--- a/ui/src/views/compute/DeployVnfAppliance.vue
+++ b/ui/src/views/compute/DeployVnfAppliance.vue
@@ -1305,7 +1305,7 @@ export default {
       for (const deviceId of managementDeviceIds) {
         if (this.vnfNicNetworks && this.vnfNicNetworks[deviceId] &&
           ((this.vnfNicNetworks[deviceId].type === 'Isolated' && this.vnfNicNetworks[deviceId].vpcid === undefined) ||
-            (this.vnfNicNetworks[deviceId].type === 'Shared' && this.zone.securitygroupsenabled))) {
+            (this.vnfNicNetworks[deviceId].type === 'Shared' && this.vnfNicNetworks[deviceId].service.filter(svc => svc.name === 'SecurityGroupProvider')))) {
           return true
         }
       }
diff --git a/ui/src/views/network/VnfAppliancesTab.vue b/ui/src/views/network/VnfAppliancesTab.vue
index 0db85323d15d..139516187c46 100644
--- a/ui/src/views/network/VnfAppliancesTab.vue
+++ b/ui/src/views/network/VnfAppliancesTab.vue
@@ -120,7 +120,7 @@ export default {
   methods: {
     fetchData () {
       var params = {
-        details: 'servoff,tmpl,nics',
+        details: 'group,nics,secgrp,tmpl,servoff,diskoff,iso,volume,affgrp,backoff,vnfnics',
         isVnf: true,
         listAll: true
       }

From cd5bb09d0d19e4e01baeaad7a6cbe14ab2db28bc Mon Sep 17 00:00:00 2001
From: Abhisar Sinha <63767682+abh1sar@users.noreply.github.com>
Date: Thu, 22 Jan 2026 15:29:41 +0530
Subject: [PATCH 003/117] Fix potential leaks in executePipedCommands (#12478)

---
 .../java/com/cloud/utils/script/Script.java   | 22 +++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/utils/src/main/java/com/cloud/utils/script/Script.java b/utils/src/main/java/com/cloud/utils/script/Script.java
index 6c62c9106484..ffda782edda2 100644
--- a/utils/src/main/java/com/cloud/utils/script/Script.java
+++ b/utils/src/main/java/com/cloud/utils/script/Script.java
@@ -40,9 +40,11 @@
 import java.util.concurrent.ScheduledFuture;
 import java.util.concurrent.TimeUnit;
 import java.util.concurrent.TimeoutException;
+import java.util.concurrent.atomic.AtomicReference;
 import java.util.stream.Collectors;
 
 import org.apache.cloudstack.utils.security.KeyStoreUtils;
+import org.apache.commons.collections.CollectionUtils;
 import org.apache.commons.io.IOUtils;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
@@ -708,13 +710,31 @@ public static int executeCommandForExitValue(String... command) {
         return executeCommandForExitValue(0, command);
     }
 
+    private static void cleanupProcesses(AtomicReference<List<Process>> processesRef) {
+        List<Process> processes = processesRef.get();
+        if (CollectionUtils.isNotEmpty(processes)) {
+            for (Process process : processes) {
+                if (process == null) {
+                    continue;
+                }
+                LOGGER.trace(String.format("Cleaning up process [%s] from piped commands.", process.pid()));
+                IOUtils.closeQuietly(process.getErrorStream());
+                IOUtils.closeQuietly(process.getOutputStream());
+                IOUtils.closeQuietly(process.getInputStream());
+                process.destroyForcibly();
+            }
+        }
+    }
+
     public static Pair<Integer, String> executePipedCommands(List<String[]> commands, long timeout) {
         if (timeout <= 0) {
             timeout = DEFAULT_TIMEOUT;
         }
+        final AtomicReference<List<Process>> processesRef = new AtomicReference<>();
         Callable<Pair<Integer, String>> commandRunner = () -> {
             List<ProcessBuilder> builders = commands.stream().map(ProcessBuilder::new).collect(Collectors.toList());
             List<Process> processes = ProcessBuilder.startPipeline(builders);
+            processesRef.set(processes);
             Process last = processes.get(processes.size()-1);
             try (BufferedReader reader = new BufferedReader(new InputStreamReader(last.getInputStream()))) {
                 String line;
@@ -741,6 +761,8 @@ public static Pair<Integer, String> executePipedCommands(List<String[]> commands
             result.second(ERR_TIMEOUT);
         } catch (InterruptedException | ExecutionException e) {
             LOGGER.error("Error executing piped commands", e);
+        } finally {
+            cleanupProcesses(processesRef);
         }
         return result;
     }

From d1eb2822d9d5b346840851cf21611345454ed734 Mon Sep 17 00:00:00 2001
From: Vishesh <8760112+vishesh92@users.noreply.github.com>
Date: Thu, 22 Jan 2026 18:59:35 +0530
Subject: [PATCH 004/117] Remove redundant Exceptions from logs for vm
 schedules (#12428)

---
 .../vm/schedule/dao/VMScheduledJobDao.java        |  2 ++
 .../vm/schedule/dao/VMScheduledJobDaoImpl.java    | 15 +++++++++++++++
 .../cloudstack/vm/schedule/VMSchedulerImpl.java   |  8 +++++++-
 3 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/engine/schema/src/main/java/org/apache/cloudstack/vm/schedule/dao/VMScheduledJobDao.java b/engine/schema/src/main/java/org/apache/cloudstack/vm/schedule/dao/VMScheduledJobDao.java
index 7b8c01aae6ad..835ac696f26c 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/vm/schedule/dao/VMScheduledJobDao.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/vm/schedule/dao/VMScheduledJobDao.java
@@ -31,4 +31,6 @@ public interface VMScheduledJobDao extends GenericDao<VMScheduledJobVO, Long> {
     int expungeJobsForSchedules(List<Long> scheduleId, Date dateAfter);
 
     int expungeJobsBefore(Date currentTimestamp);
+
+    VMScheduledJobVO findByScheduleAndTimestamp(long scheduleId, Date scheduledTimestamp);
 }
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/vm/schedule/dao/VMScheduledJobDaoImpl.java b/engine/schema/src/main/java/org/apache/cloudstack/vm/schedule/dao/VMScheduledJobDaoImpl.java
index 50a2b12fd774..2f08a41b92e4 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/vm/schedule/dao/VMScheduledJobDaoImpl.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/vm/schedule/dao/VMScheduledJobDaoImpl.java
@@ -39,6 +39,8 @@ public class VMScheduledJobDaoImpl extends GenericDaoBase<VMScheduledJobVO, Long
 
     private final SearchBuilder<VMScheduledJobVO> expungeJobForScheduleSearch;
 
+    private final SearchBuilder<VMScheduledJobVO> scheduleAndTimestampSearch;
+
     static final String SCHEDULED_TIMESTAMP = "scheduled_timestamp";
 
     static final String VM_SCHEDULE_ID = "vm_schedule_id";
@@ -58,6 +60,11 @@ public VMScheduledJobDaoImpl() {
         expungeJobForScheduleSearch.and(VM_SCHEDULE_ID, expungeJobForScheduleSearch.entity().getVmScheduleId(), SearchCriteria.Op.IN);
         expungeJobForScheduleSearch.and(SCHEDULED_TIMESTAMP, expungeJobForScheduleSearch.entity().getScheduledTime(), SearchCriteria.Op.GTEQ);
         expungeJobForScheduleSearch.done();
+
+        scheduleAndTimestampSearch = createSearchBuilder();
+        scheduleAndTimestampSearch.and(VM_SCHEDULE_ID, scheduleAndTimestampSearch.entity().getVmScheduleId(), SearchCriteria.Op.EQ);
+        scheduleAndTimestampSearch.and(SCHEDULED_TIMESTAMP, scheduleAndTimestampSearch.entity().getScheduledTime(), SearchCriteria.Op.EQ);
+        scheduleAndTimestampSearch.done();
     }
 
     /**
@@ -92,4 +99,12 @@ public int expungeJobsBefore(Date date) {
         sc.setParameters(SCHEDULED_TIMESTAMP, date);
         return expunge(sc);
     }
+
+    @Override
+    public VMScheduledJobVO findByScheduleAndTimestamp(long scheduleId, Date scheduledTimestamp) {
+        SearchCriteria<VMScheduledJobVO> sc = scheduleAndTimestampSearch.create();
+        sc.setParameters(VM_SCHEDULE_ID, scheduleId);
+        sc.setParameters(SCHEDULED_TIMESTAMP, scheduledTimestamp);
+        return findOneBy(sc);
+    }
 }
diff --git a/server/src/main/java/org/apache/cloudstack/vm/schedule/VMSchedulerImpl.java b/server/src/main/java/org/apache/cloudstack/vm/schedule/VMSchedulerImpl.java
index 7410fb1c2655..56d794fa5c2c 100644
--- a/server/src/main/java/org/apache/cloudstack/vm/schedule/VMSchedulerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/vm/schedule/VMSchedulerImpl.java
@@ -162,7 +162,13 @@ public Date scheduleNextJob(VMScheduleVO vmSchedule, Date timestamp) {
         }
 
         Date scheduledDateTime = Date.from(ts.toInstant());
-        VMScheduledJobVO scheduledJob = new VMScheduledJobVO(vmSchedule.getVmId(), vmSchedule.getId(), vmSchedule.getAction(), scheduledDateTime);
+        VMScheduledJobVO scheduledJob = vmScheduledJobDao.findByScheduleAndTimestamp(vmSchedule.getId(), scheduledDateTime);
+        if (scheduledJob != null) {
+            logger.trace("Job is already scheduled for schedule {} at {}", vmSchedule, scheduledDateTime);
+            return scheduledDateTime;
+        }
+
+        scheduledJob = new VMScheduledJobVO(vmSchedule.getVmId(), vmSchedule.getId(), vmSchedule.getAction(), scheduledDateTime);
         try {
             vmScheduledJobDao.persist(scheduledJob);
             ActionEventUtils.onScheduledActionEvent(User.UID_SYSTEM, vm.getAccountId(), actionEventMap.get(vmSchedule.getAction()),

From 6846619a6f1f27bb8fe67be8161e4ca839c6c4fc Mon Sep 17 00:00:00 2001
From: Nicolas Vazquez <nicovazquez90@gmail.com>
Date: Thu, 22 Jan 2026 10:32:46 -0300
Subject: [PATCH 005/117] Fix update network offering domainids size limitation
 (#12431)

---
 .../api/command/admin/network/UpdateNetworkOfferingCmd.java      | 1 +
 1 file changed, 1 insertion(+)

diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/network/UpdateNetworkOfferingCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/network/UpdateNetworkOfferingCmd.java
index 9af10262b2d5..8910966ba2e3 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/network/UpdateNetworkOfferingCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/network/UpdateNetworkOfferingCmd.java
@@ -78,6 +78,7 @@ public class UpdateNetworkOfferingCmd extends BaseCmd {
 
     @Parameter(name = ApiConstants.DOMAIN_ID,
             type = CommandType.STRING,
+            length = 4096,
             description = "The ID of the containing domain(s) as comma separated string, public for public offerings")
     private String domainIds;
 

From 6a9835904cb35983ab88e539fe0a5b4c8ce9931b Mon Sep 17 00:00:00 2001
From: Nicolas Vazquez <nicovazquez90@gmail.com>
Date: Thu, 22 Jan 2026 10:57:46 -0300
Subject: [PATCH 006/117] Fix for zoneids parameters length on updateAPIs
 (#12440)

---
 .../api/command/admin/offering/UpdateDiskOfferingCmd.java        | 1 +
 .../api/command/admin/offering/UpdateServiceOfferingCmd.java     | 1 +
 .../cloudstack/api/command/admin/vpc/UpdateVPCOfferingCmd.java   | 1 +
 3 files changed, 3 insertions(+)

diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/offering/UpdateDiskOfferingCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/offering/UpdateDiskOfferingCmd.java
index 2f07f85f9836..c93b5d41a1c5 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/offering/UpdateDiskOfferingCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/offering/UpdateDiskOfferingCmd.java
@@ -75,6 +75,7 @@ public class UpdateDiskOfferingCmd extends BaseCmd {
     @Parameter(name = ApiConstants.ZONE_ID,
             type = CommandType.STRING,
             description = "The ID of the containing zone(s) as comma separated string, all for all zones offerings",
+            length = 4096,
             since = "4.13")
     private String zoneIds;
 
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/offering/UpdateServiceOfferingCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/offering/UpdateServiceOfferingCmd.java
index 0dc97659b9d8..26c7d87ab45c 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/offering/UpdateServiceOfferingCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/offering/UpdateServiceOfferingCmd.java
@@ -69,6 +69,7 @@ public class UpdateServiceOfferingCmd extends BaseCmd {
     @Parameter(name = ApiConstants.ZONE_ID,
             type = CommandType.STRING,
             description = "The ID of the containing zone(s) as comma separated string, all for all zones offerings",
+            length = 4096,
             since = "4.13")
     private String zoneIds;
 
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/vpc/UpdateVPCOfferingCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/vpc/UpdateVPCOfferingCmd.java
index b8a8077b30b5..44bc88c8daf5 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/vpc/UpdateVPCOfferingCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/vpc/UpdateVPCOfferingCmd.java
@@ -65,6 +65,7 @@ public class UpdateVPCOfferingCmd extends BaseAsyncCmd {
     @Parameter(name = ApiConstants.ZONE_ID,
             type = CommandType.STRING,
             description = "The ID of the containing zone(s) as comma separated string, all for all zones offerings",
+            length = 4096,
             since = "4.13")
     private String zoneIds;
 

From bce3e54a7e46216917acfe2f1ba1e2a9c9b12128 Mon Sep 17 00:00:00 2001
From: Daman Arora <61474540+Damans227@users.noreply.github.com>
Date: Thu, 22 Jan 2026 09:02:46 -0500
Subject: [PATCH 007/117] improve error handling for template upload
 notifications (#12412)

Co-authored-by: Daman Arora <daman.arora@shapeblue.com>
---
 ui/src/utils/plugins.js                         | 13 +++++++------
 ui/src/views/image/RegisterOrUploadTemplate.vue |  6 +-----
 2 files changed, 8 insertions(+), 11 deletions(-)

diff --git a/ui/src/utils/plugins.js b/ui/src/utils/plugins.js
index a07f8178604f..0ec957c87292 100644
--- a/ui/src/utils/plugins.js
+++ b/ui/src/utils/plugins.js
@@ -218,18 +218,19 @@ export const notifierPlugin = {
         if (error.response.status) {
           msg = `${i18n.global.t('message.request.failed')} (${error.response.status})`
         }
-        if (error.message) {
-          desc = error.message
-        }
-        if (error.response.headers && 'x-description' in error.response.headers) {
+        if (error.response.headers?.['x-description']) {
           desc = error.response.headers['x-description']
-        }
-        if (desc === '' && error.response.data) {
+        } else if (error.response.data) {
           const responseKey = _.findKey(error.response.data, 'errortext')
           if (responseKey) {
             desc = error.response.data[responseKey].errortext
+          } else if (typeof error.response.data === 'string') {
+            desc = error.response.data
           }
         }
+        if (!desc && error.message) {
+          desc = error.message
+        }
       }
       let countNotify = store.getters.countNotify
       countNotify++
diff --git a/ui/src/views/image/RegisterOrUploadTemplate.vue b/ui/src/views/image/RegisterOrUploadTemplate.vue
index 76df7b246aa1..3ada9f6fd531 100644
--- a/ui/src/views/image/RegisterOrUploadTemplate.vue
+++ b/ui/src/views/image/RegisterOrUploadTemplate.vue
@@ -638,11 +638,7 @@ export default {
         this.$emit('refresh-data')
         this.closeAction()
       }).catch(e => {
-        this.$notification.error({
-          message: this.$t('message.upload.failed'),
-          description: `${this.$t('message.upload.template.failed.description')} -  ${e}`,
-          duration: 0
-        })
+        this.$notifyError(e)
       })
     },
     fetchCustomHypervisorName () {

From 8db065a14eb41bab0fb3420e66ee96722f1ed6ad Mon Sep 17 00:00:00 2001
From: Manoj Kumar <manojkr.itbhu@gmail.com>
Date: Fri, 23 Jan 2026 21:04:52 +0530
Subject: [PATCH 008/117] limit iso filename to have 251 chars at max (#12430)

---
 .../api/BaseUpdateTemplateOrIsoCmd.java       |  2 +-
 .../api/command/user/iso/RegisterIsoCmd.java  |  2 +-
 .../cloud/upgrade/DatabaseUpgradeChecker.java |  2 +
 .../upgrade/dao/Upgrade42020to42030.java      | 64 +++++++++++++++++++
 .../META-INF/db/schema-42020to42030.sql       | 22 +++++++
 5 files changed, 90 insertions(+), 2 deletions(-)
 create mode 100644 engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42020to42030.java
 create mode 100644 engine/schema/src/main/resources/META-INF/db/schema-42020to42030.sql

diff --git a/api/src/main/java/org/apache/cloudstack/api/BaseUpdateTemplateOrIsoCmd.java b/api/src/main/java/org/apache/cloudstack/api/BaseUpdateTemplateOrIsoCmd.java
index 38cf765dd1aa..696a500860e3 100644
--- a/api/src/main/java/org/apache/cloudstack/api/BaseUpdateTemplateOrIsoCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/BaseUpdateTemplateOrIsoCmd.java
@@ -42,7 +42,7 @@ public abstract class BaseUpdateTemplateOrIsoCmd extends BaseCmd {
     @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = TemplateResponse.class, required = true, description = "The ID of the image file")
     private Long id;
 
-    @Parameter(name = ApiConstants.NAME, type = CommandType.STRING, description = "The name of the image file")
+    @Parameter(name = ApiConstants.NAME, type = CommandType.STRING, length = 251, description = "The name of the image file")
     private String templateName;
 
     @Parameter(name = ApiConstants.OS_TYPE_ID,
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/iso/RegisterIsoCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/iso/RegisterIsoCmd.java
index f499c01ce582..2de0f96f2716 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/iso/RegisterIsoCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/iso/RegisterIsoCmd.java
@@ -70,7 +70,7 @@ public class RegisterIsoCmd extends BaseCmd implements UserCmd {
     @Parameter(name = ApiConstants.IS_EXTRACTABLE, type = CommandType.BOOLEAN, description = "True if the ISO or its derivatives are extractable; default is false")
     private Boolean extractable;
 
-    @Parameter(name = ApiConstants.NAME, type = CommandType.STRING, required = true, description = "The name of the ISO")
+    @Parameter(name = ApiConstants.NAME, type = CommandType.STRING, required = true, length = 251, description = "The name of the ISO")
     private String isoName;
 
     @Parameter(name = ApiConstants.OS_TYPE_ID,
diff --git a/engine/schema/src/main/java/com/cloud/upgrade/DatabaseUpgradeChecker.java b/engine/schema/src/main/java/com/cloud/upgrade/DatabaseUpgradeChecker.java
index afb7a8d69e6d..a8a166fbf275 100644
--- a/engine/schema/src/main/java/com/cloud/upgrade/DatabaseUpgradeChecker.java
+++ b/engine/schema/src/main/java/com/cloud/upgrade/DatabaseUpgradeChecker.java
@@ -33,6 +33,7 @@
 
 import javax.inject.Inject;
 
+import com.cloud.upgrade.dao.Upgrade42020to42030;
 import com.cloud.utils.FileUtil;
 import org.apache.cloudstack.utils.CloudStackVersion;
 import org.apache.commons.lang3.StringUtils;
@@ -236,6 +237,7 @@ public DatabaseUpgradeChecker() {
                 .next("4.19.0.0", new Upgrade41900to41910())
                 .next("4.19.1.0", new Upgrade41910to42000())
                 .next("4.20.0.0", new Upgrade42000to42010())
+                .next("4.20.2.0", new Upgrade42020to42030())
                 .build();
     }
 
diff --git a/engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42020to42030.java b/engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42020to42030.java
new file mode 100644
index 000000000000..68100e164018
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42020to42030.java
@@ -0,0 +1,64 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.upgrade.dao;
+
+import java.io.InputStream;
+import java.sql.Connection;
+
+import com.cloud.utils.exception.CloudRuntimeException;
+
+public class Upgrade42020to42030 extends DbUpgradeAbstractImpl implements DbUpgrade, DbUpgradeSystemVmTemplate {
+
+    @Override
+    public String[] getUpgradableVersionRange() {
+        return new String[]{"4.20.2.0", "4.20.3.0"};
+    }
+
+    @Override
+    public String getUpgradedVersion() {
+        return "4.20.3.0";
+    }
+
+    @Override
+    public boolean supportsRollingUpgrade() {
+        return false;
+    }
+
+    @Override
+    public InputStream[] getPrepareScripts() {
+        final String scriptFile = "META-INF/db/schema-42020to42030.sql";
+        final InputStream script = Thread.currentThread().getContextClassLoader().getResourceAsStream(scriptFile);
+        if (script == null) {
+            throw new CloudRuntimeException("Unable to find " + scriptFile);
+        }
+
+        return new InputStream[] {script};
+    }
+
+    @Override
+    public void performDataMigration(Connection conn) {
+    }
+
+    @Override
+    public InputStream[] getCleanupScripts() {
+        return null;
+    }
+
+    @Override
+    public void updateSystemVmTemplates(Connection conn) {
+    }
+}
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42020to42030.sql b/engine/schema/src/main/resources/META-INF/db/schema-42020to42030.sql
new file mode 100644
index 000000000000..598fdb7adc46
--- /dev/null
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42020to42030.sql
@@ -0,0 +1,22 @@
+-- Licensed to the Apache Software Foundation (ASF) under one
+-- or more contributor license agreements.  See the NOTICE file
+-- distributed with this work for additional information
+-- regarding copyright ownership.  The ASF licenses this file
+-- to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance
+-- with the License.  You may obtain a copy of the License at
+--
+--   http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing,
+-- software distributed under the License is distributed on an
+-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+-- KIND, either express or implied.  See the License for the
+-- specific language governing permissions and limitations
+-- under the License.
+
+--;
+-- Schema upgrade from 4.20.2.0 to 4.20.3.0
+--;
+
+ALTER TABLE `cloud`.`template_store_ref` MODIFY COLUMN `download_url` varchar(2048);

From c8cadcb56e553bdbbc141365061bd3542f43612e Mon Sep 17 00:00:00 2001
From: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
Date: Mon, 26 Jan 2026 14:01:14 +0530
Subject: [PATCH 009/117] NPE fix while deleting storage pool when pool has
 detached volumes (#12451)

* NPE fix while deleting storage pool when pool has detached volumes

* review

* unit tests

* Added log for volumes not attached to any VMs

* update filter, log and test

* updated volume dao method names returning non destroyed volumes

* build fix

---------

Co-authored-by: dahn <daan@onecht.net>
---
 .../java/com/cloud/storage/dao/VolumeDao.java |  6 +-
 .../com/cloud/storage/dao/VolumeDaoImpl.java  |  6 +-
 .../datastore/PrimaryDataStoreImpl.java       |  2 +-
 .../cloudstack/sioc/SiocManagerImpl.java      |  2 +-
 .../driver/DateraPrimaryDataStoreDriver.java  |  2 +-
 .../provider/DateraHostListener.java          |  4 +-
 .../SolidFirePrimaryDataStoreDriver.java      |  2 +-
 .../provider/SolidFireHostListener.java       |  4 +-
 .../StorPoolPrimaryDataStoreDriver.java       |  2 +-
 .../cloud/resource/ResourceManagerImpl.java   |  4 +-
 .../java/com/cloud/server/StatsCollector.java |  2 +-
 .../com/cloud/storage/StorageManagerImpl.java | 16 ++++--
 .../storage/StoragePoolAutomationImpl.java    |  2 +-
 .../java/com/cloud/vm/UserVmManagerImpl.java  |  2 +-
 .../resource/ResourceManagerImplTest.java     | 12 ++--
 .../cloud/storage/StorageManagerImplTest.java | 56 ++++++++++++++++++-
 16 files changed, 90 insertions(+), 34 deletions(-)

diff --git a/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDao.java b/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDao.java
index 4936af3caab5..83f027195185 100644
--- a/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDao.java
+++ b/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDao.java
@@ -48,7 +48,7 @@ public interface VolumeDao extends GenericDao<VolumeVO, Long>, StateDao<Volume.S
 
     List<VolumeVO> findIncludingRemovedByInstanceAndType(long id, Volume.Type vType);
 
-    List<VolumeVO> findByInstanceIdAndPoolId(long instanceId, long poolId);
+    List<VolumeVO> findNonDestroyedVolumesByInstanceIdAndPoolId(long instanceId, long poolId);
 
     List<VolumeVO> findByInstanceIdDestroyed(long vmId);
 
@@ -70,11 +70,11 @@ public interface VolumeDao extends GenericDao<VolumeVO, Long>, StateDao<Volume.S
 
     List<VolumeVO> findCreatedByInstance(long id);
 
-    List<VolumeVO> findByPoolId(long poolId);
+    List<VolumeVO> findNonDestroyedVolumesByPoolId(long poolId);
 
     VolumeVO findByPoolIdName(long poolId, String name);
 
-    List<VolumeVO> findByPoolId(long poolId, Volume.Type volumeType);
+    List<VolumeVO> findNonDestroyedVolumesByPoolId(long poolId, Volume.Type volumeType);
 
     List<VolumeVO> findByPoolIdAndState(long poolid, Volume.State state);
 
diff --git a/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDaoImpl.java b/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDaoImpl.java
index 5ef64b046646..a72b4a258457 100644
--- a/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDaoImpl.java
@@ -135,7 +135,7 @@ public List<VolumeVO> findByInstanceAndDeviceId(long instanceId, long deviceId)
     }
 
     @Override
-    public List<VolumeVO> findByPoolId(long poolId) {
+    public List<VolumeVO> findNonDestroyedVolumesByPoolId(long poolId) {
         SearchCriteria<VolumeVO> sc = AllFieldsSearch.create();
         sc.setParameters("poolId", poolId);
         sc.setParameters("notDestroyed", Volume.State.Destroy, Volume.State.Expunged);
@@ -144,7 +144,7 @@ public List<VolumeVO> findByPoolId(long poolId) {
     }
 
     @Override
-    public List<VolumeVO> findByInstanceIdAndPoolId(long instanceId, long poolId) {
+    public List<VolumeVO> findNonDestroyedVolumesByInstanceIdAndPoolId(long instanceId, long poolId) {
         SearchCriteria<VolumeVO> sc = AllFieldsSearch.create();
         sc.setParameters("instanceId", instanceId);
         sc.setParameters("poolId", poolId);
@@ -161,7 +161,7 @@ public VolumeVO findByPoolIdName(long poolId, String name) {
     }
 
     @Override
-    public List<VolumeVO> findByPoolId(long poolId, Volume.Type volumeType) {
+    public List<VolumeVO> findNonDestroyedVolumesByPoolId(long poolId, Volume.Type volumeType) {
         SearchCriteria<VolumeVO> sc = AllFieldsSearch.create();
         sc.setParameters("poolId", poolId);
         sc.setParameters("notDestroyed", Volume.State.Destroy, Volume.State.Expunged);
diff --git a/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/datastore/PrimaryDataStoreImpl.java b/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/datastore/PrimaryDataStoreImpl.java
index 6a10c26cc0bc..d864bf8cd8c7 100644
--- a/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/datastore/PrimaryDataStoreImpl.java
+++ b/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/datastore/PrimaryDataStoreImpl.java
@@ -126,7 +126,7 @@ public VolumeInfo getVolume(long id) {
 
     @Override
     public List<VolumeInfo> getVolumes() {
-        List<VolumeVO> volumes = volumeDao.findByPoolId(getId());
+        List<VolumeVO> volumes = volumeDao.findNonDestroyedVolumesByPoolId(getId());
         List<VolumeInfo> volumeInfos = new ArrayList<VolumeInfo>();
         for (VolumeVO volume : volumes) {
             volumeInfos.add(VolumeObject.getVolumeObject(this, volume));
diff --git a/plugins/api/vmware-sioc/src/main/java/org/apache/cloudstack/sioc/SiocManagerImpl.java b/plugins/api/vmware-sioc/src/main/java/org/apache/cloudstack/sioc/SiocManagerImpl.java
index e93b8df39e95..b01af35725f9 100644
--- a/plugins/api/vmware-sioc/src/main/java/org/apache/cloudstack/sioc/SiocManagerImpl.java
+++ b/plugins/api/vmware-sioc/src/main/java/org/apache/cloudstack/sioc/SiocManagerImpl.java
@@ -123,7 +123,7 @@ public void updateSiocInfo(long zoneId, long storagePoolId, int sharesPerGB, int
 
             int limitIopsTotal = 0;
 
-            List<VolumeVO> volumes = volumeDao.findByPoolId(storagePoolId, null);
+            List<VolumeVO> volumes = volumeDao.findNonDestroyedVolumesByPoolId(storagePoolId, null);
 
             if (volumes != null && volumes.size() > 0) {
                 Set<Long> instanceIds = new HashSet<>();
diff --git a/plugins/storage/volume/datera/src/main/java/org/apache/cloudstack/storage/datastore/driver/DateraPrimaryDataStoreDriver.java b/plugins/storage/volume/datera/src/main/java/org/apache/cloudstack/storage/datastore/driver/DateraPrimaryDataStoreDriver.java
index dcf84525748f..62393610499a 100644
--- a/plugins/storage/volume/datera/src/main/java/org/apache/cloudstack/storage/datastore/driver/DateraPrimaryDataStoreDriver.java
+++ b/plugins/storage/volume/datera/src/main/java/org/apache/cloudstack/storage/datastore/driver/DateraPrimaryDataStoreDriver.java
@@ -563,7 +563,7 @@ public long getUsedBytes(StoragePool storagePool) {
     private long getUsedBytes(StoragePool storagePool, long volumeIdToIgnore) {
         long usedSpaceBytes = 0;
 
-        List<VolumeVO> lstVolumes = _volumeDao.findByPoolId(storagePool.getId(), null);
+        List<VolumeVO> lstVolumes = _volumeDao.findNonDestroyedVolumesByPoolId(storagePool.getId(), null);
 
         if (lstVolumes != null) {
             for (VolumeVO volume : lstVolumes) {
diff --git a/plugins/storage/volume/datera/src/main/java/org/apache/cloudstack/storage/datastore/provider/DateraHostListener.java b/plugins/storage/volume/datera/src/main/java/org/apache/cloudstack/storage/datastore/provider/DateraHostListener.java
index a0dc23da4861..08bc89737f26 100644
--- a/plugins/storage/volume/datera/src/main/java/org/apache/cloudstack/storage/datastore/provider/DateraHostListener.java
+++ b/plugins/storage/volume/datera/src/main/java/org/apache/cloudstack/storage/datastore/provider/DateraHostListener.java
@@ -247,7 +247,7 @@ private List<String> getStoragePaths(long clusterId, long storagePoolId) {
         List<String> storagePaths = new ArrayList<>();
 
         // If you do not pass in null for the second parameter, you only get back applicable ROOT disks.
-        List<VolumeVO> volumes = _volumeDao.findByPoolId(storagePoolId, null);
+        List<VolumeVO> volumes = _volumeDao.findNonDestroyedVolumesByPoolId(storagePoolId, null);
 
         if (volumes != null) {
             for (VolumeVO volume : volumes) {
@@ -317,7 +317,7 @@ private List<Map<String, String>> getTargets(long clusterId, long storagePoolId)
         StoragePoolVO storagePool = _storagePoolDao.findById(storagePoolId);
 
         // If you do not pass in null for the second parameter, you only get back applicable ROOT disks.
-        List<VolumeVO> volumes = _volumeDao.findByPoolId(storagePoolId, null);
+        List<VolumeVO> volumes = _volumeDao.findNonDestroyedVolumesByPoolId(storagePoolId, null);
 
         if (volumes != null) {
             for (VolumeVO volume : volumes) {
diff --git a/plugins/storage/volume/solidfire/src/main/java/org/apache/cloudstack/storage/datastore/driver/SolidFirePrimaryDataStoreDriver.java b/plugins/storage/volume/solidfire/src/main/java/org/apache/cloudstack/storage/datastore/driver/SolidFirePrimaryDataStoreDriver.java
index 6cc76d99d9ee..1e927e20168e 100644
--- a/plugins/storage/volume/solidfire/src/main/java/org/apache/cloudstack/storage/datastore/driver/SolidFirePrimaryDataStoreDriver.java
+++ b/plugins/storage/volume/solidfire/src/main/java/org/apache/cloudstack/storage/datastore/driver/SolidFirePrimaryDataStoreDriver.java
@@ -433,7 +433,7 @@ private long getUsedBytes(StoragePool storagePool, long volumeIdToIgnore) {
     public long getUsedIops(StoragePool storagePool) {
         long usedIops = 0;
 
-        List<VolumeVO> volumes = volumeDao.findByPoolId(storagePool.getId(), null);
+        List<VolumeVO> volumes = volumeDao.findNonDestroyedVolumesByPoolId(storagePool.getId(), null);
 
         if (volumes != null) {
             for (VolumeVO volume : volumes) {
diff --git a/plugins/storage/volume/solidfire/src/main/java/org/apache/cloudstack/storage/datastore/provider/SolidFireHostListener.java b/plugins/storage/volume/solidfire/src/main/java/org/apache/cloudstack/storage/datastore/provider/SolidFireHostListener.java
index 052191128f1c..c961c9267395 100644
--- a/plugins/storage/volume/solidfire/src/main/java/org/apache/cloudstack/storage/datastore/provider/SolidFireHostListener.java
+++ b/plugins/storage/volume/solidfire/src/main/java/org/apache/cloudstack/storage/datastore/provider/SolidFireHostListener.java
@@ -199,7 +199,7 @@ private List<String> getStoragePaths(long clusterId, long storagePoolId) {
         List<String> storagePaths = new ArrayList<>();
 
         // If you do not pass in null for the second parameter, you only get back applicable ROOT disks.
-        List<VolumeVO> volumes = volumeDao.findByPoolId(storagePoolId, null);
+        List<VolumeVO> volumes = volumeDao.findNonDestroyedVolumesByPoolId(storagePoolId, null);
 
         if (volumes != null) {
             for (VolumeVO volume : volumes) {
@@ -230,7 +230,7 @@ private List<Map<String, String>> getTargets(long clusterId, long storagePoolId)
         StoragePoolVO storagePool = storagePoolDao.findById(storagePoolId);
 
         // If you do not pass in null for the second parameter, you only get back applicable ROOT disks.
-        List<VolumeVO> volumes = volumeDao.findByPoolId(storagePoolId, null);
+        List<VolumeVO> volumes = volumeDao.findNonDestroyedVolumesByPoolId(storagePoolId, null);
 
         if (volumes != null) {
             for (VolumeVO volume : volumes) {
diff --git a/plugins/storage/volume/storpool/src/main/java/org/apache/cloudstack/storage/datastore/driver/StorPoolPrimaryDataStoreDriver.java b/plugins/storage/volume/storpool/src/main/java/org/apache/cloudstack/storage/datastore/driver/StorPoolPrimaryDataStoreDriver.java
index 6ca67cb59235..619beee3ec6a 100644
--- a/plugins/storage/volume/storpool/src/main/java/org/apache/cloudstack/storage/datastore/driver/StorPoolPrimaryDataStoreDriver.java
+++ b/plugins/storage/volume/storpool/src/main/java/org/apache/cloudstack/storage/datastore/driver/StorPoolPrimaryDataStoreDriver.java
@@ -1276,7 +1276,7 @@ public Pair<Long, Long> getVolumeStats(StoragePool storagePool, String volumeId)
                 return volumeStats;
             }
         } else {
-            List<VolumeVO> volumes = volumeDao.findByPoolId(storagePool.getId());
+            List<VolumeVO> volumes = volumeDao.findNonDestroyedVolumesByPoolId(storagePool.getId());
             for (VolumeVO volume : volumes) {
                 if (volume.getPath() != null && volume.getPath().equals(volumeId)) {
                     long size = volume.getSize();
diff --git a/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java b/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
index e62e89eb0efc..a77ecfcb7fe1 100755
--- a/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
+++ b/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
@@ -1026,8 +1026,8 @@ private void addVolumesToList(List<VolumeVO> volumes, List<VolumeVO> volumesToAd
     }
 
     protected void destroyLocalStoragePoolVolumes(long poolId) {
-        List<VolumeVO> rootDisks = volumeDao.findByPoolId(poolId);
-        List<VolumeVO> dataVolumes = volumeDao.findByPoolId(poolId, Volume.Type.DATADISK);
+        List<VolumeVO> rootDisks = volumeDao.findNonDestroyedVolumesByPoolId(poolId);
+        List<VolumeVO> dataVolumes = volumeDao.findNonDestroyedVolumesByPoolId(poolId, Volume.Type.DATADISK);
 
         List<VolumeVO> volumes = new ArrayList<>();
         addVolumesToList(volumes, rootDisks);
diff --git a/server/src/main/java/com/cloud/server/StatsCollector.java b/server/src/main/java/com/cloud/server/StatsCollector.java
index 7e83d452bb9f..1e0138f7cf90 100644
--- a/server/src/main/java/com/cloud/server/StatsCollector.java
+++ b/server/src/main/java/com/cloud/server/StatsCollector.java
@@ -1646,7 +1646,7 @@ protected void runInContext() {
                 List<StoragePoolVO> pools = _storagePoolDao.listAll();
 
                 for (StoragePoolVO pool : pools) {
-                    List<VolumeVO> volumes = _volsDao.findByPoolId(pool.getId(), null);
+                    List<VolumeVO> volumes = _volsDao.findNonDestroyedVolumesByPoolId(pool.getId(), null);
                     for (VolumeVO volume : volumes) {
                         if (!List.of(ImageFormat.QCOW2, ImageFormat.VHD, ImageFormat.OVA, ImageFormat.RAW).contains(volume.getFormat()) &&
                             !List.of(Storage.StoragePoolType.PowerFlex, Storage.StoragePoolType.FiberChannel).contains(pool.getPoolType())) {
diff --git a/server/src/main/java/com/cloud/storage/StorageManagerImpl.java b/server/src/main/java/com/cloud/storage/StorageManagerImpl.java
index 8392c85527d0..13b7fbb00c20 100644
--- a/server/src/main/java/com/cloud/storage/StorageManagerImpl.java
+++ b/server/src/main/java/com/cloud/storage/StorageManagerImpl.java
@@ -1558,17 +1558,21 @@ private boolean deleteDataStoreInternal(StoragePoolVO sPool, boolean forced) {
 
     protected String getStoragePoolNonDestroyedVolumesLog(long storagePoolId) {
         StringBuilder sb = new StringBuilder();
-        List<VolumeVO> nonDestroyedVols = volumeDao.findByPoolId(storagePoolId, null);
+        List<VolumeVO> nonDestroyedVols = volumeDao.findNonDestroyedVolumesByPoolId(storagePoolId, null);
         VMInstanceVO volInstance;
         List<String> logMessageInfo = new ArrayList<>();
 
         sb.append("[");
         for (VolumeVO vol : nonDestroyedVols) {
-            volInstance = _vmInstanceDao.findById(vol.getInstanceId());
-            if (volInstance != null) {
-                logMessageInfo.add(String.format("Volume [%s] (attached to VM [%s])", vol.getUuid(), volInstance.getUuid()));
+            if (vol.getInstanceId() != null) {
+                volInstance = _vmInstanceDao.findById(vol.getInstanceId());
+                if (volInstance != null) {
+                    logMessageInfo.add(String.format("Volume [%s] (attached to VM [%s])", vol.getUuid(), volInstance.getUuid()));
+                } else {
+                    logMessageInfo.add(String.format("Volume [%s] (attached VM with ID [%d] doesn't exists)", vol.getUuid(), vol.getInstanceId()));
+                }
             } else {
-                logMessageInfo.add(String.format("Volume [%s]", vol.getUuid()));
+                logMessageInfo.add(String.format("Volume [%s] (not attached to any VM)", vol.getUuid()));
             }
         }
         sb.append(String.join(", ", logMessageInfo));
@@ -2640,7 +2644,7 @@ private void handleRemoveChildStoragePoolFromDatastoreCluster(Set<String> childD
 
         for (String childDatastoreUUID : childDatastoreUUIDs) {
             StoragePoolVO dataStoreVO = _storagePoolDao.findPoolByUUID(childDatastoreUUID);
-            List<VolumeVO> allVolumes = volumeDao.findByPoolId(dataStoreVO.getId());
+            List<VolumeVO> allVolumes = volumeDao.findNonDestroyedVolumesByPoolId(dataStoreVO.getId());
             allVolumes.removeIf(volumeVO -> volumeVO.getInstanceId() == null);
             allVolumes.removeIf(volumeVO -> volumeVO.getState() != Volume.State.Ready);
             for (VolumeVO volume : allVolumes) {
diff --git a/server/src/main/java/com/cloud/storage/StoragePoolAutomationImpl.java b/server/src/main/java/com/cloud/storage/StoragePoolAutomationImpl.java
index 612582640f42..667af5a876f1 100644
--- a/server/src/main/java/com/cloud/storage/StoragePoolAutomationImpl.java
+++ b/server/src/main/java/com/cloud/storage/StoragePoolAutomationImpl.java
@@ -91,7 +91,7 @@ public boolean maintain(DataStore store) {
                 boolean restart = !CollectionUtils.isEmpty(upPools);
 
                 // 2. Get a list of all the ROOT volumes within this storage pool
-                List<VolumeVO> allVolumes = volumeDao.findByPoolId(pool.getId());
+                List<VolumeVO> allVolumes = volumeDao.findNonDestroyedVolumesByPoolId(pool.getId());
                 // 3. Enqueue to the work queue
                 enqueueMigrationsForVolumes(allVolumes, pool);
                 // 4. Process the queue
diff --git a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
index b00358caaa93..3e045f5a9057 100644
--- a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
+++ b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
@@ -2261,7 +2261,7 @@ public HashMap<String, VolumeStatsEntry> getVolumeStatistics(long clusterId, Str
     private List<String> getVolumesByHost(HostVO host, StoragePool pool){
         List<VMInstanceVO> vmsPerHost = _vmInstanceDao.listByHostId(host.getId());
         return vmsPerHost.stream()
-                .flatMap(vm -> _volsDao.findByInstanceIdAndPoolId(vm.getId(),pool.getId()).stream().map(vol ->
+                .flatMap(vm -> _volsDao.findNonDestroyedVolumesByInstanceIdAndPoolId(vm.getId(),pool.getId()).stream().map(vol ->
                 vol.getState() == Volume.State.Ready ? (vol.getFormat() == ImageFormat.OVA ? vol.getChainInfo() : vol.getPath()) : null).filter(Objects::nonNull))
                 .collect(Collectors.toList());
     }
diff --git a/server/src/test/java/com/cloud/resource/ResourceManagerImplTest.java b/server/src/test/java/com/cloud/resource/ResourceManagerImplTest.java
index 414d41145f7b..5b7353bded6c 100644
--- a/server/src/test/java/com/cloud/resource/ResourceManagerImplTest.java
+++ b/server/src/test/java/com/cloud/resource/ResourceManagerImplTest.java
@@ -198,8 +198,8 @@ public void setup() throws Exception {
 
         rootDisks = Arrays.asList(rootDisk1, rootDisk2);
         dataDisks = Collections.singletonList(dataDisk);
-        when(volumeDao.findByPoolId(poolId)).thenReturn(rootDisks);
-        when(volumeDao.findByPoolId(poolId, Volume.Type.DATADISK)).thenReturn(dataDisks);
+        when(volumeDao.findNonDestroyedVolumesByPoolId(poolId)).thenReturn(rootDisks);
+        when(volumeDao.findNonDestroyedVolumesByPoolId(poolId, Volume.Type.DATADISK)).thenReturn(dataDisks);
     }
 
     @After
@@ -564,22 +564,22 @@ public void testDestroyLocalStoragePoolVolumesBothRootDisksAndDataDisks() {
 
     @Test
     public void testDestroyLocalStoragePoolVolumesOnlyRootDisks() {
-        when(volumeDao.findByPoolId(poolId, Volume.Type.DATADISK)).thenReturn(null);
+        when(volumeDao.findNonDestroyedVolumesByPoolId(poolId, Volume.Type.DATADISK)).thenReturn(null);
         resourceManager.destroyLocalStoragePoolVolumes(poolId);
         verify(volumeDao, times(rootDisks.size())).updateAndRemoveVolume(any(VolumeVO.class));
     }
 
     @Test
     public void testDestroyLocalStoragePoolVolumesOnlyDataDisks() {
-        when(volumeDao.findByPoolId(poolId)).thenReturn(null);
+        when(volumeDao.findNonDestroyedVolumesByPoolId(poolId)).thenReturn(null);
         resourceManager.destroyLocalStoragePoolVolumes(poolId);
         verify(volumeDao, times(dataDisks.size())).updateAndRemoveVolume(any(VolumeVO.class));
     }
 
     @Test
     public void testDestroyLocalStoragePoolVolumesNoDisks() {
-        when(volumeDao.findByPoolId(poolId)).thenReturn(null);
-        when(volumeDao.findByPoolId(poolId, Volume.Type.DATADISK)).thenReturn(null);
+        when(volumeDao.findNonDestroyedVolumesByPoolId(poolId)).thenReturn(null);
+        when(volumeDao.findNonDestroyedVolumesByPoolId(poolId, Volume.Type.DATADISK)).thenReturn(null);
         resourceManager.destroyLocalStoragePoolVolumes(poolId);
         verify(volumeDao, never()).updateAndRemoveVolume(any(VolumeVO.class));
     }
diff --git a/server/src/test/java/com/cloud/storage/StorageManagerImplTest.java b/server/src/test/java/com/cloud/storage/StorageManagerImplTest.java
index 4a28e044d9c5..5f02c89339a0 100644
--- a/server/src/test/java/com/cloud/storage/StorageManagerImplTest.java
+++ b/server/src/test/java/com/cloud/storage/StorageManagerImplTest.java
@@ -531,7 +531,7 @@ public void testEnableDefaultDatastoreDownloadRedirectionForExistingInstallation
     }
 
     @Test
-    public void getStoragePoolNonDestroyedVolumesLogTestNonDestroyedVolumesReturnLog() {
+    public void getStoragePoolNonDestroyedVolumesLogTestNonDestroyedVolumes_VMAttachedLogs() {
         Mockito.doReturn(1L).when(storagePoolVOMock).getId();
         Mockito.doReturn(1L).when(volume1VOMock).getInstanceId();
         Mockito.doReturn("786633d1-a942-4374-9d56-322dd4b0d202").when(volume1VOMock).getUuid();
@@ -539,7 +539,7 @@ public void getStoragePoolNonDestroyedVolumesLogTestNonDestroyedVolumesReturnLog
         Mockito.doReturn("ffb46333-e983-4c21-b5f0-51c5877a3805").when(volume2VOMock).getUuid();
         Mockito.doReturn("58760044-928f-4c4e-9fef-d0e48423595e").when(vmInstanceVOMock).getUuid();
 
-        Mockito.when(_volumeDao.findByPoolId(storagePoolVOMock.getId(), null)).thenReturn(List.of(volume1VOMock, volume2VOMock));
+        Mockito.when(_volumeDao.findNonDestroyedVolumesByPoolId(storagePoolVOMock.getId(), null)).thenReturn(List.of(volume1VOMock, volume2VOMock));
         Mockito.doReturn(vmInstanceVOMock).when(vmInstanceDao).findById(Mockito.anyLong());
 
         String log = storageManagerImpl.getStoragePoolNonDestroyedVolumesLog(storagePoolVOMock.getId());
@@ -548,6 +548,58 @@ public void getStoragePoolNonDestroyedVolumesLogTestNonDestroyedVolumesReturnLog
         Assert.assertEquals(expected, log);
     }
 
+    @Test
+    public void getStoragePoolNonDestroyedVolumesLogTestNonDestroyedVolumes_VMLogForOneVolume() {
+        Mockito.doReturn(1L).when(storagePoolVOMock).getId();
+        Mockito.doReturn(null).when(volume1VOMock).getInstanceId();
+        Mockito.doReturn("786633d1-a942-4374-9d56-322dd4b0d202").when(volume1VOMock).getUuid();
+        Mockito.doReturn(1L).when(volume2VOMock).getInstanceId();
+        Mockito.doReturn("ffb46333-e983-4c21-b5f0-51c5877a3805").when(volume2VOMock).getUuid();
+        Mockito.doReturn("58760044-928f-4c4e-9fef-d0e48423595e").when(vmInstanceVOMock).getUuid();
+
+        Mockito.when(_volumeDao.findNonDestroyedVolumesByPoolId(storagePoolVOMock.getId(), null)).thenReturn(List.of(volume1VOMock, volume2VOMock));
+        Mockito.doReturn(vmInstanceVOMock).when(vmInstanceDao).findById(Mockito.anyLong());
+
+        String log = storageManagerImpl.getStoragePoolNonDestroyedVolumesLog(storagePoolVOMock.getId());
+        String expected = String.format("[Volume [%s] (not attached to any VM), Volume [%s] (attached to VM [%s])]", volume1VOMock.getUuid(), volume2VOMock.getUuid(), vmInstanceVOMock.getUuid());
+
+        Assert.assertEquals(expected, log);
+    }
+
+    @Test
+    public void getStoragePoolNonDestroyedVolumesLogTestNonDestroyedVolumes_NotAttachedLogs() {
+        Mockito.doReturn(1L).when(storagePoolVOMock).getId();
+        Mockito.doReturn(null).when(volume1VOMock).getInstanceId();
+        Mockito.doReturn("786633d1-a942-4374-9d56-322dd4b0d202").when(volume1VOMock).getUuid();
+        Mockito.doReturn(null).when(volume2VOMock).getInstanceId();
+        Mockito.doReturn("ffb46333-e983-4c21-b5f0-51c5877a3805").when(volume2VOMock).getUuid();
+
+        Mockito.when(_volumeDao.findNonDestroyedVolumesByPoolId(storagePoolVOMock.getId(), null)).thenReturn(List.of(volume1VOMock, volume2VOMock));
+
+        String log = storageManagerImpl.getStoragePoolNonDestroyedVolumesLog(storagePoolVOMock.getId());
+        String expected = String.format("[Volume [%s] (not attached to any VM), Volume [%s] (not attached to any VM)]", volume1VOMock.getUuid(), volume2VOMock.getUuid());
+
+        Assert.assertEquals(expected, log);
+    }
+
+    @Test
+    public void getStoragePoolNonDestroyedVolumesLogTestNonDestroyedVolumes_VMNotExistsLog() {
+        Mockito.doReturn(1L).when(storagePoolVOMock).getId();
+        Mockito.doReturn(1L).when(volume1VOMock).getInstanceId();
+        Mockito.doReturn("786633d1-a942-4374-9d56-322dd4b0d202").when(volume1VOMock).getUuid();
+        Mockito.doReturn(1L).when(volume2VOMock).getInstanceId();
+        Mockito.doReturn("ffb46333-e983-4c21-b5f0-51c5877a3805").when(volume2VOMock).getUuid();
+
+        Mockito.when(_volumeDao.findNonDestroyedVolumesByPoolId(storagePoolVOMock.getId(), null)).thenReturn(List.of(volume1VOMock, volume2VOMock));
+        Mockito.doReturn(null).when(vmInstanceDao).findById(Mockito.anyLong());
+
+        String log = storageManagerImpl.getStoragePoolNonDestroyedVolumesLog(storagePoolVOMock.getId());
+        String expected = String.format("[Volume [%s] (attached VM with ID [%d] doesn't exists), Volume [%s] (attached VM with ID [%d] doesn't exists)]",
+                volume1VOMock.getUuid(), volume1VOMock.getInstanceId(), volume2VOMock.getUuid(), volume2VOMock.getInstanceId());
+
+        Assert.assertEquals(expected, log);
+    }
+
     private ChangeStoragePoolScopeCmd mockChangeStoragePooolScopeCmd(String newScope) {
         ChangeStoragePoolScopeCmd cmd = new ChangeStoragePoolScopeCmd();
         ReflectionTestUtils.setField(cmd, "id", 1L);

From 4adb7195701f2b28b86456f739ad59ec9f369abf Mon Sep 17 00:00:00 2001
From: Pearl Dsilva <pearl1594@gmail.com>
Date: Mon, 26 Jan 2026 04:18:12 -0500
Subject: [PATCH 010/117] Allow modification of user vm details if
 user.vm.readonly.details is empty (#10456)

---
 .../apache/cloudstack/query/QueryService.java |  2 +-
 .../framework/config/ConfigKey.java           | 28 +++++++++++++++++--
 2 files changed, 27 insertions(+), 3 deletions(-)

diff --git a/api/src/main/java/org/apache/cloudstack/query/QueryService.java b/api/src/main/java/org/apache/cloudstack/query/QueryService.java
index 828f9d5e064a..5181ebe2b763 100644
--- a/api/src/main/java/org/apache/cloudstack/query/QueryService.java
+++ b/api/src/main/java/org/apache/cloudstack/query/QueryService.java
@@ -118,7 +118,7 @@ public interface QueryService {
 
     ConfigKey<String> UserVMReadOnlyDetails = new ConfigKey<>(String.class,
     "user.vm.readonly.details", "Advanced", "dataDiskController, rootDiskController",
-            "List of read-only VM settings/details as comma separated string", true, ConfigKey.Scope.Global, null, null, null, null, null, ConfigKey.Kind.CSV, null);
+            "List of read-only VM settings/details as comma separated string", true, ConfigKey.Scope.Global, null, null, null, null, null, ConfigKey.Kind.CSV, null, "");
 
     ConfigKey<Boolean> SortKeyAscending = new ConfigKey<>("Advanced", Boolean.class, "sortkey.algorithm", "true",
             "Sort algorithm - ascending or descending - to use. For entities that use sort key(template, disk offering, service offering, " +
diff --git a/framework/config/src/main/java/org/apache/cloudstack/framework/config/ConfigKey.java b/framework/config/src/main/java/org/apache/cloudstack/framework/config/ConfigKey.java
index 00cf56345c8d..27b04ddf8937 100644
--- a/framework/config/src/main/java/org/apache/cloudstack/framework/config/ConfigKey.java
+++ b/framework/config/src/main/java/org/apache/cloudstack/framework/config/ConfigKey.java
@@ -120,10 +120,18 @@ public String toString() {
 
     static ConfigDepotImpl s_depot = null;
 
-    static public void init(ConfigDepotImpl depot) {
+    private String _defaultValueIfEmpty = null;
+
+    public static void init(ConfigDepotImpl depot) {
         s_depot = depot;
     }
 
+    public ConfigKey(Class<T> type, String name, String category, String defaultValue, String description, boolean isDynamic, Scope scope, T multiplier,
+                     String displayText, String parent, Ternary<String, String, Long> group, Pair<String, Long> subGroup, Kind kind, String options, String defaultValueIfEmpty) {
+        this(type, name, category, defaultValue, description, isDynamic, scope, multiplier, displayText, parent, group, subGroup, kind, options);
+        this._defaultValueIfEmpty = defaultValueIfEmpty;
+    }
+
     public ConfigKey(String category, Class<T> type, String name, String defaultValue, String description, boolean isDynamic, Scope scope) {
         this(type, name, category, defaultValue, description, isDynamic, scope, null);
     }
@@ -216,7 +224,19 @@ public boolean isSameKeyAs(Object obj) {
     public T value() {
         if (_value == null || isDynamic()) {
             String value = s_depot != null ? s_depot.getConfigStringValue(_name, Scope.Global, null) : null;
-            _value = valueOf((value == null) ? defaultValue() : value);
+
+            String effective;
+            if (value != null) {
+                if (value.isEmpty() && _defaultValueIfEmpty != null) {
+                    effective = _defaultValueIfEmpty;
+                } else {
+                    effective = value;
+                }
+            } else {
+                effective = _defaultValueIfEmpty != null ? _defaultValueIfEmpty : defaultValue();
+            }
+
+            _value = valueOf(effective);
         }
 
         return _value;
@@ -231,6 +251,10 @@ protected T valueInScope(Scope scope, Long id) {
         if (value == null) {
             return value();
         }
+
+        if (value.isEmpty() && _defaultValueIfEmpty != null) {
+            return valueOf(_defaultValueIfEmpty);
+        }
         return valueOf(value);
     }
 

From 0958dfc13864315e83ae906bf4f90328ccd1557c Mon Sep 17 00:00:00 2001
From: Artem Sidorenko <artem@posteo.de>
Date: Mon, 26 Jan 2026 10:21:47 +0100
Subject: [PATCH 011/117] Fix: proper permissions for systemvm template
 registrations on hardened systems (#12098)

Related to https://github.com/apache/cloudstack/issues/10029#issuecomment-2531599607

We have umask 0077, so cloud-install-sys-tmplt is creating by default paths like below

```
$ ls -l /mnt/secondary/template/tmpl/
total 16
drwx------. 3 root root 4096 Nov 19 13:58 1
drwxrwxrwx. 7 root root 4096 Oct 31 09:42 2
drwxrwxrwx. 3 root root 4096 Oct 30 15:59 4
drwxr-xr-x. 2 root root 4096 Oct 31 10:21 5
$ ls -l /mnt/secondary/template/tmpl/1/
total 4
drwx------. 2 root root 4096 Nov 19 13:59 3
$ ls -l /mnt/secondary/template/tmpl/1/3/
total 549848
-rw-------. 1 root root 563032576 Nov 19 13:59 d23a1e19-c563-4f69-85ca-8721cf02082c.qcow2
-rw-------. 1 root root       287 Nov 19 13:59 template.properties
```

This results to the permissions problems later on, when trying to access the image

Signed-off-by: Artem Sidorenko <artem.sidorenko@telekom.de>
---
 scripts/storage/secondary/cloud-install-sys-tmplt | 1 +
 scripts/storage/secondary/setup-sysvm-tmplt       | 1 +
 2 files changed, 2 insertions(+)

diff --git a/scripts/storage/secondary/cloud-install-sys-tmplt b/scripts/storage/secondary/cloud-install-sys-tmplt
index ad976c502c69..fc09dc968fff 100755
--- a/scripts/storage/secondary/cloud-install-sys-tmplt
+++ b/scripts/storage/secondary/cloud-install-sys-tmplt
@@ -44,6 +44,7 @@ failed() {
 }
 
 #set -x
+umask 0022 # ensure we have the proper permissions even on hardened deployments
 mflag=
 fflag=
 ext="vhd"
diff --git a/scripts/storage/secondary/setup-sysvm-tmplt b/scripts/storage/secondary/setup-sysvm-tmplt
index 06f0586fe342..63006cc4e4c2 100755
--- a/scripts/storage/secondary/setup-sysvm-tmplt
+++ b/scripts/storage/secondary/setup-sysvm-tmplt
@@ -19,6 +19,7 @@
 
 # Usage: e.g. failed $? "this is an error"
 set -x
+umask 0022 # ensure we have the proper permissions even on hardened deployments
 
 failed() {
   local returnval=$1

From d010e9fcf29822a312618eee5d7a4c8f0eb69d2e Mon Sep 17 00:00:00 2001
From: Manoj Kumar <manojkr.itbhu@gmail.com>
Date: Mon, 26 Jan 2026 15:03:30 +0530
Subject: [PATCH 012/117] Notify user if template upgrade is not required
 (#12483)

---
 .../cloud/network/router/VirtualNetworkApplianceManagerImpl.java | 1 +
 1 file changed, 1 insertion(+)

diff --git a/server/src/main/java/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java b/server/src/main/java/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
index e171b68399bf..7d0a4f208386 100644
--- a/server/src/main/java/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
@@ -3358,6 +3358,7 @@ private List<Long> rebootRouters(final List<DomainRouterVO> routers) {
                 jobIds.add(jobId);
             } else {
                 logger.debug("Router: {} is already at the latest version. No upgrade required", router);
+                throw new CloudRuntimeException("Router is already at the latest version. No upgrade required");
             }
         }
         return jobIds;

From 315cd52fd1ac7fe461b9ceca6651cddca0382087 Mon Sep 17 00:00:00 2001
From: Rohit Yadav <rohit.yadav@shapeblue.com>
Date: Mon, 26 Jan 2026 16:23:47 +0530
Subject: [PATCH 013/117] snapshot: fix listSnapshots for volume which got
 delete and whose storage pool got deleted (#12433)

This fixes the case when the storage pool is removed as well the KVM
host and the subsequent volumes on the host. When that happened, listing
snapshots (for recovery purposes) cause NPE as the pool_id was null, but
last_pool_id for the related destroyed volume wasn't null. This adds a
fallback logic.

Signed-off-by: Rohit Yadav <rohit@yadav.cloud>
---
 .../storage/snapshot/StorageSystemSnapshotStrategy.java         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/snapshot/StorageSystemSnapshotStrategy.java b/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/snapshot/StorageSystemSnapshotStrategy.java
index a19397d03e32..560bb4b2fc12 100644
--- a/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/snapshot/StorageSystemSnapshotStrategy.java
+++ b/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/snapshot/StorageSystemSnapshotStrategy.java
@@ -951,7 +951,7 @@ public StrategyPriority canHandle(Snapshot snapshot, Long zoneId, SnapshotOperat
 
         VolumeVO volumeVO = volumeDao.findByIdIncludingRemoved(volumeId);
 
-        long volumeStoragePoolId = volumeVO.getPoolId();
+        long volumeStoragePoolId = (volumeVO.getPoolId() != null ? volumeVO.getPoolId() : volumeVO.getLastPoolId());
 
         if (SnapshotOperation.REVERT.equals(op)) {
             boolean baseVolumeExists = volumeVO.getRemoved() == null;

From 63bdc2b990314f5443961a24b7522397a65bc81f Mon Sep 17 00:00:00 2001
From: Manoj Kumar <manojkr.itbhu@gmail.com>
Date: Mon, 26 Jan 2026 16:25:55 +0530
Subject: [PATCH 014/117] Add log for null templateVO (#12406)

---
 .../cloudstack/storage/image/TemplateDataFactoryImpl.java      | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/engine/storage/image/src/main/java/org/apache/cloudstack/storage/image/TemplateDataFactoryImpl.java b/engine/storage/image/src/main/java/org/apache/cloudstack/storage/image/TemplateDataFactoryImpl.java
index c6430bcf9f93..3e1504beb3ad 100644
--- a/engine/storage/image/src/main/java/org/apache/cloudstack/storage/image/TemplateDataFactoryImpl.java
+++ b/engine/storage/image/src/main/java/org/apache/cloudstack/storage/image/TemplateDataFactoryImpl.java
@@ -296,6 +296,9 @@ public TemplateInfo getReadyBypassedTemplateOnManagedStorage(long templateId, Te
     @Override
     public boolean isTemplateMarkedForDirectDownload(long templateId) {
         VMTemplateVO templateVO = imageDataDao.findById(templateId);
+        if (templateVO == null) {
+            throw new CloudRuntimeException(String.format("Template not found with ID: %s", templateId));
+        }
         return templateVO.isDirectDownload();
     }
 }

From 097c3a018bae6faf6cdac2db09c56507b980fa4f Mon Sep 17 00:00:00 2001
From: Wei Zhou <weizhou@apache.org>
Date: Mon, 26 Jan 2026 11:56:14 +0100
Subject: [PATCH 015/117] ConfigDrive: use file absolute path instead of
 canonical path to create ISO (#11623)

* ConfigDrive: use file absolute path instead of canonical path to create ISO

* el8: add xorrisofs as option
---
 .../storage/configdrive/ConfigDriveBuilder.java      |  4 ++--
 .../storage/configdrive/ConfigDriveBuilderTest.java  | 12 ++++++------
 packaging/el8/cloud.spec                             |  2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/engine/storage/configdrive/src/main/java/org/apache/cloudstack/storage/configdrive/ConfigDriveBuilder.java b/engine/storage/configdrive/src/main/java/org/apache/cloudstack/storage/configdrive/ConfigDriveBuilder.java
index 0b81a25b1cd0..15febbe972c4 100644
--- a/engine/storage/configdrive/src/main/java/org/apache/cloudstack/storage/configdrive/ConfigDriveBuilder.java
+++ b/engine/storage/configdrive/src/main/java/org/apache/cloudstack/storage/configdrive/ConfigDriveBuilder.java
@@ -231,9 +231,9 @@ static String getProgramToGenerateIso() throws IOException {
             throw new CloudRuntimeException("Cannot create ISO for config drive using any know tool. Known paths [/usr/bin/genisoimage, /usr/bin/mkisofs, /usr/local/bin/mkisofs]");
         }
         if (!isoCreator.canExecute()) {
-            throw new CloudRuntimeException("Cannot create ISO for config drive using: " + isoCreator.getCanonicalPath());
+            throw new CloudRuntimeException("Cannot create ISO for config drive using: " + isoCreator.getAbsolutePath());
         }
-        return isoCreator.getCanonicalPath();
+        return isoCreator.getAbsolutePath();
     }
 
     /**
diff --git a/engine/storage/configdrive/src/test/java/org/apache/cloudstack/storage/configdrive/ConfigDriveBuilderTest.java b/engine/storage/configdrive/src/test/java/org/apache/cloudstack/storage/configdrive/ConfigDriveBuilderTest.java
index c04ff0a16015..03ceac843997 100644
--- a/engine/storage/configdrive/src/test/java/org/apache/cloudstack/storage/configdrive/ConfigDriveBuilderTest.java
+++ b/engine/storage/configdrive/src/test/java/org/apache/cloudstack/storage/configdrive/ConfigDriveBuilderTest.java
@@ -435,7 +435,7 @@ public void getProgramToGenerateIsoTestGenIsoExistsAndIsExecutable() throws Exce
 
             Mockito.verify(genIsoFileMock, Mockito.times(2)).exists();
             Mockito.verify(genIsoFileMock).canExecute();
-            Mockito.verify(genIsoFileMock).getCanonicalPath();
+            Mockito.verify(genIsoFileMock).getAbsolutePath();
         }
     }
 
@@ -475,11 +475,11 @@ public void getProgramToGenerateIsoTestNotGenIsoMkIsoInLinux() throws Exception
 
             Mockito.verify(genIsoFileMock, Mockito.times(1)).exists();
             Mockito.verify(genIsoFileMock, Mockito.times(0)).canExecute();
-            Mockito.verify(genIsoFileMock, Mockito.times(0)).getCanonicalPath();
+            Mockito.verify(genIsoFileMock, Mockito.times(0)).getAbsolutePath();
 
             Mockito.verify(mkIsoProgramInLinuxFileMock, Mockito.times(2)).exists();
             Mockito.verify(mkIsoProgramInLinuxFileMock, Mockito.times(1)).canExecute();
-            Mockito.verify(mkIsoProgramInLinuxFileMock, Mockito.times(1)).getCanonicalPath();
+            Mockito.verify(mkIsoProgramInLinuxFileMock, Mockito.times(1)).getAbsolutePath();
         }
     }
 
@@ -509,15 +509,15 @@ public void getProgramToGenerateIsoTestMkIsoMac() throws Exception {
 
             Mockito.verify(genIsoFileMock, Mockito.times(1)).exists();
             Mockito.verify(genIsoFileMock, Mockito.times(0)).canExecute();
-            Mockito.verify(genIsoFileMock, Mockito.times(0)).getCanonicalPath();
+            Mockito.verify(genIsoFileMock, Mockito.times(0)).getAbsolutePath();
 
             Mockito.verify(mkIsoProgramInLinuxFileMock, Mockito.times(1)).exists();
             Mockito.verify(mkIsoProgramInLinuxFileMock, Mockito.times(0)).canExecute();
-            Mockito.verify(mkIsoProgramInLinuxFileMock, Mockito.times(0)).getCanonicalPath();
+            Mockito.verify(mkIsoProgramInLinuxFileMock, Mockito.times(0)).getAbsolutePath();
 
             Mockito.verify(mkIsoProgramInMacOsFileMock, Mockito.times(1)).exists();
             Mockito.verify(mkIsoProgramInMacOsFileMock, Mockito.times(1)).canExecute();
-            Mockito.verify(mkIsoProgramInMacOsFileMock, Mockito.times(1)).getCanonicalPath();
+            Mockito.verify(mkIsoProgramInMacOsFileMock, Mockito.times(1)).getAbsolutePath();
         }
     }
 
diff --git a/packaging/el8/cloud.spec b/packaging/el8/cloud.spec
index 3d4851122669..507a6e64173f 100644
--- a/packaging/el8/cloud.spec
+++ b/packaging/el8/cloud.spec
@@ -76,7 +76,7 @@ Requires: sudo
 Requires: /sbin/service
 Requires: /sbin/chkconfig
 Requires: /usr/bin/ssh-keygen
-Requires: (genisoimage or mkisofs)
+Requires: (genisoimage or mkisofs or xorrisofs)
 Requires: ipmitool
 Requires: %{name}-common = %{_ver}
 Requires: (iptables-services or iptables)

From 36edd92e480d8b738335c6500b2e90c4d3f91fb9 Mon Sep 17 00:00:00 2001
From: Henrique Sato <henriquesato2003@gmail.com>
Date: Mon, 26 Jan 2026 07:58:42 -0300
Subject: [PATCH 016/117] Fix snapshot physical size after migration (#12166)

---
 .../cloudstack/storage/image/SecondaryStorageServiceImpl.java   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/engine/storage/image/src/main/java/org/apache/cloudstack/storage/image/SecondaryStorageServiceImpl.java b/engine/storage/image/src/main/java/org/apache/cloudstack/storage/image/SecondaryStorageServiceImpl.java
index 641a2a40dcd5..f739fecf9bf1 100644
--- a/engine/storage/image/src/main/java/org/apache/cloudstack/storage/image/SecondaryStorageServiceImpl.java
+++ b/engine/storage/image/src/main/java/org/apache/cloudstack/storage/image/SecondaryStorageServiceImpl.java
@@ -280,7 +280,7 @@ protected Void migrateDataCallBack(AsyncCallbackDispatcher<SecondaryStorageServi
     private void updateDataObject(DataObject srcData, DataObject destData) {
         if (destData instanceof SnapshotInfo) {
             SnapshotDataStoreVO snapshotStore = snapshotStoreDao.findBySourceSnapshot(srcData.getId(), DataStoreRole.Image);
-            SnapshotDataStoreVO destSnapshotStore = snapshotStoreDao.findByStoreSnapshot(DataStoreRole.Image, srcData.getDataStore().getId(), srcData.getId());
+            SnapshotDataStoreVO destSnapshotStore = snapshotStoreDao.findByStoreSnapshot(DataStoreRole.Image, destData.getDataStore().getId(), destData.getId());
             if (snapshotStore != null && destSnapshotStore != null) {
                 destSnapshotStore.setPhysicalSize(snapshotStore.getPhysicalSize());
                 destSnapshotStore.setCreated(snapshotStore.getCreated());

From 44793da58f29e534562b757bbf905071099507c3 Mon Sep 17 00:00:00 2001
From: Edward-x <30854794+YLChen-007@users.noreply.github.com>
Date: Mon, 26 Jan 2026 19:22:22 +0800
Subject: [PATCH 017/117] =?UTF-8?q?fix=20Sensitive=20Data=20Exposure=20Thr?=
 =?UTF-8?q?ough=20Exception=20Logging=20in=20OVM=20Hypervis=E2=80=A6=20(#1?=
 =?UTF-8?q?2032)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* fix Sensitive Data Exposure Through Exception Logging in OVM Hypervisor Configuration

* extra ‘)’ in log.

Co-authored-by: Abhisar Sinha <63767682+abh1sar@users.noreply.github.com>

* remove non-descriptive part

Co-authored-by: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>

---------

Co-authored-by: chenyoulong20g@ict.ac.cn <chenyoulong20g@ict.ac.cn>
Co-authored-by: dahn <daan.hoogland@gmail.com>
Co-authored-by: Abhisar Sinha <63767682+abh1sar@users.noreply.github.com>
Co-authored-by: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
---
 .../src/main/java/com/cloud/ovm/hypervisor/OvmResourceBase.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/hypervisors/ovm/src/main/java/com/cloud/ovm/hypervisor/OvmResourceBase.java b/plugins/hypervisors/ovm/src/main/java/com/cloud/ovm/hypervisor/OvmResourceBase.java
index 9d958a9894a4..a65e4d778d37 100644
--- a/plugins/hypervisors/ovm/src/main/java/com/cloud/ovm/hypervisor/OvmResourceBase.java
+++ b/plugins/hypervisors/ovm/src/main/java/com/cloud/ovm/hypervisor/OvmResourceBase.java
@@ -362,7 +362,7 @@ protected void setupServer() throws IOException {
 
         sshConnection = SSHCmdHelper.acquireAuthorizedConnection(_ip, _username, _password);
         if (sshConnection == null) {
-            throw new CloudRuntimeException(String.format("Cannot connect to ovm host(IP=%1$s, username=%2$s, password=%3$s", _ip, _username, _password));
+            throw new CloudRuntimeException(String.format("Cannot connect to ovm host(IP=%1$s, username=%2$s)", _ip, _username));
         }
 
         if (!SSHCmdHelper.sshExecuteCmd(sshConnection, "sh /usr/bin/configureOvm.sh postSetup")) {

From bbc23a74683052228d254ba0e4958f4c19254f90 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bernardo=20De=20Marco=20Gon=C3=A7alves?=
 <bernardomg2004@gmail.com>
Date: Mon, 26 Jan 2026 09:14:40 -0300
Subject: [PATCH 018/117] fix install path for systemvm templates when
 introducing new sec storage (#11605)

---
 .../cloudstack/storage/image/TemplateServiceImpl.java      | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/engine/storage/image/src/main/java/org/apache/cloudstack/storage/image/TemplateServiceImpl.java b/engine/storage/image/src/main/java/org/apache/cloudstack/storage/image/TemplateServiceImpl.java
index 1bb954da4109..c18be7c73355 100644
--- a/engine/storage/image/src/main/java/org/apache/cloudstack/storage/image/TemplateServiceImpl.java
+++ b/engine/storage/image/src/main/java/org/apache/cloudstack/storage/image/TemplateServiceImpl.java
@@ -1318,9 +1318,10 @@ public void addSystemVMTemplatesToSecondary(DataStore store) {
                 if (_vmTemplateStoreDao.isTemplateMarkedForDirectDownload(tmplt.getId())) {
                     continue;
                 }
-                tmpltStore =
-                        new TemplateDataStoreVO(storeId, tmplt.getId(), new Date(), 100, Status.DOWNLOADED, null, null, null,
-                                TemplateConstants.DEFAULT_SYSTEM_VM_TEMPLATE_PATH + tmplt.getId() + '/', tmplt.getUrl());
+                String templateDirectoryPath = TemplateConstants.DEFAULT_TMPLT_ROOT_DIR + File.separator + TemplateConstants.DEFAULT_TMPLT_FIRST_LEVEL_DIR;
+                String installPath = templateDirectoryPath + tmplt.getAccountId() + File.separator + tmplt.getId() + File.separator;
+                tmpltStore = new TemplateDataStoreVO(storeId, tmplt.getId(), new Date(), 100, Status.DOWNLOADED,
+                        null, null, null, installPath, tmplt.getUrl());
                 tmpltStore.setSize(0L);
                 tmpltStore.setPhysicalSize(0); // no size information for
                 // pre-seeded system vm templates

From 7536516e41636c9ae77ddda89c4f9827bfe55ba5 Mon Sep 17 00:00:00 2001
From: Manoj Kumar <manojkr.itbhu@gmail.com>
Date: Mon, 26 Jan 2026 18:12:43 +0530
Subject: [PATCH 019/117] add missing label text for label.aclname (#12511)

---
 ui/public/locales/en.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index 64437a4d07c1..8bb7dba9bf54 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -47,6 +47,7 @@
 "label.acl.rules": "ACL rules",
 "label.acl.reason.description": "Enter the reason behind an ACL rule.",
 "label.aclid": "ACL",
+"label.aclname": "ACL name",
 "label.acl.rule.name": "ACL rule name",
 "label.acquire.new.ip": "Acquire new IP",
 "label.acquire.new.secondary.ip": "Acquire new secondary IP",

From d50899427a70185bd0933bf386ae52aa0eab396b Mon Sep 17 00:00:00 2001
From: Daan Hoogland <dahn@apache.org>
Date: Mon, 26 Jan 2026 14:17:38 +0100
Subject: [PATCH 020/117] merge forward error

---
 .../src/main/java/com/cloud/resource/ResourceManagerImpl.java   | 2 +-
 .../test/java/com/cloud/resource/ResourceManagerImplTest.java   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java b/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
index ab3162e7a4b9..110353c4b482 100755
--- a/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
+++ b/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
@@ -2366,7 +2366,7 @@ public void updateStoragePoolConnectionsOnHosts(Long poolId, List<String> storag
             List<Long> conflictingHostIds = new ArrayList<>(CollectionUtils.intersection(hostIdsToDisconnect, hostIdsUsingTheStoragePool));
             if (CollectionUtils.isNotEmpty(conflictingHostIds)) {
                 Map<HostVO, List<VolumeVO>> hostVolumeMap = new HashMap<>();
-                List<VolumeVO> volumesInPool = volumeDao.findByPoolId(poolId);
+                List<VolumeVO> volumesInPool = volumeDao.findNonDestroyedVolumesByPoolId(poolId);
                 Map<Long, VMInstanceVO> vmInstanceCache = new HashMap<>();
 
                 for (Long hostId : conflictingHostIds) {
diff --git a/server/src/test/java/com/cloud/resource/ResourceManagerImplTest.java b/server/src/test/java/com/cloud/resource/ResourceManagerImplTest.java
index 6ed0774a4238..7e60c111ab2f 100644
--- a/server/src/test/java/com/cloud/resource/ResourceManagerImplTest.java
+++ b/server/src/test/java/com/cloud/resource/ResourceManagerImplTest.java
@@ -944,7 +944,7 @@ public void testUpdateStoragePoolConnectionsOnHosts_ConflictWithHostIdsAndVolume
         Mockito.when(volume2.getInstanceId()).thenReturn(101L);
 
         List<VolumeVO> volumesInPool = Arrays.asList(volume1, volume2);
-        Mockito.doReturn(volumesInPool).when(volumeDao).findByPoolId(poolId);
+        Mockito.doReturn(volumesInPool).when(volumeDao).findNonDestroyedVolumesByPoolId(poolId);
 
         VMInstanceVO vmInstance1 = Mockito.mock(VMInstanceVO.class);
         VMInstanceVO vmInstance2 = Mockito.mock(VMInstanceVO.class);

From 88181ebe722c95bc628851c25b8b6fad06a14780 Mon Sep 17 00:00:00 2001
From: John Bampton <jbampton@users.noreply.github.com>
Date: Mon, 26 Jan 2026 23:59:31 +1000
Subject: [PATCH 021/117] Standardize and auto add license headers to all cfg
 files with pre-commit (#12230)

---
 .pre-commit-config.yaml                       | 10 +++++++
 setup/dev/s3.cfg                              | 29 +++++++++---------
 systemvm/debian/etc/haproxy/haproxy.cfg       | 17 +++++++++++
 .../devcloud-kvm-advanced-fusion.cfg          | 30 +++++++++----------
 tools/devcloud-kvm/devcloud-kvm-advanced.cfg  | 30 +++++++++----------
 tools/devcloud-kvm/devcloud-kvm.cfg           | 30 +++++++++----------
 tools/devcloud4/advanced/marvin.cfg           | 30 +++++++++----------
 tools/devcloud4/basic/marvin.cfg              | 30 +++++++++----------
 8 files changed, 112 insertions(+), 94 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 26adafcbf268..49829caf125e 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -52,6 +52,16 @@ repos:
         args: ['644']
         files: \.md$
         stages: [manual]
+      - id: insert-license
+        name: add license for all cfg files
+        description: automatically adds a licence header to all cfg files that don't have a license header
+        files: \.cfg$
+        args:
+          - --comment-style
+          - '|#|'
+          - --license-filepath
+          - .github/workflows/license-templates/LICENSE.txt
+          - --fuzzy-match-generates-todo
       - id: insert-license
         name: add license for all Markdown files
         files: \.md$
diff --git a/setup/dev/s3.cfg b/setup/dev/s3.cfg
index de28e5b2698c..ce414f584cf1 100644
--- a/setup/dev/s3.cfg
+++ b/setup/dev/s3.cfg
@@ -1,20 +1,19 @@
-#  Licensed to the Apache Software Foundation (ASF) under one
-#  or more contributor license agreements.  See the NOTICE file
-#  distributed with this work for additional information
-#  regarding copyright ownership.  The ASF licenses this file
-#  to you under the Apache License, Version 2.0 (the
-#  "License"); you may not use this file except in compliance
-#  with the License.  You may obtain a copy of the License at
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
 #
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-#  Unless required by applicable law or agreed to in writing,
-#  software distributed under the License is distributed on an
-#  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-#  KIND, either express or implied.  See the License for the
-#  specific language governing permissions and limitations
-#  under the License.
+#   http://www.apache.org/licenses/LICENSE-2.0
 #
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 
 # TODO: Change ACCESS_KEY/ SECRET_KEY to your credentials on the object store
 
diff --git a/systemvm/debian/etc/haproxy/haproxy.cfg b/systemvm/debian/etc/haproxy/haproxy.cfg
index 21964f297c25..68a4cd7cd585 100644
--- a/systemvm/debian/etc/haproxy/haproxy.cfg
+++ b/systemvm/debian/etc/haproxy/haproxy.cfg
@@ -1,3 +1,20 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
 global
 	log 127.0.0.1:3914   local0 info
 	chroot /var/lib/haproxy
diff --git a/tools/devcloud-kvm/devcloud-kvm-advanced-fusion.cfg b/tools/devcloud-kvm/devcloud-kvm-advanced-fusion.cfg
index b1a3418e5d30..ce3ec91bbcfb 100644
--- a/tools/devcloud-kvm/devcloud-kvm-advanced-fusion.cfg
+++ b/tools/devcloud-kvm/devcloud-kvm-advanced-fusion.cfg
@@ -1,21 +1,19 @@
-#  Licensed to the Apache Software Foundation (ASF) under one
-#  or more contributor license agreements.  See the NOTICE file
-#  distributed with this work for additional information
-#  regarding copyright ownership.  The ASF licenses this file
-#  to you under the Apache License, Version 2.0 (the
-#  "License"); you may not use this file except in compliance
-#  with the License.  You may obtain a copy of the License at
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
 #
-#    http://www.apache.org/licenses/LICENSE-2.0
+#   http://www.apache.org/licenses/LICENSE-2.0
 #
-#  Unless required by applicable law or agreed to in writing,
-#  software distributed under the License is distributed on an
-#  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-#  KIND, either express or implied.  See the License for the
-#  specific language governing permissions and limitations
-#  under the License.
-#
-
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 
 {
     "zones": [
diff --git a/tools/devcloud-kvm/devcloud-kvm-advanced.cfg b/tools/devcloud-kvm/devcloud-kvm-advanced.cfg
index a3a41da874f0..60ad8b58b9ff 100644
--- a/tools/devcloud-kvm/devcloud-kvm-advanced.cfg
+++ b/tools/devcloud-kvm/devcloud-kvm-advanced.cfg
@@ -1,21 +1,19 @@
-#  Licensed to the Apache Software Foundation (ASF) under one
-#  or more contributor license agreements.  See the NOTICE file
-#  distributed with this work for additional information
-#  regarding copyright ownership.  The ASF licenses this file
-#  to you under the Apache License, Version 2.0 (the
-#  "License"); you may not use this file except in compliance
-#  with the License.  You may obtain a copy of the License at
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
 #
-#    http://www.apache.org/licenses/LICENSE-2.0
+#   http://www.apache.org/licenses/LICENSE-2.0
 #
-#  Unless required by applicable law or agreed to in writing,
-#  software distributed under the License is distributed on an
-#  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-#  KIND, either express or implied.  See the License for the
-#  specific language governing permissions and limitations
-#  under the License.
-#
-
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 
 {
     "zones": [
diff --git a/tools/devcloud-kvm/devcloud-kvm.cfg b/tools/devcloud-kvm/devcloud-kvm.cfg
index ffd23504ffec..5ac417a13dc7 100644
--- a/tools/devcloud-kvm/devcloud-kvm.cfg
+++ b/tools/devcloud-kvm/devcloud-kvm.cfg
@@ -1,20 +1,20 @@
-#  Licensed to the Apache Software Foundation (ASF) under one
-#  or more contributor license agreements.  See the NOTICE file
-#  distributed with this work for additional information
-#  regarding copyright ownership.  The ASF licenses this file
-#  to you under the Apache License, Version 2.0 (the
-#  "License"); you may not use this file except in compliance
-#  with the License.  You may obtain a copy of the License at
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
 #
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-#  Unless required by applicable law or agreed to in writing,
-#  software distributed under the License is distributed on an
-#  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-#  KIND, either express or implied.  See the License for the
-#  specific language governing permissions and limitations
-#  under the License.
+#   http://www.apache.org/licenses/LICENSE-2.0
 #
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
 # This is a stock devcloud config converted from the file
 # tools/devcloud/devcloud.cfg.
 
diff --git a/tools/devcloud4/advanced/marvin.cfg b/tools/devcloud4/advanced/marvin.cfg
index 222dc65d0452..7b6e656e6204 100644
--- a/tools/devcloud4/advanced/marvin.cfg
+++ b/tools/devcloud4/advanced/marvin.cfg
@@ -1,21 +1,19 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
 #
-#  Licensed to the Apache Software Foundation (ASF) under one
-#  or more contributor license agreements.  See the NOTICE file
-#  distributed with this work for additional information
-#  regarding copyright ownership.  The ASF licenses this file
-#  to you under the Apache License, Version 2.0 (the
-#  "License"); you may not use this file except in compliance
-#  with the License.  You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-#  Unless required by applicable law or agreed to in writing,
-#  software distributed under the License is distributed on an
-#  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-#  KIND, either express or implied.  See the License for the
-#  specific language governing permissions and limitations
-#  under the License.
+#   http://www.apache.org/licenses/LICENSE-2.0
 #
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 
 {
     "zones": [
diff --git a/tools/devcloud4/basic/marvin.cfg b/tools/devcloud4/basic/marvin.cfg
index 1c8ee547b265..9b7d73c381b1 100644
--- a/tools/devcloud4/basic/marvin.cfg
+++ b/tools/devcloud4/basic/marvin.cfg
@@ -1,21 +1,19 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
 #
-#  Licensed to the Apache Software Foundation (ASF) under one
-#  or more contributor license agreements.  See the NOTICE file
-#  distributed with this work for additional information
-#  regarding copyright ownership.  The ASF licenses this file
-#  to you under the Apache License, Version 2.0 (the
-#  "License"); you may not use this file except in compliance
-#  with the License.  You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-#  Unless required by applicable law or agreed to in writing,
-#  software distributed under the License is distributed on an
-#  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-#  KIND, either express or implied.  See the License for the
-#  specific language governing permissions and limitations
-#  under the License.
+#   http://www.apache.org/licenses/LICENSE-2.0
 #
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
 
 {
     "zones": [

From 63c8b5fc5627fd0de6d05609625e826de1a6f677 Mon Sep 17 00:00:00 2001
From: Wei Zhou <weizhou@apache.org>
Date: Mon, 26 Jan 2026 15:23:27 +0100
Subject: [PATCH 022/117] api/server: support deploy-as-is template as VNF
 template (#12499)

---
 .../user/vm/DeployVnfApplianceCmd.java        |  2 +-
 .../storage/template/VnfTemplateManager.java  |  4 +++-
 .../storage/template/VnfTemplateUtils.java    | 18 ++++++++++++++++
 .../cloud/template/TemplateManagerImpl.java   |  9 ++++++++
 .../java/com/cloud/vm/UserVmManagerImpl.java  |  2 +-
 .../template/VnfTemplateManagerImpl.java      | 21 ++++++++++++++++++-
 .../template/TemplateManagerImplTest.java     |  8 +++++++
 .../com/cloud/vm/UserVmManagerImplTest.java   |  6 +++---
 .../template/VnfTemplateManagerImplTest.java  |  8 +++----
 ui/public/locales/en.json                     |  2 +-
 ui/src/views/compute/DeployVnfAppliance.vue   | 14 +++++++++++--
 .../views/compute/wizard/VnfNicsSelection.vue |  5 +++++
 12 files changed, 85 insertions(+), 14 deletions(-)

diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DeployVnfApplianceCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DeployVnfApplianceCmd.java
index 4d50dd9c39bf..92ddfd5b2357 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DeployVnfApplianceCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DeployVnfApplianceCmd.java
@@ -43,7 +43,7 @@
 public class DeployVnfApplianceCmd extends DeployVMCmd implements UserCmd {
 
     @Parameter(name = ApiConstants.VNF_CONFIGURE_MANAGEMENT, type = CommandType.BOOLEAN, required = false,
-            description = "True by default, security group or network rules (source nat and firewall rules) will be configured for VNF management interfaces. False otherwise. " +
+            description = "False by default, security group or network rules (source nat and firewall rules) will be configured for VNF management interfaces. True otherwise. " +
                     "Network rules are configured if management network is an isolated network or shared network with security groups.")
     private Boolean vnfConfigureManagement;
 
diff --git a/api/src/main/java/org/apache/cloudstack/storage/template/VnfTemplateManager.java b/api/src/main/java/org/apache/cloudstack/storage/template/VnfTemplateManager.java
index 6571346ad654..3df59811561b 100644
--- a/api/src/main/java/org/apache/cloudstack/storage/template/VnfTemplateManager.java
+++ b/api/src/main/java/org/apache/cloudstack/storage/template/VnfTemplateManager.java
@@ -29,6 +29,7 @@
 import org.apache.cloudstack.api.command.user.vm.DeployVnfApplianceCmd;
 import org.apache.cloudstack.framework.config.ConfigKey;
 import java.util.List;
+import java.util.Map;
 
 public interface VnfTemplateManager {
 
@@ -42,11 +43,12 @@ public interface VnfTemplateManager {
 
     void updateVnfTemplate(long templateId, UpdateVnfTemplateCmd cmd);
 
-    void validateVnfApplianceNics(VirtualMachineTemplate template, List<Long> networkIds);
+    void validateVnfApplianceNics(VirtualMachineTemplate template, List<Long> networkIds, Map<Integer, Long> vmNetworkMap);
 
     SecurityGroup createSecurityGroupForVnfAppliance(DataCenter zone, VirtualMachineTemplate template, Account owner, DeployVnfApplianceCmd cmd);
 
     void createIsolatedNetworkRulesForVnfAppliance(DataCenter zone, VirtualMachineTemplate template, Account owner,
                                                    UserVm vm, DeployVnfApplianceCmd cmd)
             throws InsufficientAddressCapacityException, ResourceAllocationException, ResourceUnavailableException;
+
 }
diff --git a/api/src/main/java/org/apache/cloudstack/storage/template/VnfTemplateUtils.java b/api/src/main/java/org/apache/cloudstack/storage/template/VnfTemplateUtils.java
index e997a50cec03..16ff2abb564a 100644
--- a/api/src/main/java/org/apache/cloudstack/storage/template/VnfTemplateUtils.java
+++ b/api/src/main/java/org/apache/cloudstack/storage/template/VnfTemplateUtils.java
@@ -16,6 +16,7 @@
 // under the License.
 package org.apache.cloudstack.storage.template;
 
+import com.cloud.agent.api.to.deployasis.OVFNetworkTO;
 import com.cloud.exception.InvalidParameterValueException;
 import com.cloud.network.VNF;
 import com.cloud.storage.Storage;
@@ -124,6 +125,9 @@ public static void validateVnfNics(List<VNF.VnfNic> nicsList) {
     public static void validateApiCommandParams(BaseCmd cmd, VirtualMachineTemplate template) {
         if (cmd instanceof RegisterVnfTemplateCmd) {
             RegisterVnfTemplateCmd registerCmd = (RegisterVnfTemplateCmd) cmd;
+            if (registerCmd.isDeployAsIs() && CollectionUtils.isNotEmpty(registerCmd.getVnfNics())) {
+                throw new InvalidParameterValueException("VNF nics cannot be specified when register a deploy-as-is Template. Please wait until Template settings are read from OVA.");
+            }
             validateApiCommandParams(registerCmd.getVnfDetails(), registerCmd.getVnfNics(), registerCmd.getTemplateType());
         } else if (cmd instanceof UpdateVnfTemplateCmd) {
             UpdateVnfTemplateCmd updateCmd = (UpdateVnfTemplateCmd) cmd;
@@ -149,4 +153,18 @@ public static void validateVnfCidrList(List<String> cidrList) {
             }
         }
     }
+
+    public static void validateDeployAsIsTemplateVnfNics(List<OVFNetworkTO> ovfNetworks, List<VNF.VnfNic> vnfNics) {
+        if (CollectionUtils.isEmpty(vnfNics)) {
+            return;
+        }
+        if (CollectionUtils.isEmpty(ovfNetworks)) {
+            throw new InvalidParameterValueException("The list of networks read from OVA is empty. Please wait until the template is fully downloaded and processed.");
+        }
+        for (VNF.VnfNic vnfNic : vnfNics) {
+            if (vnfNic.getDeviceId() < ovfNetworks.size() && !vnfNic.isRequired()) {
+                throw new InvalidParameterValueException(String.format("The VNF nic [device ID: %s ] is required as it is defined in the OVA template.", vnfNic.getDeviceId()));
+            }
+        }
+    }
 }
diff --git a/server/src/main/java/com/cloud/template/TemplateManagerImpl.java b/server/src/main/java/com/cloud/template/TemplateManagerImpl.java
index ba8e57141803..2c7d2d593e3e 100755
--- a/server/src/main/java/com/cloud/template/TemplateManagerImpl.java
+++ b/server/src/main/java/com/cloud/template/TemplateManagerImpl.java
@@ -122,6 +122,7 @@
 import com.cloud.agent.api.to.DiskTO;
 import com.cloud.agent.api.to.NfsTO;
 import com.cloud.agent.api.to.VirtualMachineTO;
+import com.cloud.agent.api.to.deployasis.OVFNetworkTO;
 import com.cloud.api.ApiDBUtils;
 import com.cloud.api.query.dao.UserVmJoinDao;
 import com.cloud.api.query.vo.UserVmJoinVO;
@@ -131,6 +132,7 @@
 import com.cloud.dc.DataCenterVO;
 import com.cloud.dc.dao.DataCenterDao;
 import com.cloud.deploy.DeployDestination;
+import com.cloud.deployasis.dao.TemplateDeployAsIsDetailsDao;
 import com.cloud.domain.Domain;
 import com.cloud.domain.dao.DomainDao;
 import com.cloud.event.ActionEvent;
@@ -313,6 +315,8 @@ public class TemplateManagerImpl extends ManagerBase implements TemplateManager,
     protected SnapshotHelper snapshotHelper;
     @Inject
     VnfTemplateManager vnfTemplateManager;
+    @Inject
+    TemplateDeployAsIsDetailsDao templateDeployAsIsDetailsDao;
 
     @Inject
     private SecondaryStorageHeuristicDao secondaryStorageHeuristicDao;
@@ -2172,6 +2176,11 @@ private VMTemplateVO updateTemplateOrIso(BaseUpdateTemplateOrIsoCmd cmd) {
             templateType = validateTemplateType(cmd, isAdmin, template.isCrossZones());
             if (cmd instanceof UpdateVnfTemplateCmd) {
                 VnfTemplateUtils.validateApiCommandParams(cmd, template);
+                UpdateVnfTemplateCmd updateCmd = (UpdateVnfTemplateCmd) cmd;
+                if (template.isDeployAsIs() && CollectionUtils.isNotEmpty(updateCmd.getVnfNics())) {
+                    List<OVFNetworkTO> ovfNetworks = templateDeployAsIsDetailsDao.listNetworkRequirementsByTemplateId(template.getId());
+                    VnfTemplateUtils.validateDeployAsIsTemplateVnfNics(ovfNetworks, updateCmd.getVnfNics());
+                }
                 vnfTemplateManager.updateVnfTemplate(template.getId(), (UpdateVnfTemplateCmd) cmd);
             }
             templateTag = ((UpdateTemplateCmd)cmd).getTemplateTag();
diff --git a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
index 3e045f5a9057..815ac4f70fe8 100644
--- a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
+++ b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
@@ -6127,7 +6127,7 @@ public UserVm createVirtualMachine(DeployVMCmd cmd) throws InsufficientCapacityE
             throw new InvalidParameterValueException("Unable to use template " + templateId);
         }
         if (TemplateType.VNF.equals(template.getTemplateType())) {
-            vnfTemplateManager.validateVnfApplianceNics(template, cmd.getNetworkIds());
+            vnfTemplateManager.validateVnfApplianceNics(template, cmd.getNetworkIds(), cmd.getVmNetworkMap());
         } else if (cmd instanceof DeployVnfApplianceCmd) {
             throw new InvalidParameterValueException("Can't deploy VNF appliance from a non-VNF template");
         }
diff --git a/server/src/main/java/org/apache/cloudstack/storage/template/VnfTemplateManagerImpl.java b/server/src/main/java/org/apache/cloudstack/storage/template/VnfTemplateManagerImpl.java
index ef0f6f6b226d..0ebff237a44e 100644
--- a/server/src/main/java/org/apache/cloudstack/storage/template/VnfTemplateManagerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/storage/template/VnfTemplateManagerImpl.java
@@ -201,7 +201,14 @@ public ConfigKey<?>[] getConfigKeys() {
     }
 
     @Override
-    public void validateVnfApplianceNics(VirtualMachineTemplate template, List<Long> networkIds) {
+    public void validateVnfApplianceNics(VirtualMachineTemplate template, List<Long> networkIds, Map<Integer, Long> vmNetworkMap) {
+        if (template.isDeployAsIs()) {
+            if (CollectionUtils.isNotEmpty(networkIds)) {
+                throw new InvalidParameterValueException("VNF nics mappings should be empty for deploy-as-is templates");
+            }
+            validateVnfApplianceNetworksMap(template, vmNetworkMap);
+            return;
+        }
         if (CollectionUtils.isEmpty(networkIds)) {
             throw new InvalidParameterValueException("VNF nics list is empty");
         }
@@ -213,6 +220,18 @@ public void validateVnfApplianceNics(VirtualMachineTemplate template, List<Long>
         }
     }
 
+    private void validateVnfApplianceNetworksMap(VirtualMachineTemplate template, Map<Integer, Long> vmNetworkMap) {
+        if (MapUtils.isEmpty(vmNetworkMap)) {
+            throw new InvalidParameterValueException("VNF networks map is empty");
+        }
+        List<VnfTemplateNicVO> vnfNics = vnfTemplateNicDao.listByTemplateId(template.getId());
+        for (VnfTemplateNicVO vnfNic : vnfNics) {
+            if (vnfNic.isRequired() && vmNetworkMap.size() <= vnfNic.getDeviceId()) {
+                throw new InvalidParameterValueException("VNF nic is required but not found: " + vnfNic);
+            }
+        }
+    }
+
     protected Set<Integer> getOpenPortsForVnfAppliance(VirtualMachineTemplate template) {
         Set<Integer> ports = new HashSet<>();
         VnfTemplateDetailVO accessMethodsDetail = vnfTemplateDetailsDao.findDetail(template.getId(), VNF.AccessDetail.ACCESS_METHODS.name().toLowerCase());
diff --git a/server/src/test/java/com/cloud/template/TemplateManagerImplTest.java b/server/src/test/java/com/cloud/template/TemplateManagerImplTest.java
index 98b1c05dba83..9680fe5e1fd4 100755
--- a/server/src/test/java/com/cloud/template/TemplateManagerImplTest.java
+++ b/server/src/test/java/com/cloud/template/TemplateManagerImplTest.java
@@ -23,6 +23,7 @@
 import com.cloud.api.query.dao.UserVmJoinDao;
 import com.cloud.configuration.Resource;
 import com.cloud.dc.dao.DataCenterDao;
+import com.cloud.deployasis.dao.TemplateDeployAsIsDetailsDao;
 import com.cloud.domain.dao.DomainDao;
 import com.cloud.event.dao.UsageEventDao;
 import com.cloud.exception.InvalidParameterValueException;
@@ -204,6 +205,8 @@ public class TemplateManagerImplTest {
     AccountManager _accountMgr;
     @Inject
     VnfTemplateManager vnfTemplateManager;
+    @Inject
+    TemplateDeployAsIsDetailsDao templateDeployAsIsDetailsDao;
 
     @Inject
     HeuristicRuleHelper heuristicRuleHelperMock;
@@ -956,6 +959,11 @@ public VnfTemplateManager vnfTemplateManager() {
             return Mockito.mock(VnfTemplateManager.class);
         }
 
+        @Bean
+        public TemplateDeployAsIsDetailsDao templateDeployAsIsDetailsDao() {
+            return Mockito.mock(TemplateDeployAsIsDetailsDao.class);
+        }
+
         @Bean
         public SnapshotHelper snapshotHelper() {
             return Mockito.mock(SnapshotHelper.class);
diff --git a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
index ac1ecaa456b0..570c57cb68d1 100644
--- a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
+++ b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
@@ -1079,7 +1079,7 @@ public void createVirtualMachine() throws ResourceUnavailableException, Insuffic
         when(templateMock.isDeployAsIs()).thenReturn(false);
         when(templateMock.getFormat()).thenReturn(Storage.ImageFormat.QCOW2);
         when(templateMock.getUserDataId()).thenReturn(null);
-        Mockito.doNothing().when(vnfTemplateManager).validateVnfApplianceNics(any(), nullable(List.class));
+        Mockito.doNothing().when(vnfTemplateManager).validateVnfApplianceNics(any(), nullable(List.class), nullable(Map.class));
 
         ServiceOfferingJoinVO svcOfferingMock = Mockito.mock(ServiceOfferingJoinVO.class);
         when(serviceOfferingJoinDao.findById(anyLong())).thenReturn(svcOfferingMock);
@@ -1091,7 +1091,7 @@ public void createVirtualMachine() throws ResourceUnavailableException, Insuffic
 
         UserVm result = userVmManagerImpl.createVirtualMachine(deployVMCmd);
         assertEquals(userVmVoMock, result);
-        Mockito.verify(vnfTemplateManager).validateVnfApplianceNics(templateMock, null);
+        Mockito.verify(vnfTemplateManager).validateVnfApplianceNics(templateMock, null, null);
         Mockito.verify(userVmManagerImpl).createBasicSecurityGroupVirtualMachine(any(), any(), any(), any(), any(), any(), any(),
                 any(), any(), any(), any(), any(), any(), any(), any(), any(), any(), any(), nullable(Boolean.class), any(), any(), any(),
                 any(), any(), any(), any(), eq(true), any());
@@ -1335,7 +1335,7 @@ public void createVirtualMachineWithCloudRuntimeException() throws ResourceUnava
         when(templateMock.isDeployAsIs()).thenReturn(false);
         when(templateMock.getFormat()).thenReturn(Storage.ImageFormat.QCOW2);
         when(templateMock.getUserDataId()).thenReturn(null);
-        Mockito.doNothing().when(vnfTemplateManager).validateVnfApplianceNics(any(), nullable(List.class));
+        Mockito.doNothing().when(vnfTemplateManager).validateVnfApplianceNics(any(), nullable(List.class), nullable(Map.class));
 
         ServiceOfferingJoinVO svcOfferingMock = Mockito.mock(ServiceOfferingJoinVO.class);
         when(serviceOfferingJoinDao.findById(anyLong())).thenReturn(svcOfferingMock);
diff --git a/server/src/test/java/org/apache/cloudstack/storage/template/VnfTemplateManagerImplTest.java b/server/src/test/java/org/apache/cloudstack/storage/template/VnfTemplateManagerImplTest.java
index c3fa0d62604c..b9565ebb2922 100644
--- a/server/src/test/java/org/apache/cloudstack/storage/template/VnfTemplateManagerImplTest.java
+++ b/server/src/test/java/org/apache/cloudstack/storage/template/VnfTemplateManagerImplTest.java
@@ -228,25 +228,25 @@ public void testPersistVnfTemplateUpdateWithoutDetails() {
     @Test
     public void testValidateVnfApplianceNicsWithRequiredNics() {
         List<Long> networkIds = Arrays.asList(200L, 201L);
-        vnfTemplateManagerImpl.validateVnfApplianceNics(template, networkIds);
+        vnfTemplateManagerImpl.validateVnfApplianceNics(template, networkIds, null);
     }
 
     @Test
     public void testValidateVnfApplianceNicsWithAllNics() {
         List<Long> networkIds = Arrays.asList(200L, 201L, 202L);
-        vnfTemplateManagerImpl.validateVnfApplianceNics(template, networkIds);
+        vnfTemplateManagerImpl.validateVnfApplianceNics(template, networkIds, null);
     }
 
     @Test(expected = InvalidParameterValueException.class)
     public void testValidateVnfApplianceNicsWithEmptyList() {
         List<Long> networkIds = new ArrayList<>();
-        vnfTemplateManagerImpl.validateVnfApplianceNics(template, networkIds);
+        vnfTemplateManagerImpl.validateVnfApplianceNics(template, networkIds, null);
     }
 
     @Test(expected = InvalidParameterValueException.class)
     public void testValidateVnfApplianceNicsWithMissingNetworkId() {
         List<Long> networkIds = Arrays.asList(200L);
-        vnfTemplateManagerImpl.validateVnfApplianceNics(template, networkIds);
+        vnfTemplateManagerImpl.validateVnfApplianceNics(template, networkIds, null);
     }
 
     @Test
diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index 8bb7dba9bf54..b2465fa325f4 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -2529,7 +2529,7 @@
 "label.vnf.cidr.list": "CIDR from which access to the VNF appliance's Management interface should be allowed from",
 "label.vnf.cidr.list.tooltip": "the CIDR list to forward traffic from to the VNF management interface. Multiple entries must be separated by a single comma character (,). The default value is 0.0.0.0/0.",
 "label.vnf.configure.management": "Configure network rules for VNF's management interfaces",
-"label.vnf.configure.management.tooltip": "True by default, security group or network rules (source nat and firewall rules) will be configured for VNF management interfaces. False otherwise. Learn what rules are configured at http://docs.cloudstack.apache.org/en/latest/adminguide/networking/vnf_templates_appliances.html#deploying-vnf-appliances",
+"label.vnf.configure.management.tooltip": "False by default, security group or network rules (source nat and firewall rules) will be configured for VNF management interfaces. True otherwise. Learn what rules are configured at http://docs.cloudstack.apache.org/en/latest/adminguide/networking/vnf_templates_appliances.html#deploying-vnf-appliances",
 "label.vnf.detail.add": "Add VNF detail",
 "label.vnf.detail.remove": "Remove VNF detail",
 "label.vnf.details": "VNF Details",
diff --git a/ui/src/views/compute/DeployVnfAppliance.vue b/ui/src/views/compute/DeployVnfAppliance.vue
index fec1139ab9b6..9b09de5a1868 100644
--- a/ui/src/views/compute/DeployVnfAppliance.vue
+++ b/ui/src/views/compute/DeployVnfAppliance.vue
@@ -372,6 +372,7 @@
                   <div>
                     <vnf-nics-selection
                       :items="templateVnfNics"
+                      :templateNics="templateNics"
                       :networks="networks"
                       @update-vnf-nic-networks="($event) => updateVnfNicNetworks($event)" />
                   </div>
@@ -1293,7 +1294,8 @@ export default {
       return tabList
     },
     showVnfNicsSection () {
-      return this.networks && this.networks.length > 0 && this.vm.templateid && this.templateVnfNics && this.templateVnfNics.length > 0
+      return ((this.networks && this.networks.length > 0) || (this.templateNics && this.templateNics.length > 0)) &&
+        this.vm.templateid && this.templateVnfNics && this.templateVnfNics.length > 0
     },
     showVnfConfigureManagement () {
       const managementDeviceIds = []
@@ -1303,6 +1305,11 @@ export default {
         }
       }
       for (const deviceId of managementDeviceIds) {
+        if (this.templateNics && this.templateNics[deviceId] &&
+          ((this.templateNics[deviceId].selectednetworktype === 'Isolated' && this.templateNics[deviceId].selectednetworkvpcid === undefined) ||
+            (this.templateNics[deviceId].selectednetworktype === 'Shared' && this.templateNics[deviceId].selectednetworkwithsg))) {
+          return true
+        }
         if (this.vnfNicNetworks && this.vnfNicNetworks[deviceId] &&
           ((this.vnfNicNetworks[deviceId].type === 'Isolated' && this.vnfNicNetworks[deviceId].vpcid === undefined) ||
             (this.vnfNicNetworks[deviceId].type === 'Shared' && this.vnfNicNetworks[deviceId].service.filter(svc => svc.name === 'SecurityGroupProvider')))) {
@@ -2005,7 +2012,7 @@ export default {
         // All checked networks should be used and only once.
         // Required NIC must be associated to a network
         // DeviceID must be consequent
-        if (this.templateVnfNics && this.templateVnfNics.length > 0) {
+        if (this.templateVnfNics && this.templateVnfNics.length > 0 && (!this.templateNics || this.templateNics.length === 0)) {
           let nextDeviceId = 0
           const usedNetworkIds = []
           const keys = Object.keys(this.vnfNicNetworks)
@@ -2629,6 +2636,9 @@ export default {
             var network = this.options.networks[Math.min(i, this.options.networks.length - 1)]
             nic.selectednetworkid = network.id
             nic.selectednetworkname = network.name
+            nic.selectednetworktype = network.type
+            nic.selectednetworkvpcid = network.vpcid
+            nic.selectednetworkwithsg = network.service.filter(svc => svc.name === 'SecurityGroupProvider').length > 0
             this.nicToNetworkSelection.push({ nic: nic.id, network: network.id })
           }
         }
diff --git a/ui/src/views/compute/wizard/VnfNicsSelection.vue b/ui/src/views/compute/wizard/VnfNicsSelection.vue
index fdd5276b4f6e..40bdc1c676a8 100644
--- a/ui/src/views/compute/wizard/VnfNicsSelection.vue
+++ b/ui/src/views/compute/wizard/VnfNicsSelection.vue
@@ -50,6 +50,7 @@
       <template #network="{ record }">
         <a-form-item style="display: block" :name="'nic-' + record.deviceid">
           <a-select
+            disabled="templateNics && templateNics.length > 0"
             @change="updateNicNetworkValue($event, record.deviceid)"
             optionFilterProp="label"
             :filterOption="(input, option) => {
@@ -75,6 +76,10 @@ export default {
       type: Array,
       default: () => []
     },
+    templateNics: {
+      type: Array,
+      default: () => []
+    },
     networks: {
       type: Array,
       default: () => []

From fa3dee886ed1257dd1856b7eed2b9c79c9c1219e Mon Sep 17 00:00:00 2001
From: dahn <daan@onecht.net>
Date: Mon, 26 Jan 2026 15:35:17 +0100
Subject: [PATCH 023/117] do not add disk cache mode from an empty string
 (#12248)

Co-authored-by: Daan Hoogland <dahn@apache.org>
---
 .../cloud/hypervisor/kvm/resource/LibvirtDomainXMLParser.java | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtDomainXMLParser.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtDomainXMLParser.java
index 8b26bc94e218..4d823783a99a 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtDomainXMLParser.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtDomainXMLParser.java
@@ -111,7 +111,9 @@ public boolean parseDomainXML(String domXML) {
                     def.defNetworkBasedDisk(diskPath, host, port, authUserName, poolUuid, diskLabel,
                         DiskDef.DiskBus.valueOf(bus.toUpperCase()),
                         DiskDef.DiskProtocol.valueOf(protocol.toUpperCase()), fmt);
-                    def.setCacheMode(DiskDef.DiskCacheMode.valueOf(diskCacheMode.toUpperCase()));
+                    if (StringUtils.isNotBlank(diskCacheMode)) {
+                        def.setCacheMode(DiskDef.DiskCacheMode.valueOf(diskCacheMode.toUpperCase()));
+                    }
                 } else {
                     String diskFmtType = getAttrValue("driver", "type", disk);
                     String diskCacheMode = getAttrValue("driver", "cache", disk);

From 5bb5af4c480d5f8155fe52008ff49ef437891007 Mon Sep 17 00:00:00 2001
From: Pearl Dsilva <pearl1594@gmail.com>
Date: Mon, 26 Jan 2026 11:33:06 -0500
Subject: [PATCH 024/117] 4.20: Fix unit test failure (#12520)

---
 server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
index 570c57cb68d1..06fb65921c3a 100644
--- a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
+++ b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
@@ -36,6 +36,7 @@
 import static org.mockito.Mockito.when;
 
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -1091,7 +1092,7 @@ public void createVirtualMachine() throws ResourceUnavailableException, Insuffic
 
         UserVm result = userVmManagerImpl.createVirtualMachine(deployVMCmd);
         assertEquals(userVmVoMock, result);
-        Mockito.verify(vnfTemplateManager).validateVnfApplianceNics(templateMock, null, null);
+        Mockito.verify(vnfTemplateManager).validateVnfApplianceNics(templateMock, null, Collections.emptyMap());
         Mockito.verify(userVmManagerImpl).createBasicSecurityGroupVirtualMachine(any(), any(), any(), any(), any(), any(), any(),
                 any(), any(), any(), any(), any(), any(), any(), any(), any(), any(), any(), nullable(Boolean.class), any(), any(), any(),
                 any(), any(), any(), any(), eq(true), any());

From 9b0c28c16daffbfc448d86f8d3e5fbac86dfc6ac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bernardo=20De=20Marco=20Gon=C3=A7alves?=
 <bernardomg2004@gmail.com>
Date: Mon, 26 Jan 2026 17:00:53 -0300
Subject: [PATCH 025/117] fix regression in the listBackupSchedules API
 (#12402)

---
 .../api/command/user/backup/ListBackupScheduleCmd.java           | 1 -
 1 file changed, 1 deletion(-)

diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/ListBackupScheduleCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/ListBackupScheduleCmd.java
index eed346376152..17bd06bfdd4b 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/ListBackupScheduleCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/ListBackupScheduleCmd.java
@@ -59,7 +59,6 @@ public class ListBackupScheduleCmd extends BaseListProjectAndAccountResourcesCmd
     @Parameter(name = ApiConstants.VIRTUAL_MACHINE_ID,
             type = CommandType.UUID,
             entityType = UserVmResponse.class,
-            required = true,
             description = "ID of the Instance")
     private Long vmId;
 

From 128dbe2c0be87c9a2986030aa40264444738cd76 Mon Sep 17 00:00:00 2001
From: GaOrtiga <49285692+GaOrtiga@users.noreply.github.com>
Date: Tue, 27 Jan 2026 02:06:59 -0300
Subject: [PATCH 026/117] Refactor configuration SystemVMDefaultHypervisor
 (#8934)

* refactor configuration SystemVMDefaultHypervisor

* change variable name

---------

Co-authored-by: Gabriel <gabriel.fernandes@scclouds.com.br>
---
 .../com/cloud/resource/ResourceManager.java    |  5 +++++
 .../java/com/cloud/configuration/Config.java   |  7 -------
 .../cloud/resource/ResourceManagerImpl.java    | 18 +++++++-----------
 3 files changed, 12 insertions(+), 18 deletions(-)

diff --git a/engine/components-api/src/main/java/com/cloud/resource/ResourceManager.java b/engine/components-api/src/main/java/com/cloud/resource/ResourceManager.java
index 8550dfdd9067..120b716518e1 100755
--- a/engine/components-api/src/main/java/com/cloud/resource/ResourceManager.java
+++ b/engine/components-api/src/main/java/com/cloud/resource/ResourceManager.java
@@ -79,6 +79,11 @@ public interface ResourceManager extends ResourceService, Configurable {
             ConfigKey.Kind.Select,
             "," + CPU.CPUArch.getTypesAsCSV());
 
+    ConfigKey<String> SystemVMDefaultHypervisor = new ConfigKey<String>(String.class,
+            "system.vm.default.hypervisor", "Advanced", "Any", "Hypervisor type used to create System VMs. Valid values are: XenServer, KVM, VMware, Hyperv, VirtualBox, " +
+            "Parralels, BareMetal, Ovm, LXC, Any", true, ConfigKey.Scope.Global, null, null, null, null, null, ConfigKey.Kind.Select, "XenServer, KVM, VMware, Hyperv, " +
+            "VirtualBox, Parralels, BareMetal, Ovm, LXC, Any");
+
     /**
      * Register a listener for different types of resource life cycle events.
      * There can only be one type of listener per type of host.
diff --git a/server/src/main/java/com/cloud/configuration/Config.java b/server/src/main/java/com/cloud/configuration/Config.java
index abae4d3996cb..a82ccb33a4a3 100644
--- a/server/src/main/java/com/cloud/configuration/Config.java
+++ b/server/src/main/java/com/cloud/configuration/Config.java
@@ -542,13 +542,6 @@ public enum Config {
             "true",
             "Indicates whether or not to automatically reserver system VM standby capacity.",
             null),
-    SystemVMDefaultHypervisor("Advanced",
-            ManagementServer.class,
-            String.class,
-            "system.vm.default.hypervisor",
-            null,
-            "Hypervisor type used to create system vm, valid values are: XenServer, KVM, VMware, Hyperv, VirtualBox, Parralels, BareMetal, Ovm, LXC, Any",
-            null),
     SystemVMRandomPassword(
             "Advanced",
             ManagementServer.class,
diff --git a/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java b/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
index 110353c4b482..3545bf5dddf5 100755
--- a/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
+++ b/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
@@ -352,7 +352,6 @@ public void setDiscoverers(final List<? extends Discoverer> discoverers) {
     private final HashMap<String, ResourceStateAdapter> _resourceStateAdapters = new HashMap<>();
 
     private final HashMap<Integer, List<ResourceListener>> _lifeCycleListeners = new HashMap<>();
-    private HypervisorType _defaultSystemVMHypervisor;
 
     private static final int ACQUIRE_GLOBAL_LOCK_TIMEOUT_FOR_COOPERATION = 30; // seconds
 
@@ -2935,7 +2934,6 @@ public DataCenter getZone(Long zoneId) {
 
     @Override
     public boolean configure(final String name, final Map<String, Object> params) throws ConfigurationException {
-        _defaultSystemVMHypervisor = HypervisorType.getType(_configDao.getValue(Config.SystemVMDefaultHypervisor.toString()));
         _gson = GsonHelper.getGson();
 
         _hypervisorsInDC = _hostDao.createSearchBuilder(String.class);
@@ -2981,10 +2979,7 @@ public List<HypervisorType> getSupportedHypervisorTypes(final long zoneId, final
 
     @Override
     public HypervisorType getDefaultHypervisor(final long zoneId) {
-        HypervisorType defaultHyper = HypervisorType.None;
-        if (_defaultSystemVMHypervisor != HypervisorType.None) {
-            defaultHyper = _defaultSystemVMHypervisor;
-        }
+        HypervisorType systemVMDefaultHypervisor = HypervisorType.getType(ResourceManager.SystemVMDefaultHypervisor.value());
 
         final DataCenterVO dc = _dcDao.findById(zoneId);
         if (dc == null) {
@@ -2993,27 +2988,27 @@ public HypervisorType getDefaultHypervisor(final long zoneId) {
         _dcDao.loadDetails(dc);
         final String defaultHypervisorInZone = dc.getDetail("defaultSystemVMHypervisorType");
         if (defaultHypervisorInZone != null) {
-            defaultHyper = HypervisorType.getType(defaultHypervisorInZone);
+            systemVMDefaultHypervisor = HypervisorType.getType(defaultHypervisorInZone);
         }
 
         final List<VMTemplateVO> systemTemplates = _templateDao.listAllSystemVMTemplates();
         boolean isValid = false;
         for (final VMTemplateVO template : systemTemplates) {
-            if (template.getHypervisorType() == defaultHyper) {
+            if (template.getHypervisorType() == systemVMDefaultHypervisor) {
                 isValid = true;
                 break;
             }
         }
 
         if (isValid) {
-            final List<ClusterVO> clusters = _clusterDao.listByDcHyType(zoneId, defaultHyper.toString());
+            final List<ClusterVO> clusters = _clusterDao.listByDcHyType(zoneId, systemVMDefaultHypervisor.toString());
             if (clusters.isEmpty()) {
                 isValid = false;
             }
         }
 
         if (isValid) {
-            return defaultHyper;
+            return systemVMDefaultHypervisor;
         } else {
             return HypervisorType.None;
         }
@@ -4578,7 +4573,8 @@ public ConfigKey<?>[] getConfigKeys() {
         return new ConfigKey<?>[] {
                 KvmSshToAgentEnabled,
                 HOST_MAINTENANCE_LOCAL_STRATEGY,
-                SystemVmPreferredArchitecture
+                SystemVmPreferredArchitecture,
+                SystemVMDefaultHypervisor
         };
     }
 }

From f292143af88f3b77949b04e98c633ffadb3925a2 Mon Sep 17 00:00:00 2001
From: Sinscerly <Sinscerly@users.noreply.github.com>
Date: Tue, 27 Jan 2026 07:47:42 +0100
Subject: [PATCH 027/117] Fix/prometheus metadata sorting (#12112)

* fix prometheus metadata and sorted. Adds in TYPE and HELP

* fix random linting issue
---
 .../metrics/PrometheusExporterImpl.java       | 129 ++++++++++++++----
 1 file changed, 103 insertions(+), 26 deletions(-)

diff --git a/plugins/integrations/prometheus/src/main/java/org/apache/cloudstack/metrics/PrometheusExporterImpl.java b/plugins/integrations/prometheus/src/main/java/org/apache/cloudstack/metrics/PrometheusExporterImpl.java
index 8908bfa000f8..2ed65efd1e8f 100644
--- a/plugins/integrations/prometheus/src/main/java/org/apache/cloudstack/metrics/PrometheusExporterImpl.java
+++ b/plugins/integrations/prometheus/src/main/java/org/apache/cloudstack/metrics/PrometheusExporterImpl.java
@@ -512,20 +512,48 @@ public void updateMetrics() {
     public String getMetrics() {
         final StringBuilder stringBuilder = new StringBuilder();
         stringBuilder.append("# Cloudstack Prometheus Metrics\n");
-        for (final Item item : metricsItems) {
+
+        List<Item> sortedItems = metricsItems.stream()
+            .sorted((item1, item2) -> item1.name.compareTo(item2.name))
+            .collect(Collectors.toList());
+
+        String currentMetricName = null;
+
+        for (Item item : sortedItems) {
+            if (!item.name.equals(currentMetricName)) {
+                currentMetricName = item.name;
+                stringBuilder.append("# HELP ").append(currentMetricName).append(" ")
+                            .append(item.getHelp()).append("\n");
+                stringBuilder.append("# TYPE ").append(currentMetricName).append(" ")
+                            .append(item.getType()).append("\n");
+            }
+
             stringBuilder.append(item.toMetricsString()).append("\n");
         }
+
         return stringBuilder.toString();
     }
 
     private abstract class Item {
         String name;
+        String help;
+        String type;
 
-        public Item(final String nm) {
+        public Item(final String nm, final String hlp, final String tp) {
             name = nm;
+            help = hlp;
+            type = tp;
         }
 
         public abstract String toMetricsString();
+
+        public String getHelp() {
+            return help;
+        }
+
+        public String getType() {
+            return type;
+        }
     }
 
     class ItemVM extends Item {
@@ -535,7 +563,9 @@ class ItemVM extends Item {
         long total;
 
         public ItemVM(final String zn, final String zu, final String st, long cnt) {
-            super("cloudstack_vms_total");
+            super("cloudstack_vms_total",
+                  "Total number of virtual machines",
+                  "gauge");
             zoneName = zn;
             zoneUuid = zu;
             filter = st;
@@ -556,7 +586,9 @@ class ItemVMByTag extends Item {
         String hosttags;
 
         public ItemVMByTag(final String zn, final String zu, final String st, long cnt, final String tags) {
-            super("cloudstack_vms_total_by_tag");
+            super("cloudstack_vms_total_by_tag",
+                  "Total number of virtual machines grouped by host tags",
+                  "gauge");
             zoneName = zn;
             zoneUuid = zu;
             filter = st;
@@ -577,7 +609,9 @@ class ItemVolume extends Item {
         int total;
 
         public ItemVolume(final String zn, final String zu, final String st, int cnt) {
-            super("cloudstack_volumes_total");
+            super("cloudstack_volumes_total",
+                  "Total number of volumes",
+                  "gauge");
             zoneName = zn;
             zoneUuid = zu;
             filter = st;
@@ -598,7 +632,9 @@ class ItemHost extends Item {
         String hosttags;
 
         public ItemHost(final String zn, final String zu, final String st, int cnt, final String tags) {
-            super("cloudstack_hosts_total");
+            super("cloudstack_hosts_total",
+                  "Total number of hosts",
+                  "gauge");
             zoneName = zn;
             zoneUuid = zu;
             state = st;
@@ -610,6 +646,7 @@ public ItemHost(final String zn, final String zu, final String st, int cnt, fina
         public String toMetricsString() {
             if (StringUtils.isNotEmpty(hosttags)) {
                 name = "cloudstack_hosts_total_by_tag";
+                help = "Total number of hosts grouped by tags";
                 return String.format("%s{zone=\"%s\",filter=\"%s\",tags=\"%s\"} %d", name, zoneName, state, hosttags, total);
             }
             return String.format("%s{zone=\"%s\",filter=\"%s\"} %d", name, zoneName, state, total);
@@ -628,7 +665,9 @@ class ItemVMCore extends Item {
         String hosttags;
 
         public ItemVMCore(final String zn, final String zu, final String hn, final String hu, final String hip, final String fl, final Long cr, final int dedicated, final String tags) {
-            super("cloudstack_host_vms_cores_total");
+            super("cloudstack_host_vms_cores_total",
+                  "Total number of VM cores on hosts",
+                  "gauge");
             zoneName = zn;
             zoneUuid = zu;
             hostName = hn;
@@ -649,6 +688,7 @@ public String toMetricsString() {
                     return String.format("%s{zone=\"%s\",filter=\"%s\"} %d", name, zoneName, filter, core);
                 } else {
                     name = "cloudstack_host_vms_cores_total_by_tag";
+                    help = "Total number of VM cores grouped by host tags";
                     return String.format("%s{zone=\"%s\",filter=\"%s\",tags=\"%s\"} %d", name, zoneName, filter, hosttags, core);
                 }
             }
@@ -657,13 +697,14 @@ public String toMetricsString() {
     }
 
     class MissingHostInfo extends Item {
-
         String zoneName;
         String hostName;
         MissingInfoFilter filter;
 
         public MissingHostInfo(String zoneName, String hostname, MissingInfoFilter filter) {
-            super("cloudstack_host_missing_info");
+            super("cloudstack_host_missing_info",
+                  "Hosts with missing capacity or statistics information",
+                  "gauge");
             this.zoneName = zoneName;
             this.hostName = hostname;
             this.filter = filter;
@@ -688,7 +729,9 @@ class ItemHostCpu extends Item {
         String hosttags;
 
         public ItemHostCpu(final String zn, final String zu, final String hn, final String hu, final String hip, final String of, final String fl, final double mh, final int dedicated, final String tags) {
-            super("cloudstack_host_cpu_usage_mhz_total");
+            super("cloudstack_host_cpu_usage_mhz_total",
+                  "Host CPU usage in MHz",
+                  "gauge");
             zoneName = zn;
             zoneUuid = zu;
             hostName = hn;
@@ -708,6 +751,7 @@ public String toMetricsString() {
                     return String.format("%s{zone=\"%s\",filter=\"%s\"} %.2f", name, zoneName, filter, mhertz);
                 } else {
                     name = "cloudstack_host_cpu_usage_mhz_total_by_tag";
+                    help = "Host CPU usage in MHz grouped by host tags";
                     return String.format("%s{zone=\"%s\",filter=\"%s\",tags=\"%s\"} %.2f", name, zoneName, filter, hosttags, mhertz);
                 }
             }
@@ -728,7 +772,9 @@ class ItemHostMemory extends Item {
         String hosttags;
 
         public ItemHostMemory(final String zn, final String zu, final String hn, final String hu, final String hip, final String of, final String fl, final double membytes, final int dedicated, final String tags) {
-            super("cloudstack_host_memory_usage_mibs_total");
+            super("cloudstack_host_memory_usage_mibs_total",
+                  "Host memory usage in MiB",
+                  "gauge");
             zoneName = zn;
             zoneUuid = zu;
             hostName = hn;
@@ -748,6 +794,7 @@ public String toMetricsString() {
                     return String.format("%s{zone=\"%s\",filter=\"%s\"} %.2f", name, zoneName, filter, miBytes);
                 } else {
                     name = "cloudstack_host_memory_usage_mibs_total_by_tag";
+                    help = "Host memory usage in MiB grouped by host tags";
                     return String.format("%s{zone=\"%s\",filter=\"%s\",tags=\"%s\"} %.2f", name, zoneName, filter, hosttags, miBytes);
                 }
             }
@@ -764,7 +811,9 @@ class ItemHostVM extends Item {
         int total;
 
         public ItemHostVM(final String zoneName, final String zoneUuid, final String hostName, final String hostUuid, final String hostIp, final int total) {
-            super("cloudstack_host_vms_total");
+            super("cloudstack_host_vms_total",
+                  "Total number of VMs per host",
+                  "gauge");
             this.zoneName = zoneName;
             this.zoneUuid = zoneUuid;
             this.hostName = hostName;
@@ -790,7 +839,9 @@ class ItemPool extends Item {
         double total;
 
         public ItemPool(final String zn, final String zu, final String pn, final String pa, final String typ, final String of, final String fl, double cnt) {
-            super("cloudstack_storage_pool_gibs_total");
+            super("cloudstack_storage_pool_gibs_total",
+                  "Storage pool capacity in GiB",
+                  "gauge");
             zoneName = zn;
             zoneUuid = zu;
             pname = pn;
@@ -817,7 +868,9 @@ class ItemPrivateIp extends Item {
         int total;
 
         public ItemPrivateIp(final String zn, final String zu, final String fl, int cnt) {
-            super("cloudstack_private_ips_total");
+            super("cloudstack_private_ips_total",
+                  "Total number of private IP addresses",
+                  "gauge");
             zoneName = zn;
             zoneUuid = zu;
             filter = fl;
@@ -837,7 +890,9 @@ class ItemPublicIp extends Item {
         int total;
 
         public ItemPublicIp(final String zn, final String zu, final String fl, int cnt) {
-            super("cloudstack_public_ips_total");
+            super("cloudstack_public_ips_total",
+                  "Total number of public IP addresses",
+                  "gauge");
             zoneName = zn;
             zoneUuid = zu;
             filter = fl;
@@ -857,7 +912,9 @@ class ItemSharedNetworkIp extends Item {
         int total;
 
         public ItemSharedNetworkIp(final String zn, final String zu, final String fl, int cnt) {
-            super("cloudstack_shared_network_ips_total");
+            super("cloudstack_shared_network_ips_total",
+                  "Total number of shared network IP addresses",
+                  "gauge");
             zoneName = zn;
             zoneUuid = zu;
             filter = fl;
@@ -877,7 +934,9 @@ class ItemVlan extends Item {
         int total;
 
         public ItemVlan(final String zn, final String zu, final String fl, int cnt) {
-            super("cloudstack_vlans_total");
+            super("cloudstack_vlans_total",
+                  "Total number of VLANs",
+                  "gauge");
             zoneName = zn;
             zoneUuid = zu;
             filter = fl;
@@ -894,7 +953,9 @@ class ItemDomainLimitCpu extends Item {
         long cores;
 
         public ItemDomainLimitCpu(final long c) {
-            super("cloudstack_domain_limit_cpu_cores_total");
+            super("cloudstack_domain_limit_cpu_cores_total",
+                  "Total CPU core limit across all domains",
+                  "gauge");
             cores = c;
         }
 
@@ -908,7 +969,9 @@ class ItemDomainLimitMemory extends Item {
         long miBytes;
 
         public ItemDomainLimitMemory(final long mb) {
-            super("cloudstack_domain_limit_memory_mibs_total");
+            super("cloudstack_domain_limit_memory_mibs_total",
+                  "Total memory limit in MiB across all domains",
+                  "gauge");
             miBytes = mb;
         }
 
@@ -927,7 +990,9 @@ class ItemHostIsDedicated extends Item {
         int isDedicated;
 
         public ItemHostIsDedicated(final String zoneName, final String zoneUuid, final String hostName, final String hostUuid, final String hostIp, final int isDedicated) {
-            super("cloudstack_host_is_dedicated");
+            super("cloudstack_host_is_dedicated",
+                  "Whether a host is dedicated (1) or not (0)",
+                  "gauge");
             this.zoneName = zoneName;
             this.zoneUuid = zoneUuid;
             this.hostName = hostName;
@@ -949,7 +1014,9 @@ class ItemActiveDomains extends Item {
         int total;
 
         public ItemActiveDomains(final String zn, final String zu, final int cnt) {
-            super("cloudstack_active_domains_total");
+            super("cloudstack_active_domains_total",
+                  "Total number of active domains",
+                  "gauge");
             zoneName = zn;
             zoneUuid = zu;
             total = cnt;
@@ -970,7 +1037,9 @@ class ItemHostDedicatedToAccount extends Item {
 
         public ItemHostDedicatedToAccount(final String zoneName, final String hostName,
                                           final String accountName, final String domainName, int isDedicated) {
-            super("cloudstack_host_dedicated_to_account");
+            super("cloudstack_host_dedicated_to_account",
+                  "Host dedication to specific account",
+                  "gauge");
             this.zoneName = zoneName;
             this.hostName = hostName;
             this.accountName = accountName;
@@ -991,7 +1060,9 @@ class ItemPerDomainResourceLimit extends Item {
         String resourceType;
 
         public ItemPerDomainResourceLimit(final long c, final String domainName, final String resourceType) {
-            super("cloudstack_domain_resource_limit");
+            super("cloudstack_domain_resource_limit",
+                  "Resource limits per domain",
+                  "gauge");
             this.cores = c;
             this.domainName = domainName;
             this.resourceType = resourceType;
@@ -1009,7 +1080,9 @@ class ItemPerDomainResourceCount extends Item {
         String resourceType;
 
         public ItemPerDomainResourceCount(final long mb, final String domainName, final String resourceType) {
-            super("cloudstack_domain_resource_count");
+            super("cloudstack_domain_resource_count",
+                  "Resource usage count per domain",
+                  "gauge");
             this.miBytes = mb;
             this.domainName = domainName;
             this.resourceType = resourceType;
@@ -1027,7 +1100,9 @@ class ItemActiveAccounts extends Item {
         int total;
 
         public ItemActiveAccounts(final String zn, final String zu, final int cnt) {
-            super("cloudstack_active_accounts_total");
+            super("cloudstack_active_accounts_total",
+                  "Total number of active accounts",
+                  "gauge");
             zoneName = zn;
             zoneUuid = zu;
             total = cnt;
@@ -1047,7 +1122,9 @@ class ItemVMsBySize extends Item {
         int total;
 
         public ItemVMsBySize(final String zn, final String zu, final int c, final int m, int cnt) {
-            super("cloudstack_vms_total_by_size");
+            super("cloudstack_vms_total_by_size",
+                  "Total number of VMs grouped by CPU and memory size",
+                  "gauge");
             zoneName = zn;
             zoneUuid = zu;
             cpu = c;

From f73362ae48aea35cab4e457c8364c6de3e978643 Mon Sep 17 00:00:00 2001
From: Vitor Hugo Homem Marzarotto
 <59698484+vits-hugs@users.noreply.github.com>
Date: Tue, 27 Jan 2026 04:13:21 -0300
Subject: [PATCH 028/117] Fix saml bug unable to login (#10868)

* Fix check

* Adds configuration for behaviour, when SAML SSO is disabled for a user

* set default configuration value to false and rename it to enable.login.with.disabled.saml

---------

Co-authored-by: Vitor Hugo Homem Marzarotto <vitor.marzarotto@scclouds.com.br>
Co-authored-by: erikbocks <erik.bock@outlook.com>
---
 .../org/apache/cloudstack/saml/SAML2AuthManager.java     | 3 +++
 .../org/apache/cloudstack/saml/SAML2AuthManagerImpl.java | 9 +++++++--
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/plugins/user-authenticators/saml2/src/main/java/org/apache/cloudstack/saml/SAML2AuthManager.java b/plugins/user-authenticators/saml2/src/main/java/org/apache/cloudstack/saml/SAML2AuthManager.java
index 523f694d80b2..618536a71f66 100644
--- a/plugins/user-authenticators/saml2/src/main/java/org/apache/cloudstack/saml/SAML2AuthManager.java
+++ b/plugins/user-authenticators/saml2/src/main/java/org/apache/cloudstack/saml/SAML2AuthManager.java
@@ -82,6 +82,9 @@ public interface SAML2AuthManager extends PluggableAPIAuthenticator, PluggableSe
     ConfigKey<Boolean> SAMLRequirePasswordLogin = new ConfigKey<Boolean>("Advanced", Boolean.class, "saml2.require.password", "true",
     "When enabled SAML2 will validate that the SAML login was performed with a password.  If disabled, other forms of authentication are allowed (two-factor, certificate, etc) on the SAML Authentication Provider", true);
 
+    ConfigKey<Boolean> EnableLoginAfterSAMLDisable = new ConfigKey<>("Advanced", Boolean.class, "enable.login.with.disabled.saml", "false", "When enabled, if SAML SSO is disabled, enables user to login with user and password, otherwise a user with SAML SSO disabled cannot login", true);
+
+
 
     SAMLProviderMetadata getSPMetadata();
     SAMLProviderMetadata getIdPMetadata(String entityId);
diff --git a/plugins/user-authenticators/saml2/src/main/java/org/apache/cloudstack/saml/SAML2AuthManagerImpl.java b/plugins/user-authenticators/saml2/src/main/java/org/apache/cloudstack/saml/SAML2AuthManagerImpl.java
index 93b7bc5be93b..9f8101b867d4 100644
--- a/plugins/user-authenticators/saml2/src/main/java/org/apache/cloudstack/saml/SAML2AuthManagerImpl.java
+++ b/plugins/user-authenticators/saml2/src/main/java/org/apache/cloudstack/saml/SAML2AuthManagerImpl.java
@@ -451,8 +451,13 @@ public boolean authorizeUser(Long userId, String entityId, boolean enable) {
                 user.setExternalEntity(entityId);
                 user.setSource(User.Source.SAML2);
             } else {
+                boolean enableLoginAfterSAMLDisable =  SAML2AuthManager.EnableLoginAfterSAMLDisable.value();
                 if (user.getSource().equals(User.Source.SAML2)) {
-                    user.setSource(User.Source.SAML2DISABLED);
+                    if(enableLoginAfterSAMLDisable) {
+                        user.setSource(User.Source.UNKNOWN);
+                    } else {
+                        user.setSource(User.Source.SAML2DISABLED);
+                    }
                 } else {
                     return false;
                 }
@@ -541,6 +546,6 @@ public ConfigKey<?>[] getConfigKeys() {
                 SAMLCloudStackRedirectionUrl, SAMLUserAttributeName,
                 SAMLIdentityProviderMetadataURL, SAMLDefaultIdentityProviderId,
                 SAMLSignatureAlgorithm, SAMLAppendDomainSuffix, SAMLTimeout, SAMLCheckSignature,
-                SAMLForceAuthn, SAMLUserSessionKeyPathAttribute, SAMLRequirePasswordLogin};
+                SAMLForceAuthn, SAMLUserSessionKeyPathAttribute, SAMLRequirePasswordLogin, EnableLoginAfterSAMLDisable};
     }
 }

From ff0cfc9148a63d340133beb451afaa4699097f43 Mon Sep 17 00:00:00 2001
From: Nicolas Vazquez <nicovazquez90@gmail.com>
Date: Tue, 27 Jan 2026 04:15:46 -0300
Subject: [PATCH 029/117] Add ability to filter by version for listHosts and
 listMgmtServers APIs (#12472)

* Add ability to filter by version for listHosts and listMgmtServers APIs

* Address review comment

* Fix listMgmtServers API
---
 .../api/command/admin/host/ListHostsCmd.java     |  7 +++++++
 .../command/admin/management/ListMgmtsCmd.java   |  8 ++++++++
 .../com/cloud/api/query/QueryManagerImpl.java    | 16 ++++++++++++++++
 3 files changed, 31 insertions(+)

diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/host/ListHostsCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/host/ListHostsCmd.java
index a73a0d00ffbe..972a9c8950c4 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/host/ListHostsCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/host/ListHostsCmd.java
@@ -109,6 +109,9 @@ public class ListHostsCmd extends BaseListCmd {
     @Parameter(name = ApiConstants.ARCH, type = CommandType.STRING, description = "CPU Arch of the host", since = "4.20.1")
     private String arch;
 
+    @Parameter(name = ApiConstants.VERSION, type = CommandType.STRING, description = "the host version", since = "4.20.3")
+    private String version;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -197,6 +200,10 @@ public CPU.CPUArch getArch() {
         return StringUtils.isBlank(arch) ? null : CPU.CPUArch.fromType(arch);
     }
 
+    public String getVersion() {
+        return version;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/management/ListMgmtsCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/management/ListMgmtsCmd.java
index ecc59f7cab86..293cb34e7028 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/management/ListMgmtsCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/management/ListMgmtsCmd.java
@@ -45,6 +45,10 @@ public class ListMgmtsCmd extends BaseListCmd {
             since = "4.20.1.0")
     private Boolean peers;
 
+    @Parameter(name = ApiConstants.VERSION, type = CommandType.STRING,
+            description = "the version of the management server", since = "4.20.3")
+    private String version;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -61,6 +65,10 @@ public Boolean getPeers() {
         return BooleanUtils.toBooleanDefaultIfNull(peers, false);
     }
 
+    public String getVersion() {
+        return version;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
index 5833ede550e7..a89a1eed87bf 100644
--- a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
+++ b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
@@ -2309,6 +2309,7 @@ public Pair<List<Long>, Integer> searchForServerIdsAndCount(ListHostsCmd cmd) {
         Long pageSize = cmd.getPageSizeVal();
         Hypervisor.HypervisorType hypervisorType = cmd.getHypervisor();
         final CPU.CPUArch arch = cmd.getArch();
+        String version = cmd.getVersion();
 
         Filter searchFilter = new Filter(HostVO.class, "id", Boolean.TRUE, startIndex, pageSize);
 
@@ -2325,11 +2326,13 @@ public Pair<List<Long>, Integer> searchForServerIdsAndCount(ListHostsCmd cmd) {
         hostSearchBuilder.and("resourceState", hostSearchBuilder.entity().getResourceState(), SearchCriteria.Op.EQ);
         hostSearchBuilder.and("hypervisor_type", hostSearchBuilder.entity().getHypervisorType(), SearchCriteria.Op.EQ);
         hostSearchBuilder.and("arch", hostSearchBuilder.entity().getArch(), SearchCriteria.Op.EQ);
+        hostSearchBuilder.and("version", hostSearchBuilder.entity().getVersion(), SearchCriteria.Op.EQ);
 
         if (keyword != null) {
             hostSearchBuilder.and().op("keywordName", hostSearchBuilder.entity().getName(), SearchCriteria.Op.LIKE);
             hostSearchBuilder.or("keywordStatus", hostSearchBuilder.entity().getStatus(), SearchCriteria.Op.LIKE);
             hostSearchBuilder.or("keywordType", hostSearchBuilder.entity().getType(), SearchCriteria.Op.LIKE);
+            hostSearchBuilder.or("keywordVersion", hostSearchBuilder.entity().getVersion(), SearchCriteria.Op.LIKE);
             hostSearchBuilder.cp();
         }
 
@@ -2360,6 +2363,7 @@ public Pair<List<Long>, Integer> searchForServerIdsAndCount(ListHostsCmd cmd) {
             sc.setParameters("keywordName", "%" + keyword + "%");
             sc.setParameters("keywordStatus", "%" + keyword + "%");
             sc.setParameters("keywordType", "%" + keyword + "%");
+            sc.setParameters("keywordVersion", "%" + keyword + "%");
         }
 
         if (id != null) {
@@ -2409,6 +2413,10 @@ public Pair<List<Long>, Integer> searchForServerIdsAndCount(ListHostsCmd cmd) {
             sc.setParameters("arch", arch);
         }
 
+        if (version != null) {
+            sc.setParameters("version", version);
+        }
+
         Pair<List<HostVO>, Integer> uniqueHostPair = hostDao.searchAndCount(sc, searchFilter);
         Integer count = uniqueHostPair.second();
         List<Long> hostIds = uniqueHostPair.first().stream().map(HostVO::getId).collect(Collectors.toList());
@@ -5397,6 +5405,8 @@ public ListResponse<ManagementServerResponse> listManagementServers(ListMgmtsCmd
     protected Pair<List<ManagementServerJoinVO>, Integer> listManagementServersInternal(ListMgmtsCmd cmd) {
         Long id = cmd.getId();
         String name = cmd.getHostName();
+        String version = cmd.getVersion();
+        String keyword = cmd.getKeyword();
 
         SearchBuilder<ManagementServerJoinVO> sb = managementServerJoinDao.createSearchBuilder();
         SearchCriteria<ManagementServerJoinVO> sc = sb.create();
@@ -5406,6 +5416,12 @@ protected Pair<List<ManagementServerJoinVO>, Integer> listManagementServersInter
         if (name != null) {
             sc.addAnd("name", SearchCriteria.Op.EQ, name);
         }
+        if (version != null) {
+            sc.addAnd("version", SearchCriteria.Op.EQ, version);
+        }
+        if (keyword != null) {
+            sc.addAnd("version", SearchCriteria.Op.LIKE, "%" + keyword + "%");
+        }
         return managementServerJoinDao.searchAndCount(sc, null);
     }
 

From ca076637183dc827afc052c755b489c9c985160a Mon Sep 17 00:00:00 2001
From: Abhisar Sinha <63767682+abh1sar@users.noreply.github.com>
Date: Tue, 27 Jan 2026 13:23:17 +0530
Subject: [PATCH 030/117] Show backup offerings with
 userDrivenBackupsAllowed=false to all users (#11889)

---
 .../org/apache/cloudstack/backup/BackupManagerImpl.java   | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java b/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
index ef3ba917de74..c0955e40d2c3 100644
--- a/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
@@ -314,11 +314,6 @@ public Pair<List<BackupOffering>, Integer> listBackupOfferings(final ListBackupO
         SearchBuilder<BackupOfferingVO> sb = backupOfferingDao.createSearchBuilder();
         sb.and("zone_id", sb.entity().getZoneId(), SearchCriteria.Op.EQ);
         sb.and("name", sb.entity().getName(), SearchCriteria.Op.EQ);
-        CallContext ctx = CallContext.current();
-        final Account caller = ctx.getCallingAccount();
-        if (Account.Type.NORMAL == caller.getType()) {
-            sb.and("user_backups_allowed", sb.entity().isUserDrivenBackupAllowed(), SearchCriteria.Op.EQ);
-        }
         final SearchCriteria<BackupOfferingVO> sc = sb.create();
 
         if (zoneId != null) {
@@ -328,9 +323,6 @@ public Pair<List<BackupOffering>, Integer> listBackupOfferings(final ListBackupO
         if (keyword != null) {
             sc.setParameters("name", "%" + keyword + "%");
         }
-        if (Account.Type.NORMAL == caller.getType()) {
-            sc.setParameters("user_backups_allowed", true);
-        }
         Pair<List<BackupOfferingVO>, Integer> result = backupOfferingDao.searchAndCount(sc, searchFilter);
         return new Pair<>(new ArrayList<>(result.first()), result.second());
     }

From cabd9a98e13f0b7b926391c52ea29730d554088c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Erik=20B=C3=B6ck?=
 <89930804+erikbocks@users.noreply.github.com>
Date: Tue, 27 Jan 2026 04:59:12 -0300
Subject: [PATCH 031/117] Implemented auto refresh button for VM metrics
 (#10900)

* added auto refresh button for vm metrics

* refactored getStartDate method and fixed auto refresh date period not being update

* switch variables from var to const
---
 ui/public/locales/en.json           |  2 +
 ui/public/locales/pt_BR.json        |  8 ++++
 ui/src/components/view/StatsTab.vue | 68 ++++++++++++++++++-----------
 3 files changed, 53 insertions(+), 25 deletions(-)

diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index 4834ad989522..8253bbd87bcf 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -436,6 +436,8 @@
 "label.auto.assign": "Automatically assign",
 "label.auto.assign.diskoffering.disk.size": "Automatically assign offering matching the disk size",
 "label.auto.assign.random.ip": "Automatically assign a random IP address",
+"label.auto.refresh.statistics": "Period between auto refreshes",
+"label.auto.refresh.statistics.none": "None",
 "label.automigrate.volume": "Auto migrate volume to another storage pool if required",
 "label.autoscale.vm.groups": "AutoScaling Groups",
 "label.autoscale.vm.profile": "AutoScale Instance Profile",
diff --git a/ui/public/locales/pt_BR.json b/ui/public/locales/pt_BR.json
index 44347b1f251f..c82a9e3c952d 100644
--- a/ui/public/locales/pt_BR.json
+++ b/ui/public/locales/pt_BR.json
@@ -288,6 +288,8 @@
 "label.author.name": "Nome do autor",
 "label.auto.assign.diskoffering.disk.size": "Atribuir automaticamente a oferta correspondente ao tamanho do disco",
 "label.auto.assign.random.ip": "Atribuir automaticamente um enderec\u0327o de IP aleat\u00f3rio",
+"label.auto.refresh.statistics": "Tempo entre atualiza\u00e7\u00f5es autom\u00e1ticas",
+"label.auto.refresh.statistics.none": "Nenhum",
 "label.autoscalingenabled": "Escalonamento autom\u00e1tico",
 "label.availability": "Disponibilidade",
 "label.available": "Dispon\u00edvel",
@@ -610,6 +612,12 @@
 "label.download.state": "Estado do download",
 "label.dpd": "Detec\u00e7\u00e3o de correspondente morto",
 "label.driver": "Driver",
+"label.duration.custom": "Personalizado",
+"label.duration.1hour": "1 hora",
+"label.duration.6hours": "6 horas",
+"label.duration.12hours": "12 horas",
+"label.duration.24hours": "24 horas",
+"label.duration.7days": "7 dias",
 "label.dynamicscalingenabled": "Escalonamento din\u00e2mico habilitado",
 "label.dynamicscalingenabled.tooltip": "VM s\u00f3 pode ser dinamicamente escalonada quando o escalonamento din\u00e2mico estiver habilitado no template, oferta de computa\u00e7\u00e3o e nas configura\u00e7\u00e3oes globais",
 "label.edit": "Editar",
diff --git a/ui/src/components/view/StatsTab.vue b/ui/src/components/view/StatsTab.vue
index 8703b6b995de..d8739ece6c14 100644
--- a/ui/src/components/view/StatsTab.vue
+++ b/ui/src/components/view/StatsTab.vue
@@ -41,9 +41,9 @@
           <a-radio-group
             v-model:value="durationSelectorValue"
             buttonStyle="solid"
-            @change="handleDurationChange">
+            @change="updateVirtualMachineStats">
             <a-radio-button value="">
-              {{ $t('1 hour') }}
+              {{ $t('label.duration.1hour') }}
             </a-radio-button>
             <a-radio-button value="6hours" v-if="statsRetentionTime >= 60">
               {{ $t('label.duration.6hours') }}
@@ -62,6 +62,16 @@
             </a-radio-button>
           </a-radio-group>
           <InfoCircleOutlined class="info-icon" :title="$t('label.see.more.info.shown.charts')" @click="onClickShowResourceInfoModal('CHART')"/>
+          <span>{{$t('label.auto.refresh.statistics')}}</span>
+          <a-select
+            v-model:value="refreshTime"
+            style="width: 100px">
+            <a-select-option value="0">{{$t('label.auto.refresh.statistics.none')}}</a-select-option>
+            <a-select-option value="5000">5s</a-select-option>
+            <a-select-option value="30000">30s</a-select-option>
+            <a-select-option value="60000">1min</a-select-option>
+            <a-select-option value="300000">5min</a-select-option>
+          </a-select>
         </div>
         <div class="ant-tag" v-if="durationSelectorValue==='custom'">
           <a-button @click="openFilter()">
@@ -297,6 +307,8 @@ export default {
       selectedDiskUnitOfMeasurement: 'KiB',
       diskUnitsOfMeasurement: ['KiB', 'MiB', 'GiB'],
       chartLabels: [],
+      refreshTime: '0',
+      refreshIntervalId: null,
       resourceUsageHistory: {
         cpu: [],
         memory: {
@@ -334,6 +346,9 @@ export default {
   mounted () {
     this.fetchData()
   },
+  unmounted () {
+    window.clearInterval(this.refreshIntervalId)
+  },
   computed: {
     statsRetentionTime () {
       if (this.resourceType === 'Volume') {
@@ -371,6 +386,15 @@ export default {
         return
       }
       this.fetchData()
+    },
+    refreshTime: function () {
+      this.updateVirtualMachineStats()
+      if (this.refreshTime === '0') return window.clearInterval(this.refreshIntervalId)
+
+      window.clearInterval(this.refreshIntervalId)
+      this.refreshIntervalId = window.setInterval(() => {
+        this.updateVirtualMachineStats()
+      }, parseInt(this.refreshTime))
     }
   },
   methods: {
@@ -398,26 +422,10 @@ export default {
       this.resourceTypeToShowInfo = resource
       this.showResourceInfoModal = true
     },
-    handleDurationChange () {
-      var now = this.getEndDate()
-      var start = new Date(now)
-      switch (this.durationSelectorValue) {
-        case '6hours':
-          start.setHours(start.getHours() - 6)
-          break
-        case '12hours':
-          start.setHours(start.getHours() - 12)
-          break
-        case 'day':
-          start.setDate(start.getDate() - 1)
-          break
-        case 'week':
-          start.setDate(start.getDate() - 7)
-          break
-        default:
-          start.setHours(start.getHours() - 1)
-      }
-      this.handleSubmit({ startDate: start, endDate: now })
+    updateVirtualMachineStats () {
+      const start = this.getStartDate()
+      const end = this.getEndDate()
+      this.handleSubmit({ startDate: start, endDate: end })
     },
     handleSubmit (values) {
       if (values.startDate) {
@@ -437,9 +445,19 @@ export default {
       this.showFilterStatsModal = false
     },
     getStartDate () {
-      var now = new Date()
-      now.setHours(now.getHours() - 1)
-      return now
+      const now = new Date()
+      switch (this.durationSelectorValue) {
+        case '6hours':
+          return now.setHours(now.getHours() - 6)
+        case '12hours':
+          return now.setHours(now.getHours() - 12)
+        case 'day':
+          return now.setDate(now.getDate() - 1)
+        case 'week':
+          return now.setDate(now.getDate() - 7)
+        default:
+          return now.setHours(now.getHours() - 1)
+      }
     },
     getEndDate () {
       return new Date()

From fce69fbfe0b723dd81e2120c1cbc4732b41098f2 Mon Sep 17 00:00:00 2001
From: Nicolas Vazquez <nicovazquez90@gmail.com>
Date: Tue, 27 Jan 2026 05:27:43 -0300
Subject: [PATCH 032/117] VM Power state optimization (#12463)

* Publish VM Power state optimization (PowerReportMissing)

* Fix logging
---
 .../java/com/cloud/vm/VirtualMachinePowerStateSyncImpl.java | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachinePowerStateSyncImpl.java b/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachinePowerStateSyncImpl.java
index 7a1a39ec0f07..475ed0f37bd2 100644
--- a/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachinePowerStateSyncImpl.java
+++ b/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachinePowerStateSyncImpl.java
@@ -89,7 +89,7 @@ protected void updateAndPublishVmPowerStates(long hostId, Map<Long, VirtualMachi
             return;
         }
         for (Long vmId : vmIds) {
-            if (!notUpdated.containsKey(vmId)) {
+            if (MapUtils.isEmpty(notUpdated) || !notUpdated.containsKey(vmId)) {
                 logger.debug("VM state report is updated. {}, {}, power state: {}",
                         () -> hostCache.get(hostId), () -> vmCache.get(vmId), () -> instancePowerStates.get(vmId));
                 _messageBus.publish(null, VirtualMachineManager.Topics.VM_POWER_STATE,
@@ -158,8 +158,8 @@ private void processMissingVmReport(long hostId, Set<Long> vmIds, boolean force)
                 // an update might have occurred that we should not override in case of out of band migration
                 instancePowerStates.put(instance.getId(), VirtualMachine.PowerState.PowerReportMissing);
             } else {
-                logger.debug("vm id: {} - time since last state update({} ms) has not passed graceful period yet",
-                        instance.getId(), milliSecondsSinceLastStateUpdate);
+                logger.debug("vm id: {} - time since last state update({} ms) has not passed graceful period ({} ms) yet",
+                        instance.getId(), milliSecondsSinceLastStateUpdate, milliSecondsGracefulPeriod);
             }
         }
         updateAndPublishVmPowerStates(hostId, instancePowerStates, startTime);

From 0458c5328bf03c1a2f4d291a2e3895e158e7abd7 Mon Sep 17 00:00:00 2001
From: Fabricio Duarte <fabricio.duarte.jr@gmail.com>
Date: Tue, 27 Jan 2026 06:05:09 -0300
Subject: [PATCH 033/117] Consider secondary storage selectors during template
 synchronization (#10956)

* Consider secondary storage selectors during template synchronization

* Fix checkstyle

* Remove unused import
---
 .../com/cloud/template/TemplateManager.java   |  2 +
 .../storage/image/TemplateServiceImpl.java    | 37 ++++++++++---
 .../image/TemplateServiceImplTest.java        | 55 +++++++++++--------
 .../template/HypervisorTemplateAdapter.java   | 15 +----
 .../cloud/template/TemplateManagerImpl.java   | 11 ++++
 .../HypervisorTemplateAdapterTest.java        | 27 +--------
 .../template/TemplateManagerImplTest.java     | 20 +++++++
 7 files changed, 97 insertions(+), 70 deletions(-)

diff --git a/engine/components-api/src/main/java/com/cloud/template/TemplateManager.java b/engine/components-api/src/main/java/com/cloud/template/TemplateManager.java
index 7191bd5b1d7e..1dde19d7a5d1 100644
--- a/engine/components-api/src/main/java/com/cloud/template/TemplateManager.java
+++ b/engine/components-api/src/main/java/com/cloud/template/TemplateManager.java
@@ -152,6 +152,8 @@ public interface TemplateManager {
 
     TemplateType validateTemplateType(BaseCmd cmd, boolean isAdmin, boolean isCrossZones);
 
+    DataStore verifyHeuristicRulesForZone(VMTemplateVO template, Long zoneId);
+
     List<DatadiskTO> getTemplateDisksOnImageStore(VirtualMachineTemplate template, DataStoreRole role, String configurationId);
 
     static Boolean getValidateUrlIsResolvableBeforeRegisteringTemplateValue() {
diff --git a/engine/storage/image/src/main/java/org/apache/cloudstack/storage/image/TemplateServiceImpl.java b/engine/storage/image/src/main/java/org/apache/cloudstack/storage/image/TemplateServiceImpl.java
index c18be7c73355..bee62955051a 100644
--- a/engine/storage/image/src/main/java/org/apache/cloudstack/storage/image/TemplateServiceImpl.java
+++ b/engine/storage/image/src/main/java/org/apache/cloudstack/storage/image/TemplateServiceImpl.java
@@ -290,21 +290,41 @@ public void handleSysTemplateDownload(HypervisorType hostHyper, Long dcId) {
         }
     }
 
-    protected boolean isSkipTemplateStoreDownload(VMTemplateVO template, Long zoneId) {
-        if (template.isPublicTemplate()) {
+    protected boolean shouldDownloadTemplateToStore(VMTemplateVO template, DataStore store) {
+        Long zoneId = store.getScope().getScopeId();
+        DataStore directedStore = _tmpltMgr.verifyHeuristicRulesForZone(template, zoneId);
+        if (directedStore != null && store.getId() != directedStore.getId()) {
+            logger.info("Template [{}] will not be download to image store [{}], as a heuristic rule is directing it to another store.",
+                    template.getUniqueName(), store.getName());
             return false;
         }
+
+        if (template.isPublicTemplate()) {
+            logger.debug("Download of template [{}] to image store [{}] cannot be skipped, as it is public.", template.getUniqueName(),
+                    store.getName());
+            return true;
+        }
+
         if (template.isFeatured()) {
-            return false;
+            logger.debug("Download of template [{}] to image store [{}] cannot be skipped, as it is featured.", template.getUniqueName(),
+                    store.getName());
+            return true;
         }
+
         if (TemplateType.SYSTEM.equals(template.getTemplateType())) {
-            return false;
+            logger.debug("Download of template [{}] to image store [{}] cannot be skipped, as it is a system VM template.",
+                    template.getUniqueName(),store.getName());
+            return true;
         }
+
         if (zoneId != null &&  _vmTemplateStoreDao.findByTemplateZone(template.getId(), zoneId, DataStoreRole.Image) == null) {
-            logger.debug("Template {} is not present on any image store for the zone ID: {}, its download cannot be skipped", template, zoneId);
-            return false;
+            logger.debug("Download of template [{}] to image store [{}] cannot be skipped, as it is not present on any image store of zone [{}].",
+                    template.getUniqueName(), store.getName(), zoneId);
+            return true;
         }
-        return true;
+
+        logger.info("Skipping download of template [{}] to image store [{}].", template.getUniqueName(), store.getName());
+        return false;
     }
 
     @Override
@@ -531,8 +551,7 @@ public void handleTemplateSync(DataStore store) {
                         // download.
                         for (VMTemplateVO tmplt : toBeDownloaded) {
                             // if this is private template, skip sync to a new image store
-                            if (isSkipTemplateStoreDownload(tmplt, zoneId)) {
-                                logger.info("Skip sync downloading private template {} to a new image store", tmplt);
+                            if (!shouldDownloadTemplateToStore(tmplt, store)) {
                                 continue;
                             }
 
diff --git a/engine/storage/image/src/test/java/org/apache/cloudstack/storage/image/TemplateServiceImplTest.java b/engine/storage/image/src/test/java/org/apache/cloudstack/storage/image/TemplateServiceImplTest.java
index 276581e2e482..cb7994915b34 100644
--- a/engine/storage/image/src/test/java/org/apache/cloudstack/storage/image/TemplateServiceImplTest.java
+++ b/engine/storage/image/src/test/java/org/apache/cloudstack/storage/image/TemplateServiceImplTest.java
@@ -19,6 +19,7 @@
 package org.apache.cloudstack.storage.image;
 
 import com.cloud.storage.template.TemplateProp;
+import com.cloud.template.TemplateManager;
 import org.apache.cloudstack.engine.orchestration.service.StorageOrchestrationService;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreManager;
@@ -70,6 +71,9 @@ public class TemplateServiceImplTest {
     @Mock
     TemplateObject templateInfoMock;
 
+    @Mock
+    DataStore dataStoreMock;
+
     @Mock
     DataStore sourceStoreMock;
 
@@ -82,6 +86,9 @@ public class TemplateServiceImplTest {
     @Mock
     StorageOrchestrationService storageOrchestrator;
 
+    @Mock
+    TemplateManager templateManagerMock;
+
     Map<String, TemplateProp> templatesInSourceStore = new HashMap<>();
 
     @Before
@@ -96,45 +103,45 @@ public void setUp() {
         Mockito.doReturn(null).when(templateService).listTemplate(destStoreMock);
         Mockito.doReturn("install-path").when(templateInfoMock).getInstallPath();
         Mockito.doReturn(templateInfoMock).when(templateDataFactoryMock).getTemplate(2L, sourceStoreMock);
+        Mockito.doReturn(3L).when(dataStoreMock).getId();
+        Mockito.doReturn(zoneScopeMock).when(dataStoreMock).getScope();
+    }
+
+    @Test
+    public void shouldDownloadTemplateToStoreTestSkipsTemplateDirectedToAnotherStorage() {
+        DataStore destinedStore = Mockito.mock(DataStore.class);
+        Mockito.doReturn(dataStoreMock.getId() + 1L).when(destinedStore).getId();
+        Mockito.when(templateManagerMock.verifyHeuristicRulesForZone(tmpltMock, zoneScopeMock.getScopeId())).thenReturn(destinedStore);
+        Assert.assertFalse(templateService.shouldDownloadTemplateToStore(tmpltMock, dataStoreMock));
     }
 
     @Test
-    public void testIsSkipTemplateStoreDownloadPublicTemplate() {
-        VMTemplateVO templateVO = Mockito.mock(VMTemplateVO.class);
-        Mockito.when(templateVO.isPublicTemplate()).thenReturn(true);
-        Assert.assertFalse(templateService.isSkipTemplateStoreDownload(templateVO, 1L));
+    public void shouldDownloadTemplateToStoreTestDownloadsPublicTemplate() {
+        Mockito.when(tmpltMock.isPublicTemplate()).thenReturn(true);
+        Assert.assertTrue(templateService.shouldDownloadTemplateToStore(tmpltMock, dataStoreMock));
     }
 
     @Test
-    public void testIsSkipTemplateStoreDownloadFeaturedTemplate() {
-        VMTemplateVO templateVO = Mockito.mock(VMTemplateVO.class);
-        Mockito.when(templateVO.isFeatured()).thenReturn(true);
-        Assert.assertFalse(templateService.isSkipTemplateStoreDownload(templateVO, 1L));
+    public void shouldDownloadTemplateToStoreTestDownloadsFeaturedTemplate() {
+        Mockito.when(tmpltMock.isFeatured()).thenReturn(true);
+        Assert.assertTrue(templateService.shouldDownloadTemplateToStore(tmpltMock, dataStoreMock));
     }
 
     @Test
-    public void testIsSkipTemplateStoreDownloadSystemTemplate() {
-        VMTemplateVO templateVO = Mockito.mock(VMTemplateVO.class);
-        Mockito.when(templateVO.getTemplateType()).thenReturn(Storage.TemplateType.SYSTEM);
-        Assert.assertFalse(templateService.isSkipTemplateStoreDownload(templateVO, 1L));
+    public void shouldDownloadTemplateToStoreTestDownloadsSystemTemplate() {
+        Mockito.when(tmpltMock.getTemplateType()).thenReturn(Storage.TemplateType.SYSTEM);
+        Assert.assertTrue(templateService.shouldDownloadTemplateToStore(tmpltMock, dataStoreMock));
     }
 
     @Test
-    public void testIsSkipTemplateStoreDownloadPrivateNoRefTemplate() {
-        VMTemplateVO templateVO = Mockito.mock(VMTemplateVO.class);
-        long id = 1L;
-        Mockito.when(templateVO.getId()).thenReturn(id);
-        Mockito.when(templateDataStoreDao.findByTemplateZone(id, id, DataStoreRole.Image)).thenReturn(null);
-        Assert.assertFalse(templateService.isSkipTemplateStoreDownload(templateVO, id));
+    public void shouldDownloadTemplateToStoreTestDownloadsPrivateNoRefTemplate() {
+        Assert.assertTrue(templateService.shouldDownloadTemplateToStore(tmpltMock, dataStoreMock));
     }
 
     @Test
-    public void testIsSkipTemplateStoreDownloadPrivateExistingTemplate() {
-        VMTemplateVO templateVO = Mockito.mock(VMTemplateVO.class);
-        long id = 1L;
-        Mockito.when(templateVO.getId()).thenReturn(id);
-        Mockito.when(templateDataStoreDao.findByTemplateZone(id, id, DataStoreRole.Image)).thenReturn(Mockito.mock(TemplateDataStoreVO.class));
-        Assert.assertTrue(templateService.isSkipTemplateStoreDownload(templateVO, id));
+    public void shouldDownloadTemplateToStoreTestSkipsPrivateExistingTemplate() {
+        Mockito.when(templateDataStoreDao.findByTemplateZone(tmpltMock.getId(), zoneScopeMock.getScopeId(), DataStoreRole.Image)).thenReturn(Mockito.mock(TemplateDataStoreVO.class));
+        Assert.assertFalse(templateService.shouldDownloadTemplateToStore(tmpltMock, dataStoreMock));
     }
 
     @Test
diff --git a/server/src/main/java/com/cloud/template/HypervisorTemplateAdapter.java b/server/src/main/java/com/cloud/template/HypervisorTemplateAdapter.java
index fb4ea94ae3df..1422e788e24c 100644
--- a/server/src/main/java/com/cloud/template/HypervisorTemplateAdapter.java
+++ b/server/src/main/java/com/cloud/template/HypervisorTemplateAdapter.java
@@ -61,7 +61,6 @@
 import org.apache.cloudstack.framework.async.AsyncRpcContext;
 import org.apache.cloudstack.framework.messagebus.MessageBus;
 import org.apache.cloudstack.framework.messagebus.PublishScope;
-import org.apache.cloudstack.secstorage.heuristics.HeuristicType;
 import org.apache.cloudstack.storage.command.TemplateOrVolumePostUploadCommand;
 import org.apache.cloudstack.storage.datastore.db.TemplateDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.TemplateDataStoreVO;
@@ -308,7 +307,7 @@ protected void createTemplateWithinZones(TemplateProfile profile, VMTemplateVO t
 
 
         for (long zoneId : zonesIds) {
-            DataStore imageStore = verifyHeuristicRulesForZone(template, zoneId);
+            DataStore imageStore = templateMgr.verifyHeuristicRulesForZone(template, zoneId);
 
             if (imageStore == null) {
                 List<DataStore> imageStores = getImageStoresThrowsExceptionIfNotFound(zoneId, profile);
@@ -327,16 +326,6 @@ protected List<DataStore> getImageStoresThrowsExceptionIfNotFound(long zoneId, T
         return imageStores;
     }
 
-    protected DataStore verifyHeuristicRulesForZone(VMTemplateVO template, Long zoneId) {
-        HeuristicType heuristicType;
-        if (ImageFormat.ISO.equals(template.getFormat())) {
-            heuristicType = HeuristicType.ISO;
-        } else {
-            heuristicType = HeuristicType.TEMPLATE;
-        }
-        return heuristicRuleHelper.getImageStoreIfThereIsHeuristicRule(zoneId, heuristicType, template);
-    }
-
     protected void standardImageStoreAllocation(List<DataStore> imageStores, VMTemplateVO template) {
         Set<Long> zoneSet = new HashSet<Long>();
         Collections.shuffle(imageStores);
@@ -432,7 +421,7 @@ public List<TemplateOrVolumePostUploadCommand> doInTransaction(TransactionStatus
                 }
 
                 Long zoneId = zoneIdList.get(0);
-                DataStore imageStore = verifyHeuristicRulesForZone(template, zoneId);
+                DataStore imageStore = templateMgr.verifyHeuristicRulesForZone(template, zoneId);
                 List<TemplateOrVolumePostUploadCommand> payloads = new LinkedList<>();
 
                 if (imageStore == null) {
diff --git a/server/src/main/java/com/cloud/template/TemplateManagerImpl.java b/server/src/main/java/com/cloud/template/TemplateManagerImpl.java
index 2c7d2d593e3e..5773410c35ad 100755
--- a/server/src/main/java/com/cloud/template/TemplateManagerImpl.java
+++ b/server/src/main/java/com/cloud/template/TemplateManagerImpl.java
@@ -2356,6 +2356,17 @@ public TemplateType validateTemplateType(BaseCmd cmd, boolean isAdmin, boolean i
         return templateType;
     }
 
+    @Override
+    public DataStore verifyHeuristicRulesForZone(VMTemplateVO template, Long zoneId) {
+        HeuristicType heuristicType;
+        if (ImageFormat.ISO.equals(template.getFormat())) {
+            heuristicType = HeuristicType.ISO;
+        } else {
+            heuristicType = HeuristicType.TEMPLATE;
+        }
+        return heuristicRuleHelper.getImageStoreIfThereIsHeuristicRule(zoneId, heuristicType, template);
+    }
+
     void validateDetails(VMTemplateVO template, Map<String, String> details) {
         if (MapUtils.isEmpty(details)) {
             return;
diff --git a/server/src/test/java/com/cloud/template/HypervisorTemplateAdapterTest.java b/server/src/test/java/com/cloud/template/HypervisorTemplateAdapterTest.java
index 2a6d7af434a3..e2a97be469ff 100644
--- a/server/src/test/java/com/cloud/template/HypervisorTemplateAdapterTest.java
+++ b/server/src/test/java/com/cloud/template/HypervisorTemplateAdapterTest.java
@@ -49,7 +49,6 @@
 import org.apache.cloudstack.framework.events.Event;
 import org.apache.cloudstack.framework.events.EventDistributor;
 import org.apache.cloudstack.framework.messagebus.MessageBus;
-import org.apache.cloudstack.secstorage.heuristics.HeuristicType;
 import org.apache.cloudstack.storage.datastore.db.TemplateDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.TemplateDataStoreVO;
 import org.apache.cloudstack.storage.heuristics.HeuristicRuleHelper;
@@ -339,7 +338,7 @@ public void createTemplateWithinZonesTestZoneIdsNotNullShouldNotCallListAllZones
 
         Mockito.when(templateProfileMock.getZoneIdList()).thenReturn(zoneIds);
         Mockito.doReturn(null).when(_adapter).getImageStoresThrowsExceptionIfNotFound(Mockito.any(Long.class), Mockito.any(TemplateProfile.class));
-        Mockito.doReturn(null).when(_adapter).verifyHeuristicRulesForZone(Mockito.any(VMTemplateVO.class), Mockito.anyLong());
+        Mockito.doReturn(null).when(_templateMgr).verifyHeuristicRulesForZone(Mockito.any(VMTemplateVO.class), Mockito.anyLong());
         Mockito.doNothing().when(_adapter).standardImageStoreAllocation(Mockito.isNull(), Mockito.any(VMTemplateVO.class));
 
         _adapter.createTemplateWithinZones(templateProfileMock, vmTemplateVOMock);
@@ -355,7 +354,7 @@ public void createTemplateWithinZonesTestZoneDoesNotHaveActiveHeuristicRulesShou
 
         Mockito.when(templateProfileMock.getZoneIdList()).thenReturn(zoneIds);
         Mockito.doReturn(null).when(_adapter).getImageStoresThrowsExceptionIfNotFound(Mockito.any(Long.class), Mockito.any(TemplateProfile.class));
-        Mockito.doReturn(null).when(_adapter).verifyHeuristicRulesForZone(Mockito.any(VMTemplateVO.class), Mockito.anyLong());
+        Mockito.doReturn(null).when(_templateMgr).verifyHeuristicRulesForZone(Mockito.any(VMTemplateVO.class), Mockito.anyLong());
         Mockito.doNothing().when(_adapter).standardImageStoreAllocation(Mockito.isNull(), Mockito.any(VMTemplateVO.class));
 
         _adapter.createTemplateWithinZones(templateProfileMock, vmTemplateVOMock);
@@ -371,7 +370,7 @@ public void createTemplateWithinZonesTestZoneWithHeuristicRuleShouldCallValidate
         List<Long> zoneIds = List.of(1L);
 
         Mockito.when(templateProfileMock.getZoneIdList()).thenReturn(zoneIds);
-        Mockito.doReturn(dataStoreMock).when(_adapter).verifyHeuristicRulesForZone(Mockito.any(VMTemplateVO.class), Mockito.anyLong());
+        Mockito.doReturn(dataStoreMock).when(_templateMgr).verifyHeuristicRulesForZone(Mockito.any(VMTemplateVO.class), Mockito.anyLong());
         Mockito.doNothing().when(_adapter).validateSecondaryStorageAndCreateTemplate(Mockito.any(List.class), Mockito.any(VMTemplateVO.class), Mockito.isNull());
 
         _adapter.createTemplateWithinZones(templateProfileMock, vmTemplateVOMock);
@@ -409,26 +408,6 @@ public void getImageStoresThrowsExceptionIfNotFoundTestNonEmptyImageStoreShouldN
         _adapter.getImageStoresThrowsExceptionIfNotFound(zoneId, templateProfileMock);
     }
 
-    @Test
-    public void verifyHeuristicRulesForZoneTestTemplateIsISOFormatShouldCheckForISOHeuristicType() {
-        VMTemplateVO vmTemplateVOMock = Mockito.mock(VMTemplateVO.class);
-
-        Mockito.when(vmTemplateVOMock.getFormat()).thenReturn(ImageFormat.ISO);
-        _adapter.verifyHeuristicRulesForZone(vmTemplateVOMock, 1L);
-
-        Mockito.verify(heuristicRuleHelperMock, Mockito.times(1)).getImageStoreIfThereIsHeuristicRule(1L, HeuristicType.ISO, vmTemplateVOMock);
-    }
-
-    @Test
-    public void verifyHeuristicRulesForZoneTestTemplateNotISOFormatShouldCheckForTemplateHeuristicType() {
-        VMTemplateVO vmTemplateVOMock = Mockito.mock(VMTemplateVO.class);
-
-        Mockito.when(vmTemplateVOMock.getFormat()).thenReturn(ImageFormat.QCOW2);
-        _adapter.verifyHeuristicRulesForZone(vmTemplateVOMock, 1L);
-
-        Mockito.verify(heuristicRuleHelperMock, Mockito.times(1)).getImageStoreIfThereIsHeuristicRule(1L, HeuristicType.TEMPLATE, vmTemplateVOMock);
-    }
-
     @Test
     public void isZoneAndImageStoreAvailableTestZoneIdIsNullShouldReturnFalse() {
         DataStore dataStoreMock = Mockito.mock(DataStore.class);
diff --git a/server/src/test/java/com/cloud/template/TemplateManagerImplTest.java b/server/src/test/java/com/cloud/template/TemplateManagerImplTest.java
index 9680fe5e1fd4..576930e46f4b 100755
--- a/server/src/test/java/com/cloud/template/TemplateManagerImplTest.java
+++ b/server/src/test/java/com/cloud/template/TemplateManagerImplTest.java
@@ -753,6 +753,26 @@ public void testDeleteTemplateWithTemplateType() {
         Assert.assertNull(type);
     }
 
+    @Test
+    public void verifyHeuristicRulesForZoneTestTemplateIsISOFormatShouldCheckForISOHeuristicType() {
+        VMTemplateVO vmTemplateVOMock = Mockito.mock(VMTemplateVO.class);
+
+        Mockito.when(vmTemplateVOMock.getFormat()).thenReturn(Storage.ImageFormat.ISO);
+        templateManager.verifyHeuristicRulesForZone(vmTemplateVOMock, 1L);
+
+        Mockito.verify(heuristicRuleHelperMock, Mockito.times(1)).getImageStoreIfThereIsHeuristicRule(1L, HeuristicType.ISO, vmTemplateVOMock);
+    }
+
+    @Test
+    public void verifyHeuristicRulesForZoneTestTemplateNotISOFormatShouldCheckForTemplateHeuristicType() {
+        VMTemplateVO vmTemplateVOMock = Mockito.mock(VMTemplateVO.class);
+
+        Mockito.when(vmTemplateVOMock.getFormat()).thenReturn(Storage.ImageFormat.QCOW2);
+        templateManager.verifyHeuristicRulesForZone(vmTemplateVOMock, 1L);
+
+        Mockito.verify(heuristicRuleHelperMock, Mockito.times(1)).getImageStoreIfThereIsHeuristicRule(1L, HeuristicType.TEMPLATE, vmTemplateVOMock);
+    }
+
     @Configuration
     @ComponentScan(basePackageClasses = {TemplateManagerImpl.class},
             includeFilters = {@ComponentScan.Filter(value = TestConfiguration.Library.class, type = FilterType.CUSTOM)},

From ac2242ece23517b7359056779438b32131529f3c Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Tue, 27 Jan 2026 14:37:51 +0530
Subject: [PATCH 034/117] api,server,ui: support tags for domains (#11964)

* api,server,ui: support tags for domains

Fixes #11608

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* address copilot comment

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix import

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* Added tags support to listDomains API

---------

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
Co-authored-by: Harikrishna Patnala <harikrishna.patnala@gmail.com>
---
 .../java/com/cloud/server/ResourceTag.java    | 10 ++---
 .../command/admin/domain/ListDomainsCmd.java  |  4 +-
 .../api/response/DomainResponse.java          | 18 ++++----
 .../java/com/cloud/api/ApiResponseHelper.java | 41 +++++++++++++------
 .../com/cloud/api/query/QueryManagerImpl.java | 29 +++++++++++++
 .../api/query/dao/DomainJoinDaoImpl.java      | 10 ++---
 ui/src/components/view/InfoCard.vue           |  2 +-
 7 files changed, 81 insertions(+), 33 deletions(-)

diff --git a/api/src/main/java/com/cloud/server/ResourceTag.java b/api/src/main/java/com/cloud/server/ResourceTag.java
index b3026deceff8..32305753f1ae 100644
--- a/api/src/main/java/com/cloud/server/ResourceTag.java
+++ b/api/src/main/java/com/cloud/server/ResourceTag.java
@@ -16,14 +16,14 @@
 // under the License.
 package com.cloud.server;
 
-import org.apache.cloudstack.acl.ControlledEntity;
-import org.apache.cloudstack.api.Identity;
-import org.apache.cloudstack.api.InternalIdentity;
-
 import java.util.HashMap;
 import java.util.Locale;
 import java.util.Map;
 
+import org.apache.cloudstack.acl.ControlledEntity;
+import org.apache.cloudstack.api.Identity;
+import org.apache.cloudstack.api.InternalIdentity;
+
 public interface ResourceTag extends ControlledEntity, Identity, InternalIdentity {
 
     // FIXME - extract enum to another interface as its used both by resourceTags and resourceMetaData code
@@ -70,7 +70,7 @@ public enum ResourceObjectType {
         GuestOs(false, true),
         NetworkOffering(false, true),
         VpcOffering(true, false),
-        Domain(false, false, true),
+        Domain(true, false, true),
         ObjectStore(false, false, true);
 
 
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/domain/ListDomainsCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/domain/ListDomainsCmd.java
index 5c5a92c45cac..aa1978042265 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/domain/ListDomainsCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/domain/ListDomainsCmd.java
@@ -23,7 +23,7 @@
 import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.ApiConstants.DomainDetails;
-import org.apache.cloudstack.api.BaseListCmd;
+import org.apache.cloudstack.api.BaseListTaggedResourcesCmd;
 import org.apache.cloudstack.api.Parameter;
 import org.apache.cloudstack.api.ResponseObject.ResponseView;
 import org.apache.cloudstack.api.command.user.UserCmd;
@@ -39,7 +39,7 @@
 
 @APICommand(name = "listDomains", description = "Lists domains and provides detailed information for listed domains", responseObject = DomainResponse.class, responseView = ResponseView.Restricted, entityType = {Domain.class},
         requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
-public class ListDomainsCmd extends BaseListCmd implements UserCmd {
+public class ListDomainsCmd extends BaseListTaggedResourcesCmd implements UserCmd {
 
     private static final String s_name = "listdomainsresponse";
 
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/DomainResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/DomainResponse.java
index e018b1a0f724..453c6b229e97 100644
--- a/api/src/main/java/org/apache/cloudstack/api/response/DomainResponse.java
+++ b/api/src/main/java/org/apache/cloudstack/api/response/DomainResponse.java
@@ -16,21 +16,21 @@
 // under the License.
 package org.apache.cloudstack.api.response;
 
-import com.google.gson.annotations.SerializedName;
+import java.util.Date;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
 
 import org.apache.cloudstack.api.ApiConstants;
-import org.apache.cloudstack.api.BaseResponseWithAnnotations;
+import org.apache.cloudstack.api.BaseResponseWithTagInformation;
 import org.apache.cloudstack.api.EntityReference;
 
 import com.cloud.domain.Domain;
 import com.cloud.serializer.Param;
-
-import java.util.Date;
-import java.util.List;
-import java.util.Map;
+import com.google.gson.annotations.SerializedName;
 
 @EntityReference(value = Domain.class)
-public class DomainResponse extends BaseResponseWithAnnotations implements ResourceLimitAndCountResponse, SetResourceIconResponse {
+public class DomainResponse extends BaseResponseWithTagInformation implements ResourceLimitAndCountResponse, SetResourceIconResponse {
     @SerializedName(ApiConstants.ID)
     @Param(description = "The ID of the domain")
     private String id;
@@ -589,4 +589,8 @@ public void setDetails(Map<String, String> details) {
     public void setTaggedResourceLimitsAndCounts(List<TaggedResourceLimitAndCountResponse> taggedResourceLimitsAndCounts) {
         this.taggedResources = taggedResourceLimitsAndCounts;
     }
+
+    public void setTags(Set<ResourceTagResponse> tags) {
+        this.tags = tags;
+    }
 }
diff --git a/server/src/main/java/com/cloud/api/ApiResponseHelper.java b/server/src/main/java/com/cloud/api/ApiResponseHelper.java
index ce794cf5388f..48696118a34c 100644
--- a/server/src/main/java/com/cloud/api/ApiResponseHelper.java
+++ b/server/src/main/java/com/cloud/api/ApiResponseHelper.java
@@ -39,19 +39,6 @@
 
 import javax.inject.Inject;
 
-import com.cloud.bgp.ASNumber;
-import com.cloud.bgp.ASNumberRange;
-import com.cloud.configuration.ConfigurationService;
-import com.cloud.dc.ASNumberRangeVO;
-import com.cloud.dc.ASNumberVO;
-import com.cloud.dc.VlanDetailsVO;
-import com.cloud.dc.dao.ASNumberDao;
-import com.cloud.dc.dao.ASNumberRangeDao;
-import com.cloud.dc.dao.VlanDetailsDao;
-import com.cloud.hypervisor.Hypervisor;
-import com.cloud.network.vpc.VpcGateway;
-import com.cloud.network.vpn.Site2SiteVpnManager;
-import com.cloud.storage.BucketVO;
 import org.apache.cloudstack.acl.ControlledEntity;
 import org.apache.cloudstack.acl.ControlledEntity.ACLType;
 import org.apache.cloudstack.affinity.AffinityGroup;
@@ -277,14 +264,19 @@
 import com.cloud.api.query.vo.VolumeJoinVO;
 import com.cloud.api.query.vo.VpcOfferingJoinVO;
 import com.cloud.api.response.ApiResponseSerializer;
+import com.cloud.bgp.ASNumber;
+import com.cloud.bgp.ASNumberRange;
 import com.cloud.capacity.Capacity;
 import com.cloud.capacity.CapacityVO;
 import com.cloud.capacity.dao.CapacityDaoImpl.SummedCapacity;
 import com.cloud.configuration.ConfigurationManager;
+import com.cloud.configuration.ConfigurationService;
 import com.cloud.configuration.Resource.ResourceOwnerType;
 import com.cloud.configuration.Resource.ResourceType;
 import com.cloud.configuration.ResourceCount;
 import com.cloud.configuration.ResourceLimit;
+import com.cloud.dc.ASNumberRangeVO;
+import com.cloud.dc.ASNumberVO;
 import com.cloud.dc.ClusterDetailsDao;
 import com.cloud.dc.ClusterVO;
 import com.cloud.dc.DataCenter;
@@ -295,7 +287,11 @@
 import com.cloud.dc.StorageNetworkIpRange;
 import com.cloud.dc.Vlan;
 import com.cloud.dc.Vlan.VlanType;
+import com.cloud.dc.VlanDetailsVO;
 import com.cloud.dc.VlanVO;
+import com.cloud.dc.dao.ASNumberDao;
+import com.cloud.dc.dao.ASNumberRangeDao;
+import com.cloud.dc.dao.VlanDetailsDao;
 import com.cloud.domain.Domain;
 import com.cloud.domain.DomainVO;
 import com.cloud.event.Event;
@@ -304,6 +300,7 @@
 import com.cloud.host.ControlState;
 import com.cloud.host.Host;
 import com.cloud.host.HostVO;
+import com.cloud.hypervisor.Hypervisor;
 import com.cloud.hypervisor.HypervisorCapabilities;
 import com.cloud.network.GuestVlan;
 import com.cloud.network.GuestVlanRange;
@@ -367,9 +364,11 @@
 import com.cloud.network.vpc.PrivateGateway;
 import com.cloud.network.vpc.StaticRoute;
 import com.cloud.network.vpc.Vpc;
+import com.cloud.network.vpc.VpcGateway;
 import com.cloud.network.vpc.VpcOffering;
 import com.cloud.network.vpc.VpcVO;
 import com.cloud.network.vpc.dao.VpcOfferingDao;
+import com.cloud.network.vpn.Site2SiteVpnManager;
 import com.cloud.offering.DiskOffering;
 import com.cloud.offering.NetworkOffering;
 import com.cloud.offering.NetworkOffering.Detail;
@@ -388,6 +387,7 @@
 import com.cloud.server.ResourceTag;
 import com.cloud.server.ResourceTag.ResourceObjectType;
 import com.cloud.service.ServiceOfferingVO;
+import com.cloud.storage.BucketVO;
 import com.cloud.storage.DataStoreRole;
 import com.cloud.storage.DiskOfferingVO;
 import com.cloud.storage.GuestOS;
@@ -586,6 +586,7 @@ public DomainResponse createDomainResponse(Domain domain) {
         if (domain.getChildCount() > 0) {
             domainResponse.setHasChild(true);
         }
+        populateDomainTags(domain.getUuid(), domainResponse);
         domainResponse.setObjectName("domain");
         return domainResponse;
     }
@@ -3048,6 +3049,20 @@ public static void populateOwner(ControlledViewEntityResponse response, Controll
         response.setDomainPath(getPrettyDomainPath(object.getDomainPath()));
     }
 
+    public static void populateDomainTags(String domainUuid, DomainResponse domainResponse) {
+        List<ResourceTagJoinVO> tags = ApiDBUtils.listResourceTagViewByResourceUUID(domainUuid,
+                ResourceTag.ResourceObjectType.Domain);
+        if (CollectionUtils.isEmpty(tags)) {
+            return;
+        }
+        Set<ResourceTagResponse> tagResponses = new HashSet<>();
+        for (ResourceTagJoinVO tag : tags) {
+            ResourceTagResponse tagResponse = ApiDBUtils.newResourceTagResponse(tag, true);
+            tagResponses.add(tagResponse);
+        }
+        domainResponse.setTags(tagResponses);
+    }
+
     private void populateAccount(ControlledEntityResponse response, long accountId) {
         Account account = ApiDBUtils.findAccountById(accountId);
         if (account == null) {
diff --git a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
index 472be9a12b7f..a25fcdf22ef9 100644
--- a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
+++ b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
@@ -2860,6 +2860,7 @@ private Pair<List<Long>, Integer> searchForDomainIdsAndCount(ListDomainsCmd cmd)
         boolean listAll = cmd.listAll();
         boolean isRecursive = false;
         Domain domain = null;
+        Map<String, String> tags = cmd.getTags();
 
         if (domainId != null) {
             domain = _domainDao.findById(domainId);
@@ -2889,6 +2890,24 @@ private Pair<List<Long>, Integer> searchForDomainIdsAndCount(ListDomainsCmd cmd)
         domainSearchBuilder.and("path", domainSearchBuilder.entity().getPath(), SearchCriteria.Op.LIKE);
         domainSearchBuilder.and("state", domainSearchBuilder.entity().getState(), SearchCriteria.Op.EQ);
 
+        if (MapUtils.isNotEmpty(tags)) {
+            SearchBuilder<ResourceTagVO> resourceTagSearch = resourceTagDao.createSearchBuilder();
+            resourceTagSearch.and("resourceType", resourceTagSearch.entity().getResourceType(), Op.EQ);
+            resourceTagSearch.and().op();
+            for (int count = 0; count < tags.size(); count++) {
+                if (count == 0) {
+                    resourceTagSearch.op("tagKey" + count, resourceTagSearch.entity().getKey(), Op.EQ);
+                } else {
+                    resourceTagSearch.or().op("tagKey" + count, resourceTagSearch.entity().getKey(), Op.EQ);
+                }
+                resourceTagSearch.and("tagValue" + count, resourceTagSearch.entity().getValue(), Op.EQ);
+                resourceTagSearch.cp();
+            }
+            resourceTagSearch.cp();
+
+            domainSearchBuilder.join("tags", resourceTagSearch, resourceTagSearch.entity().getResourceId(), domainSearchBuilder.entity().getId(), JoinBuilder.JoinType.INNER);
+        }
+
         if (keyword != null) {
             domainSearchBuilder.and("keywordName", domainSearchBuilder.entity().getName(), SearchCriteria.Op.LIKE);
         }
@@ -2918,6 +2937,16 @@ private Pair<List<Long>, Integer> searchForDomainIdsAndCount(ListDomainsCmd cmd)
             }
         }
 
+        if (MapUtils.isNotEmpty(tags)) {
+            int count = 0;
+            sc.setJoinParameters("tags", "resourceType", ResourceObjectType.Domain);
+            for (Map.Entry<String, String> entry  : tags.entrySet()) {
+                sc.setJoinParameters("tags", "tagKey" + count, entry.getKey());
+                sc.setJoinParameters("tags", "tagValue" + count, entry.getValue());
+                count++;
+            }
+        }
+
         // return only Active domains to the API
         sc.setParameters("state", Domain.State.Active);
 
diff --git a/server/src/main/java/com/cloud/api/query/dao/DomainJoinDaoImpl.java b/server/src/main/java/com/cloud/api/query/dao/DomainJoinDaoImpl.java
index d4865c5550e1..b6a3370e6bcf 100644
--- a/server/src/main/java/com/cloud/api/query/dao/DomainJoinDaoImpl.java
+++ b/server/src/main/java/com/cloud/api/query/dao/DomainJoinDaoImpl.java
@@ -20,10 +20,8 @@
 import java.util.EnumSet;
 import java.util.List;
 
+import javax.inject.Inject;
 
-import com.cloud.api.ApiResponseHelper;
-import com.cloud.configuration.Resource;
-import com.cloud.user.AccountManager;
 import org.apache.cloudstack.annotation.AnnotationService;
 import org.apache.cloudstack.annotation.dao.AnnotationDao;
 import org.apache.cloudstack.api.ApiConstants.DomainDetails;
@@ -35,15 +33,16 @@
 import org.springframework.stereotype.Component;
 
 import com.cloud.api.ApiDBUtils;
+import com.cloud.api.ApiResponseHelper;
 import com.cloud.api.query.vo.DomainJoinVO;
+import com.cloud.configuration.Resource;
 import com.cloud.configuration.Resource.ResourceType;
 import com.cloud.domain.Domain;
+import com.cloud.user.AccountManager;
 import com.cloud.utils.db.GenericDaoBase;
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
 
-import javax.inject.Inject;
-
 @Component
 public class DomainJoinDaoImpl extends GenericDaoBase<DomainJoinVO, Long> implements DomainJoinDao {
 
@@ -110,6 +109,7 @@ public DomainResponse newDomainResponse(ResponseView view, EnumSet<DomainDetails
         }
 
         domainResponse.setDetails(ApiDBUtils.getDomainDetails(domain.getId()));
+        ApiResponseHelper.populateDomainTags(domain.getUuid(), domainResponse);
         domainResponse.setObjectName("domain");
 
         return domainResponse;
diff --git a/ui/src/components/view/InfoCard.vue b/ui/src/components/view/InfoCard.vue
index 0031d730f569..996e30ead3b5 100644
--- a/ui/src/components/view/InfoCard.vue
+++ b/ui/src/components/view/InfoCard.vue
@@ -1094,7 +1094,7 @@ export default {
       return ['UserVm', 'Template', 'ISO', 'Volume', 'Snapshot', 'Backup', 'Network',
         'LoadBalancer', 'PortForwardingRule', 'FirewallRule', 'SecurityGroup', 'SecurityGroupRule',
         'PublicIpAddress', 'Project', 'Account', 'Vpc', 'NetworkACL', 'StaticRoute', 'VMSnapshot',
-        'RemoteAccessVpn', 'User', 'SnapshotPolicy', 'VpcOffering']
+        'RemoteAccessVpn', 'User', 'SnapshotPolicy', 'VpcOffering', 'Domain']
     },
     name () {
       return this.resource.displayname || this.resource.name || this.resource.displaytext || this.resource.username ||

From 5fd5b625700b99ec4968fc19552096bcdff8a114 Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Tue, 27 Jan 2026 15:01:20 +0530
Subject: [PATCH 035/117] server: fix remove management server (#12147)

Fixes #12137

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
---
 .../com/cloud/server/ManagementServerImpl.java     | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/server/src/main/java/com/cloud/server/ManagementServerImpl.java b/server/src/main/java/com/cloud/server/ManagementServerImpl.java
index 47dcf60eb32d..110beffe4e66 100644
--- a/server/src/main/java/com/cloud/server/ManagementServerImpl.java
+++ b/server/src/main/java/com/cloud/server/ManagementServerImpl.java
@@ -682,15 +682,15 @@
 import com.cloud.alert.AlertVO;
 import com.cloud.alert.dao.AlertDao;
 import com.cloud.api.ApiDBUtils;
-import com.cloud.api.query.dao.ManagementServerJoinDao;
 import com.cloud.api.query.dao.StoragePoolJoinDao;
-import com.cloud.api.query.vo.ManagementServerJoinVO;
 import com.cloud.api.query.vo.StoragePoolJoinVO;
 import com.cloud.capacity.Capacity;
 import com.cloud.capacity.CapacityVO;
 import com.cloud.capacity.dao.CapacityDao;
 import com.cloud.capacity.dao.CapacityDaoImpl.SummedCapacity;
 import com.cloud.cluster.ClusterManager;
+import com.cloud.cluster.ManagementServerHostVO;
+import com.cloud.cluster.dao.ManagementServerHostDao;
 import com.cloud.configuration.Config;
 import com.cloud.configuration.ConfigurationManagerImpl;
 import com.cloud.consoleproxy.ConsoleProxyManagementState;
@@ -790,7 +790,6 @@
 import com.cloud.storage.GuestOSVO;
 import com.cloud.storage.GuestOsCategory;
 import com.cloud.storage.ScopeType;
-import com.cloud.storage.snapshot.SnapshotManager;
 import com.cloud.storage.Storage;
 import com.cloud.storage.StorageManager;
 import com.cloud.storage.StoragePool;
@@ -807,6 +806,7 @@
 import com.cloud.storage.dao.VMTemplateDao;
 import com.cloud.storage.dao.VolumeDao;
 import com.cloud.storage.secondary.SecondaryStorageVmManager;
+import com.cloud.storage.snapshot.SnapshotManager;
 import com.cloud.tags.ResourceTagVO;
 import com.cloud.tags.dao.ResourceTagDao;
 import com.cloud.template.TemplateManager;
@@ -1045,7 +1045,7 @@ public class ManagementServerImpl extends ManagerBase implements ManagementServe
     @Inject
     private BackupManager backupManager;
     @Inject
-    protected ManagementServerJoinDao managementServerJoinDao;
+    protected ManagementServerHostDao managementServerHostDao;
     @Inject
     ClusterManager _clusterMgr;
 
@@ -5875,7 +5875,7 @@ public void setLockControllerListener(final LockControllerListener lockControlle
     @ActionEvent(eventType = EventTypes.EVENT_MANAGEMENT_SERVER_REMOVE, eventDescription = "removing Management Server")
     public boolean removeManagementServer(RemoveManagementServerCmd cmd) {
         final Long id = cmd.getId();
-        ManagementServerJoinVO managementServer = managementServerJoinDao.findById(id);
+        ManagementServerHostVO managementServer = managementServerHostDao.findById(id);
 
         if (managementServer == null) {
             throw new InvalidParameterValueException(String.format("Unable to find a Management Server with ID equal to [%s].", id));
@@ -5885,8 +5885,8 @@ public boolean removeManagementServer(RemoveManagementServerCmd cmd) {
             throw new InvalidParameterValueException(String.format("Unable to remove Management Server with ID [%s]. It can only be removed when it is in the [%s] state, however currently it is in the [%s] state.", managementServer.getUuid(), ManagementServerHost.State.Down.name(), managementServer.getState().name()));
         }
 
-        managementServer.setRemoved(new Date());
-        return managementServerJoinDao.update(id, managementServer);
+        managementServerHostDao.remove(id);
+        return true;
 
     }
 

From b6134418eafcf458f794905f7eb672da3fc3818a Mon Sep 17 00:00:00 2001
From: Wei Zhou <weizhou@apache.org>
Date: Tue, 27 Jan 2026 11:42:24 +0100
Subject: [PATCH 036/117] server: do not run dhcp and dns check if VR is not
 provider (#12272)

---
 .../network/router/VirtualNetworkApplianceManagerImpl.java   | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/server/src/main/java/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java b/server/src/main/java/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
index 7d0a4f208386..bd73e67f10b5 100644
--- a/server/src/main/java/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
@@ -1777,8 +1777,9 @@ protected Map<String, String> getRouterHealthChecksConfig(final DomainRouterVO r
             scvm.setParameters("networkId", routerJoinVO.getNetworkId());
             scvm.setParameters("state", VirtualMachine.State.Running);
             List<UserVmJoinVO> vms = userVmJoinDao.search(scvm, null);
-            boolean isDhcpSupported = _ntwkSrvcDao.areServicesSupportedInNetwork(routerJoinVO.getNetworkId(), Service.Dhcp);
-            boolean isDnsSupported = _ntwkSrvcDao.areServicesSupportedInNetwork(routerJoinVO.getNetworkId(), Service.Dns);
+            Provider provider = routerJoinVO.getVpcId() != 0 ? Provider.VPCVirtualRouter : Provider.VirtualRouter;
+            boolean isDhcpSupported = _ntwkSrvcDao.canProviderSupportServiceInNetwork(routerJoinVO.getNetworkId(), Service.Dhcp, provider);
+            boolean isDnsSupported = _ntwkSrvcDao.canProviderSupportServiceInNetwork(routerJoinVO.getNetworkId(), Service.Dns, provider);
             for (UserVmJoinVO vm : vms) {
                 vmsData.append("vmName=").append(vm.getName())
                         .append(",macAddress=").append(vm.getMacAddress())

From 416568a373f146db3c491a17bda1e5181956a432 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Erik=20B=C3=B6ck?=
 <89930804+erikbocks@users.noreply.github.com>
Date: Tue, 27 Jan 2026 07:47:14 -0300
Subject: [PATCH 037/117] Fix typo in finalyzeAccountId (#11990)

* Fix typo in finalyzeAccountId

* fix tests
---
 .../java/com/cloud/user/AccountService.java    |  2 +-
 .../admin/vm/ImportUnmanagedInstanceCmd.java   |  2 +-
 .../command/admin/volume/ImportVolumeCmd.java  |  2 +-
 .../autoscale/CreateAutoScaleVmProfileCmd.java |  2 +-
 .../user/autoscale/CreateConditionCmd.java     |  2 +-
 .../command/user/bucket/CreateBucketCmd.java   |  2 +-
 .../user/iso/GetUploadParamsForIsoCmd.java     |  2 +-
 .../api/command/user/iso/RegisterIsoCmd.java   |  2 +-
 .../command/user/network/CreateNetworkCmd.java |  2 +-
 .../gslb/CreateGlobalLoadBalancerRuleCmd.java  |  2 +-
 .../user/resource/ListResourceLimitsCmd.java   |  2 +-
 .../user/resource/UpdateResourceCountCmd.java  |  2 +-
 .../user/resource/UpdateResourceLimitCmd.java  |  4 ++--
 .../AuthorizeSecurityGroupEgressCmd.java       |  2 +-
 .../AuthorizeSecurityGroupIngressCmd.java      |  2 +-
 .../securitygroup/DeleteSecurityGroupCmd.java  |  2 +-
 .../command/user/ssh/CreateSSHKeyPairCmd.java  |  2 +-
 .../user/ssh/RegisterSSHKeyPairCmd.java        |  2 +-
 .../storage/sharedfs/CreateSharedFSCmd.java    |  2 +-
 .../user/template/CreateTemplateCmd.java       |  2 +-
 .../GetUploadParamsForTemplateCmd.java         |  2 +-
 .../user/template/RegisterTemplateCmd.java     |  2 +-
 .../userdata/RegisterCniConfigurationCmd.java  |  2 +-
 .../user/userdata/RegisterUserDataCmd.java     |  2 +-
 .../api/command/user/vm/BaseDeployVMCmd.java   |  2 +-
 .../command/user/vmgroup/CreateVMGroupCmd.java |  2 +-
 .../command/user/volume/CreateVolumeCmd.java   |  2 +-
 .../volume/GetUploadParamsForVolumeCmd.java    |  2 +-
 .../command/user/volume/UploadVolumeCmd.java   |  2 +-
 .../api/command/user/vpc/CreateVPCCmd.java     |  2 +-
 .../api/command/user/vpn/AddVpnUserCmd.java    |  2 +-
 .../user/vpn/CreateVpnCustomerGatewayCmd.java  |  2 +-
 .../api/command/user/vpn/RemoveVpnUserCmd.java |  2 +-
 .../user/vpn/ResetVpnConnectionCmd.java        |  2 +-
 .../user/vpn/UpdateVpnCustomerGatewayCmd.java  |  2 +-
 .../admin/volume/ImportVolumeCmdTest.java      |  2 +-
 .../user/userdata/RegisterUserDataCmdTest.java |  2 +-
 .../cluster/CreateKubernetesClusterCmd.java    |  2 +-
 .../api/command/CreateServiceInstanceCmd.java  |  2 +-
 .../management/MockAccountManager.java         |  2 +-
 .../com/cloud/user/AccountManagerImpl.java     |  2 +-
 .../affinity/AffinityGroupServiceImpl.java     |  2 +-
 .../network/RoutedIpv4ManagerImpl.java         | 12 ++++++------
 .../com/cloud/vm/UserVmManagerImplTest.java    | 18 +++++++++---------
 .../affinity/AffinityApiUnitTest.java          |  2 +-
 .../affinity/AffinityGroupServiceImplTest.java |  2 +-
 .../network/RoutedIpv4ManagerImplTest.java     |  4 ++--
 47 files changed, 62 insertions(+), 62 deletions(-)

diff --git a/api/src/main/java/com/cloud/user/AccountService.java b/api/src/main/java/com/cloud/user/AccountService.java
index 8f29a2fbc428..b92654bfe174 100644
--- a/api/src/main/java/com/cloud/user/AccountService.java
+++ b/api/src/main/java/com/cloud/user/AccountService.java
@@ -124,7 +124,7 @@ User createUser(String userName, String password, String firstName, String lastN
 
     void validateAccountHasAccessToResource(Account account, AccessType accessType, Object resource);
 
-    Long finalyzeAccountId(String accountName, Long domainId, Long projectId, boolean enabledOnly);
+    Long finalizeAccountId(String accountName, Long domainId, Long projectId, boolean enabledOnly);
 
     /**
      * returns the user account object for a given user id
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ImportUnmanagedInstanceCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ImportUnmanagedInstanceCmd.java
index 1164037dfc87..ad7e8a48b252 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ImportUnmanagedInstanceCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/ImportUnmanagedInstanceCmd.java
@@ -292,7 +292,7 @@ public void execute() throws ResourceUnavailableException, InsufficientCapacityE
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             Account account = CallContext.current().getCallingAccount();
             if (account != null) {
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/volume/ImportVolumeCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/volume/ImportVolumeCmd.java
index 57c3ee586d35..50f4b9c1fbe5 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/volume/ImportVolumeCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/volume/ImportVolumeCmd.java
@@ -156,7 +156,7 @@ public void execute() throws ResourceUnavailableException, InsufficientCapacityE
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/autoscale/CreateAutoScaleVmProfileCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/autoscale/CreateAutoScaleVmProfileCmd.java
index 4ecce59fa454..db9688aa09aa 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/autoscale/CreateAutoScaleVmProfileCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/autoscale/CreateAutoScaleVmProfileCmd.java
@@ -232,7 +232,7 @@ public static String getResultObjectName() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/autoscale/CreateConditionCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/autoscale/CreateConditionCmd.java
index 9d42706cb7d7..2bb101de5593 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/autoscale/CreateConditionCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/autoscale/CreateConditionCmd.java
@@ -137,7 +137,7 @@ public String getEventType() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/bucket/CreateBucketCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/bucket/CreateBucketCmd.java
index 722556b8e2de..f1c149854d92 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/bucket/CreateBucketCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/bucket/CreateBucketCmd.java
@@ -150,7 +150,7 @@ public ApiCommandResourceType getApiResourceType() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/iso/GetUploadParamsForIsoCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/iso/GetUploadParamsForIsoCmd.java
index 564ebb20b758..43cdf09a89cf 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/iso/GetUploadParamsForIsoCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/iso/GetUploadParamsForIsoCmd.java
@@ -158,7 +158,7 @@ public String getCommandName() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(getAccountName(), getDomainId(), getProjectId(), true);
+        Long accountId = _accountService.finalizeAccountId(getAccountName(), getDomainId(), getProjectId(), true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/iso/RegisterIsoCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/iso/RegisterIsoCmd.java
index 2aa8e8e70957..1c57e902e221 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/iso/RegisterIsoCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/iso/RegisterIsoCmd.java
@@ -254,7 +254,7 @@ public String getCommandName() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/network/CreateNetworkCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/network/CreateNetworkCmd.java
index 35fec1d6b3e2..cbf6df081b3b 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/network/CreateNetworkCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/network/CreateNetworkCmd.java
@@ -417,7 +417,7 @@ public String getCommandName() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/region/ha/gslb/CreateGlobalLoadBalancerRuleCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/region/ha/gslb/CreateGlobalLoadBalancerRuleCmd.java
index df9b6b318651..20b227b831c1 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/region/ha/gslb/CreateGlobalLoadBalancerRuleCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/region/ha/gslb/CreateGlobalLoadBalancerRuleCmd.java
@@ -180,7 +180,7 @@ public ApiCommandResourceType getApiResourceType() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, null, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, null, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/resource/ListResourceLimitsCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/resource/ListResourceLimitsCmd.java
index 7bae74c73a46..4bda23617092 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/resource/ListResourceLimitsCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/resource/ListResourceLimitsCmd.java
@@ -103,7 +103,7 @@ public String getTag() {
     @Override
     public void execute() {
         List<? extends ResourceLimit> result =
-                _resourceLimitService.searchForLimits(id, _accountService.finalyzeAccountId(this.getAccountName(), this.getDomainId(), this.getProjectId(), false), this.getDomainId(),
+                _resourceLimitService.searchForLimits(id, _accountService.finalizeAccountId(this.getAccountName(), this.getDomainId(), this.getProjectId(), false), this.getDomainId(),
                         getResourceTypeEnum(), getTag(), this.getStartIndex(), this.getPageSizeVal());
         ListResponse<ResourceLimitResponse> response = new ListResponse<ResourceLimitResponse>();
         List<ResourceLimitResponse> limitResponses = new ArrayList<ResourceLimitResponse>();
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/resource/UpdateResourceCountCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/resource/UpdateResourceCountCmd.java
index 123b0e48a74c..d43bb29e9d27 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/resource/UpdateResourceCountCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/resource/UpdateResourceCountCmd.java
@@ -127,7 +127,7 @@ public long getEntityOwnerId() {
     @Override
     public void execute() {
         List<? extends ResourceCount> result =
-                _resourceLimitService.recalculateResourceCount(_accountService.finalyzeAccountId(accountName, domainId, projectId, true), getDomainId(), getResourceType(), getTag());
+                _resourceLimitService.recalculateResourceCount(_accountService.finalizeAccountId(accountName, domainId, projectId, true), getDomainId(), getResourceType(), getTag());
 
         if ((result != null) && (result.size() > 0)) {
             ListResponse<ResourceCountResponse> response = new ListResponse<ResourceCountResponse>();
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/resource/UpdateResourceLimitCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/resource/UpdateResourceLimitCmd.java
index 3678e885a6ea..f88ef9678e31 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/resource/UpdateResourceLimitCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/resource/UpdateResourceLimitCmd.java
@@ -100,7 +100,7 @@ public Integer getResourceType() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
@@ -110,7 +110,7 @@ public long getEntityOwnerId() {
 
     @Override
     public void execute() {
-        ResourceLimit result = _resourceLimitService.updateResourceLimit(_accountService.finalyzeAccountId(accountName, domainId, projectId, true), getDomainId(), resourceType, max, getTag());
+        ResourceLimit result = _resourceLimitService.updateResourceLimit(_accountService.finalizeAccountId(accountName, domainId, projectId, true), getDomainId(), resourceType, max, getTag());
         if (result != null || (result == null && max != null && max.longValue() == -1L)) {
             ResourceLimitResponse response = _responseGenerator.createResourceLimitResponse(result);
             response.setResponseName(getCommandName());
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/securitygroup/AuthorizeSecurityGroupEgressCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/securitygroup/AuthorizeSecurityGroupEgressCmd.java
index 13b09c7e19ac..7d0004c8e5d5 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/securitygroup/AuthorizeSecurityGroupEgressCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/securitygroup/AuthorizeSecurityGroupEgressCmd.java
@@ -166,7 +166,7 @@ public static String getResultObjectName() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/securitygroup/AuthorizeSecurityGroupIngressCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/securitygroup/AuthorizeSecurityGroupIngressCmd.java
index 07a4df9eb5d9..d7a95d8204e6 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/securitygroup/AuthorizeSecurityGroupIngressCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/securitygroup/AuthorizeSecurityGroupIngressCmd.java
@@ -166,7 +166,7 @@ public static String getResultObjectName() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/securitygroup/DeleteSecurityGroupCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/securitygroup/DeleteSecurityGroupCmd.java
index 0636f03c92a3..1882d80c1c1b 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/securitygroup/DeleteSecurityGroupCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/securitygroup/DeleteSecurityGroupCmd.java
@@ -103,7 +103,7 @@ public Long getId() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/ssh/CreateSSHKeyPairCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/ssh/CreateSSHKeyPairCmd.java
index a55b20593025..1b79c11644fb 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/ssh/CreateSSHKeyPairCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/ssh/CreateSSHKeyPairCmd.java
@@ -77,7 +77,7 @@ public Long getProjectId() {
     /////////////////////////////////////////////////////
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/ssh/RegisterSSHKeyPairCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/ssh/RegisterSSHKeyPairCmd.java
index 36c708ea1112..f7af86d08357 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/ssh/RegisterSSHKeyPairCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/ssh/RegisterSSHKeyPairCmd.java
@@ -85,7 +85,7 @@ public Long getProjectId() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/storage/sharedfs/CreateSharedFSCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/storage/sharedfs/CreateSharedFSCmd.java
index ddaa31612a89..595b611b5c0d 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/storage/sharedfs/CreateSharedFSCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/storage/sharedfs/CreateSharedFSCmd.java
@@ -230,7 +230,7 @@ public Long getApiResourceId() {
     }
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/template/CreateTemplateCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/template/CreateTemplateCmd.java
index 3720e2c89f16..76fadb7853ba 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/template/CreateTemplateCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/template/CreateTemplateCmd.java
@@ -354,7 +354,7 @@ private void ensureAccessCheck(Account account) {
     private Long findAccountIdToUse(Account callingAccount) {
         Long accountIdToUse = null;
         try {
-            accountIdToUse = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+            accountIdToUse = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         } catch (InvalidParameterValueException | PermissionDeniedException ex) {
             logger.error("Unable to find accountId associated with accountName={} and domainId={} or projectId={}" +
                     ", using callingAccountId={}", accountName, domainId, projectId, callingAccount.getUuid());
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/template/GetUploadParamsForTemplateCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/template/GetUploadParamsForTemplateCmd.java
index 5058790d1f4a..e6e178baada6 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/template/GetUploadParamsForTemplateCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/template/GetUploadParamsForTemplateCmd.java
@@ -223,7 +223,7 @@ public String getCommandName() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(getAccountName(), getDomainId(), getProjectId(), true);
+        Long accountId = _accountService.finalizeAccountId(getAccountName(), getDomainId(), getProjectId(), true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/template/RegisterTemplateCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/template/RegisterTemplateCmd.java
index b8a0a0c67561..49992ac66611 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/template/RegisterTemplateCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/template/RegisterTemplateCmd.java
@@ -344,7 +344,7 @@ public ApiCommandResourceType getInstanceType() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/userdata/RegisterCniConfigurationCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/userdata/RegisterCniConfigurationCmd.java
index eb80da3be05b..3f1de41eab89 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/userdata/RegisterCniConfigurationCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/userdata/RegisterCniConfigurationCmd.java
@@ -67,7 +67,7 @@ public void execute() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(getAccountName(), getDomainId(), getProjectId(), true);
+        Long accountId = _accountService.finalizeAccountId(getAccountName(), getDomainId(), getProjectId(), true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/userdata/RegisterUserDataCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/userdata/RegisterUserDataCmd.java
index cbbe76748143..d99f2fd066d6 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/userdata/RegisterUserDataCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/userdata/RegisterUserDataCmd.java
@@ -70,7 +70,7 @@ public String getUserData() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(getAccountName(), getDomainId(), getProjectId(), true);
+        Long accountId = _accountService.finalizeAccountId(getAccountName(), getDomainId(), getProjectId(), true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/BaseDeployVMCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/BaseDeployVMCmd.java
index a72fdee3a58d..07c11b21107a 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/BaseDeployVMCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/BaseDeployVMCmd.java
@@ -808,7 +808,7 @@ public static String getResultObjectName() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vmgroup/CreateVMGroupCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vmgroup/CreateVMGroupCmd.java
index a142ffa2d492..12f534e1a221 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vmgroup/CreateVMGroupCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vmgroup/CreateVMGroupCmd.java
@@ -82,7 +82,7 @@ public Long getProjectId() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/CreateVolumeCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/CreateVolumeCmd.java
index 27b592aa8f15..5938bdb810f5 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/CreateVolumeCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/CreateVolumeCmd.java
@@ -188,7 +188,7 @@ public ApiCommandResourceType getApiResourceType() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/GetUploadParamsForVolumeCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/GetUploadParamsForVolumeCmd.java
index 0020fe4021e8..1e3b2e460772 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/GetUploadParamsForVolumeCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/GetUploadParamsForVolumeCmd.java
@@ -72,7 +72,7 @@ public String getCommandName() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(getAccountName(), getDomainId(), getProjectId(), true);
+        Long accountId = _accountService.finalizeAccountId(getAccountName(), getDomainId(), getProjectId(), true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/UploadVolumeCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/UploadVolumeCmd.java
index 3d23a6317223..81077deff654 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/UploadVolumeCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/UploadVolumeCmd.java
@@ -159,7 +159,7 @@ public String getCommandName() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vpc/CreateVPCCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vpc/CreateVPCCmd.java
index a91d3bad410f..2adbbd664085 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vpc/CreateVPCCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vpc/CreateVPCCmd.java
@@ -273,7 +273,7 @@ public String getCommandName() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/AddVpnUserCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/AddVpnUserCmd.java
index b00b932258a4..78cd9a3ac7e4 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/AddVpnUserCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/AddVpnUserCmd.java
@@ -88,7 +88,7 @@ public Long getProjectId() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/CreateVpnCustomerGatewayCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/CreateVpnCustomerGatewayCmd.java
index ef0e2354495f..0da813eb4867 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/CreateVpnCustomerGatewayCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/CreateVpnCustomerGatewayCmd.java
@@ -167,7 +167,7 @@ public String getIkeVersion() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             accountId = CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/RemoveVpnUserCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/RemoveVpnUserCmd.java
index aff87105f9cb..a18619c89498 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/RemoveVpnUserCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/RemoveVpnUserCmd.java
@@ -82,7 +82,7 @@ public Long getProjecId() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/ResetVpnConnectionCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/ResetVpnConnectionCmd.java
index b6e29e66ff4b..f681c8cce182 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/ResetVpnConnectionCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/ResetVpnConnectionCmd.java
@@ -74,7 +74,7 @@ public Long getId() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, null, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, null, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/UpdateVpnCustomerGatewayCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/UpdateVpnCustomerGatewayCmd.java
index edd168f08373..56aa8b2cd16d 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/UpdateVpnCustomerGatewayCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vpn/UpdateVpnCustomerGatewayCmd.java
@@ -161,7 +161,7 @@ public String getIkeVersion() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, null, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, null, true);
         if (accountId == null) {
             accountId = CallContext.current().getCallingAccount().getId();
         }
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/admin/volume/ImportVolumeCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/admin/volume/ImportVolumeCmdTest.java
index a7c41b9271b1..235acb15eeab 100644
--- a/api/src/test/java/org/apache/cloudstack/api/command/admin/volume/ImportVolumeCmdTest.java
+++ b/api/src/test/java/org/apache/cloudstack/api/command/admin/volume/ImportVolumeCmdTest.java
@@ -46,7 +46,7 @@ public void testImportVolumeCmd() {
         Long projectId = 5L;
         long accountId = 6L;
 
-        Mockito.when(accountService.finalyzeAccountId(accountName, domainId, projectId, true)).thenReturn(accountId);
+        Mockito.when(accountService.finalizeAccountId(accountName, domainId, projectId, true)).thenReturn(accountId);
 
         ImportVolumeCmd cmd = new ImportVolumeCmd();
         ReflectionTestUtils.setField(cmd, "path", path);
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/user/userdata/RegisterUserDataCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/user/userdata/RegisterUserDataCmdTest.java
index e9605526f86f..8fac32d8f92f 100644
--- a/api/src/test/java/org/apache/cloudstack/api/command/user/userdata/RegisterUserDataCmdTest.java
+++ b/api/src/test/java/org/apache/cloudstack/api/command/user/userdata/RegisterUserDataCmdTest.java
@@ -97,7 +97,7 @@ public void validateArgsCmd() {
             ReflectionTestUtils.setField(cmd, "name", "testUserdataName");
             ReflectionTestUtils.setField(cmd, "userData", "testUserdata");
 
-            when(_accountService.finalyzeAccountId(ACCOUNT_NAME, DOMAIN_ID, PROJECT_ID, true)).thenReturn(200L);
+            when(_accountService.finalizeAccountId(ACCOUNT_NAME, DOMAIN_ID, PROJECT_ID, true)).thenReturn(200L);
 
             Assert.assertEquals("testUserdataName", cmd.getName());
             Assert.assertEquals("testUserdata", cmd.getUserData());
diff --git a/plugins/integrations/kubernetes-service/src/main/java/org/apache/cloudstack/api/command/user/kubernetes/cluster/CreateKubernetesClusterCmd.java b/plugins/integrations/kubernetes-service/src/main/java/org/apache/cloudstack/api/command/user/kubernetes/cluster/CreateKubernetesClusterCmd.java
index 9ce6dc3ea788..d30922269da9 100644
--- a/plugins/integrations/kubernetes-service/src/main/java/org/apache/cloudstack/api/command/user/kubernetes/cluster/CreateKubernetesClusterCmd.java
+++ b/plugins/integrations/kubernetes-service/src/main/java/org/apache/cloudstack/api/command/user/kubernetes/cluster/CreateKubernetesClusterCmd.java
@@ -388,7 +388,7 @@ public static String getResultObjectName() {
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/plugins/network-elements/juniper-contrail/src/main/java/org/apache/cloudstack/network/contrail/api/command/CreateServiceInstanceCmd.java b/plugins/network-elements/juniper-contrail/src/main/java/org/apache/cloudstack/network/contrail/api/command/CreateServiceInstanceCmd.java
index db98448ec179..4c0f29c8c8a8 100644
--- a/plugins/network-elements/juniper-contrail/src/main/java/org/apache/cloudstack/network/contrail/api/command/CreateServiceInstanceCmd.java
+++ b/plugins/network-elements/juniper-contrail/src/main/java/org/apache/cloudstack/network/contrail/api/command/CreateServiceInstanceCmd.java
@@ -186,7 +186,7 @@ public void execute() throws ResourceUnavailableException, InsufficientCapacityE
 
     @Override
     public long getEntityOwnerId() {
-        Long accountId = _accountService.finalyzeAccountId(accountName, domainId, projectId, true);
+        Long accountId = _accountService.finalizeAccountId(accountName, domainId, projectId, true);
         if (accountId == null) {
             return CallContext.current().getCallingAccount().getId();
         }
diff --git a/plugins/network-elements/juniper-contrail/src/test/java/org/apache/cloudstack/network/contrail/management/MockAccountManager.java b/plugins/network-elements/juniper-contrail/src/test/java/org/apache/cloudstack/network/contrail/management/MockAccountManager.java
index 54e76463bcaa..4dffb405d1a3 100644
--- a/plugins/network-elements/juniper-contrail/src/test/java/org/apache/cloudstack/network/contrail/management/MockAccountManager.java
+++ b/plugins/network-elements/juniper-contrail/src/test/java/org/apache/cloudstack/network/contrail/management/MockAccountManager.java
@@ -467,7 +467,7 @@ public void validateAccountHasAccessToResource(Account account, AccessType acces
     }
 
     @Override
-    public Long finalyzeAccountId(String accountName, Long domainId, Long projectId, boolean enabledOnly) {
+    public Long finalizeAccountId(String accountName, Long domainId, Long projectId, boolean enabledOnly) {
         // TODO Auto-generated method stub
         return null;
     }
diff --git a/server/src/main/java/com/cloud/user/AccountManagerImpl.java b/server/src/main/java/com/cloud/user/AccountManagerImpl.java
index 6f68a1048676..53b88690654e 100644
--- a/server/src/main/java/com/cloud/user/AccountManagerImpl.java
+++ b/server/src/main/java/com/cloud/user/AccountManagerImpl.java
@@ -3462,7 +3462,7 @@ public List<String> listAclGroupsByAccount(Long accountId) {
     }
 
     @Override
-    public Long finalyzeAccountId(final String accountName, final Long domainId, final Long projectId, final boolean enabledOnly) {
+    public Long finalizeAccountId(final String accountName, final Long domainId, final Long projectId, final boolean enabledOnly) {
         if (accountName != null) {
             if (domainId == null) {
                 throw new InvalidParameterValueException("Account must be specified with domainId parameter");
diff --git a/server/src/main/java/org/apache/cloudstack/affinity/AffinityGroupServiceImpl.java b/server/src/main/java/org/apache/cloudstack/affinity/AffinityGroupServiceImpl.java
index 650d52f9dc5d..d212e7435b29 100644
--- a/server/src/main/java/org/apache/cloudstack/affinity/AffinityGroupServiceImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/affinity/AffinityGroupServiceImpl.java
@@ -286,7 +286,7 @@ private AffinityGroupVO getAffinityGroupByName(String account, Long projectId, L
         if(account == null && domainId != null){
             group = _affinityGroupDao.findDomainLevelGroupByName(domainId, affinityGroupName);
         }else{
-            Long accountId = _accountMgr.finalyzeAccountId(account, domainId, projectId, true);
+            Long accountId = _accountMgr.finalizeAccountId(account, domainId, projectId, true);
             if(accountId == null){
                 Account caller = CallContext.current().getCallingAccount();
                 group = _affinityGroupDao.findByAccountAndName(caller.getAccountId(), affinityGroupName);
diff --git a/server/src/main/java/org/apache/cloudstack/network/RoutedIpv4ManagerImpl.java b/server/src/main/java/org/apache/cloudstack/network/RoutedIpv4ManagerImpl.java
index ac12dc3a9b10..5e49872c64db 100644
--- a/server/src/main/java/org/apache/cloudstack/network/RoutedIpv4ManagerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/network/RoutedIpv4ManagerImpl.java
@@ -229,7 +229,7 @@ public DataCenterIpv4GuestSubnet createDataCenterIpv4GuestSubnet(CreateIpv4Subne
 
         Long accountId = null;
         if (accountName != null || (projectId != null && projectId != -1L)) {
-            accountId = accountManager.finalyzeAccountId(accountName, domainId, projectId, false);
+            accountId = accountManager.finalizeAccountId(accountName, domainId, projectId, false);
         }
         if (accountId != null) {
             Account account = accountManager.getAccount(accountId);
@@ -371,7 +371,7 @@ public List<DataCenterIpv4GuestSubnet> listDataCenterIpv4GuestSubnets(ListIpv4Su
             sc.addAnd("domainId", SearchCriteria.Op.EQ, domainId);
         }
         if (accountName != null || (projectId != null && projectId != -1L)) {
-            Long accountId= accountManager.finalyzeAccountId(accountName, domainId, projectId, false);
+            Long accountId= accountManager.finalizeAccountId(accountName, domainId, projectId, false);
             sc.addAnd("accountId", SearchCriteria.Op.EQ, accountId);
         }
         // search via dataCenterIpv4GuestSubnetDao
@@ -394,7 +394,7 @@ public DataCenterIpv4GuestSubnet dedicateDataCenterIpv4GuestSubnet(DedicateIpv4S
         }
         Long accountId = null;
         if (accountName != null || (projectId != null && projectId != -1L)) {
-            accountId = accountManager.finalyzeAccountId(accountName, domainId, projectId, false);
+            accountId = accountManager.finalizeAccountId(accountName, domainId, projectId, false);
         }
         if (accountId != null) {
             Account account = accountManager.getAccount(accountId);
@@ -1094,7 +1094,7 @@ public BgpPeer createBgpPeer(CreateBgpPeerCmd createBgpPeerCmd) {
 
         Long accountId = null;
         if (accountName != null || (projectId != null && projectId != -1L)) {
-            accountId = accountManager.finalyzeAccountId(accountName, domainId, projectId, false);
+            accountId = accountManager.finalizeAccountId(accountName, domainId, projectId, false);
         }
         if (accountId != null) {
             Account account = accountManager.getAccount(accountId);
@@ -1283,7 +1283,7 @@ public BgpPeer dedicateBgpPeer(DedicateBgpPeerCmd dedicateBgpPeerCmd) {
         }
         Long accountId = null;
         if (accountName != null || (projectId != null && projectId != -1L)) {
-            accountId = accountManager.finalyzeAccountId(accountName, domainId, projectId, false);
+            accountId = accountManager.finalizeAccountId(accountName, domainId, projectId, false);
         }
         if (accountId != null) {
             Account account = accountManager.getAccount(accountId);
@@ -1350,7 +1350,7 @@ public List<BgpPeer> listBgpPeers(ListBgpPeersCmd listBgpPeersCmd) {
 
         Long accountId = null;
         if (accountName != null || (projectId != null && projectId != -1L)) {
-            accountId = accountManager.finalyzeAccountId(accountName, domainId, projectId, false);
+            accountId = accountManager.finalizeAccountId(accountName, domainId, projectId, false);
         }
         if (isDedicated != null) {
             SearchCriteria sc1 = createSearchCriteriaForListBgpPeersCmd(id, zoneId, asNumber, keyword);
diff --git a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
index 1ec141a8be13..82f79dbfdede 100644
--- a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
+++ b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
@@ -1136,7 +1136,7 @@ public void createVirtualMachineWithInactiveServiceOffering() throws ResourceUna
         ReflectionTestUtils.setField(deployVMCmd, "serviceOfferingId", serviceOfferingId);
         deployVMCmd._accountService = accountService;
 
-        when(accountService.finalyzeAccountId(nullable(String.class), nullable(Long.class), nullable(Long.class), eq(true))).thenReturn(accountId);
+        when(accountService.finalizeAccountId(nullable(String.class), nullable(Long.class), nullable(Long.class), eq(true))).thenReturn(accountId);
         when(accountService.getActiveAccountById(accountId)).thenReturn(account);
         when(entityManager.findById(DataCenter.class, zoneId)).thenReturn(_dcMock);
         when(entityManager.findById(ServiceOffering.class, serviceOfferingId)).thenReturn(serviceOffering);
@@ -1153,7 +1153,7 @@ public void createVirtualMachine() throws ResourceUnavailableException, Insuffic
         ReflectionTestUtils.setField(deployVMCmd, "serviceOfferingId", serviceOfferingId);
         deployVMCmd._accountService = accountService;
 
-        when(accountService.finalyzeAccountId(nullable(String.class), nullable(Long.class), nullable(Long.class), eq(true))).thenReturn(accountId);
+        when(accountService.finalizeAccountId(nullable(String.class), nullable(Long.class), nullable(Long.class), eq(true))).thenReturn(accountId);
         when(accountService.getActiveAccountById(accountId)).thenReturn(account);
         when(entityManager.findById(DataCenter.class, zoneId)).thenReturn(_dcMock);
         when(entityManager.findById(ServiceOffering.class, serviceOfferingId)).thenReturn(serviceOffering);
@@ -1409,7 +1409,7 @@ public void createVirtualMachineWithCloudRuntimeException() throws ResourceUnava
         ReflectionTestUtils.setField(deployVMCmd, "serviceOfferingId", serviceOfferingId);
         deployVMCmd._accountService = accountService;
 
-        when(accountService.finalyzeAccountId(nullable(String.class), nullable(Long.class), nullable(Long.class), eq(true))).thenReturn(accountId);
+        when(accountService.finalizeAccountId(nullable(String.class), nullable(Long.class), nullable(Long.class), eq(true))).thenReturn(accountId);
         when(accountService.getActiveAccountById(accountId)).thenReturn(account);
         when(entityManager.findById(DataCenter.class, zoneId)).thenReturn(_dcMock);
         when(entityManager.findById(ServiceOffering.class, serviceOfferingId)).thenReturn(serviceOffering);
@@ -3303,7 +3303,7 @@ public void testAllocateVMFromBackupUsingCmdValues() throws InsufficientCapacity
         CreateVMFromBackupCmd cmd = new CreateVMFromBackupCmd();
         cmd._accountService = accountService;
         cmd._entityMgr = entityManager;
-        when(accountService.finalyzeAccountId(nullable(String.class), nullable(Long.class), nullable(Long.class), eq(true))).thenReturn(accountId);
+        when(accountService.finalizeAccountId(nullable(String.class), nullable(Long.class), nullable(Long.class), eq(true))).thenReturn(accountId);
         when(accountService.getActiveAccountById(accountId)).thenReturn(account);
 
         ReflectionTestUtils.setField(cmd, "serviceOfferingId", serviceOfferingId);
@@ -3474,7 +3474,7 @@ public void testAllocateVMFromBackupUsingCmdValuesWithISO() throws InsufficientC
         CreateVMFromBackupCmd cmd = new CreateVMFromBackupCmd();
         cmd._accountService = accountService;
         cmd._entityMgr = entityManager;
-        when(accountService.finalyzeAccountId(nullable(String.class), nullable(Long.class), nullable(Long.class), eq(true))).thenReturn(accountId);
+        when(accountService.finalizeAccountId(nullable(String.class), nullable(Long.class), nullable(Long.class), eq(true))).thenReturn(accountId);
         when(accountService.getActiveAccountById(accountId)).thenReturn(account);
 
         ReflectionTestUtils.setField(cmd, "serviceOfferingId", serviceOfferingId);
@@ -3863,7 +3863,7 @@ public void createVirtualMachineWithExistingVolume() throws ResourceUnavailableE
         ReflectionTestUtils.setField(deployVMCmd, "volumeId", volumeId);
         deployVMCmd._accountService = accountService;
 
-        when(accountService.finalyzeAccountId(nullable(String.class), nullable(Long.class), nullable(Long.class), eq(true))).thenReturn(accountId);
+        when(accountService.finalizeAccountId(nullable(String.class), nullable(Long.class), nullable(Long.class), eq(true))).thenReturn(accountId);
         when(accountService.getActiveAccountById(accountId)).thenReturn(account);
         when(entityManager.findById(DataCenter.class, zoneId)).thenReturn(_dcMock);
         when(entityManager.findById(ServiceOffering.class, serviceOfferingId)).thenReturn(serviceOffering);
@@ -3899,7 +3899,7 @@ public void createVirtualMachineWithExistingSnapshot() throws ResourceUnavailabl
         ReflectionTestUtils.setField(deployVMCmd, "snapshotId", snashotId);
         deployVMCmd._accountService = accountService;
 
-        when(accountService.finalyzeAccountId(nullable(String.class), nullable(Long.class), nullable(Long.class), eq(true))).thenReturn(accountId);
+        when(accountService.finalizeAccountId(nullable(String.class), nullable(Long.class), nullable(Long.class), eq(true))).thenReturn(accountId);
         when(accountService.getActiveAccountById(accountId)).thenReturn(account);
         when(entityManager.findById(DataCenter.class, zoneId)).thenReturn(_dcMock);
         when(entityManager.findById(ServiceOffering.class, serviceOfferingId)).thenReturn(serviceOffering);
@@ -3937,7 +3937,7 @@ public void testAllocateVMFromBackupWithVmSettingsRestoration() throws Insuffici
         CreateVMFromBackupCmd cmd = new CreateVMFromBackupCmd();
         cmd._accountService = accountService;
         cmd._entityMgr = entityManager;
-        when(accountService.finalyzeAccountId(nullable(String.class), nullable(Long.class), nullable(Long.class), eq(true))).thenReturn(accountId);
+        when(accountService.finalizeAccountId(nullable(String.class), nullable(Long.class), nullable(Long.class), eq(true))).thenReturn(accountId);
         when(accountService.getActiveAccountById(accountId)).thenReturn(account);
 
         ReflectionTestUtils.setField(cmd, "serviceOfferingId", serviceOfferingId);
@@ -4003,7 +4003,7 @@ public void testAllocateVMFromBackupWithOverrideDiskOfferingComputeOnly() throws
         CreateVMFromBackupCmd cmd = new CreateVMFromBackupCmd();
         cmd._accountService = accountService;
         cmd._entityMgr = entityManager;
-        when(accountService.finalyzeAccountId(nullable(String.class), nullable(Long.class), nullable(Long.class), eq(true))).thenReturn(accountId);
+        when(accountService.finalizeAccountId(nullable(String.class), nullable(Long.class), nullable(Long.class), eq(true))).thenReturn(accountId);
         when(accountService.getActiveAccountById(accountId)).thenReturn(account);
 
         ReflectionTestUtils.setField(cmd, "serviceOfferingId", serviceOfferingId);
diff --git a/server/src/test/java/org/apache/cloudstack/affinity/AffinityApiUnitTest.java b/server/src/test/java/org/apache/cloudstack/affinity/AffinityApiUnitTest.java
index e27d9618c928..e8cc05c137e5 100644
--- a/server/src/test/java/org/apache/cloudstack/affinity/AffinityApiUnitTest.java
+++ b/server/src/test/java/org/apache/cloudstack/affinity/AffinityApiUnitTest.java
@@ -190,7 +190,7 @@ public void deleteAffinityGroupInvalidIdTest() throws ResourceInUseException {
 
     @Test(expected = InvalidParameterValueException.class)
     public void deleteAffinityGroupInvalidIdName() throws ResourceInUseException {
-        when(_acctMgr.finalyzeAccountId("user", domainId, null, true)).thenReturn(200L);
+        when(_acctMgr.finalizeAccountId("user", domainId, null, true)).thenReturn(200L);
         when(_groupDao.findByAccountAndName(200L, "group1")).thenReturn(null);
         _affinityService.deleteAffinityGroup(null, "user", null, domainId, "group1");
     }
diff --git a/server/src/test/java/org/apache/cloudstack/affinity/AffinityGroupServiceImplTest.java b/server/src/test/java/org/apache/cloudstack/affinity/AffinityGroupServiceImplTest.java
index 5657bd1f5068..495561429ea5 100644
--- a/server/src/test/java/org/apache/cloudstack/affinity/AffinityGroupServiceImplTest.java
+++ b/server/src/test/java/org/apache/cloudstack/affinity/AffinityGroupServiceImplTest.java
@@ -253,7 +253,7 @@ public void deleteAffinityGroupInvalidIdTest() throws ResourceInUseException {
     @Test(expected = InvalidParameterValueException.class)
     public void deleteAffinityGroupInvalidIdName() throws ResourceInUseException {
         when(_acctMgr.finalizeOwner((Account)any(), anyString(), anyLong(), anyLong())).thenReturn(acct);
-        when(_acctMgr.finalyzeAccountId(ACCOUNT_NAME, DOMAIN_ID, null, true)).thenReturn(200L);
+        when(_acctMgr.finalizeAccountId(ACCOUNT_NAME, DOMAIN_ID, null, true)).thenReturn(200L);
         when(_groupDao.findByAccountAndName(200L, AFFINITY_GROUP_NAME)).thenReturn(null);
         _affinityService.deleteAffinityGroup(null, ACCOUNT_NAME, null, DOMAIN_ID, AFFINITY_GROUP_NAME);
     }
diff --git a/server/src/test/java/org/apache/cloudstack/network/RoutedIpv4ManagerImplTest.java b/server/src/test/java/org/apache/cloudstack/network/RoutedIpv4ManagerImplTest.java
index 81110dd3f539..737273e8379e 100644
--- a/server/src/test/java/org/apache/cloudstack/network/RoutedIpv4ManagerImplTest.java
+++ b/server/src/test/java/org/apache/cloudstack/network/RoutedIpv4ManagerImplTest.java
@@ -340,7 +340,7 @@ public void testDedicateDataCenterIpv4GuestSubnet() {
 
         when(dataCenterIpv4GuestSubnetDao.findById(zoneSubnetId)).thenReturn(subnetVO);
 
-        when(accountManager.finalyzeAccountId(accountName, domainId, null, false)).thenReturn(accountId);
+        when(accountManager.finalizeAccountId(accountName, domainId, null, false)).thenReturn(accountId);
         when(accountManager.getAccount(accountId)).thenReturn(account);
         when(account.getDomainId()).thenReturn(domainId);
         when(dataCenterIpv4GuestSubnetDao.findById(zoneSubnetId)).thenReturn(subnetVO);
@@ -911,7 +911,7 @@ public void testDedicateBgpPeer() {
         ReflectionTestUtils.setField(cmd,"projectId", null);
 
         when(bgpPeerDao.findById(bgpPeerId)).thenReturn(bgpPeer);
-        when(accountManager.finalyzeAccountId(accountName, domainId, null, false)).thenReturn(accountId);
+        when(accountManager.finalizeAccountId(accountName, domainId, null, false)).thenReturn(accountId);
         when(accountManager.getAccount(accountId)).thenReturn(account);
         when(account.getDomainId()).thenReturn(domainId);
 

From ca5232778da46e261529f5ce0bfb027e54656e16 Mon Sep 17 00:00:00 2001
From: Pearl Dsilva <pearl1594@gmail.com>
Date: Tue, 27 Jan 2026 06:04:18 -0500
Subject: [PATCH 038/117] CKS: Use Zone MTUs when network is created at the
 time of CKS cluster creation (#12228)

---
 .../main/java/com/cloud/network/NetworkService.java  |  4 ++++
 .../cluster/KubernetesClusterManagerImpl.java        |  7 +++++--
 .../java/com/cloud/network/NetworkServiceImpl.java   | 12 ++++++++++++
 .../java/com/cloud/vpc/MockNetworkManagerImpl.java   |  7 +++++++
 4 files changed, 28 insertions(+), 2 deletions(-)

diff --git a/api/src/main/java/com/cloud/network/NetworkService.java b/api/src/main/java/com/cloud/network/NetworkService.java
index 9b570fee5c54..cb72346678df 100644
--- a/api/src/main/java/com/cloud/network/NetworkService.java
+++ b/api/src/main/java/com/cloud/network/NetworkService.java
@@ -107,6 +107,10 @@ Network createGuestNetwork(long networkOfferingId, String name, String displayTe
            PhysicalNetwork physicalNetwork, long zoneId, ControlledEntity.ACLType aclType) throws
             InsufficientCapacityException, ConcurrentOperationException, ResourceAllocationException;
 
+    Network createGuestNetwork(long networkOfferingId, String name, String displayText, Account owner,
+                               PhysicalNetwork physicalNetwork, long zoneId, ControlledEntity.ACLType aclType, Pair<Integer, Integer> vrIfaceMTUs) throws
+            InsufficientCapacityException, ConcurrentOperationException, ResourceAllocationException;
+
     Pair<List<? extends Network>, Integer> searchForNetworks(ListNetworksCmd cmd);
 
     boolean deleteNetwork(long networkId, boolean forced);
diff --git a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java
index 07c7f6eb5472..0b211f2f235a 100644
--- a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java
+++ b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java
@@ -973,9 +973,12 @@ private Network getKubernetesClusterNetworkIfMissing(final String clusterName, f
 
             CallContext networkContext = CallContext.register(CallContext.current(), ApiCommandResourceType.Network);
             try {
+                Long zoneId = zone.getId();
+                Integer publicMTU = NetworkService.VRPublicInterfaceMtu.valueIn(zoneId);
+                Integer privateMTU = NetworkService.VRPrivateInterfaceMtu.valueIn(zoneId);
                 network = networkService.createGuestNetwork(networkOffering.getId(), clusterName + "-network",
-                        owner.getAccountName() + "-network", owner, physicalNetwork, zone.getId(),
-                        ControlledEntity.ACLType.Account);
+                        owner.getAccountName() + "-network", owner, physicalNetwork, zoneId,
+                        ControlledEntity.ACLType.Account, new Pair<>(publicMTU, privateMTU));
             } catch (ConcurrentOperationException | InsufficientCapacityException | ResourceAllocationException e) {
                 logAndThrow(Level.ERROR, String.format("Unable to create network for the Kubernetes cluster: %s", clusterName));
             } finally {
diff --git a/server/src/main/java/com/cloud/network/NetworkServiceImpl.java b/server/src/main/java/com/cloud/network/NetworkServiceImpl.java
index 3c5b7ec7b1fc..cfa4574d9964 100644
--- a/server/src/main/java/com/cloud/network/NetworkServiceImpl.java
+++ b/server/src/main/java/com/cloud/network/NetworkServiceImpl.java
@@ -1869,6 +1869,18 @@ public Network createGuestNetwork(long networkOfferingId, String name, String di
                 null, null, null, null, null, null, null, null, null, null);
     }
 
+    @Override
+    @DB
+    @ActionEvent(eventType = EventTypes.EVENT_NETWORK_CREATE, eventDescription = "creating network")
+    public Network createGuestNetwork(long networkOfferingId, String name, String displayText, Account owner,
+                                      PhysicalNetwork physicalNetwork, long zoneId, ACLType aclType, Pair<Integer, Integer> vrIfaceMTUs) throws
+            InsufficientCapacityException, ConcurrentOperationException, ResourceAllocationException {
+        return _networkMgr.createGuestNetwork(networkOfferingId, name, displayText,
+                null, null, null, false, null, owner, null, physicalNetwork, zoneId,
+                aclType, null, null, null, null, true, null,
+                null, null, null, null, null, null, null, null, vrIfaceMTUs, null);
+    }
+
     void checkAndSetRouterSourceNatIp(Account owner, CreateNetworkCmd cmd, Network network) throws InsufficientAddressCapacityException, ResourceAllocationException {
         String sourceNatIp = cmd.getSourceNatIP();
         if (sourceNatIp == null) {
diff --git a/server/src/test/java/com/cloud/vpc/MockNetworkManagerImpl.java b/server/src/test/java/com/cloud/vpc/MockNetworkManagerImpl.java
index 7f4344f30e42..673d0b7a48c5 100644
--- a/server/src/test/java/com/cloud/vpc/MockNetworkManagerImpl.java
+++ b/server/src/test/java/com/cloud/vpc/MockNetworkManagerImpl.java
@@ -230,6 +230,13 @@ public Network createGuestNetwork(long networkOfferingId, String name, String di
         return null;
     }
 
+    @Override
+    public Network createGuestNetwork(long networkOfferingId, String name, String displayText, Account owner,
+           PhysicalNetwork physicalNetwork, long zoneId, ACLType aclType, Pair<Integer, Integer> vrIfaceMTUs)
+            throws InsufficientCapacityException, ConcurrentOperationException, ResourceAllocationException {
+        return null;
+    }
+
     /* (non-Javadoc)
      * @see com.cloud.network.NetworkService#searchForNetworks(com.cloud.api.commands.ListNetworksCmd)
      */

From af9d68630f7a5ce70ab329f8d2f96f36aa736223 Mon Sep 17 00:00:00 2001
From: Manoj Kumar <manojkr.itbhu@gmail.com>
Date: Tue, 27 Jan 2026 16:36:52 +0530
Subject: [PATCH 039/117] Initialize template status='Processing' (#11970)

* Initialize template status='Processing'

* remove else block and fix the error string

* restructure if-else

* standardize register ISO response

* use enum instead of string

* fix smoke test failures

* Add Download Complete status for template
---
 .../api/query/dao/TemplateJoinDaoImpl.java    | 79 ++++++++++---------
 tools/marvin/marvin/lib/base.py               |  3 +-
 2 files changed, 45 insertions(+), 37 deletions(-)

diff --git a/server/src/main/java/com/cloud/api/query/dao/TemplateJoinDaoImpl.java b/server/src/main/java/com/cloud/api/query/dao/TemplateJoinDaoImpl.java
index 05c024e8f9b9..bd3da5340562 100644
--- a/server/src/main/java/com/cloud/api/query/dao/TemplateJoinDaoImpl.java
+++ b/server/src/main/java/com/cloud/api/query/dao/TemplateJoinDaoImpl.java
@@ -77,6 +77,7 @@
 import com.cloud.user.Account;
 import com.cloud.user.AccountService;
 import com.cloud.utils.Pair;
+import com.cloud.utils.StringUtils;
 import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
@@ -161,29 +162,50 @@ protected TemplateJoinDaoImpl() {
         _count = "select count(distinct temp_zone_pair) from template_view WHERE ";
     }
 
+    private enum TemplateStatus {
+        SUCCESSFULLY_INSTALLED("Successfully Installed"),
+        INSTALLING_TEMPLATE("Installing Template"),
+        INSTALLING_ISO("Installing ISO"),
+        BYPASSED_SECONDARY_STORAGE("Bypassed Secondary Storage"),
+        PROCESSING("Processing"),
+        DOWNLOADING("%d%% Downloaded"),
+        DOWNLOAD_COMPLETE("Download Complete");
+
+        private final String status;
+        TemplateStatus(String status) {
+            this.status = status;
+        }
+        public String getStatus() {
+            return status;
+        }
+        // For statuses that have dynamic details (e.g. "75% Downloaded").
+        public String format(int percent) {
+            return String.format(status, percent);
+        }
+    }
+
     private String getTemplateStatus(TemplateJoinVO template) {
-        String templateStatus = null;
-        if (template.getDownloadState() != Status.DOWNLOADED) {
-            templateStatus = "Processing";
-            if (template.getDownloadState() == Status.DOWNLOAD_IN_PROGRESS) {
-                if (template.getDownloadPercent() == 100) {
-                    templateStatus = "Installing Template";
-                } else {
-                    templateStatus = template.getDownloadPercent() + "% Downloaded";
-                }
-            } else if (template.getDownloadState() == Status.BYPASSED) {
-                templateStatus = "Bypassed Secondary Storage";
-            } else if (template.getErrorString() == null) {
-                templateStatus = template.getTemplateState().toString();
+        if (template == null) {
+            return  null;
+        }
+        boolean isIso = Storage.ImageFormat.ISO == template.getFormat();
+        TemplateStatus templateStatus;
+        if (template.getDownloadState() == Status.DOWNLOADED) {
+            templateStatus =  isIso ? TemplateStatus.SUCCESSFULLY_INSTALLED : TemplateStatus.DOWNLOAD_COMPLETE;
+        } else if (template.getDownloadState() == Status.DOWNLOAD_IN_PROGRESS) {
+            if (template.getDownloadPercent() == 100) {
+                templateStatus = isIso ? TemplateStatus.INSTALLING_ISO : TemplateStatus.INSTALLING_TEMPLATE;
             } else {
-                templateStatus = template.getErrorString().trim();
+                return TemplateStatus.DOWNLOADING.format(template.getDownloadPercent());
             }
-        } else if (template.getDownloadState() == Status.DOWNLOADED) {
-            templateStatus = "Download Complete";
+        } else if (template.getDownloadState() == Status.BYPASSED) {
+            templateStatus = TemplateStatus.BYPASSED_SECONDARY_STORAGE;
+        } else if (StringUtils.isNotBlank(template.getErrorString())) {
+            return template.getErrorString().trim();
         } else {
-            templateStatus = "Successfully Installed";
+            templateStatus = TemplateStatus.PROCESSING;
         }
-        return templateStatus;
+        return templateStatus.getStatus();
     }
 
     @Override
@@ -511,24 +533,9 @@ public TemplateResponse newIsoResponse(TemplateJoinVO iso, ResponseView view) {
         // If the user is an admin, add the template download status
         if (isAdmin || caller.getId() == iso.getAccountId()) {
             // add download status
-            if (iso.getDownloadState() != Status.DOWNLOADED) {
-                String isoStatus = "Processing";
-                if (iso.getDownloadState() == Status.DOWNLOADED) {
-                    isoStatus = "Download Complete";
-                } else if (iso.getDownloadState() == Status.DOWNLOAD_IN_PROGRESS) {
-                    if (iso.getDownloadPercent() == 100) {
-                        isoStatus = "Installing ISO";
-                    } else {
-                        isoStatus = iso.getDownloadPercent() + "% Downloaded";
-                    }
-                } else if (iso.getDownloadState() == Status.BYPASSED) {
-                    isoStatus = "Bypassed Secondary Storage";
-                } else {
-                    isoStatus = iso.getErrorString();
-                }
-                isoResponse.setStatus(isoStatus);
-            } else {
-                isoResponse.setStatus("Successfully Installed");
+            String templateStatus = getTemplateStatus(iso);
+            if (templateStatus != null) {
+                isoResponse.setStatus(templateStatus);
             }
             isoResponse.setUrl(iso.getUrl());
             List<TemplateDataStoreVO> isosInStore = _templateStoreDao.listByTemplateNotBypassed(iso.getId());
diff --git a/tools/marvin/marvin/lib/base.py b/tools/marvin/marvin/lib/base.py
index 3d232d887c8d..39a0ccb6dd86 100755
--- a/tools/marvin/marvin/lib/base.py
+++ b/tools/marvin/marvin/lib/base.py
@@ -1658,11 +1658,12 @@ def download(self, apiclient, retries=300, interval=5):
                 # If template is ready,
                 # template.status = Download Complete
                 # Downloading - x% Downloaded
+                # Processing - Initial status
                 # Error - Any other string
                 if template.status == 'Download Complete' and template.isready:
                     return
 
-                elif 'Downloaded' in template.status:
+                elif 'Downloaded' in template.status or template.status == 'Processing':
                     retries = retries - 1
                     continue
 

From c0b5358d8eb55c1611e14528df9df60894b1e3e9 Mon Sep 17 00:00:00 2001
From: Edward-x <30854794+YLChen-007@users.noreply.github.com>
Date: Tue, 27 Jan 2026 19:55:40 +0800
Subject: [PATCH 040/117] fix Host Password Exposed in Command-Line Logging
 (#12016)

---
 .../wrapper/xenbase/CitrixUpdateHostPasswordCommandWrapper.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixUpdateHostPasswordCommandWrapper.java b/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixUpdateHostPasswordCommandWrapper.java
index 1acc292b450b..af868d8c1c70 100644
--- a/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixUpdateHostPasswordCommandWrapper.java
+++ b/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixUpdateHostPasswordCommandWrapper.java
@@ -45,7 +45,7 @@ public Answer execute(final UpdateHostPasswordCommand command, final CitrixResou
 
         Pair<Boolean, String> result;
         try {
-            logger.debug("Executing command in Host: " + cmdLine);
+            logger.debug("Executing password update command on host: {} for user: {}", hostIp, username);
             final String hostPassword = citrixResourceBase.getPwdFromQueue();
             result = xenServerUtilitiesHelper.executeSshWrapper(hostIp, 22, username, null, hostPassword, cmdLine.toString());
         } catch (final Exception e) {

From cd2d71104ed27d936bd1636deb6e4f8da8a57420 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Erik=20B=C3=B6ck?=
 <89930804+erikbocks@users.noreply.github.com>
Date: Tue, 27 Jan 2026 08:59:06 -0300
Subject: [PATCH 041/117] Implement SSVM storage network IP to API response and
 GUI details tab (#11979)

* Implement SSVM storage network IP to API response and GUI details tab

* remove network mention from attribute name

* remove network from serialized name

* fix parameter name in the UI
---
 .../cloudstack/api/response/SystemVmResponse.java    | 12 ++++++++++++
 .../main/java/com/cloud/api/ApiResponseHelper.java   |  2 ++
 ui/public/locales/en.json                            |  1 +
 ui/public/locales/pt_BR.json                         |  1 +
 ui/src/config/section/infra/systemVms.js             |  2 +-
 5 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/api/src/main/java/org/apache/cloudstack/api/response/SystemVmResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/SystemVmResponse.java
index e69f6366742c..a3ed88c27356 100644
--- a/api/src/main/java/org/apache/cloudstack/api/response/SystemVmResponse.java
+++ b/api/src/main/java/org/apache/cloudstack/api/response/SystemVmResponse.java
@@ -126,6 +126,10 @@ public class SystemVmResponse extends BaseResponseWithAnnotations {
     @Param(description = "The public netmask for the System VM")
     private String publicNetmask;
 
+    @SerializedName("storageip")
+    @Param(description = "the ip address for the system VM on the storage network")
+    private String storageIp;
+
     @SerializedName("templateid")
     @Param(description = "The Template ID for the System VM")
     private String templateId;
@@ -355,6 +359,14 @@ public void setPublicNetmask(String publicNetmask) {
         this.publicNetmask = publicNetmask;
     }
 
+    public String getStorageIp() {
+        return storageIp;
+    }
+
+    public void setStorageIp(String storageIp) {
+        this.storageIp = storageIp;
+    }
+
     public String getTemplateId() {
         return templateId;
     }
diff --git a/server/src/main/java/com/cloud/api/ApiResponseHelper.java b/server/src/main/java/com/cloud/api/ApiResponseHelper.java
index 48696118a34c..55d3c298db19 100644
--- a/server/src/main/java/com/cloud/api/ApiResponseHelper.java
+++ b/server/src/main/java/com/cloud/api/ApiResponseHelper.java
@@ -1884,6 +1884,8 @@ public SystemVmResponse createSystemVmResponse(VirtualMachine vm) {
                             vmResponse.setPublicNetmask(singleNicProfile.getIPv4Netmask());
                             vmResponse.setGateway(singleNicProfile.getIPv4Gateway());
                         }
+                    } else if (network.getTrafficType() == TrafficType.Storage) {
+                        vmResponse.setStorageIp(singleNicProfile.getIPv4Address());
                     }
                 }
             }
diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index db3a2dc4c616..2cf5f70049df 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -2438,6 +2438,7 @@
 "label.storagepool.tooltip": "Destination Storage Pool. Volume should be located in this Storage Pool",
 "label.storagetags": "Storage tags",
 "label.storagetype": "Storage type",
+"label.storageip": "Storage IP address",
 "label.strict": "Strict",
 "label.subdomainaccess": "Subdomain access",
 "label.submit": "Submit",
diff --git a/ui/public/locales/pt_BR.json b/ui/public/locales/pt_BR.json
index 76f8fa2b09cf..6bd42c84a7eb 100644
--- a/ui/public/locales/pt_BR.json
+++ b/ui/public/locales/pt_BR.json
@@ -1584,6 +1584,7 @@
 "label.storagepool": "Pool de armazenamento",
 "label.storagetags": "Tags de armazenamento",
 "label.storagetype": "Tipo de armazenamento",
+"label.storageip": "Endere\u00e7o IP na rede de armazenamento",
 "label.strict": "Rigoroso",
 "label.subdomainaccess": "acesso ao subdom\u00ednio",
 "label.submit": "Enviar",
diff --git a/ui/src/config/section/infra/systemVms.js b/ui/src/config/section/infra/systemVms.js
index 6e135ccdd36a..4a5879b17626 100644
--- a/ui/src/config/section/infra/systemVms.js
+++ b/ui/src/config/section/infra/systemVms.js
@@ -26,7 +26,7 @@ export default {
   permission: ['listSystemVms'],
   searchFilters: ['name', 'zoneid', 'podid', 'hostid', 'systemvmtype', 'storageid', 'arch'],
   columns: ['name', 'state', 'agentstate', 'systemvmtype', 'publicip', 'privateip', 'linklocalip', 'version', 'hostname', 'arch', 'zonename'],
-  details: ['name', 'id', 'agentstate', 'systemvmtype', 'publicip', 'privateip', 'linklocalip', 'gateway', 'hostname', 'arch', 'version', 'zonename', 'created', 'activeviewersessions', 'isdynamicallyscalable', 'hostcontrolstate'],
+  details: ['name', 'id', 'agentstate', 'systemvmtype', 'publicip', 'privateip', 'linklocalip', 'gateway', 'hostname', 'arch', 'version', 'zonename', 'created', 'activeviewersessions', 'isdynamicallyscalable', 'hostcontrolstate', 'storageip'],
   resourceType: 'SystemVm',
   filters: () => {
     const filters = ['starting', 'running', 'stopping', 'stopped', 'destroyed', 'expunging', 'migrating', 'error', 'unknown', 'shutdown']

From 2056c582f1c789a37b0b417892b458e9b24f966a Mon Sep 17 00:00:00 2001
From: Abhisar Sinha <63767682+abh1sar@users.noreply.github.com>
Date: Tue, 27 Jan 2026 18:01:02 +0530
Subject: [PATCH 042/117] Fix logging of forwarded IPs in logs  (#11854)

---
 .../org/apache/cloudstack/ACSRequestLog.java  |  7 +-
 .../org/apache/cloudstack/ServerDaemon.java   | 19 -----
 .../main/java/com/cloud/api/ApiServlet.java   | 34 ++++-----
 .../java/com/cloud/api/ApiServletTest.java    | 71 +++++++++++++------
 4 files changed, 69 insertions(+), 62 deletions(-)

diff --git a/client/src/main/java/org/apache/cloudstack/ACSRequestLog.java b/client/src/main/java/org/apache/cloudstack/ACSRequestLog.java
index 123d2761e008..249451120f1c 100644
--- a/client/src/main/java/org/apache/cloudstack/ACSRequestLog.java
+++ b/client/src/main/java/org/apache/cloudstack/ACSRequestLog.java
@@ -18,6 +18,7 @@
 //
 package org.apache.cloudstack;
 
+import com.cloud.api.ApiServlet;
 import com.cloud.utils.StringUtils;
 import org.eclipse.jetty.server.NCSARequestLog;
 import org.eclipse.jetty.server.Request;
@@ -25,6 +26,7 @@
 import org.eclipse.jetty.util.DateCache;
 import org.eclipse.jetty.util.component.LifeCycle;
 
+import java.net.InetAddress;
 import java.util.Locale;
 import java.util.TimeZone;
 
@@ -51,9 +53,8 @@ public void log(Request request, Response response) {
             StringBuilder sb = buffers.get();
             sb.setLength(0);
 
-            sb.append(request.getHttpChannel().getEndPoint()
-                            .getRemoteAddress().getAddress()
-                            .getHostAddress())
+            InetAddress remoteAddress = ApiServlet.getClientAddress(request);
+            sb.append(remoteAddress.getHostAddress())
                     .append(" - - [")
                     .append(dateCache.format(request.getTimeStamp()))
                     .append("] \"")
diff --git a/client/src/main/java/org/apache/cloudstack/ServerDaemon.java b/client/src/main/java/org/apache/cloudstack/ServerDaemon.java
index 196695e1fc6b..09bdb11a6b39 100644
--- a/client/src/main/java/org/apache/cloudstack/ServerDaemon.java
+++ b/client/src/main/java/org/apache/cloudstack/ServerDaemon.java
@@ -24,15 +24,12 @@
 import java.io.InputStream;
 import java.lang.management.ManagementFactory;
 import java.net.URL;
-import java.util.Arrays;
 import java.util.Properties;
 
-import com.cloud.api.ApiServer;
 import org.apache.commons.daemon.Daemon;
 import org.apache.commons.daemon.DaemonContext;
 import org.apache.commons.lang3.StringUtils;
 import org.eclipse.jetty.jmx.MBeanContainer;
-import org.eclipse.jetty.server.ForwardedRequestCustomizer;
 import org.eclipse.jetty.server.HttpConfiguration;
 import org.eclipse.jetty.server.HttpConnectionFactory;
 import org.eclipse.jetty.server.RequestLog;
@@ -193,7 +190,6 @@ public void start() throws Exception {
         httpConfig.setResponseHeaderSize(8192);
         httpConfig.setSendServerVersion(false);
         httpConfig.setSendDateHeader(false);
-        addForwardingCustomiser(httpConfig);
 
         // HTTP Connector
         createHttpConnector(httpConfig);
@@ -216,21 +212,6 @@ public void start() throws Exception {
         server.join();
     }
 
-    /**
-     * Adds a ForwardedRequestCustomizer to the HTTP configuration to handle forwarded headers.
-     * The header used for forwarding is determined by the ApiServer.listOfForwardHeaders property.
-     * Only non empty headers are considered and only the first of the comma-separated list is used.
-     * @param httpConfig the HTTP configuration to which the customizer will be added
-     */
-    private static void addForwardingCustomiser(HttpConfiguration httpConfig) {
-        ForwardedRequestCustomizer customiser = new ForwardedRequestCustomizer();
-        String header = Arrays.stream(ApiServer.listOfForwardHeaders.value().split(",")).findFirst().orElse(null);
-        if (com.cloud.utils.StringUtils.isNotEmpty(header)) {
-            customiser.setForwardedForHeader(header);
-        }
-        httpConfig.addCustomizer(customiser);
-    }
-
     @Override
     public void stop() throws Exception {
         server.stop();
diff --git a/server/src/main/java/com/cloud/api/ApiServlet.java b/server/src/main/java/com/cloud/api/ApiServlet.java
index 21d093758127..db17daaf146b 100644
--- a/server/src/main/java/com/cloud/api/ApiServlet.java
+++ b/server/src/main/java/com/cloud/api/ApiServlet.java
@@ -679,38 +679,34 @@ private boolean isSpecificAPI(String commandName) {
         }
         return false;
     }
-    boolean doUseForwardHeaders() {
+    static boolean doUseForwardHeaders() {
         return Boolean.TRUE.equals(ApiServer.useForwardHeader.value());
     }
 
-    String[] proxyNets() {
+    static String[] proxyNets() {
         return ApiServer.proxyForwardList.value().split(",");
     }
     //This method will try to get login IP of user even if servlet is behind reverseProxy or loadBalancer
-    public InetAddress getClientAddress(final HttpServletRequest request) throws UnknownHostException {
-        String ip = null;
-        InetAddress pretender = InetAddress.getByName(request.getRemoteAddr());
-        if(doUseForwardHeaders()) {
-            if (NetUtils.isIpInCidrList(pretender, proxyNets())) {
+    public static InetAddress getClientAddress(final HttpServletRequest request) throws UnknownHostException {
+        final String remote = request.getRemoteAddr();
+        if (doUseForwardHeaders()) {
+            final InetAddress remoteAddr = InetAddress.getByName(remote);
+            if (NetUtils.isIpInCidrList(remoteAddr, proxyNets())) {
                 for (String header : getClientAddressHeaders()) {
                     header = header.trim();
-                    ip = getCorrectIPAddress(request.getHeader(header));
+                    final String ip = getCorrectIPAddress(request.getHeader(header));
                     if (StringUtils.isNotBlank(ip)) {
-                        LOGGER.debug(String.format("found ip %s in header %s ", ip, header));
-                        break;
+                        LOGGER.debug("found ip {} in header {}", ip, header);
+                        return InetAddress.getByName(ip);
                     }
-                } // no address found in header so ip is blank and use remote addr
-            } // else not an allowed proxy address, ip is blank and use remote addr
-        }
-        if (StringUtils.isBlank(ip)) {
-            LOGGER.trace(String.format("no ip found in headers, returning remote address %s.", pretender.getHostAddress()));
-            return pretender;
+                }
+            }
         }
-
-        return InetAddress.getByName(ip);
+        LOGGER.trace("no ip found in headers, returning remote address {}.", remote);
+        return InetAddress.getByName(remote);
     }
 
-    private String[] getClientAddressHeaders() {
+    private static String[] getClientAddressHeaders() {
         return ApiServer.listOfForwardHeaders.value().split(",");
     }
 
diff --git a/server/src/test/java/com/cloud/api/ApiServletTest.java b/server/src/test/java/com/cloud/api/ApiServletTest.java
index 4d4f0a12098c..79fe4b86f859 100644
--- a/server/src/test/java/com/cloud/api/ApiServletTest.java
+++ b/server/src/test/java/com/cloud/api/ApiServletTest.java
@@ -33,6 +33,7 @@
 import org.apache.cloudstack.api.auth.APIAuthenticator;
 import org.apache.cloudstack.api.command.admin.config.ListCfgsByCmd;
 import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.config.impl.ConfigDepotImpl;
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
@@ -97,17 +98,20 @@ public class ApiServletTest {
     @Mock
     AccountService accountMgr;
 
-    @Mock ConfigKey<Boolean> useForwardHeader;
+    @Mock
+    ConfigDepotImpl mockConfigDepot;
+
     StringWriter responseWriter;
 
     ApiServlet servlet;
-    ApiServlet spyServlet;
+
+    private ConfigDepotImpl originalConfigDepot;
+
     @SuppressWarnings("unchecked")
     @Before
     public void setup() throws SecurityException, NoSuchFieldException,
-    IllegalArgumentException, IllegalAccessException, IOException, UnknownHostException {
+            IllegalArgumentException, IllegalAccessException, IOException {
         servlet = new ApiServlet();
-        spyServlet = Mockito.spy(servlet);
         responseWriter = new StringWriter();
         Mockito.when(response.getWriter()).thenReturn(
                 new PrintWriter(responseWriter));
@@ -131,6 +135,7 @@ public void setup() throws SecurityException, NoSuchFieldException,
         apiServerField.setAccessible(true);
         apiServerField.set(servlet, apiServer);
 
+        setupConfigDepotMock();
     }
 
     /**
@@ -151,6 +156,33 @@ public void cleanupEnvironmentHacks() throws Exception {
         Field smsField = ApiDBUtils.class.getDeclaredField("s_ms");
         smsField.setAccessible(true);
         smsField.set(null, null);
+        restoreConfigDepot();
+    }
+
+    private void setupConfigDepotMock() throws NoSuchFieldException, IllegalAccessException {
+        Field depotField = ConfigKey.class.getDeclaredField("s_depot");
+        depotField.setAccessible(true);
+        originalConfigDepot = (ConfigDepotImpl) depotField.get(null);
+        depotField.set(null, mockConfigDepot);
+        Mockito.when(mockConfigDepot.getConfigStringValue(
+            Mockito.anyString(),
+            Mockito.any(ConfigKey.Scope.class),
+            Mockito.any()
+        )).thenReturn(null);
+    }
+
+    private void restoreConfigDepot() throws Exception {
+        Field depotField = ConfigKey.class.getDeclaredField("s_depot");
+        depotField.setAccessible(true);
+        depotField.set(null, originalConfigDepot);
+    }
+
+    private void setConfigValue(String configName, String value) {
+        Mockito.when(mockConfigDepot.getConfigStringValue(
+            Mockito.eq(configName),
+            Mockito.eq(ConfigKey.Scope.Global),
+            Mockito.isNull()
+        )).thenReturn(value);
     }
 
     @Test
@@ -261,43 +293,40 @@ public void processRequestInContextLogin() throws UnknownHostException {
 
     @Test
     public void getClientAddressWithXForwardedFor() throws UnknownHostException {
-        String[] proxynet = {"127.0.0.0/8"};
-        Mockito.when(spyServlet.proxyNets()).thenReturn(proxynet);
-        Mockito.when(spyServlet.doUseForwardHeaders()).thenReturn(true);
+        setConfigValue("proxy.header.verify", "true");
+        setConfigValue("proxy.cidr", "127.0.0.0/8");
+        Mockito.when(request.getRemoteAddr()).thenReturn("127.0.0.1");
         Mockito.when(request.getHeader(Mockito.eq("X-Forwarded-For"))).thenReturn("192.168.1.1");
-        Assert.assertEquals(InetAddress.getByName("192.168.1.1"), spyServlet.getClientAddress(request));
+        Assert.assertEquals(InetAddress.getByName("192.168.1.1"), ApiServlet.getClientAddress(request));
     }
 
     @Test
     public void getClientAddressWithHttpXForwardedFor() throws UnknownHostException {
-        String[] proxynet = {"127.0.0.0/8"};
-        Mockito.when(spyServlet.proxyNets()).thenReturn(proxynet);
-        Mockito.when(spyServlet.doUseForwardHeaders()).thenReturn(true);
+        setConfigValue("proxy.header.verify", "true");
+        setConfigValue("proxy.cidr", "127.0.0.0/8");
         Mockito.when(request.getHeader(Mockito.eq("HTTP_X_FORWARDED_FOR"))).thenReturn("192.168.1.1");
-        Assert.assertEquals(InetAddress.getByName("192.168.1.1"), spyServlet.getClientAddress(request));
+        Assert.assertEquals(InetAddress.getByName("192.168.1.1"), ApiServlet.getClientAddress(request));
     }
 
     @Test
     public void getClientAddressWithRemoteAddr() throws UnknownHostException {
-        String[] proxynet = {"127.0.0.0/8"};
-        Mockito.when(spyServlet.proxyNets()).thenReturn(proxynet);
-        Mockito.when(spyServlet.doUseForwardHeaders()).thenReturn(true);
-        Assert.assertEquals(InetAddress.getByName("127.0.0.1"), spyServlet.getClientAddress(request));
+        setConfigValue("proxy.header.verify", "true");
+        setConfigValue("proxy.cidr", "127.0.0.0/8");
+        Assert.assertEquals(InetAddress.getByName("127.0.0.1"), ApiServlet.getClientAddress(request));
     }
 
     @Test
     public void getClientAddressWithHttpClientIp() throws UnknownHostException {
-        String[] proxynet = {"127.0.0.0/8"};
-        Mockito.when(spyServlet.proxyNets()).thenReturn(proxynet);
-        Mockito.when(spyServlet.doUseForwardHeaders()).thenReturn(true);
+        setConfigValue("proxy.header.verify", "true");
+        setConfigValue("proxy.cidr", "127.0.0.0/8");
         Mockito.when(request.getHeader(Mockito.eq("HTTP_CLIENT_IP"))).thenReturn("192.168.1.1");
-        Assert.assertEquals(InetAddress.getByName("192.168.1.1"), spyServlet.getClientAddress(request));
+        Assert.assertEquals(InetAddress.getByName("192.168.1.1"), ApiServlet.getClientAddress(request));
     }
 
     @Test
     public void getClientAddressDefault() throws UnknownHostException {
         Mockito.when(request.getRemoteAddr()).thenReturn("127.0.0.1");
-        Assert.assertEquals(InetAddress.getByName("127.0.0.1"), spyServlet.getClientAddress(request));
+        Assert.assertEquals(InetAddress.getByName("127.0.0.1"), ApiServlet.getClientAddress(request));
     }
 
     @Test

From d6c192c0f083a6dccacefcd1de4dd2c3e5f4dedf Mon Sep 17 00:00:00 2001
From: Lorenzo Tanganelli <lorenzo.tanganelli@hotmail.it>
Date: Tue, 27 Jan 2026 13:45:16 +0100
Subject: [PATCH 043/117] fix template id unmanaged vm (#12288)

* fix template id unmanaged vm

* Update == to equals

Co-authored-by: dahn <daan.hoogland@gmail.com>

---------

Co-authored-by: dahn <daan.hoogland@gmail.com>
---
 .../org/apache/cloudstack/vm/UnmanagedVMsManagerImpl.java    | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/server/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImpl.java b/server/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImpl.java
index 13fa2608016c..14c67417015c 100644
--- a/server/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImpl.java
@@ -1550,11 +1550,12 @@ private ServiceOfferingVO getServiceOfferingForImportInstance(Long serviceOfferi
     protected VMTemplateVO getTemplateForImportInstance(Long templateId, Hypervisor.HypervisorType hypervisorType) {
         VMTemplateVO template;
         if (templateId == null) {
-            template = templateDao.findByName(VM_IMPORT_DEFAULT_TEMPLATE_NAME);
+            String templateName = (Hypervisor.HypervisorType.KVM.equals(hypervisorType)) ? KVM_VM_IMPORT_DEFAULT_TEMPLATE_NAME : VM_IMPORT_DEFAULT_TEMPLATE_NAME;
+            template = templateDao.findByName(templateName);
             if (template == null) {
                 template = createDefaultDummyVmImportTemplate(Hypervisor.HypervisorType.KVM == hypervisorType);
                 if (template == null) {
-                    throw new InvalidParameterValueException(String.format("Default VM import template with unique name: %s for hypervisor: %s cannot be created. Please use templateid parameter for import", VM_IMPORT_DEFAULT_TEMPLATE_NAME, hypervisorType.toString()));
+                    throw new InvalidParameterValueException(String.format("Default VM import template with unique name: %s for hypervisor: %s cannot be created. Please use templateid parameter for import", templateName, hypervisorType.toString()));
                 }
             }
         } else {

From d722c9551a517e6c68919be82995699ed242a8e4 Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Tue, 27 Jan 2026 18:16:06 +0530
Subject: [PATCH 044/117] ui: fix form data double fetch/reset
 DeployVMFromBackup form data by ownership selection (#11706)

* ui: fix form data double fetch/reset DeployVMFromBackup form data by ownership selection

Related #11705

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

---------

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
---
 ui/src/components/view/DeployVMFromBackup.vue | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ui/src/components/view/DeployVMFromBackup.vue b/ui/src/components/view/DeployVMFromBackup.vue
index c1f0ffc6d145..55808db291c2 100644
--- a/ui/src/components/view/DeployVMFromBackup.vue
+++ b/ui/src/components/view/DeployVMFromBackup.vue
@@ -2137,7 +2137,9 @@ export default {
         this.owner.domainid = null
         this.owner.projectid = OwnerOptions.selectedProject
       }
-      this.resetData()
+      if (OwnerOptions.initialized) {
+        this.resetData()
+      }
     },
     fetchZones (zoneId, listZoneAllow) {
       this.zones = []

From 9dee13726588c9be91da4822c71ca5ae959839e1 Mon Sep 17 00:00:00 2001
From: Wei Zhou <weizhou@apache.org>
Date: Tue, 27 Jan 2026 14:39:08 +0100
Subject: [PATCH 045/117] debian/control: remove python2 as dependency of build
 environment (#12213)

This fixes the issue that ACS cannot be packaged on Ubuntu 24.04 due to unsupported python2
verified by `apt-get build-dep .`
---
 debian/control | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/debian/control b/debian/control
index 78842e38ed27..2b8ce929c639 100644
--- a/debian/control
+++ b/debian/control
@@ -4,7 +4,7 @@ Priority: extra
 Maintainer: The Apache CloudStack Team <dev@cloudstack.apache.org>
 Build-Depends: debhelper (>= 9), openjdk-17-jdk | java17-sdk | java17-jdk | zulu-17 | openjdk-11-jdk | java11-sdk | java11-jdk | zulu-11, genisoimage,
  python-mysql.connector | python3-mysql.connector | mysql-connector-python-py3, maven (>= 3) | maven3,
- python (>= 2.7) | python2 (>= 2.7), python3 (>= 3), python-setuptools, python3-setuptools,
+ python3 (>= 3), python3-setuptools,
  nodejs (>= 12), lsb-release, dh-systemd | debhelper (>= 13)
 Standards-Version: 3.8.1
 Homepage: http://www.cloudstack.org/

From 5aced7325046a3c80a997370176a56bd346859d9 Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Tue, 27 Jan 2026 21:18:18 +0530
Subject: [PATCH 046/117] ui: reset configuration allowed only when value not
 default (#11728)

---
 ui/src/components/view/ListView.vue             |  2 +-
 ui/src/components/view/SettingsTab.vue          | 10 +++++++++-
 ui/src/views/setting/ConfigurationHierarchy.vue |  5 ++++-
 ui/src/views/setting/ConfigurationTab.vue       | 13 +++++++++++--
 ui/src/views/setting/ConfigurationTable.vue     |  8 +++++++-
 ui/src/views/setting/ConfigurationValue.vue     | 14 +++++++++-----
 6 files changed, 41 insertions(+), 11 deletions(-)

diff --git a/ui/src/components/view/ListView.vue b/ui/src/components/view/ListView.vue
index 375fddcb55c6..bf26145c1356 100644
--- a/ui/src/components/view/ListView.vue
+++ b/ui/src/components/view/ListView.vue
@@ -966,7 +966,7 @@
           @onClick="$resetConfigurationValueConfirm(item, resetConfig)"
           v-if="editableValueKey !== record.key"
           icon="reload-outlined"
-          :disabled="!('updateConfiguration' in $store.getters.apis)"
+          :disabled="!('resetConfiguration' in $store.getters.apis) || record.value === record.defaultvalue"
         />
       </template>
       <template v-if="column.key === 'gpuDeviceActions'">
diff --git a/ui/src/components/view/SettingsTab.vue b/ui/src/components/view/SettingsTab.vue
index ab75bef83949..0e0ee33f2800 100644
--- a/ui/src/components/view/SettingsTab.vue
+++ b/ui/src/components/view/SettingsTab.vue
@@ -26,7 +26,8 @@
       <ConfigurationTable
         :columns="columns"
         :config="items"
-        :resource="resource" />
+        :resource="resource"
+        @refresh-config="handleConfigRefresh" />
     </a-col>
   </div>
 </template>
@@ -140,6 +141,13 @@ export default {
     handleSearch (value) {
       this.filter = value
       this.fetchData()
+    },
+    handleConfigRefresh (name, updatedRecord) {
+      if (!name || !updatedRecord) return
+      const index = this.items.findIndex(item => item.name === name)
+      if (index !== -1) {
+        this.items.splice(index, 1, updatedRecord)
+      }
     }
   }
 }
diff --git a/ui/src/views/setting/ConfigurationHierarchy.vue b/ui/src/views/setting/ConfigurationHierarchy.vue
index 80b464e657cc..815a048bc257 100644
--- a/ui/src/views/setting/ConfigurationHierarchy.vue
+++ b/ui/src/views/setting/ConfigurationHierarchy.vue
@@ -34,7 +34,7 @@
         <span :style="record.parent ? 'padding-left: 50px; display:block' : 'padding-left: 25px; display:block'">{{ record.description }}</span>
       </template>
       <template v-if="column.key === 'value'">
-        <ConfigurationValue :configrecord="record" />
+        <ConfigurationValue :configrecord="record" @refresh="handleConfigRefresh" />
       </template>
     </template>
   </a-table>
@@ -83,6 +83,9 @@ export default {
         return 'light-row'
       }
       return 'dark-row'
+    },
+    handleConfigRefresh (name, updatedRecord) {
+      this.$emit('refresh-config', name, updatedRecord)
     }
   }
 }
diff --git a/ui/src/views/setting/ConfigurationTab.vue b/ui/src/views/setting/ConfigurationTab.vue
index 75905cbd1748..65b256c94c95 100644
--- a/ui/src/views/setting/ConfigurationTab.vue
+++ b/ui/src/views/setting/ConfigurationTab.vue
@@ -58,7 +58,8 @@
                   :count="count"
                   :page="page"
                   :pagesize="pagesize"
-                  @change-page="changePage" />
+                  @change-page="changePage"
+                  @refresh-config="handleConfigRefresh" />
             </a-tab-pane>
             <a-tab-pane
               v-for="(group) in groups"
@@ -74,7 +75,8 @@
                   :tab="subgroup.name" >
                   <ConfigurationHierarchy
                     :columns="columns"
-                    :config="config" />
+                    :config="config"
+                    @refresh-config="handleConfigRefresh" />
                 </a-tab-pane>
               </a-tabs>
             </a-tab-pane>
@@ -322,6 +324,13 @@ export default {
           '#' + this.$route.path
         )
       }
+    },
+    handleConfigRefresh (name, updatedRecord) {
+      if (!name || !updatedRecord) return
+      const index = this.config.findIndex(item => item.name === name)
+      if (index !== -1) {
+        this.config.splice(index, 1, updatedRecord)
+      }
     }
   }
 }
diff --git a/ui/src/views/setting/ConfigurationTable.vue b/ui/src/views/setting/ConfigurationTable.vue
index da05b9342a0a..7edc1b1aad62 100644
--- a/ui/src/views/setting/ConfigurationTable.vue
+++ b/ui/src/views/setting/ConfigurationTable.vue
@@ -32,7 +32,10 @@
           <b> {{record.displaytext }} </b> {{ ' (' + record.name + ')' }} <br/> {{ record.description }}
         </template>
         <template v-if="column.key === 'value'">
-          <ConfigurationValue :configrecord="record" :resource="resource" />
+          <ConfigurationValue
+            :configrecord="record"
+            :resource="resource"
+            @refresh="handleConfigRefresh" />
         </template>
       </template>
     </a-table>
@@ -113,6 +116,9 @@ export default {
         return 'config-light-row'
       }
       return 'config-dark-row'
+    },
+    handleConfigRefresh (name, updatedRecord) {
+      this.$emit('refresh-config', name, updatedRecord)
     }
   }
 }
diff --git a/ui/src/views/setting/ConfigurationValue.vue b/ui/src/views/setting/ConfigurationValue.vue
index 662e5ef142e5..531d4e0ea61a 100644
--- a/ui/src/views/setting/ConfigurationValue.vue
+++ b/ui/src/views/setting/ConfigurationValue.vue
@@ -187,7 +187,7 @@
           @onClick="$resetConfigurationValueConfirm(configrecord, resetConfigurationValue)"
           v-if="editableValueKey === null"
           icon="reload-outlined"
-          :disabled="(!('resetConfiguration' in $store.getters.apis) || configDisabled || valueLoading)" />
+          :disabled="(!('resetConfiguration' in $store.getters.apis) || configDisabled || valueLoading || configrecord.value === configrecord.defaultvalue)" />
       </span>
     </a-list-item>
   </a-list>
@@ -273,6 +273,7 @@ export default {
       this.editableValueKey = null
     },
     updateConfigurationValue (configrecord) {
+      let configRecordEntry = this.configrecord
       this.valueLoading = true
       this.editableValueKey = null
       var newValue = this.editableValue
@@ -294,7 +295,8 @@ export default {
         params[this.scopeKey] = this.resource?.id
       }
       postAPI('updateConfiguration', params).then(json => {
-        this.editableValue = this.getEditableValue(json.updateconfigurationresponse.configuration)
+        configRecordEntry = json.updateconfigurationresponse.configuration
+        this.editableValue = this.getEditableValue(configRecordEntry)
         this.actualValue = this.editableValue
         this.$emit('change-config', { value: newValue })
         this.$store.dispatch('RefreshFeatures')
@@ -318,10 +320,11 @@ export default {
         })
       }).finally(() => {
         this.valueLoading = false
-        this.$emit('refresh')
+        this.$emit('refresh', configrecord.name, configRecordEntry)
       })
     },
     resetConfigurationValue (configrecord) {
+      let configRecordEntry = this.configrecord
       this.valueLoading = true
       this.editableValueKey = null
       const params = {
@@ -332,7 +335,8 @@ export default {
         params[this.scopeKey] = this.resource?.id
       }
       postAPI('resetConfiguration', params).then(json => {
-        this.editableValue = this.getEditableValue(json.resetconfigurationresponse.configuration)
+        configRecordEntry = json.resetconfigurationresponse.configuration
+        this.editableValue = this.getEditableValue(configRecordEntry)
         this.actualValue = this.editableValue
         var newValue = this.editableValue
         if (configrecord.type === 'Range') {
@@ -360,7 +364,7 @@ export default {
         })
       }).finally(() => {
         this.valueLoading = false
-        this.$emit('refresh')
+        this.$emit('refresh', configrecord.name, configRecordEntry)
       })
     },
     getEditableValue (configrecord) {

From dd0b863e22579caa77e399855df690d350c80d3e Mon Sep 17 00:00:00 2001
From: Edward-x <30854794+YLChen-007@users.noreply.github.com>
Date: Wed, 28 Jan 2026 12:41:23 +0800
Subject: [PATCH 047/117] sensitive information leak to log (#12018)

* sensitive information leak to log

* Update agent/src/main/java/com/cloud/agent/resource/consoleproxy/ConsoleProxyResource.java
* Update core/src/main/java/com/cloud/storage/template/HttpTemplateDownloader.java
* Update engine/schema/src/main/java/com/cloud/upgrade/DatabaseCreator.java
* Update plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalDnsmasqResource.java
* Update plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalDnsmasqResource.java
* Update plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalKickStartPxeResource.java
* Update plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalPingPxeResource.java
* Update plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalPingPxeResource.java
* Update plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalPingPxeResource.java
* Update utils/src/main/java/com/cloud/utils/UriUtils.java

Co-authored-by: dahn <daan.hoogland@gmail.com>

* Update plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalKickStartPxeResource.java

Co-authored-by: Abhisar Sinha <63767682+abh1sar@users.noreply.github.com>

* Sync with 4.20 and fix conflict in BaremetalPingPxeResource

* Apply suggestions from code review

Co-authored-by: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>

---------

Co-authored-by: chenyoulong20g@ict.ac.cn <chenyoulong20g@ict.ac.cn>
Co-authored-by: dahn <daan.hoogland@gmail.com>
Co-authored-by: dahn <daan@onecht.net>
Co-authored-by: Abhisar Sinha <63767682+abh1sar@users.noreply.github.com>
Co-authored-by: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
---
 .../resource/consoleproxy/ConsoleProxyResource.java    |  2 +-
 .../networkservice/BaremetalDnsmasqResource.java       |  4 ++--
 .../networkservice/BaremetalKickStartPxeResource.java  |  6 +++---
 .../networkservice/BaremetalPingPxeResource.java       | 10 +++++-----
 utils/src/main/java/com/cloud/utils/UriUtils.java      |  8 ++++++--
 5 files changed, 17 insertions(+), 13 deletions(-)

diff --git a/agent/src/main/java/com/cloud/agent/resource/consoleproxy/ConsoleProxyResource.java b/agent/src/main/java/com/cloud/agent/resource/consoleproxy/ConsoleProxyResource.java
index b0b1e487a263..83b11418f2c5 100644
--- a/agent/src/main/java/com/cloud/agent/resource/consoleproxy/ConsoleProxyResource.java
+++ b/agent/src/main/java/com/cloud/agent/resource/consoleproxy/ConsoleProxyResource.java
@@ -331,7 +331,7 @@ private void launchConsoleProxy(final byte[] ksBits, final String ksPassword, fi
         final Object resource = this;
         logger.info("Building class loader for com.cloud.consoleproxy.ConsoleProxy");
         if (consoleProxyMain == null) {
-            logger.info("Running com.cloud.consoleproxy.ConsoleProxy with encryptor password={}", encryptorPassword);
+            logger.info("Running com.cloud.consoleproxy.ConsoleProxy");
             consoleProxyMain = new Thread(new ManagedContextRunnable() {
                 @Override
                 protected void runInContext() {
diff --git a/plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalDnsmasqResource.java b/plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalDnsmasqResource.java
index 51acfe93d39e..8e7efedfca3b 100644
--- a/plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalDnsmasqResource.java
+++ b/plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalDnsmasqResource.java
@@ -46,10 +46,10 @@ public boolean configure(String name, Map<String, Object> params) throws Configu
         com.trilead.ssh2.Connection sshConnection = null;
         try {
             super.configure(name, params);
-            logger.debug(String.format("Trying to connect to DHCP server(IP=%1$s, username=%2$s, password=%3$s)", _ip, _username, _password));
+            logger.debug(String.format("Trying to connect to DHCP server(IP=%1$s, username=%2$s", _ip, _username));
             sshConnection = SSHCmdHelper.acquireAuthorizedConnection(_ip, _username, _password);
             if (sshConnection == null) {
-                throw new ConfigurationException(String.format("Cannot connect to DHCP server(IP=%1$s, username=%2$s, password=%3$s", _ip, _username, _password));
+                throw new ConfigurationException(String.format("Cannot connect to DHCP server(IP=%1$s, username=%2$s", _ip, _username));
             }
 
             if (!SSHCmdHelper.sshExecuteCmd(sshConnection, "[ -f '/usr/sbin/dnsmasq' ]")) {
diff --git a/plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalKickStartPxeResource.java b/plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalKickStartPxeResource.java
index 3775f4effc17..88c4dea96b3d 100644
--- a/plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalKickStartPxeResource.java
+++ b/plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalKickStartPxeResource.java
@@ -130,8 +130,8 @@ private Answer execute(VmDataCommand cmd) {
 
             sshConnection.connect(null, 60000, 60000);
             if (!sshConnection.authenticateWithPassword(_username, _password)) {
-                logger.debug("SSH Failed to authenticate");
-                throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s, password=%3$s", _ip, _username, _password));
+                logger.debug("SSH Failed to authenticate with user {} credentials", _username);
+                throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s", _ip, _username));
             }
 
             String script = String.format("python /usr/bin/baremetal_user_data.py '%s'", arg);
@@ -167,7 +167,7 @@ private Answer execute(PrepareKickstartPxeServerCommand cmd) {
             sshConnection.connect(null, 60000, 60000);
             if (!sshConnection.authenticateWithPassword(_username, _password)) {
                 logger.debug("SSH Failed to authenticate");
-                throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s, password=%3$s", _ip, _username, _password));
+                throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s", _ip, _username));
             }
 
             String copyTo = String.format("%s/%s", _tftpDir, cmd.getTemplateUuid());
diff --git a/plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalPingPxeResource.java b/plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalPingPxeResource.java
index 96b2dbfeb935..a54cd4a1a118 100644
--- a/plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalPingPxeResource.java
+++ b/plugins/hypervisors/baremetal/src/main/java/com/cloud/baremetal/networkservice/BaremetalPingPxeResource.java
@@ -101,7 +101,7 @@ public boolean configure(String name, Map<String, Object> params) throws Configu
             sshConnection.connect(null, 60000, 60000);
             if (!sshConnection.authenticateWithPassword(_username, _password)) {
                 logger.debug("SSH Failed to authenticate");
-                throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s, password=%3$s", _ip, _username, "******"));
+                throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s, password=******", _ip, _username));
             }
 
             String cmd = String.format("[ -f /%1$s/pxelinux.0 ] && [ -f /%2$s/kernel ] && [ -f /%3$s/initrd.gz ] ", _tftpDir, _tftpDir, _tftpDir);
@@ -150,8 +150,8 @@ protected PreparePxeServerAnswer execute(PreparePxeServerCommand cmd) {
         try {
             sshConnection.connect(null, 60000, 60000);
             if (!sshConnection.authenticateWithPassword(_username, _password)) {
-                logger.debug("SSH Failed to authenticate");
-                throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s, password=%3$s", _ip, _username, _password));
+                logger.debug("SSH Failed to authenticate with user {} credentials", _username);
+                throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s", _ip, _username));
             }
 
             String script =
@@ -179,7 +179,7 @@ protected Answer execute(PrepareCreateTemplateCommand cmd) {
             sshConnection.connect(null, 60000, 60000);
             if (!sshConnection.authenticateWithPassword(_username, _password)) {
                 logger.debug("SSH Failed to authenticate");
-                throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s, password=%3$s", _ip, _username, _password));
+                throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s", _ip, _username));
             }
 
             String script =
@@ -237,7 +237,7 @@ private Answer execute(VmDataCommand cmd) {
             sshConnection.connect(null, 60000, 60000);
             if (!sshConnection.authenticateWithPassword(_username, _password)) {
                 logger.debug("SSH Failed to authenticate");
-                throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s, password=%3$s", _ip, _username, _password));
+                throw new ConfigurationException(String.format("Cannot connect to PING PXE server(IP=%1$s, username=%2$s", _ip, _username));
             }
 
             String script = String.format("python /usr/bin/baremetal_user_data.py '%s'", arg);
diff --git a/utils/src/main/java/com/cloud/utils/UriUtils.java b/utils/src/main/java/com/cloud/utils/UriUtils.java
index 961c121597f5..4722e3c540ac 100644
--- a/utils/src/main/java/com/cloud/utils/UriUtils.java
+++ b/utils/src/main/java/com/cloud/utils/UriUtils.java
@@ -500,8 +500,12 @@ public static InputStream getInputStreamFromUrl(String url, String user, String
             if ((user != null) && (password != null)) {
                 httpclient.getParams().setAuthenticationPreemptive(true);
                 Credentials defaultcreds = new UsernamePasswordCredentials(user, password);
-                httpclient.getState().setCredentials(new AuthScope(hostAndPort.first(), hostAndPort.second(), AuthScope.ANY_REALM), defaultcreds);
-                LOGGER.info("Added username=" + user + ", password=" + password + "for host " + hostAndPort.first() + ":" + hostAndPort.second());
+                httpclient.getState().setCredentials(
+                        new AuthScope(hostAndPort.first(), hostAndPort.second(), AuthScope.ANY_REALM), defaultcreds);
+                LOGGER.info("Added username={} along with password for host {}:{}"
+                    , user
+                    , hostAndPort.first()
+                    , hostAndPort.second());
             }
             // Execute the method.
             GetMethod method = new GetMethod(url);

From 66665b883c1392ebb0af09544681971dcc00e046 Mon Sep 17 00:00:00 2001
From: Tonitzpp <134986282+Tonitzpp@users.noreply.github.com>
Date: Wed, 28 Jan 2026 01:42:57 -0300
Subject: [PATCH 048/117] Changed error message when snapshot is not on
 secondary when trying to perform download (#12462)

Co-authored-by: toni.zamparetti <toni.zamparetti@scclouds.com.br>
---
 .../java/com/cloud/storage/snapshot/SnapshotManagerImpl.java | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/server/src/main/java/com/cloud/storage/snapshot/SnapshotManagerImpl.java b/server/src/main/java/com/cloud/storage/snapshot/SnapshotManagerImpl.java
index ff9989acac3e..1db486584462 100755
--- a/server/src/main/java/com/cloud/storage/snapshot/SnapshotManagerImpl.java
+++ b/server/src/main/java/com/cloud/storage/snapshot/SnapshotManagerImpl.java
@@ -578,8 +578,9 @@ public String extractSnapshot(ExtractSnapshotCmd cmd) {
         }
 
         if (ObjectUtils.anyNull(chosenStore, snapshotDataStoreReference)) {
-            logger.error("Snapshot [{}] not found in any secondary storage.", snapshot);
-            throw new InvalidParameterValueException("Snapshot not found.");
+            String errorMessage = String.format("Snapshot [%s] not found in any secondary storage. The snapshot may be on primary storage, where it cannot be downloaded.", snapshot.getUuid());
+            logger.error(errorMessage);
+            throw new InvalidParameterValueException(errorMessage);
         }
 
         snapshotSrv.syncVolumeSnapshotsToRegionStore(snapshot.getVolumeId(), chosenStore);

From 062b98a51eca7da6b6083cbb31c2fb0608448386 Mon Sep 17 00:00:00 2001
From: cheng102e <38267524+cheng102e@users.noreply.github.com>
Date: Wed, 28 Jan 2026 12:45:11 +0800
Subject: [PATCH 049/117] fix: clean magic value, and update if-else to switch
 (#8848)

* fix: clean magic value, and update if-else to switch

* fix: return the (String args[])

* review

---------

Co-authored-by: jiejc1 <jiejc1@lenovo.com>
Co-authored-by: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
---
 .../src/main/java/common/Client.java          | 34 +++++++++++--------
 1 file changed, 20 insertions(+), 14 deletions(-)

diff --git a/services/console-proxy/rdpconsole/src/main/java/common/Client.java b/services/console-proxy/rdpconsole/src/main/java/common/Client.java
index 742f5c9f0cd4..972d5d753e8f 100644
--- a/services/console-proxy/rdpconsole/src/main/java/common/Client.java
+++ b/services/console-proxy/rdpconsole/src/main/java/common/Client.java
@@ -210,7 +210,6 @@ private void help() {
     public void runClient(String[] args) {
 
         try {
-
             Protocol protocol = parseOptions(args);
             if (protocol == Protocol.NONE)
                 return;
@@ -299,21 +298,28 @@ private Element setMainElementAndAddressBasedOnProtocol(Protocol protocol, SSLSt
 
     private Protocol parseOptions(String[] args) {
         String protocolName = (args.length > 0) ? args[0] : "";
-        Protocol protocol = Protocol.NONE;
+        Protocol protocol;
 
         Option[] options;
-        if (protocolName.equals("vnc")) {
-            protocol = Protocol.VNC;
-            options = join(commonOptions, vncOptions);
-        } else if (protocolName.equals("rdp")) {
-            protocol = Protocol.RDP;
-            options = join(commonOptions, rdpOptions);
-        } else if (protocolName.equals("hyperv")) {
-            protocol = Protocol.HYPERV;
-            options = join(commonOptions, hyperVOptions);
-        } else {
-            help();
-            return Protocol.NONE;
+        try {
+            protocol = Protocol.valueOf(protocolName);
+        } catch (IllegalArgumentException e) {
+            protocol = Protocol.NONE;
+        }
+
+        switch (protocol) {
+            case VNC:
+                options = join(commonOptions, vncOptions);
+                break;
+            case RDP:
+                options = join(commonOptions, rdpOptions);
+                break;
+            case HYPERV:
+                options = join(commonOptions, hyperVOptions);
+                break;
+            default:
+                help();
+                return Protocol.NONE;
         }
 
         // Parse all options for given protocol

From 21d5c10850111cd2e76d783b95b090da623ae024 Mon Sep 17 00:00:00 2001
From: Manoj Kumar <manojkr.itbhu@gmail.com>
Date: Wed, 28 Jan 2026 10:55:59 +0530
Subject: [PATCH 050/117] Apply reordered ACL list to VR router (#12525)

This PR address #9398
---
 .../network/element/VpcVirtualRouterElement.java  | 10 +++++++++-
 .../cloud/network/vpc/NetworkACLServiceImpl.java  | 15 ++++++++++++---
 2 files changed, 21 insertions(+), 4 deletions(-)

diff --git a/server/src/main/java/com/cloud/network/element/VpcVirtualRouterElement.java b/server/src/main/java/com/cloud/network/element/VpcVirtualRouterElement.java
index 3d613fca18ea..f393ef8a129d 100644
--- a/server/src/main/java/com/cloud/network/element/VpcVirtualRouterElement.java
+++ b/server/src/main/java/com/cloud/network/element/VpcVirtualRouterElement.java
@@ -550,7 +550,15 @@ public boolean applyNetworkACLs(final Network network, final List<? extends Netw
 
     @Override
     public boolean reorderAclRules(Vpc vpc, List<? extends Network> networks, List<? extends NetworkACLItem> networkACLItems) {
-        return true;
+        boolean result = true;
+        try {
+            for (Network network : networks) {
+                result = result && applyNetworkACLs(network, networkACLItems);
+            }
+        } catch (ResourceUnavailableException ex) {
+            result = false;
+        }
+        return result;
     }
 
     @Override
diff --git a/server/src/main/java/com/cloud/network/vpc/NetworkACLServiceImpl.java b/server/src/main/java/com/cloud/network/vpc/NetworkACLServiceImpl.java
index ecb164018ac0..7460ae87d44c 100644
--- a/server/src/main/java/com/cloud/network/vpc/NetworkACLServiceImpl.java
+++ b/server/src/main/java/com/cloud/network/vpc/NetworkACLServiceImpl.java
@@ -109,6 +109,8 @@ public class NetworkACLServiceImpl extends ManagerBase implements NetworkACLServ
     private NsxProviderDao nsxProviderDao;
     @Inject
     private NetrisProviderDao netrisProviderDao;
+    @Inject
+    private VpcManager vpcManager;
 
     private String supportedProtocolsForAclRules = "tcp,udp,icmp,all";
 
@@ -1037,13 +1039,20 @@ public NetworkACLItem moveNetworkAclRuleToNewPosition(MoveNetworkAclItemCmd move
             if (Objects.isNull(vpc)) {
                 return networkACLItem;
             }
+            List<NetworkVO> networks = _networkDao.listByAclId(lockedAcl.getId());
+            if (networks.isEmpty()) {
+                return networkACLItem;
+            }
+
             final DataCenter dc = _entityMgr.findById(DataCenter.class, vpc.getZoneId());
             final NsxProviderVO nsxProvider = nsxProviderDao.findByZoneId(dc.getId());
             final NetrisProviderVO netrisProvider = netrisProviderDao.findByZoneId(dc.getId());
-            List<NetworkVO> networks = _networkDao.listByAclId(lockedAcl.getId());
-            if (ObjectUtils.anyNotNull(nsxProvider, netrisProvider) && !networks.isEmpty()) {
+            boolean isVpcNetworkACLProvider = vpcManager.isProviderSupportServiceInVpc(vpc.getId(), Network.Service.NetworkACL, Network.Provider.VPCVirtualRouter);
+
+            if (ObjectUtils.anyNotNull(nsxProvider, netrisProvider) || isVpcNetworkACLProvider) {
                 allAclRules = getAllAclRulesSortedByNumber(lockedAcl.getId());
-                Network.Provider networkProvider = nsxProvider != null ? Network.Provider.Nsx : Network.Provider.Netris;
+                Network.Provider networkProvider = isVpcNetworkACLProvider ? Network.Provider.VPCVirtualRouter
+                                : (nsxProvider != null ? Network.Provider.Nsx : Network.Provider.Netris);
                 _networkAclMgr.reorderAclRules(vpc, networks, allAclRules, networkProvider);
             }
             return networkACLItem;

From 572aa1956493d58a0efa283d2f75d876d92a5ad9 Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Wed, 28 Jan 2026 11:01:53 +0530
Subject: [PATCH 051/117] ui: show usage server restart message on usage config
 change (#11969)

Fixes #10853

---------

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
---
 ui/public/locales/en.json                   |  1 +
 ui/src/components/view/ListView.vue         | 10 +---------
 ui/src/utils/plugins.js                     | 11 +++++++++++
 ui/src/views/setting/ConfigurationValue.vue | 20 ++------------------
 4 files changed, 15 insertions(+), 27 deletions(-)

diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index 275b8dbb0fe5..747154964345 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -3735,6 +3735,7 @@
 "message.resource.not.found": "Resource not found.",
 "message.restart.mgmt.server": "Please restart your management server(s) for your new settings to take effect.",
 "message.restart.network": "All services provided by this Network will be interrupted. Please confirm that you want to restart this Network.",
+"message.restart.usage.server": "Please restart your usage server(s) for your new settings to take effect.",
 "message.restart.vm.to.update.settings": "Update in fields other than name and display name will require the Instance to be restarted.",
 "message.restart.vpc": "Please confirm that you want to restart the VPC.",
 "message.restart.vpc.remark": "Please confirm that you want to restart the VPC <p><i>Remark: making a non-redundant VPC redundant will force a clean up. The Networks will not be available for a couple of minutes</i>.</p>",
diff --git a/ui/src/components/view/ListView.vue b/ui/src/components/view/ListView.vue
index 168e355cbc80..79ec5a182071 100644
--- a/ui/src/components/view/ListView.vue
+++ b/ui/src/components/view/ListView.vue
@@ -1234,15 +1234,7 @@ export default {
         this.editableValueKey = null
         this.$store.dispatch('RefreshFeatures')
         this.$messageConfigSuccess(`${this.$t('message.setting.updated')} ${record.name}`, record)
-        if (json.updateconfigurationresponse &&
-          json.updateconfigurationresponse.configuration &&
-          !json.updateconfigurationresponse.configuration.isdynamic &&
-          ['Admin'].includes(this.$store.getters.userInfo.roletype)) {
-          this.$notification.warning({
-            message: this.$t('label.status'),
-            description: this.$t('message.restart.mgmt.server')
-          })
-        }
+        this.$notifyConfigurationValueChange(json?.updateconfigurationresponse?.configuration || null)
       }).catch(error => {
         console.error(error)
         this.$message.error(this.$t('message.error.save.setting'))
diff --git a/ui/src/utils/plugins.js b/ui/src/utils/plugins.js
index 306eb9d1f594..729cef84d021 100644
--- a/ui/src/utils/plugins.js
+++ b/ui/src/utils/plugins.js
@@ -550,6 +550,17 @@ export const dialogUtilPlugin = {
         onOk: () => callback(configRecord)
       })
     }
+
+    app.config.globalProperties.$notifyConfigurationValueChange = function (configRecord) {
+      if (!configRecord || configRecord.isdynamic || store.getters.userInfo?.roletype !== 'Admin') {
+        return
+      }
+      const server = configRecord.group === 'Usage Server' ? 'usage' : 'mgmt'
+      this.$notification.warning({
+        message: this.$t('label.status'),
+        description: this.$t('message.restart.' + server + '.server')
+      })
+    }
   }
 }
 
diff --git a/ui/src/views/setting/ConfigurationValue.vue b/ui/src/views/setting/ConfigurationValue.vue
index 662e5ef142e5..31c0798a7178 100644
--- a/ui/src/views/setting/ConfigurationValue.vue
+++ b/ui/src/views/setting/ConfigurationValue.vue
@@ -299,15 +299,7 @@ export default {
         this.$emit('change-config', { value: newValue })
         this.$store.dispatch('RefreshFeatures')
         this.$messageConfigSuccess(`${this.$t('message.setting.updated')} ${configrecord.name}`, configrecord)
-        if (json.updateconfigurationresponse &&
-          json.updateconfigurationresponse.configuration &&
-          !json.updateconfigurationresponse.configuration.isdynamic &&
-          ['Admin'].includes(this.$store.getters.userInfo.roletype)) {
-          this.$notification.warning({
-            message: this.$t('label.status'),
-            description: this.$t('message.restart.mgmt.server')
-          })
-        }
+        this.$notifyConfigurationValueChange(json?.updateconfigurationresponse?.configuration || null)
       }).catch(error => {
         this.editableValue = this.actualValue
         console.error(error)
@@ -341,15 +333,7 @@ export default {
         this.$emit('change-config', { value: newValue })
         this.$store.dispatch('RefreshFeatures')
         this.$messageConfigSuccess(`${this.$t('label.setting')} ${configrecord.name} ${this.$t('label.reset.config.value')}`, configrecord)
-        if (json.resetconfigurationresponse &&
-          json.resetconfigurationresponse.configuration &&
-          !json.resetconfigurationresponse.configuration.isdynamic &&
-          ['Admin'].includes(this.$store.getters.userInfo.roletype)) {
-          this.$notification.warning({
-            message: this.$t('label.status'),
-            description: this.$t('message.restart.mgmt.server')
-          })
-        }
+        this.$notifyConfigurationValueChange(json?.resetconfigurationresponse?.configuration || null)
       }).catch(error => {
         this.editableValue = this.actualValue
         console.error(error)

From 2bfc9cb8eb621cead6b6c8067a878126f1b0c7b5 Mon Sep 17 00:00:00 2001
From: Wei Zhou <weizhou@apache.org>
Date: Wed, 28 Jan 2026 06:47:14 +0100
Subject: [PATCH 052/117] CKS: skip default egress policy check for vpc network
 offerings (#11998)

This PR fixes #11995

Steps to reproduce the issue
- create a vpc
- create a vpc tier with default offering `DefaultIsolatedNetworkOfferingForVpcNetworks`
- register CKS ISO
- create CKS on the vpc tier

expected: succeed
actual: failed with error `Kubernetes service has not been configured properly to provision Kubernetes clusters`
---
 .../cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java  | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java
index cf4bbce098af..d19470f8bab2 100644
--- a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java
+++ b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java
@@ -477,7 +477,7 @@ private boolean isKubernetesServiceNetworkOfferingConfigured(DataCenter zone, Lo
             logger.warn("Network offering: {} does not have necessary services to provision Kubernetes cluster", networkOffering);
             return false;
         }
-        if (!networkOffering.isEgressDefaultPolicy()) {
+        if (!networkOffering.isForVpc() && !networkOffering.isEgressDefaultPolicy()) {
             logger.warn("Network offering: {} has egress default policy turned off should be on to provision Kubernetes cluster", networkOffering);
             return false;
         }

From 70d4c9d1baa5f6e7696b6311e7eeaaa2c4f0de3b Mon Sep 17 00:00:00 2001
From: Fabricio Duarte <fabricio.duarte.jr@gmail.com>
Date: Wed, 28 Jan 2026 02:48:31 -0300
Subject: [PATCH 053/117] Consider secondary storage selectors during cold
 volume migration (#10957)

The secondary storage selectors allow operators to specify, for instance, that volumes should go to a specific secondary storage A. Thus, when uploading a volume, it will always be downloaded to secondary storage A.

The cold volume migration moves volumes to a secondary storage before moving them to the destination primary storage. This process does not consider the secondary storage selectors. However, some companies want to dedicate specific secondary storages for cold migration.

To address this, this PR makes the cold volume migration process consider the secondary storage selectors.
---
 .../motion/AncientDataMotionStrategy.java        | 13 ++++++++++++-
 .../storage/heuristics/HeuristicRuleHelper.java  | 16 ++++++++--------
 2 files changed, 20 insertions(+), 9 deletions(-)

diff --git a/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/AncientDataMotionStrategy.java b/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/AncientDataMotionStrategy.java
index b59ee2c61660..4cb09fb81f71 100644
--- a/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/AncientDataMotionStrategy.java
+++ b/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/AncientDataMotionStrategy.java
@@ -45,10 +45,12 @@
 import org.apache.cloudstack.engine.subsystem.api.storage.ZoneScope;
 import org.apache.cloudstack.framework.async.AsyncCompletionCallback;
 import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
+import org.apache.cloudstack.secstorage.heuristics.HeuristicType;
 import org.apache.cloudstack.storage.RemoteHostEndPoint;
 import org.apache.cloudstack.storage.command.CopyCommand;
 import org.apache.cloudstack.storage.datastore.db.VolumeDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.VolumeDataStoreVO;
+import org.apache.cloudstack.storage.heuristics.HeuristicRuleHelper;
 import org.apache.cloudstack.storage.image.datastore.ImageStoreEntity;
 import org.apache.cloudstack.storage.to.PrimaryDataStoreTO;
 import org.apache.logging.log4j.Logger;
@@ -104,6 +106,9 @@ public class AncientDataMotionStrategy implements DataMotionStrategy {
     @Inject
     SnapshotDao snapshotDao;
 
+    @Inject
+    HeuristicRuleHelper heuristicRuleHelper;
+
     @Override
     public StrategyPriority canHandle(DataObject srcData, DataObject destData) {
         return StrategyPriority.DEFAULT;
@@ -374,7 +379,13 @@ protected Answer copyVolumeBetweenPools(DataObject srcData, DataObject destData)
             }
             // need to find a nfs or cifs image store, assuming that can't copy volume
             // directly to s3
-            ImageStoreEntity imageStore = (ImageStoreEntity)dataStoreMgr.getImageStoreWithFreeCapacity(destScope.getScopeId());
+            Long zoneId = destScope.getScopeId();
+            ImageStoreEntity imageStore = (ImageStoreEntity) heuristicRuleHelper.getImageStoreIfThereIsHeuristicRule(zoneId, HeuristicType.VOLUME, destData);
+            if (imageStore == null) {
+                logger.debug("Secondary storage selector did not direct volume migration to a specific secondary storage; using secondary storage with the most free capacity.");
+                imageStore = (ImageStoreEntity) dataStoreMgr.getImageStoreWithFreeCapacity(zoneId);
+            }
+
             if (imageStore == null || !imageStore.getProtocol().equalsIgnoreCase("nfs") && !imageStore.getProtocol().equalsIgnoreCase("cifs")) {
                 String errMsg = "can't find a nfs (or cifs) image store to satisfy the need for a staging store";
                 Answer answer = new Answer(null, false, errMsg);
diff --git a/server/src/main/java/org/apache/cloudstack/storage/heuristics/HeuristicRuleHelper.java b/server/src/main/java/org/apache/cloudstack/storage/heuristics/HeuristicRuleHelper.java
index 21a34de0d23b..2e0780e7fe8d 100644
--- a/server/src/main/java/org/apache/cloudstack/storage/heuristics/HeuristicRuleHelper.java
+++ b/server/src/main/java/org/apache/cloudstack/storage/heuristics/HeuristicRuleHelper.java
@@ -117,8 +117,8 @@ protected void buildPresetVariables(JsInterpreter jsInterpreter, HeuristicType h
                 accountId = ((SnapshotInfo) obj).getAccountId();
                 break;
             case VOLUME:
-                presetVariables.setVolume(setVolumePresetVariable((VolumeVO) obj));
-                accountId = ((VolumeVO) obj).getAccountId();
+                presetVariables.setVolume(setVolumePresetVariable((com.cloud.storage.Volume) obj));
+                accountId = ((com.cloud.storage.Volume) obj).getAccountId();
                 break;
         }
         presetVariables.setAccount(setAccountPresetVariable(accountId));
@@ -191,14 +191,14 @@ protected Template setTemplatePresetVariable(VMTemplateVO templateVO) {
         return template;
     }
 
-    protected Volume setVolumePresetVariable(VolumeVO volumeVO) {
-        Volume volume = new Volume();
+    protected Volume setVolumePresetVariable(com.cloud.storage.Volume volumeVO) {
+        Volume volumePresetVariable = new Volume();
 
-        volume.setName(volumeVO.getName());
-        volume.setFormat(volumeVO.getFormat());
-        volume.setSize(volumeVO.getSize());
+        volumePresetVariable.setName(volumeVO.getName());
+        volumePresetVariable.setFormat(volumeVO.getFormat());
+        volumePresetVariable.setSize(volumeVO.getSize());
 
-        return volume;
+        return volumePresetVariable;
     }
 
     protected Snapshot setSnapshotPresetVariable(SnapshotInfo snapshotInfo) {

From 4761935145e100622df083dedffec612482b16d2 Mon Sep 17 00:00:00 2001
From: Wei Zhou <weizhou@apache.org>
Date: Wed, 28 Jan 2026 06:59:31 +0100
Subject: [PATCH 054/117] server: add options for kvm.guest.os.machine.type
 (#12414)

---
 server/src/main/java/com/cloud/api/query/QueryManagerImpl.java | 1 +
 1 file changed, 1 insertion(+)

diff --git a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
index 3b2329483954..d42dbaec6de3 100644
--- a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
+++ b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
@@ -5398,6 +5398,7 @@ private void fillVMOrTemplateDetailOptions(final Map<String, List<String>> optio
             options.put(VmDetailConstants.VIRTUAL_TPM_VERSION, Arrays.asList("1.2", "2.0"));
             options.put(VmDetailConstants.GUEST_CPU_MODE, Arrays.asList("custom", "host-model", "host-passthrough"));
             options.put(VmDetailConstants.GUEST_CPU_MODEL, Collections.emptyList());
+            options.put(VmDetailConstants.KVM_GUEST_OS_MACHINE_TYPE, Collections.emptyList());
             options.put(VmDetailConstants.KVM_SKIP_FORCE_DISK_CONTROLLER, Arrays.asList("true", "false"));
         }
 

From 0dcbe57a47875d45ee7effa92451a331c5bccc10 Mon Sep 17 00:00:00 2001
From: Edward-x <30854794+YLChen-007@users.noreply.github.com>
Date: Wed, 28 Jan 2026 14:56:44 +0800
Subject: [PATCH 055/117] Fix that Sensitive information logged in
 SshHelper.sshExecute method (#12026)

* Sensitive information logged in SshHelper.sshExecute method

* Fix that Sensitive information logged in SshHelper.sshExecute method2

* Fix sensitive information handling in SshHelper and its tests

---------

Co-authored-by: chenyoulong20g@ict.ac.cn <chenyoulong20g@ict.ac.cn>
---
 .../java/com/cloud/utils/ssh/SshHelper.java   | 73 ++++++++++++++++++-
 .../com/cloud/utils/ssh/SshHelperTest.java    | 60 +++++++++++++++
 2 files changed, 129 insertions(+), 4 deletions(-)

diff --git a/utils/src/main/java/com/cloud/utils/ssh/SshHelper.java b/utils/src/main/java/com/cloud/utils/ssh/SshHelper.java
index 87221ab5ac8e..caf2b28c52ff 100644
--- a/utils/src/main/java/com/cloud/utils/ssh/SshHelper.java
+++ b/utils/src/main/java/com/cloud/utils/ssh/SshHelper.java
@@ -23,6 +23,8 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 import org.apache.commons.io.IOUtils;
 import org.apache.commons.lang3.StringUtils;
@@ -40,6 +42,23 @@ public class SshHelper {
     private static final int DEFAULT_CONNECT_TIMEOUT = 180000;
     private static final int DEFAULT_KEX_TIMEOUT = 60000;
     private static final int DEFAULT_WAIT_RESULT_TIMEOUT = 120000;
+    private static final String MASKED_VALUE = "*****";
+
+    private static final Pattern[] SENSITIVE_COMMAND_PATTERNS = new Pattern[] {
+            Pattern.compile("(?i)(\\s+-p\\s+['\"])([^'\"]*)(['\"])"),
+            Pattern.compile("(?i)(\\s+-p\\s+)([^\\s]+)"),
+            Pattern.compile("(?i)(\\s+-p=['\"])([^'\"]*)(['\"])"),
+            Pattern.compile("(?i)(\\s+-p=)([^\\s]+)"),
+            Pattern.compile("(?i)(--password=['\"])([^'\"]*)(['\"])"),
+            Pattern.compile("(?i)(--password=)([^\\s]+)"),
+            Pattern.compile("(?i)(--password\\s+['\"])([^'\"]*)(['\"])"),
+            Pattern.compile("(?i)(--password\\s+)([^\\s]+)"),
+            Pattern.compile("(?i)(\\s+-u\\s+['\"][^,'\":]+[,:])([^'\"]*)(['\"])"),
+            Pattern.compile("(?i)(\\s+-u\\s+[^\\s,:]+[,:])([^\\s]+)"),
+            Pattern.compile("(?i)(\\s+-s\\s+['\"])([^'\"]*)(['\"])"),
+            Pattern.compile("(?i)(\\s+-s\\s+)([^\\s]+)"),
+
+    };
 
     protected static Logger LOGGER = LogManager.getLogger(SshHelper.class);
 
@@ -145,7 +164,7 @@ public static void scpTo(String host, int port, String user, File pemKeyFile, St
     }
 
     public static void scpTo(String host, int port, String user, File pemKeyFile, String password, String remoteTargetDirectory, String[] localFiles, String fileMode,
-                             int connectTimeoutInMs, int kexTimeoutInMs) throws Exception {
+            int connectTimeoutInMs, int kexTimeoutInMs) throws Exception {
 
         com.trilead.ssh2.Connection conn = null;
         com.trilead.ssh2.SCPClient scpClient = null;
@@ -291,13 +310,16 @@ public static Pair<Boolean, String> sshExecute(String host, int port, String use
             }
 
             if (sess.getExitStatus() == null) {
-                //Exit status is NOT available. Returning failure result.
-                LOGGER.error(String.format("SSH execution of command %s has no exit status set. Result output: %s", command, result));
+                // Exit status is NOT available. Returning failure result.
+                LOGGER.error(String.format("SSH execution of command %s has no exit status set. Result output: %s",
+                        sanitizeForLogging(command), sanitizeForLogging(result)));
                 return new Pair<Boolean, String>(false, result);
             }
 
             if (sess.getExitStatus() != null && sess.getExitStatus().intValue() != 0) {
-                LOGGER.error(String.format("SSH execution of command %s has an error status code in return. Result output: %s", command, result));
+                LOGGER.error(String.format(
+                        "SSH execution of command %s has an error status code in return. Result output: %s",
+                        sanitizeForLogging(command), sanitizeForLogging(result)));
                 return new Pair<Boolean, String>(false, result);
             }
             return new Pair<Boolean, String>(true, result);
@@ -366,4 +388,47 @@ protected static void throwSshExceptionIfStdoutOrStdeerIsNull(InputStream stdout
             throw new SshException(msg);
         }
     }
+
+    private static String sanitizeForLogging(String value) {
+        if (value == null) {
+            return null;
+        }
+        String masked = maskSensitiveValue(value);
+        String cleaned = com.cloud.utils.StringUtils.cleanString(masked);
+        if (StringUtils.isBlank(cleaned)) {
+            return masked;
+        }
+        return cleaned;
+    }
+
+    private static String maskSensitiveValue(String value) {
+        String masked = value;
+        for (Pattern pattern : SENSITIVE_COMMAND_PATTERNS) {
+            masked = replaceWithMask(masked, pattern);
+        }
+        return masked;
+    }
+
+    private static String replaceWithMask(String value, Pattern pattern) {
+        Matcher matcher = pattern.matcher(value);
+        if (!matcher.find()) {
+            return value;
+        }
+
+        StringBuffer buffer = new StringBuffer();
+        do {
+            StringBuilder replacement = new StringBuilder();
+            replacement.append(matcher.group(1));
+            if (matcher.groupCount() >= 3) {
+                replacement.append(MASKED_VALUE);
+                replacement.append(matcher.group(matcher.groupCount()));
+            } else {
+                replacement.append(MASKED_VALUE);
+            }
+            matcher.appendReplacement(buffer, Matcher.quoteReplacement(replacement.toString()));
+        } while (matcher.find());
+
+        matcher.appendTail(buffer);
+        return buffer.toString();
+    }
 }
diff --git a/utils/src/test/java/com/cloud/utils/ssh/SshHelperTest.java b/utils/src/test/java/com/cloud/utils/ssh/SshHelperTest.java
index 61d746bc12db..8a14f60527b6 100644
--- a/utils/src/test/java/com/cloud/utils/ssh/SshHelperTest.java
+++ b/utils/src/test/java/com/cloud/utils/ssh/SshHelperTest.java
@@ -21,6 +21,7 @@
 
 import java.io.IOException;
 import java.io.InputStream;
+import java.lang.reflect.Method;
 
 import org.junit.Assert;
 import org.junit.Test;
@@ -140,4 +141,63 @@ public void openConnectionSessionTest() throws IOException, InterruptedException
 
         Mockito.verify(conn).openSession();
     }
+
+    @Test
+    public void sanitizeForLoggingMasksShortPasswordFlag() throws Exception {
+        String command = "/opt/cloud/bin/script -v 10.0.0.1 -p superSecret";
+        String sanitized = invokeSanitizeForLogging(command);
+
+        Assert.assertTrue("Sanitized command should retain flag", sanitized.contains("-p *****"));
+        Assert.assertFalse("Sanitized command should not contain original password", sanitized.contains("superSecret"));
+    }
+
+    @Test
+    public void sanitizeForLoggingMasksQuotedPasswordFlag() throws Exception {
+        String command = "/opt/cloud/bin/script -v 10.0.0.1 -p \"super Secret\"";
+        String sanitized = invokeSanitizeForLogging(command);
+
+        Assert.assertTrue("Sanitized command should retain quoted flag", sanitized.contains("-p *****"));
+        Assert.assertFalse("Sanitized command should not contain original password",
+                sanitized.contains("super Secret"));
+    }
+
+    @Test
+    public void sanitizeForLoggingMasksLongPasswordAssignments() throws Exception {
+        String command = "tool --password=superSecret";
+        String sanitized = invokeSanitizeForLogging(command);
+
+        Assert.assertTrue("Sanitized command should retain assignment", sanitized.contains("--password=*****"));
+        Assert.assertFalse("Sanitized command should not contain original password", sanitized.contains("superSecret"));
+    }
+
+    @Test
+    public void sanitizeForLoggingMasksUsernamePasswordPairs() throws Exception {
+        String command = "/opt/cloud/bin/vpn_l2tp.sh -u alice,topSecret";
+        String sanitized = invokeSanitizeForLogging(command);
+
+        Assert.assertTrue("Sanitized command should retain username and mask password",
+                sanitized.contains("-u alice,*****"));
+        Assert.assertFalse("Sanitized command should not contain original password", sanitized.contains("topSecret"));
+    }
+
+    @Test
+    public void sanitizeForLoggingMasksUsernamePasswordPairsWithColon() throws Exception {
+        String command = "curl -u alice:topSecret https://example.com";
+        String sanitized = invokeSanitizeForLogging(command);
+
+        Assert.assertTrue("Sanitized command should retain username and mask password",
+                sanitized.contains("-u alice:*****"));
+        Assert.assertFalse("Sanitized command should not contain original password", sanitized.contains("topSecret"));
+    }
+
+    @Test
+    public void sanitizeForLoggingHandlesNullValues() throws Exception {
+        Assert.assertNull(invokeSanitizeForLogging(null));
+    }
+
+    private String invokeSanitizeForLogging(String value) throws Exception {
+        Method method = SshHelper.class.getDeclaredMethod("sanitizeForLogging", String.class);
+        method.setAccessible(true);
+        return (String) method.invoke(null, value);
+    }
 }

From 1b2ae13df74ef3f22f8e5b40b4cf45a10863205f Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Wed, 28 Jan 2026 12:40:34 +0530
Subject: [PATCH 056/117] ui: add cache for oslogo request using osId (#11422)

When OsLogo component is used in the items of a list having same OS type
it was causing listOsTypes API call multiple time. This change allows
caching request and response value for 30 seconds. Caching behaviour is
controlled using `useCache` flag.

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
---
 ui/src/components/widgets/OsLogo.vue          | 78 ++++++++++---------
 .../compute/wizard/OsBasedImageRadioGroup.vue |  3 +-
 2 files changed, 42 insertions(+), 39 deletions(-)

diff --git a/ui/src/components/widgets/OsLogo.vue b/ui/src/components/widgets/OsLogo.vue
index 643953012c18..f19aac56a1a6 100644
--- a/ui/src/components/widgets/OsLogo.vue
+++ b/ui/src/components/widgets/OsLogo.vue
@@ -31,6 +31,9 @@
 <script>
 import { getAPI } from '@/api'
 
+const CACHE_TTL_MS = 30_000
+const osTypeCache = new Map() // osId -> { ts, value?, promise? }
+
 export default {
   name: 'OsLogo',
   props: {
@@ -45,55 +48,57 @@ export default {
     size: {
       type: String,
       default: 'lg'
+    },
+    useCache: {
+      type: Boolean,
+      default: false
     }
   },
   data () {
-    return {
-      name: '',
-      osLogo: ['fas', 'image']
-    }
-  },
-  computed: {
-    logo: function () {
-      if (!this.name) {
-        this.fetchData()
-      }
-      return this.osLogo
-    }
+    return { name: '', osLogo: ['fas', 'image'] }
   },
+  computed: { logo () { return this.osLogo } },
+  mounted () { this.fetchData() },
   watch: {
-    osId: function () {
-      this.fetchData()
-    }
+    osId () { this.fetchData() },
+    osName () { this.fetchData() }
   },
   methods: {
+    async fetchOsTypeName (osId, useCache = this.useCache) {
+      const now = Date.now()
+      if (useCache) {
+        const cached = osTypeCache.get(osId)
+        if (cached?.value && (now - cached.ts) < CACHE_TTL_MS) return cached.value
+        if (cached?.promise) return cached.promise
+        const promise = getAPI('listOsTypes', { id: osId })
+          .then(json => {
+            const t = json?.listostypesresponse?.ostype
+            const name = t?.length
+              ? (t[0].description || t[0].osdisplayname || 'Linux')
+              : 'Linux'
+            osTypeCache.set(osId, { ts: Date.now(), value: name })
+            return name
+          })
+          .catch(e => { osTypeCache.delete(osId); throw e })
+        osTypeCache.set(osId, { ts: now, promise })
+        return promise
+      }
+      const json = await getAPI('listOsTypes', { id: osId })
+      const t = json?.listostypesresponse?.ostype
+      return t?.length ? (t[0].description || t[0].osdisplayname || 'Linux') : 'Linux'
+    },
     fetchData () {
       if (this.osName) {
         this.discoverOsLogo(this.osName)
-      } else if (this.osId) {
-        this.findOsName(this.osId)
+      } else if (this.osId && ('listOsTypes' in this.$store.getters.apis)) {
+        this.fetchOsTypeName(this.osId)
+          .then(this.discoverOsLogo)
+          .catch(() => this.discoverOsLogo('Linux'))
       }
     },
-    findOsName (osId) {
-      if (!('listOsTypes' in this.$store.getters.apis)) {
-        return
-      }
-      this.name = 'linux'
-      getAPI('listOsTypes', { id: osId }).then(json => {
-        if (json && json.listostypesresponse && json.listostypesresponse.ostype && json.listostypesresponse.ostype.length > 0) {
-          this.discoverOsLogo(json.listostypesresponse.ostype[0].description)
-        } else {
-          this.discoverOsLogo('Linux')
-        }
-      })
-    },
-    getFontAwesomeIcon (name) {
-      return ['fab', name]
-    },
     discoverOsLogo (name) {
       this.name = name
-      this.$emit('update-osname', this.name)
-      const osname = name.toLowerCase()
+      const osname = (name || '').toLowerCase()
       const logos = [
         { name: 'centos' },
         { name: 'debian' },
@@ -119,6 +124,3 @@ export default {
   }
 }
 </script>
-
-<style scoped>
-</style>
diff --git a/ui/src/views/compute/wizard/OsBasedImageRadioGroup.vue b/ui/src/views/compute/wizard/OsBasedImageRadioGroup.vue
index 2518ed0c0420..45ea347553c3 100644
--- a/ui/src/views/compute/wizard/OsBasedImageRadioGroup.vue
+++ b/ui/src/views/compute/wizard/OsBasedImageRadioGroup.vue
@@ -42,7 +42,8 @@
               class="radio-group__os-logo"
               size="2x"
               :osId="item.ostypeid"
-              :os-name="item.osName" />
+              :os-name="item.osName"
+              :use-cache="true" />
             &nbsp;
             {{ item.displaytext }}
             <span v-if="item?.projectid">

From 7001d43dbfa7a0e5ca68d527754570596efcb180 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 28 Jan 2026 14:09:29 +0530
Subject: [PATCH 057/117] Bump org.codehaus.mojo:properties-maven-plugin from
 1.0-alpha-2 to 1.2.1 (#12508)

---
 developer/pom.xml          | 2 +-
 tools/devcloud-kvm/pom.xml | 2 +-
 tools/devcloud4/pom.xml    | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/developer/pom.xml b/developer/pom.xml
index e2fd782fd25f..0a0979ee0379 100644
--- a/developer/pom.xml
+++ b/developer/pom.xml
@@ -66,7 +66,7 @@
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>properties-maven-plugin</artifactId>
-                <version>1.0-alpha-2</version>
+                <version>1.2.1</version>
                 <executions>
                     <execution>
                         <phase>initialize</phase>
diff --git a/tools/devcloud-kvm/pom.xml b/tools/devcloud-kvm/pom.xml
index a8cd23db9799..35cf828a27b6 100644
--- a/tools/devcloud-kvm/pom.xml
+++ b/tools/devcloud-kvm/pom.xml
@@ -56,7 +56,7 @@
                     <plugin>
                         <groupId>org.codehaus.mojo</groupId>
                         <artifactId>properties-maven-plugin</artifactId>
-                        <version>1.0-alpha-2</version>
+                        <version>1.2.1</version>
                         <executions>
                             <execution>
                                 <phase>initialize</phase>
diff --git a/tools/devcloud4/pom.xml b/tools/devcloud4/pom.xml
index 1af63b439ad7..385b49ad88c7 100644
--- a/tools/devcloud4/pom.xml
+++ b/tools/devcloud4/pom.xml
@@ -56,7 +56,7 @@
                     <plugin>
                         <groupId>org.codehaus.mojo</groupId>
                         <artifactId>properties-maven-plugin</artifactId>
-                        <version>1.0-alpha-2</version>
+                        <version>1.2.1</version>
                         <executions>
                             <execution>
                                 <phase>initialize</phase>

From 434e472ef814897a985f87b92b1d46e9cfc23eeb Mon Sep 17 00:00:00 2001
From: Tonitzpp <134986282+Tonitzpp@users.noreply.github.com>
Date: Wed, 28 Jan 2026 06:10:43 -0300
Subject: [PATCH 058/117] Change to display if public IPs are reserved in the 
 tab (#12461)

Co-authored-by: toni.zamparetti <toni.zamparetti@scclouds.com.br>
---
 ui/src/views/infra/network/IpRangesTabPublic.vue | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/ui/src/views/infra/network/IpRangesTabPublic.vue b/ui/src/views/infra/network/IpRangesTabPublic.vue
index 81f5656799e5..dc6ef671e7ce 100644
--- a/ui/src/views/infra/network/IpRangesTabPublic.vue
+++ b/ui/src/views/infra/network/IpRangesTabPublic.vue
@@ -47,6 +47,9 @@
         <template v-if="column.key === 'endip'">
           {{ record.endip || record.endipv6 }}
         </template>
+        <template v-if="column.key === 'systemvms'">
+          {{ record.systemvms || record.forsystemvms }}
+        </template>
         <template v-if="column.key === 'account' && !basicGuestNetwork">
           <a-button @click="() => handleOpenAccountModal(record)">{{ record.domain === undefined ? `${$t('label.system.ip.pool')}` : `[ ${record.domain}] ${record.account === undefined ? '' : record.account}` }}</a-button>
         </template>
@@ -128,10 +131,6 @@
           <div class="list__label">{{ $t('label.domain') }}</div>
           <div>{{ selectedItem.domain }}</div>
         </div>
-        <div style="margin-bottom: 10px;">
-          <div class="list__label">{{ $t('label.system.vms') }}</div>
-          <div>{{ selectedItem.forsystemvms }}</div>
-        </div>
       </div>
 
       <div :span="24" class="action-button">
@@ -449,6 +448,10 @@ export default {
           key: 'endip',
           title: this.$t('label.endip')
         },
+        {
+          key: 'systemvms',
+          title: this.$t('label.reserved.system.ip')
+        },
         {
           key: 'actions',
           title: this.$t('label.actions')

From 0e7f74839ae264f08382bfcb6692af4f5f073653 Mon Sep 17 00:00:00 2001
From: dahn <daan@onecht.net>
Date: Wed, 28 Jan 2026 10:48:27 +0100
Subject: [PATCH 059/117] Add configuration for archiving stale issues (#12293)

---
 .github/workflows/stale.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index e90c75979b6d..c957392c5046 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -41,3 +41,10 @@ jobs:
           days-before-pr-close: 240
           exempt-issue-labels: 'gsoc,good-first-issue,long-term-plan'
           exempt-pr-labels: 'status:ready-for-merge,status:needs-testing,status:on-hold'
+          days-before-close: -1
+      - uses: actions/stale@v10
+        with:
+          stale-issue-label: 'archive'
+          days-before-stale: 240
+          exempt-issue-labels: 'gsoc,good-first-issue,long-term-plan'
+          days-before-close: -1

From 6932cacabc187cf3d76e53c7979ed10067aff2f2 Mon Sep 17 00:00:00 2001
From: Harikrishna <harikrishna.patnala@gmail.com>
Date: Wed, 28 Jan 2026 16:00:30 +0530
Subject: [PATCH 060/117] Allow copy of templates from secondary storages of
 other zone when adding a new secondary storage (#12296)

* Allow copy of templates from secondary storages of other zone when adding a new secondary storage

* Add API param and UI changes on add secondary storage page

* Make copy template across zones non blocking

* Code fixes

* unused imports

* Add copy template flag in zone wizard and remove NFS checks

* Fix UI

* Label fixes

* code optimizations

* code refactoring

* missing changes

* Combine template copy and download into a single asynchronous operation

* unused import and fixed conflicts

* unused code

* update config message

* Fix configuration setting value on add secondary storage page

* Removed unused code

* Update unit tests
---
 .../admin/host/AddSecondaryStorageCmd.java    |  24 ++-
 .../service/StorageOrchestrationService.java  |   3 +-
 .../api/storage/TemplateService.java          |   4 +-
 .../com/cloud/storage/StorageManager.java     |   5 +-
 .../orchestration/StorageOrchestrator.java    |  45 +++--
 .../storage/image/TemplateServiceImpl.java    | 157 +++++++++++++---
 .../image/TemplateServiceImplTest.java        | 171 +++++++++++++++++-
 .../cloud/storage/ImageStoreDetailsUtil.java  |  11 ++
 .../com/cloud/storage/StorageManagerImpl.java |   2 +-
 .../cloud/template/TemplateManagerImpl.java   |  14 +-
 ui/public/locales/en.json                     |   4 +-
 ui/src/views/infra/AddSecondaryStorage.vue    |  82 ++++++++-
 .../infra/zone/ZoneWizardAddResources.vue     |  25 ++-
 .../views/infra/zone/ZoneWizardLaunchZone.vue |   5 +
 14 files changed, 487 insertions(+), 65 deletions(-)

diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/host/AddSecondaryStorageCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/host/AddSecondaryStorageCmd.java
index 9a7eff7e2e59..585fd1b87a88 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/host/AddSecondaryStorageCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/host/AddSecondaryStorageCmd.java
@@ -29,6 +29,11 @@
 import com.cloud.exception.DiscoveryException;
 import com.cloud.storage.ImageStore;
 import com.cloud.user.Account;
+import org.apache.commons.collections.MapUtils;
+
+import java.util.Collection;
+import java.util.HashMap;
+import java.util.Map;
 
 @APICommand(name = "addSecondaryStorage", description = "Adds secondary storage.", responseObject = ImageStoreResponse.class,
         requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
@@ -44,6 +49,9 @@ public class AddSecondaryStorageCmd extends BaseCmd {
     @Parameter(name = ApiConstants.ZONE_ID, type = CommandType.UUID, entityType = ZoneResponse.class, description = "The Zone ID for the secondary storage")
     protected Long zoneId;
 
+    @Parameter(name = ApiConstants.DETAILS, type = CommandType.MAP, description = "Details in key/value pairs using format details[i].keyname=keyvalue. Example: details[0].copytemplatesfromothersecondarystorages=true")
+    protected Map details;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -56,6 +64,20 @@ public Long getZoneId() {
         return zoneId;
     }
 
+    public Map<String, String> getDetails() {
+        Map<String, String> detailsMap = new HashMap<>();
+        if (MapUtils.isNotEmpty(details)) {
+            Collection<?> props = details.values();
+            for (Object prop : props) {
+                HashMap<String, String> detail = (HashMap<String, String>) prop;
+                for (Map.Entry<String, String> entry: detail.entrySet()) {
+                    detailsMap.put(entry.getKey(),entry.getValue());
+                }
+            }
+        }
+        return detailsMap;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
@@ -68,7 +90,7 @@ public long getEntityOwnerId() {
     @Override
     public void execute(){
         try{
-            ImageStore result = _storageService.discoverImageStore(null, getUrl(), "NFS", getZoneId(), null);
+            ImageStore result = _storageService.discoverImageStore(null, getUrl(), "NFS", getZoneId(), getDetails());
             ImageStoreResponse storeResponse = null;
             if (result != null ) {
                     storeResponse = _responseGenerator.createImageStoreResponse(result);
diff --git a/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/StorageOrchestrationService.java b/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/StorageOrchestrationService.java
index 8be2015bfef6..4af0c806060b 100644
--- a/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/StorageOrchestrationService.java
+++ b/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/StorageOrchestrationService.java
@@ -22,7 +22,6 @@
 
 import org.apache.cloudstack.api.response.MigrationResponse;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
-import org.apache.cloudstack.engine.subsystem.api.storage.TemplateInfo;
 import org.apache.cloudstack.engine.subsystem.api.storage.TemplateService.TemplateApiResult;
 import org.apache.cloudstack.storage.ImageStoreService.MigrationPolicy;
 
@@ -31,5 +30,5 @@ public interface StorageOrchestrationService {
 
     MigrationResponse migrateResources(Long srcImgStoreId, Long destImgStoreId, List<Long> templateIdList, List<Long> snapshotIdList);
 
-    Future<TemplateApiResult> orchestrateTemplateCopyToImageStore(TemplateInfo source, DataStore destStore);
+    Future<TemplateApiResult> orchestrateTemplateCopyFromSecondaryStores(long templateId, DataStore destStore);
 }
diff --git a/engine/api/src/main/java/org/apache/cloudstack/engine/subsystem/api/storage/TemplateService.java b/engine/api/src/main/java/org/apache/cloudstack/engine/subsystem/api/storage/TemplateService.java
index a8861d5acc68..269eb4f1c213 100644
--- a/engine/api/src/main/java/org/apache/cloudstack/engine/subsystem/api/storage/TemplateService.java
+++ b/engine/api/src/main/java/org/apache/cloudstack/engine/subsystem/api/storage/TemplateService.java
@@ -80,4 +80,6 @@ public TemplateInfo getTemplate() {
     List<DatadiskTO> getTemplateDatadisksOnImageStore(TemplateInfo templateInfo, String configurationId);
 
     AsyncCallFuture<TemplateApiResult> copyTemplateToImageStore(DataObject source, DataStore destStore);
-}
+
+    void handleTemplateCopyFromSecondaryStores(long templateId, DataStore destStore);
+ }
diff --git a/engine/components-api/src/main/java/com/cloud/storage/StorageManager.java b/engine/components-api/src/main/java/com/cloud/storage/StorageManager.java
index de0cb34d63ee..4ce1f4a96385 100644
--- a/engine/components-api/src/main/java/com/cloud/storage/StorageManager.java
+++ b/engine/components-api/src/main/java/com/cloud/storage/StorageManager.java
@@ -220,8 +220,9 @@ public interface StorageManager extends StorageService {
             "storage.pool.host.connect.workers", "1",
             "Number of worker threads to be used to connect hosts to a primary storage", true);
 
-    ConfigKey<Boolean> COPY_PUBLIC_TEMPLATES_FROM_OTHER_STORAGES = new ConfigKey<>(Boolean.class, "copy.public.templates.from.other.storages",
-            "Storage", "true", "Allow SSVMs to try copying public templates from one secondary storage to another instead of downloading them from the source.",
+    ConfigKey<Boolean> COPY_TEMPLATES_FROM_OTHER_SECONDARY_STORAGES = new ConfigKey<>(Boolean.class, "copy.templates.from.other.secondary.storages",
+            "Storage", "true", "When enabled, this feature allows templates to be copied from existing Secondary Storage servers (within the same zone or across zones) " +
+            "while adding a new Secondary Storage. If the copy operation fails, the system falls back to downloading the template from the source URL.",
             true, ConfigKey.Scope.Zone, null);
 
     /**
diff --git a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/StorageOrchestrator.java b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/StorageOrchestrator.java
index 37a1f8dc196e..933b4e0c5ce6 100644
--- a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/StorageOrchestrator.java
+++ b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/StorageOrchestrator.java
@@ -36,6 +36,9 @@
 import javax.inject.Inject;
 import javax.naming.ConfigurationException;
 
+import com.cloud.dc.dao.DataCenterDao;
+import com.cloud.storage.dao.VMTemplateDao;
+import com.cloud.template.TemplateManager;
 import org.apache.cloudstack.api.response.MigrationResponse;
 import org.apache.cloudstack.engine.orchestration.service.StorageOrchestrationService;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataObject;
@@ -45,6 +48,7 @@
 import org.apache.cloudstack.engine.subsystem.api.storage.SecondaryStorageService.DataObjectResult;
 import org.apache.cloudstack.engine.subsystem.api.storage.SnapshotDataFactory;
 import org.apache.cloudstack.engine.subsystem.api.storage.SnapshotInfo;
+import org.apache.cloudstack.engine.subsystem.api.storage.TemplateDataFactory;
 import org.apache.cloudstack.engine.subsystem.api.storage.TemplateInfo;
 import org.apache.cloudstack.engine.subsystem.api.storage.TemplateService;
 import org.apache.cloudstack.engine.subsystem.api.storage.TemplateService.TemplateApiResult;
@@ -103,6 +107,15 @@ public class StorageOrchestrator extends ManagerBase implements StorageOrchestra
     VolumeDataStoreDao volumeDataStoreDao;
     @Inject
     DataMigrationUtility migrationHelper;
+    @Inject
+    TemplateManager templateManager;
+    @Inject
+    VMTemplateDao templateDao;
+    @Inject
+    TemplateDataFactory templateDataFactory;
+    @Inject
+    DataCenterDao dcDao;
+
 
     ConfigKey<Double> ImageStoreImbalanceThreshold = new ConfigKey<>("Advanced", Double.class,
             "image.store.imbalance.threshold",
@@ -304,8 +317,9 @@ public MigrationResponse migrateResources(Long srcImgStoreId, Long destImgStoreI
     }
 
     @Override
-    public Future<TemplateApiResult> orchestrateTemplateCopyToImageStore(TemplateInfo source, DataStore destStore) {
-        return submit(destStore.getScope().getScopeId(), new CopyTemplateTask(source, destStore));
+    public Future<TemplateApiResult> orchestrateTemplateCopyFromSecondaryStores(long srcTemplateId, DataStore destStore) {
+        Long dstZoneId = destStore.getScope().getScopeId();
+        return submit(dstZoneId, new CopyTemplateFromSecondaryStorageTask(srcTemplateId, destStore));
     }
 
     protected Pair<String, Boolean> migrateCompleted(Long destDatastoreId, DataStore srcDatastore, List<DataObject> files, MigrationPolicy migrationPolicy, int skipped) {
@@ -624,13 +638,13 @@ public DataObjectResult call() {
         }
     }
 
-    private class CopyTemplateTask implements Callable<TemplateApiResult> {
-        private TemplateInfo sourceTmpl;
-        private DataStore destStore;
-        private String logid;
+    private class CopyTemplateFromSecondaryStorageTask implements Callable<TemplateApiResult> {
+        private final long srcTemplateId;
+        private final DataStore destStore;
+        private final String logid;
 
-        public CopyTemplateTask(TemplateInfo sourceTmpl, DataStore destStore) {
-            this.sourceTmpl = sourceTmpl;
+        CopyTemplateFromSecondaryStorageTask(long srcTemplateId, DataStore destStore) {
+            this.srcTemplateId = srcTemplateId;
             this.destStore = destStore;
             this.logid = ThreadContext.get(LOGCONTEXTID);
         }
@@ -639,17 +653,16 @@ public CopyTemplateTask(TemplateInfo sourceTmpl, DataStore destStore) {
         public TemplateApiResult call() {
             ThreadContext.put(LOGCONTEXTID, logid);
             TemplateApiResult result;
-            AsyncCallFuture<TemplateApiResult> future = templateService.copyTemplateToImageStore(sourceTmpl, destStore);
+            long destZoneId = destStore.getScope().getScopeId();
+            TemplateInfo sourceTmpl = templateDataFactory.getTemplate(srcTemplateId, DataStoreRole.Image);
             try {
-                result = future.get();
-            } catch (ExecutionException | InterruptedException e) {
-                logger.warn("Exception while copying template [{}] from image store [{}] to image store [{}]: {}",
-                        sourceTmpl.getUniqueName(), sourceTmpl.getDataStore().getName(), destStore.getName(), e.toString());
+                templateService.handleTemplateCopyFromSecondaryStores(srcTemplateId, destStore);
                 result = new TemplateApiResult(sourceTmpl);
-                result.setResult(e.getMessage());
+            } finally {
+                tryCleaningUpExecutor(destZoneId);
+                ThreadContext.clearAll();
             }
-            tryCleaningUpExecutor(destStore.getScope().getScopeId());
-            ThreadContext.clearAll();
+
             return result;
         }
     }
diff --git a/engine/storage/image/src/main/java/org/apache/cloudstack/storage/image/TemplateServiceImpl.java b/engine/storage/image/src/main/java/org/apache/cloudstack/storage/image/TemplateServiceImpl.java
index bee62955051a..5fc9bbac3522 100644
--- a/engine/storage/image/src/main/java/org/apache/cloudstack/storage/image/TemplateServiceImpl.java
+++ b/engine/storage/image/src/main/java/org/apache/cloudstack/storage/image/TemplateServiceImpl.java
@@ -31,6 +31,8 @@
 
 import javax.inject.Inject;
 
+import com.cloud.exception.StorageUnavailableException;
+import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.engine.orchestration.service.StorageOrchestrationService;
 import org.apache.cloudstack.engine.subsystem.api.storage.CopyCommandResult;
 import org.apache.cloudstack.engine.subsystem.api.storage.CreateCmdResult;
@@ -67,9 +69,11 @@
 import org.apache.cloudstack.storage.image.datastore.ImageStoreEntity;
 import org.apache.cloudstack.storage.image.store.TemplateObject;
 import org.apache.cloudstack.storage.to.TemplateObjectTO;
+import org.apache.commons.collections.CollectionUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.logging.log4j.Logger;
 import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.ThreadContext;
 import org.springframework.stereotype.Component;
 
 import com.cloud.agent.api.Answer;
@@ -567,10 +571,7 @@ public void handleTemplateSync(DataStore store) {
                             }
 
                             if (availHypers.contains(tmplt.getHypervisorType())) {
-                                boolean copied = isCopyFromOtherStoragesEnabled(zoneId) && tryCopyingTemplateToImageStore(tmplt, store);
-                                if (!copied) {
-                                    tryDownloadingTemplateToImageStore(tmplt, store);
-                                }
+                                storageOrchestrator.orchestrateTemplateCopyFromSecondaryStores(tmplt.getId(), store);
                             } else {
                                 logger.info("Skip downloading template {} since current data center does not have hypervisor {}", tmplt, tmplt.getHypervisorType());
                             }
@@ -617,6 +618,16 @@ public void handleTemplateSync(DataStore store) {
 
     }
 
+    @Override
+    public void handleTemplateCopyFromSecondaryStores(long templateId, DataStore destStore) {
+        VMTemplateVO template = _templateDao.findById(templateId);
+        long zoneId = destStore.getScope().getScopeId();
+        boolean copied = imageStoreDetailsUtil.isCopyTemplatesFromOtherStoragesEnabled(destStore.getId(), zoneId) && tryCopyingTemplateToImageStore(template, destStore);
+        if (!copied) {
+            tryDownloadingTemplateToImageStore(template, destStore);
+        }
+    }
+
     protected void tryDownloadingTemplateToImageStore(VMTemplateVO tmplt, DataStore destStore) {
         if (tmplt.getUrl() == null) {
             logger.info("Not downloading template [{}] to image store [{}], as it has no URL.", tmplt.getUniqueName(),
@@ -634,28 +645,134 @@ protected void tryDownloadingTemplateToImageStore(VMTemplateVO tmplt, DataStore
     }
 
     protected boolean tryCopyingTemplateToImageStore(VMTemplateVO tmplt, DataStore destStore) {
-        Long zoneId = destStore.getScope().getScopeId();
-        List<DataStore> storesInZone = _storeMgr.getImageStoresByZoneIds(zoneId);
-        for (DataStore sourceStore : storesInZone) {
-            Map<String, TemplateProp> existingTemplatesInSourceStore = listTemplate(sourceStore);
-            if (existingTemplatesInSourceStore == null || !existingTemplatesInSourceStore.containsKey(tmplt.getUniqueName())) {
-                logger.debug("Template [{}] does not exist on image store [{}]; searching on another one.",
-                        tmplt.getUniqueName(), sourceStore.getName());
+        if (searchAndCopyWithinZone(tmplt, destStore)) {
+            return true;
+        }
+
+        Long destZoneId = destStore.getScope().getScopeId();
+        logger.debug("Template [{}] not found in any image store of zone [{}]. Checking other zones.",
+                tmplt.getUniqueName(), destZoneId);
+
+        return searchAndCopyAcrossZones(tmplt, destStore, destZoneId);
+    }
+
+    private boolean searchAndCopyAcrossZones(VMTemplateVO tmplt, DataStore destStore, Long destZoneId) {
+        List<Long> allZoneIds = _dcDao.listAllIds();
+        for (Long otherZoneId : allZoneIds) {
+            if (otherZoneId.equals(destZoneId)) {
                 continue;
             }
-            TemplateObject sourceTmpl = (TemplateObject) _templateFactory.getTemplate(tmplt.getId(), sourceStore);
-            if (sourceTmpl.getInstallPath() == null) {
-                logger.warn("Can not copy template [{}] from image store [{}], as it returned a null install path.", tmplt.getUniqueName(),
-                        sourceStore.getName());
+
+            List<DataStore> storesInOtherZone = _storeMgr.getImageStoresByZoneIds(otherZoneId);
+            logger.debug("Checking zone [{}] for template [{}]...", otherZoneId, tmplt.getUniqueName());
+
+            if (CollectionUtils.isEmpty(storesInOtherZone)) {
+                logger.debug("Zone [{}] has no image stores. Skipping.", otherZoneId);
                 continue;
             }
-            storageOrchestrator.orchestrateTemplateCopyToImageStore(sourceTmpl, destStore);
-            return true;
+
+            TemplateObject sourceTmpl = findUsableTemplate(tmplt, storesInOtherZone);
+            if (sourceTmpl == null) {
+                logger.debug("Template [{}] not found with a valid install path in any image store of zone [{}].",
+                        tmplt.getUniqueName(), otherZoneId);
+                continue;
+            }
+
+            logger.info("Template [{}] found in zone [{}]. Initiating cross-zone copy to zone [{}].",
+                    tmplt.getUniqueName(), otherZoneId, destZoneId);
+
+            return copyTemplateAcrossZones(destStore, sourceTmpl);
         }
-        logger.debug("Can't copy template [{}] from another image store.", tmplt.getUniqueName());
+
+        logger.debug("Template [{}] was not found in any zone. Cannot perform zone-to-zone copy.", tmplt.getUniqueName());
         return false;
     }
 
+    protected TemplateObject findUsableTemplate(VMTemplateVO tmplt, List<DataStore> imageStores) {
+        for (DataStore store : imageStores) {
+
+            Map<String, TemplateProp> templates = listTemplate(store);
+            if (templates == null || !templates.containsKey(tmplt.getUniqueName())) {
+                continue;
+            }
+
+            TemplateObject tmpl = (TemplateObject) _templateFactory.getTemplate(tmplt.getId(), store);
+            if (tmpl.getInstallPath() == null) {
+                logger.debug("Template [{}] found in image store [{}] but install path is null. Skipping.",
+                        tmplt.getUniqueName(), store.getName());
+                continue;
+            }
+            return tmpl;
+        }
+        return null;
+    }
+
+    private boolean searchAndCopyWithinZone(VMTemplateVO tmplt, DataStore destStore) {
+        Long destZoneId = destStore.getScope().getScopeId();
+        List<DataStore> storesInSameZone = _storeMgr.getImageStoresByZoneIds(destZoneId);
+
+        TemplateObject sourceTmpl = findUsableTemplate(tmplt, storesInSameZone);
+        if (sourceTmpl == null) {
+            return false;
+        }
+
+        TemplateApiResult result;
+        AsyncCallFuture<TemplateApiResult> future = copyTemplateToImageStore(sourceTmpl, destStore);
+        try {
+            result = future.get();
+        } catch (ExecutionException | InterruptedException e) {
+            logger.warn("Exception while copying template [{}] from image store [{}] to image store [{}]: {}",
+                    sourceTmpl.getUniqueName(), sourceTmpl.getDataStore().getName(), destStore.getName(), e.toString());
+            result = new TemplateApiResult(sourceTmpl);
+            result.setResult(e.getMessage());
+        }
+        return result.isSuccess();
+    }
+
+    private boolean copyTemplateAcrossZones(DataStore destStore, TemplateObject sourceTmpl) {
+        Long dstZoneId = destStore.getScope().getScopeId();
+        DataCenterVO dstZone = _dcDao.findById(dstZoneId);
+
+        if (dstZone == null) {
+            logger.warn("Destination zone [{}] not found for template [{}].", dstZoneId, sourceTmpl.getUniqueName());
+            return false;
+        }
+
+        TemplateApiResult result;
+        try {
+            VMTemplateVO template = _templateDao.findById(sourceTmpl.getId());
+            try {
+                DataStore sourceStore = sourceTmpl.getDataStore();
+                long userId = CallContext.current().getCallingUserId();
+                boolean success = _tmpltMgr.copy(userId, template, sourceStore, dstZone);
+
+                result = new TemplateApiResult(sourceTmpl);
+                if (!success) {
+                    result.setResult("Cross-zone template copy failed");
+                }
+            } catch (StorageUnavailableException | ResourceAllocationException e) {
+                logger.error("Exception while copying template [{}] from zone [{}] to zone [{}]",
+                        template,
+                        sourceTmpl.getDataStore().getScope().getScopeId(),
+                        dstZone.getId(),
+                        e);
+                result = new TemplateApiResult(sourceTmpl);
+                result.setResult(e.getMessage());
+            } finally {
+                ThreadContext.clearAll();
+            }
+        } catch (Exception e) {
+            logger.error("Failed to copy template [{}] from zone [{}] to zone [{}].",
+                    sourceTmpl.getUniqueName(),
+                    sourceTmpl.getDataStore().getScope().getScopeId(),
+                    dstZoneId,
+                    e);
+            return false;
+        }
+
+        return result.isSuccess();
+    }
+
     @Override
     public AsyncCallFuture<TemplateApiResult> copyTemplateToImageStore(DataObject source, DataStore destStore) {
         TemplateObject sourceTmpl = (TemplateObject) source;
@@ -699,10 +816,6 @@ protected Void copyTemplateToImageStoreCallback(AsyncCallbackDispatcher<Template
         return null;
     }
 
-    protected boolean isCopyFromOtherStoragesEnabled(Long zoneId) {
-        return StorageManager.COPY_PUBLIC_TEMPLATES_FROM_OTHER_STORAGES.valueIn(zoneId);
-    }
-
     protected void publishTemplateCreation(TemplateInfo tmplt) {
         VMTemplateVO tmpltVo = _templateDao.findById(tmplt.getId());
 
diff --git a/engine/storage/image/src/test/java/org/apache/cloudstack/storage/image/TemplateServiceImplTest.java b/engine/storage/image/src/test/java/org/apache/cloudstack/storage/image/TemplateServiceImplTest.java
index cb7994915b34..e9eac0458697 100644
--- a/engine/storage/image/src/test/java/org/apache/cloudstack/storage/image/TemplateServiceImplTest.java
+++ b/engine/storage/image/src/test/java/org/apache/cloudstack/storage/image/TemplateServiceImplTest.java
@@ -18,13 +18,20 @@
  */
 package org.apache.cloudstack.storage.image;
 
+import com.cloud.dc.DataCenterVO;
+import com.cloud.dc.dao.DataCenterDao;
+import com.cloud.exception.ResourceAllocationException;
+import com.cloud.exception.StorageUnavailableException;
+import com.cloud.storage.dao.VMTemplateDao;
 import com.cloud.storage.template.TemplateProp;
 import com.cloud.template.TemplateManager;
+import com.cloud.user.Account;
+import com.cloud.user.User;
+import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.engine.orchestration.service.StorageOrchestrationService;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreManager;
 import org.apache.cloudstack.engine.subsystem.api.storage.Scope;
-import org.apache.cloudstack.framework.async.AsyncCallFuture;
 import org.apache.cloudstack.storage.datastore.db.TemplateDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.TemplateDataStoreVO;
 import org.apache.cloudstack.storage.image.store.TemplateObject;
@@ -46,6 +53,8 @@
 import java.util.List;
 import java.util.Map;
 
+import static org.mockito.Mockito.mock;
+
 @RunWith(MockitoJUnitRunner.class)
 public class TemplateServiceImplTest {
 
@@ -89,6 +98,12 @@ public class TemplateServiceImplTest {
     @Mock
     TemplateManager templateManagerMock;
 
+    @Mock
+    VMTemplateDao templateDao;
+
+    @Mock
+    DataCenterDao _dcDao;
+
     Map<String, TemplateProp> templatesInSourceStore = new HashMap<>();
 
     @Before
@@ -101,7 +116,6 @@ public void setUp() {
         Mockito.doReturn(List.of(sourceStoreMock, destStoreMock)).when(dataStoreManagerMock).getImageStoresByZoneIds(zoneId);
         Mockito.doReturn(templatesInSourceStore).when(templateService).listTemplate(sourceStoreMock);
         Mockito.doReturn(null).when(templateService).listTemplate(destStoreMock);
-        Mockito.doReturn("install-path").when(templateInfoMock).getInstallPath();
         Mockito.doReturn(templateInfoMock).when(templateDataFactoryMock).getTemplate(2L, sourceStoreMock);
         Mockito.doReturn(3L).when(dataStoreMock).getId();
         Mockito.doReturn(zoneScopeMock).when(dataStoreMock).getScope();
@@ -166,7 +180,7 @@ public void tryCopyingTemplateToImageStoreTestReturnsFalseWhenTemplateDoesNotExi
         boolean result = templateService.tryCopyingTemplateToImageStore(tmpltMock, destStoreMock);
 
         Assert.assertFalse(result);
-        Mockito.verify(storageOrchestrator, Mockito.never()).orchestrateTemplateCopyToImageStore(Mockito.any(), Mockito.any());
+        Mockito.verify(storageOrchestrator, Mockito.never()).orchestrateTemplateCopyFromSecondaryStores(Mockito.anyLong(), Mockito.any());
     }
 
     @Test
@@ -174,20 +188,161 @@ public void tryCopyingTemplateToImageStoreTestReturnsFalseWhenInstallPathIsNull(
         templatesInSourceStore.put(tmpltMock.getUniqueName(), tmpltPropMock);
         Mockito.doReturn(null).when(templateInfoMock).getInstallPath();
 
+        Scope scopeMock = Mockito.mock(Scope.class);
+        Mockito.doReturn(scopeMock).when(destStoreMock).getScope();
+        Mockito.doReturn(1L).when(scopeMock).getScopeId();
+        Mockito.doReturn(List.of(1L)).when(_dcDao).listAllIds();
+
         boolean result = templateService.tryCopyingTemplateToImageStore(tmpltMock, destStoreMock);
 
         Assert.assertFalse(result);
-        Mockito.verify(storageOrchestrator, Mockito.never()).orchestrateTemplateCopyToImageStore(Mockito.any(), Mockito.any());
+        Mockito.verify(storageOrchestrator, Mockito.never()).orchestrateTemplateCopyFromSecondaryStores(Mockito.anyLong(), Mockito.any());
     }
 
     @Test
-    public void tryCopyingTemplateToImageStoreTestReturnsTrueWhenTemplateExistsInAnotherStorageAndTaskWasScheduled() {
-        templatesInSourceStore.put(tmpltMock.getUniqueName(), tmpltPropMock);
-        Mockito.doReturn(new AsyncCallFuture<>()).when(storageOrchestrator).orchestrateTemplateCopyToImageStore(Mockito.any(), Mockito.any());
+    public void tryCopyingTemplateToImageStoreTestReturnsTrueWhenTemplateExistsInAnotherZone() throws StorageUnavailableException, ResourceAllocationException {
+        Scope scopeMock = Mockito.mock(Scope.class);
+        Mockito.doReturn(scopeMock).when(destStoreMock).getScope();
+        Mockito.doReturn(1L).when(scopeMock).getScopeId();
+        Mockito.doReturn(100L).when(tmpltMock).getId();
+        Mockito.doReturn("unique-name").when(tmpltMock).getUniqueName();
+        Mockito.doReturn(List.of(sourceStoreMock)).when(dataStoreManagerMock).getImageStoresByZoneIds(1L);
+        Mockito.doReturn(null).when(templateService).listTemplate(sourceStoreMock);
+        Mockito.doReturn(List.of(1L, 2L)).when(_dcDao).listAllIds();
+
+        DataStore otherZoneStoreMock = Mockito.mock(DataStore.class);
+        Mockito.doReturn(List.of(otherZoneStoreMock)).when(dataStoreManagerMock).getImageStoresByZoneIds(2L);
+
+        Map<String, TemplateProp> templatesInOtherZone = new HashMap<>();
+        templatesInOtherZone.put("unique-name", tmpltPropMock);
+        Mockito.doReturn(templatesInOtherZone).when(templateService).listTemplate(otherZoneStoreMock);
+
+        TemplateObject sourceTmplMock = Mockito.mock(TemplateObject.class);
+        Mockito.doReturn(sourceTmplMock).when(templateDataFactoryMock).getTemplate(100L, otherZoneStoreMock);
+        Mockito.doReturn("/mnt/secondary/template.qcow2").when(sourceTmplMock).getInstallPath();
+
+        DataCenterVO dstZoneMock = Mockito.mock(DataCenterVO.class);
+        Mockito.doReturn(dstZoneMock).when(_dcDao).findById(1L);
+        Mockito.doReturn(true).when(templateManagerMock).copy(Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.any());
 
         boolean result = templateService.tryCopyingTemplateToImageStore(tmpltMock, destStoreMock);
 
         Assert.assertTrue(result);
-        Mockito.verify(storageOrchestrator).orchestrateTemplateCopyToImageStore(Mockito.any(), Mockito.any());
+    }
+
+    @Test
+    public void tryCopyingTemplateToImageStoreTestReturnsFalseWhenDestinationZoneIsMissing() {
+        Scope scopeMock = Mockito.mock(Scope.class);
+        Mockito.doReturn(scopeMock).when(destStoreMock).getScope();
+        Mockito.doReturn(1L).when(scopeMock).getScopeId();
+        Mockito.doReturn(100L).when(tmpltMock).getId();
+        Mockito.doReturn("unique-name").when(tmpltMock).getUniqueName();
+        Mockito.doReturn(List.of(1L, 2L)).when(_dcDao).listAllIds();
+        Mockito.doReturn(List.of()).when(dataStoreManagerMock).getImageStoresByZoneIds(1L);
+
+        DataStore otherZoneStoreMock = Mockito.mock(DataStore.class);
+        Mockito.doReturn(List.of(otherZoneStoreMock)).when(dataStoreManagerMock).getImageStoresByZoneIds(2L);
+
+        Map<String, TemplateProp> templates = new HashMap<>();
+        templates.put("unique-name", tmpltPropMock);
+        Mockito.doReturn(templates).when(templateService).listTemplate(otherZoneStoreMock);
+
+        TemplateObject sourceTmplMock = Mockito.mock(TemplateObject.class);
+        Mockito.doReturn(sourceTmplMock).when(templateDataFactoryMock).getTemplate(100L, otherZoneStoreMock);
+        Mockito.doReturn("/mnt/secondary/template.qcow2").when(sourceTmplMock).getInstallPath();
+        Mockito.doReturn(null).when(_dcDao).findById(1L);
+
+        boolean result = templateService.tryCopyingTemplateToImageStore(tmpltMock, destStoreMock);
+
+        Assert.assertFalse(result);
+    }
+
+    @Test
+    public void tryCopyingTemplateToImageStoreTestReturnsTrueWhenCrossZoneCopyTaskIsScheduled() throws StorageUnavailableException, ResourceAllocationException {
+        Scope scopeMock = Mockito.mock(Scope.class);
+        Mockito.doReturn(scopeMock).when(destStoreMock).getScope();
+        Mockito.doReturn(1L).when(scopeMock).getScopeId();
+        Mockito.doReturn(100L).when(tmpltMock).getId();
+        Mockito.doReturn("unique-name").when(tmpltMock).getUniqueName();
+        Mockito.doReturn(List.of(1L, 2L)).when(_dcDao).listAllIds();
+        Mockito.doReturn(List.of()).when(dataStoreManagerMock).getImageStoresByZoneIds(1L);
+
+        DataStore otherZoneStoreMock = Mockito.mock(DataStore.class);
+        Mockito.doReturn(List.of(otherZoneStoreMock)).when(dataStoreManagerMock).getImageStoresByZoneIds(2L);
+
+        Map<String, TemplateProp> templates = new HashMap<>();
+        templates.put("unique-name", tmpltPropMock);
+        Mockito.doReturn(templates).when(templateService).listTemplate(otherZoneStoreMock);
+
+        TemplateObject sourceTmplMock = Mockito.mock(TemplateObject.class);
+        Mockito.doReturn(sourceTmplMock).when(templateDataFactoryMock).getTemplate(100L, otherZoneStoreMock);
+        Mockito.doReturn("/mnt/secondary/template.qcow2").when(sourceTmplMock).getInstallPath();
+        Mockito.doReturn(100L).when(sourceTmplMock).getId();
+
+        DataStore sourceStoreMock = Mockito.mock(DataStore.class);
+        Scope sourceScopeMock = Mockito.mock(Scope.class);
+        Mockito.doReturn(sourceStoreMock).when(sourceTmplMock).getDataStore();
+
+        DataCenterVO dstZoneMock = Mockito.mock(DataCenterVO.class);
+        Mockito.doReturn(dstZoneMock).when(_dcDao).findById(1L);
+        VMTemplateVO templateVoMock = Mockito.mock(VMTemplateVO.class);
+        Mockito.doReturn(templateVoMock).when(templateDao).findById(100L);
+
+        Mockito.doReturn(true).when(templateManagerMock).copy(Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.any());
+
+        Account account = mock(Account.class);
+        User user = mock(User.class);
+        CallContext callContext = mock(CallContext.class);
+
+        boolean result = templateService.tryCopyingTemplateToImageStore(tmpltMock, destStoreMock);
+
+        Assert.assertTrue(result);
+    }
+
+    @Test
+    public void tryCopyingTemplateToImageStoreTestReturnsFalseWhenTemplateNotFoundInAnyZone() {
+        Scope scopeMock = Mockito.mock(Scope.class);
+        Mockito.doReturn(scopeMock).when(destStoreMock).getScope();
+        Mockito.doReturn(1L).when(scopeMock).getScopeId();
+        Mockito.doReturn(List.of(1L, 2L)).when(_dcDao).listAllIds();
+        Mockito.doReturn(List.of(sourceStoreMock)).when(dataStoreManagerMock).getImageStoresByZoneIds(Mockito.anyLong());
+        Mockito.doReturn(null).when(templateService).listTemplate(Mockito.any());
+
+        boolean result = templateService.tryCopyingTemplateToImageStore(tmpltMock, destStoreMock);
+
+        Assert.assertFalse(result);
+    }
+
+    @Test
+    public void testFindUsableTemplateReturnsTemplateWithNonNullInstallPath() {
+        VMTemplateVO template = Mockito.mock(VMTemplateVO.class);
+        Mockito.when(template.getId()).thenReturn(10L);
+        Mockito.when(template.getUniqueName()).thenReturn("test-template");
+
+        DataStore storeWithNullPath = Mockito.mock(DataStore.class);
+        Mockito.when(storeWithNullPath.getName()).thenReturn("store-null");
+
+        DataStore storeWithValidPath = Mockito.mock(DataStore.class);
+        TemplateObject tmplWithNullPath = Mockito.mock(TemplateObject.class);
+        Mockito.when(tmplWithNullPath.getInstallPath()).thenReturn(null);
+
+        TemplateObject tmplWithValidPath = Mockito.mock(TemplateObject.class);
+        Mockito.when(tmplWithValidPath.getInstallPath()).thenReturn("/mnt/secondary/template.qcow2");
+
+        Mockito.doReturn(tmplWithNullPath).when(templateDataFactoryMock).getTemplate(10L, storeWithNullPath);
+        Mockito.doReturn(tmplWithValidPath).when(templateDataFactoryMock).getTemplate(10L, storeWithValidPath);
+
+        Map<String, TemplateProp> templates = new HashMap<>();
+        templates.put("test-template", Mockito.mock(TemplateProp.class));
+
+        Mockito.doReturn(templates).when(templateService).listTemplate(storeWithNullPath);
+        Mockito.doReturn(templates).when(templateService).listTemplate(storeWithValidPath);
+
+        List<DataStore> imageStores = List.of(storeWithNullPath, storeWithValidPath);
+
+        TemplateObject result = templateService.findUsableTemplate(template, imageStores);
+
+        Assert.assertNotNull(result);
+        Assert.assertEquals(tmplWithValidPath, result);
     }
 }
diff --git a/server/src/main/java/com/cloud/storage/ImageStoreDetailsUtil.java b/server/src/main/java/com/cloud/storage/ImageStoreDetailsUtil.java
index baf5ef8902db..9f5aa660f4f5 100755
--- a/server/src/main/java/com/cloud/storage/ImageStoreDetailsUtil.java
+++ b/server/src/main/java/com/cloud/storage/ImageStoreDetailsUtil.java
@@ -78,4 +78,15 @@ public String getNfsVersionByUuid(String storeUuid){
         return getGlobalDefaultNfsVersion();
     }
 
+    public boolean isCopyTemplatesFromOtherStoragesEnabled(Long storeId, Long zoneId) {
+        final Map<String, String> storeDetails = imageStoreDetailsDao.getDetails(storeId);
+        final String keyWithoutDots = StorageManager.COPY_TEMPLATES_FROM_OTHER_SECONDARY_STORAGES.key()
+                .replace(".", "");
+
+        if (storeDetails != null && storeDetails.containsKey(keyWithoutDots)) {
+            return Boolean.parseBoolean(storeDetails.get(keyWithoutDots));
+        }
+
+        return StorageManager.COPY_TEMPLATES_FROM_OTHER_SECONDARY_STORAGES.valueIn(zoneId);
+    }
 }
diff --git a/server/src/main/java/com/cloud/storage/StorageManagerImpl.java b/server/src/main/java/com/cloud/storage/StorageManagerImpl.java
index 13b7fbb00c20..d1dca0fa901b 100644
--- a/server/src/main/java/com/cloud/storage/StorageManagerImpl.java
+++ b/server/src/main/java/com/cloud/storage/StorageManagerImpl.java
@@ -4206,7 +4206,7 @@ public ConfigKey<?>[] getConfigKeys() {
                 DataStoreDownloadFollowRedirects,
                 AllowVolumeReSizeBeyondAllocation,
                 StoragePoolHostConnectWorkers,
-                COPY_PUBLIC_TEMPLATES_FROM_OTHER_STORAGES
+                COPY_TEMPLATES_FROM_OTHER_SECONDARY_STORAGES
         };
     }
 
diff --git a/server/src/main/java/com/cloud/template/TemplateManagerImpl.java b/server/src/main/java/com/cloud/template/TemplateManagerImpl.java
index 5773410c35ad..78265021c0ab 100755
--- a/server/src/main/java/com/cloud/template/TemplateManagerImpl.java
+++ b/server/src/main/java/com/cloud/template/TemplateManagerImpl.java
@@ -842,6 +842,9 @@ public boolean copy(long userId, VMTemplateVO template, DataStore srcSecStore, D
         // Copy will just find one eligible image store for the destination zone
         // and copy template there, not propagate to all image stores
         // for that zone
+
+        boolean copied = false;
+
         for (DataStore dstSecStore : dstSecStores) {
             TemplateDataStoreVO dstTmpltStore = _tmplStoreDao.findByStoreTemplate(dstSecStore.getId(), tmpltId);
             if (dstTmpltStore != null && dstTmpltStore.getDownloadState() == Status.DOWNLOADED) {
@@ -856,9 +859,12 @@ public boolean copy(long userId, VMTemplateVO template, DataStore srcSecStore, D
                 TemplateApiResult result = future.get();
                 if (result.isFailed()) {
                     logger.debug("Copy Template failed for image store {}: {}", dstSecStore, result.getResult());
+                    _tmplStoreDao.removeByTemplateStore(tmpltId, dstSecStore.getId());
                     continue; // try next image store
                 }
 
+                copied = true;
+
                 _tmpltDao.addTemplateToZone(template, dstZoneId);
 
                 if (account.getId() != Account.ACCOUNT_ID_SYSTEM) {
@@ -886,12 +892,14 @@ public boolean copy(long userId, VMTemplateVO template, DataStore srcSecStore, D
                         }
                     }
                 }
+
+                return true;
+
             } catch (Exception ex) {
-                logger.debug("Failed to copy Template to image store:{} ,will try next one", dstSecStore);
+                logger.debug("Failed to copy Template to image store:{} ,will try next one", dstSecStore, ex);
             }
         }
-        return true;
-
+        return copied;
     }
 
     @Override
diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index b2465fa325f4..99873820d53d 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -591,6 +591,8 @@
 "label.copy.consoleurl": "Copy console URL to clipboard",
 "label.copyid": "Copy ID",
 "label.copy.password": "Copy password",
+"label.copy.templates.from.other.secondary.storages": "Copy Templates from other storages instead of fetching from URLs",
+"label.copy.templates.from.other.secondary.storages.add.zone": "Copy Templates from other storages",
 "label.core": "Core",
 "label.core.zone.type": "Core Zone type",
 "label.counter": "Counter",
@@ -3019,7 +3021,7 @@
 "message.desc.importmigratefromvmwarewizard": "By selecting an existing or external VMware Datacenter and an instance to import, CloudStack migrates the selected instance from VMware to KVM on a conversion host using virt-v2v and imports it into a KVM Cluster",
 "message.desc.primary.storage": "Each Cluster must contain one or more primary storage servers. We will add the first one now. Primary storage contains the disk volumes for all the Instances running on hosts in the cluster. Use any standards-compliant protocol that is supported by the underlying hypervisor.",
 "message.desc.reset.ssh.key.pair": "Please specify a ssh key pair that you would like to add to this Instance.",
-"message.desc.secondary.storage": "Each Zone must have at least one NFS or secondary storage server. We will add the first one now. Secondary storage stores Instance Templates, ISO images, and Instance disk volume Snapshots. This server must be available to all hosts in the zone.<br/><br/>Provide the IP address and exported path.",
+"message.desc.secondary.storage": "Each Zone must have at least one NFS or secondary storage server. We will add the first one now. Secondary storage stores Instance Templates, ISO images, and Instance disk volume Snapshots. This server must be available to all hosts in the zone.<br/><br/>Provide the IP address and exported path.<br/><br/> \"Copy templates from other secondary storages\" switch can be used to automatically copy existing templates from secondary storages in other zones instead of fetching from their URLs.",
 "message.desc.register.user.data": "Please fill in the following to register new User Data.",
 "message.desc.registered.user.data": "Registered a User Data.",
 "message.desc.zone": "A Zone is the largest organizational unit in CloudStack, and it typically corresponds to a single datacenter. Zones provide physical isolation and redundancy. A zone consists of one or more Pods (each of which contains hosts and primary storage servers) and a secondary storage server which is shared by all pods in the zone.",
diff --git a/ui/src/views/infra/AddSecondaryStorage.vue b/ui/src/views/infra/AddSecondaryStorage.vue
index 746af5b959d0..db4893115a6e 100644
--- a/ui/src/views/infra/AddSecondaryStorage.vue
+++ b/ui/src/views/infra/AddSecondaryStorage.vue
@@ -48,6 +48,7 @@
           <a-form-item name="zone" ref="zone" :label="$t('label.zone')">
             <a-select
               v-model:value="form.zone"
+              @change="onZoneChange"
               showSearch
               optionFilterProp="label"
               :filterOption="(input, option) => {
@@ -105,6 +106,7 @@
           <a-form-item name="zone" ref="zone" :label="$t('label.zone')">
             <a-select
               v-model:value="form.zone"
+              @change="onZoneChange"
               showSearch
               optionFilterProp="label"
               :filterOption="(input, option) => {
@@ -159,6 +161,17 @@
             <a-input v-model:value="form.secondaryStorageNFSPath"/>
           </a-form-item>
         </div>
+        <div v-if="showCopyTemplatesToggle">
+          <a-form-item
+            name="copyTemplatesFromOtherSecondaryStorages"
+            ref="copyTemplatesFromOtherSecondaryStorages"
+            :label="$t('label.copy.templates.from.other.secondary.storages')">
+            <a-switch
+              v-model:checked="form.copyTemplatesFromOtherSecondaryStorages"
+              @change="onCopyTemplatesToggleChanged"
+            />
+          </a-form-item>
+        </div>
         <div :span="24" class="action-button">
           <a-button @click="closeModal">{{ $t('label.cancel') }}</a-button>
           <a-button type="primary" ref="submit" @click="handleSubmit">{{ $t('label.ok') }}</a-button>
@@ -191,7 +204,9 @@ export default {
       providers: ['NFS', 'SMB/CIFS', 'S3', 'Swift'],
       zones: [],
       loading: false,
-      secondaryStorageNFSStaging: false
+      secondaryStorageNFSStaging: false,
+      showCopyTemplatesToggle: false,
+      copyTemplatesTouched: false
     }
   },
   created () {
@@ -203,7 +218,8 @@ export default {
       this.formRef = ref()
       this.form = reactive({
         provider: 'NFS',
-        secondaryStorageHttps: true
+        secondaryStorageHttps: true,
+        copyTemplatesFromOtherSecondaryStorages: true
       })
       this.rules = reactive({
         zone: [{ required: true, message: this.$t('label.required') }],
@@ -225,20 +241,56 @@ export default {
     },
     fetchData () {
       this.listZones()
+      this.checkOtherSecondaryStorages()
     },
     closeModal () {
       this.$emit('close-action')
     },
+    fetchCopyTemplatesConfig () {
+      if (!this.form.zone) {
+        return
+      }
+
+      api('listConfigurations', {
+        name: 'copy.templates.from.other.secondary.storages',
+        zoneid: this.form.zone
+      }).then(json => {
+        const items =
+          json?.listconfigurationsresponse?.configuration || []
+
+        items.forEach(item => {
+          if (item.name === 'copy.templates.from.other.secondary.storages') {
+            this.form.copyTemplatesFromOtherSecondaryStorages =
+              item.value === 'true'
+          }
+        })
+      })
+    },
+    onZoneChange (val) {
+      this.form.zone = val
+      this.copyTemplatesTouched = false
+      this.fetchCopyTemplatesConfig()
+    },
     listZones () {
       api('listZones', { showicon: true }).then(json => {
-        if (json && json.listzonesresponse && json.listzonesresponse.zone) {
-          this.zones = json.listzonesresponse.zone
-          if (this.zones.length > 0) {
-            this.form.zone = this.zones[0].id || ''
-          }
+        this.zones = json.listzonesresponse.zone || []
+
+        if (this.zones.length > 0) {
+          this.form.zone = this.zones[0].id
+          this.fetchCopyTemplatesConfig()
         }
       })
     },
+    checkOtherSecondaryStorages () {
+      api('listImageStores', { listall: true }).then(json => {
+        const stores = json?.listimagestoresresponse?.imagestore || []
+
+        this.showCopyTemplatesToggle = stores.length > 0
+      })
+    },
+    onCopyTemplatesToggleChanged (val) {
+      this.copyTemplatesTouched = true
+    },
     nfsURL (server, path) {
       var url
       if (path.substring(0, 1) !== '/') {
@@ -362,6 +414,22 @@ export default {
           nfsParams.url = nfsUrl
         }
 
+        if (
+          this.showCopyTemplatesToggle &&
+          this.copyTemplatesTouched
+        ) {
+          const copyTemplatesKey = 'copytemplatesfromothersecondarystorages'
+
+          const detailIdx = Object.keys(data)
+            .filter(k => k.startsWith('details['))
+            .map(k => parseInt(k.match(/details\[(\d+)\]/)[1]))
+            .reduce((a, b) => Math.max(a, b), -1) + 1
+
+          data[`details[${detailIdx}].key`] = copyTemplatesKey
+          data[`details[${detailIdx}].value`] =
+            values.copyTemplatesFromOtherSecondaryStorages.toString()
+        }
+
         this.loading = true
 
         try {
diff --git a/ui/src/views/infra/zone/ZoneWizardAddResources.vue b/ui/src/views/infra/zone/ZoneWizardAddResources.vue
index 4bd602f0acaa..298cc7fec9da 100644
--- a/ui/src/views/infra/zone/ZoneWizardAddResources.vue
+++ b/ui/src/views/infra/zone/ZoneWizardAddResources.vue
@@ -840,6 +840,13 @@ export default {
           display: {
             secondaryStorageProvider: ['Swift']
           }
+        },
+        {
+          title: 'label.copy.templates.from.other.secondary.storages.add.zone',
+          key: 'copyTemplatesFromOtherSecondaryStorages',
+          required: false,
+          switch: true,
+          checked: this.copytemplate
         }
       ]
     }
@@ -860,7 +867,8 @@ export default {
       }],
       storageProviders: [],
       currentStep: null,
-      options: ['primaryStorageScope', 'primaryStorageProtocol', 'provider', 'primaryStorageProvider']
+      options: ['primaryStorageScope', 'primaryStorageProtocol', 'provider', 'primaryStorageProvider'],
+      copytemplate: true
     }
   },
   created () {
@@ -885,6 +893,7 @@ export default {
           primaryStorageScope: null
         })
       }
+      this.applyCopyTemplatesOptionFromGlobalSettingDuringSecondaryStorageAddition()
     }
   },
   watch: {
@@ -1108,6 +1117,20 @@ export default {
         this.storageProviders = storageProviders
       })
     },
+    applyCopyTemplatesOptionFromGlobalSettingDuringSecondaryStorageAddition () {
+      api('listConfigurations', {
+        name: 'copy.templates.from.other.secondary.storages'
+      }).then(json => {
+        const config = json?.listconfigurationsresponse?.configuration?.[0]
+
+        if (!config || config.value === undefined) {
+          return
+        }
+
+        const value = String(config.value).toLowerCase() === 'true'
+        this.copytemplate = value
+      })
+    },
     fetchPrimaryStorageProvider () {
       this.primaryStorageProviders = []
       api('listStorageProviders', { type: 'primary' }).then(json => {
diff --git a/ui/src/views/infra/zone/ZoneWizardLaunchZone.vue b/ui/src/views/infra/zone/ZoneWizardLaunchZone.vue
index a787ad839cdb..fbf5e6f5c204 100644
--- a/ui/src/views/infra/zone/ZoneWizardLaunchZone.vue
+++ b/ui/src/views/infra/zone/ZoneWizardLaunchZone.vue
@@ -1580,6 +1580,11 @@ export default {
         params.provider = this.prefillContent.secondaryStorageProvider
         params.zoneid = this.stepData.zoneReturned.id
         params.url = url
+        if (this.prefillContent.copyTemplatesFromOtherSecondaryStorages !== undefined) {
+          params['details[0].key'] = 'copytemplatesfromothersecondarystorages'
+          params['details[0].value'] =
+            this.prefillContent.copyTemplatesFromOtherSecondaryStorages
+        }
       } else if (this.prefillContent.secondaryStorageProvider === 'SMB') {
         const nfsServer = this.prefillContent.secondaryStorageServer
         const path = this.prefillContent.secondaryStoragePath

From ff7ec0cd229fc829f3f978e3573366cd20fec5f2 Mon Sep 17 00:00:00 2001
From: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
Date: Wed, 28 Jan 2026 16:15:48 +0530
Subject: [PATCH 061/117] Update alert id for VR public and private interface
 (#12527)

---
 .../main/java/org/apache/cloudstack/alert/AlertService.java  | 4 ++--
 .../src/main/java/com/cloud/alert/AlertManager.java          | 1 -
 .../src/main/resources/META-INF/db/schema-42020to42030.sql   | 3 +++
 server/src/main/java/com/cloud/event/AlertGenerator.java     | 5 +++--
 4 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/api/src/main/java/org/apache/cloudstack/alert/AlertService.java b/api/src/main/java/org/apache/cloudstack/alert/AlertService.java
index 1250284b5c27..4ae6288efce4 100644
--- a/api/src/main/java/org/apache/cloudstack/alert/AlertService.java
+++ b/api/src/main/java/org/apache/cloudstack/alert/AlertService.java
@@ -71,8 +71,8 @@ private AlertType(short type, String name, boolean isDefault) {
         public static final AlertType ALERT_TYPE_HA_ACTION = new AlertType((short)30, "ALERT.HA.ACTION", true);
         public static final AlertType ALERT_TYPE_CA_CERT = new AlertType((short)31, "ALERT.CA.CERT", true);
         public static final AlertType ALERT_TYPE_VM_SNAPSHOT = new AlertType((short)32, "ALERT.VM.SNAPSHOT", true);
-        public static final AlertType ALERT_TYPE_VR_PUBLIC_IFACE_MTU = new AlertType((short)32, "ALERT.VR.PUBLIC.IFACE.MTU", true);
-        public static final AlertType ALERT_TYPE_VR_PRIVATE_IFACE_MTU = new AlertType((short)32, "ALERT.VR.PRIVATE.IFACE.MTU", true);
+        public static final AlertType ALERT_TYPE_VR_PUBLIC_IFACE_MTU = new AlertType((short)33, "ALERT.VR.PUBLIC.IFACE.MTU", true);
+        public static final AlertType ALERT_TYPE_VR_PRIVATE_IFACE_MTU = new AlertType((short)34, "ALERT.VR.PRIVATE.IFACE.MTU", true);
 
         public short getType() {
             return type;
diff --git a/engine/components-api/src/main/java/com/cloud/alert/AlertManager.java b/engine/components-api/src/main/java/com/cloud/alert/AlertManager.java
index 3d4e6579f7ca..7fe19c3ba9f8 100644
--- a/engine/components-api/src/main/java/com/cloud/alert/AlertManager.java
+++ b/engine/components-api/src/main/java/com/cloud/alert/AlertManager.java
@@ -54,5 +54,4 @@ public interface AlertManager extends Manager, AlertService {
     void recalculateCapacity();
 
     void sendAlert(AlertType alertType, long dataCenterId, Long podId, String subject, String body);
-
 }
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42020to42030.sql b/engine/schema/src/main/resources/META-INF/db/schema-42020to42030.sql
index 598fdb7adc46..567e623564ea 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-42020to42030.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42020to42030.sql
@@ -20,3 +20,6 @@
 --;
 
 ALTER TABLE `cloud`.`template_store_ref` MODIFY COLUMN `download_url` varchar(2048);
+
+UPDATE `cloud`.`alert` SET type = 33 WHERE name = 'ALERT.VR.PUBLIC.IFACE.MTU';
+UPDATE `cloud`.`alert` SET type = 34 WHERE name = 'ALERT.VR.PRIVATE.IFACE.MTU';
diff --git a/server/src/main/java/com/cloud/event/AlertGenerator.java b/server/src/main/java/com/cloud/event/AlertGenerator.java
index f1b23e873082..601bf5e831a4 100644
--- a/server/src/main/java/com/cloud/event/AlertGenerator.java
+++ b/server/src/main/java/com/cloud/event/AlertGenerator.java
@@ -67,12 +67,13 @@ void init() {
     }
 
     public static void publishAlertOnEventBus(String alertType, long dataCenterId, Long podId, String subject, String body) {
-
         String configKey = Config.PublishAlertEvent.key();
         String value = s_configDao.getValue(configKey);
         boolean configValue = Boolean.parseBoolean(value);
-        if(!configValue)
+        if (!configValue) {
             return;
+        }
+
         try {
             eventDistributor = ComponentContext.getComponent(EventDistributor.class);
         } catch (NoSuchBeanDefinitionException nbe) {

From 83ce0067b82bc39c7c91667c6ac4d2dd144ce450 Mon Sep 17 00:00:00 2001
From: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
Date: Wed, 28 Jan 2026 16:37:57 +0530
Subject: [PATCH 062/117] Update the snapshot physical size for the primary
 storage resource after snapshot creation and during resource count
 recalculation (#12481)

* Update snapshot size for the primary storage resource after snapshot creation and during resource count recalculation

* Update snapshot physical size

* review

* review
---
 .../user/snapshot/CreateSnapshotCmd.java      |  3 +-
 .../datastore/db/SnapshotDataStoreDao.java    | 14 +++++++++
 .../db/SnapshotDataStoreDaoImpl.java          | 29 +++++++++++++++++-
 .../ResourceLimitManagerImpl.java             | 10 +++----
 .../storage/snapshot/SnapshotManagerImpl.java | 30 +++++++++++--------
 .../ResourceLimitManagerImplTest.java         | 10 +++++--
 6 files changed, 73 insertions(+), 23 deletions(-)

diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/snapshot/CreateSnapshotCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/snapshot/CreateSnapshotCmd.java
index bd541b691838..078d4517f95e 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/snapshot/CreateSnapshotCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/snapshot/CreateSnapshotCmd.java
@@ -244,8 +244,7 @@ public void execute() {
     }
 
     private Snapshot.LocationType getLocationType() {
-
-        if (Snapshot.LocationType.values() == null || Snapshot.LocationType.values().length == 0 || locationType == null) {
+        if (locationType == null) {
             return null;
         }
 
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/SnapshotDataStoreDao.java b/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/SnapshotDataStoreDao.java
index ef0a5d0ebff0..96df49287736 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/SnapshotDataStoreDao.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/SnapshotDataStoreDao.java
@@ -110,4 +110,18 @@ public interface SnapshotDataStoreDao extends GenericDao<SnapshotDataStoreVO, Lo
     void updateDisplayForSnapshotStoreRole(long snapshotId, long storeId, DataStoreRole role, boolean display);
 
     int expungeBySnapshotList(List<Long> snapshotIds, Long batchSize);
+
+    /**
+     * Returns the total physical size, in bytes, of all snapshots stored on primary
+     * storage for the specified account that have not yet been backed up to
+     * secondary storage.
+     *
+     * <p>If no such snapshots are found, this method returns {@code 0}.</p>
+     *
+     * @param accountId the ID of the account whose snapshots on primary storage
+     *                  should be considered
+     * @return the total physical size in bytes of matching snapshots on primary
+     *         storage, or {@code 0} if none are found
+     */
+    long getSnapshotsPhysicalSizeOnPrimaryStorageByAccountId(long accountId);
 }
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/SnapshotDataStoreDaoImpl.java b/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/SnapshotDataStoreDaoImpl.java
index ba76a6b3f411..c68316dd1feb 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/SnapshotDataStoreDaoImpl.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/SnapshotDataStoreDaoImpl.java
@@ -78,6 +78,15 @@ public class SnapshotDataStoreDaoImpl extends GenericDaoBase<SnapshotDataStoreVO
             " order by created %s " +
             " limit 1";
 
+    private static final String GET_PHYSICAL_SIZE_OF_SNAPSHOTS_ON_PRIMARY_BY_ACCOUNT = "SELECT SUM(s.physical_size) " +
+            "FROM cloud.snapshot_store_ref s " +
+            "LEFT JOIN cloud.snapshots ON s.snapshot_id = snapshots.id " +
+            "WHERE snapshots.account_id = ? " +
+            "AND snapshots.removed IS NULL " +
+            "AND s.state = 'Ready' " +
+            "AND s.store_role = 'Primary' " +
+            "AND NOT EXISTS (SELECT 1 FROM cloud.snapshot_store_ref i WHERE i.snapshot_id = s.snapshot_id AND i.store_role = 'Image')";
+
     @Override
     public boolean configure(String name, Map<String, Object> params) throws ConfigurationException {
         super.configure(name, params);
@@ -118,7 +127,6 @@ public boolean configure(String name, Map<String, Object> params) throws Configu
         stateSearch.and(STATE, stateSearch.entity().getState(), SearchCriteria.Op.IN);
         stateSearch.done();
 
-
         idStateNeqSearch = createSearchBuilder();
         idStateNeqSearch.and(SNAPSHOT_ID, idStateNeqSearch.entity().getSnapshotId(), SearchCriteria.Op.EQ);
         idStateNeqSearch.and(STATE, idStateNeqSearch.entity().getState(), SearchCriteria.Op.NEQ);
@@ -578,4 +586,23 @@ public int expungeBySnapshotList(final List<Long> snapshotIds, final Long batchS
         sc.setParameters("snapshotIds", snapshotIds.toArray());
         return batchExpunge(sc, batchSize);
     }
+
+    @Override
+    public long getSnapshotsPhysicalSizeOnPrimaryStorageByAccountId(long accountId) {
+        long snapshotsPhysicalSize = 0;
+        try (TransactionLegacy transactionLegacy = TransactionLegacy.currentTxn()) {
+            try (PreparedStatement preparedStatement = transactionLegacy.prepareStatement(GET_PHYSICAL_SIZE_OF_SNAPSHOTS_ON_PRIMARY_BY_ACCOUNT)) {
+                preparedStatement.setLong(1, accountId);
+
+                try (ResultSet resultSet = preparedStatement.executeQuery()) {
+                    if (resultSet.next()) {
+                        snapshotsPhysicalSize = resultSet.getLong(1);
+                    }
+                }
+            }
+        } catch (SQLException e) {
+            logger.warn("Failed to get the snapshots physical size for the account [{}] due to [{}].", accountId, e.getMessage(), e);
+        }
+        return snapshotsPhysicalSize;
+    }
 }
diff --git a/server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java b/server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java
index b890b72f7589..d4d91b6de7bc 100644
--- a/server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java
+++ b/server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java
@@ -1171,7 +1171,6 @@ protected long recalculateDomainResourceCount(final long domainId, final Resourc
         }
 
         return Transaction.execute((TransactionCallback<Long>) status -> {
-            long newResourceCount = 0L;
             List<Long> domainIdList = childDomains.stream().map(DomainVO::getId).collect(Collectors.toList());
             domainIdList.add(domainId);
             List<Long> accountIdList = accounts.stream().map(AccountVO::getId).collect(Collectors.toList());
@@ -1189,6 +1188,7 @@ protected long recalculateDomainResourceCount(final long domainId, final Resourc
             List<ResourceCountVO> resourceCounts = _resourceCountDao.lockRows(rowIdsToLock);
 
             long oldResourceCount = 0L;
+            long newResourceCount = 0L;
             ResourceCountVO domainRC = null;
 
             // calculate project count here
@@ -1210,7 +1210,7 @@ protected long recalculateDomainResourceCount(final long domainId, final Resourc
             if (oldResourceCount != newResourceCount) {
                 domainRC.setCount(newResourceCount);
                 _resourceCountDao.update(domainRC.getId(), domainRC);
-                logger.warn("Discrepency in the resource count has been detected (original count = {} correct count = {}) for Type = {} for Domain ID = {} is fixed during resource count recalculation.",
+                logger.warn("Discrepancy in the resource count has been detected (original count = {} correct count = {}) for Type = {} for Domain ID = {} is fixed during resource count recalculation.",
                         oldResourceCount, newResourceCount, type, domainId);
             }
             return newResourceCount;
@@ -1436,16 +1436,17 @@ private long calculatePublicIpForAccount(long accountId) {
     }
 
     protected long calculatePrimaryStorageForAccount(long accountId, String tag) {
+        long snapshotsPhysicalSizeOnPrimaryStorage = _snapshotDataStoreDao.getSnapshotsPhysicalSizeOnPrimaryStorageByAccountId(accountId);
         if (StringUtils.isEmpty(tag)) {
             List<Long> virtualRouters = _vmDao.findIdsOfAllocatedVirtualRoutersForAccount(accountId);
-            return _volumeDao.primaryStorageUsedForAccount(accountId, virtualRouters);
+            return snapshotsPhysicalSizeOnPrimaryStorage + _volumeDao.primaryStorageUsedForAccount(accountId, virtualRouters);
         }
         long storage = 0;
         List<VolumeVO> volumes = getVolumesWithAccountAndTag(accountId, tag);
         for (VolumeVO volume : volumes) {
             storage += volume.getSize() == null ? 0L : volume.getSize();
         }
-        return storage;
+        return snapshotsPhysicalSizeOnPrimaryStorage + storage;
     }
 
     @Override
@@ -2143,7 +2144,6 @@ public ConfigKey<?>[] getConfigKeys() {
 
     protected class ResourceCountCheckTask extends ManagedContextRunnable {
         public ResourceCountCheckTask() {
-
         }
 
         @Override
diff --git a/server/src/main/java/com/cloud/storage/snapshot/SnapshotManagerImpl.java b/server/src/main/java/com/cloud/storage/snapshot/SnapshotManagerImpl.java
index e7606572a07c..19cde4da0f17 100755
--- a/server/src/main/java/com/cloud/storage/snapshot/SnapshotManagerImpl.java
+++ b/server/src/main/java/com/cloud/storage/snapshot/SnapshotManagerImpl.java
@@ -276,6 +276,15 @@ protected boolean isBackupSnapshotToSecondaryForZone(long zoneId) {
         return !DataCenter.Type.Edge.equals(zone.getType());
     }
 
+    private ResourceType getStoreResourceType(long dataCenterId, Snapshot.LocationType locationType) {
+        ResourceType storeResourceType = ResourceType.secondary_storage;
+        if (!isBackupSnapshotToSecondaryForZone(dataCenterId) ||
+                Snapshot.LocationType.PRIMARY.equals(locationType)) {
+            storeResourceType = ResourceType.primary_storage;
+        }
+        return storeResourceType;
+    }
+
     @Override
     public String getConfigComponentName() {
         return SnapshotManager.class.getSimpleName();
@@ -614,7 +623,7 @@ public Snapshot backupSnapshotFromVmSnapshot(Long snapshotId, Long vmId, Long vo
         _snapshotDao.update(snapshot.getId(), snapshot);
         snapshotInfo = this.snapshotFactory.getSnapshot(snapshotId, store);
 
-        Long snapshotOwnerId = vm.getAccountId();
+        long snapshotOwnerId = vm.getAccountId();
 
         try {
             SnapshotStrategy snapshotStrategy = _storageStrategyFactory.getSnapshotStrategy(snapshot, SnapshotOperation.BACKUP);
@@ -622,7 +631,6 @@ public Snapshot backupSnapshotFromVmSnapshot(Long snapshotId, Long vmId, Long vo
                 throw new CloudRuntimeException(String.format("Unable to find Snapshot strategy to handle Snapshot [%s]", snapshot));
             }
             snapshotInfo = snapshotStrategy.backupSnapshot(snapshotInfo);
-
         } catch (Exception e) {
             logger.debug("Failed to backup Snapshot from Instance Snapshot", e);
             _resourceLimitMgr.decrementResourceCount(snapshotOwnerId, ResourceType.snapshot);
@@ -771,12 +779,11 @@ public boolean deleteSnapshot(long snapshotId, Long zoneId) {
         _accountMgr.checkAccess(caller, null, true, snapshotCheck);
 
         SnapshotStrategy snapshotStrategy = _storageStrategyFactory.getSnapshotStrategy(snapshotCheck, zoneId, SnapshotOperation.DELETE);
-
         if (snapshotStrategy == null) {
             logger.error("Unable to find snapshot strategy to handle snapshot [{}]", snapshotCheck);
-
             return false;
         }
+
         Pair<List<SnapshotDataStoreVO>, List<Long>> storeRefAndZones = getStoreRefsAndZonesForSnapshotDelete(snapshotId, zoneId);
         List<SnapshotDataStoreVO> snapshotStoreRefs = storeRefAndZones.first();
         List<Long> zoneIds = storeRefAndZones.second();
@@ -1472,8 +1479,9 @@ public SnapshotInfo takeSnapshot(VolumeInfo volume) throws ResourceAllocationExc
                 UsageEventUtils.publishUsageEvent(EventTypes.EVENT_SNAPSHOT_CREATE, snapshot.getAccountId(), snapshot.getDataCenterId(), snapshotId, snapshot.getName(), null, null,
                         snapshotStoreRef.getPhysicalSize(), volume.getSize(), snapshot.getClass().getName(), snapshot.getUuid());
 
+                ResourceType storeResourceType = dataStoreRole == DataStoreRole.Image ? ResourceType.secondary_storage : ResourceType.primary_storage;
                 // Correct the resource count of snapshot in case of delta snapshots.
-                _resourceLimitMgr.decrementResourceCount(snapshotOwner.getId(), ResourceType.secondary_storage, new Long(volume.getSize() - snapshotStoreRef.getPhysicalSize()));
+                _resourceLimitMgr.decrementResourceCount(snapshotOwner.getId(), storeResourceType, new Long(volume.getSize() - snapshotStoreRef.getPhysicalSize()));
 
                 if (!payload.getAsyncBackup() && backupSnapToSecondary) {
                     copyNewSnapshotToZones(snapshotId, snapshot.getDataCenterId(), payload.getZoneIds());
@@ -1485,15 +1493,17 @@ public SnapshotInfo takeSnapshot(VolumeInfo volume) throws ResourceAllocationExc
             if (logger.isDebugEnabled()) {
                 logger.debug("Failed to create snapshot" + cre.getLocalizedMessage());
             }
+            ResourceType storeResourceType = getStoreResourceType(volume.getDataCenterId(), payload.getLocationType());
             _resourceLimitMgr.decrementResourceCount(snapshotOwner.getId(), ResourceType.snapshot);
-            _resourceLimitMgr.decrementResourceCount(snapshotOwner.getId(), ResourceType.secondary_storage, new Long(volume.getSize()));
+            _resourceLimitMgr.decrementResourceCount(snapshotOwner.getId(), storeResourceType, new Long(volume.getSize()));
             throw cre;
         } catch (Exception e) {
             if (logger.isDebugEnabled()) {
                 logger.debug("Failed to create snapshot", e);
             }
+            ResourceType storeResourceType = getStoreResourceType(volume.getDataCenterId(), payload.getLocationType());
             _resourceLimitMgr.decrementResourceCount(snapshotOwner.getId(), ResourceType.snapshot);
-            _resourceLimitMgr.decrementResourceCount(snapshotOwner.getId(), ResourceType.secondary_storage, new Long(volume.getSize()));
+            _resourceLimitMgr.decrementResourceCount(snapshotOwner.getId(), storeResourceType, new Long(volume.getSize()));
             throw new CloudRuntimeException("Failed to create snapshot", e);
         }
         return snapshot;
@@ -1695,11 +1705,7 @@ public Snapshot allocSnapshot(Long volumeId, Long policyId, String snapshotName,
         Type snapshotType = getSnapshotType(policyId);
         Account owner = _accountMgr.getAccount(volume.getAccountId());
 
-        ResourceType storeResourceType = ResourceType.secondary_storage;
-        if (!isBackupSnapshotToSecondaryForZone(volume.getDataCenterId()) ||
-                Snapshot.LocationType.PRIMARY.equals(locationType)) {
-            storeResourceType = ResourceType.primary_storage;
-        }
+        ResourceType storeResourceType = getStoreResourceType(volume.getDataCenterId(), locationType);
         try {
             _resourceLimitMgr.checkResourceLimit(owner, ResourceType.snapshot);
             _resourceLimitMgr.checkResourceLimit(owner, storeResourceType, volume.getSize());
diff --git a/server/src/test/java/com/cloud/resourcelimit/ResourceLimitManagerImplTest.java b/server/src/test/java/com/cloud/resourcelimit/ResourceLimitManagerImplTest.java
index 34030626d22e..53ccc830dd2d 100644
--- a/server/src/test/java/com/cloud/resourcelimit/ResourceLimitManagerImplTest.java
+++ b/server/src/test/java/com/cloud/resourcelimit/ResourceLimitManagerImplTest.java
@@ -28,6 +28,7 @@
 import org.apache.cloudstack.api.response.TaggedResourceLimitAndCountResponse;
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.reservation.dao.ReservationDao;
+import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreDao;
 import org.apache.commons.collections.CollectionUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.apache.logging.log4j.LogManager;
@@ -118,6 +119,8 @@ public class ResourceLimitManagerImplTest extends TestCase {
     VolumeDao volumeDao;
     @Mock
     UserVmDao userVmDao;
+    @Mock
+    SnapshotDataStoreDao snapshotDataStoreDao;
 
     private List<String> hostTags = List.of("htag1", "htag2", "htag3");
     private List<String> storageTags = List.of("stag1", "stag2");
@@ -840,12 +843,13 @@ public void testCalculatePrimaryStorageForAccount() {
         String tag = null;
         Mockito.when(vmDao.findIdsOfAllocatedVirtualRoutersForAccount(accountId))
                 .thenReturn(List.of(1L));
+        Mockito.when(snapshotDataStoreDao.getSnapshotsPhysicalSizeOnPrimaryStorageByAccountId(accountId)).thenReturn(100L);
         Mockito.when(volumeDao.primaryStorageUsedForAccount(Mockito.eq(accountId), Mockito.anyList())).thenReturn(100L);
-        Assert.assertEquals(100L, resourceLimitManager.calculatePrimaryStorageForAccount(accountId, tag));
+        Assert.assertEquals(200L, resourceLimitManager.calculatePrimaryStorageForAccount(accountId, tag));
 
         tag = "";
         Mockito.when(volumeDao.primaryStorageUsedForAccount(Mockito.eq(accountId), Mockito.anyList())).thenReturn(200L);
-        Assert.assertEquals(200L, resourceLimitManager.calculatePrimaryStorageForAccount(accountId, tag));
+        Assert.assertEquals(300L, resourceLimitManager.calculatePrimaryStorageForAccount(accountId, tag));
 
         tag = "tag";
         VolumeVO vol = Mockito.mock(VolumeVO.class);
@@ -853,7 +857,7 @@ public void testCalculatePrimaryStorageForAccount() {
         Mockito.when(vol.getSize()).thenReturn(size);
         List<VolumeVO> vols = List.of(vol, vol);
         Mockito.doReturn(vols).when(resourceLimitManager).getVolumesWithAccountAndTag(accountId, tag);
-        Assert.assertEquals(vols.size() * size, resourceLimitManager.calculatePrimaryStorageForAccount(accountId, tag));
+        Assert.assertEquals((vols.size() * size) + 100L, resourceLimitManager.calculatePrimaryStorageForAccount(accountId, tag));
     }
 
     @Test

From 38e30a116c1c7b7011582e4b6c14f541e5be651b Mon Sep 17 00:00:00 2001
From: Pearl Dsilva <pearl1594@gmail.com>
Date: Wed, 28 Jan 2026 06:12:32 -0500
Subject: [PATCH 063/117] Add support for vTPM for XenServer and XCP-ng 8.3/8.4
 (#12263)

* XenServer 8.4/XCP-ng 8.3: Support vTPM

* fix issue

* add log for windows 11 or other such guests OSs that require vtpm

* remove secure bootmode requirement

* Fix uefi setting on host for xenserver 8.4
---
 .../resource/CitrixResourceBase.java          | 79 +++++++++++++++++++
 .../xenbase/CitrixReadyCommandWrapper.java    | 10 ++-
 .../xenbase/CitrixStartCommandWrapper.java    |  8 ++
 .../vm/hypervisor/xenserver/xenserver84/vmops | 40 +++++++++-
 .../com/cloud/api/query/QueryManagerImpl.java |  4 +
 5 files changed, 139 insertions(+), 2 deletions(-)

diff --git a/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/CitrixResourceBase.java b/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/CitrixResourceBase.java
index 063a5a18ca23..cdb4d7434aef 100644
--- a/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/CitrixResourceBase.java
+++ b/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/CitrixResourceBase.java
@@ -51,6 +51,7 @@
 import javax.naming.ConfigurationException;
 import javax.xml.parsers.ParserConfigurationException;
 
+import com.xensource.xenapi.VTPM;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.diagnostics.CopyToSecondaryStorageAnswer;
 import org.apache.cloudstack.diagnostics.CopyToSecondaryStorageCommand;
@@ -5826,4 +5827,82 @@ public void destroyVm(VM vm, Connection connection, boolean forced) throws XenAP
     public void destroyVm(VM vm, Connection connection) throws XenAPIException, XmlRpcException {
         destroyVm(vm, connection, false);
     }
+
+    /**
+     * Configure vTPM (Virtual Trusted Platform Module) support for a VM.
+     * vTPM provides a virtual TPM 2.0 device for VMs, enabling features like Secure Boot and disk encryption.
+     *
+     * Requirements:
+     * - XenServer/XCP-ng 8.3 (and above)
+     * - UEFI Secure Boot enabled
+     * - VM in halted state
+     *
+     * @param conn XenServer connection
+     * @param vm The VM to configure
+     * @param vmSpec VM specification containing vTPM settings
+     */
+    public void configureVTPM(Connection conn, VM vm, VirtualMachineTO vmSpec) throws XenAPIException, XmlRpcException {
+        if (vmSpec == null || vmSpec.getDetails() == null) {
+            return;
+        }
+
+        String vtpmEnabled = vmSpec.getDetails().getOrDefault(VmDetailConstants.VIRTUAL_TPM_ENABLED, null);
+
+        final Map<String, String> platform = vm.getPlatform(conn);
+        if (platform != null) {
+            final String guestRequiresVtpm = platform.get("vtpm");
+            if (guestRequiresVtpm != null && Boolean.parseBoolean(guestRequiresVtpm) && !Boolean.parseBoolean(vtpmEnabled)) {
+                logger.warn("Guest OS requires vTPM by default, even if VM details doesn't have the setting: {}", vmSpec.getName());
+                return;
+            }
+        }
+
+        if (!Boolean.parseBoolean(vtpmEnabled)) {
+            return;
+        }
+
+        String bootMode = StringUtils.defaultIfEmpty(vmSpec.getDetails().get(ApiConstants.BootType.UEFI.toString()), null);
+        String bootType = (bootMode == null) ? ApiConstants.BootType.BIOS.toString() : ApiConstants.BootType.UEFI.toString();
+
+        if (!ApiConstants.BootType.UEFI.toString().equals(bootType)) {
+            logger.warn("vTPM requires UEFI boot mode. Skipping vTPM configuration for VM: {}", vmSpec.getName());
+            return;
+        }
+
+        try {
+            Set<VTPM> existingVtpms = vm.getVTPMs(conn);
+            if (!existingVtpms.isEmpty()) {
+                logger.debug("vTPM already exists for VM: {}", vmSpec.getName());
+                return;
+            }
+
+            // Creates vTPM using: xe vtpm-create vm-uuid=<uuid>
+            String vmUuid = vm.getUuid(conn);
+            String result = callHostPlugin(conn, "vmops", "create_vtpm", "vm_uuid", vmUuid);
+
+            if (result == null || result.isEmpty() || result.startsWith("ERROR:") || result.startsWith("EXCEPTION:")) {
+                throw new CloudRuntimeException("Failed to create vTPM, result: " + result);
+            }
+
+            logger.info("Successfully created vTPM {} for VM: {}", result.trim(), vmSpec.getName());
+        } catch (Exception e) {
+            logger.warn("Failed to configure vTPM for VM: {}, continuing without vTPM", vmSpec.getName(), e);
+        }
+    }
+
+    public boolean isVTPMSupported(Connection conn, Host host) {
+        try {
+            Host.Record hostRecord = host.getRecord(conn);
+            String productVersion = hostRecord.softwareVersion.get("product_version");
+            if (productVersion == null) {
+                return false;
+            }
+            ComparableVersion currentVersion = new ComparableVersion(productVersion);
+            ComparableVersion minVersion = new ComparableVersion("8.2.0");
+            return currentVersion.compareTo(minVersion) >= 0;
+        } catch (Exception e) {
+            logger.warn("Failed to check vTPM support on host", e);
+            return false;
+        }
+    }
 }
diff --git a/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixReadyCommandWrapper.java b/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixReadyCommandWrapper.java
index c5605e85f947..4f55ae82337b 100644
--- a/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixReadyCommandWrapper.java
+++ b/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixReadyCommandWrapper.java
@@ -60,12 +60,20 @@ public Answer execute(final ReadyCommand command, final CitrixResourceBase citri
             final Set<VM> vms = host.getResidentVMs(conn);
             citrixResourceBase.destroyPatchVbd(conn, vms);
 
+        } catch (final Exception e) {
+            logger.warn("Unable to destroy CD-ROM device for system VMs", e);
+        }
+
+        try {
+            final Host host = Host.getByUuid(conn, citrixResourceBase.getHost().getUuid());
             final Host.Record hr = host.getRecord(conn);
             if (isUefiSupported(CitrixHelper.getProductVersion(hr))) {
                 hostDetails.put(com.cloud.host.Host.HOST_UEFI_ENABLE, Boolean.TRUE.toString());
             }
-        } catch (final Exception e) {
+        } catch (Exception e) {
+            logger.warn("Unable to get UEFI support info", e);
         }
+
         try {
             final boolean result = citrixResourceBase.cleanupHaltedVms(conn);
             if (!result) {
diff --git a/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixStartCommandWrapper.java b/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixStartCommandWrapper.java
index d448638f028d..5c2355a4cec3 100644
--- a/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixStartCommandWrapper.java
+++ b/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixStartCommandWrapper.java
@@ -97,6 +97,14 @@ public Answer execute(final StartCommand command, final CitrixResourceBase citri
                 citrixResourceBase.createVGPU(conn, command, vm, gpuDevice);
             }
 
+            try {
+                if (citrixResourceBase.isVTPMSupported(conn, host)) {
+                    citrixResourceBase.configureVTPM(conn, vm, vmSpec);
+                }
+            } catch (Exception e) {
+                logger.warn("Failed to configure vTPM for VM " + vmName + ", continuing without vTPM", e);
+            }
+
             Host.Record record = host.getRecord(conn);
             String xenBrand = record.softwareVersion.get("product_brand");
             String xenVersion = record.softwareVersion.get("product_version");
diff --git a/scripts/vm/hypervisor/xenserver/xenserver84/vmops b/scripts/vm/hypervisor/xenserver/xenserver84/vmops
index cf6e6325d688..76d4571ef181 100755
--- a/scripts/vm/hypervisor/xenserver/xenserver84/vmops
+++ b/scripts/vm/hypervisor/xenserver/xenserver84/vmops
@@ -1587,6 +1587,43 @@ def network_rules(session, args):
     except:
         logging.exception("Failed to network rule!")
 
+@echo
+def create_vtpm(session, args):
+    util.SMlog("create_vtpm called with args: %s" % str(args))
+
+    try:
+        vm_uuid = args.get('vm_uuid')
+        if not vm_uuid:
+            return "ERROR: vm_uuid parameter is required"
+
+        # Check if vTPM already exists for this VM
+        cmd = ['xe', 'vtpm-list', 'vm-uuid=' + vm_uuid, '--minimal']
+        result = util.pread2(cmd)
+        existing_vtpms = result.strip()
+
+        if existing_vtpms:
+            util.SMlog("vTPM already exists for VM %s: %s" % (vm_uuid, existing_vtpms))
+            return existing_vtpms.split(',')[0]
+
+        cmd = ['xe', 'vtpm-create', 'vm-uuid=' + vm_uuid]
+        result = util.pread2(cmd)
+        vtpm_uuid = result.strip()
+
+        if vtpm_uuid:
+            util.SMlog("Successfully created vTPM %s for VM %s" % (vtpm_uuid, vm_uuid))
+            return vtpm_uuid
+        else:
+            return "ERROR: Failed to create vTPM, empty result"
+
+    except CommandException as e:
+        error_msg = "xe command failed: %s" % str(e)
+        util.SMlog("ERROR: %s" % error_msg)
+        return "ERROR: " + error_msg
+    except Exception as e:
+        error_msg = str(e)
+        util.SMlog("ERROR: %s" % error_msg)
+        return "ERROR: " + error_msg
+
 if __name__ == "__main__":
     XenAPIPlugin.dispatch({"pingtest": pingtest, "setup_iscsi":setup_iscsi,
                            "preparemigration": preparemigration,
@@ -1604,4 +1641,5 @@ if __name__ == "__main__":
                            "createFileInDomr":createFileInDomr,
                            "kill_copy_process":kill_copy_process,
                            "secureCopyToHost":secureCopyToHost,
-                           "runPatchScriptInDomr": runPatchScriptInDomr})
+                           "runPatchScriptInDomr": runPatchScriptInDomr,
+                           "create_vtpm": create_vtpm})
diff --git a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
index 1361dbcdab04..6713a7dc07eb 100644
--- a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
+++ b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
@@ -5440,6 +5440,10 @@ private void fillVMOrTemplateDetailOptions(final Map<String, List<String>> optio
             options.put(VmDetailConstants.RAM_RESERVATION, Collections.emptyList());
             options.put(VmDetailConstants.VIRTUAL_TPM_ENABLED, Arrays.asList("true", "false"));
         }
+
+        if (HypervisorType.XenServer.equals(hypervisorType)) {
+            options.put(VmDetailConstants.VIRTUAL_TPM_ENABLED, Arrays.asList("true", "false"));
+        }
     }
 
     @Override

From 8c2ba2b34119f570bdedee750b5aa762a634a3a5 Mon Sep 17 00:00:00 2001
From: Rohit Yadav <rohit.yadav@shapeblue.com>
Date: Wed, 28 Jan 2026 16:46:34 +0530
Subject: [PATCH 064/117] ui: bump nodejs v24 LTS usage (#12471)

---
 ui/README.md    | 6 +++---
 ui/package.json | 9 ++++++---
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/ui/README.md b/ui/README.md
index 170232b574e5..3f7bcb8120ea 100644
--- a/ui/README.md
+++ b/ui/README.md
@@ -27,18 +27,18 @@ A modern role-based progressive CloudStack UI based on Vue.js and Ant Design.
 
 Install node: (Debian/Ubuntu)
 
-    curl -sL https://deb.nodesource.com/setup_20.x | sudo -E bash -
+    curl -sL https://deb.nodesource.com/setup_24.x | sudo -E bash -
     sudo apt-get install -y nodejs
     # Or use distro provided: sudo apt-get install npm nodejs
 
 Install node: (CentOS/Fedora/RHEL)
 
-    curl -sL https://rpm.nodesource.com/setup_20.x | sudo bash -
+    curl -sL https://rpm.nodesource.com/setup_24.x | sudo bash -
     sudo yum install nodejs
 
 Install node: (Mac OS)
 
-    brew install node@20
+    brew install node@24
 
 Optionally, you may also install system-wide dev tools:
 
diff --git a/ui/package.json b/ui/package.json
index 48f337500bda..9801c1b18153 100644
--- a/ui/package.json
+++ b/ui/package.json
@@ -101,15 +101,18 @@
     "eslint-plugin-vue": "^7.0.0",
     "less": "^3.0.4",
     "less-loader": "^5.0.0",
+    "nan": "2.18.0",
+    "node-gyp": "10.0.1",
     "sass": "^1.49.9",
     "sass-loader": "^8.0.2",
     "uglifyjs-webpack-plugin": "^2.2.0",
     "vue-jest": "^5.0.0-0",
     "vue-svg-loader": "^0.17.0-beta.2",
-    "webpack": "^4.46.0",
-    "node-gyp": "10.0.1",  "nan": "2.18.0"
+    "webpack": "^4.46.0"
+  },
+  "resolutions": {
+    "nan": "2.18.0"
   },
-  "resolutions": { "nan": "2.18.0" },
   "eslintConfig": {
     "root": true,
     "env": {

From 35e6d7c5ba8f921c7611ab6c0c84d7b3db557456 Mon Sep 17 00:00:00 2001
From: Edward-x <30854794+YLChen-007@users.noreply.github.com>
Date: Wed, 28 Jan 2026 19:16:59 +0800
Subject: [PATCH 065/117] fix that log sensitive infomation in cmd of script
 (#12024)

* fix that log sensitive infomation in cmd of script

* Remove unnecessary line break in Script.java

* Update utils/src/main/java/com/cloud/utils/script/Script.java

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Refactor logging in Script class to simplify handling of sensitive arguments

* Improve command logging in Script class to include full command line when debugging

* Remove unused _passwordCommand flag from Script class to simplify code

* Update utils/src/main/java/com/cloud/utils/script/Script.java

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* Remove unused import for KeyStoreUtils

* Update utils/src/main/java/com/cloud/utils/script/Script.java

---------

Co-authored-by: chenyoulong20g@ict.ac.cn <chenyoulong20g@ict.ac.cn>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: dahn <daan@onecht.net>
Co-authored-by: dahn <daan.hoogland@gmail.com>
---
 ...bvirtUpdateHostPasswordCommandWrapper.java |  3 +-
 ...itrixUpdateHostPasswordCommandWrapper.java |  2 +-
 .../java/com/cloud/utils/script/Script.java   | 99 +++++++++++--------
 .../com/cloud/utils/script/ScriptTest.java    | 30 ++++++
 4 files changed, 93 insertions(+), 41 deletions(-)

diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtUpdateHostPasswordCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtUpdateHostPasswordCommandWrapper.java
index b8fe0ded7168..80c723b5a6e0 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtUpdateHostPasswordCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtUpdateHostPasswordCommandWrapper.java
@@ -37,7 +37,8 @@ public Answer execute(final UpdateHostPasswordCommand command, final LibvirtComp
         final String newPassword = command.getNewPassword();
 
         final Script script = libvirtUtilitiesHelper.buildScript(libvirtComputingResource.getUpdateHostPasswdPath());
-        script.add(username, newPassword);
+        script.add(username);
+        script.addSensitive(newPassword);
         final String result = script.execute();
 
         if (result != null) {
diff --git a/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixUpdateHostPasswordCommandWrapper.java b/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixUpdateHostPasswordCommandWrapper.java
index af868d8c1c70..e3ee0ca13cab 100644
--- a/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixUpdateHostPasswordCommandWrapper.java
+++ b/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixUpdateHostPasswordCommandWrapper.java
@@ -47,7 +47,7 @@ public Answer execute(final UpdateHostPasswordCommand command, final CitrixResou
         try {
             logger.debug("Executing password update command on host: {} for user: {}", hostIp, username);
             final String hostPassword = citrixResourceBase.getPwdFromQueue();
-            result = xenServerUtilitiesHelper.executeSshWrapper(hostIp, 22, username, null, hostPassword, cmdLine.toString());
+            result = xenServerUtilitiesHelper.executeSshWrapper(hostIp, 22, username, null, hostPassword, cmdLine);
         } catch (final Exception e) {
             return new Answer(command, false, e.getMessage());
         }
diff --git a/utils/src/main/java/com/cloud/utils/script/Script.java b/utils/src/main/java/com/cloud/utils/script/Script.java
index ffda782edda2..09c58dce9a87 100644
--- a/utils/src/main/java/com/cloud/utils/script/Script.java
+++ b/utils/src/main/java/com/cloud/utils/script/Script.java
@@ -30,8 +30,10 @@
 import java.net.URL;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Properties;
+import java.util.Set;
 import java.util.concurrent.Callable;
 import java.util.concurrent.ExecutionException;
 import java.util.concurrent.Executors;
@@ -43,7 +45,6 @@
 import java.util.concurrent.atomic.AtomicReference;
 import java.util.stream.Collectors;
 
-import org.apache.cloudstack.utils.security.KeyStoreUtils;
 import org.apache.commons.collections.CollectionUtils;
 import org.apache.commons.io.IOUtils;
 import org.apache.logging.log4j.LogManager;
@@ -66,8 +67,8 @@ public class Script implements Callable<String> {
     private static final int DEFAULT_TIMEOUT = 3600 * 1000; /* 1 hour */
     private volatile boolean _isTimeOut = false;
 
-    private boolean _passwordCommand = false;
     private boolean avoidLoggingCommand = false;
+    private final Set<Integer> sensitiveArgIndices = new HashSet<>();
 
     private static final ScheduledExecutorService s_executors = Executors.newScheduledThreadPool(10, new NamedThreadFactory("Script"));
 
@@ -145,6 +146,11 @@ public void add(String param) {
         _command.add(param);
     }
 
+    public void addSensitive(String param) {
+        _command.add(param);
+        sensitiveArgIndices.add(_command.size() - 1);
+    }
+
     public Script set(String name, String value) {
         _command.add(name);
         _command.add(value);
@@ -163,7 +169,7 @@ protected String buildCommandLine(String[] command) {
             if (sanitizeViCmdParameter(cmd, builder) || sanitizeRbdFileFormatCmdParameter(cmd, builder)) {
                 continue;
             }
-            if (obscureParam) {
+            if (obscureParam || sensitiveArgIndices.contains(i)) {
                 builder.append("******").append(" ");
                 obscureParam = false;
             } else {
@@ -172,7 +178,6 @@ protected String buildCommandLine(String[] command) {
 
             if ("-y".equals(cmd) || "-z".equals(cmd)) {
                 obscureParam = true;
-                _passwordCommand = true;
             }
         }
         return builder.toString();
@@ -240,8 +245,8 @@ static String stackTraceAsString(Throwable throwable) {
     public String execute(OutputInterpreter interpreter) {
         String[] command = _command.toArray(new String[_command.size()]);
         String commandLine = buildCommandLine(command);
-        if (_logger.isDebugEnabled() && !avoidLoggingCommand) {
-            _logger.debug(String.format("Executing command [%s].", commandLine.split(KeyStoreUtils.KS_FILENAME)[0]));
+        if (_logger.isDebugEnabled() ) {
+            _logger.debug(String.format("Executing command [%s].", commandLine));
         }
 
         try {
@@ -263,48 +268,62 @@ public String execute(OutputInterpreter interpreter) {
             _thread = Thread.currentThread();
             ScheduledFuture<String> future = null;
             if (_timeout > 0) {
-                _logger.trace(String.format("Scheduling the execution of command [%s] with a timeout of [%s] milliseconds.", commandLine, _timeout));
+                _logger.trace(String.format(
+                        "Scheduling the execution of command [%s] with a timeout of [%s] milliseconds.",
+                        commandLine, _timeout));
                 future = s_executors.schedule(this, _timeout, TimeUnit.MILLISECONDS);
             }
 
             long processPid = _process.pid();
             Task task = null;
             if (interpreter != null && interpreter.drain()) {
-                _logger.trace(String.format("Executing interpreting task of process [%s] for command [%s].", processPid, commandLine));
+                _logger.trace(String.format("Executing interpreting task of process [%s] for command [%s].",
+                        processPid, commandLine));
                 task = new Task(interpreter, ir);
                 s_executors.execute(task);
             }
 
             while (true) {
-                _logger.trace(String.format("Attempting process [%s] execution for command [%s] with timeout [%s].", processPid, commandLine, _timeout));
+                _logger.trace(String.format("Attempting process [%s] execution for command [%s] with timeout [%s].",
+                        processPid, commandLine, _timeout));
                 try {
                     if (_process.waitFor(_timeout, TimeUnit.MILLISECONDS)) {
-                        _logger.trace(String.format("Process [%s] execution for command [%s] completed within timeout period [%s].", processPid, commandLine,
+                        _logger.trace(String.format(
+                                "Process [%s] execution for command [%s] completed within timeout period [%s].",
+                                processPid, commandLine,
                                 _timeout));
                         if (_process.exitValue() == 0) {
-                            _logger.debug(String.format("Successfully executed process [%s] for command [%s].", processPid, commandLine));
+                            _logger.debug(String.format("Successfully executed process [%s] for command [%s].",
+                                    processPid, commandLine));
                             if (interpreter != null) {
                                 if (interpreter.drain()) {
-                                    _logger.trace(String.format("Returning task result of process [%s] for command [%s].", processPid, commandLine));
+                                    _logger.trace(
+                                            String.format("Returning task result of process [%s] for command [%s].",
+                                                    processPid, commandLine));
                                     return task.getResult();
                                 }
-                                _logger.trace(String.format("Returning interpretation of process [%s] for command [%s].", processPid, commandLine));
+                                _logger.trace(
+                                        String.format("Returning interpretation of process [%s] for command [%s].",
+                                                processPid, commandLine));
                                 return interpreter.interpret(ir);
                             } else {
                                 // null return exitValue apparently
-                                _logger.trace(String.format("Process [%s] for command [%s] exited with value [%s].", processPid, commandLine,
+                                _logger.trace(String.format("Process [%s] for command [%s] exited with value [%s].",
+                                        processPid, commandLine,
                                         _process.exitValue()));
                                 return String.valueOf(_process.exitValue());
                             }
                         } else {
-                            _logger.warn(String.format("Execution of process [%s] for command [%s] failed.", processPid, commandLine));
+                            _logger.warn(String.format("Execution of process [%s] for command [%s] failed.",
+                                    processPid, commandLine));
                             break;
                         }
                     }
                 } catch (InterruptedException e) {
                     if (!_isTimeOut) {
-                        _logger.debug(String.format("Exception [%s] occurred; however, it was not a timeout. Therefore, proceeding with the execution of process [%s] for command "
-                                + "[%s].", e.getMessage(), processPid, commandLine), e);
+                        _logger.debug(String.format(
+                                "Exception [%s] occurred; however, it was not a timeout. Therefore, proceeding with the execution of process [%s] for command [%s].",
+                                e.getMessage(), processPid, commandLine), e);
                         continue;
                     }
                 } finally {
@@ -317,18 +336,17 @@ public String execute(OutputInterpreter interpreter) {
                 TimedOutLogger log = new TimedOutLogger(_process);
                 Task timedoutTask = new Task(log, ir);
 
-                _logger.trace(String.format("Running timed out task of process [%s] for command [%s].", processPid, commandLine));
+                _logger.trace(String.format("Running timed out task of process [%s] for command [%s].", processPid,
+                        commandLine));
                 timedoutTask.run();
-                if (!_passwordCommand) {
-                    _logger.warn(String.format("Process [%s] for command [%s] timed out. Output is [%s].", processPid, commandLine, timedoutTask.getResult()));
-                } else {
-                    _logger.warn(String.format("Process [%s] for command [%s] timed out.", processPid, commandLine));
-                }
+                _logger.warn(String.format("Process [%s] for command [%s] timed out. Output is [%s].", processPid,
+                            commandLine, timedoutTask.getResult()));
 
                 return ERR_TIMEOUT;
             }
 
-            _logger.debug(String.format("Exit value of process [%s] for command [%s] is [%s].", processPid, commandLine, _process.exitValue()));
+            _logger.debug(String.format("Exit value of process [%s] for command [%s] is [%s].", processPid,
+                    commandLine, _process.exitValue()));
 
             BufferedReader reader = new BufferedReader(new InputStreamReader(_process.getInputStream()), 128);
 
@@ -339,19 +357,24 @@ public String execute(OutputInterpreter interpreter) {
                 error = String.valueOf(_process.exitValue());
             }
 
-            _logger.warn(String.format("Process [%s] for command [%s] encountered the error: [%s].", processPid, commandLine, error));
+            _logger.warn(String.format("Process [%s] for command [%s] encountered the error: [%s].", processPid,
+                    commandLine, error));
 
             return error;
         } catch (SecurityException ex) {
-            _logger.warn(String.format("Exception [%s] occurred. This may be due to an attempt of executing command [%s] as non root.", ex.getMessage(), commandLine),
+            _logger.warn(String.format(
+                    "Exception [%s] occurred. This may be due to an attempt of executing command [%s] as non root.",
+                    ex.getMessage(), commandLine),
                     ex);
             return stackTraceAsString(ex);
         } catch (Exception ex) {
-            _logger.warn(String.format("Exception [%s] occurred when attempting to run command [%s].", ex.getMessage(), commandLine), ex);
+            _logger.warn(String.format("Exception [%s] occurred when attempting to run command [%s].",
+                    ex.getMessage(), commandLine), ex);
             return stackTraceAsString(ex);
         } finally {
             if (_process != null) {
-                _logger.trace(String.format("Destroying process [%s] for command [%s].", _process.pid(), commandLine));
+                _logger.trace(
+                        String.format("Destroying process [%s] for command [%s].", _process.pid(), commandLine));
                 IOUtils.closeQuietly(_process.getErrorStream());
                 IOUtils.closeQuietly(_process.getOutputStream());
                 IOUtils.closeQuietly(_process.getInputStream());
@@ -362,9 +385,10 @@ public String execute(OutputInterpreter interpreter) {
 
     public String executeIgnoreExitValue(OutputInterpreter interpreter, int exitValue) {
         String[] command = _command.toArray(new String[_command.size()]);
+        String commandLine = buildCommandLine(command);
 
         if (_logger.isDebugEnabled()) {
-            _logger.debug(String.format("Executing: %s", buildCommandLine(command).split(KeyStoreUtils.KS_FILENAME)[0]));
+            _logger.debug(String.format("Executing: %s", commandLine));
         }
 
         try {
@@ -375,7 +399,7 @@ public String executeIgnoreExitValue(OutputInterpreter interpreter, int exitValu
 
             _process = pb.start();
             if (_process == null) {
-                _logger.warn(String.format("Unable to execute: %s", buildCommandLine(command)));
+                _logger.warn(String.format("Unable to execute: %s", commandLine));
                 return String.format("Unable to execute the command: %s", command[0]);
             }
 
@@ -439,11 +463,8 @@ public String executeIgnoreExitValue(OutputInterpreter interpreter, int exitValu
                 Task timedoutTask = new Task(log, ir);
 
                 timedoutTask.run();
-                if (!_passwordCommand) {
-                    _logger.warn(String.format("Timed out: %s.  Output is: %s", buildCommandLine(command), timedoutTask.getResult()));
-                } else {
-                    _logger.warn(String.format("Timed out: %s", buildCommandLine(command)));
-                }
+                _logger.warn(String.format("Timed out: %s.  Output is: %s", commandLine,
+                            timedoutTask.getResult()));
 
                 return ERR_TIMEOUT;
             }
@@ -467,7 +488,7 @@ public String executeIgnoreExitValue(OutputInterpreter interpreter, int exitValu
             _logger.warn("Security Exception....not running as root?", ex);
             return stackTraceAsString(ex);
         } catch (Exception ex) {
-            _logger.warn(String.format("Exception: %s", buildCommandLine(command)), ex);
+            _logger.warn(String.format("Exception: %s", commandLine), ex);
             return stackTraceAsString(ex);
         } finally {
             if (_process != null) {
@@ -516,9 +537,9 @@ public void run() {
                 } catch (Exception ex) {
                     result = stackTraceAsString(ex);
                 } finally {
-                        done = true;
-                        notifyAll();
-                        IOUtils.closeQuietly(reader);
+                    done = true;
+                    notifyAll();
+                    IOUtils.closeQuietly(reader);
                 }
             }
         }
diff --git a/utils/src/test/java/com/cloud/utils/script/ScriptTest.java b/utils/src/test/java/com/cloud/utils/script/ScriptTest.java
index cc6047959da9..a52f3840bea9 100644
--- a/utils/src/test/java/com/cloud/utils/script/ScriptTest.java
+++ b/utils/src/test/java/com/cloud/utils/script/ScriptTest.java
@@ -78,4 +78,34 @@ public void testGetExecutableAbsolutePath() {
         String result = Script.getExecutableAbsolutePath("ls");
         Assert.assertTrue(List.of("/usr/bin/ls", "/bin/ls").contains(result));
     }
+
+    @Test
+    public void testBuildCommandLineWithSensitiveData() {
+        Script script = new Script("test.sh");
+        script.add("normal-arg");
+        script.addSensitive("sensitive-arg");
+        String commandLine = script.toString();
+        Assert.assertEquals("test.sh normal-arg ****** ", commandLine);
+    }
+
+    @Test
+    public void testBuildCommandLineWithMultipleSensitiveData() {
+        Script script = new Script("test.sh");
+        script.add("normal-arg");
+        script.addSensitive("sensitive-arg1");
+        script.add("another-normal-arg");
+        script.addSensitive("sensitive-arg2");
+        String commandLine = script.toString();
+        Assert.assertEquals("test.sh normal-arg ****** another-normal-arg ****** ", commandLine);
+    }
+
+    @Test
+    public void testBuildCommandLineWithLegacyPasswordOption() {
+        Script script = new Script("test.sh");
+        script.add("-y");
+        script.add("legacy-password");
+        String commandLine = script.toString();
+        Assert.assertEquals("test.sh -y ****** ", commandLine);
+    }
+
 }

From 4d35d68e4ef77a6e034f2464ab92976a175bc11c Mon Sep 17 00:00:00 2001
From: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
Date: Wed, 28 Jan 2026 17:17:50 +0530
Subject: [PATCH 066/117] Fix url in password reset email (#12078)

---
 .../org/apache/cloudstack/ServerDaemon.java   | 15 +++-----
 .../user/UserPasswordResetManager.java        |  4 ++-
 .../user/UserPasswordResetManagerImpl.java    | 26 +++++++++++---
 .../cloud/utils/server/ServerProperties.java  | 36 +++++++++++++++++--
 4 files changed, 64 insertions(+), 17 deletions(-)

diff --git a/client/src/main/java/org/apache/cloudstack/ServerDaemon.java b/client/src/main/java/org/apache/cloudstack/ServerDaemon.java
index 09bdb11a6b39..06477fff8986 100644
--- a/client/src/main/java/org/apache/cloudstack/ServerDaemon.java
+++ b/client/src/main/java/org/apache/cloudstack/ServerDaemon.java
@@ -71,11 +71,6 @@ public class ServerDaemon implements Daemon {
     private static final String BIND_INTERFACE = "bind.interface";
     private static final String CONTEXT_PATH = "context.path";
     private static final String SESSION_TIMEOUT = "session.timeout";
-    private static final String HTTP_ENABLE = "http.enable";
-    private static final String HTTP_PORT = "http.port";
-    private static final String HTTPS_ENABLE = "https.enable";
-    private static final String HTTPS_PORT = "https.port";
-    private static final String KEYSTORE_FILE = "https.keystore";
     private static final String KEYSTORE_PASSWORD = "https.keystore.password";
     private static final String WEBAPP_DIR = "webapp.dir";
     private static final String ACCESS_LOG = "access.log";
@@ -137,11 +132,11 @@ public void init(final DaemonContext context) {
             }
             setBindInterface(properties.getProperty(BIND_INTERFACE, null));
             setContextPath(properties.getProperty(CONTEXT_PATH, "/client"));
-            setHttpEnable(Boolean.valueOf(properties.getProperty(HTTP_ENABLE, "true")));
-            setHttpPort(Integer.valueOf(properties.getProperty(HTTP_PORT, "8080")));
-            setHttpsEnable(Boolean.valueOf(properties.getProperty(HTTPS_ENABLE, "false")));
-            setHttpsPort(Integer.valueOf(properties.getProperty(HTTPS_PORT, "8443")));
-            setKeystoreFile(properties.getProperty(KEYSTORE_FILE));
+            setHttpEnable(Boolean.valueOf(properties.getProperty(ServerProperties.HTTP_ENABLE, "true")));
+            setHttpPort(Integer.valueOf(properties.getProperty(ServerProperties.HTTP_PORT, "8080")));
+            setHttpsEnable(Boolean.valueOf(properties.getProperty(ServerProperties.HTTPS_ENABLE, "false")));
+            setHttpsPort(Integer.valueOf(properties.getProperty(ServerProperties.HTTPS_PORT, "8443")));
+            setKeystoreFile(properties.getProperty(ServerProperties.KEYSTORE_FILE));
             setKeystorePassword(properties.getProperty(KEYSTORE_PASSWORD));
             setWebAppLocation(properties.getProperty(WEBAPP_DIR));
             setAccessLogFile(properties.getProperty(ACCESS_LOG, "access.log"));
diff --git a/server/src/main/java/org/apache/cloudstack/user/UserPasswordResetManager.java b/server/src/main/java/org/apache/cloudstack/user/UserPasswordResetManager.java
index 377e57b31e93..ca14f6a1654e 100644
--- a/server/src/main/java/org/apache/cloudstack/user/UserPasswordResetManager.java
+++ b/server/src/main/java/org/apache/cloudstack/user/UserPasswordResetManager.java
@@ -78,7 +78,9 @@ public interface UserPasswordResetManager {
 
     ConfigKey<String> UserPasswordResetDomainURL = new ConfigKey<>(ConfigKey.CATEGORY_ADVANCED,
             String.class, "user.password.reset.mail.domain.url", null,
-            "Domain URL for reset password links sent to the user via email", true,
+            "Domain URL (along with scheme - http:// or https:// and port as applicable) for reset password links sent to the user via email. " +
+                    "If this is not set, CloudStack would determine the domain url based on the first management server from 'host' setting " +
+                    "and http scheme based on the https.enabled flag from server.properties file in the management server.", true,
             ConfigKey.Scope.Global);
 
     void setResetTokenAndSend(UserAccount userAccount);
diff --git a/server/src/main/java/org/apache/cloudstack/user/UserPasswordResetManagerImpl.java b/server/src/main/java/org/apache/cloudstack/user/UserPasswordResetManagerImpl.java
index 618ad5c86572..c62bca8eca4b 100644
--- a/server/src/main/java/org/apache/cloudstack/user/UserPasswordResetManagerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/user/UserPasswordResetManagerImpl.java
@@ -23,6 +23,7 @@
 import com.cloud.user.dao.UserDao;
 import com.cloud.utils.StringUtils;
 import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.server.ServerProperties;
 import com.github.mustachejava.DefaultMustacheFactory;
 import com.github.mustachejava.Mustache;
 import com.github.mustachejava.MustacheFactory;
@@ -48,6 +49,7 @@
 import java.util.Set;
 import java.util.UUID;
 
+import static org.apache.cloudstack.config.ApiServiceConfiguration.ManagementServerAddresses;
 import static org.apache.cloudstack.resourcedetail.UserDetailVO.PasswordResetToken;
 import static org.apache.cloudstack.resourcedetail.UserDetailVO.PasswordResetTokenExpiryDate;
 
@@ -68,7 +70,7 @@ public class UserPasswordResetManagerImpl extends ManagerBase implements UserPas
             new ConfigKey<>(ConfigKey.CATEGORY_ADVANCED, String.class,
             "user.password.reset.mail.template", "Hello {{username}}!\n" +
             "You have requested to reset your password. Please click the following link to reset your password:\n" +
-            "{{{domainUrl}}}{{{resetLink}}}\n" +
+            "{{{resetLink}}}\n" +
             "If you did not request a password reset, please ignore this email.\n" +
             "\n" +
             "Regards,\n" +
@@ -179,10 +181,26 @@ public void setResetTokenAndSend(UserAccount userAccount) {
         final String email = userAccount.getEmail();
         final String username = userAccount.getUsername();
         final String subject = "Password Reset Request";
-        final String domainUrl = UserPasswordResetDomainURL.value();
+        String domainUrl = UserPasswordResetDomainURL.value();
+        if (StringUtils.isBlank(domainUrl)) {
+            String mgmtServerAddr = ManagementServerAddresses.value().split(",")[0];
+            if (ServerProperties.isHttpsEnabled()) {
+                domainUrl = "https://" + mgmtServerAddr + ":" + ServerProperties.getHttpsPort();
+            } else {
+                domainUrl = "http://" + mgmtServerAddr + ":" + ServerProperties.getHttpPort();
+            }
+        } else if (!domainUrl.startsWith("http://") && !domainUrl.startsWith("https://")) {
+            if (ServerProperties.isHttpsEnabled()) {
+                domainUrl = "https://" + domainUrl;
+            } else {
+                domainUrl = "http://" + domainUrl;
+            }
+        }
+
+        domainUrl = domainUrl.replaceAll("/+$", "");
 
-        String resetLink = String.format("/client/#/user/resetPassword?username=%s&token=%s",
-                username, resetToken);
+        String resetLink = String.format("%s/client/#/user/resetPassword?username=%s&token=%s",
+                domainUrl, username, resetToken);
         String content = getMessageBody(userAccount, resetToken, resetLink);
 
         SMTPMailProperties mailProperties = new SMTPMailProperties();
diff --git a/utils/src/main/java/com/cloud/utils/server/ServerProperties.java b/utils/src/main/java/com/cloud/utils/server/ServerProperties.java
index 36d8614e68f1..9e81fff90f01 100644
--- a/utils/src/main/java/com/cloud/utils/server/ServerProperties.java
+++ b/utils/src/main/java/com/cloud/utils/server/ServerProperties.java
@@ -17,10 +17,12 @@
 package com.cloud.utils.server;
 
 import com.cloud.utils.crypt.EncryptionSecretKeyChecker;
+import com.cloud.utils.StringUtils;
 import org.apache.commons.io.IOUtils;
 import org.apache.logging.log4j.Logger;
 import org.apache.logging.log4j.LogManager;
 
+import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
 import java.util.Properties;
@@ -28,9 +30,20 @@
 public class ServerProperties {
     protected Logger logger = LogManager.getLogger(getClass());
 
+    public static final String HTTP_ENABLE = "http.enable";
+    public static final String HTTP_PORT = "http.port";
+    public static final String HTTPS_ENABLE = "https.enable";
+    public static final String HTTPS_PORT = "https.port";
+    public static final String KEYSTORE_FILE = "https.keystore";
+    public static final String PASSWORD_ENCRYPTION_TYPE = "password.encryption.type";
+
     private static Properties properties = new Properties();
     private static boolean loaded = false;
-    public static final String passwordEncryptionType = "password.encryption.type";
+
+    private static int httpPort = 8080;
+
+    private static boolean httpsEnable = false;
+    private static int httpsPort = 8443;
 
     public synchronized static Properties getServerProperties(InputStream inputStream) {
         if (!loaded) {
@@ -39,7 +52,7 @@ public synchronized static Properties getServerProperties(InputStream inputStrea
                 serverProps.load(inputStream);
 
                 EncryptionSecretKeyChecker checker = new EncryptionSecretKeyChecker();
-                checker.check(serverProps, passwordEncryptionType);
+                checker.check(serverProps, PASSWORD_ENCRYPTION_TYPE);
 
                 if (EncryptionSecretKeyChecker.useEncryption()) {
                     EncryptionSecretKeyChecker.decryptAnyProperties(serverProps);
@@ -50,10 +63,29 @@ public synchronized static Properties getServerProperties(InputStream inputStrea
                 IOUtils.closeQuietly(inputStream);
             }
 
+            httpPort = Integer.parseInt(serverProps.getProperty(ServerProperties.HTTP_PORT, "8080"));
+
+            boolean httpsEnabled = Boolean.parseBoolean(serverProps.getProperty(ServerProperties.HTTPS_ENABLE, "false"));
+            String keystoreFile = serverProps.getProperty(KEYSTORE_FILE);
+            httpsEnable =  httpsEnabled && StringUtils.isNotEmpty(keystoreFile) && new File(keystoreFile).exists();
+            httpsPort = Integer.parseInt(serverProps.getProperty(ServerProperties.HTTPS_PORT, "8443"));
+
             properties = serverProps;
             loaded = true;
         }
 
         return properties;
     }
+
+    public static int getHttpPort() {
+        return httpPort;
+    }
+
+    public static boolean isHttpsEnabled() {
+        return httpsEnable;
+    }
+
+    public static int getHttpsPort() {
+        return httpsPort;
+    }
 }

From 6a04e14f8767a90b5d709e3105f7f47500b4d21c Mon Sep 17 00:00:00 2001
From: Wei Zhou <weizhou@apache.org>
Date: Wed, 28 Jan 2026 13:09:10 +0100
Subject: [PATCH 067/117] VR: fix dns list in redundant VPC VRs (#12161)

---
 systemvm/debian/opt/cloud/bin/cs/CsDhcp.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/systemvm/debian/opt/cloud/bin/cs/CsDhcp.py b/systemvm/debian/opt/cloud/bin/cs/CsDhcp.py
index e15714af212f..a2309067289d 100755
--- a/systemvm/debian/opt/cloud/bin/cs/CsDhcp.py
+++ b/systemvm/debian/opt/cloud/bin/cs/CsDhcp.py
@@ -110,7 +110,7 @@ def configure_server(self):
             if gn.get_dns() and device:
                 sline = "dhcp-option=tag:interface-%s-%s,6" % (device, idx)
                 dns_list = [x for x in gn.get_dns() if x]
-                if (self.config.is_vpc() or self.config.is_router()) and ('is_vr_guest_gateway' in gn.data and gn.data['is_vr_guest_gateway']):
+                if self.config.is_vpc() and not gn.is_vr_guest_gateway():
                   if gateway in dns_list:
                     dns_list.remove(gateway)
                   if gn.data['router_guest_ip'] != ip:

From 37507e87990bdf2fe36767da996c079859c9ac0f Mon Sep 17 00:00:00 2001
From: dahn <daan@onecht.net>
Date: Wed, 28 Jan 2026 13:11:24 +0100
Subject: [PATCH 068/117] address warnings in capacity manager (#11971)

Co-authored-by: Daan Hoogland <dahn@apache.org>
---
 .../cloud/capacity/CapacityManagerImpl.java   | 155 +++++-------------
 1 file changed, 38 insertions(+), 117 deletions(-)

diff --git a/server/src/main/java/com/cloud/capacity/CapacityManagerImpl.java b/server/src/main/java/com/cloud/capacity/CapacityManagerImpl.java
index 2de9abc827ec..2940f900b081 100644
--- a/server/src/main/java/com/cloud/capacity/CapacityManagerImpl.java
+++ b/server/src/main/java/com/cloud/capacity/CapacityManagerImpl.java
@@ -50,7 +50,6 @@
 import com.cloud.agent.api.Answer;
 import com.cloud.agent.api.Command;
 import com.cloud.agent.api.StartupCommand;
-import com.cloud.agent.api.StartupRoutingCommand;
 import com.cloud.capacity.dao.CapacityDao;
 import com.cloud.configuration.Config;
 import com.cloud.dc.ClusterDetailsDao;
@@ -82,7 +81,6 @@
 import com.cloud.utils.Pair;
 import com.cloud.utils.component.ManagerBase;
 import com.cloud.utils.db.DB;
-import com.cloud.utils.db.SearchCriteria;
 import com.cloud.utils.db.Transaction;
 import com.cloud.utils.db.TransactionCallbackNoReturn;
 import com.cloud.utils.db.TransactionStatus;
@@ -167,11 +165,6 @@ public boolean start() {
         return true;
     }
 
-    @Override
-    public boolean stop() {
-        return true;
-    }
-
     @DB
     @Override
     public boolean releaseVmCapacity(VirtualMachine vm, final boolean moveFromReserved, final boolean moveToReservered, final Long hostId) {
@@ -395,8 +388,8 @@ host, toHumanReadableSize(usedMem), toHumanReadableSize(reservedMem),
                     long cluster_id = host.getClusterId();
                     ClusterDetailsVO cluster_detail_cpu = _clusterDetailsDao.findDetail(cluster_id, VmDetailConstants.CPU_OVER_COMMIT_RATIO);
                     ClusterDetailsVO cluster_detail_ram = _clusterDetailsDao.findDetail(cluster_id, VmDetailConstants.MEMORY_OVER_COMMIT_RATIO);
-                    Float cpuOvercommitRatio = Float.parseFloat(cluster_detail_cpu.getValue());
-                    Float memoryOvercommitRatio = Float.parseFloat(cluster_detail_ram.getValue());
+                    float cpuOvercommitRatio = Float.parseFloat(cluster_detail_cpu.getValue());
+                    float memoryOvercommitRatio = Float.parseFloat(cluster_detail_ram.getValue());
 
                     boolean hostHasCpuCapability, hostHasCapacity = false;
                     hostHasCpuCapability = checkIfHostHasCpuCapability(host, cpucore, cpuspeed);
@@ -424,14 +417,13 @@ host, toHumanReadableSize(usedMem), toHumanReadableSize(reservedMem),
             if (e instanceof CloudRuntimeException) {
                 throw e;
             }
-            return;
         }
     }
 
     @Override
     public boolean checkIfHostHasCpuCapability(Host host, Integer cpuNum, Integer cpuSpeed) {
         // Check host can support the Cpu Number and Speed.
-        boolean isCpuNumGood = host.getCpus().intValue() >= cpuNum;
+        boolean isCpuNumGood = host.getCpus() >= cpuNum;
         boolean isCpuSpeedGood = host.getSpeed().intValue() >= cpuSpeed;
         boolean hasCpuCapability = isCpuNumGood && isCpuSpeedGood;
 
@@ -482,13 +474,10 @@ public boolean checkIfHostHasCapacity(Host host, Integer cpu, long ram, boolean
 
         String failureReason = "";
         if (checkFromReservedCapacity) {
-            long freeCpu = reservedCpu;
-            long freeMem = reservedMem;
-
             if (logger.isDebugEnabled()) {
                 logger.debug("We need to allocate to the last host again, so checking if there is enough reserved capacity");
-                logger.debug("Reserved CPU: " + freeCpu + " , Requested CPU: " + cpu);
-                logger.debug("Reserved RAM: " + toHumanReadableSize(freeMem) + " , Requested RAM: " + toHumanReadableSize(ram));
+                logger.debug("Reserved CPU: " + reservedCpu + " , Requested CPU: " + cpu);
+                logger.debug("Reserved RAM: " + toHumanReadableSize(reservedMem) + " , Requested RAM: " + toHumanReadableSize(ram));
             }
             /* alloc from reserved */
             if (reservedCpu >= cpu) {
@@ -586,7 +575,7 @@ public long getUsedIops(StoragePoolVO pool) {
 
     @Override
     public long getAllocatedPoolCapacity(StoragePoolVO pool, VMTemplateVO templateForVmCreation) {
-        long totalAllocatedSize = 0;
+        long totalAllocatedSize;
 
         // if the storage pool is managed, the used bytes can be larger than the sum of the sizes of all of the non-destroyed volumes
         // in this case, call getUsedBytes(StoragePoolVO)
@@ -700,11 +689,11 @@ public void updateCapacityForHost(final Host host) {
 
         Pair<String, String> clusterValues =
                 clusterValuesCache.get(host.getClusterId());
-        Float clusterCpuOvercommitRatio = Float.parseFloat(clusterValues.first());
-        Float clusterRamOvercommitRatio = Float.parseFloat(clusterValues.second());
+        float clusterCpuOvercommitRatio = Float.parseFloat(clusterValues.first());
+        float clusterRamOvercommitRatio = Float.parseFloat(clusterValues.second());
         for (VMInstanceVO vm : vms) {
-            Float cpuOvercommitRatio = 1.0f;
-            Float ramOvercommitRatio = 1.0f;
+            float cpuOvercommitRatio;
+            float ramOvercommitRatio;
             Map<String, String> vmDetails = getVmDetailsForCapacityCalculation(vm.getId());
             String vmDetailCpu = vmDetails.get(VmDetailConstants.CPU_OVER_COMMIT_RATIO);
             String vmDetailRam = vmDetails.get(VmDetailConstants.MEMORY_OVER_COMMIT_RATIO);
@@ -717,21 +706,22 @@ public void updateCapacityForHost(final Host host) {
             }
             if (so.isDynamic()) {
                 usedMemory +=
-                    ((Integer.parseInt(vmDetails.get(UsageEventVO.DynamicParameters.memory.name())) * 1024L * 1024L) / ramOvercommitRatio) *
-                        clusterRamOvercommitRatio;
+                        (long) (((Integer.parseInt(vmDetails.get(UsageEventVO.DynamicParameters.memory.name())) * 1024L * 1024L)
+                                / ramOvercommitRatio) * clusterRamOvercommitRatio);
                 if(vmDetails.containsKey(UsageEventVO.DynamicParameters.cpuSpeed.name())) {
                     usedCpu +=
-                            ((Integer.parseInt(vmDetails.get(UsageEventVO.DynamicParameters.cpuNumber.name())) * Integer.parseInt(vmDetails.get(UsageEventVO.DynamicParameters.cpuSpeed.name()))) / cpuOvercommitRatio) *
-                                    clusterCpuOvercommitRatio;
+                            (long) ((((long) Integer.parseInt(vmDetails.get(UsageEventVO.DynamicParameters.cpuNumber.name()))
+                                                                * Integer.parseInt(vmDetails.get(UsageEventVO.DynamicParameters.cpuSpeed.name())))
+                                                                / cpuOvercommitRatio) * clusterCpuOvercommitRatio);
                 } else {
                     usedCpu +=
-                            ((Integer.parseInt(vmDetails.get(UsageEventVO.DynamicParameters.cpuNumber.name())) * so.getSpeed()) / cpuOvercommitRatio) *
-                                    clusterCpuOvercommitRatio;
+                            (long) ((((long) Integer.parseInt(vmDetails.get(UsageEventVO.DynamicParameters.cpuNumber.name())) * so.getSpeed()) / cpuOvercommitRatio) *
+                                                                clusterCpuOvercommitRatio);
                 }
                 usedCpuCore += Integer.parseInt(vmDetails.get(UsageEventVO.DynamicParameters.cpuNumber.name()));
             } else {
-                usedMemory += ((so.getRamSize() * 1024L * 1024L) / ramOvercommitRatio) * clusterRamOvercommitRatio;
-                usedCpu += ((so.getCpu() * so.getSpeed()) / cpuOvercommitRatio) * clusterCpuOvercommitRatio;
+                usedMemory += (long) (((so.getRamSize() * 1024L * 1024L) / ramOvercommitRatio) * clusterRamOvercommitRatio);
+                usedCpu += (long) ((((long) so.getCpu() * so.getSpeed()) / cpuOvercommitRatio) * clusterCpuOvercommitRatio);
                 usedCpuCore += so.getCpu();
             }
         }
@@ -740,8 +730,8 @@ public void updateCapacityForHost(final Host host) {
         logger.debug("Found {} VM, not running on {}", vmsByLastHostId.size(), host);
 
         for (VMInstanceVO vm : vmsByLastHostId) {
-            Float cpuOvercommitRatio = 1.0f;
-            Float ramOvercommitRatio = 1.0f;
+            float cpuOvercommitRatio = 1.0f;
+            float ramOvercommitRatio = 1.0f;
             long lastModificationTime = Optional.ofNullable(vm.getUpdateTime()).orElse(vm.getCreated()).getTime();
             long secondsSinceLastUpdate = (DateUtil.currentGMTTime().getTime() - lastModificationTime) / 1000;
             if (secondsSinceLastUpdate < _vmCapacityReleaseInterval) {
@@ -761,28 +751,28 @@ public void updateCapacityForHost(final Host host) {
                 }
                 if (so.isDynamic()) {
                     reservedMemory +=
-                        ((Integer.parseInt(vmDetails.get(UsageEventVO.DynamicParameters.memory.name())) * 1024L * 1024L) / ramOvercommitRatio) *
-                            clusterRamOvercommitRatio;
+                            (long) (((Integer.parseInt(vmDetails.get(UsageEventVO.DynamicParameters.memory.name())) * 1024L * 1024L) / ramOvercommitRatio) *
+                                                        clusterRamOvercommitRatio);
                     if(vmDetails.containsKey(UsageEventVO.DynamicParameters.cpuSpeed.name())) {
                         reservedCpu +=
-                                ((Integer.parseInt(vmDetails.get(UsageEventVO.DynamicParameters.cpuNumber.name())) * Integer.parseInt(vmDetails.get(UsageEventVO.DynamicParameters.cpuSpeed.name()))) / cpuOvercommitRatio) *
-                                        clusterCpuOvercommitRatio;
+                                (long) (((Long.parseLong(vmDetails.get(UsageEventVO.DynamicParameters.cpuNumber.name())) * Integer.parseInt(vmDetails.get(UsageEventVO.DynamicParameters.cpuSpeed.name()))) / cpuOvercommitRatio) *
+                                                                        clusterCpuOvercommitRatio);
                     } else {
                         reservedCpu +=
-                                ((Integer.parseInt(vmDetails.get(UsageEventVO.DynamicParameters.cpuNumber.name())) * so.getSpeed()) / cpuOvercommitRatio) *
-                                        clusterCpuOvercommitRatio;
+                                (long) (((Long.parseLong(vmDetails.get(UsageEventVO.DynamicParameters.cpuNumber.name())) * so.getSpeed()) / cpuOvercommitRatio) *
+                                                                        clusterCpuOvercommitRatio);
                     }
                     reservedCpuCore += Integer.parseInt(vmDetails.get(UsageEventVO.DynamicParameters.cpuNumber.name()));
                 } else {
-                    reservedMemory += ((so.getRamSize() * 1024L * 1024L) / ramOvercommitRatio) * clusterRamOvercommitRatio;
-                    reservedCpu += (so.getCpu() * so.getSpeed() / cpuOvercommitRatio) * clusterCpuOvercommitRatio;
+                    reservedMemory += (long) (((so.getRamSize() * 1024L * 1024L) / ramOvercommitRatio) * clusterRamOvercommitRatio);
+                    reservedCpu += (long) (((long) so.getCpu() * so.getSpeed() / cpuOvercommitRatio) * clusterCpuOvercommitRatio);
                     reservedCpuCore += so.getCpu();
                 }
             } else {
                 // signal if not done already, that the VM has been stopped for skip.counting.hours,
                 // hence capacity will not be reserved anymore.
                 VMInstanceDetailVO messageSentFlag = _vmInstanceDetailsDao.findDetail(vm.getId(), VmDetailConstants.MESSAGE_RESERVED_CAPACITY_FREED_FLAG);
-                if (messageSentFlag == null || !Boolean.valueOf(messageSentFlag.getValue())) {
+                if (messageSentFlag == null || !Boolean.parseBoolean(messageSentFlag.getValue())) {
                     _messageBus.publish(_name, "VM_ReservedCapacity_Free", PublishScope.LOCAL, vm);
 
                     if (vm.getType() == VirtualMachine.Type.User) {
@@ -859,7 +849,7 @@ public void doInTransactionWithoutResult(TransactionStatus status) {
             if (host.getTotalMemory() != null) {
                 memCap.setTotalCapacity(host.getTotalMemory());
             }
-            long hostTotalCpu = host.getCpus().longValue() * host.getSpeed().longValue();
+            long hostTotalCpu = host.getCpus().longValue() * host.getSpeed();
 
             if (cpuCap.getTotalCapacity() != hostTotalCpu) {
                 logger.debug("Calibrate total cpu for host: {} old total CPU:{} new total CPU:{}", host, cpuCap.getTotalCapacity(), hostTotalCpu);
@@ -938,7 +928,7 @@ public void doInTransactionWithoutResult(TransactionStatus status) {
 
                     capacity =
                         new CapacityVO(host.getId(), host.getDataCenterId(), host.getPodId(), host.getClusterId(), usedCpuFinal, host.getCpus().longValue() *
-                            host.getSpeed().longValue(), Capacity.CAPACITY_TYPE_CPU);
+                                host.getSpeed(), Capacity.CAPACITY_TYPE_CPU);
                     capacity.setReservedCapacity(reservedCpuFinal);
                     capacity.setCapacityState(capacityState);
                     _capacityDao.persist(capacity);
@@ -1029,78 +1019,10 @@ public boolean postStateTransitionEvent(StateMachine2.Transition<State, Event> t
       return true;
     }
 
-  // TODO: Get rid of this case once we've determined that the capacity listeners above have all the changes
-    // create capacity entries if none exist for this server
-    private void createCapacityEntry(StartupCommand startup, HostVO server) {
-        SearchCriteria<CapacityVO> capacitySC = _capacityDao.createSearchCriteria();
-        capacitySC.addAnd("hostOrPoolId", SearchCriteria.Op.EQ, server.getId());
-        capacitySC.addAnd("dataCenterId", SearchCriteria.Op.EQ, server.getDataCenterId());
-        capacitySC.addAnd("podId", SearchCriteria.Op.EQ, server.getPodId());
-
-        if (startup instanceof StartupRoutingCommand) {
-            SearchCriteria<CapacityVO> capacityCPU = _capacityDao.createSearchCriteria();
-            capacityCPU.addAnd("hostOrPoolId", SearchCriteria.Op.EQ, server.getId());
-            capacityCPU.addAnd("dataCenterId", SearchCriteria.Op.EQ, server.getDataCenterId());
-            capacityCPU.addAnd("podId", SearchCriteria.Op.EQ, server.getPodId());
-            capacityCPU.addAnd("capacityType", SearchCriteria.Op.EQ, Capacity.CAPACITY_TYPE_CPU);
-            List<CapacityVO> capacityVOCpus = _capacityDao.search(capacitySC, null);
-            Float cpuovercommitratio = Float.parseFloat(_clusterDetailsDao.findDetail(server.getClusterId(), VmDetailConstants.CPU_OVER_COMMIT_RATIO).getValue());
-            Float memoryOvercommitRatio = Float.parseFloat(_clusterDetailsDao.findDetail(server.getClusterId(), VmDetailConstants.MEMORY_OVER_COMMIT_RATIO).getValue());
-
-            if (capacityVOCpus != null && !capacityVOCpus.isEmpty()) {
-                CapacityVO CapacityVOCpu = capacityVOCpus.get(0);
-                long newTotalCpu = (long)(server.getCpus().longValue() * server.getSpeed().longValue() * cpuovercommitratio);
-                if ((CapacityVOCpu.getTotalCapacity() <= newTotalCpu) || ((CapacityVOCpu.getUsedCapacity() + CapacityVOCpu.getReservedCapacity()) <= newTotalCpu)) {
-                    CapacityVOCpu.setTotalCapacity(newTotalCpu);
-                } else if ((CapacityVOCpu.getUsedCapacity() + CapacityVOCpu.getReservedCapacity() > newTotalCpu) && (CapacityVOCpu.getUsedCapacity() < newTotalCpu)) {
-                    CapacityVOCpu.setReservedCapacity(0);
-                    CapacityVOCpu.setTotalCapacity(newTotalCpu);
-                } else {
-                    logger.debug("What? new cpu is :" + newTotalCpu + ", old one is " + CapacityVOCpu.getUsedCapacity() + "," + CapacityVOCpu.getReservedCapacity() +
-                        "," + CapacityVOCpu.getTotalCapacity());
-                }
-                _capacityDao.update(CapacityVOCpu.getId(), CapacityVOCpu);
-            } else {
-                CapacityVO capacity =
-                    new CapacityVO(server.getId(), server.getDataCenterId(), server.getPodId(), server.getClusterId(), 0L, server.getCpus().longValue() *
-                        server.getSpeed().longValue(), Capacity.CAPACITY_TYPE_CPU);
-                _capacityDao.persist(capacity);
-            }
-
-            SearchCriteria<CapacityVO> capacityMem = _capacityDao.createSearchCriteria();
-            capacityMem.addAnd("hostOrPoolId", SearchCriteria.Op.EQ, server.getId());
-            capacityMem.addAnd("dataCenterId", SearchCriteria.Op.EQ, server.getDataCenterId());
-            capacityMem.addAnd("podId", SearchCriteria.Op.EQ, server.getPodId());
-            capacityMem.addAnd("capacityType", SearchCriteria.Op.EQ, Capacity.CAPACITY_TYPE_MEMORY);
-            List<CapacityVO> capacityVOMems = _capacityDao.search(capacityMem, null);
-
-            if (capacityVOMems != null && !capacityVOMems.isEmpty()) {
-                CapacityVO CapacityVOMem = capacityVOMems.get(0);
-                long newTotalMem = (long)((server.getTotalMemory()) * memoryOvercommitRatio);
-                if (CapacityVOMem.getTotalCapacity() <= newTotalMem || (CapacityVOMem.getUsedCapacity() + CapacityVOMem.getReservedCapacity() <= newTotalMem)) {
-                    CapacityVOMem.setTotalCapacity(newTotalMem);
-                } else if (CapacityVOMem.getUsedCapacity() + CapacityVOMem.getReservedCapacity() > newTotalMem && CapacityVOMem.getUsedCapacity() < newTotalMem) {
-                    CapacityVOMem.setReservedCapacity(0);
-                    CapacityVOMem.setTotalCapacity(newTotalMem);
-                } else {
-                    logger.debug("What? new mem is :" + newTotalMem + ", old one is " + CapacityVOMem.getUsedCapacity() + "," + CapacityVOMem.getReservedCapacity() +
-                        "," + CapacityVOMem.getTotalCapacity());
-                }
-                _capacityDao.update(CapacityVOMem.getId(), CapacityVOMem);
-            } else {
-                CapacityVO capacity =
-                    new CapacityVO(server.getId(), server.getDataCenterId(), server.getPodId(), server.getClusterId(), 0L, server.getTotalMemory(),
-                        Capacity.CAPACITY_TYPE_MEMORY);
-                _capacityDao.persist(capacity);
-            }
-        }
-
-    }
-
     @Override
     public float getClusterOverProvisioningFactor(Long clusterId, short capacityType) {
 
-        String capacityOverProvisioningName = "";
+        String capacityOverProvisioningName;
         if (capacityType == Capacity.CAPACITY_TYPE_CPU) {
             capacityOverProvisioningName = VmDetailConstants.CPU_OVER_COMMIT_RATIO;
         } else if (capacityType == Capacity.CAPACITY_TYPE_MEMORY) {
@@ -1110,15 +1032,14 @@ public float getClusterOverProvisioningFactor(Long clusterId, short capacityType
         }
 
         ClusterDetailsVO clusterDetailCpu = _clusterDetailsDao.findDetail(clusterId, capacityOverProvisioningName);
-        Float clusterOverProvisioningRatio = Float.parseFloat(clusterDetailCpu.getValue());
-        return clusterOverProvisioningRatio;
+        return Float.parseFloat(clusterDetailCpu.getValue());
 
     }
 
     @Override
     public boolean checkIfClusterCrossesThreshold(Long clusterId, Integer cpuRequested, long ramRequested) {
-        Float clusterCpuOverProvisioning = getClusterOverProvisioningFactor(clusterId, Capacity.CAPACITY_TYPE_CPU);
-        Float clusterMemoryOverProvisioning = getClusterOverProvisioningFactor(clusterId, Capacity.CAPACITY_TYPE_MEMORY);
+        float clusterCpuOverProvisioning = getClusterOverProvisioningFactor(clusterId, Capacity.CAPACITY_TYPE_CPU);
+        float clusterMemoryOverProvisioning = getClusterOverProvisioningFactor(clusterId, Capacity.CAPACITY_TYPE_MEMORY);
         Float clusterCpuCapacityDisableThreshold = DeploymentClusterPlanner.ClusterCPUCapacityDisableThreshold.valueIn(clusterId);
         Float clusterMemoryCapacityDisableThreshold = DeploymentClusterPlanner.ClusterMemoryCapacityDisableThreshold.valueIn(clusterId);
 
@@ -1148,8 +1069,8 @@ public Pair<Boolean, Boolean> checkIfHostHasCpuCapabilityAndCapacity(Host host,
         int cpu_requested = offering.getCpu() * offering.getSpeed();
         long ram_requested = offering.getRamSize() * 1024L * 1024L;
         Pair<String, String> clusterDetails = getClusterValues(host.getClusterId());
-        Float cpuOvercommitRatio = Float.parseFloat(clusterDetails.first());
-        Float memoryOvercommitRatio = Float.parseFloat(clusterDetails.second());
+        float cpuOvercommitRatio = Float.parseFloat(clusterDetails.first());
+        float memoryOvercommitRatio = Float.parseFloat(clusterDetails.second());
 
         boolean hostHasCpuCapability = checkIfHostHasCpuCapability(host, offering.getCpu(), offering.getSpeed());
         boolean hostHasCapacity = checkIfHostHasCapacity(host, cpu_requested, ram_requested, false, cpuOvercommitRatio, memoryOvercommitRatio,

From 69c69dc537c025eca86dc0e48ae9dc7761887ef8 Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Wed, 28 Jan 2026 17:53:39 +0530
Subject: [PATCH 069/117] server,engine-schema: make config -
 use.https.to.upload zone scoped (#11539)

---
 .../java/com/cloud/storage/VolumeApiService.java   |  4 ++--
 .../command/TemplateOrVolumePostUploadCommand.java | 14 +++++++++-----
 .../resources/META-INF/db/schema-42100to42200.sql  |  5 +++++
 .../com/cloud/storage/VolumeApiServiceImpl.java    | 11 +++++++----
 .../com/cloud/template/TemplateAdapterBase.java    |  7 ++++---
 .../com/cloud/template/TemplateManagerImpl.java    |  2 +-
 .../SecondaryStorageManagerImpl.java               |  2 +-
 7 files changed, 29 insertions(+), 16 deletions(-)

diff --git a/api/src/main/java/com/cloud/storage/VolumeApiService.java b/api/src/main/java/com/cloud/storage/VolumeApiService.java
index 19c2ebe455a5..1a9bcc6ee98b 100644
--- a/api/src/main/java/com/cloud/storage/VolumeApiService.java
+++ b/api/src/main/java/com/cloud/storage/VolumeApiService.java
@@ -56,9 +56,9 @@ public interface VolumeApiService {
             Boolean.class,
             "use.https.to.upload",
             "true",
-            "Determines the protocol (HTTPS or HTTP) ACS will use to generate links to upload ISOs, volumes, and templates. When set as 'true', ACS will use protocol HTTPS, otherwise, it will use protocol HTTP. Default value is 'true'.",
+            "Controls whether upload links for ISOs, volumes, and templates use HTTPS (true, default) or HTTP (false). After changing this setting, the Secondary Storage VM (SSVM) must be recreated",
             true,
-            ConfigKey.Scope.StoragePool);
+            ConfigKey.Scope.Zone);
 
     /**
      * Creates the database object for a volume based on the given criteria
diff --git a/core/src/main/java/org/apache/cloudstack/storage/command/TemplateOrVolumePostUploadCommand.java b/core/src/main/java/org/apache/cloudstack/storage/command/TemplateOrVolumePostUploadCommand.java
index 3ac83031eaf5..253a2607a72c 100644
--- a/core/src/main/java/org/apache/cloudstack/storage/command/TemplateOrVolumePostUploadCommand.java
+++ b/core/src/main/java/org/apache/cloudstack/storage/command/TemplateOrVolumePostUploadCommand.java
@@ -57,8 +57,10 @@ public class TemplateOrVolumePostUploadCommand {
 
     private String nfsVersion;
 
-    public TemplateOrVolumePostUploadCommand(long entityId, String entityUUID, String absolutePath, String checksum, String type, String name, String imageFormat, String dataTo,
-            String dataToRole) {
+    private long zoneId;
+
+    public TemplateOrVolumePostUploadCommand(long entityId, String entityUUID, String absolutePath, String checksum,
+             String type, String name, String imageFormat, String dataTo, String dataToRole, long zoneId) {
         this.entityId = entityId;
         this.entityUUID = entityUUID;
         this.absolutePath = absolutePath;
@@ -68,9 +70,7 @@ public TemplateOrVolumePostUploadCommand(long entityId, String entityUUID, Strin
         this.imageFormat = imageFormat;
         this.dataTo = dataTo;
         this.dataToRole = dataToRole;
-    }
-
-    public TemplateOrVolumePostUploadCommand() {
+        this.zoneId = zoneId;
     }
 
     public String getRemoteEndPoint() {
@@ -216,4 +216,8 @@ public void setProcessTimeout(long processTimeout) {
     public long getProcessTimeout() {
         return processTimeout;
     }
+
+    public long getZoneId() {
+        return zoneId;
+    }
 }
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42100to42200.sql b/engine/schema/src/main/resources/META-INF/db/schema-42100to42200.sql
index b523016aa3dc..858c46a7c1ee 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-42100to42200.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42100to42200.sql
@@ -87,3 +87,8 @@ CALL `cloud`.`INSERT_EXTENSION_DETAIL_IF_NOT_EXISTS`('MaaS', 'orchestratorrequir
 
 CALL `cloud`.`IDEMPOTENT_DROP_UNIQUE_KEY`('counter', 'uc_counter__provider__source__value');
 CALL `cloud`.`IDEMPOTENT_ADD_UNIQUE_KEY`('cloud.counter', 'uc_counter__provider__source__value__removed', '(provider, source, value, removed)');
+
+-- Change scope for configuration - 'use.https.to.upload from' from StoragePool to Zone
+UPDATE `cloud`.`configuration` SET `scope` = 2 WHERE `name` = 'use.https.to.upload';
+-- Delete the configuration for 'use.https.to.upload' from StoragePool
+DELETE FROM `cloud`.`storage_pool_details` WHERE `name` = 'use.https.to.upload';
diff --git a/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java b/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java
index ce7fab9272e3..31bf80e6459b 100644
--- a/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java
+++ b/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java
@@ -504,9 +504,10 @@ public GetUploadParamsResponse doInTransaction(TransactionStatus status) throws
                 GetUploadParamsResponse response = new GetUploadParamsResponse();
 
                 String ssvmUrlDomain = _configDao.getValue(Config.SecStorageSecureCopyCert.key());
-                String protocol = UseHttpsToUpload.value() ? "https" : "http";
+                String protocol = UseHttpsToUpload.valueIn(zoneId) ? "https" : "http";
 
-                String url = ImageStoreUtil.generatePostUploadUrl(ssvmUrlDomain, ep.getPublicAddr(), vol.getUuid(),  protocol);
+                String url = ImageStoreUtil.generatePostUploadUrl(ssvmUrlDomain, ep.getPublicAddr(), vol.getUuid(),
+                        protocol);
                 response.setPostURL(new URL(url));
 
                 // set the post url, this is used in the monitoring thread to determine the SSVM
@@ -526,8 +527,10 @@ public GetUploadParamsResponse doInTransaction(TransactionStatus status) throws
                 /*
                  * encoded metadata using the post upload config key
                  */
-                TemplateOrVolumePostUploadCommand command = new TemplateOrVolumePostUploadCommand(vol.getId(), vol.getUuid(), volumeStore.getInstallPath(), cmd.getChecksum(), vol.getType().toString(),
-                        vol.getName(), vol.getFormat().toString(), dataObject.getDataStore().getUri(), dataObject.getDataStore().getRole().toString());
+                TemplateOrVolumePostUploadCommand command = new TemplateOrVolumePostUploadCommand(vol.getId(),
+                        vol.getUuid(), volumeStore.getInstallPath(), cmd.getChecksum(), vol.getType().toString(),
+                        vol.getName(), vol.getFormat().toString(), dataObject.getDataStore().getUri(),
+                        dataObject.getDataStore().getRole().toString(), zoneId);
                 command.setLocalPath(volumeStore.getLocalDownloadPath());
                 //using the existing max upload size configuration
                 command.setProcessTimeout(NumbersUtil.parseLong(_configDao.getValue("vmware.package.ova.timeout"), 3600));
diff --git a/server/src/main/java/com/cloud/template/TemplateAdapterBase.java b/server/src/main/java/com/cloud/template/TemplateAdapterBase.java
index da620a3375a3..b50acedddc08 100644
--- a/server/src/main/java/com/cloud/template/TemplateAdapterBase.java
+++ b/server/src/main/java/com/cloud/template/TemplateAdapterBase.java
@@ -234,9 +234,10 @@ protected void postUploadAllocation(List<DataStore> imageStores, VMTemplateVO te
                 throw new CloudRuntimeException(errMsg);
             }
 
-            TemplateOrVolumePostUploadCommand payload = new TemplateOrVolumePostUploadCommand(template.getId(), template.getUuid(), tmpl.getInstallPath(), tmpl
-                    .getChecksum(), tmpl.getType().toString(), template.getUniqueName(), template.getFormat().toString(), templateOnStore.getDataStore().getUri(),
-                    templateOnStore.getDataStore().getRole().toString());
+            TemplateOrVolumePostUploadCommand payload = new TemplateOrVolumePostUploadCommand(template.getId(),
+                    template.getUuid(), tmpl.getInstallPath(), tmpl.getChecksum(), tmpl.getType().toString(),
+                    template.getUniqueName(), template.getFormat().toString(), templateOnStore.getDataStore().getUri(),
+                    templateOnStore.getDataStore().getRole().toString(), zoneId_is);
             //using the existing max template size configuration
             payload.setMaxUploadSize(_configDao.getValue(Config.MaxTemplateAndIsoSize.key()));
 
diff --git a/server/src/main/java/com/cloud/template/TemplateManagerImpl.java b/server/src/main/java/com/cloud/template/TemplateManagerImpl.java
index d751bf92e7b7..91998877761f 100755
--- a/server/src/main/java/com/cloud/template/TemplateManagerImpl.java
+++ b/server/src/main/java/com/cloud/template/TemplateManagerImpl.java
@@ -415,7 +415,7 @@ private GetUploadParamsResponse registerPostUploadInternal(TemplateAdapter adapt
             TemplateOrVolumePostUploadCommand firstCommand = payload.get(0);
 
             String ssvmUrlDomain = _configDao.getValue(Config.SecStorageSecureCopyCert.key());
-            String protocol = VolumeApiService.UseHttpsToUpload.value() ? "https" : "http";
+            String protocol = VolumeApiService.UseHttpsToUpload.valueIn(firstCommand.getZoneId()) ? "https" : "http";
 
             String url = ImageStoreUtil.generatePostUploadUrl(ssvmUrlDomain, firstCommand.getRemoteEndPoint(), firstCommand.getEntityUUID(), protocol);
             response.setPostURL(new URL(url));
diff --git a/services/secondary-storage/controller/src/main/java/org/apache/cloudstack/secondarystorage/SecondaryStorageManagerImpl.java b/services/secondary-storage/controller/src/main/java/org/apache/cloudstack/secondarystorage/SecondaryStorageManagerImpl.java
index e26091f677ec..9d4c73111595 100644
--- a/services/secondary-storage/controller/src/main/java/org/apache/cloudstack/secondarystorage/SecondaryStorageManagerImpl.java
+++ b/services/secondary-storage/controller/src/main/java/org/apache/cloudstack/secondarystorage/SecondaryStorageManagerImpl.java
@@ -1252,7 +1252,7 @@ public boolean finalizeVirtualMachineProfile(VirtualMachineProfile profile, Depl
             logger.debug(String.format("Boot args for machine profile [%s]: [%s].", profile.toString(), bootArgs));
         }
 
-        boolean useHttpsToUpload = BooleanUtils.toBooleanDefaultIfNull(VolumeApiService.UseHttpsToUpload.value(), true);
+        boolean useHttpsToUpload = VolumeApiService.UseHttpsToUpload.valueIn(dc.getId());
         logger.debug(String.format("Setting UseHttpsToUpload config on cmdline with [%s] value.", useHttpsToUpload));
         buf.append(" useHttpsToUpload=").append(useHttpsToUpload);
 

From ded975ceb8ff2a972d029d289f0c889232707c42 Mon Sep 17 00:00:00 2001
From: Davi Torres <90287660+daviftorres@users.noreply.github.com>
Date: Wed, 28 Jan 2026 08:43:05 -0500
Subject: [PATCH 070/117] Improve message "Network is unavailable. Please
 contact administrator" (#11981)

* Improve message "Network is unavailable. Please contact administrator"

This trivial change provide more details for root administrators during troubleshooting.

See discussion https://github.com/apache/cloudstack/discussions/11980

* Improve error message for unavailable guest network

* Update engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java

Co-authored-by: dahn <daan.hoogland@gmail.com>

* Fix and refactor

---------

Co-authored-by: dahn <daan.hoogland@gmail.com>
Co-authored-by: nvazquez <nicovazquez90@gmail.com>
---
 .../main/java/com/cloud/vm/VirtualMachineManagerImpl.java   | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java b/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java
index 86f456306110..e8796fb02529 100755
--- a/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java
+++ b/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java
@@ -935,7 +935,11 @@ public void start(final String vmUuid, final Map<VirtualMachineProfile.Param, Ob
             throw new CloudRuntimeException(String.format("Unable to start a VM [%s] due to [%s].", vmUuid, e.getMessage()), e).add(VirtualMachine.class, vmUuid);
         } catch (final ResourceUnavailableException e) {
             if (e.getScope() != null && e.getScope().equals(VirtualRouter.class)){
-                throw new CloudRuntimeException("Network is unavailable. Please contact administrator", e).add(VirtualMachine.class, vmUuid);
+                Account callingAccount = CallContext.current().getCallingAccount();
+                String errorSuffix = (callingAccount != null && callingAccount.getType() == Account.Type.ADMIN) ?
+                        String.format("Failure: %s", e.getMessage()) :
+                        "Please contact administrator.";
+                throw new CloudRuntimeException(String.format("The Network for VM %s is unavailable. %s", vmUuid, errorSuffix), e).add(VirtualMachine.class, vmUuid);
             }
             throw new CloudRuntimeException(String.format("Unable to start a VM [%s] due to [%s].", vmUuid, e.getMessage()), e).add(VirtualMachine.class, vmUuid);
         }

From 9fc93af85fb34b480065b975257992b1c5631fcd Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Wed, 28 Jan 2026 19:36:04 +0530
Subject: [PATCH 071/117] ui: allow actions for other users of root admin
 (#11319)

Fixes #10306

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
---
 ui/src/config/section/user.js | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/ui/src/config/section/user.js b/ui/src/config/section/user.js
index a18994fd6ce1..65c1a17f760b 100644
--- a/ui/src/config/section/user.js
+++ b/ui/src/config/section/user.js
@@ -105,9 +105,10 @@ export default {
       message: 'message.enable.user',
       dataView: true,
       show: (record, store) => {
-        return ['Admin', 'DomainAdmin'].includes(store.userInfo.roletype) && !record.isdefault &&
-          !(record.domain === 'ROOT' && record.account === 'admin' && record.accounttype === 1) &&
-          ['disabled', 'locked'].includes(record.state)
+        if (!['disabled', 'locked'].includes(record.state) || record.isdefault || !['Admin', 'DomainAdmin'].includes(store.userInfo.roletype)) {
+          return false
+        }
+        return ![1, 4].includes(record.accounttype) || store.userInfo.roletype === 'Admin'
       }
     },
     {
@@ -117,9 +118,10 @@ export default {
       message: 'message.disable.user',
       dataView: true,
       show: (record, store) => {
-        return ['Admin', 'DomainAdmin'].includes(store.userInfo.roletype) && !record.isdefault &&
-          !(record.domain === 'ROOT' && record.account === 'admin' && record.accounttype === 1) &&
-          record.state === 'enabled'
+        if (record.state !== 'enabled' || record.isdefault || !['Admin', 'DomainAdmin'].includes(store.userInfo.roletype)) {
+          return false
+        }
+        return ![1, 4].includes(record.accounttype) || (store.userInfo.roletype === 'Admin' && record.id !== store.userInfo.id)
       }
     },
     {
@@ -131,9 +133,10 @@ export default {
       dataView: true,
       popup: true,
       show: (record, store) => {
-        return ['Admin', 'DomainAdmin'].includes(store.userInfo.roletype) && !record.isdefault &&
-          !(record.domain === 'ROOT' && record.account === 'admin' && record.accounttype === 1) &&
-          record.state === 'enabled'
+        if (record.state !== 'enabled' || record.isdefault || !['Admin', 'DomainAdmin'].includes(store.userInfo.roletype)) {
+          return false
+        }
+        return ![1, 4].includes(record.accounttype) || (store.userInfo.roletype === 'Admin' && record.id !== store.userInfo.id)
       }
     },
     {

From 95de88a8ffee115a98fd34818394d420b01f8cdf Mon Sep 17 00:00:00 2001
From: Abhisar Sinha <63767682+abh1sar@users.noreply.github.com>
Date: Wed, 28 Jan 2026 19:38:25 +0530
Subject: [PATCH 072/117] Usage server should takeover immediately if the other
 Usage server has been stopped gracefully (#12507)

---
 .../src/main/java/com/cloud/usage/dao/UsageJobDao.java       | 2 ++
 .../src/main/java/com/cloud/usage/dao/UsageJobDaoImpl.java   | 3 ++-
 usage/src/main/java/com/cloud/usage/UsageManagerImpl.java    | 5 +++++
 3 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/engine/schema/src/main/java/com/cloud/usage/dao/UsageJobDao.java b/engine/schema/src/main/java/com/cloud/usage/dao/UsageJobDao.java
index d4038d4ceeb4..b22ce69d94ea 100644
--- a/engine/schema/src/main/java/com/cloud/usage/dao/UsageJobDao.java
+++ b/engine/schema/src/main/java/com/cloud/usage/dao/UsageJobDao.java
@@ -28,6 +28,8 @@ public interface UsageJobDao extends GenericDao<UsageJobVO, Long> {
 
     UsageJobVO getLastJob();
 
+    UsageJobVO getNextRecurringJob();
+
     UsageJobVO getNextImmediateJob();
 
     long getLastJobSuccessDateMillis();
diff --git a/engine/schema/src/main/java/com/cloud/usage/dao/UsageJobDaoImpl.java b/engine/schema/src/main/java/com/cloud/usage/dao/UsageJobDaoImpl.java
index 44a7d1a8b727..6f340501cf18 100644
--- a/engine/schema/src/main/java/com/cloud/usage/dao/UsageJobDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/usage/dao/UsageJobDaoImpl.java
@@ -156,7 +156,8 @@ public UsageJobVO getLastJob() {
         return jobs.get(0);
     }
 
-    private UsageJobVO getNextRecurringJob() {
+    @Override
+    public UsageJobVO getNextRecurringJob() {
         Filter filter = new Filter(UsageJobVO.class, "id", false, Long.valueOf(0), Long.valueOf(1));
         SearchCriteria<UsageJobVO> sc = createSearchCriteria();
         sc.addAnd("endMillis", SearchCriteria.Op.EQ, Long.valueOf(0));
diff --git a/usage/src/main/java/com/cloud/usage/UsageManagerImpl.java b/usage/src/main/java/com/cloud/usage/UsageManagerImpl.java
index 99de98f56e4a..30cdfcf21f08 100644
--- a/usage/src/main/java/com/cloud/usage/UsageManagerImpl.java
+++ b/usage/src/main/java/com/cloud/usage/UsageManagerImpl.java
@@ -2257,6 +2257,11 @@ protected void runInContext() {
                         }
                     }
 
+                    if (_usageJobDao.getNextRecurringJob() == null) {
+                        // Own the usage processing immediately if no other node is owning it
+                        _usageJobDao.createNewJob(_hostname, _pid, UsageJobVO.JOB_TYPE_RECURRING);
+                    }
+
                     Long jobId = _usageJobDao.checkHeartbeat(_hostname, _pid, _aggregationDuration);
                     if (jobId != null) {
                         // if I'm taking over the job...see how long it's been since the last job, and if it's more than the

From 059debf212500c789d062abe7be00448a1744824 Mon Sep 17 00:00:00 2001
From: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
Date: Wed, 28 Jan 2026 19:39:37 +0530
Subject: [PATCH 073/117] Add the procedure files for insert extensions and
 update guest os category (#12482)

* Add the procedure files for insert extensions and update guestos category

* fixed indentation

* Apply suggestions from code review

Co-authored-by: Vishesh <8760112+vishesh92@users.noreply.github.com>

---------

Co-authored-by: Vishesh <8760112+vishesh92@users.noreply.github.com>
---
 .../cloud.insert_category_if_not_exists.sql   | 27 +++++++++++
 ...on_custom_action_details_if_not_exists.sql | 46 +++++++++++++++++++
 ..._extension_custom_action_if_not_exists.sql | 46 +++++++++++++++++++
 ....insert_extension_detail_if_not_exists.sql | 39 ++++++++++++++++
 .../cloud.insert_extension_if_not_exists.sql  | 38 +++++++++++++++
 .../cloud.update_category_for_guest_oses.sql  | 33 +++++++++++++
 ...w_and_delete_old_category_for_guest_os.sql | 35 ++++++++++++++
 7 files changed, 264 insertions(+)
 create mode 100644 engine/schema/src/main/resources/META-INF/db/procedures/cloud.insert_category_if_not_exists.sql
 create mode 100644 engine/schema/src/main/resources/META-INF/db/procedures/cloud.insert_extension_custom_action_details_if_not_exists.sql
 create mode 100644 engine/schema/src/main/resources/META-INF/db/procedures/cloud.insert_extension_custom_action_if_not_exists.sql
 create mode 100644 engine/schema/src/main/resources/META-INF/db/procedures/cloud.insert_extension_detail_if_not_exists.sql
 create mode 100644 engine/schema/src/main/resources/META-INF/db/procedures/cloud.insert_extension_if_not_exists.sql
 create mode 100644 engine/schema/src/main/resources/META-INF/db/procedures/cloud.update_category_for_guest_oses.sql
 create mode 100644 engine/schema/src/main/resources/META-INF/db/procedures/cloud.update_new_and_delete_old_category_for_guest_os.sql

diff --git a/engine/schema/src/main/resources/META-INF/db/procedures/cloud.insert_category_if_not_exists.sql b/engine/schema/src/main/resources/META-INF/db/procedures/cloud.insert_category_if_not_exists.sql
new file mode 100644
index 000000000000..a82dc7204c2e
--- /dev/null
+++ b/engine/schema/src/main/resources/META-INF/db/procedures/cloud.insert_category_if_not_exists.sql
@@ -0,0 +1,27 @@
+-- Licensed to the Apache Software Foundation (ASF) under one
+-- or more contributor license agreements.  See the NOTICE file
+-- distributed with this work for additional information
+-- regarding copyright ownership.  The ASF licenses this file
+-- to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance
+-- with the License.  You may obtain a copy of the License at
+--
+--   http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing,
+-- software distributed under the License is distributed on an
+-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+-- KIND, either express or implied.  See the License for the
+-- specific language governing permissions and limitations
+-- under the License.
+
+-- Add new OS categories if not present
+DROP PROCEDURE IF EXISTS `cloud`.`INSERT_CATEGORY_IF_NOT_EXIST`;
+CREATE PROCEDURE `cloud`.`INSERT_CATEGORY_IF_NOT_EXIST`(IN os_name VARCHAR(255))
+BEGIN
+    IF NOT EXISTS ((SELECT 1 FROM `cloud`.`guest_os_category` WHERE name = os_name))
+    THEN
+        INSERT INTO `cloud`.`guest_os_category` (name, uuid)
+            VALUES (os_name, UUID())
+;   END IF
+; END;
diff --git a/engine/schema/src/main/resources/META-INF/db/procedures/cloud.insert_extension_custom_action_details_if_not_exists.sql b/engine/schema/src/main/resources/META-INF/db/procedures/cloud.insert_extension_custom_action_details_if_not_exists.sql
new file mode 100644
index 000000000000..77b162236266
--- /dev/null
+++ b/engine/schema/src/main/resources/META-INF/db/procedures/cloud.insert_extension_custom_action_details_if_not_exists.sql
@@ -0,0 +1,46 @@
+-- Licensed to the Apache Software Foundation (ASF) under one
+-- or more contributor license agreements.  See the NOTICE file
+-- distributed with this work for additional information
+-- regarding copyright ownership.  The ASF licenses this file
+-- to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance
+-- with the License.  You may obtain a copy of the License at
+--
+--   http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing,
+-- software distributed under the License is distributed on an
+-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+-- KIND, either express or implied.  See the License for the
+-- specific language governing permissions and limitations
+-- under the License.
+
+DROP PROCEDURE IF EXISTS `cloud`.`INSERT_EXTENSION_CUSTOM_ACTION_DETAILS_IF_NOT_EXISTS`;
+CREATE PROCEDURE `cloud`.`INSERT_EXTENSION_CUSTOM_ACTION_DETAILS_IF_NOT_EXISTS` (
+    IN ext_name VARCHAR(255),
+    IN action_name VARCHAR(255),
+    IN param_json TEXT
+)
+BEGIN
+    DECLARE action_id BIGINT UNSIGNED
+;   SELECT `eca`.`id` INTO action_id FROM `cloud`.`extension_custom_action` `eca`
+    JOIN `cloud`.`extension` `e` ON `e`.`id` = `eca`.`extension_id`
+    WHERE `eca`.`name` = action_name AND `e`.`name` = ext_name LIMIT 1
+;   IF NOT EXISTS (
+        SELECT 1 FROM `cloud`.`extension_custom_action_details`
+        WHERE `extension_custom_action_id` = action_id
+          AND `name` = 'parameters'
+    ) THEN
+        INSERT INTO `cloud`.`extension_custom_action_details` (
+            `extension_custom_action_id`,
+            `name`,
+            `value`,
+            `display`
+        ) VALUES (
+            action_id,
+            'parameters',
+            param_json,
+            0
+        )
+;   END IF
+;END;
diff --git a/engine/schema/src/main/resources/META-INF/db/procedures/cloud.insert_extension_custom_action_if_not_exists.sql b/engine/schema/src/main/resources/META-INF/db/procedures/cloud.insert_extension_custom_action_if_not_exists.sql
new file mode 100644
index 000000000000..9dbffa630f84
--- /dev/null
+++ b/engine/schema/src/main/resources/META-INF/db/procedures/cloud.insert_extension_custom_action_if_not_exists.sql
@@ -0,0 +1,46 @@
+-- Licensed to the Apache Software Foundation (ASF) under one
+-- or more contributor license agreements.  See the NOTICE file
+-- distributed with this work for additional information
+-- regarding copyright ownership.  The ASF licenses this file
+-- to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance
+-- with the License.  You may obtain a copy of the License at
+--
+--   http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing,
+-- software distributed under the License is distributed on an
+-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+-- KIND, either express or implied.  See the License for the
+-- specific language governing permissions and limitations
+-- under the License.
+
+DROP PROCEDURE IF EXISTS `cloud`.`INSERT_EXTENSION_CUSTOM_ACTION_IF_NOT_EXISTS`;
+CREATE PROCEDURE `cloud`.`INSERT_EXTENSION_CUSTOM_ACTION_IF_NOT_EXISTS`(
+    IN ext_name VARCHAR(255),
+    IN action_name VARCHAR(255),
+    IN action_desc VARCHAR(4096),
+    IN resource_type VARCHAR(255),
+    IN allowed_roles INT UNSIGNED,
+    IN success_msg VARCHAR(4096),
+    IN error_msg VARCHAR(4096),
+    IN timeout_seconds INT UNSIGNED
+)
+BEGIN
+    DECLARE ext_id BIGINT
+;   SELECT `id` INTO ext_id FROM `cloud`.`extension` WHERE `name` = ext_name LIMIT 1
+;   IF NOT EXISTS (
+        SELECT 1 FROM `cloud`.`extension_custom_action` WHERE `name` = action_name AND `extension_id` = ext_id
+    ) THEN
+        INSERT INTO `cloud`.`extension_custom_action` (
+            `uuid`, `name`, `description`, `extension_id`, `resource_type`,
+            `allowed_role_types`, `success_message`, `error_message`,
+            `enabled`, `timeout`, `created`, `removed`
+        )
+        VALUES (
+            UUID(), action_name, action_desc, ext_id, resource_type,
+            allowed_roles, success_msg, error_msg,
+            1, timeout_seconds, NOW(), NULL
+        )
+;   END IF
+;END;
diff --git a/engine/schema/src/main/resources/META-INF/db/procedures/cloud.insert_extension_detail_if_not_exists.sql b/engine/schema/src/main/resources/META-INF/db/procedures/cloud.insert_extension_detail_if_not_exists.sql
new file mode 100644
index 000000000000..f9d6c5da9512
--- /dev/null
+++ b/engine/schema/src/main/resources/META-INF/db/procedures/cloud.insert_extension_detail_if_not_exists.sql
@@ -0,0 +1,39 @@
+-- Licensed to the Apache Software Foundation (ASF) under one
+-- or more contributor license agreements.  See the NOTICE file
+-- distributed with this work for additional information
+-- regarding copyright ownership.  The ASF licenses this file
+-- to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance
+-- with the License.  You may obtain a copy of the License at
+--
+--   http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing,
+-- software distributed under the License is distributed on an
+-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+-- KIND, either express or implied.  See the License for the
+-- specific language governing permissions and limitations
+-- under the License.
+
+DROP PROCEDURE IF EXISTS `cloud`.`INSERT_EXTENSION_DETAIL_IF_NOT_EXISTS`;
+CREATE PROCEDURE `cloud`.`INSERT_EXTENSION_DETAIL_IF_NOT_EXISTS`(
+    IN ext_name VARCHAR(255),
+    IN detail_key VARCHAR(255),
+    IN detail_value TEXT,
+    IN display TINYINT(1)
+)
+BEGIN
+    DECLARE ext_id BIGINT
+;   SELECT `id` INTO ext_id FROM `cloud`.`extension` WHERE `name` = ext_name LIMIT 1
+;   IF NOT EXISTS (
+        SELECT 1 FROM `cloud`.`extension_details`
+        WHERE `extension_id` = ext_id AND `name` = detail_key
+    ) THEN
+        INSERT INTO `cloud`.`extension_details` (
+            `extension_id`, `name`, `value`, `display`
+        )
+        VALUES (
+            ext_id, detail_key, detail_value, display
+        )
+;   END IF
+;END;
diff --git a/engine/schema/src/main/resources/META-INF/db/procedures/cloud.insert_extension_if_not_exists.sql b/engine/schema/src/main/resources/META-INF/db/procedures/cloud.insert_extension_if_not_exists.sql
new file mode 100644
index 000000000000..8d74f9b2a986
--- /dev/null
+++ b/engine/schema/src/main/resources/META-INF/db/procedures/cloud.insert_extension_if_not_exists.sql
@@ -0,0 +1,38 @@
+-- Licensed to the Apache Software Foundation (ASF) under one
+-- or more contributor license agreements.  See the NOTICE file
+-- distributed with this work for additional information
+-- regarding copyright ownership.  The ASF licenses this file
+-- to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance
+-- with the License.  You may obtain a copy of the License at
+--
+--   http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing,
+-- software distributed under the License is distributed on an
+-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+-- KIND, either express or implied.  See the License for the
+-- specific language governing permissions and limitations
+-- under the License.
+
+DROP PROCEDURE IF EXISTS `cloud`.`INSERT_EXTENSION_IF_NOT_EXISTS`;
+CREATE PROCEDURE `cloud`.`INSERT_EXTENSION_IF_NOT_EXISTS`(
+    IN ext_name VARCHAR(255),
+    IN ext_desc VARCHAR(255),
+    IN ext_path VARCHAR(255)
+)
+BEGIN
+    IF NOT EXISTS (
+        SELECT 1 FROM `cloud`.`extension` WHERE `name` = ext_name
+    ) THEN
+        INSERT INTO `cloud`.`extension` (
+            `uuid`, `name`, `description`, `type`,
+            `relative_path`, `path_ready`,
+            `is_user_defined`, `state`, `created`, `removed`
+        )
+        VALUES (
+            UUID(), ext_name, ext_desc, 'Orchestrator',
+            ext_path, 1, 0, 'Enabled', NOW(), NULL
+        )
+;   END IF
+;END;
diff --git a/engine/schema/src/main/resources/META-INF/db/procedures/cloud.update_category_for_guest_oses.sql b/engine/schema/src/main/resources/META-INF/db/procedures/cloud.update_category_for_guest_oses.sql
new file mode 100644
index 000000000000..87f3a85d27ef
--- /dev/null
+++ b/engine/schema/src/main/resources/META-INF/db/procedures/cloud.update_category_for_guest_oses.sql
@@ -0,0 +1,33 @@
+-- Licensed to the Apache Software Foundation (ASF) under one
+-- or more contributor license agreements.  See the NOTICE file
+-- distributed with this work for additional information
+-- regarding copyright ownership.  The ASF licenses this file
+-- to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance
+-- with the License.  You may obtain a copy of the License at
+--
+--   http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing,
+-- software distributed under the License is distributed on an
+-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+-- KIND, either express or implied.  See the License for the
+-- specific language governing permissions and limitations
+-- under the License.
+
+-- Move existing guest OS to new categories
+DROP PROCEDURE IF EXISTS `cloud`.`UPDATE_CATEGORY_FOR_GUEST_OSES`;
+CREATE PROCEDURE `cloud`.`UPDATE_CATEGORY_FOR_GUEST_OSES`(IN category_name VARCHAR(255), IN os_name VARCHAR(255))
+BEGIN
+    DECLARE category_id BIGINT
+;   SELECT `id` INTO category_id
+    FROM `cloud`.`guest_os_category`
+    WHERE `name` = category_name
+    LIMIT 1
+;   IF category_id IS NULL THEN
+        SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = 'Category not found'
+;   END IF
+;   UPDATE `cloud`.`guest_os`
+    SET `category_id` = category_id
+    WHERE `display_name` LIKE CONCAT('%', os_name, '%')
+; END;
diff --git a/engine/schema/src/main/resources/META-INF/db/procedures/cloud.update_new_and_delete_old_category_for_guest_os.sql b/engine/schema/src/main/resources/META-INF/db/procedures/cloud.update_new_and_delete_old_category_for_guest_os.sql
new file mode 100644
index 000000000000..42f7aa738cff
--- /dev/null
+++ b/engine/schema/src/main/resources/META-INF/db/procedures/cloud.update_new_and_delete_old_category_for_guest_os.sql
@@ -0,0 +1,35 @@
+-- Licensed to the Apache Software Foundation (ASF) under one
+-- or more contributor license agreements.  See the NOTICE file
+-- distributed with this work for additional information
+-- regarding copyright ownership.  The ASF licenses this file
+-- to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance
+-- with the License.  You may obtain a copy of the License at
+--
+--   http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing,
+-- software distributed under the License is distributed on an
+-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+-- KIND, either express or implied.  See the License for the
+-- specific language governing permissions and limitations
+-- under the License.
+
+-- Move existing guest OS whose category will be deleted to Other category
+DROP PROCEDURE IF EXISTS `cloud`.`UPDATE_NEW_AND_DELETE_OLD_CATEGORY_FOR_GUEST_OS`;
+CREATE PROCEDURE `cloud`.`UPDATE_NEW_AND_DELETE_OLD_CATEGORY_FOR_GUEST_OS`(IN to_category_name VARCHAR(255), IN from_category_name VARCHAR(255))
+BEGIN
+    DECLARE done INT DEFAULT 0
+;   DECLARE to_category_id BIGINT
+;   SELECT id INTO to_category_id
+    FROM `cloud`.`guest_os_category`
+    WHERE `name` = to_category_name
+    LIMIT 1
+;   IF to_category_id IS NULL THEN
+        SIGNAL SQLSTATE '45000' SET MESSAGE_TEXT = 'ToCategory not found'
+;   END IF
+;   UPDATE `cloud`.`guest_os`
+    SET `category_id` = to_category_id
+    WHERE `category_id` = (SELECT `id` FROM `cloud`.`guest_os_category` WHERE `name` = from_category_name)
+;   UPDATE `cloud`.`guest_os_category` SET `removed`=now() WHERE `name` = from_category_name
+; END;

From 9956d325488246a1b6dd0d33398471c0c698de49 Mon Sep 17 00:00:00 2001
From: Daman Arora <61474540+Damans227@users.noreply.github.com>
Date: Wed, 28 Jan 2026 09:11:14 -0500
Subject: [PATCH 074/117] Fix delete snapshot policy expunged volume (#12474)

* use findByIdIncludingRemoved for volume retrieval in snapshot policy validation

* add unit tests

* add cleanup for orphan snapshot policies

* delete snapshot policies when expunging volumes

* update orphan cleanup to remove policies for volumes that are in expunged state or null

---------

Co-authored-by: Daman Arora <daman.arora@shapeblue.com>
---
 .../storage/volume/VolumeServiceImpl.java     |  4 +-
 .../storage/snapshot/SnapshotManagerImpl.java | 18 +++-
 .../snapshot/SnapshotManagerImplTest.java     | 92 +++++++++++++++++++
 3 files changed, 112 insertions(+), 2 deletions(-)

diff --git a/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/volume/VolumeServiceImpl.java b/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/volume/VolumeServiceImpl.java
index c59ae5b18e33..5e0eb7529acb 100644
--- a/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/volume/VolumeServiceImpl.java
+++ b/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/volume/VolumeServiceImpl.java
@@ -387,6 +387,7 @@ public AsyncCallFuture<VolumeApiResult> expungeVolumeAsync(VolumeInfo volume) {
             logger.info("Expunge volume with no data store specified");
             if (canVolumeBeRemoved(volume.getId())) {
                 logger.info("Volume {} is not referred anywhere, remove it from volumes table", volume);
+                snapshotMgr.deletePoliciesForVolume(volume.getId());
                 volDao.remove(volume.getId());
             }
             future.complete(result);
@@ -422,6 +423,7 @@ public AsyncCallFuture<VolumeApiResult> expungeVolumeAsync(VolumeInfo volume) {
                 }
                 VMTemplateVO template = templateDao.findById(vol.getTemplateId());
                 if (template != null && !template.isDeployAsIs()) {
+                    snapshotMgr.deletePoliciesForVolume(vol.getId());
                     volDao.remove(vol.getId());
                     future.complete(result);
                     return future;
@@ -493,6 +495,7 @@ public Void deleteVolumeCallback(AsyncCallbackDispatcher<VolumeServiceImpl, Comm
 
                 if (canVolumeBeRemoved(vo.getId())) {
                     logger.info("Volume {} is not referred anywhere, remove it from volumes table", vo);
+                    snapshotMgr.deletePoliciesForVolume(vo.getId());
                     volDao.remove(vo.getId());
                 }
 
@@ -1657,7 +1660,6 @@ public void destroyVolume(long volumeId) {
         // mark volume entry in volumes table as destroy state
         VolumeInfo vol = volFactory.getVolume(volumeId);
         vol.stateTransit(Volume.Event.DestroyRequested);
-        snapshotMgr.deletePoliciesForVolume(volumeId);
         annotationDao.removeByEntityType(AnnotationService.EntityType.VOLUME.name(), vol.getUuid());
 
         vol.stateTransit(Volume.Event.OperationSucceeded);
diff --git a/server/src/main/java/com/cloud/storage/snapshot/SnapshotManagerImpl.java b/server/src/main/java/com/cloud/storage/snapshot/SnapshotManagerImpl.java
index ff9989acac3e..886feea19f20 100755
--- a/server/src/main/java/com/cloud/storage/snapshot/SnapshotManagerImpl.java
+++ b/server/src/main/java/com/cloud/storage/snapshot/SnapshotManagerImpl.java
@@ -1889,9 +1889,25 @@ public boolean start() {
                 logger.debug("Failed to delete snapshot in destroying state: {}", snapshotVO);
             }
         }
+        cleanupOrphanSnapshotPolicies();
+
         return true;
     }
 
+    private void cleanupOrphanSnapshotPolicies() {
+        List<SnapshotPolicyVO> policies = _snapshotPolicyDao.listActivePolicies();
+        if (CollectionUtils.isEmpty(policies)) {
+            return;
+        }
+        for (SnapshotPolicyVO policy : policies) {
+            VolumeVO volume = _volsDao.findByIdIncludingRemoved(policy.getVolumeId());
+            if (volume == null || volume.getState() == Volume.State.Expunged) {
+                logger.info("Removing orphan snapshot policy {} for non-existent volume {}", policy.getId(), policy.getVolumeId());
+                deletePolicy(policy.getId());
+            }
+        }
+    }
+
     @Override
     public boolean stop() {
         backupSnapshotExecutor.shutdown();
@@ -1924,7 +1940,7 @@ public boolean deleteSnapshotPolicies(DeleteSnapshotPoliciesCmd cmd) {
             if (snapshotPolicyVO == null) {
                 throw new InvalidParameterValueException("Policy id given: " + policy + " does not exist");
             }
-            VolumeVO volume = _volsDao.findById(snapshotPolicyVO.getVolumeId());
+            VolumeVO volume = _volsDao.findByIdIncludingRemoved(snapshotPolicyVO.getVolumeId());
             if (volume == null) {
                 throw new InvalidParameterValueException("Policy id given: " + policy + " does not belong to a valid volume");
             }
diff --git a/server/src/test/java/com/cloud/storage/snapshot/SnapshotManagerImplTest.java b/server/src/test/java/com/cloud/storage/snapshot/SnapshotManagerImplTest.java
index 367a49a801ff..2d3cb04ab962 100644
--- a/server/src/test/java/com/cloud/storage/snapshot/SnapshotManagerImplTest.java
+++ b/server/src/test/java/com/cloud/storage/snapshot/SnapshotManagerImplTest.java
@@ -30,6 +30,7 @@
 import com.cloud.storage.SnapshotPolicyVO;
 import com.cloud.storage.SnapshotVO;
 import com.cloud.storage.VolumeVO;
+import com.cloud.server.TaggedResourceService;
 import com.cloud.storage.dao.SnapshotDao;
 import com.cloud.storage.dao.SnapshotPolicyDao;
 import com.cloud.storage.dao.SnapshotZoneDao;
@@ -44,6 +45,7 @@
 
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
+import org.apache.cloudstack.api.command.user.snapshot.DeleteSnapshotPoliciesCmd;
 import org.apache.cloudstack.api.command.user.snapshot.ListSnapshotPoliciesCmd;
 import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.engine.subsystem.api.storage.CreateCmdResult;
@@ -100,6 +102,10 @@ public class SnapshotManagerImplTest {
     VolumeDao volumeDao;
     @Mock
     SnapshotPolicyDao snapshotPolicyDao;
+    @Mock
+    SnapshotScheduler snapshotScheduler;
+    @Mock
+    TaggedResourceService taggedResourceService;
     @InjectMocks
     SnapshotManagerImpl snapshotManager = new SnapshotManagerImpl();
 
@@ -108,6 +114,8 @@ public void setUp() {
         snapshotManager._snapshotPolicyDao = snapshotPolicyDao;
         snapshotManager._volsDao = volumeDao;
         snapshotManager._accountMgr = accountManager;
+        snapshotManager._snapSchedMgr = snapshotScheduler;
+        snapshotManager.taggedResourceService = taggedResourceService;
     }
 
     @After
@@ -520,4 +528,88 @@ public void testListSnapshotPolicies_RootAdmin() {
         Assert.assertEquals(1, result.first().size());
         Assert.assertEquals(Integer.valueOf(1), result.second());
     }
+
+    @Test
+    public void testDeleteSnapshotPoliciesForRemovedVolume() {
+        Long policyId = 1L;
+        Long volumeId = 10L;
+        Long accountId = 2L;
+
+        DeleteSnapshotPoliciesCmd cmd = Mockito.mock(DeleteSnapshotPoliciesCmd.class);
+        Mockito.when(cmd.getId()).thenReturn(policyId);
+        Mockito.when(cmd.getIds()).thenReturn(null);
+
+        Account caller = Mockito.mock(Account.class);
+        Mockito.when(caller.getId()).thenReturn(accountId);
+        CallContext.register(Mockito.mock(User.class), caller);
+
+        SnapshotPolicyVO policyVO = Mockito.mock(SnapshotPolicyVO.class);
+        Mockito.when(policyVO.getId()).thenReturn(policyId);
+        Mockito.when(policyVO.getVolumeId()).thenReturn(volumeId);
+        Mockito.when(policyVO.getUuid()).thenReturn("policy-uuid");
+        Mockito.when(snapshotPolicyDao.findById(policyId)).thenReturn(policyVO);
+
+        // Volume is removed (expunged) but findByIdIncludingRemoved should still return it
+        VolumeVO volumeVO = Mockito.mock(VolumeVO.class);
+        Mockito.when(volumeDao.findByIdIncludingRemoved(volumeId)).thenReturn(volumeVO);
+
+        Mockito.when(snapshotPolicyDao.remove(policyId)).thenReturn(true);
+
+        boolean result = snapshotManager.deleteSnapshotPolicies(cmd);
+
+        Assert.assertTrue(result);
+        Mockito.verify(volumeDao).findByIdIncludingRemoved(volumeId);
+        Mockito.verify(snapshotScheduler).removeSchedule(volumeId, policyId);
+        Mockito.verify(snapshotPolicyDao).remove(policyId);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testDeleteSnapshotPoliciesNoPolicyId() {
+        DeleteSnapshotPoliciesCmd cmd = Mockito.mock(DeleteSnapshotPoliciesCmd.class);
+        Mockito.when(cmd.getId()).thenReturn(null);
+        Mockito.when(cmd.getIds()).thenReturn(null);
+
+        snapshotManager.deleteSnapshotPolicies(cmd);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testDeleteSnapshotPoliciesPolicyNotFound() {
+        Long policyId = 1L;
+
+        DeleteSnapshotPoliciesCmd cmd = Mockito.mock(DeleteSnapshotPoliciesCmd.class);
+        Mockito.when(cmd.getId()).thenReturn(policyId);
+        Mockito.when(cmd.getIds()).thenReturn(null);
+
+        Mockito.when(snapshotPolicyDao.findById(policyId)).thenReturn(null);
+
+        snapshotManager.deleteSnapshotPolicies(cmd);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testDeleteSnapshotPoliciesVolumeNotFound() {
+        Long policyId = 1L;
+        Long volumeId = 10L;
+
+        DeleteSnapshotPoliciesCmd cmd = Mockito.mock(DeleteSnapshotPoliciesCmd.class);
+        Mockito.when(cmd.getId()).thenReturn(policyId);
+        Mockito.when(cmd.getIds()).thenReturn(null);
+
+        SnapshotPolicyVO policyVO = Mockito.mock(SnapshotPolicyVO.class);
+        Mockito.when(policyVO.getVolumeId()).thenReturn(volumeId);
+        Mockito.when(snapshotPolicyDao.findById(policyId)).thenReturn(policyVO);
+
+        // Volume doesn't exist at all (even when including removed)
+        Mockito.when(volumeDao.findByIdIncludingRemoved(volumeId)).thenReturn(null);
+
+        snapshotManager.deleteSnapshotPolicies(cmd);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testDeleteSnapshotPoliciesManualPolicyId() {
+        DeleteSnapshotPoliciesCmd cmd = Mockito.mock(DeleteSnapshotPoliciesCmd.class);
+        Mockito.when(cmd.getId()).thenReturn(Snapshot.MANUAL_POLICY_ID);
+        Mockito.when(cmd.getIds()).thenReturn(null);
+
+        snapshotManager.deleteSnapshotPolicies(cmd);
+    }
 }

From 7786cf93c28fec5e5baf5d069f4f4d08e1750ab8 Mon Sep 17 00:00:00 2001
From: Pearl Dsilva <pearl1594@gmail.com>
Date: Wed, 28 Jan 2026 09:13:56 -0500
Subject: [PATCH 075/117] Veeam: Use restore timeout as an interval as opposed
 to a counter (#11772)

* Veeam: Use restore timeout as a time interval as opposed to a counter

* fix log

* fix unit test

* remove unused imports

* fix comment

* unused import

* change to while - issure refactoring
---
 .../org/apache/cloudstack/backup/veeam/VeeamClient.java    | 7 +++++--
 .../apache/cloudstack/backup/veeam/VeeamClientTest.java    | 5 ++---
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/plugins/backup/veeam/src/main/java/org/apache/cloudstack/backup/veeam/VeeamClient.java b/plugins/backup/veeam/src/main/java/org/apache/cloudstack/backup/veeam/VeeamClient.java
index fe3633dab161..8a111f928680 100644
--- a/plugins/backup/veeam/src/main/java/org/apache/cloudstack/backup/veeam/VeeamClient.java
+++ b/plugins/backup/veeam/src/main/java/org/apache/cloudstack/backup/veeam/VeeamClient.java
@@ -364,7 +364,9 @@ private boolean checkTaskStatus(final HttpResponse response) throws IOException
      * that is used to wait for the restore to complete before throwing a {@link CloudRuntimeException}.
      */
     protected void checkIfRestoreSessionFinished(String type, String path) throws IOException {
-        for (int j = 0; j < restoreTimeout; j++) {
+        long startTime = System.currentTimeMillis();
+        long timeoutMs = restoreTimeout * 1000L;
+        while (System.currentTimeMillis() - startTime < timeoutMs) {
             HttpResponse relatedResponse = get(path);
             RestoreSession session = parseRestoreSessionResponse(relatedResponse);
             if (session.getResult().equals("Success")) {
@@ -378,7 +380,8 @@ protected void checkIfRestoreSessionFinished(String type, String path) throws IO
                         getRestoreVmErrorDescription(StringUtils.substringAfterLast(sessionUid, ":"))));
                 throw new CloudRuntimeException(String.format("Restore job [%s] failed.", sessionUid));
             }
-            logger.debug(String.format("Waiting %s seconds, out of a total of %s seconds, for the restore backup process to finish.", j, restoreTimeout));
+            logger.debug("Waiting {} seconds, out of a total of {} seconds, for the restore backup process to finish.",
+                    (System.currentTimeMillis() - startTime) / 1000, restoreTimeout);
 
             try {
                 Thread.sleep(1000);
diff --git a/plugins/backup/veeam/src/test/java/org/apache/cloudstack/backup/veeam/VeeamClientTest.java b/plugins/backup/veeam/src/test/java/org/apache/cloudstack/backup/veeam/VeeamClientTest.java
index 0c70c75939ef..333c3e16053a 100644
--- a/plugins/backup/veeam/src/test/java/org/apache/cloudstack/backup/veeam/VeeamClientTest.java
+++ b/plugins/backup/veeam/src/test/java/org/apache/cloudstack/backup/veeam/VeeamClientTest.java
@@ -25,7 +25,6 @@
 import static com.github.tomakehurst.wiremock.client.WireMock.urlMatching;
 import static com.github.tomakehurst.wiremock.client.WireMock.verify;
 import static org.junit.Assert.fail;
-import static org.mockito.Mockito.times;
 
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
@@ -157,7 +156,7 @@ public void getRepositoryNameFromJobTestSuccess() throws Exception {
     @Test
     public void checkIfRestoreSessionFinishedTestTimeoutException() throws IOException {
         try {
-            ReflectionTestUtils.setField(mockClient, "restoreTimeout", 10);
+            ReflectionTestUtils.setField(mockClient, "restoreTimeout", 2);
             RestoreSession restoreSession = Mockito.mock(RestoreSession.class);
             HttpResponse httpResponse = Mockito.mock(HttpResponse.class);
             Mockito.when(mockClient.get(Mockito.anyString())).thenReturn(httpResponse);
@@ -169,7 +168,7 @@ public void checkIfRestoreSessionFinishedTestTimeoutException() throws IOExcepti
         } catch (Exception e) {
             Assert.assertEquals("Related job type: RestoreTest was not successful", e.getMessage());
         }
-        Mockito.verify(mockClient, times(10)).get(Mockito.anyString());
+        Mockito.verify(mockClient, Mockito.atLeastOnce()).get(Mockito.anyString());
     }
 
     @Test

From d83c2e42253c870955a05a386db5ec266e04a3f3 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 28 Jan 2026 15:30:46 +0100
Subject: [PATCH 076/117] Bump com.vmware.vapi:vapi-runtime from 2.40.0 to
 2.61.2 (#12495)

---
 plugins/network-elements/nsx/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/network-elements/nsx/pom.xml b/plugins/network-elements/nsx/pom.xml
index e6431d074cac..9c0f680068c9 100644
--- a/plugins/network-elements/nsx/pom.xml
+++ b/plugins/network-elements/nsx/pom.xml
@@ -59,7 +59,7 @@
         <dependency>
             <groupId>com.vmware.vapi</groupId>
             <artifactId>vapi-runtime</artifactId>
-            <version>2.40.0</version>
+            <version>2.61.2</version>
         </dependency>
     </dependencies>
 </project>

From 1300fc5e91ac0c6ab57dbd35bb083944e9f94cef Mon Sep 17 00:00:00 2001
From: Jeevan <jeevanyewale4@gmail.com>
Date: Wed, 28 Jan 2026 20:56:37 +0530
Subject: [PATCH 077/117] Fix keyword parameter filtering in
 listBackupOfferings API (#12540)

Signed-off-by: Jeevan Yewale <jeevanyewale4@gmial.com>
Co-authored-by: Jeevan Yewale <jeevanyewale4@gmial.com>
---
 .../java/org/apache/cloudstack/backup/BackupManagerImpl.java   | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java b/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
index 1e6ef1a7852b..dc2677a507f0 100644
--- a/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
@@ -239,7 +239,8 @@ public Pair<List<BackupOffering>, Integer> listBackupOfferings(final ListBackupO
         final Filter searchFilter = new Filter(BackupOfferingVO.class, "id", true, cmd.getStartIndex(), cmd.getPageSizeVal());
         SearchBuilder<BackupOfferingVO> sb = backupOfferingDao.createSearchBuilder();
         sb.and("zone_id", sb.entity().getZoneId(), SearchCriteria.Op.EQ);
-        sb.and("name", sb.entity().getName(), SearchCriteria.Op.EQ);
+        sb.and("name", sb.entity().getName(), SearchCriteria.Op.LIKE);
+
         CallContext ctx = CallContext.current();
         final Account caller = ctx.getCallingAccount();
         if (Account.Type.NORMAL == caller.getType()) {

From 106f478e2c988a6cddbf302e1e83e5c344b53464 Mon Sep 17 00:00:00 2001
From: Harikrishna <harikrishna.patnala@gmail.com>
Date: Wed, 28 Jan 2026 22:46:38 +0530
Subject: [PATCH 078/117] Remove unnecessary stubbings in
 ManagementServerMaintenanceManagerImplTest (#11914)

---
 .../maintenance/ManagementServerMaintenanceManagerImplTest.java | 2 --
 1 file changed, 2 deletions(-)

diff --git a/plugins/maintenance/src/test/java/org/apache/cloudstack/maintenance/ManagementServerMaintenanceManagerImplTest.java b/plugins/maintenance/src/test/java/org/apache/cloudstack/maintenance/ManagementServerMaintenanceManagerImplTest.java
index 280d1eaf9eb9..a208893f6d1b 100644
--- a/plugins/maintenance/src/test/java/org/apache/cloudstack/maintenance/ManagementServerMaintenanceManagerImplTest.java
+++ b/plugins/maintenance/src/test/java/org/apache/cloudstack/maintenance/ManagementServerMaintenanceManagerImplTest.java
@@ -321,7 +321,6 @@ public void prepareForMaintenanceAndCancelFromMaintenanceState() {
             spy.prepareForMaintenance("static", false);
         });
 
-        Mockito.when(msHost.getState()).thenReturn(ManagementServerHost.State.Maintenance);
         Mockito.doNothing().when(jobManagerMock).enableAsyncJobs();
         spy.cancelMaintenance();
         Mockito.verify(jobManagerMock).enableAsyncJobs();
@@ -339,7 +338,6 @@ public void prepareForMaintenanceAndCancelFromPreparingForMaintenanceState() {
             spy.prepareForMaintenance("static", false);
         });
 
-        Mockito.when(msHost.getState()).thenReturn(ManagementServerHost.State.PreparingForMaintenance);
         Mockito.doNothing().when(jobManagerMock).enableAsyncJobs();
         spy.cancelMaintenance();
         Mockito.verify(jobManagerMock).enableAsyncJobs();

From 98debd235f99c2e6e0f49b69f7b16b5e3b9b0853 Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Thu, 29 Jan 2026 10:35:32 +0530
Subject: [PATCH 079/117] gha: fix duplicate key for stale workflow

Fixes failing pre-commit GHA

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
---
 .github/workflows/stale.yml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index c957392c5046..842e4497a4ad 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -41,7 +41,6 @@ jobs:
           days-before-pr-close: 240
           exempt-issue-labels: 'gsoc,good-first-issue,long-term-plan'
           exempt-pr-labels: 'status:ready-for-merge,status:needs-testing,status:on-hold'
-          days-before-close: -1
       - uses: actions/stale@v10
         with:
           stale-issue-label: 'archive'

From 243872a77103494b3c030439e4ee24071a03ef2a Mon Sep 17 00:00:00 2001
From: Vishesh <8760112+vishesh92@users.noreply.github.com>
Date: Thu, 29 Jan 2026 11:40:23 +0530
Subject: [PATCH 080/117] Use infinite scroll select (#11991)

* addresses the domain selection (listed after the page size) with keyword search
---
 ui/src/components/view/DedicateDomain.vue     | 129 +++++-----
 .../widgets/InfiniteScrollSelect.vue          |  91 ++++++-
 ui/src/views/iam/AddUser.vue                  | 121 ++++------
 ui/src/views/infra/UsageRecords.vue           | 112 ++++-----
 ui/src/views/storage/CreateTemplate.vue       | 111 ++++-----
 ui/src/views/storage/UploadLocalVolume.vue    | 225 +++++++-----------
 ui/src/views/storage/UploadVolume.vue         | 216 +++++++----------
 ui/src/views/tools/CreateWebhook.vue          | 124 ++++------
 ui/src/views/tools/ManageVolumes.vue          | 157 +++++-------
 9 files changed, 558 insertions(+), 728 deletions(-)

diff --git a/ui/src/components/view/DedicateDomain.vue b/ui/src/components/view/DedicateDomain.vue
index 0b3645ce4183..4b8cc31ae46e 100644
--- a/ui/src/components/view/DedicateDomain.vue
+++ b/ui/src/components/view/DedicateDomain.vue
@@ -18,52 +18,44 @@
 <template>
   <div class="form">
     <div class="form__item" :class="{'error': domainError}">
-      <a-spin :spinning="domainsLoading">
-        <p class="form__label">{{ $t('label.domain') }}<span class="required">*</span></p>
-        <p class="required required-label">{{ $t('label.required') }}</p>
-        <a-select
-          style="width: 100%"
-          showSearch
-          optionFilterProp="label"
-          :filterOption="(input, option) => {
-            return option.label.toLowerCase().indexOf(input.toLowerCase()) >= 0
-          }"
-          @change="handleChangeDomain"
-          v-focus="true"
-          v-model:value="domainId">
-          <a-select-option
-            v-for="(domain, index) in domainsList"
-            :value="domain.id"
-            :key="index"
-            :label="domain.path || domain.name || domain.description">
-            {{ domain.path || domain.name || domain.description }}
-          </a-select-option>
-        </a-select>
-      </a-spin>
+      <p class="form__label">{{ $t('label.domain') }}<span class="required">*</span></p>
+      <p class="required required-label">{{ $t('label.required') }}</p>
+      <infinite-scroll-select
+        style="width: 100%"
+        v-model:value="domainId"
+        api="listDomains"
+        :apiParams="domainsApiParams"
+        resourceType="domain"
+        optionValueKey="id"
+        optionLabelKey="path"
+        defaultIcon="block-outlined"
+        v-focus="true"
+        @change-option-value="handleChangeDomain" />
     </div>
-    <div class="form__item" v-if="accountsList">
+    <div class="form__item">
       <p class="form__label">{{ $t('label.account') }}</p>
-      <a-select
+      <infinite-scroll-select
         style="width: 100%"
-        @change="handleChangeAccount"
-        showSearch
-        optionFilterProp="value"
-        :filterOption="(input, option) => {
-          return option.value.toLowerCase().indexOf(input.toLowerCase()) >= 0
-        }" >
-        <a-select-option v-for="(account, index) in accountsList" :value="account.name" :key="index">
-          {{ account.name }}
-        </a-select-option>
-      </a-select>
+        v-model:value="selectedAccount"
+        api="listAccounts"
+        :apiParams="accountsApiParams"
+        resourceType="account"
+        optionValueKey="name"
+        optionLabelKey="name"
+        defaultIcon="team-outlined"
+        @change-option-value="handleChangeAccount" />
     </div>
   </div>
 </template>
 
 <script>
-import { api } from '@/api'
+import InfiniteScrollSelect from '@/components/widgets/InfiniteScrollSelect.vue'
 
 export default {
   name: 'DedicateDomain',
+  components: {
+    InfiniteScrollSelect
+  },
   props: {
     error: {
       type: Boolean,
@@ -72,59 +64,48 @@ export default {
   },
   data () {
     return {
-      domainsLoading: false,
       domainId: null,
-      accountsList: null,
-      domainsList: null,
+      selectedAccount: null,
       domainError: false
     }
   },
+  computed: {
+    domainsApiParams () {
+      return {
+        listall: true,
+        details: 'min'
+      }
+    },
+    accountsApiParams () {
+      if (!this.domainId) {
+        return {
+          listall: true,
+          showicon: true
+        }
+      }
+      return {
+        showicon: true,
+        domainid: this.domainId
+      }
+    }
+  },
   watch: {
     error () {
       this.domainError = this.error
     }
   },
   created () {
-    this.fetchData()
   },
   methods: {
-    fetchData () {
-      this.domainsLoading = true
-      api('listDomains', {
-        listAll: true,
-        details: 'min'
-      }).then(response => {
-        this.domainsList = response.listdomainsresponse.domain
-
-        if (this.domainsList[0]) {
-          this.domainId = this.domainsList[0].id
-          this.handleChangeDomain(this.domainId)
-        }
-      }).catch(error => {
-        this.$notifyError(error)
-      }).finally(() => {
-        this.domainsLoading = false
-      })
-    },
-    fetchAccounts () {
-      api('listAccounts', {
-        domainid: this.domainId
-      }).then(response => {
-        this.accountsList = response.listaccountsresponse.account || []
-        if (this.accountsList && this.accountsList.length === 0) {
-          this.handleChangeAccount(null)
-        }
-      }).catch(error => {
-        this.$notifyError(error)
-      })
-    },
-    handleChangeDomain (e) {
-      this.$emit('domainChange', e)
+    handleChangeDomain (domainId) {
+      this.domainId = domainId
+      this.selectedAccount = null
+      this.$emit('domainChange', domainId)
       this.domainError = false
-      this.fetchAccounts()
     },
-    handleChangeAccount (e) {
-      this.$emit('accountChange', e)
+    handleChangeAccount (accountName) {
+      this.selectedAccount = accountName
+      this.$emit('accountChange', accountName)
     }
   }
 }
diff --git a/ui/src/components/widgets/InfiniteScrollSelect.vue b/ui/src/components/widgets/InfiniteScrollSelect.vue
index f97faf390f84..da780b66b80f 100644
--- a/ui/src/components/widgets/InfiniteScrollSelect.vue
+++ b/ui/src/components/widgets/InfiniteScrollSelect.vue
@@ -41,8 +41,10 @@
   - optionValueKey (String, optional): Property to use as the value for options (e.g., 'name'). Default is 'id'
   - optionLabelKey (String, optional): Property to use as the label for options (e.g., 'name'). Default is 'name'
   - defaultOption (Object, optional): Preselected object to include initially
+  - allowClear (Boolean, optional): Whether to allow clearing the selection. Default is false
   - showIcon (Boolean, optional): Whether to show icon for the options. Default is true
   - defaultIcon (String, optional): Icon to be shown when there is no resource icon for the option. Default is 'cloud-outlined'
+  - selectFirstOption (Boolean, optional): Whether to automatically select the first option when options are loaded. Default is false
 
   Events:
   - @change-option-value (Function): Emits the selected option value(s) when value(s) changes. Do not use @change as it will give warnings and may not work
@@ -58,6 +60,7 @@
     :filter-option="false"
     :loading="loading"
     show-search
+    :allowClear="allowClear"
     placeholder="Select"
     @search="onSearchTimed"
     @popupScroll="onScroll"
@@ -75,9 +78,9 @@
         </div>
       </div>
     </template>
-    <a-select-option v-for="option in options" :key="option.id" :value="option[optionValueKey]">
+    <a-select-option v-for="option in selectableOptions" :key="option.id" :value="option[optionValueKey]">
       <span>
-        <span v-if="showIcon">
+        <span v-if="showIcon && option.id !== null && option.id !== undefined">
           <resource-icon v-if="option.icon && option.icon.base64image" :image="option.icon.base64image" size="1x" style="margin-right: 5px"/>
           <render-icon v-else :icon="defaultIcon" style="margin-right: 5px" />
         </span>
@@ -124,6 +127,10 @@ export default {
       type: Object,
       default: null
     },
+    allowClear: {
+      type: Boolean,
+      default: false
+    },
     showIcon: {
       type: Boolean,
       default: true
@@ -135,6 +142,10 @@ export default {
     pageSize: {
       type: Number,
       default: null
+    },
+    selectFirstOption: {
+      type: Boolean,
+      default: false
     }
   },
   data () {
@@ -147,7 +158,8 @@ export default {
       searchTimer: null,
       scrollHandlerAttached: false,
       preselectedOptionValue: null,
-      successiveFetches: 0
+      successiveFetches: 0,
+      hasAutoSelectedFirst: false
     }
   },
   created () {
@@ -166,6 +178,36 @@ export default {
     },
     formattedSearchFooterMessage () {
       return `${this.$t('label.showing.results.for').replace('%x', this.searchQuery)}`
+    },
+    selectableOptions () {
+      const currentValue = this.$attrs.value
+      // Only filter out null/empty options when the current value is also null/undefined/empty
+      // This prevents such options from being selected and allows the placeholder to show instead
+      if (currentValue === null || currentValue === undefined || currentValue === '') {
+        return this.options.filter(option => {
+          const optionValue = option[this.optionValueKey]
+          return optionValue !== null && optionValue !== undefined && optionValue !== ''
+        })
+      }
+      // When a valid value is selected, show all options
+      return this.options
+    },
+    apiOptionsCount () {
+      if (this.defaultOption) {
+        const defaultOptionValue = this.defaultOption[this.optionValueKey]
+        return this.options.filter(option => option[this.optionValueKey] !== defaultOptionValue).length
+      }
+      return this.options.length
+    },
+    preselectedMatchValue () {
+      // Extract the first value from preselectedOptionValue if it's an array, otherwise return the value itself
+      if (!this.preselectedOptionValue) return null
+      return Array.isArray(this.preselectedOptionValue) ? this.preselectedOptionValue[0] : this.preselectedOptionValue
+    },
+    preselectedMatch () {
+      // Find the matching option for the preselected value
+      if (!this.preselectedMatchValue) return null
+      return this.options.find(entry => entry[this.optionValueKey] === this.preselectedMatchValue) || null
     }
   },
   watch: {
@@ -210,6 +252,7 @@ export default {
       }).finally(() => {
         if (this.successiveFetches === 0) {
           this.loading = false
+          this.autoSelectFirstOptionIfNeeded()
         }
       })
     },
@@ -220,11 +263,10 @@ export default {
         this.resetPreselectedOptionValue()
         return
       }
-      const matchValue = Array.isArray(this.preselectedOptionValue) ? this.preselectedOptionValue[0] : this.preselectedOptionValue
-      const match = this.options.find(entry => entry[this.optionValueKey] === matchValue)
-      if (!match) {
+      if (!this.preselectedMatch) {
         this.successiveFetches++
-        if (this.options.length < this.totalCount) {
+        // Exclude defaultOption from count when comparing with totalCount
+        if (this.apiOptionsCount < this.totalCount) {
           this.fetchItems()
         } else {
           this.resetPreselectedOptionValue()
@@ -232,7 +274,7 @@ export default {
         return
       }
       if (Array.isArray(this.preselectedOptionValue) && this.preselectedOptionValue.length > 1) {
-        this.preselectedOptionValue = this.preselectedOptionValue.filter(o => o !== match)
+        this.preselectedOptionValue = this.preselectedOptionValue.filter(o => o !== this.preselectedMatchValue)
       } else {
         this.resetPreselectedOptionValue()
       }
@@ -246,6 +288,36 @@ export default {
       this.preselectedOptionValue = null
       this.successiveFetches = 0
     },
+    autoSelectFirstOptionIfNeeded () {
+      if (!this.selectFirstOption || this.hasAutoSelectedFirst) {
+        return
+      }
+      // Don't auto-select if there's a preselected value being fetched
+      if (this.preselectedOptionValue) {
+        return
+      }
+      const currentValue = this.$attrs.value
+      if (currentValue !== undefined && currentValue !== null && currentValue !== '') {
+        return
+      }
+      if (this.options.length === 0) {
+        return
+      }
+      if (this.searchQuery && this.searchQuery.length > 0) {
+        return
+      }
+      // Only auto-select after initial load is complete (no more successive fetches)
+      if (this.successiveFetches > 0) {
+        return
+      }
+      const firstOption = this.options[0]
+      if (firstOption) {
+        const firstValue = firstOption[this.optionValueKey]
+        this.hasAutoSelectedFirst = true
+        this.$emit('change-option-value', firstValue)
+        this.$emit('change-option', firstOption)
+      }
+    },
     onSearchTimed (value) {
       clearTimeout(this.searchTimer)
       this.searchTimer = setTimeout(() => {
@@ -264,7 +336,8 @@ export default {
     },
     onScroll (e) {
       const nearBottom = e.target.scrollTop + e.target.clientHeight >= e.target.scrollHeight - 10
-      const hasMore = this.options.length < this.totalCount
+      // Exclude defaultOption from count when comparing with totalCount
+      const hasMore = this.apiOptionsCount < this.totalCount
       if (nearBottom && hasMore && !this.loading) {
         this.fetchItems()
       }
diff --git a/ui/src/views/iam/AddUser.vue b/ui/src/views/iam/AddUser.vue
index 49bca3278965..3f0bd018050f 100644
--- a/ui/src/views/iam/AddUser.vue
+++ b/ui/src/views/iam/AddUser.vue
@@ -90,45 +90,31 @@
           <template #label>
             <tooltip-label :title="$t('label.domainid')" :tooltip="apiParams.domainid.description"/>
           </template>
-          <a-select
-            :loading="domainLoading"
+          <infinite-scroll-select
             v-model:value="form.domainid"
+            api="listDomains"
+            :apiParams="domainsApiParams"
+            resourceType="domain"
+            optionValueKey="id"
+            optionLabelKey="path"
+            defaultIcon="block-outlined"
+            :selectFirstOption="true"
             :placeholder="apiParams.domainid.description"
-            showSearch
-            optionFilterProp="label"
-            :filterOption="(input, option) => {
-              return  option.label.toLowerCase().indexOf(input.toLowerCase()) >= 0
-            }" >
-            <a-select-option v-for="domain in domainsList" :key="domain.id" :label="domain.path || domain.name || domain.description">
-              <span>
-                <resource-icon v-if="domain && domain.icon" :image="domain.icon.base64image" size="1x" style="margin-right: 5px"/>
-                <block-outlined v-else style="margin-right: 5px" />
-                {{ domain.path || domain.name || domain.description }}
-              </span>
-            </a-select-option>
-          </a-select>
+            @change-option-value="handleDomainChange" />
         </a-form-item>
         <a-form-item name="account" ref="account" v-if="!account">
           <template #label>
             <tooltip-label :title="$t('label.account')" :tooltip="apiParams.account.description"/>
           </template>
-          <a-select
+          <infinite-scroll-select
             v-model:value="form.account"
-            :loading="loadingAccount"
-            :placeholder="apiParams.account.description"
-            showSearch
-            optionFilterProp="label"
-            :filterOption="(input, option) => {
-              return  option.label.toLowerCase().indexOf(input.toLowerCase()) >= 0
-            }" >
-            <a-select-option v-for="(item, idx) in accountList" :key="idx" :label="item.name">
-              <span>
-                <resource-icon v-if="item && item.icon" :image="item.icon.base64image" size="1x" style="margin-right: 5px"/>
-                <team-outlined v-else style="margin-right: 5px" />
-                {{ item.name }}
-              </span>
-            </a-select-option>
-          </a-select>
+            api="listAccounts"
+            :apiParams="accountsApiParams"
+            resourceType="account"
+            optionValueKey="name"
+            optionLabelKey="name"
+            defaultIcon="team-outlined"
+            :placeholder="apiParams.account.description" />
         </a-form-item>
         <a-form-item name="timezone" ref="timezone">
           <template #label>
@@ -185,12 +171,14 @@ import { timeZone } from '@/utils/timezone'
 import debounce from 'lodash/debounce'
 import ResourceIcon from '@/components/view/ResourceIcon'
 import TooltipLabel from '@/components/widgets/TooltipLabel'
+import InfiniteScrollSelect from '@/components/widgets/InfiniteScrollSelect.vue'
 
 export default {
   name: 'AddUser',
   components: {
     TooltipLabel,
-    ResourceIcon
+    ResourceIcon,
+    InfiniteScrollSelect
   },
   data () {
     this.fetchTimeZone = debounce(this.fetchTimeZone, 800)
@@ -198,14 +186,9 @@ export default {
       loading: false,
       timeZoneLoading: false,
       timeZoneMap: [],
-      domainLoading: false,
-      domainsList: [],
-      selectedDomain: '',
       samlEnable: false,
       idpLoading: false,
       idps: [],
-      loadingAccount: false,
-      accountList: [],
       account: null,
       domainid: null
     }
@@ -218,6 +201,19 @@ export default {
   computed: {
     samlAllowed () {
       return 'authorizeSamlSso' in this.$store.getters.apis
+    },
+    domainsApiParams () {
+      return {
+        listall: true,
+        showicon: true,
+        details: 'min'
+      }
+    },
+    accountsApiParams () {
+      return {
+        showicon: true,
+        domainid: this.form?.domainid || null
+      }
     }
   },
   methods: {
@@ -241,53 +237,18 @@ export default {
     fetchData () {
       this.account = this.$route.query && this.$route.query.account ? this.$route.query.account : null
       this.domainid = this.$route.query && this.$route.query.domainid ? this.$route.query.domainid : null
-      if (!this.domianid) {
-        this.fetchDomains()
+      // Set initial domain if provided from route
+      if (this.domainid) {
+        this.form.domainid = this.domainid
       }
       this.fetchTimeZone()
       if (this.samlAllowed) {
         this.fetchIdps()
       }
     },
-    fetchDomains () {
-      this.domainLoading = true
-      var params = {
-        listAll: true,
-        showicon: true,
-        details: 'min'
-      }
-      api('listDomains', params).then(response => {
-        this.domainsList = response.listdomainsresponse.domain || []
-      }).catch(error => {
-        this.$notification.error({
-          message: `${this.$t('label.error')} ${error.response.status}`,
-          description: error.response.data.errorresponse.errortext
-        })
-      }).finally(() => {
-        const domainid = this.domainsList[0]?.id || ''
-        this.form.domainid = domainid
-        this.fetchAccount(domainid)
-        this.domainLoading = false
-      })
-    },
-    fetchAccount (domainid) {
-      this.accountList = []
+    handleDomainChange (domainId) {
+      this.form.domainid = domainId
       this.form.account = null
-      this.loadingAccount = true
-      var params = { listAll: true, showicon: true }
-      if (domainid) {
-        params.domainid = domainid
-      }
-      api('listAccounts', params).then(response => {
-        this.accountList = response.listaccountsresponse.account || []
-      }).catch(error => {
-        this.$notification.error({
-          message: `${this.$t('label.error')} ${error.response.status}`,
-          description: error.response.data.errorresponse.errortext
-        })
-      }).finally(() => {
-        this.loadingAccount = false
-      })
     },
     fetchTimeZone (value) {
       this.timeZoneMap = []
@@ -328,12 +289,14 @@ export default {
           accounttype: 0
         }
 
+        // Account: use route query account if available, otherwise use form value (which is the account name)
         if (this.account) {
           params.account = this.account
-        } else if (this.accountList[values.account]) {
-          params.account = this.accountList[values.account].name
+        } else if (values.account) {
+          params.account = values.account
         }
 
+        // Domain: use route query domainid if available, otherwise use form value
         if (this.domainid) {
           params.domainid = this.domainid
         } else if (values.domainid) {
diff --git a/ui/src/views/infra/UsageRecords.vue b/ui/src/views/infra/UsageRecords.vue
index feb1d88bd9b6..0a41aa4052c6 100644
--- a/ui/src/views/infra/UsageRecords.vue
+++ b/ui/src/views/infra/UsageRecords.vue
@@ -121,15 +121,20 @@
                   ref="domain"
                   name="domain"
                 >
-                  <a-auto-complete
+                  <infinite-scroll-select
                     v-model:value="form.domain"
-                    :options="domains"
+                    api="listDomains"
+                    :apiParams="domainsApiParams"
+                    resourceType="domain"
+                    optionValueKey="id"
+                    optionLabelKey="path"
+                    defaultIcon="block-outlined"
                     :placeholder="$t('label.domain')"
-                    :filter-option="filterOption"
+                    :defaultOption="{ id: null, path: ''}"
+                    :allowClear="true"
                     style="width: 100%;"
-                    @select="getAccounts"
-                    :dropdownMatchSelectWidth="false"
-                  />
+                    @change-option-value="handleDomainChange"
+                    @change-option="handleDomainOptionChange" />
                 </a-form-item>
               </a-col>
             </a-row>&nbsp;
@@ -150,15 +155,20 @@
               ref="account"
               name="account"
             >
-            <a-auto-complete
+              <infinite-scroll-select
                 v-model:value="form.account"
-                :options="accounts"
+                api="listAccounts"
+                :apiParams="accountsApiParams"
+                resourceType="account"
+                optionValueKey="id"
+                optionLabelKey="name"
+                defaultIcon="team-outlined"
                 :placeholder="$t('label.account')"
-                :filter-option="filterOption"
                 :disabled="form.isRecursive"
-                :dropdownMatchSelectWidth="false"
-                @select="selectAccount"
-              />
+                :defaultOption="{ id: null, name: ''}"
+                allowClear="true"
+                @change-option-value="selectAccount"
+                @change-option="selectAccountOption" />
             </a-form-item>
           </a-col>
           <a-col :span="3" v-if="'listUsageTypes' in $store.getters.apis">
@@ -361,6 +371,7 @@ import ListView from '@/components/view/ListView'
 import TooltipLabel from '@/components/widgets/TooltipLabel'
 import TooltipButton from '@/components/widgets/TooltipButton'
 import Status from '@/components/widgets/Status'
+import InfiniteScrollSelect from '@/components/widgets/InfiniteScrollSelect.vue'
 
 dayjs.extend(relativeTime)
 dayjs.extend(utc)
@@ -374,7 +385,8 @@ export default {
     ListView,
     Status,
     TooltipLabel,
-    TooltipButton
+    TooltipButton,
+    InfiniteScrollSelect
   },
   props: {
     resource: {
@@ -402,8 +414,6 @@ export default {
       page: 1,
       pageSize: 20,
       usageTypes: [],
-      domains: [],
-      accounts: [],
       account: null,
       domain: null,
       usageType: null,
@@ -436,6 +446,23 @@ export default {
     this.fetchData()
     this.updateColumns()
   },
+  computed: {
+    domainsApiParams () {
+      return {
+        listall: true
+      }
+    },
+    accountsApiParams () {
+      if (!this.form.domain) {
+        return {
+          listall: true
+        }
+      }
+      return {
+        domainid: this.form.domain
+      }
+    }
+  },
   methods: {
     clearFilters () {
       this.formRef.value.resetFields()
@@ -445,8 +472,6 @@ export default {
       this.usageType = null
       this.page = 1
       this.pageSize = 20
-
-      this.getAccounts()
     },
     disabledDate (current) {
       return current && current > dayjs().endOf('day')
@@ -473,8 +498,6 @@ export default {
       this.listUsageServerMetrics()
       this.getUsageTypes()
       this.getAllUsageRecordColumns()
-      this.getDomains()
-      this.getAccounts()
       if (!this.$store.getters.customColumns[this.$store.getters.userInfo.id]) {
         this.$store.getters.customColumns[this.$store.getters.userInfo.id] = {}
         this.$store.getters.customColumns[this.$store.getters.userInfo.id][this.$route.path] = this.selectedColumnKeys
@@ -528,16 +551,6 @@ export default {
         this.formRef.value.scrollToField(error.errorFields[0].name)
       })
     },
-    selectAccount (value, option) {
-      if (option && option.id) {
-        this.account = option
-      } else {
-        this.account = null
-        if (this.formRef?.value) {
-          this.formRef.value.resetFields('account')
-        }
-      }
-    },
     selectUsageType (value, option) {
       if (option && option.id) {
         this.usageType = option
@@ -548,24 +561,12 @@ export default {
         }
       }
     },
-    getDomains () {
-      api('listDomains', { listAll: true }).then(json => {
-        if (json && json.listdomainsresponse && json.listdomainsresponse.domain) {
-          this.domains = [{ id: null, value: '' }, ...json.listdomainsresponse.domain.map(x => {
-            return {
-              id: x.id,
-              value: x.path
-            }
-          })]
-        }
-      })
+    handleDomainChange (domainId) {
+      this.form.domain = domainId
+      this.form.account = null
     },
-    getAccounts (value, option) {
-      var params = {
-        listAll: true
-      }
+    handleDomainOptionChange (option) {
       if (option && option.id) {
-        params.domainid = option.id
         this.domain = option
       } else {
         this.domain = null
@@ -573,16 +574,19 @@ export default {
           this.formRef.value.resetFields('domain')
         }
       }
-      api('listAccounts', params).then(json => {
-        if (json && json.listaccountsresponse && json.listaccountsresponse.account) {
-          this.accounts = [{ id: null, value: '' }, ...json.listaccountsresponse.account.map(x => {
-            return {
-              id: x.id,
-              value: x.name
-            }
-          })]
+    },
+    selectAccount (accountId) {
+      this.form.account = accountId
+    },
+    selectAccountOption (option) {
+      if (option && option.id) {
+        this.account = option
+      } else {
+        this.account = null
+        if (this.formRef?.value) {
+          this.formRef.value.resetFields('account')
         }
-      })
+      }
     },
     getParams (page, pageSize) {
       const formRaw = toRaw(this.form)
diff --git a/ui/src/views/storage/CreateTemplate.vue b/ui/src/views/storage/CreateTemplate.vue
index d974092a5f8c..819d0cc0ac34 100644
--- a/ui/src/views/storage/CreateTemplate.vue
+++ b/ui/src/views/storage/CreateTemplate.vue
@@ -73,42 +73,32 @@
           <template #label>
             <tooltip-label :title="$t('label.domainid')" :tooltip="apiParams.domainid.description"/>
           </template>
-          <a-select
+          <infinite-scroll-select
             v-model:value="form.domainid"
-            showSearch
-            optionFilterProp="label"
-            :filterOption="(input, option) => {
-              return option.label.toLowerCase().indexOf(input.toLowerCase()) >= 0
-            }"
-            :loading="domainLoading"
+            api="listDomains"
+            :apiParams="domainsApiParams"
+            resourceType="domain"
+            optionValueKey="id"
+            optionLabelKey="path"
+            defaultIcon="block-outlined"
+            allowClear="true"
             :placeholder="apiParams.domainid.description"
-            @change="val => { handleDomainChange(val) }">
-            <a-select-option v-for="(opt, optIndex) in this.domains" :key="optIndex" :label="opt.path || opt.name || opt.description" :value="opt.id">
-              <span>
-                <resource-icon v-if="opt && opt.icon" :image="opt.icon.base64image" size="1x" style="margin-right: 5px"/>
-                <block-outlined v-else style="margin-right: 5px" />
-                {{ opt.path || opt.name || opt.description }}
-              </span>
-            </a-select-option>
-          </a-select>
+            @change-option-value="handleDomainChange" />
         </a-form-item>
         <a-form-item name="account" ref="account" v-if="domainid">
           <template #label>
             <tooltip-label :title="$t('label.account')" :tooltip="apiParams.account.description"/>
           </template>
-          <a-select
+          <infinite-scroll-select
             v-model:value="form.account"
-            showSearch
-            optionFilterProp="label"
-            :filterOption="(input, option) => {
-              return option.value.toLowerCase().indexOf(input.toLowerCase()) >= 0
-            }"
-            :placeholder="apiParams.account.description"
-            @change="val => { handleAccountChange(val) }">
-            <a-select-option v-for="(acc, index) in accounts" :value="acc.name" :key="index">
-              {{ acc.name }}
-            </a-select-option>
-          </a-select>
+            api="listAccounts"
+            :apiParams="accountsApiParams"
+            resourceType="account"
+            optionValueKey="name"
+            optionLabelKey="name"
+            defaultIcon="team-outlined"
+            allowClear="true"
+            :placeholder="apiParams.account.description" />
         </a-form-item>
 
       <a-form-item
@@ -199,13 +189,15 @@ import { api } from '@/api'
 import { mixinForm } from '@/utils/mixin'
 import ResourceIcon from '@/components/view/ResourceIcon'
 import TooltipLabel from '@/components/widgets/TooltipLabel'
+import InfiniteScrollSelect from '@/components/widgets/InfiniteScrollSelect.vue'
 
 export default {
   name: 'CreateTemplate',
   mixins: [mixinForm],
   components: {
     ResourceIcon,
-    TooltipLabel
+    TooltipLabel,
+    InfiniteScrollSelect
   },
   props: {
     resource: {
@@ -219,9 +211,6 @@ export default {
       zones: [],
       osTypes: {},
       loading: false,
-      domains: [],
-      accounts: [],
-      domainLoading: false,
       domainid: null,
       account: null,
       architectureTypes: {}
@@ -230,6 +219,21 @@ export default {
   computed: {
     isAdminRole () {
       return this.$store.getters.userInfo.roletype === 'Admin'
+    },
+    domainsApiParams () {
+      return {
+        listall: true,
+        showicon: true,
+        details: 'min'
+      }
+    },
+    accountsApiParams () {
+      if (!this.domainid) {
+        return null
+      }
+      return {
+        domainid: this.domainid
+      }
     }
   },
   beforeCreate () {
@@ -256,9 +260,6 @@ export default {
       if (this.resource.intervaltype) {
         this.fetchSnapshotZones()
       }
-      if ('listDomains' in this.$store.getters.apis) {
-        this.fetchDomains()
-      }
       this.architectureTypes.opts = this.$fetchCpuArchitectureTypes()
     },
     fetchOsTypes () {
@@ -309,44 +310,16 @@ export default {
         }
       })
     },
-    fetchDomains () {
-      const params = {}
-      params.listAll = true
-      params.showicon = true
-      params.details = 'min'
-      this.domainLoading = true
-      api('listDomains', params).then(json => {
-        this.domains = json.listdomainsresponse.domain
-      }).finally(() => {
-        this.domainLoading = false
-        this.handleDomainChange(null)
-      })
-    },
-    async handleDomainChange (domain) {
-      this.domainid = domain
+    handleDomainChange (domainId) {
+      this.domainid = domainId
       this.form.account = null
       this.account = null
-      if ('listAccounts' in this.$store.getters.apis) {
-        await this.fetchAccounts()
-      }
-    },
-    fetchAccounts () {
-      return new Promise((resolve, reject) => {
-        api('listAccounts', {
-          domainid: this.domainid
-        }).then(response => {
-          this.accounts = response?.listaccountsresponse?.account || []
-          resolve(this.accounts)
-        }).catch(error => {
-          this.$notifyError(error)
-        })
-      })
     },
-    handleAccountChange (acc) {
-      if (acc) {
-        this.account = acc.name
+    handleAccountChange (accountName) {
+      if (accountName) {
+        this.account = accountName
       } else {
-        this.account = acc
+        this.account = null
       }
     },
     handleSubmit (e) {
diff --git a/ui/src/views/storage/UploadLocalVolume.vue b/ui/src/views/storage/UploadLocalVolume.vue
index 75775c9010a8..3a0bf4e129fe 100644
--- a/ui/src/views/storage/UploadLocalVolume.vue
+++ b/ui/src/views/storage/UploadLocalVolume.vue
@@ -57,43 +57,33 @@
           <template #label>
             <tooltip-label :title="$t('label.zoneid')" :tooltip="apiParams.zoneid.description"/>
           </template>
-          <a-select
+          <infinite-scroll-select
             v-model:value="form.zoneId"
-            showSearch
-            optionFilterProp="label"
-            :filterOption="(input, option) => {
-              return option.label.toLowerCase().indexOf(input.toLowerCase()) >= 0
-            }" >
-            <a-select-option :value="zone.id" v-for="zone in zones" :key="zone.id" :label="zone.name || zone.description">
-              <span>
-                <resource-icon v-if="zone.icon" :image="zone.icon.base64image" size="1x" style="margin-right: 5px"/>
-                <global-outlined v-else style="margin-right: 5px"/>
-                {{ zone.name || zone.description }}
-              </span>
-            </a-select-option>
-          </a-select>
+            api="listZones"
+            :apiParams="zonesApiParams"
+            resourceType="zone"
+            optionValueKey="id"
+            optionLabelKey="name"
+            defaultIcon="global-outlined"
+            selectFirstOption="true"
+            @change-option-value="handleZoneChange" />
         </a-form-item>
         <a-form-item name="diskofferingid" ref="diskofferingid">
           <template #label>
             <tooltip-label :title="$t('label.diskofferingid')" :tooltip="apiParams.diskofferingid.description"/>
           </template>
-          <a-select
+          <infinite-scroll-select
             v-model:value="form.diskofferingid"
-            :loading="offeringLoading"
+            api="listDiskOfferings"
+            :apiParams="diskOfferingsApiParams"
+            resourceType="diskoffering"
+            optionValueKey="id"
+            optionLabelKey="displaytext"
+            defaultIcon="hdd-outlined"
+            :defaultOption="{ id: null, displaytext: ''}"
+            allowClear="true"
             :placeholder="apiParams.diskofferingid.description"
-            showSearch
-            optionFilterProp="label"
-            :filterOption="(input, option) => {
-              return option.label.toLowerCase().indexOf(input.toLowerCase()) >= 0
-            }" >
-            <a-select-option
-              v-for="(offering, index) in offerings"
-              :value="offering.id"
-              :key="index"
-              :label="offering.displaytext || offering.name">
-              {{ offering.displaytext || offering.name }}
-            </a-select-option>
-          </a-select>
+            @change-option="onChangeDiskOffering" />
         </a-form-item>
         <a-form-item ref="format" name="format">
           <template #label>
@@ -124,38 +114,33 @@
           <template #label>
             <tooltip-label :title="$t('label.domain')" :tooltip="apiParams.domainid.description"/>
           </template>
-          <a-select
+          <infinite-scroll-select
             v-model:value="form.domainid"
-            showSearch
-            optionFilterProp="label"
-            :filterOption="(input, option) => {
-              return option.label.toLowerCase().indexOf(input.toLowerCase()) >= 0
-            }"
-            :loading="domainLoading"
+            api="listDomains"
+            :apiParams="domainsApiParams"
+            resourceType="domain"
+            optionValueKey="id"
+            optionLabelKey="path"
+            defaultIcon="block-outlined"
             :placeholder="$t('label.domainid')"
-            @change="val => { handleDomainChange(domainList[val].id) }">
-            <a-select-option v-for="(opt, optIndex) in domainList" :key="optIndex" :label="opt.path || opt.name || opt.description">
-              {{ opt.path || opt.name || opt.description }}
-            </a-select-option>
-          </a-select>
+            allowClear="true"
+            @change-option-value="handleDomainChange" />
         </a-form-item>
         <a-form-item name="account" ref="account" v-if="'listDomains' in $store.getters.apis">
           <template #label>
             <tooltip-label :title="$t('label.account')" :tooltip="apiParams.account.description"/>
           </template>
-          <a-select
+          <infinite-scroll-select
             v-model:value="form.account"
-            showSearch
-            optionFilterProp="value"
-            :filterOption="(input, option) => {
-              return option.value.toLowerCase().indexOf(input.toLowerCase()) >= 0
-            }"
+            api="listAccounts"
+            :apiParams="accountsApiParams"
+            resourceType="account"
+            optionValueKey="name"
+            optionLabelKey="name"
+            defaultIcon="team-outlined"
+            allowClear="true"
             :placeholder="$t('label.account')"
-            @change="val => { handleAccountChange(val) }">
-            <a-select-option v-for="(acc, index) in accountList" :value="acc.name" :key="index">
-              {{ acc.name }}
-            </a-select-option>
-          </a-select>
+            @change-option-value="handleAccountChange" />
         </a-form-item>
         <div :span="24" class="action-button">
           <a-button @click="closeAction">{{ $t('label.cancel') }}</a-button>
@@ -173,27 +158,25 @@ import { axios } from '../../utils/request'
 import { mixinForm } from '@/utils/mixin'
 import ResourceIcon from '@/components/view/ResourceIcon'
 import TooltipLabel from '@/components/widgets/TooltipLabel'
+import InfiniteScrollSelect from '@/components/widgets/InfiniteScrollSelect.vue'
 
 export default {
   name: 'UploadLocalVolume',
   mixins: [mixinForm],
   components: {
     ResourceIcon,
-    TooltipLabel
+    TooltipLabel,
+    InfiniteScrollSelect
   },
   data () {
     return {
       fileList: [],
-      zones: [],
-      domainList: [],
-      accountList: [],
-      offerings: [],
-      offeringLoading: false,
       formats: ['RAW', 'VHD', 'VHDX', 'OVA', 'QCOW2'],
       domainId: null,
       account: null,
       uploadParams: null,
-      domainLoading: false,
+      customDiskOffering: false,
+      isCustomizedDiskIOps: false,
       loading: false,
       uploadPercentage: 0
     }
@@ -201,9 +184,38 @@ export default {
   beforeCreate () {
     this.apiParams = this.$getApiParams('getUploadParamsForVolume')
   },
+  computed: {
+    zonesApiParams () {
+      return {
+        showicon: true
+      }
+    },
+    diskOfferingsApiParams () {
+      if (!this.form.zoneId) {
+        return null
+      }
+      return {
+        zoneid: this.form.zoneId,
+        listall: true
+      }
+    },
+    domainsApiParams () {
+      return {
+        listall: true,
+        details: 'min'
+      }
+    },
+    accountsApiParams () {
+      if (!this.form.domainid) {
+        return null
+      }
+      return {
+        domainid: this.form.domainid
+      }
+    }
+  },
   created () {
     this.initForm()
-    this.fetchData()
   },
   methods: {
     initForm () {
@@ -221,38 +233,18 @@ export default {
         zoneId: [{ required: true, message: this.$t('message.error.select') }]
       })
     },
-    listZones () {
-      api('listZones', { showicon: true }).then(json => {
-        if (json && json.listzonesresponse && json.listzonesresponse.zone) {
-          this.zones = json.listzonesresponse.zone
-          this.zones = this.zones.filter(zone => zone.type !== 'Edge')
-          if (this.zones.length > 0) {
-            this.onZoneChange(this.zones[0].id)
-          }
-        }
-      })
-    },
-    onZoneChange (zoneId) {
+    handleZoneChange (zoneId) {
       this.form.zoneId = zoneId
-      this.zoneId = zoneId
-      this.fetchDiskOfferings(zoneId)
+      // InfiniteScrollSelect will auto-reload disk offerings when apiParams changes
     },
-    fetchDiskOfferings (zoneId) {
-      this.offeringLoading = true
-      this.offerings = [{ id: -1, name: '' }]
-      this.form.diskofferingid = undefined
-      api('listDiskOfferings', {
-        zoneid: zoneId,
-        listall: true
-      }).then(json => {
-        for (var offering of json.listdiskofferingsresponse.diskoffering) {
-          if (offering.iscustomized) {
-            this.offerings.push(offering)
-          }
-        }
-      }).finally(() => {
-        this.offeringLoading = false
-      })
+    onChangeDiskOffering (offering) {
+      if (offering) {
+        this.customDiskOffering = offering.iscustomized || false
+        this.isCustomizedDiskIOps = offering.iscustomizediops || false
+      } else {
+        this.customDiskOffering = false
+        this.isCustomizedDiskIOps = false
+      }
     },
     handleRemove (file) {
       const index = this.fileList.indexOf(file)
@@ -266,53 +258,14 @@ export default {
       this.form.file = file
       return false
     },
-    handleDomainChange (domain) {
-      this.domainId = domain
-      if ('listAccounts' in this.$store.getters.apis) {
-        this.fetchAccounts()
-      }
-    },
-    handleAccountChange (acc) {
-      if (acc) {
-        this.account = acc.name
-      } else {
-        this.account = acc
-      }
-    },
-    fetchData () {
-      this.listZones()
-      if ('listDomains' in this.$store.getters.apis) {
-        this.fetchDomains()
-      }
+    handleDomainChange (domainId) {
+      this.form.domainid = domainId
+      this.domainId = domainId
+      this.form.account = null
     },
-    fetchDomains () {
-      this.domainLoading = true
-      api('listDomains', {
-        listAll: true,
-        details: 'min'
-      }).then(response => {
-        this.domainList = response.listdomainsresponse.domain
-
-        if (this.domainList[0]) {
-          this.handleDomainChange(null)
-        }
-      }).catch(error => {
-        this.$notifyError(error)
-      }).finally(() => {
-        this.domainLoading = false
-      })
-    },
-    fetchAccounts () {
-      api('listAccounts', {
-        domainid: this.domainId
-      }).then(response => {
-        this.accountList = response.listaccountsresponse.account || []
-        if (this.accountList && this.accountList.length === 0) {
-          this.handleAccountChange(null)
-        }
-      }).catch(error => {
-        this.$notifyError(error)
-      })
+    handleAccountChange (accountName) {
+      this.form.account = accountName
+      this.account = accountName
     },
     handleSubmit (e) {
       e.preventDefault()
diff --git a/ui/src/views/storage/UploadVolume.vue b/ui/src/views/storage/UploadVolume.vue
index 937c3ad76aa5..c2cbaabc2256 100644
--- a/ui/src/views/storage/UploadVolume.vue
+++ b/ui/src/views/storage/UploadVolume.vue
@@ -47,21 +47,16 @@
           <template #label>
             <tooltip-label :title="$t('label.zoneid')" :tooltip="apiParams.zoneid.description"/>
           </template>
-          <a-select
+          <infinite-scroll-select
             v-model:value="form.zoneId"
-            showSearch
-            optionFilterProp="label"
-            :filterOption="(input, option) => {
-              return option.label.toLowerCase().indexOf(input.toLowerCase()) >= 0
-            }" >
-            <a-select-option :value="zone.id" v-for="zone in zones" :key="zone.id" :label="zone.name || zone.description">
-              <span>
-                <resource-icon v-if="zone.icon" :image="zone.icon.base64image" size="1x" style="margin-right: 5px"/>
-                <global-outlined v-else style="margin-right: 5px"/>
-                {{ zone.name || zone.description }}
-              </span>
-            </a-select-option>
-          </a-select>
+            api="listZones"
+            :apiParams="zonesApiParams"
+            resourceType="zone"
+            optionValueKey="id"
+            optionLabelKey="name"
+            defaultIcon="global-outlined"
+            selectFirstOption="true"
+            @change-option-value="handleZoneChange" />
         </a-form-item>
         <a-form-item name="format" ref="format">
           <template #label>
@@ -83,23 +78,17 @@
           <template #label>
             <tooltip-label :title="$t('label.diskofferingid')" :tooltip="apiParams.diskofferingid.description || $t('label.diskoffering')"/>
           </template>
-          <a-select
+          <infinite-scroll-select
             v-model:value="form.diskofferingid"
-            :loading="loading"
-            @change="id => onChangeDiskOffering(id)"
-            showSearch
-            optionFilterProp="label"
-            :filterOption="(input, option) => {
-              return option.label.toLowerCase().indexOf(input.toLowerCase()) >= 0
-            }" >
-            <a-select-option
-              v-for="(offering, index) in offerings"
-              :value="offering.id"
-              :key="index"
-              :label="offering.displaytext || offering.name">
-              {{ offering.displaytext || offering.name }}
-            </a-select-option>
-          </a-select>
+            api="listDiskOfferings"
+            :apiParams="diskOfferingsApiParams"
+            resourceType="diskoffering"
+            optionValueKey="id"
+            optionLabelKey="displaytext"
+            defaultIcon="hdd-outlined"
+            :defaultOption="{ id: null, displaytext: ''}"
+            allowClear="true"
+            @change-option="onChangeDiskOffering" />
         </a-form-item>
         <a-form-item name="checksum" ref="checksum">
           <template #label>
@@ -114,38 +103,33 @@
           <template #label>
             <tooltip-label :title="$t('label.domain')" :tooltip="apiParams.domainid.description"/>
           </template>
-          <a-select
+          <infinite-scroll-select
             v-model:value="form.domainid"
-            showSearch
-            optionFilterProp="label"
-            :filterOption="(input, option) => {
-              return option.label.toLowerCase().indexOf(input.toLowerCase()) >= 0
-            }"
-            :loading="domainLoading"
+            api="listDomains"
+            :apiParams="domainsApiParams"
+            resourceType="domain"
+            optionValueKey="id"
+            optionLabelKey="path"
+            defaultIcon="block-outlined"
+            allowClear="true"
             :placeholder="$t('label.domainid')"
-            @change="val => { handleDomainChange(domainList[val].id) }">
-            <a-select-option v-for="(opt, optIndex) in domainList" :key="optIndex" :label="opt.path || opt.name || opt.description">
-              {{ opt.path || opt.name || opt.description }}
-            </a-select-option>
-          </a-select>
+            @change-option-value="handleDomainChange" />
         </a-form-item>
         <a-form-item name="account" ref="account" v-if="'listDomains' in $store.getters.apis">
           <template #label>
             <tooltip-label :title="$t('label.account')" :tooltip="apiParams.account.description"/>
           </template>
-          <a-select
+          <infinite-scroll-select
             v-model:value="form.account"
-            showSearch
-            optionFilterProp="value"
-            :filterOption="(input, option) => {
-              return option.value.toLowerCase().indexOf(input.toLowerCase()) >= 0
-            }"
+            api="listAccounts"
+            :apiParams="accountsApiParams"
+            resourceType="account"
+            optionValueKey="name"
+            optionLabelKey="name"
+            defaultIcon="team-outlined"
             :placeholder="$t('label.account')"
-            @change="val => { handleAccountChange(val) }">
-            <a-select-option v-for="(acc, index) in accountList" :value="acc.name" :key="index">
-              {{ acc.name }}
-            </a-select-option>
-          </a-select>
+            allowClear="true"
+            @change-option-value="handleAccountChange" />
         </a-form-item>
         <div :span="24" class="action-button">
           <a-button @click="closeAction">{{ $t('label.cancel') }}</a-button>
@@ -162,27 +146,26 @@ import { api } from '@/api'
 import { mixinForm } from '@/utils/mixin'
 import ResourceIcon from '@/components/view/ResourceIcon'
 import TooltipLabel from '@/components/widgets/TooltipLabel'
+import InfiniteScrollSelect from '@/components/widgets/InfiniteScrollSelect.vue'
 
 export default {
   name: 'UploadVolume',
   mixins: [mixinForm],
   components: {
     ResourceIcon,
-    TooltipLabel
+    TooltipLabel,
+    InfiniteScrollSelect
   },
   data () {
     return {
-      zones: [],
-      domainList: [],
-      accountList: [],
       formats: ['RAW', 'VHD', 'VHDX', 'OVA', 'QCOW2'],
-      offerings: [],
       zoneSelected: '',
       selectedDiskOfferingId: null,
       domainId: null,
       account: null,
       uploadParams: null,
-      domainLoading: false,
+      customDiskOffering: false,
+      isCustomizedDiskIOps: false,
       loading: false,
       uploadPercentage: 0
     }
@@ -190,9 +173,36 @@ export default {
   beforeCreate () {
     this.apiParams = this.$getApiParams('uploadVolume')
   },
+  computed: {
+    zonesApiParams () {
+      return {
+        showicon: true
+      }
+    },
+    diskOfferingsApiParams () {
+      if (!this.form.zoneId) {
+        return null
+      }
+      return {
+        zoneid: this.form.zoneId,
+        listall: true
+      }
+    },
+    domainsApiParams () {
+      return {
+        listall: true,
+        details: 'min'
+      }
+    },
+    accountsApiParams () {
+      return {
+        domainid: this.form?.domainid || null,
+        showicon: true
+      }
+    }
+  },
   created () {
     this.initForm()
-    this.fetchData()
   },
   methods: {
     initForm () {
@@ -207,78 +217,28 @@ export default {
         format: [{ required: true, message: this.$t('message.error.select') }]
       })
     },
-    fetchData () {
-      this.loading = true
-      api('listZones', { showicon: true }).then(json => {
-        this.zones = json.listzonesresponse.zone || []
-        this.zones = this.zones.filter(zone => zone.type !== 'Edge')
-        this.form.zoneId = this.zones[0].id || ''
-        this.fetchDiskOfferings(this.form.zoneId)
-      }).finally(() => {
-        this.loading = false
-      })
-      if ('listDomains' in this.$store.getters.apis) {
-        this.fetchDomains()
-      }
-    },
-    fetchDiskOfferings (zoneId) {
-      this.loading = true
-      api('listDiskOfferings', {
-        zoneid: zoneId,
-        listall: true
-      }).then(json => {
-        this.offerings = json.listdiskofferingsresponse.diskoffering || []
-      }).finally(() => {
-        this.loading = false
-      })
+    handleZoneChange (zoneId) {
+      this.form.zoneId = zoneId
+      // InfiniteScrollSelect will auto-reload disk offerings when apiParams changes
     },
-    fetchDomains () {
-      this.domainLoading = true
-      api('listDomains', {
-        listAll: true,
-        details: 'min'
-      }).then(response => {
-        this.domainList = response.listdomainsresponse.domain
-
-        if (this.domainList[0]) {
-          this.handleDomainChange(null)
-        }
-      }).catch(error => {
-        this.$notifyError(error)
-      }).finally(() => {
-        this.domainLoading = false
-      })
-    },
-    fetchAccounts () {
-      api('listAccounts', {
-        domainid: this.domainId
-      }).then(response => {
-        this.accountList = response.listaccountsresponse.account || []
-        if (this.accountList && this.accountList.length === 0) {
-          this.handleAccountChange(null)
-        }
-      }).catch(error => {
-        this.$notifyError(error)
-      })
-    },
-    onChangeDiskOffering (id) {
-      const offering = this.offerings.filter(x => x.id === id)
-      this.customDiskOffering = offering[0]?.iscustomized || false
-      this.isCustomizedDiskIOps = offering[0]?.iscustomizediops || false
-    },
-    handleDomainChange (domain) {
-      this.domainId = domain
-      if ('listAccounts' in this.$store.getters.apis) {
-        this.fetchAccounts()
-      }
-    },
-    handleAccountChange (acc) {
-      if (acc) {
-        this.account = acc.name
+    onChangeDiskOffering (offering) {
+      if (offering) {
+        this.customDiskOffering = offering.iscustomized || false
+        this.isCustomizedDiskIOps = offering.iscustomizediops || false
       } else {
-        this.account = acc
+        this.customDiskOffering = false
+        this.isCustomizedDiskIOps = false
       }
     },
+    handleDomainChange (domainId) {
+      this.form.domainid = domainId
+      this.domainId = domainId
+      this.form.account = null
+    },
+    handleAccountChange (accountName) {
+      this.form.account = accountName
+      this.account = accountName
+    },
     handleSubmit (e) {
       e.preventDefault()
       if (this.loading) return
diff --git a/ui/src/views/tools/CreateWebhook.vue b/ui/src/views/tools/CreateWebhook.vue
index 2b4374719771..ef07cc39ed00 100644
--- a/ui/src/views/tools/CreateWebhook.vue
+++ b/ui/src/views/tools/CreateWebhook.vue
@@ -67,39 +67,33 @@
               <info-circle-outlined style="color: rgba(0,0,0,.45)" />
             </a-tooltip>
           </template>
-          <a-select
+          <infinite-scroll-select
             id="domain-selection"
             v-model:value="form.domainid"
-            showSearch
-            optionFilterProp="label"
-            :filterOption="(input, option) => {
-              return option.label.toLowerCase().indexOf(input.toLowerCase()) >= 0
-            }"
-            :loading="domainLoading"
+            api="listDomains"
+            :apiParams="domainsApiParams"
+            resourceType="domain"
+            optionValueKey="id"
+            optionLabelKey="path"
+            defaultIcon="block-outlined"
+            :defaultOption="{ id: null, path: ''}"
+            allowClear="true"
             :placeholder="apiParams.domainid.description"
-            @change="val => { handleDomainChanged(val) }">
-            <a-select-option v-for="opt in domains" :key="opt.id" :label="opt.path || opt.name || opt.description || ''">
-              {{ opt.path || opt.name || opt.description }}
-            </a-select-option>
-          </a-select>
+            @change-option-value="handleDomainChanged" />
         </a-form-item>
         <a-form-item name="account" ref="account" v-if="isAdminOrDomainAdmin && ['Local'].includes(form.scope) && form.domainid">
           <template #label>
             <tooltip-label :title="$t('label.account')" :tooltip="apiParams.account.description"/>
           </template>
-          <a-select
+          <infinite-scroll-select
             v-model:value="form.account"
-            showSearch
-            optionFilterProp="label"
-            :filterOption="(input, option) => {
-              return option.value.toLowerCase().indexOf(input.toLowerCase()) >= 0
-            }"
-            :loading="accountLoading"
-            :placeholder="apiParams.account.description">
-            <a-select-option v-for="opt in accounts" :key="opt.id" :label="opt.name">
-              {{ opt.name }}
-            </a-select-option>
-          </a-select>
+            api="listAccounts"
+            :apiParams="accountsApiParams"
+            resourceType="account"
+            optionValueKey="name"
+            optionLabelKey="name"
+            defaultIcon="team-outlined"
+            :placeholder="apiParams.account.description" />
         </a-form-item>
         <a-form-item name="payloadurl" ref="payloadurl">
           <template #label>
@@ -156,25 +150,22 @@
 <script>
 import { ref, reactive, toRaw } from 'vue'
 import { api } from '@/api'
-import _ from 'lodash'
 import { mixinForm } from '@/utils/mixin'
 import TooltipLabel from '@/components/widgets/TooltipLabel'
 import TestWebhookDeliveryView from '@/components/view/TestWebhookDeliveryView'
+import InfiniteScrollSelect from '@/components/widgets/InfiniteScrollSelect.vue'
 
 export default {
   name: 'CreateWebhook',
   mixins: [mixinForm],
   components: {
     TooltipLabel,
-    TestWebhookDeliveryView
+    TestWebhookDeliveryView,
+    InfiniteScrollSelect
   },
   props: {},
   data () {
     return {
-      domains: [],
-      domainLoading: false,
-      accounts: [],
-      accountLoading: false,
       loading: false,
       testDeliveryAllowed: false,
       testDeliveryLoading: false
@@ -185,9 +176,6 @@ export default {
   },
   created () {
     this.initForm()
-    if (['Domain', 'Local'].includes(this.form.scope)) {
-      this.fetchDomainData()
-    }
   },
   computed: {
     isAdminOrDomainAdmin () {
@@ -201,6 +189,21 @@ export default {
         return this.form.payloadurl.toLowerCase().startsWith('https://')
       }
       return false
+    },
+    domainsApiParams () {
+      return {
+        listAll: true,
+        showicon: true,
+        details: 'min'
+      }
+    },
+    accountsApiParams () {
+      if (!this.form.domainid) {
+        return null
+      }
+      return {
+        domainid: this.form.domainid
+      }
     }
   },
   methods: {
@@ -228,46 +231,6 @@ export default {
     updateTestDeliveryLoading (value) {
       this.testDeliveryLoading = value
     },
-    fetchDomainData () {
-      this.domainLoading = true
-      this.domains = [
-        {
-          id: null,
-          name: ''
-        }
-      ]
-      this.form.domainid = null
-      this.form.account = null
-      api('listDomains', {}).then(json => {
-        const listdomains = json.listdomainsresponse.domain
-        this.domains = this.domains.concat(listdomains)
-      }).finally(() => {
-        this.domainLoading = false
-        if (this.arrayHasItems(this.domains)) {
-          this.form.domainid = null
-        }
-      })
-    },
-    fetchAccountData () {
-      this.accounts = []
-      this.form.account = null
-      if (!this.form.domainid) {
-        return
-      }
-      this.accountLoading = true
-      var params = {
-        domainid: this.form.domainid
-      }
-      api('listAccounts', params).then(json => {
-        const listAccounts = json.listaccountsresponse.account || []
-        this.accounts = listAccounts
-      }).finally(() => {
-        this.accountLoading = false
-        if (this.arrayHasItems(this.accounts)) {
-          this.form.account = this.accounts[0].id
-        }
-      })
-    },
     handleSubmit (e) {
       e.preventDefault()
       if (this.loading) return
@@ -300,10 +263,8 @@ export default {
           return
         }
         if (values.account) {
-          const accountItem = _.find(this.accounts, (option) => option.id === values.account)
-          if (accountItem) {
-            params.account = accountItem.name
-          }
+          // values.account is the account name (optionValueKey="name")
+          params.account = values.account
         }
         this.loading = true
         api('createWebhook', params).then(json => {
@@ -331,14 +292,11 @@ export default {
       }, 1)
     },
     handleScopeChange (e) {
-      if (['Domain', 'Local'].includes(this.form.scope)) {
-        this.fetchDomainData()
-      }
+      this.form.domainid = null
+      this.form.account = null
     },
     handleDomainChanged (domainid) {
-      if (domainid) {
-        this.fetchAccountData()
-      }
+      this.form.account = null
     }
   }
 }
diff --git a/ui/src/views/tools/ManageVolumes.vue b/ui/src/views/tools/ManageVolumes.vue
index 94c06b4ce9c4..7fe4a56c1bc7 100644
--- a/ui/src/views/tools/ManageVolumes.vue
+++ b/ui/src/views/tools/ManageVolumes.vue
@@ -372,22 +372,16 @@
               name="domain"
               ref="domain"
               :label="$t('label.domain')">
-              <a-select
-                @change="changeDomain"
+              <infinite-scroll-select
                 v-model:value="importForm.selectedDomain"
-                showSearch
-                optionFilterProp="label"
-                :filterOption="(input, option) => {
-                  return  option.label.toLowerCase().indexOf(input.toLowerCase()) >= 0
-                }" >
-                <a-select-option v-for="domain in domains" :key="domain.name" :value="domain.id" :label="domain.path || domain.name || domain.description">
-                <span>
-                  <resource-icon v-if="domain && domain.icon" :image="domain.icon.base64image" size="1x" style="margin-right: 5px"/>
-                  <block-outlined v-else style="margin-right: 5px" />
-                  {{ domain.path || domain.name || domain.description }}
-                </span>
-                </a-select-option>
-              </a-select>
+                api="listDomains"
+                :apiParams="domainsApiParams"
+                resourceType="domain"
+                optionValueKey="id"
+                optionLabelKey="path"
+                defaultIcon="block-outlined"
+                allowClear="true"
+                @change-option-value="changeDomain" />
             </a-form-item>
 
             <a-form-item
@@ -395,22 +389,16 @@
               name="account"
               ref="account"
               :label="$t('label.account')">
-              <a-select
-                @change="changeAccount"
+              <infinite-scroll-select
                 v-model:value="importForm.selectedAccount"
-                showSearch
-                optionFilterProp="value"
-                :filterOption="(input, option) => {
-                    return option.value.toLowerCase().indexOf(input.toLowerCase()) >= 0
-                  }" >
-                <a-select-option v-for="account in accounts" :key="account.name" :value="account.name">
-                  <span>
-                    <resource-icon v-if="account && account.icon" :image="account.icon.base64image" size="1x" style="margin-right: 5px"/>
-                    <team-outlined v-else style="margin-right: 5px" />
-                    {{ account.name }}
-                  </span>
-                </a-select-option>
-              </a-select>
+                api="listAccounts"
+                :apiParams="accountsApiParams"
+                resourceType="account"
+                optionValueKey="name"
+                optionLabelKey="name"
+                defaultIcon="team-outlined"
+                allowClear="true"
+                @change-option-value="changeAccount" />
               <span v-if="importForm.accountError" class="required">{{ $t('label.required') }}</span>
             </a-form-item>
 
@@ -419,22 +407,16 @@
               name="project"
               ref="project"
               :label="$t('label.project')">
-              <a-select
-                @change="changeProject"
+              <infinite-scroll-select
                 v-model:value="importForm.selectedProject"
-                showSearch
-                optionFilterProp="label"
-                :filterOption="(input, option) => {
-                  return  option.label.toLowerCase().indexOf(input.toLowerCase()) >= 0
-                }" >
-                <a-select-option v-for="project in projects" :key="project.id" :value="project.id" :label="project.name">
-                <span>
-                  <resource-icon v-if="project && project.icon" :image="project.icon.base64image" size="1x" style="margin-right: 5px"/>
-                  <project-outlined v-else style="margin-right: 5px" />
-                  {{ project.name }}
-                </span>
-                </a-select-option>
-              </a-select>
+                api="listProjects"
+                :apiParams="projectsApiParams"
+                resourceType="project"
+                optionValueKey="id"
+                optionLabelKey="name"
+                defaultIcon="project-outlined"
+                allowClear="true"
+                @change-option-value="changeProject" />
               <span v-if="importForm.projectError" class="required">{{ $t('label.required') }}</span>
             </a-form-item>
 
@@ -480,6 +462,7 @@ import Status from '@/components/widgets/Status'
 import SearchView from '@/components/view/SearchView'
 import ResourceIcon from '@/components/view/ResourceIcon'
 import TooltipLabel from '@/components/widgets/TooltipLabel.vue'
+import InfiniteScrollSelect from '@/components/widgets/InfiniteScrollSelect.vue'
 
 export default {
   components: {
@@ -487,7 +470,8 @@ export default {
     Breadcrumb,
     Status,
     SearchView,
-    ResourceIcon
+    ResourceIcon,
+    InfiniteScrollSelect
   },
   name: 'ManageVolumes',
   data () {
@@ -607,7 +591,6 @@ export default {
     this.page.managed = parseInt(this.$route.query.managedpage || 1)
     this.initForm()
     this.fetchData()
-    this.fetchDomains()
   },
   computed: {
     isPageAllowed () {
@@ -629,6 +612,36 @@ export default {
     showCluster () {
       return this.poolscope !== 'zone'
     },
+    domainsApiParams () {
+      return {
+        listall: true,
+        details: 'min',
+        showicon: true
+      }
+    },
+    accountsApiParams () {
+      if (!this.importForm.selectedDomain) {
+        return null
+      }
+      return {
+        domainid: this.importForm.selectedDomain,
+        showicon: true,
+        state: 'Enabled',
+        isrecursive: false
+      }
+    },
+    projectsApiParams () {
+      if (!this.importForm.selectedDomain) {
+        return null
+      }
+      return {
+        domainid: this.importForm.selectedDomain,
+        state: 'Active',
+        showicon: true,
+        details: 'min',
+        isrecursive: false
+      }
+    },
     showHost () {
       return this.poolscope === 'host'
     },
@@ -970,53 +983,6 @@ export default {
       this.updateQuery('scope', value)
       this.fetchOptions(this.params.zones, 'zones', value)
     },
-    fetchDomains () {
-      api('listDomains', {
-        response: 'json',
-        listAll: true,
-        showicon: true,
-        details: 'min'
-      }).then(response => {
-        this.domains = response.listdomainsresponse.domain || []
-      }).catch(error => {
-        this.$notifyError(error)
-      }).finally(() => {
-        this.loading = false
-      })
-    },
-    fetchAccounts () {
-      this.loading = true
-      api('listAccounts', {
-        response: 'json',
-        domainId: this.importForm.selectedDomain,
-        showicon: true,
-        state: 'Enabled',
-        isrecursive: false
-      }).then(response => {
-        this.accounts = response.listaccountsresponse.account || []
-      }).catch(error => {
-        this.$notifyError(error)
-      }).finally(() => {
-        this.loading = false
-      })
-    },
-    fetchProjects () {
-      this.loading = true
-      api('listProjects', {
-        response: 'json',
-        domainId: this.importForm.selectedDomain,
-        state: 'Active',
-        showicon: true,
-        details: 'min',
-        isrecursive: false
-      }).then(response => {
-        this.projects = response.listprojectsresponse.project || []
-      }).catch(error => {
-        this.$notifyError(error)
-      }).finally(() => {
-        this.loading = false
-      })
-    },
     changeAccountType () {
       this.importForm.selectedDomain = null
       this.importForm.selectedAccount = null
@@ -1029,8 +995,7 @@ export default {
       this.importForm.selectedProject = null
       this.importForm.selectedDiskoffering = null
       this.diskOfferings = {}
-      this.fetchAccounts()
-      this.fetchProjects()
+      // InfiniteScrollSelect will auto-reload when apiParams changes
     },
     changeAccount () {
       this.importForm.selectedProject = null

From b7fc7179fca83f12f2b6ef4d215b02f79f04bcba Mon Sep 17 00:00:00 2001
From: Fabricio Duarte <fabricio.duarte.jr@gmail.com>
Date: Thu, 29 Jan 2026 03:14:05 -0300
Subject: [PATCH 081/117] Add batch deletion support to `removeRawUsageRecords`
 (#12522)

* Add batch deletion support to `removeRawUsageRecords`

* Remove ORDER BY from batch expunge
---
 .../java/com/cloud/usage/dao/UsageDao.java    |  2 +-
 .../com/cloud/usage/dao/UsageDaoImpl.java     | 37 ++++++++++---------
 .../main/java/com/cloud/utils/db/Filter.java  |  3 +-
 .../com/cloud/utils/db/GenericDaoBase.java    |  4 +-
 .../ConfigurationManagerImpl.java             |  2 +-
 .../com/cloud/usage/UsageServiceImpl.java     |  3 +-
 6 files changed, 29 insertions(+), 22 deletions(-)

diff --git a/engine/schema/src/main/java/com/cloud/usage/dao/UsageDao.java b/engine/schema/src/main/java/com/cloud/usage/dao/UsageDao.java
index ea490e60f9e7..b9d8d9c05366 100644
--- a/engine/schema/src/main/java/com/cloud/usage/dao/UsageDao.java
+++ b/engine/schema/src/main/java/com/cloud/usage/dao/UsageDao.java
@@ -62,7 +62,7 @@ public interface UsageDao extends GenericDao<UsageVO, Long> {
 
     void saveUsageRecords(List<UsageVO> usageRecords);
 
-    void removeOldUsageRecords(int days);
+    void expungeAllOlderThan(int days, long limitPerQuery);
 
     UsageVO persistUsage(final UsageVO usage);
 
diff --git a/engine/schema/src/main/java/com/cloud/usage/dao/UsageDaoImpl.java b/engine/schema/src/main/java/com/cloud/usage/dao/UsageDaoImpl.java
index 34e7843bfc46..2d99c78fad18 100644
--- a/engine/schema/src/main/java/com/cloud/usage/dao/UsageDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/usage/dao/UsageDaoImpl.java
@@ -26,15 +26,16 @@
 import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDaoBase;
 import com.cloud.utils.db.QueryBuilder;
+import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
 import com.cloud.utils.db.Transaction;
 import com.cloud.utils.db.TransactionCallback;
-import com.cloud.utils.db.TransactionCallbackNoReturn;
 import com.cloud.utils.db.TransactionLegacy;
 import com.cloud.utils.db.TransactionStatus;
 import com.cloud.utils.exception.CloudRuntimeException;
 
 import org.apache.cloudstack.acl.RoleType;
+import org.apache.commons.lang3.time.DateUtils;
 import org.springframework.stereotype.Component;
 
 import java.sql.PreparedStatement;
@@ -51,7 +52,6 @@
 public class UsageDaoImpl extends GenericDaoBase<UsageVO, Long> implements UsageDao {
     private static final String DELETE_ALL = "DELETE FROM cloud_usage";
     private static final String DELETE_ALL_BY_ACCOUNTID = "DELETE FROM cloud_usage WHERE account_id = ?";
-    private static final String DELETE_ALL_BY_INTERVAL = "DELETE FROM cloud_usage WHERE end_date < DATE_SUB(CURRENT_DATE(), INTERVAL ? DAY)";
     private static final String INSERT_ACCOUNT = "INSERT INTO cloud_usage.account (id, account_name, uuid, type, role_id, domain_id, removed, cleanup_needed) VALUES (?,?,?,?,?,?,?,?)";
     private static final String INSERT_USER_STATS = "INSERT INTO cloud_usage.user_statistics (id, data_center_id, account_id, public_ip_address, device_id, device_type, network_id, net_bytes_received,"
             + " net_bytes_sent, current_bytes_received, current_bytes_sent, agg_bytes_received, agg_bytes_sent) VALUES (?,?,?,?,?,?,?,?,?,?, ?, ?, ?)";
@@ -88,8 +88,12 @@ public class UsageDaoImpl extends GenericDaoBase<UsageVO, Long> implements Usage
 
     private static final String UPDATE_BUCKET_STATS = "UPDATE cloud_usage.bucket_statistics SET size=? WHERE id=?";
 
+    protected SearchBuilder<UsageVO> endDateLessThanSearch;
 
     public UsageDaoImpl() {
+        endDateLessThanSearch = createSearchBuilder();
+        endDateLessThanSearch.and("endDate", endDateLessThanSearch.entity().getEndDate(), SearchCriteria.Op.LT);
+        endDateLessThanSearch.done();
     }
 
     @Override
@@ -539,21 +543,20 @@ public void saveUsageRecords(List<UsageVO> usageRecords) {
     }
 
     @Override
-    public void removeOldUsageRecords(int days) {
-        Transaction.execute(TransactionLegacy.USAGE_DB, new TransactionCallbackNoReturn() {
-            @Override
-            public void doInTransactionWithoutResult(TransactionStatus status) {
-                TransactionLegacy txn = TransactionLegacy.currentTxn();
-                PreparedStatement pstmt = null;
-                try {
-                    pstmt = txn.prepareAutoCloseStatement(DELETE_ALL_BY_INTERVAL);
-                    pstmt.setLong(1, days);
-                    pstmt.executeUpdate();
-                } catch (Exception ex) {
-                    logger.error("error removing old cloud_usage records for interval: " + days);
-                }
-            }
-        });
+    public void expungeAllOlderThan(int days, long limitPerQuery) {
+        SearchCriteria<UsageVO> sc = endDateLessThanSearch.create();
+
+        Date limit = DateUtils.addDays(new Date(), -days);
+        sc.setParameters("endDate", limit);
+
+        TransactionLegacy txn = TransactionLegacy.open(TransactionLegacy.USAGE_DB);
+        try {
+            logger.debug("Removing all cloud_usage records older than [{}].", limit);
+            int totalExpunged = batchExpunge(sc, limitPerQuery);
+            logger.info("Removed a total of [{}] cloud_usage records older than [{}].", totalExpunged, limit);
+        } finally {
+            txn.close();
+        }
     }
 
     public UsageVO persistUsage(final UsageVO usage) {
diff --git a/framework/db/src/main/java/com/cloud/utils/db/Filter.java b/framework/db/src/main/java/com/cloud/utils/db/Filter.java
index fb8c9ee37fcb..90e42952a990 100644
--- a/framework/db/src/main/java/com/cloud/utils/db/Filter.java
+++ b/framework/db/src/main/java/com/cloud/utils/db/Filter.java
@@ -57,7 +57,8 @@ public Filter(Class<?> clazz, String field, boolean ascending) {
     }
 
     public Filter(long limit) {
-        _orderBy = " ORDER BY RAND() LIMIT " + limit;
+        _orderBy = " ORDER BY RAND()";
+        _limit = limit;
     }
 
     public Filter(Long offset, Long limit) {
diff --git a/framework/db/src/main/java/com/cloud/utils/db/GenericDaoBase.java b/framework/db/src/main/java/com/cloud/utils/db/GenericDaoBase.java
index c3a4d2c2487c..535fa032d232 100644
--- a/framework/db/src/main/java/com/cloud/utils/db/GenericDaoBase.java
+++ b/framework/db/src/main/java/com/cloud/utils/db/GenericDaoBase.java
@@ -1161,6 +1161,8 @@ protected void addFilter(final StringBuilder sql, final Filter filter) {
                 if (filter.getLimit() != null) {
                     sql.append(", ").append(filter.getLimit());
                 }
+            } else if (filter.getLimit() != null) {
+                sql.append(" LIMIT ").append(filter.getLimit());
             }
         }
     }
@@ -1322,7 +1324,7 @@ public int batchExpunge(final SearchCriteria<T> sc, final Long batchSize) {
         Filter filter = null;
         final long batchSizeFinal = ObjectUtils.defaultIfNull(batchSize, 0L);
         if (batchSizeFinal > 0) {
-            filter = new Filter(batchSizeFinal);
+            filter = new Filter(null, batchSizeFinal);
         }
         int expunged = 0;
         int currentExpunged = 0;
diff --git a/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java b/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
index 62b3c23d27ec..3a4bdf8afec5 100644
--- a/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
+++ b/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
@@ -527,7 +527,7 @@ public class ConfigurationManagerImpl extends ManagerBase implements Configurati
     public static final ConfigKey<Long> DELETE_QUERY_BATCH_SIZE = new ConfigKey<>("Advanced", Long.class, "delete.query.batch.size", "0",
             "Indicates the limit applied while deleting entries in bulk. With this, the delete query will apply the limit as many times as necessary," +
                     " to delete all the entries. This is advised when retaining several days of records, which can lead to slowness. <= 0 means that no limit will " +
-                    "be applied. Default value is 0. For now, this is used for deletion of vm & volume stats only.", true);
+                    "be applied. Default value is 0. For now, this is used for deletion of VM stats, volume stats, and usage records.", true);
 
     private static final String IOPS_READ_RATE = "IOPS Read";
     private static final String IOPS_WRITE_RATE = "IOPS Write";
diff --git a/server/src/main/java/com/cloud/usage/UsageServiceImpl.java b/server/src/main/java/com/cloud/usage/UsageServiceImpl.java
index c46f1f43fd07..edaa22c3bcfa 100644
--- a/server/src/main/java/com/cloud/usage/UsageServiceImpl.java
+++ b/server/src/main/java/com/cloud/usage/UsageServiceImpl.java
@@ -26,6 +26,7 @@
 import javax.inject.Inject;
 import javax.naming.ConfigurationException;
 
+import com.cloud.configuration.ConfigurationManagerImpl;
 import org.apache.cloudstack.api.command.admin.usage.GenerateUsageRecordsCmd;
 import org.apache.cloudstack.api.command.admin.usage.ListUsageRecordsCmd;
 import org.apache.cloudstack.api.command.admin.usage.RemoveRawUsageRecordsCmd;
@@ -489,7 +490,7 @@ public boolean removeRawUsageRecords(RemoveRawUsageRecordsCmd cmd) throws Invali
                     }
                 }
             }
-            _usageDao.removeOldUsageRecords(interval);
+            _usageDao.expungeAllOlderThan(interval, ConfigurationManagerImpl.DELETE_QUERY_BATCH_SIZE.value());
         } else {
             throw new InvalidParameterValueException("Invalid interval value. Interval to remove cloud_usage records should be greater than 0");
         }

From 65e9bebc698e65a2fee6dbc0f96a8bbd2f5ce084 Mon Sep 17 00:00:00 2001
From: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
Date: Thu, 29 Jan 2026 11:46:10 +0530
Subject: [PATCH 082/117] Show parent snapshot (along with the chain size) for
 incremental snapshots (#12468)

* Show parent snapshot (along with the chain size) for incremental snapshots

* review

* review changes
---
 .../user/config/ListCapabilitiesCmd.java        |  1 +
 .../api/response/CapabilitiesResponse.java      |  8 ++++++++
 .../api/response/SnapshotResponse.java          | 16 ++++++++++++++++
 .../api/query/dao/SnapshotJoinDaoImpl.java      |  2 ++
 .../com/cloud/server/ManagementServerImpl.java  |  2 ++
 ui/src/components/view/ListView.vue             | 14 ++++++++++++++
 ui/src/config/section/storage.js                | 17 +++++++++++++----
 7 files changed, 56 insertions(+), 4 deletions(-)

diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/config/ListCapabilitiesCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/config/ListCapabilitiesCmd.java
index ed1bd7b063b2..947467a6f5e9 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/config/ListCapabilitiesCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/config/ListCapabilitiesCmd.java
@@ -51,6 +51,7 @@ public void execute() {
         response.setDiskOffMaxSize((Long)capabilities.get("customDiskOffMaxSize"));
         response.setRegionSecondaryEnabled((Boolean)capabilities.get("regionSecondaryEnabled"));
         response.setKVMSnapshotEnabled((Boolean)capabilities.get("KVMSnapshotEnabled"));
+        response.setSnapshotShowChainSize((Boolean)capabilities.get("SnapshotShowChainSize"));
         response.setAllowUserViewDestroyedVM((Boolean)capabilities.get("allowUserViewDestroyedVM"));
         response.setAllowUserExpungeRecoverVM((Boolean)capabilities.get("allowUserExpungeRecoverVM"));
         response.setAllowUserExpungeRecoverVolume((Boolean)capabilities.get("allowUserExpungeRecoverVolume"));
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/CapabilitiesResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/CapabilitiesResponse.java
index 930d1a50de0f..d8b6384216d6 100644
--- a/api/src/main/java/org/apache/cloudstack/api/response/CapabilitiesResponse.java
+++ b/api/src/main/java/org/apache/cloudstack/api/response/CapabilitiesResponse.java
@@ -73,6 +73,10 @@ public class CapabilitiesResponse extends BaseResponse {
     @Param(description = "True if Snapshot is supported for KVM host, false otherwise")
     private boolean kvmSnapshotEnabled;
 
+    @SerializedName("snapshotshowchainsize")
+    @Param(description = "True to show the parent and chain size (sum of physical size of snapshot and all its parents) for incremental snapshots", since = "4.22.1")
+    private boolean snapshotShowChainSize;
+
     @SerializedName("apilimitmax")
     @Param(description = "Max allowed number of api requests within the specified interval")
     private Integer apiLimitMax;
@@ -197,6 +201,10 @@ public void setKVMSnapshotEnabled(boolean kvmSnapshotEnabled) {
         this.kvmSnapshotEnabled = kvmSnapshotEnabled;
     }
 
+    public void setSnapshotShowChainSize(boolean snapshotShowChainSize) {
+        this.snapshotShowChainSize = snapshotShowChainSize;
+    }
+
     public void setApiLimitInterval(Integer apiLimitInterval) {
         this.apiLimitInterval = apiLimitInterval;
     }
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/SnapshotResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/SnapshotResponse.java
index 827a55b18754..3db6fd87ed59 100644
--- a/api/src/main/java/org/apache/cloudstack/api/response/SnapshotResponse.java
+++ b/api/src/main/java/org/apache/cloudstack/api/response/SnapshotResponse.java
@@ -155,6 +155,14 @@ public class SnapshotResponse extends BaseResponseWithTagInformation implements
     @Param(description = "download progress of a snapshot", since = "4.19.0")
     private Map<String, String> downloadDetails;
 
+    @SerializedName("parent")
+    @Param(description = "The parent ID of the Snapshot", since = "4.22.1")
+    private String parent;
+
+    @SerializedName("parentname")
+    @Param(description = "The parent name of the Snapshot", since = "4.22.1")
+    private String parentName;
+
     public SnapshotResponse() {
         tags = new LinkedHashSet<ResourceTagResponse>();
     }
@@ -313,4 +321,12 @@ public void setDatastoreType(String datastoreType) {
     public void setDownloadDetails(Map<String, String> downloadDetails) {
         this.downloadDetails = downloadDetails;
     }
+
+    public void setParent(String parent) {
+        this.parent = parent;
+    }
+
+    public void setParentName(String parentName) {
+        this.parentName = parentName;
+    }
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/SnapshotJoinDaoImpl.java b/server/src/main/java/com/cloud/api/query/dao/SnapshotJoinDaoImpl.java
index 9ea14edf2b73..0b0d9b269f3e 100644
--- a/server/src/main/java/com/cloud/api/query/dao/SnapshotJoinDaoImpl.java
+++ b/server/src/main/java/com/cloud/api/query/dao/SnapshotJoinDaoImpl.java
@@ -109,6 +109,8 @@ private void setSnapshotInfoDetailsInResponse(SnapshotJoinVO snapshot, SnapshotR
             if (showChainSize && snapshotInfo.getParent() != null) {
                 long chainSize = calculateChainSize(snapshotInfo);
                 snapshotResponse.setChainSize(chainSize);
+                snapshotResponse.setParent(snapshotInfo.getParent().getUuid());
+                snapshotResponse.setParentName(snapshotInfo.getParent().getName());
             }
         }
     }
diff --git a/server/src/main/java/com/cloud/server/ManagementServerImpl.java b/server/src/main/java/com/cloud/server/ManagementServerImpl.java
index 110beffe4e66..249d5da81dce 100644
--- a/server/src/main/java/com/cloud/server/ManagementServerImpl.java
+++ b/server/src/main/java/com/cloud/server/ManagementServerImpl.java
@@ -4799,6 +4799,7 @@ public Map<String, Object> listCapabilities(final ListCapabilitiesCmd cmd) {
         final long diskOffMinSize = VolumeOrchestrationService.CustomDiskOfferingMinSize.value();
         final long diskOffMaxSize = VolumeOrchestrationService.CustomDiskOfferingMaxSize.value();
         final boolean KVMSnapshotEnabled = SnapshotManager.KVMSnapshotEnabled.value();
+        final boolean SnapshotShowChainSize = SnapshotManager.snapshotShowChainSize.value();
 
         final boolean userPublicTemplateEnabled = TemplateManager.AllowPublicUserTemplates.valueIn(caller.getId());
 
@@ -4839,6 +4840,7 @@ public Map<String, Object> listCapabilities(final ListCapabilitiesCmd cmd) {
         capabilities.put("customDiskOffMaxSize", diskOffMaxSize);
         capabilities.put("regionSecondaryEnabled", regionSecondaryEnabled);
         capabilities.put("KVMSnapshotEnabled", KVMSnapshotEnabled);
+        capabilities.put("SnapshotShowChainSize", SnapshotShowChainSize);
         capabilities.put("allowUserViewDestroyedVM", allowUserViewDestroyedVM);
         capabilities.put("allowUserExpungeRecoverVM", allowUserExpungeRecoverVM);
         capabilities.put("allowUserExpungeRecoverVolume", allowUserExpungeRecoverVolume);
diff --git a/ui/src/components/view/ListView.vue b/ui/src/components/view/ListView.vue
index 79ec5a182071..ebdfe3df1b4d 100644
--- a/ui/src/components/view/ListView.vue
+++ b/ui/src/components/view/ListView.vue
@@ -739,6 +739,20 @@
         >{{ text }}</router-link>
         <span v-else>{{ text }}</span>
       </template>
+      <template v-if="column.key === 'parentname' && ['snapshot'].includes($route.path.split('/')[1])">
+        <router-link
+          v-if="record.parent && $router.resolve('/snapshot/' + record.parent).matched[0].redirect !== '/exception/404'"
+          :to="{ path: '/snapshot/' + record.parent }"
+        >{{ text }}</router-link>
+        <span v-else>{{ text }}</span>
+      </template>
+      <template v-if="column.key === 'parentName' && ['vmsnapshot'].includes($route.path.split('/')[1])">
+        <router-link
+          v-if="record.parent && $router.resolve('/vmsnapshot/' + record.parent).matched[0].redirect !== '/exception/404'"
+          :to="{ path: '/vmsnapshot/' + record.parent }"
+        >{{ text }}</router-link>
+        <span v-else>{{ text }}</span>
+      </template>
       <template v-if="column.key === 'templateversion'">
         <span> {{ record.version }} </span>
       </template>
diff --git a/ui/src/config/section/storage.js b/ui/src/config/section/storage.js
index 41875ec4db53..75432314b034 100644
--- a/ui/src/config/section/storage.js
+++ b/ui/src/config/section/storage.js
@@ -92,7 +92,7 @@ export default {
         }
       ],
       searchFilters: () => {
-        var filters = ['name', 'zoneid', 'domainid', 'account', 'state', 'tags', 'serviceofferingid', 'diskofferingid', 'isencrypted']
+        const filters = ['name', 'zoneid', 'domainid', 'account', 'state', 'tags', 'serviceofferingid', 'diskofferingid', 'isencrypted']
         if (['Admin', 'DomainAdmin'].includes(store.getters.userInfo.roletype)) {
           filters.push('storageid')
         }
@@ -311,7 +311,10 @@ export default {
       permission: ['listSnapshots'],
       resourceType: 'Snapshot',
       columns: () => {
-        var fields = ['name', 'state', 'volumename', 'intervaltype', 'physicalsize', 'created']
+        const fields = ['name', 'state', 'volumename', 'intervaltype', 'physicalsize', 'created']
+        if (store.getters.features.snapshotshowchainsize) {
+          fields.splice(fields.indexOf('created'), 0, 'chainsize', 'parentname')
+        }
         if (['Admin', 'DomainAdmin'].includes(store.getters.userInfo.roletype)) {
           fields.push('account')
           if (store.getters.listAllProjects) {
@@ -324,7 +327,13 @@ export default {
         fields.push('zonename')
         return fields
       },
-      details: ['name', 'id', 'volumename', 'volumetype', 'snapshottype', 'intervaltype', 'physicalsize', 'virtualsize', 'chainsize', 'account', 'domain', 'created'],
+      details: () => {
+        const fields = ['name', 'id', 'volumename', 'volumetype', 'snapshottype', 'intervaltype', 'physicalsize', 'virtualsize', 'account', 'domain', 'created']
+        if (store.getters.features.snapshotshowchainsize) {
+          fields.splice(fields.indexOf('account'), 0, 'chainsize', 'parentname')
+        }
+        return fields
+      },
       tabs: [
         {
           name: 'details',
@@ -346,7 +355,7 @@ export default {
         }
       ],
       searchFilters: () => {
-        var filters = ['name', 'domainid', 'account', 'tags', 'zoneid']
+        const filters = ['name', 'domainid', 'account', 'tags', 'zoneid']
         if (['Admin', 'DomainAdmin'].includes(store.getters.userInfo.roletype)) {
           filters.push('storageid')
           filters.push('imagestoreid')

From 286e406e3872d7cbef26e3182ad4b764841d90e4 Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Thu, 29 Jan 2026 12:05:51 +0530
Subject: [PATCH 083/117] ui: clear selected resource when no items in listview
 (#11946)

Fixes #11922

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
---
 ui/src/views/AutogenView.vue | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/ui/src/views/AutogenView.vue b/ui/src/views/AutogenView.vue
index e0583cd97a4e..1cbd3d282b98 100644
--- a/ui/src/views/AutogenView.vue
+++ b/ui/src/views/AutogenView.vue
@@ -1191,15 +1191,12 @@ export default {
             }
           }
         }
-        if (this.items.length > 0) {
-          if (!this.showAction || this.dataView) {
-            this.resource = this.items[0]
-            this.$emit('change-resource', this.resource)
-          }
-        } else {
-          if (this.dataView) {
-            this.$router.push({ path: '/exception/404' })
-          }
+        if (this.items.length <= 0 && this.dataView) {
+          this.$router.push({ path: '/exception/404' })
+        }
+        if (!this.showAction || this.dataView) {
+          this.resource = this.items?.[0] || {}
+          this.$emit('change-resource', this.resource)
         }
       }).catch(error => {
         if (!error || !error.message) {

From 10e0d42f456cb994570cce172ffef02bd8bedeaa Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Thu, 29 Jan 2026 13:07:52 +0530
Subject: [PATCH 084/117] =?UTF-8?q?ui:=20introduce=20section-level=20?=
 =?UTF-8?q?=E2=80=9Cadvisories=E2=80=9D=20with=20quick-fix=20actions=20(#1?=
 =?UTF-8?q?1763)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* ui: introduce section-level “advisories” with quick-fix actions

This change adds a lightweight “advisories” mechanism to section configs and ships the first advisory to help operators satisfy some of the CKS prerequisites.

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix endpoint.url check

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* label consistency

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* Update ui/src/components/view/AdvisoriesView.vue

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

* improvements

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* remove comments

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* allow disabling

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

---------

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 ui/public/locales/en.json                 |  17 +++
 ui/src/api/index.js                       |   4 +
 ui/src/components/view/AdvisoriesView.vue | 161 +++++++++++++++++++
 ui/src/config/router.js                   |   5 +
 ui/src/config/section/compute.js          | 178 ++++++++++++++++++++++
 ui/src/utils/acsrepo/index.js             |  81 ++++++++++
 ui/src/views/AutogenView.vue              |   7 +-
 7 files changed, 452 insertions(+), 1 deletion(-)
 create mode 100644 ui/src/components/view/AdvisoriesView.vue
 create mode 100644 ui/src/utils/acsrepo/index.js

diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index 4c57faf4b317..57343658d58e 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -292,8 +292,10 @@
 "label.add.isolated.network": "Add Isolated Network",
 "label.add.kubernetes.cluster": "Add Kubernetes Cluster",
 "label.add.acl.name": "ACL name",
+"label.add.latest.kubernetes.iso": "Add latest Kubernetes ISO",
 "label.add.ldap.account": "Add LDAP Account",
 "label.add.logical.router": "Add Logical Router to this Network",
+"label.add.minimum.required.compute.offering": "Add minimum required Compute Offering",
 "label.add.more": "Add more",
 "label.add.nodes": "Add Nodes to Kubernetes Cluster",
 "label.add.netscaler.device": "Add Netscaler Device",
@@ -1102,6 +1104,7 @@
 "label.firstname": "First name",
 "label.firstname.lower": "firstname",
 "label.fix.errors": "Fix errors",
+"label.fix.global.setting": "Fix Global Setting",
 "label.fixed": "Fixed Offering",
 "label.for": "for",
 "label.forcks": "For CKS",
@@ -1135,6 +1138,9 @@
 "label.globo.dns.configuration": "GloboDNS configuration",
 "label.glustervolume": "Volume",
 "label.go.back": "Go back",
+"label.go.to.compute.offerings": "Go to Compute Offerings",
+"label.go.to.global.settings": "Go to Global Settings",
+"label.go.to.kubernetes.isos": "Go to Kubernetes ISOs",
 "label.gpu": "GPU",
 "label.gpucardid": "GPU Card",
 "label.gpucardname": "GPU Card",
@@ -3058,12 +3064,17 @@
 "message.add.ip.v6.firewall.rule.failed": "Failed to add IPv6 firewall rule",
 "message.add.ip.v6.firewall.rule.processing": "Adding IPv6 firewall rule...",
 "message.add.ip.v6.firewall.rule.success": "Added IPv6 firewall rule",
+"message.advisory.cks.endpoint.url.not.configured": "Endpoint URL which will be used by Kubernetes clusters is not configured correctly",
+"message.advisory.cks.min.offering": "No suitable Compute Offering found for Kubernetes cluster nodes with minimum required resources (2 vCPU, 2 GB RAM)",
+"message.advisory.cks.version.check": "No Kubernetes version found that can be used to deploy a Kubernetes cluster",
 "message.redeliver.webhook.delivery": "Redeliver this Webhook delivery",
 "message.remove.ip.v6.firewall.rule.failed": "Failed to remove IPv6 firewall rule",
 "message.remove.ip.v6.firewall.rule.processing": "Removing IPv6 firewall rule...",
 "message.remove.ip.v6.firewall.rule.success": "Removed IPv6 firewall rule",
 "message.remove.sslcert.failed": "Failed to remove SSL certificate from load balancer",
 "message.remove.sslcert.processing": "Removing SSL certificate from load balancer...",
+"message.add.latest.kubernetes.iso.failed": "Failed to add latest Kubernetes ISO",
+"message.add.minimum.required.compute.offering.kubernetes.cluster.failed": "Failed to add minimum required Compute Offering for Kubernetes cluster nodes",
 "message.add.netris.controller": "Add Netris Provider",
 "message.add.nsx.controller": "Add NSX Provider",
 "message.add.network": "Add a new network for Zone: <b><span id=\"zone_name\"></span></b>",
@@ -3104,9 +3115,13 @@
 "message.add.vpn.gateway": "Please confirm that you want to add a VPN Gateway.",
 "message.add.vpn.gateway.failed": "Adding VPN gateway failed",
 "message.add.vpn.gateway.processing": "Adding VPN gateway...",
+"message.added.latest.kubernetes.iso": "Latest Kubernetes ISO added successfully",
+"message.added.minimum.required.compute.offering.kubernetes.cluster": "Minimum required Compute Offering for Kubernetes cluster nodes added successfully",
 "message.added.vpc.offering": "Added VPC offering",
 "message.adding.firewall.policy": "Adding Firewall Policy",
 "message.adding.host": "Adding host",
+"message.adding.latest.kubernetes.iso": "Adding latest Kubernetes ISO",
+"message.adding.minimum.required.compute.offering.kubernetes.cluster": "Adding minimum required Compute Offering for Kubernetes cluster nodes",
 "message.adding.netscaler.device": "Adding Netscaler device",
 "message.adding.netscaler.provider": "Adding Netscaler provider",
 "message.adding.nodes.to.cluster": "Adding nodes to Kubernetes cluster",
@@ -3544,6 +3559,8 @@
 "message.failed.to.remove": "Failed to remove",
 "message.forgot.password.success": "An email has been sent to your email address with instructions on how to reset your password.",
 "message.generate.keys": "Please confirm that you would like to generate new API/Secret keys for this User.",
+"message.global.setting.updated": "Global Setting updated successfully.",
+"message.global.setting.update.failed": "Failed to update Global Setting.",
 "message.chart.statistic.info": "The shown charts are self-adjustable, that means, if the value gets close to the limit or overpass it, it will grow to adjust the shown value",
 "message.chart.statistic.info.hypervisor.additionals": "The metrics data depend on the hypervisor plugin used for each hypervisor. The behavior can vary across different hypervisors. For instance, with KVM, metrics are real-time statistics provided by libvirt. In contrast, with VMware, the metrics are averaged data for a given time interval controlled by configuration.",
 "message.guest.traffic.in.advanced.zone": "Guest Network traffic is communication between end-user Instances. Specify a range of VLAN IDs or VXLAN Network identifiers (VNIs) to carry guest traffic for each physical Network.",
diff --git a/ui/src/api/index.js b/ui/src/api/index.js
index 0c8e8e9696c3..5ec73a0b20e1 100644
--- a/ui/src/api/index.js
+++ b/ui/src/api/index.js
@@ -140,3 +140,7 @@ export function oauthlogin (arg) {
     }
   })
 }
+
+export function getBaseUrl () {
+  return vueProps.axios.defaults.baseURL
+}
diff --git a/ui/src/components/view/AdvisoriesView.vue b/ui/src/components/view/AdvisoriesView.vue
new file mode 100644
index 000000000000..c668ec023801
--- /dev/null
+++ b/ui/src/components/view/AdvisoriesView.vue
@@ -0,0 +1,161 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+<template>
+  <div>
+    <div v-for="advisory in advisories" :key="advisory.id" style="margin-bottom: 10px;">
+      <a-alert
+        :type="advisory.severity || 'info'"
+        :show-icon="true"
+        :closable="true"
+        :message="$t(advisory.message)"
+        @close="onAlertClose(advisory)">
+        <template #description>
+          <a-space direction="horizontal" size="small">
+            <span v-for="(action, idx) in advisory.actions" :key="idx">
+              <a-button
+                v-if="typeof action.show === 'function' ? action.show($store) : action.show"
+                size="small"
+                :type="(action.primary || advisory.actions.length === 1) ? 'primary' : 'default'"
+                @click="onAlertBtnClick(action, advisory)">
+                {{ $t(action.label) }}
+              </a-button>
+            </span>
+          </a-space>
+        </template>
+      </a-alert>
+    </div>
+  </div>
+</template>
+
+<script>
+
+const DISMISSED_ADVISORIES_KEY = 'dismissed_advisories'
+
+export default {
+  name: 'AdvisoriesView',
+  components: {
+  },
+  props: {},
+  data () {
+    return {
+      advisories: []
+    }
+  },
+  created () {
+    this.evaluateAdvisories()
+  },
+  computed: {
+  },
+  methods: {
+    async evaluateAdvisories () {
+      this.advisories = []
+      const metaAdvisories = this.$route.meta.advisories || []
+      const dismissedAdvisories = this.$localStorage.get(DISMISSED_ADVISORIES_KEY) || []
+      const advisoryPromises = metaAdvisories.map(async advisory => {
+        if (dismissedAdvisories.includes(advisory.id)) {
+          return null
+        }
+        const active = await Promise.resolve(advisory.condition(this.$store))
+        if (active) {
+          return advisory
+        } else if (advisory.dismissOnConditionFail) {
+          this.dismissAdvisory(advisory.id, true)
+        }
+        return null
+      })
+      const results = await Promise.all(advisoryPromises)
+      this.advisories = results.filter(a => a !== null)
+    },
+    onAlertClose (advisory) {
+      this.dismissAdvisory(advisory.id)
+    },
+    dismissAdvisory (advisoryId, skipUpdateLocal) {
+      let dismissedAdvisories = this.$localStorage.get(DISMISSED_ADVISORIES_KEY) || []
+      dismissedAdvisories = dismissedAdvisories.filter(id => id !== advisoryId)
+      dismissedAdvisories.push(advisoryId)
+      this.$localStorage.set(DISMISSED_ADVISORIES_KEY, dismissedAdvisories)
+      if (skipUpdateLocal) {
+        return
+      }
+      this.advisories = this.advisories.filter(advisory => advisory.id !== advisoryId)
+    },
+    undismissAdvisory (advisory, evaluate) {
+      let dismissedAdvisories = this.$localStorage.get(DISMISSED_ADVISORIES_KEY) || []
+      dismissedAdvisories = dismissedAdvisories.filter(id => id !== advisory.id)
+      this.$localStorage.set(DISMISSED_ADVISORIES_KEY, dismissedAdvisories)
+      if (evaluate) {
+        Promise.resolve(advisory.condition(this.$store)).then(active => {
+          if (active) {
+            this.advisories.push(advisory)
+          }
+        })
+      } else {
+        this.advisories.push(advisory)
+      }
+    },
+    handleAdvisoryActionError (action, advisory, evaluate) {
+      if (action.errorMessage) {
+        this.showActionMessage('error', advisory.id, action.errorMessage)
+      }
+      this.undismissAdvisory(advisory, evaluate)
+    },
+    handleAdvisoryActionResult (action, advisory, result) {
+      if (result && action.successMessage) {
+        this.showActionMessage('success', advisory.id, action.successMessage)
+        return
+      }
+      this.handleAdvisoryActionError(action, advisory, false)
+    },
+    showActionMessage (type, key, content) {
+      const data = {
+        content: this.$t(content),
+        key: key,
+        duration: type === 'loading' ? 0 : 3
+      }
+      if (type === 'loading') {
+        this.$message.loading(data)
+      } else if (type === 'success') {
+        this.$message.success(data)
+      } else if (type === 'error') {
+        this.$message.error(data)
+      } else {
+        this.$message.info(data)
+      }
+    },
+    onAlertBtnClick (action, advisory) {
+      this.dismissAdvisory(advisory.id)
+      if (typeof action.run !== 'function') {
+        return
+      }
+      if (action.loadingLabel) {
+        this.showActionMessage('loading', advisory.id, action.loadingLabel)
+      }
+      const result = action.run(this.$store, this.$router)
+      if (result instanceof Promise) {
+        result.then(success => {
+          this.handleAdvisoryActionResult(action, advisory, success)
+        }).catch(() => {
+          this.handleAdvisoryActionError(action, advisory, true)
+        })
+      } else {
+        this.handleAdvisoryActionResult(action, advisory, result)
+      }
+    }
+  }
+}
+</script>
diff --git a/ui/src/config/router.js b/ui/src/config/router.js
index 08df799dd898..3e5d8677b347 100644
--- a/ui/src/config/router.js
+++ b/ui/src/config/router.js
@@ -81,6 +81,7 @@ function generateRouterMap (section) {
           filters: child.filters,
           params: child.params ? child.params : {},
           columns: child.columns,
+          advisories: !vueProps.$config.advisoriesDisabled ? child.advisories : undefined,
           details: child.details,
           searchFilters: child.searchFilters,
           related: child.related,
@@ -180,6 +181,10 @@ function generateRouterMap (section) {
     map.meta.columns = section.columns
   }
 
+  if (!vueProps.$config.advisoriesDisabled && section.advisories) {
+    map.meta.advisories = section.advisories
+  }
+
   if (section.actions) {
     map.meta.actions = section.actions
   }
diff --git a/ui/src/config/section/compute.js b/ui/src/config/section/compute.js
index a03693e351d8..32e888bb53dc 100644
--- a/ui/src/config/section/compute.js
+++ b/ui/src/config/section/compute.js
@@ -18,6 +18,8 @@
 import { shallowRef, defineAsyncComponent } from 'vue'
 import store from '@/store'
 import { isZoneCreated } from '@/utils/zone'
+import { getAPI, postAPI, getBaseUrl } from '@/api'
+import { getLatestKubernetesIsoParams } from '@/utils/acsrepo'
 import kubernetesIcon from '@/assets/icons/kubernetes.svg?inline'
 
 export default {
@@ -582,6 +584,182 @@ export default {
         }
       ],
       resourceType: 'KubernetesCluster',
+      advisories: [
+        {
+          id: 'cks-min-offering',
+          severity: 'warning',
+          message: 'message.advisory.cks.min.offering',
+          docsHelp: 'plugins/cloudstack-kubernetes-service.html',
+          dismissOnConditionFail: true,
+          condition: async (store) => {
+            if (!('listServiceOfferings' in store.getters.apis)) {
+              return false
+            }
+            const params = {
+              cpunumber: 2,
+              memory: 2048,
+              issystem: false
+            }
+            try {
+              const json = await getAPI('listServiceOfferings', params)
+              const offerings = json?.listserviceofferingsresponse?.serviceoffering || []
+              return !offerings.some(o => !o.iscustomized)
+            } catch (error) {}
+            return false
+          },
+          actions: [
+            {
+              primary: true,
+              label: 'label.add.minimum.required.compute.offering',
+              loadingLabel: 'message.adding.minimum.required.compute.offering.kubernetes.cluster',
+              show: (store) => { return ('createServiceOffering' in store.getters.apis) },
+              run: async () => {
+                const params = {
+                  name: 'CKS Instance',
+                  cpunumber: 2,
+                  cpuspeed: 1000,
+                  memory: 2048,
+                  iscustomized: false,
+                  issystem: false
+                }
+                try {
+                  const json = await postAPI('createServiceOffering', params)
+                  if (json?.createserviceofferingresponse?.serviceoffering) {
+                    return true
+                  }
+                } catch (error) {}
+                return false
+              },
+              successMessage: 'message.added.minimum.required.compute.offering.kubernetes.cluster',
+              errorMessage: 'message.add.minimum.required.compute.offering.kubernetes.cluster.failed'
+            },
+            {
+              label: 'label.go.to.compute.offerings',
+              show: (store) => { return ('listServiceOfferings' in store.getters.apis) },
+              run: (store, router) => {
+                router.push({ name: 'computeoffering' })
+                return false
+              }
+            }
+          ]
+        },
+        {
+          id: 'cks-version-check',
+          severity: 'warning',
+          message: 'message.advisory.cks.version.check',
+          docsHelp: 'plugins/cloudstack-kubernetes-service.html',
+          dismissOnConditionFail: true,
+          condition: async (store) => {
+            const api = 'listKubernetesSupportedVersions'
+            if (!(api in store.getters.apis)) {
+              return false
+            }
+            try {
+              const json = await getAPI(api, {})
+              const versions = json?.listkubernetessupportedversionsresponse?.kubernetessupportedversion || []
+              return versions.length === 0
+            } catch (error) {}
+            return false
+          },
+          actions: [
+            {
+              primary: true,
+              label: 'label.add.latest.kubernetes.iso',
+              loadingLabel: 'message.adding.latest.kubernetes.iso',
+              show: (store) => { return ('addKubernetesSupportedVersion' in store.getters.apis) },
+              run: async () => {
+                let arch = 'x86_64'
+                if ('listClusters' in store.getters.apis) {
+                  try {
+                    const json = await getAPI('listClusters', { allocationstate: 'Enabled', page: 1, pagesize: 1 })
+                    const cluster = json?.listclustersresponse?.cluster?.[0] || {}
+                    arch = cluster.architecture || 'x86_64'
+                  } catch (error) {}
+                }
+                const params = await getLatestKubernetesIsoParams(arch)
+                try {
+                  const json = await postAPI('addKubernetesSupportedVersion', params)
+                  if (json?.addkubernetessupportedversionresponse?.kubernetessupportedversion) {
+                    return true
+                  }
+                } catch (error) {}
+                return false
+              },
+              successMessage: 'message.added.latest.kubernetes.iso',
+              errorMessage: 'message.add.latest.kubernetes.iso.failed'
+            },
+            {
+              label: 'label.go.to.kubernetes.isos',
+              show: true,
+              run: (store, router) => {
+                router.push({ name: 'kubernetesiso' })
+                return false
+              }
+            }
+          ]
+        },
+        {
+          id: 'cks-endpoint-url',
+          severity: 'warning',
+          message: 'message.advisory.cks.endpoint.url.not.configured',
+          docsHelp: 'plugins/cloudstack-kubernetes-service.html',
+          dismissOnConditionFail: true,
+          condition: async (store) => {
+            if (!['Admin'].includes(store.getters.userInfo.roletype)) {
+              return false
+            }
+            let url = ''
+            const baseUrl = getBaseUrl()
+            if (baseUrl.startsWith('/')) {
+              url = window.location.origin + baseUrl
+            }
+            if (!url || url.startsWith('http://localhost')) {
+              return false
+            }
+            const params = {
+              name: 'endpoint.url'
+            }
+            const json = await getAPI('listConfigurations', params)
+            const configuration = json?.listconfigurationsresponse?.configuration?.[0] || {}
+            return !configuration.value || configuration.value.startsWith('http://localhost')
+          },
+          actions: [
+            {
+              primary: true,
+              label: 'label.fix.global.setting',
+              show: (store) => { return ('updateConfiguration' in store.getters.apis) },
+              run: async () => {
+                let url = ''
+                const baseUrl = getBaseUrl()
+                if (baseUrl.startsWith('/')) {
+                  url = window.location.origin + baseUrl
+                }
+                const params = {
+                  name: 'endpoint.url',
+                  value: url
+                }
+                try {
+                  const json = await postAPI('updateConfiguration', params)
+                  if (json?.updateconfigurationresponse?.configuration) {
+                    return true
+                  }
+                } catch (error) {}
+                return false
+              },
+              successMessage: 'message.global.setting.updated',
+              errorMessage: 'message.global.setting.update.failed'
+            },
+            {
+              label: 'label.go.to.global.settings',
+              show: (store) => { return ('listConfigurations' in store.getters.apis) },
+              run: (store, router) => {
+                router.push({ name: 'globalsetting' })
+                return false
+              }
+            }
+          ]
+        }
+      ],
       actions: [
         {
           api: 'createKubernetesCluster',
diff --git a/ui/src/utils/acsrepo/index.js b/ui/src/utils/acsrepo/index.js
new file mode 100644
index 000000000000..809bd7f17483
--- /dev/null
+++ b/ui/src/utils/acsrepo/index.js
@@ -0,0 +1,81 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+const BASE_KUBERNETES_ISO_URL = 'https://download.cloudstack.org/cks/'
+
+function getDefaultLatestKubernetesIsoParams (arch) {
+  return {
+    name: 'v1.33.1-calico-' + arch,
+    semanticversion: '1.33.1',
+    url: BASE_KUBERNETES_ISO_URL + 'setup-v1.33.1-calico-' + arch + '.iso',
+    arch: arch,
+    mincpunumber: 2,
+    minmemory: 2048
+  }
+}
+
+/**
+ * Returns the latest Kubernetes ISO info for the given architecture.
+ * Falls back to a hardcoded default if fetching fails.
+ * @param {string} arch
+ * @returns {Promise<{name: string, semanticversion: string, url: string, arch: string}>}
+ */
+export async function getLatestKubernetesIsoParams (arch) {
+  arch = arch || 'x86_64'
+  try {
+    const html = await fetch(BASE_KUBERNETES_ISO_URL, { cache: 'no-store' }).then(r => r.text())
+
+    const hrefs = [...html.matchAll(/href="([^"]+\.iso)"/gi)].map(m => m[1])
+
+    // Prefer files that explicitly include the arch (e.g. ...-x86_64.iso)
+    let isoHrefs = hrefs.filter(h => new RegExp(`${arch}\\.iso$`, 'i').test(h))
+
+    // Fallback: older files without arch suffix (e.g. setup-1.28.4.iso)
+    if (isoHrefs.length === 0) {
+      isoHrefs = hrefs.filter(h => /setup-\d+\.\d+\.\d+\.iso$/i.test(h))
+    }
+
+    const entries = isoHrefs.map(h => {
+      const m = h.match(/setup-(?:v)?(\d+\.\d+\.\d+)(?:-calico)?(?:-(x86_64|arm64))?/i)
+      return m
+        ? {
+          name: h.replace('.iso', ''),
+          semanticversion: m[1],
+          url: new URL(h, BASE_KUBERNETES_ISO_URL).toString(),
+          arch: m[2] || arch,
+          mincpunumber: 2,
+          minmemory: 2048
+        }
+        : null
+    }).filter(Boolean)
+
+    if (entries.length === 0) throw new Error('No matching ISOs found')
+
+    entries.sort((a, b) => {
+      const pa = a.semanticversion.split('.').map(Number)
+      const pb = b.semanticversion.split('.').map(Number)
+      for (let i = 0; i < 3; i++) {
+        if ((pb[i] ?? 0) !== (pa[i] ?? 0)) return (pb[i] ?? 0) - (pa[i] ?? 0)
+      }
+      return 0
+    })
+
+    return entries[0]
+  } catch {
+    return { ...getDefaultLatestKubernetesIsoParams(arch) }
+  }
+}
diff --git a/ui/src/views/AutogenView.vue b/ui/src/views/AutogenView.vue
index e0583cd97a4e..cfbaf580507d 100644
--- a/ui/src/views/AutogenView.vue
+++ b/ui/src/views/AutogenView.vue
@@ -540,6 +540,9 @@
         class="row-element"
         v-else
       >
+        <advisories-view
+          v-if="$route.meta.advisories && !loading"
+        />
         <list-view
           :loading="loading"
           :columns="columns"
@@ -604,6 +607,7 @@ import ResourceIcon from '@/components/view/ResourceIcon'
 import BulkActionProgress from '@/components/view/BulkActionProgress'
 import TooltipLabel from '@/components/widgets/TooltipLabel'
 import DetailsInput from '@/components/widgets/DetailsInput'
+import AdvisoriesView from '@/components/view/AdvisoriesView'
 
 export default {
   name: 'Resource',
@@ -617,7 +621,8 @@ export default {
     TooltipLabel,
     OsLogo,
     ResourceIcon,
-    DetailsInput
+    DetailsInput,
+    AdvisoriesView
   },
   mixins: [mixinDevice],
   provide: function () {

From bd459a4c4c79ff9ef20be4894a4c472ea52a4632 Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Thu, 29 Jan 2026 13:30:54 +0530
Subject: [PATCH 085/117] ui: allow viewing hosts from management server
 connected agents (#12149)

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
---
 ui/src/components/view/ListView.vue | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/ui/src/components/view/ListView.vue b/ui/src/components/view/ListView.vue
index ebdfe3df1b4d..7fd344da209f 100644
--- a/ui/src/components/view/ListView.vue
+++ b/ui/src/components/view/ListView.vue
@@ -868,6 +868,14 @@
       <template v-if="['isfeatured'].includes(column.key) && ['guestoscategory'].includes($route.path.split('/')[1])">
         {{ record.isfeatured ? $t('label.yes') : $t('label.no') }}
       </template>
+      <template v-if="['agentscount'].includes(column.key)">
+        <router-link
+          v-if="['managementserver'].includes($route.path.split('/')[1]) && $router.resolve('/host').matched[0].redirect !== '/exception/404'"
+          :to="{ path: '/host', query: { managementserverid: record.id } }">
+          {{ text }}
+        </router-link>
+        <span v-else> {{ text }} </span>
+      </template>
       <template v-if="column.key === 'order'">
         <div class="shift-btns">
           <a-tooltip

From a8f1e4a5bacae41001aaeedacb02867f26bee056 Mon Sep 17 00:00:00 2001
From: Manoj Kumar <manojkr.itbhu@gmail.com>
Date: Thu, 29 Jan 2026 13:40:28 +0530
Subject: [PATCH 086/117] import network acl rules using csv (#12013)

---
 .../main/java/com/cloud/event/EventTypes.java |   1 +
 .../cloud/network/vpc/NetworkACLService.java  |   3 +
 .../user/network/CreateNetworkACLCmd.java     |  30 +-
 .../user/network/ImportNetworkACLCmd.java     | 132 ++++++
 .../network/vpc/NetworkACLServiceImpl.java    | 120 +++++-
 .../cloud/server/ManagementServerImpl.java    |   2 +
 ui/public/locales/en.json                     |  10 +-
 ui/src/views/network/AclRulesTab.vue          |  32 +-
 ui/src/views/network/ImportNetworkACL.vue     | 381 ++++++++++++++++++
 9 files changed, 699 insertions(+), 12 deletions(-)
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/user/network/ImportNetworkACLCmd.java
 create mode 100644 ui/src/views/network/ImportNetworkACL.vue

diff --git a/api/src/main/java/com/cloud/event/EventTypes.java b/api/src/main/java/com/cloud/event/EventTypes.java
index 38e601c790a7..6fa6a06ea82e 100644
--- a/api/src/main/java/com/cloud/event/EventTypes.java
+++ b/api/src/main/java/com/cloud/event/EventTypes.java
@@ -582,6 +582,7 @@ public class EventTypes {
 
     // Network ACL
     public static final String EVENT_NETWORK_ACL_CREATE = "NETWORK.ACL.CREATE";
+    public static final String EVENT_NETWORK_ACL_IMPORT = "NETWORK.ACL.IMPORT";
     public static final String EVENT_NETWORK_ACL_DELETE = "NETWORK.ACL.DELETE";
     public static final String EVENT_NETWORK_ACL_REPLACE = "NETWORK.ACL.REPLACE";
     public static final String EVENT_NETWORK_ACL_UPDATE = "NETWORK.ACL.UPDATE";
diff --git a/api/src/main/java/com/cloud/network/vpc/NetworkACLService.java b/api/src/main/java/com/cloud/network/vpc/NetworkACLService.java
index 40aee1f08f1d..84e48d5d5b8a 100644
--- a/api/src/main/java/com/cloud/network/vpc/NetworkACLService.java
+++ b/api/src/main/java/com/cloud/network/vpc/NetworkACLService.java
@@ -19,6 +19,7 @@
 import java.util.List;
 
 import org.apache.cloudstack.api.command.user.network.CreateNetworkACLCmd;
+import org.apache.cloudstack.api.command.user.network.ImportNetworkACLCmd;
 import org.apache.cloudstack.api.command.user.network.ListNetworkACLListsCmd;
 import org.apache.cloudstack.api.command.user.network.ListNetworkACLsCmd;
 import org.apache.cloudstack.api.command.user.network.MoveNetworkAclItemCmd;
@@ -98,4 +99,6 @@ public interface NetworkACLService {
     NetworkACLItem moveNetworkAclRuleToNewPosition(MoveNetworkAclItemCmd moveNetworkAclItemCmd);
 
     NetworkACLItem moveRuleToTheTopInACLList(NetworkACLItem ruleBeingMoved);
+
+    List<NetworkACLItem> importNetworkACLRules(ImportNetworkACLCmd cmd) throws ResourceUnavailableException;
 }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/network/CreateNetworkACLCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/network/CreateNetworkACLCmd.java
index a6cd724f2d1f..087e31c08829 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/network/CreateNetworkACLCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/network/CreateNetworkACLCmd.java
@@ -58,7 +58,7 @@ public class CreateNetworkACLCmd extends BaseAsyncCreateCmd {
     private Integer publicEndPort;
 
     @Parameter(name = ApiConstants.CIDR_LIST, type = CommandType.LIST, collectionType = CommandType.STRING, description = "The CIDR list to allow traffic from/to. Multiple entries must be separated by a single comma character (,).")
-    private List<String> cidrlist;
+    private List<String> cidrList;
 
     @Parameter(name = ApiConstants.ICMP_TYPE, type = CommandType.INTEGER, description = "Type of the ICMP message being sent")
     private Integer icmpType;
@@ -118,8 +118,8 @@ public void setProtocol(String protocol) {
     }
 
     public List<String> getSourceCidrList() {
-        if (cidrlist != null) {
-            return cidrlist;
+        if (cidrList != null) {
+            return cidrList;
         } else {
             List<String> oneCidrList = new ArrayList<String>();
             oneCidrList.add(NetUtils.ALL_IP4_CIDRS);
@@ -238,6 +238,30 @@ public String getReason() {
         return reason;
     }
 
+    public void setCidrList(List<String> cidrList) {
+        this.cidrList = cidrList;
+    }
+
+    public void setIcmpType(Integer icmpType) {
+        this.icmpType = icmpType;
+    }
+
+    public void setIcmpCode(Integer icmpCode) {
+        this.icmpCode = icmpCode;
+    }
+
+    public void setNumber(Integer number) {
+        this.number = number;
+    }
+
+    public void setDisplay(Boolean display) {
+        this.display = display;
+    }
+
+    public void setReason(String reason) {
+        this.reason = reason;
+    }
+
     @Override
     public void create() {
         NetworkACLItem result = _networkACLService.createNetworkACLItem(this);
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/network/ImportNetworkACLCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/network/ImportNetworkACLCmd.java
new file mode 100644
index 000000000000..daf3633ce2a4
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/network/ImportNetworkACLCmd.java
@@ -0,0 +1,132 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.user.network;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.BaseAsyncCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.api.response.NetworkACLItemResponse;
+import org.apache.cloudstack.api.response.NetworkACLResponse;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.commons.collections.MapUtils;
+
+import com.cloud.event.EventTypes;
+import com.cloud.exception.ResourceUnavailableException;
+import com.cloud.network.vpc.NetworkACLItem;
+import com.cloud.user.Account;
+
+@APICommand(name = "importNetworkACL", description = "Imports Network ACL rules.",
+        responseObject = NetworkACLItemResponse.class,
+        requestHasSensitiveInfo = false, responseHasSensitiveInfo = false,
+        since = "4.22.1")
+public class ImportNetworkACLCmd extends BaseAsyncCmd {
+
+    // ///////////////////////////////////////////////////
+    // ////////////// API parameters /////////////////////
+    // ///////////////////////////////////////////////////
+
+    @Parameter(
+            name = ApiConstants.ACL_ID,
+            type = CommandType.UUID,
+            entityType = NetworkACLResponse.class,
+            required = true,
+            description = "The ID of the Network ACL to which the rules will be imported"
+    )
+    private Long aclId;
+
+    @Parameter(name = ApiConstants.RULES, type = CommandType.MAP, required = true,
+            description = "Rules param list, id and protocol are must. Invalid rules will be discarded. Example: " +
+                    "rules[0].id=101&rules[0].protocol=tcp&rules[0].traffictype=ingress&rules[0].state=active&rules[0].cidrlist=192.168.1.0/24" +
+                    "&rules[0].tags=web&rules[0].aclid=acl-001&rules[0].aclname=web-acl&rules[0].number=1&rules[0].action=allow&rules[0].fordisplay=true" +
+                    "&rules[0].description=allow%20web%20traffic&rules[1].id=102&rules[1].protocol=udp&rules[1].traffictype=egress&rules[1].state=enabled" +
+                    "&rules[1].cidrlist=10.0.0.0/8&rules[1].tags=db&rules[1].aclid=acl-002&rules[1].aclname=db-acl&rules[1].number=2&rules[1].action=deny" +
+                    "&rules[1].fordisplay=false&rules[1].description=deny%20database%20traffic")
+    private Map rules;
+
+
+    // ///////////////////////////////////////////////////
+    // ///////////////// Accessors ///////////////////////
+    // ///////////////////////////////////////////////////
+
+    // Returns map, corresponds to a rule with the details in the keys:
+    // id, protocol, startport, endport, traffictype, state, cidrlist, tags, aclid, aclname, number, action, fordisplay, description
+    public Map getRules() {
+        return rules;
+    }
+
+    public Long getAclId() {
+        return aclId;
+    }
+
+    // ///////////////////////////////////////////////////
+    // ///////////// API Implementation///////////////////
+    // ///////////////////////////////////////////////////
+
+
+    @Override
+    public void execute() throws ResourceUnavailableException {
+        validateParams();
+        List<NetworkACLItem> importedRules = _networkACLService.importNetworkACLRules(this);
+        ListResponse<NetworkACLItemResponse> response = new ListResponse<>();
+        List<NetworkACLItemResponse> aclResponse = new ArrayList<>();
+        for (NetworkACLItem acl : importedRules) {
+            NetworkACLItemResponse ruleData = _responseGenerator.createNetworkACLItemResponse(acl);
+            aclResponse.add(ruleData);
+        }
+        response.setResponses(aclResponse, importedRules.size());
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        Account account = CallContext.current().getCallingAccount();
+        if (account != null) {
+            return account.getId();
+        }
+        return Account.ACCOUNT_ID_SYSTEM;
+    }
+
+    @Override
+    public String getEventType() {
+        return EventTypes.EVENT_NETWORK_ACL_IMPORT;
+    }
+
+    @Override
+    public String getEventDescription() {
+        return "Importing ACL rules for ACL ID: " + getAclId();
+    }
+
+
+    private void validateParams() {
+        if(MapUtils.isEmpty(rules)) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "Rules parameter is empty or null");
+        }
+
+        if (getAclId() == null || _networkACLService.getNetworkACL(getAclId()) == null) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "Unable to find Network ACL with provided ACL ID");
+        }
+    }
+}
diff --git a/server/src/main/java/com/cloud/network/vpc/NetworkACLServiceImpl.java b/server/src/main/java/com/cloud/network/vpc/NetworkACLServiceImpl.java
index 7460ae87d44c..94e79ec6ea75 100644
--- a/server/src/main/java/com/cloud/network/vpc/NetworkACLServiceImpl.java
+++ b/server/src/main/java/com/cloud/network/vpc/NetworkACLServiceImpl.java
@@ -26,15 +26,11 @@
 
 import javax.inject.Inject;
 
-import com.cloud.dc.DataCenter;
-import com.cloud.exception.PermissionDeniedException;
-import com.cloud.network.dao.NetrisProviderDao;
-import com.cloud.network.dao.NsxProviderDao;
-import com.cloud.network.element.NetrisProviderVO;
-import com.cloud.network.element.NsxProviderVO;
+import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.ApiErrorCode;
 import org.apache.cloudstack.api.ServerApiException;
 import org.apache.cloudstack.api.command.user.network.CreateNetworkACLCmd;
+import org.apache.cloudstack.api.command.user.network.ImportNetworkACLCmd;
 import org.apache.cloudstack.api.command.user.network.ListNetworkACLListsCmd;
 import org.apache.cloudstack.api.command.user.network.ListNetworkACLsCmd;
 import org.apache.cloudstack.api.command.user.network.MoveNetworkAclItemCmd;
@@ -43,19 +39,26 @@
 import org.apache.cloudstack.context.CallContext;
 import org.apache.commons.codec.digest.DigestUtils;
 import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.lang3.BooleanUtils;
 import org.apache.commons.lang3.ObjectUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.stereotype.Component;
 
+import com.cloud.dc.DataCenter;
 import com.cloud.event.ActionEvent;
 import com.cloud.event.EventTypes;
 import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.exception.PermissionDeniedException;
 import com.cloud.exception.ResourceUnavailableException;
 import com.cloud.network.Network;
 import com.cloud.network.NetworkModel;
 import com.cloud.network.Networks;
+import com.cloud.network.dao.NetrisProviderDao;
 import com.cloud.network.dao.NetworkDao;
 import com.cloud.network.dao.NetworkVO;
+import com.cloud.network.dao.NsxProviderDao;
+import com.cloud.network.element.NetrisProviderVO;
+import com.cloud.network.element.NsxProviderVO;
 import com.cloud.network.vpc.NetworkACLItem.Action;
 import com.cloud.network.vpc.NetworkACLItem.TrafficType;
 import com.cloud.network.vpc.dao.NetworkACLDao;
@@ -1070,6 +1073,111 @@ public NetworkACLItem moveRuleToTheTopInACLList(NetworkACLItem ruleBeingMoved) {
         return moveRuleToTheTop(ruleBeingMoved, allRules);
     }
 
+    @Override
+    public List<NetworkACLItem> importNetworkACLRules(ImportNetworkACLCmd cmd) throws ResourceUnavailableException {
+        long aclId = cmd.getAclId();
+        Map<Object, Object> rules = cmd.getRules();
+        List<NetworkACLItem> createdRules = new ArrayList<>();
+        List<String> errors = new ArrayList<>();
+        for (Map.Entry<Object, Object> entry : rules.entrySet()) {
+            try {
+                Map<String, Object> ruleMap = (Map<String, Object>) entry.getValue();
+                NetworkACLItem item = createACLRuleFromMap(ruleMap, aclId);
+                createdRules.add(item);
+            } catch (Exception ex) {
+                String error = "Failed to import rule at index " + entry.getKey() + ": " + ex.getMessage();
+                errors.add(error);
+                logger.error(error, ex);
+            }
+        }
+        // no rules got imported
+        if (createdRules.isEmpty() && !errors.isEmpty()) {
+            logger.error("Failed to import any ACL rules. Errors: {}", String.join("; ", errors));
+            throw new CloudRuntimeException("Failed to import any ACL rules.");
+        }
+
+        // apply ACL to network
+        if (!createdRules.isEmpty()) {
+            applyNetworkACL(aclId);
+        }
+        return createdRules;
+    }
+
+    private NetworkACLItem createACLRuleFromMap(Map<String, Object> ruleMap, long aclId) {
+        String protocol = (String) ruleMap.get(ApiConstants.PROTOCOL);
+        if (protocol == null || protocol.trim().isEmpty()) {
+            throw new InvalidParameterValueException("Protocol is required");
+        }
+        String action = (String) ruleMap.getOrDefault(ApiConstants.ACTION, "deny");
+        String trafficType = (String) ruleMap.getOrDefault(ApiConstants.TRAFFIC_TYPE, NetworkACLItem.TrafficType.Ingress);
+        String forDisplay = (String) ruleMap.getOrDefault(ApiConstants.FOR_DISPLAY, "true");
+
+        // Create ACL rule using the service
+        CreateNetworkACLCmd cmd = new CreateNetworkACLCmd();
+        cmd.setAclId(aclId);
+        cmd.setProtocol(protocol.toLowerCase());
+        cmd.setAction(action.toLowerCase());
+        cmd.setTrafficType(trafficType.toLowerCase());
+        cmd.setDisplay(BooleanUtils.toBoolean(forDisplay));
+
+        // Optional parameters
+        if (ruleMap.containsKey(ApiConstants.CIDR_LIST)) {
+            Object cidrObj = ruleMap.get(ApiConstants.CIDR_LIST);
+            List<String> cidrList = new ArrayList<>();
+            if (cidrObj instanceof String) {
+                for (String cidr : ((String) cidrObj).split(",")) {
+                    cidrList.add(cidr.trim());
+                }
+            } else if (cidrObj instanceof List) {
+                cidrList.addAll((List<String>) cidrObj);
+            }
+            cmd.setCidrList(cidrList);
+        }
+
+        if (ruleMap.containsKey(ApiConstants.START_PORT)) {
+            cmd.setPublicStartPort(parseInt(ruleMap.get(ApiConstants.START_PORT)));
+        }
+
+        if (ruleMap.containsKey(ApiConstants.END_PORT)) {
+            cmd.setPublicEndPort(parseInt(ruleMap.get(ApiConstants.END_PORT)));
+        }
+
+        if (ruleMap.containsKey(ApiConstants.NUMBER)) {
+            cmd.setNumber(parseInt(ruleMap.get(ApiConstants.NUMBER)));
+        }
+
+        if (ruleMap.containsKey(ApiConstants.ICMP_TYPE)) {
+            cmd.setIcmpType(parseInt(ruleMap.get(ApiConstants.ICMP_TYPE)));
+        }
+
+        if (ruleMap.containsKey(ApiConstants.ICMP_CODE)) {
+            cmd.setIcmpCode(parseInt(ruleMap.get(ApiConstants.ICMP_CODE)));
+        }
+
+        if (ruleMap.containsKey(ApiConstants.ACL_REASON)) {
+            cmd.setReason((String) ruleMap.get(ApiConstants.ACL_REASON));
+        }
+
+        return createNetworkACLItem(cmd);
+    }
+
+    private Integer parseInt(Object value) {
+        if (value == null) {
+            return null;
+        }
+        if (value instanceof Integer) {
+            return (Integer) value;
+        }
+        if (value instanceof String) {
+            try {
+                return Integer.parseInt((String) value);
+            } catch (NumberFormatException e) {
+                throw new InvalidParameterValueException("Invalid integer value: " + value);
+            }
+        }
+        throw new InvalidParameterValueException("Cannot convert to integer: " + value);
+    }
+
     /**
      * Validates the consistency of the ACL; the validation process is the following.
      * <ul>
diff --git a/server/src/main/java/com/cloud/server/ManagementServerImpl.java b/server/src/main/java/com/cloud/server/ManagementServerImpl.java
index 249d5da81dce..57d87898109c 100644
--- a/server/src/main/java/com/cloud/server/ManagementServerImpl.java
+++ b/server/src/main/java/com/cloud/server/ManagementServerImpl.java
@@ -454,6 +454,7 @@
 import org.apache.cloudstack.api.command.user.network.DeleteNetworkACLCmd;
 import org.apache.cloudstack.api.command.user.network.DeleteNetworkACLListCmd;
 import org.apache.cloudstack.api.command.user.network.DeleteNetworkCmd;
+import org.apache.cloudstack.api.command.user.network.ImportNetworkACLCmd;
 import org.apache.cloudstack.api.command.user.network.ListNetworkACLListsCmd;
 import org.apache.cloudstack.api.command.user.network.ListNetworkACLsCmd;
 import org.apache.cloudstack.api.command.user.network.ListNetworkOfferingsCmd;
@@ -4039,6 +4040,7 @@ public List<Class<?>> getCommands() {
         cmdList.add(EnableStaticNatCmd.class);
         cmdList.add(ListIpForwardingRulesCmd.class);
         cmdList.add(CreateNetworkACLCmd.class);
+        cmdList.add(ImportNetworkACLCmd.class);
         cmdList.add(CreateNetworkCmd.class);
         cmdList.add(DeleteNetworkACLCmd.class);
         cmdList.add(DeleteNetworkCmd.class);
diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index 747154964345..bf5ea84b3435 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -42,7 +42,9 @@
 "label.accounts": "Accounts",
 "label.accountstate": "Account state",
 "label.accounttype": "Account type",
-"label.acl.export": "Export ACL rules",
+"label.import": "Import",
+"label.acl.import": "Import rules",
+"label.acl.export": "Export rules",
 "label.acl.id": "ACL ID",
 "label.acl.rules": "ACL rules",
 "label.acl.reason.description": "Enter the reason behind an ACL rule.",
@@ -252,7 +254,7 @@
 "label.activeviewersessions": "Active sessions",
 "label.add": "Add",
 "label.add.account": "Add Account",
-"label.add.acl.rule": "Add ACL rule",
+"label.add.acl.rule": "Add rule",
 "label.add.acl": "Add ACL",
 "label.add.affinity.group": "Add new Affinity Group",
 "label.add.backup.schedule": "Add Backup Schedule",
@@ -704,6 +706,7 @@
 "label.cron.mode": "Cron mode",
 "label.crosszones": "Cross Zones",
 "label.csienabled": "CSI Enabled",
+"label.csv.preview": "Data preview",
 "label.currency": "Currency",
 "label.current": "Current",
 "label.currentstep": "Current step",
@@ -2902,6 +2905,8 @@
 "message.action.create.snapshot.from.vmsnapshot": "Please confirm that you want to create Snapshot from Instance Snapshot",
 "message.action.create.instance.from.backup": "Please confirm that you want to create a new Instance from the given Backup.<br>Click on configure to edit the parameters for the new Instance before creation.",
 "message.create.instance.from.backup.different.zone": "Creating Instance from Backup on a different Zone. Please ensure that the backup repository is accessible in the selected Zone.",
+"message.csv.empty": "Empty CSV File",
+"message.csv.missing.headers": "Columns are missing from headers in CSV",
 "message.template.ostype.different.from.backup": "Selected Template has a different OS type than the Backup. Please proceed with caution.",
 "message.iso.ostype.different.from.backup": "Selected ISO has a different OS type than the Backup. Please proceed with caution.",
 "message.action.delete.asnrange": "Please confirm the AS range that you want to delete",
@@ -3643,6 +3648,7 @@
 "message.move.acl.order.processing": "Moving ACL rule...",
 "message.network.acl.default.allow": "Warning: With this policy all traffic will be allowed through the firewall to this VPC Network Tier. You should consider securing your Network.",
 "message.network.acl.default.deny": "Warning: With this policy all traffic will be denied through the firewall to this VPC Network Tier. In order to allow traffic through you will need to change policies.",
+"message.network.acl.import.note": "Note: Only valid rules from the CSV will be imported. Invalid entries will be discarded.",
 "message.network.addvm.desc": "Please specify the Network that you would like to add this Instance to. A new NIC will be added for this Network.",
 "message.network.description": "Setup Network and traffic.",
 "message.network.error": "Network Error",
diff --git a/ui/src/views/network/AclRulesTab.vue b/ui/src/views/network/AclRulesTab.vue
index da6d834e4a35..e452e495a224 100644
--- a/ui/src/views/network/AclRulesTab.vue
+++ b/ui/src/views/network/AclRulesTab.vue
@@ -28,10 +28,16 @@
         {{ $t('label.add.acl.rule') }}
       </a-button>
 
+      <a-button type="dashed" @click="handleImportRules" style="width: 100%;  margin-right: 10px">
+        <template #icon><upload-outlined /></template>
+        {{ $t('label.acl.import') }}
+      </a-button>
+
       <a-button type="dashed" @click="exportAclList" style="width: 100%">
         <template #icon><download-outlined /></template>
         {{ $t('label.acl.export') }}
       </a-button>
+
       <div class="search-bar">
         <a-input-search
           style="width: 25vw;float: right;margin-left: 10px; z-index: 8"
@@ -304,6 +310,21 @@
         </div>
       </a-form>
     </a-modal>
+
+    <a-modal
+      v-if="showImportModal"
+      :visible="showImportModal"
+      :title="$t('label.acl.import')"
+      :closable="true"
+      :maskClosable="false"
+      :footer="null"
+      :width="800"
+      @cancel="closeImportModal">
+      <import-network-a-c-l
+        :resource="resource"
+        @refresh-data="fetchData"
+        @close-action="closeImportModal" />
+    </a-modal>
   </a-spin>
 </template>
 
@@ -313,13 +334,15 @@ import { getAPI, postAPI } from '@/api'
 import draggable from 'vuedraggable'
 import { mixinForm } from '@/utils/mixin'
 import TooltipButton from '@/components/widgets/TooltipButton'
+import ImportNetworkACL from './ImportNetworkACL'
 
 export default {
   name: 'AclListRulesTab',
   mixins: [mixinForm],
   components: {
     draggable,
-    TooltipButton
+    TooltipButton,
+    ImportNetworkACL
   },
   props: {
     resource: {
@@ -344,6 +367,7 @@ export default {
       tagsModalVisible: false,
       tagsLoading: false,
       ruleModalVisible: false,
+      showImportModal: false,
       ruleModalTitle: this.$t('label.edit.rule'),
       ruleFormMode: 'edit'
     }
@@ -788,6 +812,12 @@ export default {
     },
     capitalise (val) {
       return val.toUpperCase()
+    },
+    handleImportRules () {
+      this.showImportModal = true
+    },
+    closeImportModal () {
+      this.showImportModal = false
     }
   }
 }
diff --git a/ui/src/views/network/ImportNetworkACL.vue b/ui/src/views/network/ImportNetworkACL.vue
new file mode 100644
index 000000000000..2456a75af45d
--- /dev/null
+++ b/ui/src/views/network/ImportNetworkACL.vue
@@ -0,0 +1,381 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+<template>
+  <div v-ctrl-enter="handleSubmit">
+    <a-spin :spinning="loading">
+      <a-form
+        :ref="formRef"
+        :model="form"
+        :rules="rules"
+        layout="vertical"
+        @finish="handleSubmit">
+
+        <div class="info-section" style="margin-bottom: 24px; padding: 16px; background: #fafafa; border-radius: 4px;">
+          <a-descriptions :column="1" size="small">
+            <a-descriptions-item :label="$t('label.acl.id')">
+              <span style="font-family: monospace;">{{ resource.id }}</span>
+            </a-descriptions-item>
+            <a-descriptions-item :label="$t('label.add.acl.name')">
+              <strong>{{ resource.name }}</strong>
+            </a-descriptions-item>
+          </a-descriptions>
+        </div>
+
+        <a-form-item name="file" ref="file">
+          <template #label>
+            <tooltip-label :title="$t('label.rules.file')" :tooltip="$t('label.rules.file.to.import')"/>
+          </template>
+          <a-upload-dragger
+            :multiple=false
+            :fileList="fileList"
+            @remove="handleRemove"
+            :beforeUpload="beforeUpload"
+            @change="handleChange"
+            v-model:value="form.file">
+            <p class="ant-upload-drag-icon">
+              <cloud-upload-outlined />
+            </p>
+            <p class="ant-upload-text" v-if="fileList.length === 0">
+              {{ $t('label.rules.file.import.description') }}
+            </p>
+          </a-upload-dragger>
+        </a-form-item>
+
+        <a-form-item v-if="csvData.length > 0" :label="$t('label.csv.preview')">
+          <div class="csv-preview">
+            <a-table
+                :columns="columns"
+                :dataSource="csvData"
+                :pagination="{ pageSize: 5 }"
+                :scroll="{ x: true }"
+                size="small">
+
+                <template #action="{ record }">
+                  <a-tag :color="record.action && record.action.toLowerCase() === 'allow' ? 'green' : 'red'">
+                    {{ record.action ? record.action.toUpperCase() : 'N/A' }}
+                  </a-tag>
+                </template>
+
+                <template #traffictype="{ record }">
+                  <a-tag :color="record.traffictype && record.traffictype.toLowerCase() === 'ingress' ? 'blue' : 'orange'">
+                    {{ record.traffictype ? record.traffictype.toUpperCase() : 'N/A' }}
+                  </a-tag>
+                </template>
+
+            </a-table>
+          </div>
+        </a-form-item>
+
+        <span>{{ $t('message.network.acl.import.note') }}</span><br/>
+
+        <div :span="24" class="action-button">
+          <a-button class="button-cancel" @click="closeAction">{{ $t('label.cancel') }}</a-button>
+          <a-button
+            class="button-submit"
+            ref="submit"
+            type="primary"
+            :loading="loading"
+            :disabled="csvData.length === 0"
+            @click="handleSubmit">{{ $t('label.import') }}</a-button>
+        </div>
+
+      </a-form>
+    </a-spin>
+  </div>
+</template>
+
+<script>
+import { ref, reactive, toRaw } from 'vue'
+import { postAPI } from '@/api'
+import TooltipLabel from '@/components/widgets/TooltipLabel'
+
+export default {
+  name: 'ImportNetworkACL',
+  components: {
+    TooltipLabel
+  },
+  props: {
+    resource: {
+      type: Object,
+      required: true
+    }
+  },
+  data () {
+    return {
+      loading: false,
+      fileList: [],
+      csvData: '',
+      csvFileType: ['.csv', 'text/csv', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', 'application/vnd.ms-excel'],
+      columns: [
+        {
+          title: this.$t('label.protocol'),
+          dataIndex: 'protocol',
+          key: 'protocol',
+          width: 100
+        },
+        {
+          title: this.$t('label.action'),
+          dataIndex: 'action',
+          key: 'action',
+          width: 100,
+          slots: { customRender: 'action' }
+        },
+        {
+          title: this.$t('label.cidr'),
+          dataIndex: 'cidrlist',
+          width: 150,
+          ellipsis: true
+        },
+        {
+          title: this.$t('label.startport'),
+          dataIndex: 'startport',
+          width: 100
+        },
+        {
+          title: this.$t('label.endport'),
+          dataIndex: 'endport',
+          width: 100
+        },
+        {
+          title: this.$t('label.traffictype'),
+          dataIndex: 'traffictype',
+          key: 'traffictype',
+          width: 120,
+          slots: { customRender: 'traffictype' }
+        },
+        {
+          title: this.$t('label.number'),
+          dataIndex: 'number',
+          width: 80
+        },
+        {
+          title: this.$t('label.reason'),
+          dataIndex: 'reason',
+          ellipsis: true
+        }
+      ]
+    }
+  },
+  beforeCreate () {
+    this.apiParams = this.$getApiParams('importNetworkACL')
+  },
+  created () {
+    this.initForm()
+  },
+  methods: {
+    initForm () {
+      this.formRef = ref()
+      this.form = reactive({})
+      this.rules = reactive({
+        file: [
+          { required: true, message: this.$t('message.error.required.input') },
+          {
+            validator: this.checkCsvRulesFile,
+            message: this.$t('label.error.rules.file.import')
+          }
+        ]
+      })
+    },
+    beforeUpload (file) {
+      if (!this.csvFileType.includes(file.type)) {
+        return false
+      }
+      this.fileList = [file]
+      this.form.file = file
+      return false // Stop from uploading automatically
+    },
+    handleSubmit (e) {
+      e.preventDefault()
+      if (this.loading) return
+      this.formRef.value.validate().then(() => {
+        const values = toRaw(this.form)
+        const params = {}
+        for (const key in values) {
+          const input = values[key]
+          if (input === undefined) {
+            continue
+          }
+          if (key === 'file') {
+            continue
+          }
+          params[key] = input
+        }
+
+        if (this.csvData.length === 0) {
+          this.$message.error(this.$t('message.csv.no.data'))
+          return
+        }
+        this.importNetworkACL()
+      }).catch(error => {
+        this.formRef.value.scrollToField(error.errorFields[0].name)
+      })
+    },
+    handleRemove (file) {
+      const index = this.fileList.indexOf(file)
+      const newFileList = this.fileList.slice()
+      newFileList.splice(index, 1)
+      this.fileList = newFileList
+      this.form.file = undefined
+    },
+    handleChange (info) {
+      if (info.file.status === 'error') {
+        this.$notification.error({
+          message: this.$t('label.error.file.upload'),
+          description: this.$t('label.error.file.upload')
+        })
+      }
+    },
+    async checkCsvRulesFile (rule, value) {
+      if (!value || value === '') {
+        return Promise.resolve()
+      } else {
+        if (!this.csvFileType.includes(value.type)) {
+          return Promise.reject(rule.message)
+        }
+
+        try {
+          const validFile = await this.readCsvFile(value)
+          if (!validFile) {
+            return Promise.reject(rule.message)
+          } else {
+            return Promise.resolve()
+          }
+        } catch (reason) {
+          return Promise.reject(rule.message)
+        }
+      }
+    },
+    readCsvFile (file) {
+      return new Promise((resolve, reject) => {
+        if (window.FileReader) {
+          const reader = new FileReader()
+          reader.onload = (event) => {
+            const text = event.target.result
+            const lines = text.split('\n').filter(line => line.trim() !== '')
+            if (lines.length < 2) {
+              this.$message.error(this.$t('message.csv.empty'))
+              resolve(false)
+            }
+            const headers = this.parseCSVLine(lines[0])
+            const requiredHeaders = ['protocol', 'cidrlist', 'traffictype']
+            const missingHeaders = requiredHeaders.filter(h => !headers.includes(h.toLowerCase()))
+            if (missingHeaders.length > 0) {
+              this.$message.error(this.$t('message.csv.missing.headers') + ': ' + missingHeaders.join(', '))
+              resolve(false)
+            }
+            // Parse data rows
+            const data = []
+            for (let i = 1; i < lines.length; i++) {
+              const values = this.parseCSVLine(lines[i])
+              if (values.length === headers.length) {
+                const row = {}
+                headers.forEach((header, index) => {
+                  const value = values[index].trim()
+                  if (value !== '' && value !== 'null') {
+                    row[header.toLowerCase()] = value
+                  }
+                })
+                data.push(row)
+              }
+            }
+
+            this.csvData = data
+            resolve(true)
+          }
+
+          reader.onerror = (event) => {
+            if (event.target.error.name === 'NotReadableError') {
+              reject(event.target.error)
+            }
+          }
+
+          reader.readAsText(file)
+        } else {
+          reject(this.$t('label.error.file.read'))
+        }
+      })
+    },
+    parseCSVLine (line) {
+      const result = []
+      let current = ''
+      let inQuotes = false
+
+      for (let i = 0; i < line.length; i++) {
+        const char = line[i]
+        if (char === '"') {
+          inQuotes = !inQuotes
+        } else if (char === ',' && !inQuotes) {
+          result.push(current)
+          current = ''
+        } else {
+          current += char
+        }
+      }
+      result.push(current)
+
+      return result.map(v => v.trim())
+    },
+    closeAction () {
+      this.$emit('close-action')
+    },
+    importNetworkACL () {
+      this.loading = true
+      const params = {
+        aclid: this.resource.id
+      }
+      this.csvData.forEach(function (values, index) {
+        for (const key in values) {
+          params['rules[' + index + '].' + key] = values[key]
+        }
+      })
+      postAPI('importNetworkACL', params).then(response => {
+        this.$pollJob({
+          jobId: response.importnetworkaclresponse.jobid,
+          title: this.$t('message.success.add.network.acl'),
+          successMethod: () => {
+            this.loading = false
+          },
+          errorMessage: this.$t('message.add.network.acl.failed'),
+          errorMethod: () => {
+            this.loading = false
+          },
+          loadingMessage: this.$t('message.add.network.acl.processing'),
+          catchMessage: this.$t('error.fetching.async.job.result'),
+          catchMethod: () => {
+            this.loading = false
+          }
+        })
+      }).catch(error => {
+        this.$notifyError(error)
+      }).finally(() => {
+        this.loading = false
+      })
+    }
+  }
+}
+</script>
+
+<style scoped lang="less">
+  .csv-preview {
+  max-height: 400px;
+  overflow: auto;
+  border: 1px solid #d9d9d9;
+  border-radius: 4px;
+  padding: 10px;
+}
+</style>

From 9b4f16b73fabd2c53cb9884326f8442936d66bad Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Thu, 29 Jan 2026 13:52:07 +0530
Subject: [PATCH 087/117] api,server: apis return their http request type
 (#11382)

* api,server: apis return their http request type

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix and unit test

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* more test

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* address copilot

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* Update plugins/api/discovery/src/main/java/org/apache/cloudstack/api/response/ApiDiscoveryResponse.java

---------

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
Co-authored-by: dahn <daan@onecht.net>
Co-authored-by: Harikrishna <harikrishna.patnala@gmail.com>
---
 .../org/apache/cloudstack/api/APICommand.java |   2 +
 .../apache/cloudstack/api/ApiConstants.java   |   1 +
 ...ntAllowedToCreateOfferingsWithTagsCmd.java |   3 +-
 .../api/response/ApiDiscoveryResponse.java    |  13 ++
 .../discovery/ApiDiscoveryServiceImpl.java    |   9 +-
 .../ApiDiscoveryServiceImplTest.java          | 123 +++++++++++++++
 .../api/command/QuotaBalanceCmd.java          |   3 +-
 .../api/command/QuotaEnabledCmd.java          |   3 +-
 .../api/command/QuotaStatementCmd.java        |   3 +-
 .../api/command/QuotaSummaryCmd.java          |   3 +-
 .../api/command/QuotaTariffListCmd.java       |   3 +-
 .../cloudian/api/CloudianIsEnabledCmd.java    |   3 +-
 .../api/command/ReadyForShutdownCmd.java      |   3 +-
 .../command/VerifyOAuthCodeAndGetUserCmd.java |  14 +-
 .../main/java/com/cloud/api/ApiServlet.java   |  46 ++++--
 .../java/com/cloud/api/ApiServletTest.java    | 143 ++++++++++++++----
 16 files changed, 319 insertions(+), 56 deletions(-)
 create mode 100644 plugins/api/discovery/src/test/java/org/apache/cloudstack/discovery/ApiDiscoveryServiceImplTest.java

diff --git a/api/src/main/java/org/apache/cloudstack/api/APICommand.java b/api/src/main/java/org/apache/cloudstack/api/APICommand.java
index c559be081165..b77649046ca9 100644
--- a/api/src/main/java/org/apache/cloudstack/api/APICommand.java
+++ b/api/src/main/java/org/apache/cloudstack/api/APICommand.java
@@ -50,4 +50,6 @@
     RoleType[] authorized() default {};
 
     Class<?>[] entityType() default {};
+
+    String httpMethod() default "";
 }
diff --git a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
index 2e0e843b5354..d00e339de2fd 100644
--- a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
+++ b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
@@ -282,6 +282,7 @@ public class ApiConstants {
     public static final String HOST = "host";
     public static final String HOST_CONTROL_STATE = "hostcontrolstate";
     public static final String HOSTS_MAP = "hostsmap";
+    public static final String HTTP_REQUEST_TYPE = "httprequesttype";
     public static final String HYPERVISOR = "hypervisor";
     public static final String INLINE = "inline";
     public static final String INSTANCE = "instance";
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/offering/IsAccountAllowedToCreateOfferingsWithTagsCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/offering/IsAccountAllowedToCreateOfferingsWithTagsCmd.java
index fcd6b03d3e59..4b1cd2ff7255 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/offering/IsAccountAllowedToCreateOfferingsWithTagsCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/offering/IsAccountAllowedToCreateOfferingsWithTagsCmd.java
@@ -26,7 +26,8 @@
 import org.apache.cloudstack.api.response.IsAccountAllowedToCreateOfferingsWithTagsResponse;
 
 @APICommand(name = "isAccountAllowedToCreateOfferingsWithTags", description = "Return true if the specified account is allowed to create offerings with tags.",
-        responseObject = IsAccountAllowedToCreateOfferingsWithTagsResponse.class, requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
+        responseObject = IsAccountAllowedToCreateOfferingsWithTagsResponse.class, requestHasSensitiveInfo = false, responseHasSensitiveInfo = false,
+        httpMethod = "GET")
 public class IsAccountAllowedToCreateOfferingsWithTagsCmd extends BaseCmd {
 
     @Parameter(name = ApiConstants.ID, type = CommandType.UUID, entityType = AccountResponse.class, description = "Account UUID", required = true)
diff --git a/plugins/api/discovery/src/main/java/org/apache/cloudstack/api/response/ApiDiscoveryResponse.java b/plugins/api/discovery/src/main/java/org/apache/cloudstack/api/response/ApiDiscoveryResponse.java
index 4b243f2e8a1a..90b3b89d3fb5 100644
--- a/plugins/api/discovery/src/main/java/org/apache/cloudstack/api/response/ApiDiscoveryResponse.java
+++ b/plugins/api/discovery/src/main/java/org/apache/cloudstack/api/response/ApiDiscoveryResponse.java
@@ -59,6 +59,10 @@ public class ApiDiscoveryResponse extends BaseResponse {
     @Param(description = "Response field type")
     private String type;
 
+    @SerializedName(ApiConstants.HTTP_REQUEST_TYPE)
+    @Param(description = "Preferred HTTP request type for the API", since = "4.23.0")
+    private String httpRequestType;
+
     public ApiDiscoveryResponse() {
         params = new HashSet<ApiParameterResponse>();
         apiResponse = new HashSet<ApiResponseResponse>();
@@ -74,6 +78,7 @@ public ApiDiscoveryResponse(ApiDiscoveryResponse another) {
         this.params = new HashSet<>(another.getParams());
         this.apiResponse = new HashSet<>(another.getApiResponse());
         this.type = another.getType();
+        this.httpRequestType = another.getHttpRequestType();
         this.setObjectName(another.getObjectName());
     }
 
@@ -140,4 +145,12 @@ public Set<ApiResponseResponse> getApiResponse() {
     public String getType() {
         return type;
     }
+
+    public String getHttpRequestType() {
+        return httpRequestType;
+    }
+
+    public void setHttpRequestType(String httpRequestType) {
+        this.httpRequestType = httpRequestType;
+    }
 }
diff --git a/plugins/api/discovery/src/main/java/org/apache/cloudstack/discovery/ApiDiscoveryServiceImpl.java b/plugins/api/discovery/src/main/java/org/apache/cloudstack/discovery/ApiDiscoveryServiceImpl.java
index 452b95cf2c05..d6d235162efb 100644
--- a/plugins/api/discovery/src/main/java/org/apache/cloudstack/discovery/ApiDiscoveryServiceImpl.java
+++ b/plugins/api/discovery/src/main/java/org/apache/cloudstack/discovery/ApiDiscoveryServiceImpl.java
@@ -50,6 +50,7 @@
 import org.reflections.ReflectionUtils;
 import org.springframework.stereotype.Component;
 
+import com.cloud.api.ApiServlet;
 import com.cloud.exception.PermissionDeniedException;
 import com.cloud.serializer.Param;
 import com.cloud.user.Account;
@@ -189,7 +190,7 @@ private ApiResponseResponse getFieldResponseMap(Field responseField) {
         return responseResponse;
     }
 
-    private ApiDiscoveryResponse getCmdRequestMap(Class<?> cmdClass, APICommand apiCmdAnnotation) {
+    protected ApiDiscoveryResponse getCmdRequestMap(Class<?> cmdClass, APICommand apiCmdAnnotation) {
         String apiName = apiCmdAnnotation.name();
         ApiDiscoveryResponse response = new ApiDiscoveryResponse();
         response.setName(apiName);
@@ -197,6 +198,12 @@ private ApiDiscoveryResponse getCmdRequestMap(Class<?> cmdClass, APICommand apiC
         if (!apiCmdAnnotation.since().isEmpty()) {
             response.setSince(apiCmdAnnotation.since());
         }
+        String httpRequestType = apiCmdAnnotation.httpMethod();
+        if (StringUtils.isBlank(httpRequestType)) {
+            httpRequestType = ApiServlet.GET_REQUEST_COMMANDS.matcher(apiName.toLowerCase()).matches() ?
+                    "GET" : "POST";
+        }
+        response.setHttpRequestType(httpRequestType);
 
         Set<Field> fields = ReflectUtil.getAllFieldsForClass(cmdClass, new Class<?>[] {BaseCmd.class, BaseAsyncCmd.class, BaseAsyncCreateCmd.class});
 
diff --git a/plugins/api/discovery/src/test/java/org/apache/cloudstack/discovery/ApiDiscoveryServiceImplTest.java b/plugins/api/discovery/src/test/java/org/apache/cloudstack/discovery/ApiDiscoveryServiceImplTest.java
new file mode 100644
index 000000000000..e69b9523d449
--- /dev/null
+++ b/plugins/api/discovery/src/test/java/org/apache/cloudstack/discovery/ApiDiscoveryServiceImplTest.java
@@ -0,0 +1,123 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.discovery;
+
+import static org.mockito.ArgumentMatchers.any;
+
+import java.lang.reflect.Field;
+import java.util.Set;
+
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.BaseAsyncCmd;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.command.admin.account.CreateAccountCmd;
+import org.apache.cloudstack.api.command.admin.user.GetUserCmd;
+import org.apache.cloudstack.api.command.user.discovery.ListApisCmd;
+import org.apache.cloudstack.api.response.ApiDiscoveryResponse;
+import org.apache.cloudstack.api.response.ApiParameterResponse;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import com.cloud.utils.ReflectUtil;
+
+@RunWith(MockitoJUnitRunner.class)
+public class ApiDiscoveryServiceImplTest {
+
+    @Mock
+    APICommand apiCommandMock;
+
+    @Spy
+    @InjectMocks
+    ApiDiscoveryServiceImpl discoveryServiceSpy;
+
+    @Before
+    public void setUp() {
+        Mockito.when(apiCommandMock.name()).thenReturn("listApis");
+        Mockito.when(apiCommandMock.since()).thenReturn("");
+    }
+
+    @Test
+    public void getCmdRequestMapReturnsResponseWithCorrectApiNameAndDescription() {
+        Mockito.when(apiCommandMock.description()).thenReturn("Lists all APIs");
+        ApiDiscoveryResponse response = discoveryServiceSpy.getCmdRequestMap(ListApisCmd.class, apiCommandMock);
+        Assert.assertEquals("listApis", response.getName());
+        Assert.assertEquals("Lists all APIs", response.getDescription());
+    }
+
+    @Test
+    public void getCmdRequestMapSetsHttpRequestTypeToGetWhenApiNameMatchesGetPattern() {
+        Mockito.when(apiCommandMock.name()).thenReturn("getUser");
+        Mockito.when(apiCommandMock.httpMethod()).thenReturn("");
+        ApiDiscoveryResponse response = discoveryServiceSpy.getCmdRequestMap(GetUserCmd.class, apiCommandMock);
+        Assert.assertEquals("GET", response.getHttpRequestType());
+    }
+
+    @Test
+    public void getCmdRequestMapSetsHttpRequestTypeToPostWhenApiNameDoesNotMatchGetPattern() {
+        Mockito.when(apiCommandMock.name()).thenReturn("createAccount");
+        Mockito.when(apiCommandMock.httpMethod()).thenReturn("");
+        ApiDiscoveryResponse response = discoveryServiceSpy.getCmdRequestMap(CreateAccountCmd.class, apiCommandMock);
+        Assert.assertEquals("POST", response.getHttpRequestType());
+    }
+
+    @Test
+    public void getCmdRequestMapSetsAsyncToTrueForAsyncCommand() {
+        Mockito.when(apiCommandMock.name()).thenReturn("asyncApi");
+        ApiDiscoveryResponse response = discoveryServiceSpy.getCmdRequestMap(BaseAsyncCmd.class, apiCommandMock);
+        Assert.assertTrue(response.getAsync());
+    }
+
+    @Test
+    public void getCmdRequestMapDoesNotAddParamsWithoutParameterAnnotation() {
+        ApiDiscoveryResponse response = discoveryServiceSpy.getCmdRequestMap(BaseCmd.class, apiCommandMock);
+        Assert.assertFalse(response.getParams().isEmpty());
+        Assert.assertEquals(1, response.getParams().size());
+    }
+
+    @Test
+    public void getCmdRequestMapAddsParamsWithExposedAndIncludedInApiDocAnnotations() {
+        Field fieldMock = Mockito.mock(Field.class);
+        Parameter parameterMock = Mockito.mock(Parameter.class);
+        Mockito.when(parameterMock.expose()).thenReturn(true);
+        Mockito.when(parameterMock.includeInApiDoc()).thenReturn(true);
+        Mockito.when(parameterMock.name()).thenReturn("paramName");
+        Mockito.when(parameterMock.since()).thenReturn("");
+        Mockito.when(parameterMock.entityType()).thenReturn(new Class[]{Object.class});
+        Mockito.when(parameterMock.description()).thenReturn("paramDescription");
+        Mockito.when(parameterMock.type()).thenReturn(BaseCmd.CommandType.STRING);
+        Mockito.when(fieldMock.getAnnotation(Parameter.class)).thenReturn(parameterMock);
+        try (MockedStatic<ReflectUtil> reflectUtilMockedStatic = Mockito.mockStatic(ReflectUtil.class)) {
+            reflectUtilMockedStatic.when(() -> ReflectUtil.getAllFieldsForClass(any(Class.class), any(Class[].class)))
+                    .thenReturn(Set.of(fieldMock));
+            ApiDiscoveryResponse response = discoveryServiceSpy.getCmdRequestMap(ListApisCmd.class, apiCommandMock);
+            Set<ApiParameterResponse> params = response.getParams();
+            Assert.assertEquals(1, params.size());
+            ApiParameterResponse paramResponse = params.iterator().next();
+            Assert.assertEquals("paramName", ReflectionTestUtils.getField(paramResponse, "name"));
+        }
+    }
+}
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaBalanceCmd.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaBalanceCmd.java
index cf39f802d34f..0cec0df66182 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaBalanceCmd.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaBalanceCmd.java
@@ -35,7 +35,8 @@
 import org.apache.cloudstack.quota.vo.QuotaBalanceVO;
 import org.apache.cloudstack.api.response.QuotaStatementItemResponse;
 
-@APICommand(name = "quotaBalance", responseObject = QuotaStatementItemResponse.class, description = "Create a quota balance statement", since = "4.7.0", requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
+@APICommand(name = "quotaBalance", responseObject = QuotaStatementItemResponse.class, description = "Create a quota balance statement", since = "4.7.0", requestHasSensitiveInfo = false, responseHasSensitiveInfo = false,
+        httpMethod = "GET")
 public class QuotaBalanceCmd extends BaseCmd {
 
 
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaEnabledCmd.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaEnabledCmd.java
index 4035a5205e6c..af1d146ea9dc 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaEnabledCmd.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaEnabledCmd.java
@@ -26,7 +26,8 @@
 
 import javax.inject.Inject;
 
-@APICommand(name = "quotaIsEnabled", responseObject = QuotaEnabledResponse.class, description = "Return true if the plugin is enabled", since = "4.7.0", requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
+@APICommand(name = "quotaIsEnabled", responseObject = QuotaEnabledResponse.class, description = "Return true if the plugin is enabled", since = "4.7.0", requestHasSensitiveInfo = false, responseHasSensitiveInfo = false,
+        httpMethod = "GET")
 public class QuotaEnabledCmd extends BaseCmd {
 
 
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaStatementCmd.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaStatementCmd.java
index 18f9bc48a6e2..d3bd3868ed16 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaStatementCmd.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaStatementCmd.java
@@ -35,7 +35,8 @@
 
 import com.cloud.user.Account;
 
-@APICommand(name = "quotaStatement", responseObject = QuotaStatementItemResponse.class, description = "Create a quota statement", since = "4.7.0", requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
+@APICommand(name = "quotaStatement", responseObject = QuotaStatementItemResponse.class, description = "Create a quota statement", since = "4.7.0", requestHasSensitiveInfo = false, responseHasSensitiveInfo = false,
+        httpMethod = "GET")
 public class QuotaStatementCmd extends BaseCmd {
 
 
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaSummaryCmd.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaSummaryCmd.java
index 42a598042b39..87322b01f4d4 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaSummaryCmd.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaSummaryCmd.java
@@ -33,7 +33,8 @@
 
 import javax.inject.Inject;
 
-@APICommand(name = "quotaSummary", responseObject = QuotaSummaryResponse.class, description = "Lists balance and quota usage for all Accounts", since = "4.7.0", requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
+@APICommand(name = "quotaSummary", responseObject = QuotaSummaryResponse.class, description = "Lists balance and quota usage for all Accounts", since = "4.7.0", requestHasSensitiveInfo = false, responseHasSensitiveInfo = false,
+        httpMethod = "GET")
 public class QuotaSummaryCmd extends BaseListCmd {
 
     @Parameter(name = ApiConstants.ACCOUNT, type = CommandType.STRING, required = false, description = "Optional, Account Id for which statement needs to be generated")
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaTariffListCmd.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaTariffListCmd.java
index d054d5459313..e0bab07501b6 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaTariffListCmd.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaTariffListCmd.java
@@ -38,7 +38,8 @@
 import java.util.Date;
 import java.util.List;
 
-@APICommand(name = "quotaTariffList", responseObject = QuotaTariffResponse.class, description = "Lists all quota tariff plans", since = "4.7.0", requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
+@APICommand(name = "quotaTariffList", responseObject = QuotaTariffResponse.class, description = "Lists all quota tariff plans", since = "4.7.0", requestHasSensitiveInfo = false, responseHasSensitiveInfo = false,
+        httpMethod = "GET")
 public class QuotaTariffListCmd extends BaseListCmd {
 
     @Inject
diff --git a/plugins/integrations/cloudian/src/main/java/org/apache/cloudstack/cloudian/api/CloudianIsEnabledCmd.java b/plugins/integrations/cloudian/src/main/java/org/apache/cloudstack/cloudian/api/CloudianIsEnabledCmd.java
index 56cb74e3cab7..3c334ba55c2e 100644
--- a/plugins/integrations/cloudian/src/main/java/org/apache/cloudstack/cloudian/api/CloudianIsEnabledCmd.java
+++ b/plugins/integrations/cloudian/src/main/java/org/apache/cloudstack/cloudian/api/CloudianIsEnabledCmd.java
@@ -31,7 +31,8 @@
         responseObject = CloudianEnabledResponse.class,
         requestHasSensitiveInfo = false, responseHasSensitiveInfo = false,
         since = "4.11.0",
-        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User})
+        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User},
+        httpMethod = "GET")
 public class CloudianIsEnabledCmd extends BaseCmd {
 
     @Inject
diff --git a/plugins/maintenance/src/main/java/org/apache/cloudstack/api/command/ReadyForShutdownCmd.java b/plugins/maintenance/src/main/java/org/apache/cloudstack/api/command/ReadyForShutdownCmd.java
index 782b23a04222..36ec4fff9c95 100644
--- a/plugins/maintenance/src/main/java/org/apache/cloudstack/api/command/ReadyForShutdownCmd.java
+++ b/plugins/maintenance/src/main/java/org/apache/cloudstack/api/command/ReadyForShutdownCmd.java
@@ -26,7 +26,8 @@
             description = "Returns the status of CloudStack, whether a shutdown has been triggered and if ready to shutdown",
             since = "4.19.0",
             responseObject = ManagementServerMaintenanceResponse.class,
-            requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
+            requestHasSensitiveInfo = false, responseHasSensitiveInfo = false,
+            httpMethod = "GET")
 public class ReadyForShutdownCmd extends BaseMSMaintenanceActionCmd {
     public static final String APINAME = "readyForShutdown";
 
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/VerifyOAuthCodeAndGetUserCmd.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/VerifyOAuthCodeAndGetUserCmd.java
index bd49f87d6273..b3d2d335ba25 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/VerifyOAuthCodeAndGetUserCmd.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/VerifyOAuthCodeAndGetUserCmd.java
@@ -20,8 +20,10 @@
 import java.util.List;
 import java.util.Map;
 
-import com.cloud.api.response.ApiResponseSerializer;
-import com.cloud.user.Account;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+
 import org.apache.cloudstack.acl.RoleType;
 import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.ApiConstants;
@@ -37,13 +39,13 @@
 import org.apache.cloudstack.oauth2.api.response.OauthProviderResponse;
 import org.apache.commons.lang.ArrayUtils;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
+import com.cloud.api.response.ApiResponseSerializer;
+import com.cloud.user.Account;
 
 @APICommand(name = "verifyOAuthCodeAndGetUser", description = "Verify the OAuth Code and fetch the corresponding user from provider", responseObject = OauthProviderResponse.class, entityType = {},
         requestHasSensitiveInfo = false, responseHasSensitiveInfo = false,
-        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User}, since = "4.19.0")
+        authorized = {RoleType.Admin, RoleType.ResourceAdmin, RoleType.DomainAdmin, RoleType.User}, since = "4.19.0",
+        httpMethod = "GET")
 public class VerifyOAuthCodeAndGetUserCmd extends BaseListCmd implements APIAuthenticator {
 
     /////////////////////////////////////////////////////
diff --git a/server/src/main/java/com/cloud/api/ApiServlet.java b/server/src/main/java/com/cloud/api/ApiServlet.java
index db17daaf146b..158df2240717 100644
--- a/server/src/main/java/com/cloud/api/ApiServlet.java
+++ b/server/src/main/java/com/cloud/api/ApiServlet.java
@@ -25,8 +25,8 @@
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
-import java.util.regex.Pattern;
 import java.util.Set;
+import java.util.regex.Pattern;
 
 import javax.inject.Inject;
 import javax.servlet.ServletConfig;
@@ -52,10 +52,9 @@
 import org.apache.cloudstack.managed.context.ManagedContext;
 import org.apache.cloudstack.utils.consoleproxy.ConsoleAccessUtils;
 import org.apache.commons.collections.MapUtils;
-
-import org.apache.logging.log4j.Logger;
-import org.apache.logging.log4j.LogManager;
 import org.apache.commons.lang3.EnumUtils;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
 import org.jetbrains.annotations.Nullable;
 import org.springframework.stereotype.Component;
 import org.springframework.web.context.support.SpringBeanAutowiringSupport;
@@ -70,12 +69,12 @@
 import com.cloud.user.AccountService;
 import com.cloud.user.User;
 import com.cloud.user.UserAccount;
-
 import com.cloud.utils.HttpUtils;
-import com.cloud.utils.HttpUtils.ApiSessionKeySameSite;
 import com.cloud.utils.HttpUtils.ApiSessionKeyCheckOption;
+import com.cloud.utils.HttpUtils.ApiSessionKeySameSite;
 import com.cloud.utils.StringUtils;
 import com.cloud.utils.db.EntityManager;
+import com.cloud.utils.exception.CloudRuntimeException;
 import com.cloud.utils.net.NetUtils;
 
 @Component("apiServlet")
@@ -84,9 +83,7 @@ public class ApiServlet extends HttpServlet {
     private static final Logger ACCESSLOGGER = LogManager.getLogger("apiserver." + ApiServlet.class.getName());
     private static final String REPLACEMENT = "_";
     private static final String LOGGER_REPLACEMENTS = "[\n\r\t]";
-    private static final Pattern GET_REQUEST_COMMANDS = Pattern.compile("^(get|list|query|find)(\\w+)+$");
-    private static final HashSet<String> GET_REQUEST_COMMANDS_LIST = new HashSet<>(Set.of("isaccountallowedtocreateofferingswithtags",
-            "readyforshutdown", "cloudianisenabled", "quotabalance", "quotasummary", "quotatarifflist", "quotaisenabled", "quotastatement", "verifyoauthcodeandgetuser"));
+    public static final Pattern GET_REQUEST_COMMANDS = Pattern.compile("^(get|list|query|find)(\\w+)+$");
     private static final HashSet<String> POST_REQUESTS_TO_DISABLE_LOGGING = new HashSet<>(Set.of(
             "login",
             "oauthlogin",
@@ -367,7 +364,7 @@ void processRequestInContext(final HttpServletRequest req, final HttpServletResp
                 }
             }
 
-            if (apiServer.isPostRequestsAndTimestampsEnforced() && !isStateChangingCommandUsingPOST(command, req.getMethod(), params)) {
+            if (apiServer.isPostRequestsAndTimestampsEnforced() && isStateChangingCommandNotUsingPOST(command, req.getMethod(), params)) {
                 String errorText = String.format("State changing command %s needs to be sent using POST request", command);
                 if (command.equalsIgnoreCase("updateConfiguration") && params.containsKey("name")) {
                     errorText = String.format("Changes for configuration %s needs to be sent using POST request", params.get("name")[0]);
@@ -485,13 +482,32 @@ private boolean checkIfAuthenticatorIsOf2FA(String command) {
         return verify2FA;
     }
 
-    private boolean isStateChangingCommandUsingPOST(String command, String method, Map<String, Object[]> params) {
-        if (command == null || (!GET_REQUEST_COMMANDS.matcher(command.toLowerCase()).matches() && !GET_REQUEST_COMMANDS_LIST.contains(command.toLowerCase())
-                && !command.equalsIgnoreCase("updateConfiguration") && !method.equals("POST"))) {
+    protected boolean isStateChangingCommandNotUsingPOST(String command, String method, Map<String, Object[]> params) {
+        if (BaseCmd.HTTPMethod.POST.toString().equalsIgnoreCase(method)) {
+            return false;
+        }
+        if (command == null || method == null) {
+            return true;
+        }
+        String commandHttpMethod = null;
+        try {
+            Class<?> cmdClass = apiServer.getCmdClass(command);
+            if (cmdClass != null) {
+                APICommand at = cmdClass.getAnnotation(APICommand.class);
+                if (at != null && org.apache.commons.lang3.StringUtils.isNotBlank(at.httpMethod())) {
+                    commandHttpMethod = at.httpMethod();
+                }
+            }
+        } catch (CloudRuntimeException e) {
+            LOGGER.trace("Command class not found for {}; falling back to pattern match", command, e);
+        }
+        if (BaseCmd.HTTPMethod.GET.toString().equalsIgnoreCase(commandHttpMethod) ||
+                GET_REQUEST_COMMANDS.matcher(command.toLowerCase()).matches()) {
             return false;
         }
-        return !command.equalsIgnoreCase("updateConfiguration") || method.equals("POST") || (params.containsKey("name")
-                && params.get("name")[0].toString().equalsIgnoreCase(ApiServer.EnforcePostRequestsAndTimestamps.key()));
+        return !command.equalsIgnoreCase("updateConfiguration") ||
+                !params.containsKey("name") ||
+                !ApiServer.EnforcePostRequestsAndTimestamps.key().equalsIgnoreCase(params.get("name")[0].toString());
     }
 
     protected boolean skip2FAcheckForAPIs(String command) {
diff --git a/server/src/test/java/com/cloud/api/ApiServletTest.java b/server/src/test/java/com/cloud/api/ApiServletTest.java
index 79fe4b86f859..c5ee9f58154d 100644
--- a/server/src/test/java/com/cloud/api/ApiServletTest.java
+++ b/server/src/test/java/com/cloud/api/ApiServletTest.java
@@ -16,22 +16,30 @@
 // under the License.
 package com.cloud.api;
 
-import com.cloud.api.auth.ListUserTwoFactorAuthenticatorProvidersCmd;
-import com.cloud.api.auth.SetupUserTwoFactorAuthenticationCmd;
-import com.cloud.api.auth.ValidateUserTwoFactorAuthenticationCodeCmd;
-import com.cloud.server.ManagementServer;
-import com.cloud.user.Account;
-import com.cloud.user.AccountManagerImpl;
-import com.cloud.user.AccountService;
-import com.cloud.user.User;
-import com.cloud.user.UserAccount;
-import com.cloud.utils.HttpUtils;
-import com.cloud.vm.UserVmManager;
+import static org.mockito.ArgumentMatchers.nullable;
+
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.io.StringWriter;
+import java.io.UnsupportedEncodingException;
+import java.lang.reflect.Field;
+import java.net.InetAddress;
+import java.net.URLEncoder;
+import java.net.UnknownHostException;
+import java.util.HashMap;
+import java.util.Map;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+
+import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.auth.APIAuthenticationManager;
 import org.apache.cloudstack.api.auth.APIAuthenticationType;
 import org.apache.cloudstack.api.auth.APIAuthenticator;
 import org.apache.cloudstack.api.command.admin.config.ListCfgsByCmd;
+import org.apache.cloudstack.api.command.admin.offering.IsAccountAllowedToCreateOfferingsWithTagsCmd;
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.framework.config.impl.ConfigDepotImpl;
 import org.junit.After;
@@ -43,25 +51,24 @@
 import org.mockito.Mockito;
 import org.mockito.junit.MockitoJUnitRunner;
 
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
-import java.io.IOException;
-import java.io.PrintWriter;
-import java.io.StringWriter;
-import java.io.UnsupportedEncodingException;
-import java.lang.reflect.Field;
-import java.net.InetAddress;
-import java.net.URLEncoder;
-import java.net.UnknownHostException;
-import java.util.HashMap;
-import java.util.Map;
-
-import static org.mockito.ArgumentMatchers.nullable;
+import com.cloud.api.auth.ListUserTwoFactorAuthenticatorProvidersCmd;
+import com.cloud.api.auth.SetupUserTwoFactorAuthenticationCmd;
+import com.cloud.api.auth.ValidateUserTwoFactorAuthenticationCodeCmd;
+import com.cloud.server.ManagementServer;
+import com.cloud.user.Account;
+import com.cloud.user.AccountManagerImpl;
+import com.cloud.user.AccountService;
+import com.cloud.user.User;
+import com.cloud.user.UserAccount;
+import com.cloud.utils.HttpUtils;
+import com.cloud.vm.UserVmManager;
 
 @RunWith(MockitoJUnitRunner.class)
 public class ApiServletTest {
 
+    private static final String[] STATE_CHANGING_COMMAND_CHECK_NAME_PARAM =
+            {ApiServer.EnforcePostRequestsAndTimestamps.key()};
+
     @Mock
     ApiServer apiServer;
 
@@ -461,4 +468,88 @@ public void testVerify2FAWhenExpectedCommandIsNotCalled() throws UnknownHostExce
 
         Assert.assertEquals(false, result);
     }
+
+    @Test
+    public void isStateChangingCommandNotUsingPOSTReturnsFalseForPostMethod() {
+        String command = "updateConfiguration";
+        String method = "POST";
+        Map<String, Object[]> params = new HashMap<>();
+
+        boolean result = servlet.isStateChangingCommandNotUsingPOST(command, method, params);
+
+        Assert.assertFalse(result);
+    }
+
+    @Test
+    public void isStateChangingCommandNotUsingPOSTReturnsTrueForNullCommandAndMethod() {
+        String command = null;
+        String method = null;
+        Map<String, Object[]> params = new HashMap<>();
+
+        boolean result = servlet.isStateChangingCommandNotUsingPOST(command, method, params);
+
+        Assert.assertTrue(result);
+    }
+
+    @Test
+    public void isStateChangingCommandNotUsingPOSTReturnsFalseForGetHttpMethodAnnotation() {
+        String command = "isAccountAllowedToCreateOfferingsWithTags";
+        String method = "GET";
+        Map<String, Object[]> params = new HashMap<>();
+        Class<?> cmdClass = IsAccountAllowedToCreateOfferingsWithTagsCmd.class;
+        APICommand apiCommand = cmdClass.getAnnotation(APICommand.class);
+        Mockito.doReturn(cmdClass).when(apiServer).getCmdClass(command);
+        Assert.assertNotNull(apiCommand);
+        Assert.assertEquals("GET", apiCommand.httpMethod());
+        boolean result = servlet.isStateChangingCommandNotUsingPOST(command, method, params);
+        Assert.assertFalse(result);
+    }
+
+    @Test
+    public void isStateChangingCommandNotUsingPOSTReturnsFalseForMatchingGetRequestPattern() {
+        String command = "listZones";
+        String method = "GET";
+        Map<String, Object[]> params = new HashMap<>();
+        boolean result = servlet.isStateChangingCommandNotUsingPOST(command, method, params);
+        Assert.assertFalse(result);
+    }
+
+    @Test
+    public void isStateChangingCommandNotUsingPOSTReturnsTrueForMissingNameParameter() {
+        String command = "updateConfiguration";
+        String method = "GET";
+        Map<String, Object[]> params = new HashMap<>();
+        boolean result = servlet.isStateChangingCommandNotUsingPOST(command, method, params);
+        Assert.assertTrue(result);
+    }
+
+    @Test
+    public void isStateChangingCommandNotUsingPOSTReturnsFalseForUpdateConfigurationEnforcePostRequestsKey() {
+        String command = "updateConfiguration";
+        String method = "GET";
+        Map<String, Object[]> params = new HashMap<>();
+        params.put("name", STATE_CHANGING_COMMAND_CHECK_NAME_PARAM);
+        boolean result = servlet.isStateChangingCommandNotUsingPOST(command, method, params);
+        Assert.assertFalse(result);
+    }
+
+    @Test
+    public void isStateChangingCommandNotUsingPOSTReturnsFalseForWrongApiEnforcePostRequestsKey() {
+        String command = "updateSomeApi";
+        String method = "GET";
+        Map<String, Object[]> params = new HashMap<>();
+        params.put("name", STATE_CHANGING_COMMAND_CHECK_NAME_PARAM);
+        boolean result = servlet.isStateChangingCommandNotUsingPOST(command, method, params);
+        Assert.assertTrue(result);
+    }
+
+    @Test
+    public void isStateChangingCommandNotUsingPOSTReturnsFalseForUpdateConfigurationNonEnforcePostRequestsKey() {
+        String command = "updateConfiguration";
+        String method = "GET";
+        Map<String, Object[]> params = new HashMap<>();
+        params.put("name", new String[] { "key" });
+        boolean result = servlet.isStateChangingCommandNotUsingPOST(command, method, params);
+        Assert.assertTrue(result);
+    }
 }

From 664f76c7e4b61489927abb6b5e859d79c47662a4 Mon Sep 17 00:00:00 2001
From: Nicolas Vazquez <nicovazquez90@gmail.com>
Date: Thu, 29 Jan 2026 05:24:58 -0300
Subject: [PATCH 088/117] Fix KvmSshToAgentEnabled setting description and make
 it dynamic (#12533)

---
 .../java/com/cloud/resource/ResourceManager.java   |  4 ++--
 .../resources/META-INF/db/schema-42020to42030.sql  |  3 +++
 .../com/cloud/resource/ResourceManagerImpl.java    |  3 +--
 .../cloud/resource/ResourceManagerImplTest.java    | 14 +++++++++++---
 4 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/engine/components-api/src/main/java/com/cloud/resource/ResourceManager.java b/engine/components-api/src/main/java/com/cloud/resource/ResourceManager.java
index 89dc4badcbcf..936e8b3448eb 100755
--- a/engine/components-api/src/main/java/com/cloud/resource/ResourceManager.java
+++ b/engine/components-api/src/main/java/com/cloud/resource/ResourceManager.java
@@ -51,8 +51,8 @@ public interface ResourceManager extends ResourceService, Configurable {
 
     ConfigKey<Boolean> KvmSshToAgentEnabled = new ConfigKey<>("Advanced", Boolean.class,
             "kvm.ssh.to.agent","true",
-            "Number of retries when preparing a host into Maintenance Mode is faulty before failing",
-            false);
+            "True if the management server will restart the agent service via SSH into the KVM hosts after or during maintenance operations",
+            true);
 
     ConfigKey<String> HOST_MAINTENANCE_LOCAL_STRATEGY = new ConfigKey<>(String.class,
     "host.maintenance.local.storage.strategy", "Advanced","Error",
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42020to42030.sql b/engine/schema/src/main/resources/META-INF/db/schema-42020to42030.sql
index 567e623564ea..5eec97278bad 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-42020to42030.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42020to42030.sql
@@ -23,3 +23,6 @@ ALTER TABLE `cloud`.`template_store_ref` MODIFY COLUMN `download_url` varchar(20
 
 UPDATE `cloud`.`alert` SET type = 33 WHERE name = 'ALERT.VR.PUBLIC.IFACE.MTU';
 UPDATE `cloud`.`alert` SET type = 34 WHERE name = 'ALERT.VR.PRIVATE.IFACE.MTU';
+
+-- Update configuration 'kvm.ssh.to.agent' description and is_dynamic fields
+UPDATE `cloud`.`configuration` SET description = 'True if the management server will restart the agent service via SSH into the KVM hosts after or during maintenance operations', is_dynamic = 1 WHERE name = 'kvm.ssh.to.agent';
diff --git a/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java b/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
index a77ecfcb7fe1..c076ab7c893e 100755
--- a/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
+++ b/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
@@ -2920,8 +2920,7 @@ protected void handleAgentIfNotConnected(HostVO host, boolean vmsMigrating) {
         if (!isAgentOnHost || vmsMigrating || host.getStatus() == Status.Up) {
             return;
         }
-        final boolean sshToAgent = Boolean.parseBoolean(_configDao.getValue(KvmSshToAgentEnabled.key()));
-        if (sshToAgent) {
+        if (KvmSshToAgentEnabled.value()) {
             Ternary<String, String, String> credentials = getHostCredentials(host);
             connectAndRestartAgentOnHost(host, credentials.first(), credentials.second(), credentials.third());
         } else {
diff --git a/server/src/test/java/com/cloud/resource/ResourceManagerImplTest.java b/server/src/test/java/com/cloud/resource/ResourceManagerImplTest.java
index 5b7353bded6c..1669d7a47d9f 100644
--- a/server/src/test/java/com/cloud/resource/ResourceManagerImplTest.java
+++ b/server/src/test/java/com/cloud/resource/ResourceManagerImplTest.java
@@ -45,6 +45,7 @@
 import com.trilead.ssh2.Connection;
 import org.apache.cloudstack.api.command.admin.host.CancelHostAsDegradedCmd;
 import org.apache.cloudstack.api.command.admin.host.DeclareHostAsDegradedCmd;
+import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
 import org.junit.After;
 import org.junit.Assert;
@@ -61,6 +62,7 @@
 import org.mockito.Spy;
 import org.mockito.junit.MockitoJUnitRunner;
 
+import java.lang.reflect.Field;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
@@ -152,6 +154,12 @@ public class ResourceManagerImplTest {
     private MockedConstruction<GetVncPortCommand> getVncPortCommandMockedConstruction;
     private AutoCloseable closeable;
 
+    private void overrideDefaultConfigValue(final ConfigKey configKey, final String name, final Object o) throws IllegalAccessException, NoSuchFieldException {
+        Field f = ConfigKey.class.getDeclaredField(name);
+        f.setAccessible(true);
+        f.set(configKey, o);
+    }
+
     @Before
     public void setup() throws Exception {
         closeable = MockitoAnnotations.openMocks(this);
@@ -194,7 +202,7 @@ public void setup() throws Exception {
                 eq("service cloudstack-agent restart"))).
                 willReturn(new SSHCmdHelper.SSHCmdResult(0,"",""));
 
-        when(configurationDao.getValue(ResourceManager.KvmSshToAgentEnabled.key())).thenReturn("true");
+        overrideDefaultConfigValue(ResourceManager.KvmSshToAgentEnabled, "_defaultValue", "true");
 
         rootDisks = Arrays.asList(rootDisk1, rootDisk2);
         dataDisks = Collections.singletonList(dataDisk);
@@ -372,9 +380,9 @@ public void testHandleAgentSSHEnabledConnectedAgent() {
     }
 
     @Test(expected = CloudRuntimeException.class)
-    public void testHandleAgentSSHDisabledNotConnectedAgent() {
+    public void testHandleAgentSSHDisabledNotConnectedAgent() throws NoSuchFieldException, IllegalAccessException {
         when(host.getStatus()).thenReturn(Status.Disconnected);
-        when(configurationDao.getValue(ResourceManager.KvmSshToAgentEnabled.key())).thenReturn("false");
+        overrideDefaultConfigValue(ResourceManager.KvmSshToAgentEnabled, "_defaultValue", "false");
         resourceManager.handleAgentIfNotConnected(host, false);
     }
 

From 26b57655ecea10d65689084a9bf7a2285b744697 Mon Sep 17 00:00:00 2001
From: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
Date: Thu, 29 Jan 2026 13:59:41 +0530
Subject: [PATCH 089/117] Deployment plan fixes for VM with last host, and last
 host in maintenance (#12062)

* Deployment plan fixes for VM with last host
- Consider last host when it is not in maintenance
- Fail deployment when user requests for last host consideration and last host doesn't exists or in maintenance

* changes

* msg update with vm/host name

* address comments

* Exclude last hosts with error or degraded state as well, for vm deploy

* review changes
---
 .../deploy/DeploymentPlanningManagerImpl.java | 80 ++++++++++---------
 .../cloud/ha/HighAvailabilityManagerImpl.java |  4 +-
 .../cloud/resource/ResourceManagerImpl.java   |  2 +-
 3 files changed, 45 insertions(+), 41 deletions(-)

diff --git a/server/src/main/java/com/cloud/deploy/DeploymentPlanningManagerImpl.java b/server/src/main/java/com/cloud/deploy/DeploymentPlanningManagerImpl.java
index e7b926eb4e44..6881fbab98c9 100644
--- a/server/src/main/java/com/cloud/deploy/DeploymentPlanningManagerImpl.java
+++ b/server/src/main/java/com/cloud/deploy/DeploymentPlanningManagerImpl.java
@@ -36,6 +36,7 @@
 import javax.inject.Inject;
 import javax.naming.ConfigurationException;
 
+import com.cloud.resource.ResourceState;
 import org.apache.cloudstack.affinity.AffinityGroupDomainMapVO;
 import org.apache.cloudstack.affinity.AffinityGroupProcessor;
 import org.apache.cloudstack.affinity.AffinityGroupService;
@@ -378,22 +379,12 @@ public DeployDestination planDeployment(VirtualMachineProfile vmProfile, Deploym
             planner = getDeploymentPlannerByName(plannerName);
         }
 
-        Host lastHost = null;
-
-        String considerLastHostStr = (String)vmProfile.getParameter(VirtualMachineProfile.Param.ConsiderLastHost);
-        boolean considerLastHost = vm.getLastHostId() != null && haVmTag == null &&
-                (considerLastHostStr == null || Boolean.TRUE.toString().equalsIgnoreCase(considerLastHostStr));
-        if (considerLastHost) {
-            HostVO host = _hostDao.findById(vm.getLastHostId());
-            logger.debug("This VM has last host_id specified, trying to choose the same host: " + host);
-            lastHost = host;
-
-            DeployDestination deployDestination = deployInVmLastHost(vmProfile, plan, avoids, planner, vm, dc, offering, cpuRequested, ramRequested, volumesRequireEncryption);
-            if (deployDestination != null) {
-                return deployDestination;
-            }
+        DeployDestination deployDestinationForVmLasthost = deployInVmLastHost(vmProfile, plan, avoids, planner, vm, dc, offering, cpuRequested, ramRequested, volumesRequireEncryption);
+        if (deployDestinationForVmLasthost != null) {
+            return deployDestinationForVmLasthost;
         }
 
+        HostVO lastHost = _hostDao.findById(vm.getLastHostId());
         avoidOtherClustersForDeploymentIfMigrationDisabled(vm, lastHost, avoids);
 
         DeployDestination dest = null;
@@ -475,47 +466,56 @@ private void avoidDifferentArchResources(VirtualMachineProfile vmProfile, DataCe
     private DeployDestination deployInVmLastHost(VirtualMachineProfile vmProfile, DeploymentPlan plan, ExcludeList avoids,
             DeploymentPlanner planner, VirtualMachine vm, DataCenter dc, ServiceOffering offering, int cpuRequested, long ramRequested,
             boolean volumesRequireEncryption) throws InsufficientServerCapacityException {
-        HostVO host = _hostDao.findById(vm.getLastHostId());
-        if (canUseLastHost(host, avoids, plan, vm, offering, volumesRequireEncryption)) {
-            _hostDao.loadHostTags(host);
-            _hostDao.loadDetails(host);
-            if (host.getStatus() != Status.Up) {
+        String considerLastHostStr = (String)vmProfile.getParameter(VirtualMachineProfile.Param.ConsiderLastHost);
+        String haVmTag = (String)vmProfile.getParameter(VirtualMachineProfile.Param.HaTag);
+        boolean considerLastHost = vm.getLastHostId() != null && haVmTag == null &&
+                !(Boolean.FALSE.toString().equalsIgnoreCase(considerLastHostStr));
+        if (!considerLastHost) {
+            return null;
+        }
+
+        logger.debug("This VM has last host_id: {}", vm.getLastHostId());
+        HostVO lastHost = _hostDao.findById(vm.getLastHostId());
+        if (canUseLastHost(lastHost, avoids, plan, vm, offering, volumesRequireEncryption)) {
+            _hostDao.loadHostTags(lastHost);
+            _hostDao.loadDetails(lastHost);
+            if (lastHost.getStatus() != Status.Up) {
                 logger.debug("Cannot deploy VM [{}] to the last host [{}] because this host is not in UP state or is not enabled. Host current status [{}] and resource status [{}].",
-                        vm, host, host.getState().name(), host.getResourceState());
+                        vm, lastHost, lastHost.getState().name(), lastHost.getResourceState());
                 return null;
             }
-            if (checkVmProfileAndHost(vmProfile, host)) {
-                long cluster_id = host.getClusterId();
+            if (checkVmProfileAndHost(vmProfile, lastHost)) {
+                long cluster_id = lastHost.getClusterId();
                 ClusterDetailsVO cluster_detail_cpu = _clusterDetailsDao.findDetail(cluster_id, "cpuOvercommitRatio");
                 ClusterDetailsVO cluster_detail_ram = _clusterDetailsDao.findDetail(cluster_id, "memoryOvercommitRatio");
                 float cpuOvercommitRatio = Float.parseFloat(cluster_detail_cpu.getValue());
                 float memoryOvercommitRatio = Float.parseFloat(cluster_detail_ram.getValue());
 
                 boolean hostHasCpuCapability, hostHasCapacity = false;
-                hostHasCpuCapability = _capacityMgr.checkIfHostHasCpuCapability(host, offering.getCpu(), offering.getSpeed());
+                hostHasCpuCapability = _capacityMgr.checkIfHostHasCpuCapability(lastHost, offering.getCpu(), offering.getSpeed());
 
                 if (hostHasCpuCapability) {
                     // first check from reserved capacity
-                    hostHasCapacity = _capacityMgr.checkIfHostHasCapacity(host, cpuRequested, ramRequested, true, cpuOvercommitRatio, memoryOvercommitRatio, true);
+                    hostHasCapacity = _capacityMgr.checkIfHostHasCapacity(lastHost, cpuRequested, ramRequested, true, cpuOvercommitRatio, memoryOvercommitRatio, true);
 
                     // if not reserved, check the free capacity
                     if (!hostHasCapacity)
-                        hostHasCapacity = _capacityMgr.checkIfHostHasCapacity(host, cpuRequested, ramRequested, false, cpuOvercommitRatio, memoryOvercommitRatio, true);
+                        hostHasCapacity = _capacityMgr.checkIfHostHasCapacity(lastHost, cpuRequested, ramRequested, false, cpuOvercommitRatio, memoryOvercommitRatio, true);
                     }
 
                 boolean displayStorage = getDisplayStorageFromVmProfile(vmProfile);
                 if (!hostHasCapacity || !hostHasCpuCapability) {
-                    logger.debug("Cannot deploy VM [{}] to the last host [{}] because this host does not have enough capacity to deploy this VM.", vm, host);
+                    logger.debug("Cannot deploy VM [{}] to the last host [{}] because this host does not have enough capacity to deploy this VM.", vm, lastHost);
                     return null;
                 }
-                Pod pod = _podDao.findById(host.getPodId());
-                Cluster cluster = _clusterDao.findById(host.getClusterId());
+                Pod pod = _podDao.findById(lastHost.getPodId());
+                Cluster cluster = _clusterDao.findById(lastHost.getClusterId());
 
                 logger.debug("Last host [{}] of VM [{}] is UP and has enough capacity. Checking for suitable pools for this host under zone [{}], pod [{}] and cluster [{}].",
-                        host, vm, dc, pod, cluster);
+                        lastHost, vm, dc, pod, cluster);
 
                 if (vm.getHypervisorType() == HypervisorType.BareMetal) {
-                    DeployDestination dest = new DeployDestination(dc, pod, cluster, host, new HashMap<>(), displayStorage);
+                    DeployDestination dest = new DeployDestination(dc, pod, cluster, lastHost, new HashMap<>(), displayStorage);
                     logger.debug("Returning Deployment Destination: {}.", dest);
                     return dest;
                 }
@@ -523,8 +523,8 @@ private DeployDestination deployInVmLastHost(VirtualMachineProfile vmProfile, De
                 // search for storage under the zone, pod, cluster
                 // of
                 // the last host.
-                DataCenterDeployment lastPlan = new DataCenterDeployment(host.getDataCenterId(),
-                        host.getPodId(), host.getClusterId(), host.getId(), plan.getPoolId(), null);
+                DataCenterDeployment lastPlan = new DataCenterDeployment(lastHost.getDataCenterId(),
+                        lastHost.getPodId(), lastHost.getClusterId(), lastHost.getId(), plan.getPoolId(), null);
                 Pair<Map<Volume, List<StoragePool>>, List<Volume>> result = findSuitablePoolsForVolumes(
                         vmProfile, lastPlan, avoids, HostAllocator.RETURN_UPTO_ALL);
                 Map<Volume, List<StoragePool>> suitableVolumeStoragePools = result.first();
@@ -533,11 +533,11 @@ private DeployDestination deployInVmLastHost(VirtualMachineProfile vmProfile, De
                 // choose the potential pool for this VM for this
                 // host
                 if (suitableVolumeStoragePools.isEmpty()) {
-                    logger.debug("Cannot find suitable storage pools in host [{}] to deploy VM [{}]", host, vm);
+                    logger.debug("Cannot find suitable storage pools in host [{}] to deploy VM [{}]", lastHost, vm);
                     return null;
                 }
                 List<Host> suitableHosts = new ArrayList<>();
-                suitableHosts.add(host);
+                suitableHosts.add(lastHost);
                 Pair<Host, Map<Volume, StoragePool>> potentialResources = findPotentialDeploymentResources(
                         suitableHosts, suitableVolumeStoragePools, avoids,
                         getPlannerUsage(planner, vmProfile, plan, avoids), readyAndReusedVolumes, plan.getPreferredHosts(), vm);
@@ -550,7 +550,7 @@ private DeployDestination deployInVmLastHost(VirtualMachineProfile vmProfile, De
                     for (Volume vol : readyAndReusedVolumes) {
                         storageVolMap.remove(vol);
                     }
-                    DeployDestination dest = new DeployDestination(dc, pod, cluster, host, storageVolMap, displayStorage);
+                    DeployDestination dest = new DeployDestination(dc, pod, cluster, lastHost, storageVolMap, displayStorage);
                     logger.debug("Returning Deployment Destination: {}", dest);
                     return dest;
                 }
@@ -562,7 +562,7 @@ private DeployDestination deployInVmLastHost(VirtualMachineProfile vmProfile, De
 
     private boolean canUseLastHost(HostVO host, ExcludeList avoids, DeploymentPlan plan, VirtualMachine vm, ServiceOffering offering, boolean volumesRequireEncryption) {
         if (host == null) {
-            logger.warn("Could not find last host of VM [{}] with id [{}]. Skipping this and trying other available hosts.", vm, vm.getLastHostId());
+            logger.warn("Could not find last host of VM [{}] with id [{}]. Skipping it", vm, vm.getLastHostId());
             return false;
         }
 
@@ -576,6 +576,12 @@ private boolean canUseLastHost(HostVO host, ExcludeList avoids, DeploymentPlan p
             return false;
         }
 
+        logger.debug("VM's last host is {}, trying to choose the same host if it is not in maintenance, error or degraded state", host);
+        if (host.isInMaintenanceStates() || Arrays.asList(ResourceState.Error, ResourceState.Degraded).contains(host.getResourceState())) {
+            logger.debug("Unable to deploy VM {} in the last host, last host {} is in {} state", vm.getName(), host.getName(), host.getResourceState());
+            return false;
+        }
+
         if (_capacityMgr.checkIfHostReachMaxGuestLimit(host)) {
             logger.debug("Cannot deploy VM [{}] in the last host [{}] because this host already has the max number of running VMs (users and system VMs). Skipping this and trying other available hosts.",
                     vm, host);
@@ -1474,7 +1480,7 @@ private Pair<Boolean, Boolean> findVMStorageRequirements(VirtualMachineProfile v
 
     protected Pair<Host, Map<Volume, StoragePool>> findPotentialDeploymentResources(List<Host> suitableHosts, Map<Volume, List<StoragePool>> suitableVolumeStoragePools,
                                                                                     ExcludeList avoid, PlannerResourceUsage resourceUsageRequired, List<Volume> readyAndReusedVolumes, List<Long> preferredHosts, VirtualMachine vm) {
-        logger.debug("Trying to find a potenial host and associated storage pools from the suitable host/pool lists for this VM");
+        logger.debug("Trying to find a potential host and associated storage pools from the suitable host/pool lists for this VM");
 
         boolean hostCanAccessPool = false;
         boolean haveEnoughSpace = false;
diff --git a/server/src/main/java/com/cloud/ha/HighAvailabilityManagerImpl.java b/server/src/main/java/com/cloud/ha/HighAvailabilityManagerImpl.java
index b0f3e6d8d697..e3f67420a2ab 100644
--- a/server/src/main/java/com/cloud/ha/HighAvailabilityManagerImpl.java
+++ b/server/src/main/java/com/cloud/ha/HighAvailabilityManagerImpl.java
@@ -833,7 +833,7 @@ public Long migrate(final HaWorkVO work) {
         if (checkAndCancelWorkIfNeeded(work)) {
             return null;
         }
-        logger.info("Migration attempt: for VM {}from host {}. Starting attempt: {}/{} times.", vm, srcHost, 1 + work.getTimesTried(), _maxRetries);
+        logger.info("Migration attempt: for {} from {}. Starting attempt: {}/{} times.", vm, srcHost, 1 + work.getTimesTried(), _maxRetries);
 
         if (VirtualMachine.State.Stopped.equals(vm.getState())) {
             logger.info(String.format("vm %s is Stopped, skipping migrate.", vm));
@@ -843,8 +843,6 @@ public Long migrate(final HaWorkVO work) {
             logger.info(String.format("VM %s is running on a different host %s, skipping migration", vm, vm.getHostId()));
             return null;
         }
-        logger.info("Migration attempt: for VM " + vm.getUuid() + "from host id " + srcHostId +
-                ". Starting attempt: " + (1 + work.getTimesTried()) + "/" + _maxRetries + " times.");
 
         try {
             work.setStep(Step.Migrating);
diff --git a/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java b/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
index c076ab7c893e..12ceac213228 100755
--- a/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
+++ b/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
@@ -1417,7 +1417,7 @@ private boolean doMaintain(final long hostId) {
                         throw new CloudRuntimeException("There are active VMs using the host's local storage pool. Please stop all VMs on this host that use local storage.");
                     }
                 } else {
-                    logger.info("Maintenance: scheduling migration of VM {} from host {}", vm, host);
+                    logger.info("Maintenance: scheduling migration of {} from {}", vm, host);
                     _haMgr.scheduleMigration(vm, HighAvailabilityManager.ReasonType.HostMaintenance);
                 }
             }

From c681d0d0a2f53a7ef52de5cc2a4bb0d7d2aa864a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bernardo=20De=20Marco=20Gon=C3=A7alves?=
 <bernardomg2004@gmail.com>
Date: Thu, 29 Jan 2026 06:01:54 -0300
Subject: [PATCH 090/117] Change `vmsnapshot.max` setting scope to the account
 level (#11616)

---
 .../com/cloud/vm/snapshot/VMSnapshotManager.java  |  2 +-
 .../cloud/vm/snapshot/VMSnapshotManagerImpl.java  |  7 ++++---
 .../cloud/vm/snapshot/VMSnapshotManagerTest.java  | 15 +++++++++++++++
 3 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/engine/components-api/src/main/java/com/cloud/vm/snapshot/VMSnapshotManager.java b/engine/components-api/src/main/java/com/cloud/vm/snapshot/VMSnapshotManager.java
index 6478469f190c..6831552b83db 100644
--- a/engine/components-api/src/main/java/com/cloud/vm/snapshot/VMSnapshotManager.java
+++ b/engine/components-api/src/main/java/com/cloud/vm/snapshot/VMSnapshotManager.java
@@ -31,7 +31,7 @@ public interface VMSnapshotManager extends VMSnapshotService, Manager {
     static final ConfigKey<Integer> VMSnapshotExpireInterval = new ConfigKey<Integer>("Advanced", Integer.class, "vmsnapshot.expire.interval", "-1",
             "VM Snapshot expire interval in hours", true, ConfigKey.Scope.Account);
 
-    ConfigKey<Integer> VMSnapshotMax = new ConfigKey<Integer>("Advanced", Integer.class, "vmsnapshot.max", "10", "Maximum vm snapshots for a single vm", true, ConfigKey.Scope.Global);
+    ConfigKey<Integer> VMSnapshotMax = new ConfigKey<Integer>("Advanced", Integer.class, "vmsnapshot.max", "10", "Maximum VM snapshots for a single VM", true, ConfigKey.Scope.Account);
 
     /**
      * Delete all VM snapshots belonging to one VM
diff --git a/server/src/main/java/com/cloud/vm/snapshot/VMSnapshotManagerImpl.java b/server/src/main/java/com/cloud/vm/snapshot/VMSnapshotManagerImpl.java
index 617a4e54a6e4..d5e25adcd5fa 100644
--- a/server/src/main/java/com/cloud/vm/snapshot/VMSnapshotManagerImpl.java
+++ b/server/src/main/java/com/cloud/vm/snapshot/VMSnapshotManagerImpl.java
@@ -400,10 +400,11 @@ public VMSnapshot allocVMSnapshot(Long vmId, String vsDisplayName, String vsDesc
         _accountMgr.checkAccess(caller, null, true, userVmVo);
 
         // check max snapshot limit for per VM
-        int vmSnapshotMax = VMSnapshotManager.VMSnapshotMax.value();
-
+        boolean vmBelongsToProject = _accountMgr.getAccount(userVmVo.getAccountId()).getType() == Account.Type.PROJECT;
+        long accountIdToRetrieveConfigurationValueFrom = vmBelongsToProject ? caller.getId() : userVmVo.getAccountId();
+        int vmSnapshotMax = VMSnapshotManager.VMSnapshotMax.valueIn(accountIdToRetrieveConfigurationValueFrom);
         if (_vmSnapshotDao.findByVm(vmId).size() >= vmSnapshotMax) {
-            throw new CloudRuntimeException("Creating Instance Snapshot failed due to a Instance can just have : " + vmSnapshotMax + " Instance Snapshots. Please delete old ones");
+            throw new CloudRuntimeException(String.format("Each VM can have at most [%s] VM snapshots.", vmSnapshotMax));
         }
 
         // check if there are active volume snapshots tasks
diff --git a/server/src/test/java/com/cloud/vm/snapshot/VMSnapshotManagerTest.java b/server/src/test/java/com/cloud/vm/snapshot/VMSnapshotManagerTest.java
index a0f09981a401..b696d743ac64 100644
--- a/server/src/test/java/com/cloud/vm/snapshot/VMSnapshotManagerTest.java
+++ b/server/src/test/java/com/cloud/vm/snapshot/VMSnapshotManagerTest.java
@@ -41,6 +41,7 @@
 import com.cloud.storage.dao.VolumeDao;
 import com.cloud.user.Account;
 import com.cloud.user.AccountManager;
+import com.cloud.user.AccountVO;
 import com.cloud.user.dao.AccountDao;
 import com.cloud.user.dao.UserDao;
 import com.cloud.uservm.UserVm;
@@ -136,6 +137,8 @@ public class VMSnapshotManagerTest {
     VMSnapshotDetailsDao _vmSnapshotDetailsDao;
     @Mock
     UserVmManager _userVmManager;
+    @Mock
+    private AccountVO accountVOMock;
 
     private static final long TEST_VM_ID = 3L;
     private static final long SERVICE_OFFERING_ID = 1L;
@@ -285,8 +288,12 @@ public void testCreateVMSnapshotF3() throws AgentUnavailableException, Operation
     @SuppressWarnings("unchecked")
     @Test(expected = CloudRuntimeException.class)
     public void testAllocVMSnapshotF4() throws ResourceAllocationException {
+        long accountId = 1L;
         List<VMSnapshotVO> mockList = mock(List.class);
         when(mockList.size()).thenReturn(10);
+        when(_userVMDao.findById(TEST_VM_ID)).thenReturn(vmMock);
+        when(userVm.getAccountId()).thenReturn(accountId);
+        when(_accountMgr.getAccount(accountId)).thenReturn(accountVOMock);
         when(_vmSnapshotDao.findByVm(TEST_VM_ID)).thenReturn(mockList);
         _vmSnapshotMgr.allocVMSnapshot(TEST_VM_ID, "", "", true);
     }
@@ -295,8 +302,12 @@ public void testAllocVMSnapshotF4() throws ResourceAllocationException {
     @SuppressWarnings("unchecked")
     @Test(expected = CloudRuntimeException.class)
     public void testAllocVMSnapshotF5() throws ResourceAllocationException {
+        long accountId = 1L;
         List<SnapshotVO> mockList = mock(List.class);
         when(mockList.size()).thenReturn(1);
+        when(_userVMDao.findById(TEST_VM_ID)).thenReturn(vmMock);
+        when(userVm.getAccountId()).thenReturn(accountId);
+        when(_accountMgr.getAccount(accountId)).thenReturn(accountVOMock);
         when(_snapshotDao.listByInstanceId(TEST_VM_ID, Snapshot.State.Creating, Snapshot.State.CreatedOnPrimary, Snapshot.State.BackingUp)).thenReturn(mockList);
         _vmSnapshotMgr.allocVMSnapshot(TEST_VM_ID, "", "", true);
     }
@@ -304,6 +315,10 @@ public void testAllocVMSnapshotF5() throws ResourceAllocationException {
     // successful creation case
     @Test
     public void testCreateVMSnapshot() throws AgentUnavailableException, OperationTimedoutException, ResourceAllocationException, NoTransitionException {
+        long accountId = 1L;
+        when(_userVMDao.findById(TEST_VM_ID)).thenReturn(vmMock);
+        when(userVm.getAccountId()).thenReturn(accountId);
+        when(_accountMgr.getAccount(accountId)).thenReturn(accountVOMock);
         when(vmMock.getState()).thenReturn(State.Running);
         _vmSnapshotMgr.allocVMSnapshot(TEST_VM_ID, "", "", true);
     }

From 6ba5e082217ab7af0ee5042bfdff1053fad41430 Mon Sep 17 00:00:00 2001
From: Rene Peinthor <rene.peinthor@linbit.com>
Date: Thu, 29 Jan 2026 10:08:12 +0100
Subject: [PATCH 091/117] Linstor: support live migration from other primary
 storage (#12532)

* Linstor: Refactor resource creation methods to LinstorUtil

Move reusable methods from LinstorPrimaryDataStoreDriverImpl to LinstorUtil
to enable sharing with other components:
- logLinstorAnswer, logLinstorAnswers, checkLinstorAnswersThrow
- getRscGrp, getEncryptedLayerList, applyQoSSettings
- createResourceBase, createResource, spawnResource
- canShareTemplateForResourceGroup, foundShareableTemplate

Add LIN_PROP_DRBDOPT_EXACT_SIZE constant and exactSize parameter support
for DRBD exact-size property handling during resource creation.

* Linstor: Add LinstorDataMotionStrategy for VM live migration

Implement DataMotionStrategy for live migration of VMs with volumes on
Linstor or other primary storage.

Key features:
- Support live migration with storage from other primary storages
- Preserve DRBD exact-size property during migration
---
 plugins/storage/volume/linstor/CHANGELOG.md   |   6 +
 .../LinstorPrimaryDataStoreDriverImpl.java    | 316 +------------
 .../storage/datastore/util/LinstorUtil.java   | 293 +++++++++++-
 .../motion/LinstorDataMotionStrategy.java     | 437 ++++++++++++++++++
 .../spring-storage-volume-linstor-context.xml |   2 +
 ...LinstorPrimaryDataStoreDriverImplTest.java |   7 +-
 6 files changed, 764 insertions(+), 297 deletions(-)
 create mode 100644 plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/motion/LinstorDataMotionStrategy.java

diff --git a/plugins/storage/volume/linstor/CHANGELOG.md b/plugins/storage/volume/linstor/CHANGELOG.md
index 47d1ddeb06cf..a5d609325d60 100644
--- a/plugins/storage/volume/linstor/CHANGELOG.md
+++ b/plugins/storage/volume/linstor/CHANGELOG.md
@@ -5,6 +5,12 @@ All notable changes to Linstor CloudStack plugin will be documented in this file
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2026-01-17]
+
+### Added
+
+- Support live migrate from other primary storage
+
 ## [2025-12-18]
 
 ### Changed
diff --git a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImpl.java b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImpl.java
index c2bce6e5a046..27b5f7ef7ec7 100644
--- a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImpl.java
+++ b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImpl.java
@@ -21,33 +21,25 @@
 import com.linbit.linstor.api.DevelopersApi;
 import com.linbit.linstor.api.model.ApiCallRc;
 import com.linbit.linstor.api.model.ApiCallRcList;
-import com.linbit.linstor.api.model.AutoSelectFilter;
 import com.linbit.linstor.api.model.LayerType;
-import com.linbit.linstor.api.model.Properties;
 import com.linbit.linstor.api.model.ResourceDefinition;
 import com.linbit.linstor.api.model.ResourceDefinitionCloneRequest;
 import com.linbit.linstor.api.model.ResourceDefinitionCloneStarted;
 import com.linbit.linstor.api.model.ResourceDefinitionCreate;
 import com.linbit.linstor.api.model.ResourceDefinitionModify;
-import com.linbit.linstor.api.model.ResourceGroup;
-import com.linbit.linstor.api.model.ResourceGroupSpawn;
 import com.linbit.linstor.api.model.ResourceMakeAvailable;
 import com.linbit.linstor.api.model.ResourceWithVolumes;
 import com.linbit.linstor.api.model.Snapshot;
 import com.linbit.linstor.api.model.SnapshotRestore;
-import com.linbit.linstor.api.model.VolumeDefinition;
 import com.linbit.linstor.api.model.VolumeDefinitionModify;
 
 import javax.annotation.Nonnull;
-import javax.annotation.Nullable;
 import javax.inject.Inject;
 
-import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
-import java.util.Objects;
 import java.util.Optional;
 import java.util.stream.Collectors;
 
@@ -117,10 +109,9 @@
 import org.apache.cloudstack.storage.to.SnapshotObjectTO;
 import org.apache.cloudstack.storage.to.VolumeObjectTO;
 import org.apache.cloudstack.storage.volume.VolumeObject;
-
-import org.apache.logging.log4j.Logger;
-import org.apache.logging.log4j.LogManager;
 import org.apache.commons.collections.CollectionUtils;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
 
 import java.nio.charset.StandardCharsets;
 
@@ -335,275 +326,11 @@ public void deleteAsync(DataStore dataStore, DataObject dataObject, AsyncComplet
         }
     }
 
-    private void logLinstorAnswer(@Nonnull ApiCallRc answer) {
-        if (answer.isError()) {
-            logger.error(answer.getMessage());
-        } else if (answer.isWarning()) {
-            logger.warn(answer.getMessage());
-        } else if (answer.isInfo()) {
-            logger.info(answer.getMessage());
-        }
-    }
-
-    private void logLinstorAnswers(@Nonnull ApiCallRcList answers) {
-        answers.forEach(this::logLinstorAnswer);
-    }
-
-    private void checkLinstorAnswersThrow(@Nonnull ApiCallRcList answers) {
-        logLinstorAnswers(answers);
-        if (answers.hasError())
-        {
-            String errMsg = answers.stream()
-                .filter(ApiCallRc::isError)
-                .findFirst()
-                .map(ApiCallRc::getMessage).orElse("Unknown linstor error");
-            throw new CloudRuntimeException(errMsg);
-        }
-    }
-
     private String checkLinstorAnswers(@Nonnull ApiCallRcList answers) {
-        logLinstorAnswers(answers);
+        LinstorUtil.logLinstorAnswers(answers);
         return answers.stream().filter(ApiCallRc::isError).findFirst().map(ApiCallRc::getMessage).orElse(null);
     }
 
-    private void applyQoSSettings(StoragePoolVO storagePool, DevelopersApi api, String rscName, Long maxIops)
-        throws ApiException
-    {
-        Long currentQosIops = null;
-        List<VolumeDefinition> vlmDfns = api.volumeDefinitionList(rscName, null, null);
-        if (!vlmDfns.isEmpty())
-        {
-            Properties props = vlmDfns.get(0).getProps();
-            long iops = Long.parseLong(props.getOrDefault("sys/fs/blkio_throttle_write_iops", "0"));
-            currentQosIops = iops > 0 ? iops : null;
-        }
-
-        if (!Objects.equals(maxIops, currentQosIops))
-        {
-            VolumeDefinitionModify vdm = new VolumeDefinitionModify();
-            if (maxIops != null)
-            {
-                Properties props = new Properties();
-                props.put("sys/fs/blkio_throttle_read_iops", "" + maxIops);
-                props.put("sys/fs/blkio_throttle_write_iops", "" + maxIops);
-                vdm.overrideProps(props);
-                logger.info("Apply qos setting: " + maxIops + " to " + rscName);
-            }
-            else
-            {
-                logger.info("Remove QoS setting for " + rscName);
-                vdm.deleteProps(Arrays.asList("sys/fs/blkio_throttle_read_iops", "sys/fs/blkio_throttle_write_iops"));
-            }
-            ApiCallRcList answers = api.volumeDefinitionModify(rscName, 0, vdm);
-            checkLinstorAnswersThrow(answers);
-
-            Long capacityIops = storagePool.getCapacityIops();
-            if (capacityIops != null)
-            {
-                long vcIops = currentQosIops != null ? currentQosIops * -1 : 0;
-                long vMaxIops = maxIops != null ? maxIops : 0;
-                long newIops = vcIops + vMaxIops;
-                capacityIops -= newIops;
-                logger.info(String.format("Current storagepool %s iops capacity:  %d", storagePool, capacityIops));
-                storagePool.setCapacityIops(Math.max(0, capacityIops));
-                _storagePoolDao.update(storagePool.getId(), storagePool);
-            }
-        }
-    }
-
-    private String getRscGrp(StoragePool storagePool) {
-        return storagePool.getUserInfo() != null && !storagePool.getUserInfo().isEmpty() ?
-            storagePool.getUserInfo() : "DfltRscGrp";
-    }
-
-    /**
-     * Returns the layerlist of the resourceGroup with encryption(LUKS) added above STORAGE.
-     * If the resourceGroup layer list already contains LUKS this layer list will be returned.
-     * @param api Linstor developers API
-     * @param resourceGroup Resource group to get the encryption layer list
-     * @return layer list with LUKS added
-     */
-    public List<LayerType> getEncryptedLayerList(DevelopersApi api, String resourceGroup) {
-        try {
-            List<ResourceGroup> rscGrps = api.resourceGroupList(
-                    Collections.singletonList(resourceGroup), Collections.emptyList(), null, null);
-
-            if (CollectionUtils.isEmpty(rscGrps)) {
-                throw new CloudRuntimeException(
-                        String.format("Resource Group %s not found on Linstor cluster.", resourceGroup));
-            }
-
-            final ResourceGroup rscGrp = rscGrps.get(0);
-            List<LayerType> layers = Arrays.asList(LayerType.DRBD, LayerType.LUKS, LayerType.STORAGE);
-            List<String> curLayerStack = rscGrp.getSelectFilter() != null ?
-                    rscGrp.getSelectFilter().getLayerStack() : Collections.emptyList();
-            if (CollectionUtils.isNotEmpty(curLayerStack)) {
-                layers = curLayerStack.stream().map(LayerType::valueOf).collect(Collectors.toList());
-                if (!layers.contains(LayerType.LUKS)) {
-                    layers.add(layers.size() - 1, LayerType.LUKS); // lowest layer is STORAGE
-                }
-            }
-            return layers;
-        } catch (ApiException e) {
-            throw new CloudRuntimeException(
-                    String.format("Resource Group %s not found on Linstor cluster.", resourceGroup));
-        }
-    }
-
-    /**
-     * Spawns a new Linstor resource with the given arguments.
-     * @param api
-     * @param newRscName
-     * @param sizeInBytes
-     * @param isTemplate
-     * @param rscGrpName
-     * @param volName
-     * @param vmName
-     * @throws ApiException
-     */
-    private void spawnResource(
-            DevelopersApi api, String newRscName, long sizeInBytes, boolean isTemplate, String rscGrpName,
-            String volName, String vmName, @Nullable Long passPhraseId, @Nullable byte[] passPhrase) throws ApiException
-    {
-        ResourceGroupSpawn rscGrpSpawn = new ResourceGroupSpawn();
-        rscGrpSpawn.setResourceDefinitionName(newRscName);
-        rscGrpSpawn.addVolumeSizesItem(sizeInBytes / 1024);
-        if (passPhraseId != null) {
-            AutoSelectFilter asf = new AutoSelectFilter();
-            List<LayerType> luksLayers = getEncryptedLayerList(api, rscGrpName);
-            asf.setLayerStack(luksLayers.stream().map(LayerType::toString).collect(Collectors.toList()));
-            rscGrpSpawn.setSelectFilter(asf);
-            if (passPhrase != null) {
-                String utf8Passphrase = new String(passPhrase, StandardCharsets.UTF_8);
-                rscGrpSpawn.setVolumePassphrases(Collections.singletonList(utf8Passphrase));
-            }
-        }
-
-        if (isTemplate) {
-            Properties props = new Properties();
-            props.put(LinstorUtil.getTemplateForAuxPropKey(rscGrpName), "true");
-            rscGrpSpawn.setResourceDefinitionProps(props);
-        }
-
-        logger.info("Linstor: Spawn resource " + newRscName);
-        ApiCallRcList answers = api.resourceGroupSpawn(rscGrpName, rscGrpSpawn);
-        checkLinstorAnswersThrow(answers);
-
-        answers = LinstorUtil.applyAuxProps(api, newRscName, volName, vmName);
-        checkLinstorAnswersThrow(answers);
-    }
-
-    /**
-     * Condition if a template resource can be shared with the given resource group.
-     * @param tgtRscGrp
-     * @param tgtLayerStack
-     * @param rg
-     * @return True if the template resource can be shared, else false.
-     */
-    private boolean canShareTemplateForResourceGroup(
-            ResourceGroup tgtRscGrp, List<String> tgtLayerStack, ResourceGroup rg) {
-        List<String> rgLayerStack = rg.getSelectFilter() != null ?
-                rg.getSelectFilter().getLayerStack() : null;
-        return Objects.equals(tgtLayerStack, rgLayerStack) &&
-                Objects.equals(tgtRscGrp.getSelectFilter().getStoragePoolList(),
-                        rg.getSelectFilter().getStoragePoolList());
-    }
-
-    /**
-     * Searches for a shareable template for this rscGrpName and sets the aux template property.
-     * @param api
-     * @param rscName
-     * @param rscGrpName
-     * @param existingRDs
-     * @return
-     * @throws ApiException
-     */
-    private boolean foundShareableTemplate(
-            DevelopersApi api, String rscName, String rscGrpName,
-            List<Pair<ResourceDefinition, ResourceGroup>> existingRDs) throws ApiException {
-        if (!existingRDs.isEmpty()) {
-            ResourceGroup tgtRscGrp = api.resourceGroupList(
-                    Collections.singletonList(rscGrpName), null, null, null).get(0);
-            List<String> tgtLayerStack = tgtRscGrp.getSelectFilter() != null ?
-                    tgtRscGrp.getSelectFilter().getLayerStack() : null;
-
-            // check if there is already a template copy, that we could reuse
-            // this means if select filters are similar enough to allow cloning from
-            for (Pair<ResourceDefinition, ResourceGroup> rdPair : existingRDs) {
-                ResourceGroup rg = rdPair.second();
-                if (canShareTemplateForResourceGroup(tgtRscGrp, tgtLayerStack, rg)) {
-                    LinstorUtil.setAuxTemplateForProperty(api, rscName, rscGrpName);
-                    return true;
-                }
-            }
-        }
-        return false;
-    }
-
-    /**
-     * Creates a new Linstor resource.
-     * @param rscName
-     * @param sizeInBytes
-     * @param volName
-     * @param vmName
-     * @param api
-     * @param rscGrp
-     * @param poolId
-     * @param isTemplate indicates if the resource is a template
-     * @return true if a new resource was created, false if it already existed or was reused.
-     */
-    private boolean createResourceBase(
-        String rscName, long sizeInBytes, String volName, String vmName,
-        @Nullable Long passPhraseId, @Nullable byte[] passPhrase, DevelopersApi api,
-        String rscGrp, long poolId, boolean isTemplate)
-    {
-        try
-        {
-            logger.debug("createRscBase: {} :: {} :: {}", rscName, rscGrp, isTemplate);
-            List<Pair<ResourceDefinition, ResourceGroup>> existingRDs = LinstorUtil.getRDAndRGListStartingWith(api, rscName);
-
-            String fullRscName = String.format("%s-%d", rscName, poolId);
-            boolean alreadyCreated = existingRDs.stream()
-                    .anyMatch(p -> p.first().getName().equalsIgnoreCase(fullRscName)) ||
-                    existingRDs.stream().anyMatch(p -> p.first().getProps().containsKey(LinstorUtil.getTemplateForAuxPropKey(rscGrp)));
-            if (!alreadyCreated) {
-                boolean createNewRsc = !foundShareableTemplate(api, rscName, rscGrp, existingRDs);
-                if (createNewRsc) {
-                    String newRscName = existingRDs.isEmpty() ? rscName : fullRscName;
-                    spawnResource(api, newRscName, sizeInBytes, isTemplate, rscGrp,
-                            volName, vmName, passPhraseId, passPhrase);
-                }
-                return createNewRsc;
-            }
-            return false;
-        } catch (ApiException apiEx)
-        {
-            logger.error("Linstor: ApiEx - " + apiEx.getMessage());
-            throw new CloudRuntimeException(apiEx.getBestMessage(), apiEx);
-        }
-    }
-
-    private String createResource(VolumeInfo vol, StoragePoolVO storagePoolVO) {
-        DevelopersApi linstorApi = LinstorUtil.getLinstorAPI(storagePoolVO.getHostAddress());
-        final String rscGrp = getRscGrp(storagePoolVO);
-
-        final String rscName = LinstorUtil.RSC_PREFIX + vol.getUuid();
-        createResourceBase(
-            rscName, vol.getSize(), vol.getName(), vol.getAttachedVmName(), vol.getPassphraseId(), vol.getPassphrase(),
-                linstorApi, rscGrp, storagePoolVO.getId(), false);
-
-        try
-        {
-            applyQoSSettings(storagePoolVO, linstorApi, rscName, vol.getMaxIops());
-
-            return LinstorUtil.getDevicePath(linstorApi, rscName);
-        } catch (ApiException apiEx)
-        {
-            logger.error("Linstor: ApiEx - " + apiEx.getMessage());
-            throw new CloudRuntimeException(apiEx.getBestMessage(), apiEx);
-        }
-    }
-
     private void resizeResource(DevelopersApi api, String resourceName, long sizeByte) throws ApiException {
         VolumeDefinitionModify dfm = new VolumeDefinitionModify();
         dfm.setSizeKib(sizeByte / 1024);
@@ -688,13 +415,14 @@ private String cloneResource(long csCloneId, VolumeInfo volumeInfo, StoragePoolV
 
             try {
                 ResourceDefinition templateRD = LinstorUtil.findResourceDefinition(
-                        linstorApi, templateRscName, getRscGrp(storagePoolVO));
+                        linstorApi, templateRscName, LinstorUtil.getRscGrp(storagePoolVO));
                 final String cloneRes = templateRD != null ? templateRD.getName() : templateRscName;
                 logger.info("Clone resource definition {} to {}", cloneRes, rscName);
                 ResourceDefinitionCloneRequest cloneRequest = new ResourceDefinitionCloneRequest();
                 cloneRequest.setName(rscName);
                 if (volumeInfo.getPassphraseId() != null) {
-                    List<LayerType> encryptionLayer = getEncryptedLayerList(linstorApi, getRscGrp(storagePoolVO));
+                    List<LayerType> encryptionLayer = LinstorUtil.getEncryptedLayerList(
+                            linstorApi, LinstorUtil.getRscGrp(storagePoolVO));
                     cloneRequest.setLayerList(encryptionLayer);
                     if (volumeInfo.getPassphrase() != null) {
                         String utf8Passphrase = new String(volumeInfo.getPassphrase(), StandardCharsets.UTF_8);
@@ -704,7 +432,7 @@ private String cloneResource(long csCloneId, VolumeInfo volumeInfo, StoragePoolV
                 ResourceDefinitionCloneStarted cloneStarted = linstorApi.resourceDefinitionClone(
                     cloneRes, cloneRequest);
 
-                checkLinstorAnswersThrow(cloneStarted.getMessages());
+                LinstorUtil.checkLinstorAnswersThrow(cloneStarted.getMessages());
 
                 if (!CloneWaiter.waitFor(linstorApi, cloneStarted)) {
                     throw new CloudRuntimeException("Clone for resource " + rscName + " failed.");
@@ -716,11 +444,12 @@ private String cloneResource(long csCloneId, VolumeInfo volumeInfo, StoragePoolV
                     resizeResource(linstorApi, rscName, volumeInfo.getSize());
                 }
 
-                updateRscGrpIfNecessary(linstorApi, rscName, getRscGrp(storagePoolVO));
+                updateRscGrpIfNecessary(linstorApi, rscName, LinstorUtil.getRscGrp(storagePoolVO));
 
                 deleteTemplateForProps(linstorApi, rscName);
                 LinstorUtil.applyAuxProps(linstorApi, rscName, volumeInfo.getName(), volumeInfo.getAttachedVmName());
-                applyQoSSettings(storagePoolVO, linstorApi, rscName, volumeInfo.getMaxIops());
+                LinstorUtil.applyQoSSettings(
+                        _storagePoolDao, storagePoolVO, linstorApi, rscName, volumeInfo.getMaxIops());
 
                 return LinstorUtil.getDevicePath(linstorApi, rscName);
             } catch (ApiException apiEx) {
@@ -744,7 +473,7 @@ private ResourceDefinitionCreate createResourceDefinitionCreate(String rscName,
     }
 
     private String createResourceFromSnapshot(long csSnapshotId, String rscName, StoragePoolVO storagePoolVO) {
-        final String rscGrp = getRscGrp(storagePoolVO);
+        final String rscGrp = LinstorUtil.getRscGrp(storagePoolVO);
         final DevelopersApi linstorApi = LinstorUtil.getLinstorAPI(storagePoolVO.getHostAddress());
 
         SnapshotVO snapshotVO = _snapshotDao.findById(csSnapshotId);
@@ -757,22 +486,22 @@ private String createResourceFromSnapshot(long csSnapshotId, String rscName, Sto
             logger.debug("Create new resource definition: " + rscName);
             ResourceDefinitionCreate rdCreate = createResourceDefinitionCreate(rscName, rscGrp);
             ApiCallRcList answers = linstorApi.resourceDefinitionCreate(rdCreate);
-            checkLinstorAnswersThrow(answers);
+            LinstorUtil.checkLinstorAnswersThrow(answers);
 
             SnapshotRestore snapshotRestore = new SnapshotRestore();
             snapshotRestore.toResource(rscName);
 
             logger.debug("Create new volume definition for snapshot: " + cloneRes + ":" + snapName);
             answers = linstorApi.resourceSnapshotsRestoreVolumeDefinition(cloneRes, snapName, snapshotRestore);
-            checkLinstorAnswersThrow(answers);
+            LinstorUtil.checkLinstorAnswersThrow(answers);
 
             // restore snapshot to new resource
             logger.info("Restore resource from snapshot: " + cloneRes + ":" + snapName);
             answers = linstorApi.resourceSnapshotRestore(cloneRes, snapName, snapshotRestore);
-            checkLinstorAnswersThrow(answers);
+            LinstorUtil.checkLinstorAnswersThrow(answers);
 
             LinstorUtil.applyAuxProps(linstorApi, rscName, volumeVO.getName(), null);
-            applyQoSSettings(storagePoolVO, linstorApi, rscName, volumeVO.getMaxIops());
+            LinstorUtil.applyQoSSettings(_storagePoolDao, storagePoolVO, linstorApi, rscName, volumeVO.getMaxIops());
 
             return LinstorUtil.getDevicePath(linstorApi, rscName);
         } catch (ApiException apiEx) {
@@ -790,7 +519,7 @@ private String createVolume(VolumeInfo volumeInfo, StoragePoolVO storagePoolVO)
         } else if (csTemplateId > 0) {
             return cloneResource(csTemplateId, volumeInfo, storagePoolVO);
         } else {
-            return createResource(volumeInfo, storagePoolVO);
+            return LinstorUtil.createResource(volumeInfo, storagePoolVO, _storagePoolDao);
         }
     }
 
@@ -1140,7 +869,7 @@ private String restoreResourceFromSnapshot(
             String rscName,
             String snapshotName,
             String restoredName) throws ApiException {
-        final String rscGrp = getRscGrp(storagePoolVO);
+        final String rscGrp = LinstorUtil.getRscGrp(storagePoolVO);
         // try to delete -rst resource, could happen if the copy failed and noone deleted it.
         deleteResourceDefinition(storagePoolVO, restoredName);
         ResourceDefinitionCreate rdc = createResourceDefinitionCreate(restoredName, rscGrp);
@@ -1185,7 +914,7 @@ private Answer copyTemplate(DataObject srcData, DataObject dstData) {
         final StoragePoolVO pool = _storagePoolDao.findById(dstData.getDataStore().getId());
         final DevelopersApi api = LinstorUtil.getLinstorAPI(pool.getHostAddress());
         final String rscName = LinstorUtil.RSC_PREFIX + dstData.getUuid();
-        boolean newCreated = createResourceBase(
+        boolean newCreated = LinstorUtil.createResourceBase(
             LinstorUtil.RSC_PREFIX + dstData.getUuid(),
             tInfo.getSize(),
             tInfo.getName(),
@@ -1193,9 +922,10 @@ private Answer copyTemplate(DataObject srcData, DataObject dstData) {
             null,
             null,
             api,
-            getRscGrp(pool),
+            LinstorUtil.getRscGrp(pool),
             pool.getId(),
-            true);
+            true,
+            false);
 
         Answer answer;
         if (newCreated) {
@@ -1429,7 +1159,7 @@ public void resize(DataObject data, AsyncCompletionCallback<CreateCmdResult> cal
         {
             resizeResource(api, rscName, resizeParameter.newSize);
 
-            applyQoSSettings(pool, api, rscName, resizeParameter.newMaxIops);
+            LinstorUtil.applyQoSSettings(_storagePoolDao, pool, api, rscName, resizeParameter.newMaxIops);
             {
                 final VolumeVO volume = _volumeDao.findById(vol.getId());
                 volume.setMinIops(resizeParameter.newMinIops);
@@ -1534,7 +1264,7 @@ public boolean canProvideStorageStats() {
     @Override
     public Pair<Long, Long> getStorageStats(StoragePool storagePool) {
         logger.debug(String.format("Requesting storage stats: %s", storagePool));
-        return LinstorUtil.getStorageStats(storagePool.getHostAddress(), getRscGrp(storagePool));
+        return LinstorUtil.getStorageStats(storagePool.getHostAddress(), LinstorUtil.getRscGrp(storagePool));
     }
 
     @Override
diff --git a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java
index 4196c12b116d..7c45493dddc4 100644
--- a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java
+++ b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java
@@ -22,6 +22,8 @@
 import com.linbit.linstor.api.DevelopersApi;
 import com.linbit.linstor.api.model.ApiCallRc;
 import com.linbit.linstor.api.model.ApiCallRcList;
+import com.linbit.linstor.api.model.AutoSelectFilter;
+import com.linbit.linstor.api.model.LayerType;
 import com.linbit.linstor.api.model.Node;
 import com.linbit.linstor.api.model.Properties;
 import com.linbit.linstor.api.model.ProviderKind;
@@ -29,24 +31,36 @@
 import com.linbit.linstor.api.model.ResourceDefinition;
 import com.linbit.linstor.api.model.ResourceDefinitionModify;
 import com.linbit.linstor.api.model.ResourceGroup;
+import com.linbit.linstor.api.model.ResourceGroupSpawn;
 import com.linbit.linstor.api.model.ResourceWithVolumes;
 import com.linbit.linstor.api.model.StoragePool;
 import com.linbit.linstor.api.model.Volume;
+import com.linbit.linstor.api.model.VolumeDefinition;
+import com.linbit.linstor.api.model.VolumeDefinitionModify;
 
 import javax.annotation.Nonnull;
+import javax.annotation.Nullable;
 
+import java.util.Arrays;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.Optional;
 import java.util.stream.Collectors;
 
 import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
 import com.cloud.utils.Pair;
 import com.cloud.utils.exception.CloudRuntimeException;
-import org.apache.logging.log4j.Logger;
+import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
+import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.apache.commons.collections.CollectionUtils;
 import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import java.nio.charset.StandardCharsets;
 
 public class LinstorUtil {
     protected static Logger LOGGER = LogManager.getLogger(LinstorUtil.class);
@@ -56,6 +70,8 @@ public class LinstorUtil {
     public static final String RSC_GROUP = "resourceGroup";
     public static final String CS_TEMPLATE_FOR_PREFIX = "_cs-template-for-";
 
+    public static final String LIN_PROP_DRBDOPT_EXACT_SIZE = "DrbdOptions/ExactSize";
+
     public static final String TEMP_VOLUME_ID = "tempVolumeId";
 
     public static final String CLUSTER_DEFAULT_MIN_IOPS = "clusterDefaultMinIops";
@@ -76,6 +92,32 @@ public static String getBestErrorMessage(ApiCallRcList answers) {
                 .orElse((answers.get(0)).getMessage()) : null;
     }
 
+    public static void logLinstorAnswer(@Nonnull ApiCallRc answer) {
+        if (answer.isError()) {
+            LOGGER.error(answer.getMessage());
+        } else if (answer.isWarning()) {
+            LOGGER.warn(answer.getMessage());
+        } else if (answer.isInfo()) {
+            LOGGER.info(answer.getMessage());
+        }
+    }
+
+    public static void logLinstorAnswers(@Nonnull ApiCallRcList answers) {
+        answers.forEach(LinstorUtil::logLinstorAnswer);
+    }
+
+    public static void checkLinstorAnswersThrow(@Nonnull ApiCallRcList answers) {
+        logLinstorAnswers(answers);
+        if (answers.hasError())
+        {
+            String errMsg = answers.stream()
+                    .filter(ApiCallRc::isError)
+                    .findFirst()
+                    .map(ApiCallRc::getMessage).orElse("Unknown linstor error");
+            throw new CloudRuntimeException(errMsg);
+        }
+    }
+
     public static List<String> getLinstorNodeNames(@Nonnull DevelopersApi api) throws ApiException
     {
         List<Node> nodes = api.nodeList(
@@ -488,4 +530,253 @@ public static boolean resourceSupportZeroBlocks(KVMStoragePool pool, String resN
         }
         return false;
     }
+
+    public static String getRscGrp(com.cloud.storage.StoragePool storagePool) {
+        return storagePool.getUserInfo() != null && !storagePool.getUserInfo().isEmpty() ?
+                storagePool.getUserInfo() : "DfltRscGrp";
+    }
+
+    /**
+     * Condition if a template resource can be shared with the given resource group.
+     * @param tgtRscGrp
+     * @param tgtLayerStack
+     * @param rg
+     * @return True if the template resource can be shared, else false.
+     */
+    private static boolean canShareTemplateForResourceGroup(
+            ResourceGroup tgtRscGrp, List<String> tgtLayerStack, ResourceGroup rg) {
+        List<String> rgLayerStack = rg.getSelectFilter() != null ?
+                rg.getSelectFilter().getLayerStack() : null;
+        return Objects.equals(tgtLayerStack, rgLayerStack) &&
+                Objects.equals(tgtRscGrp.getSelectFilter().getStoragePoolList(),
+                        rg.getSelectFilter().getStoragePoolList());
+    }
+
+    /**
+     * Searches for a shareable template for this rscGrpName and sets the aux template property.
+     * @param api
+     * @param rscName
+     * @param rscGrpName
+     * @param existingRDs
+     * @return
+     * @throws ApiException
+     */
+    private static boolean foundShareableTemplate(
+            DevelopersApi api, String rscName, String rscGrpName,
+            List<Pair<ResourceDefinition, ResourceGroup>> existingRDs) throws ApiException {
+        if (!existingRDs.isEmpty()) {
+            ResourceGroup tgtRscGrp = api.resourceGroupList(
+                    Collections.singletonList(rscGrpName), null, null, null).get(0);
+            List<String> tgtLayerStack = tgtRscGrp.getSelectFilter() != null ?
+                    tgtRscGrp.getSelectFilter().getLayerStack() : null;
+
+            // check if there is already a template copy, that we could reuse
+            // this means if select filters are similar enough to allow cloning from
+            for (Pair<ResourceDefinition, ResourceGroup> rdPair : existingRDs) {
+                ResourceGroup rg = rdPair.second();
+                if (canShareTemplateForResourceGroup(tgtRscGrp, tgtLayerStack, rg)) {
+                    LinstorUtil.setAuxTemplateForProperty(api, rscName, rscGrpName);
+                    return true;
+                }
+            }
+        }
+        return false;
+    }
+
+    /**
+     * Returns the layerlist of the resourceGroup with encryption(LUKS) added above STORAGE.
+     * If the resourceGroup layer list already contains LUKS this layer list will be returned.
+     * @param api Linstor developers API
+     * @param resourceGroup Resource group to get the encryption layer list
+     * @return layer list with LUKS added
+     */
+    public static List<LayerType> getEncryptedLayerList(DevelopersApi api, String resourceGroup) {
+        try {
+            List<ResourceGroup> rscGrps = api.resourceGroupList(
+                    Collections.singletonList(resourceGroup), Collections.emptyList(), null, null);
+
+            if (CollectionUtils.isEmpty(rscGrps)) {
+                throw new CloudRuntimeException(
+                        String.format("Resource Group %s not found on Linstor cluster.", resourceGroup));
+            }
+
+            final ResourceGroup rscGrp = rscGrps.get(0);
+            List<LayerType> layers = Arrays.asList(LayerType.DRBD, LayerType.LUKS, LayerType.STORAGE);
+            List<String> curLayerStack = rscGrp.getSelectFilter() != null ?
+                    rscGrp.getSelectFilter().getLayerStack() : Collections.emptyList();
+            if (CollectionUtils.isNotEmpty(curLayerStack)) {
+                layers = curLayerStack.stream().map(LayerType::valueOf).collect(Collectors.toList());
+                if (!layers.contains(LayerType.LUKS)) {
+                    layers.add(layers.size() - 1, LayerType.LUKS); // lowest layer is STORAGE
+                }
+            }
+            return layers;
+        } catch (ApiException e) {
+            throw new CloudRuntimeException(
+                    String.format("Resource Group %s not found on Linstor cluster.", resourceGroup));
+        }
+    }
+
+    /**
+     * Spawns a new Linstor resource with the given arguments.
+     * @param api
+     * @param newRscName
+     * @param sizeInBytes
+     * @param isTemplate
+     * @param rscGrpName
+     * @param volName
+     * @param vmName
+     * @throws ApiException
+     */
+    private static void spawnResource(
+            DevelopersApi api, String newRscName, long sizeInBytes, boolean isTemplate, String rscGrpName,
+            String volName, String vmName, @Nullable Long passPhraseId, @Nullable byte[] passPhrase,
+            boolean exactSize) throws ApiException
+    {
+        ResourceGroupSpawn rscGrpSpawn = new ResourceGroupSpawn();
+        rscGrpSpawn.setResourceDefinitionName(newRscName);
+        rscGrpSpawn.addVolumeSizesItem(sizeInBytes / 1024);
+        if (passPhraseId != null) {
+            AutoSelectFilter asf = new AutoSelectFilter();
+            List<LayerType> luksLayers = getEncryptedLayerList(api, rscGrpName);
+            asf.setLayerStack(luksLayers.stream().map(LayerType::toString).collect(Collectors.toList()));
+            rscGrpSpawn.setSelectFilter(asf);
+            if (passPhrase != null) {
+                String utf8Passphrase = new String(passPhrase, StandardCharsets.UTF_8);
+                rscGrpSpawn.setVolumePassphrases(Collections.singletonList(utf8Passphrase));
+            }
+        }
+
+        Properties props = new Properties();
+        if (isTemplate) {
+            props.put(LinstorUtil.getTemplateForAuxPropKey(rscGrpName), "true");
+        }
+        if (exactSize) {
+            props.put(LIN_PROP_DRBDOPT_EXACT_SIZE, "true");
+        }
+        rscGrpSpawn.setResourceDefinitionProps(props);
+
+        LOGGER.info("Linstor: Spawn resource " + newRscName);
+        ApiCallRcList answers = api.resourceGroupSpawn(rscGrpName, rscGrpSpawn);
+        checkLinstorAnswersThrow(answers);
+
+        answers = LinstorUtil.applyAuxProps(api, newRscName, volName, vmName);
+        checkLinstorAnswersThrow(answers);
+    }
+
+    /**
+     * Creates a new Linstor resource.
+     * @param rscName
+     * @param sizeInBytes
+     * @param volName
+     * @param vmName
+     * @param api
+     * @param rscGrp
+     * @param poolId
+     * @param isTemplate indicates if the resource is a template
+     * @return true if a new resource was created, false if it already existed or was reused.
+     */
+    public static boolean createResourceBase(
+            String rscName, long sizeInBytes, String volName, String vmName,
+            @Nullable Long passPhraseId, @Nullable byte[] passPhrase, DevelopersApi api,
+            String rscGrp, long poolId, boolean isTemplate, boolean exactSize)
+    {
+        try
+        {
+            LOGGER.debug("createRscBase: {} :: {} :: {} :: {}", rscName, rscGrp, isTemplate, exactSize);
+            List<Pair<ResourceDefinition, ResourceGroup>> existingRDs = LinstorUtil.getRDAndRGListStartingWith(api, rscName);
+
+            String fullRscName = String.format("%s-%d", rscName, poolId);
+            boolean alreadyCreated = existingRDs.stream()
+                    .anyMatch(p -> p.first().getName().equalsIgnoreCase(fullRscName)) ||
+                    existingRDs.stream().anyMatch(p -> p.first().getProps().containsKey(LinstorUtil.getTemplateForAuxPropKey(rscGrp)));
+            if (!alreadyCreated) {
+                boolean createNewRsc = !foundShareableTemplate(api, rscName, rscGrp, existingRDs);
+                if (createNewRsc) {
+                    String newRscName = existingRDs.isEmpty() ? rscName : fullRscName;
+                    spawnResource(api, newRscName, sizeInBytes, isTemplate, rscGrp,
+                            volName, vmName, passPhraseId, passPhrase, exactSize);
+                }
+                return createNewRsc;
+            }
+            return false;
+        } catch (ApiException apiEx)
+        {
+            LOGGER.error("Linstor: ApiEx - {}", apiEx.getMessage());
+            throw new CloudRuntimeException(apiEx.getBestMessage(), apiEx);
+        }
+    }
+
+    public static void applyQoSSettings(PrimaryDataStoreDao primaryDataStoreDao,
+                                  StoragePoolVO storagePool, DevelopersApi api, String rscName, Long maxIops)
+            throws ApiException
+    {
+        Long currentQosIops = null;
+        List<VolumeDefinition> vlmDfns = api.volumeDefinitionList(rscName, null, null);
+        if (!vlmDfns.isEmpty())
+        {
+            Properties props = vlmDfns.get(0).getProps();
+            long iops = Long.parseLong(props.getOrDefault("sys/fs/blkio_throttle_write_iops", "0"));
+            currentQosIops = iops > 0 ? iops : null;
+        }
+
+        if (!Objects.equals(maxIops, currentQosIops))
+        {
+            VolumeDefinitionModify vdm = new VolumeDefinitionModify();
+            if (maxIops != null)
+            {
+                Properties props = new Properties();
+                props.put("sys/fs/blkio_throttle_read_iops", "" + maxIops);
+                props.put("sys/fs/blkio_throttle_write_iops", "" + maxIops);
+                vdm.overrideProps(props);
+                LOGGER.info("Apply qos setting: {} to {}", maxIops, rscName);
+            }
+            else
+            {
+                LOGGER.info("Remove QoS setting for {}", rscName);
+                vdm.deleteProps(Arrays.asList("sys/fs/blkio_throttle_read_iops", "sys/fs/blkio_throttle_write_iops"));
+            }
+            ApiCallRcList answers = api.volumeDefinitionModify(rscName, 0, vdm);
+            LinstorUtil.checkLinstorAnswersThrow(answers);
+
+            Long capacityIops = storagePool.getCapacityIops();
+            if (capacityIops != null)
+            {
+                long vcIops = currentQosIops != null ? currentQosIops * -1 : 0;
+                long vMaxIops = maxIops != null ? maxIops : 0;
+                long newIops = vcIops + vMaxIops;
+                capacityIops -= newIops;
+                LOGGER.info("Current storagepool {} iops capacity:  {}", storagePool, capacityIops);
+                storagePool.setCapacityIops(Math.max(0, capacityIops));
+                primaryDataStoreDao.update(storagePool.getId(), storagePool);
+            }
+        }
+    }
+
+    public static String createResource(VolumeInfo vol, StoragePoolVO storagePoolVO,
+                                        PrimaryDataStoreDao primaryDataStoreDao) {
+        return createResource(vol, storagePoolVO, primaryDataStoreDao, false);
+    }
+
+    public static String createResource(VolumeInfo vol, StoragePoolVO storagePoolVO,
+                                        PrimaryDataStoreDao primaryDataStoreDao, boolean exactSize) {
+        DevelopersApi linstorApi = LinstorUtil.getLinstorAPI(storagePoolVO.getHostAddress());
+        final String rscGrp = getRscGrp(storagePoolVO);
+
+        final String rscName = LinstorUtil.RSC_PREFIX + vol.getUuid();
+        createResourceBase(
+                rscName, vol.getSize(), vol.getName(), vol.getAttachedVmName(), vol.getPassphraseId(), vol.getPassphrase(),
+                linstorApi, rscGrp, storagePoolVO.getId(), false, exactSize);
+
+        try
+        {
+            applyQoSSettings(primaryDataStoreDao, storagePoolVO, linstorApi, rscName, vol.getMaxIops());
+
+            return LinstorUtil.getDevicePath(linstorApi, rscName);
+        } catch (ApiException apiEx)
+        {
+            LOGGER.error("Linstor: ApiEx - " + apiEx.getMessage());
+            throw new CloudRuntimeException(apiEx.getBestMessage(), apiEx);
+        }
+    }
 }
diff --git a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/motion/LinstorDataMotionStrategy.java b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/motion/LinstorDataMotionStrategy.java
new file mode 100644
index 000000000000..cab2820f09ae
--- /dev/null
+++ b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/motion/LinstorDataMotionStrategy.java
@@ -0,0 +1,437 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.cloudstack.storage.motion;
+
+import com.linbit.linstor.api.ApiException;
+import com.linbit.linstor.api.DevelopersApi;
+import com.linbit.linstor.api.model.ApiCallRcList;
+import com.linbit.linstor.api.model.ResourceDefinition;
+import com.linbit.linstor.api.model.ResourceDefinitionModify;
+
+import javax.inject.Inject;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import com.cloud.agent.AgentManager;
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.MigrateAnswer;
+import com.cloud.agent.api.MigrateCommand;
+import com.cloud.agent.api.PrepareForMigrationCommand;
+import com.cloud.agent.api.to.DataObjectType;
+import com.cloud.agent.api.to.VirtualMachineTO;
+import com.cloud.exception.AgentUnavailableException;
+import com.cloud.exception.OperationTimedoutException;
+import com.cloud.host.Host;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.storage.Storage;
+import com.cloud.storage.StorageManager;
+import com.cloud.storage.Volume;
+import com.cloud.storage.VolumeVO;
+import com.cloud.storage.dao.GuestOSCategoryDao;
+import com.cloud.storage.dao.GuestOSDao;
+import com.cloud.storage.dao.SnapshotDao;
+import com.cloud.storage.dao.VolumeDao;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.vm.VMInstanceVO;
+import com.cloud.vm.dao.VMInstanceDao;
+import org.apache.cloudstack.engine.subsystem.api.storage.CopyCommandResult;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataMotionStrategy;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataObject;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
+import org.apache.cloudstack.engine.subsystem.api.storage.ObjectInDataStoreStateMachine;
+import org.apache.cloudstack.engine.subsystem.api.storage.StrategyPriority;
+import org.apache.cloudstack.engine.subsystem.api.storage.VolumeDataFactory;
+import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
+import org.apache.cloudstack.engine.subsystem.api.storage.VolumeService;
+import org.apache.cloudstack.framework.async.AsyncCallFuture;
+import org.apache.cloudstack.framework.async.AsyncCompletionCallback;
+import org.apache.cloudstack.storage.command.CopyCmdAnswer;
+import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.apache.cloudstack.storage.datastore.util.LinstorUtil;
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.collections.MapUtils;
+import org.apache.commons.lang3.ObjectUtils;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.springframework.stereotype.Component;
+
+
+/**
+ * Current state:
+ *   just changing the resource-group on same storage pool resource-group is not really good enough.
+ *   Linstor lacks currently of a good way to move resources to another resource-group and respecting
+ *   every auto-filter setting.
+ *   Also linstor clone would simply set the new resource-group without any adjustments of storage pools or
+ *   auto-select resource placement.
+ *   So currently, we will create a new resource in the wanted primary storage and let qemu copy the data into the
+ *   devices.
+ */
+
+@Component
+public class LinstorDataMotionStrategy implements DataMotionStrategy {
+    protected Logger logger = LogManager.getLogger(getClass());
+
+    @Inject
+    private SnapshotDataStoreDao _snapshotStoreDao;
+    @Inject
+    private PrimaryDataStoreDao _storagePool;
+    @Inject
+    private VolumeDao _volumeDao;
+    @Inject
+    private VolumeDataFactory _volumeDataFactory;
+    @Inject
+    private VMInstanceDao _vmDao;
+    @Inject
+    private GuestOSDao _guestOsDao;
+    @Inject
+    private VolumeService _volumeService;
+    @Inject
+    private GuestOSCategoryDao _guestOsCategoryDao;
+    @Inject
+    private SnapshotDao _snapshotDao;
+    @Inject
+    private AgentManager _agentManager;
+    @Inject
+    private PrimaryDataStoreDao _storagePoolDao;
+
+    @Override
+    public StrategyPriority canHandle(DataObject srcData, DataObject dstData) {
+        DataObjectType srcType = srcData.getType();
+        DataObjectType dstType = dstData.getType();
+        logger.debug("canHandle: {} -> {}", srcType, dstType);
+        return StrategyPriority.CANT_HANDLE;
+    }
+
+    @Override
+    public void copyAsync(DataObject srcData, DataObject destData, Host destHost,
+            AsyncCompletionCallback<CopyCommandResult> callback) {
+        throw new CloudRuntimeException("not implemented");
+    }
+
+    private boolean isDestinationLinstorPrimaryStorage(Map<VolumeInfo, DataStore> volumeMap) {
+        if (MapUtils.isNotEmpty(volumeMap)) {
+            for (DataStore dataStore : volumeMap.values()) {
+                StoragePoolVO storagePoolVO = _storagePool.findById(dataStore.getId());
+                if (storagePoolVO == null
+                        || !storagePoolVO.getStorageProviderName().equals(LinstorUtil.PROVIDER_NAME)) {
+                    return false;
+                }
+            }
+        } else {
+            return false;
+        }
+        return true;
+    }
+
+    @Override
+    public StrategyPriority canHandle(Map<VolumeInfo, DataStore> volumeMap, Host srcHost, Host destHost) {
+        logger.debug("canHandle -- {}: {} -> {}", volumeMap, srcHost, destHost);
+        if (srcHost.getId() != destHost.getId() && isDestinationLinstorPrimaryStorage(volumeMap)) {
+            return StrategyPriority.HIGHEST;
+        }
+        return StrategyPriority.CANT_HANDLE;
+    }
+
+    private VolumeVO createNewVolumeVO(Volume volume, StoragePoolVO storagePoolVO) {
+        VolumeVO newVol = new VolumeVO(volume);
+        newVol.setInstanceId(null);
+        newVol.setChainInfo(null);
+        newVol.setPath(newVol.getUuid());
+        newVol.setFolder(null);
+        newVol.setPodId(storagePoolVO.getPodId());
+        newVol.setPoolId(storagePoolVO.getId());
+        newVol.setLastPoolId(volume.getPoolId());
+
+        return _volumeDao.persist(newVol);
+    }
+
+    private void removeExactSizeProperty(VolumeInfo volumeInfo) {
+        StoragePoolVO destStoragePool = _storagePool.findById(volumeInfo.getDataStore().getId());
+        DevelopersApi api = LinstorUtil.getLinstorAPI(destStoragePool.getHostAddress());
+
+        ResourceDefinitionModify rdm = new ResourceDefinitionModify();
+        rdm.setDeleteProps(Collections.singletonList(LinstorUtil.LIN_PROP_DRBDOPT_EXACT_SIZE));
+        try {
+            String rscName = LinstorUtil.RSC_PREFIX + volumeInfo.getPath();
+            ApiCallRcList answers = api.resourceDefinitionModify(rscName, rdm);
+            LinstorUtil.checkLinstorAnswersThrow(answers);
+        } catch (ApiException apiEx) {
+            logger.error("Linstor: ApiEx - {}", apiEx.getMessage());
+            throw new CloudRuntimeException(apiEx.getBestMessage(), apiEx);
+        }
+    }
+
+    private void handlePostMigration(boolean success, Map<VolumeInfo, VolumeInfo> srcVolumeInfoToDestVolumeInfo,
+                                     VirtualMachineTO vmTO, Host destHost) {
+        if (!success) {
+            try {
+                PrepareForMigrationCommand pfmc = new PrepareForMigrationCommand(vmTO);
+
+                pfmc.setRollback(true);
+
+                Answer pfma = _agentManager.send(destHost.getId(), pfmc);
+
+                if (pfma == null || !pfma.getResult()) {
+                    String details = pfma != null ? pfma.getDetails() : "null answer returned";
+                    String msg = "Unable to rollback prepare for migration due to the following: " + details;
+
+                    throw new AgentUnavailableException(msg, destHost.getId());
+                }
+            } catch (Exception e) {
+                logger.debug("Failed to disconnect one or more (original) dest volumes", e);
+            }
+        }
+
+        for (Map.Entry<VolumeInfo, VolumeInfo> entry : srcVolumeInfoToDestVolumeInfo.entrySet()) {
+            VolumeInfo srcVolumeInfo = entry.getKey();
+            VolumeInfo destVolumeInfo = entry.getValue();
+
+            if (success) {
+                srcVolumeInfo.processEvent(ObjectInDataStoreStateMachine.Event.OperationSucceeded);
+                destVolumeInfo.processEvent(ObjectInDataStoreStateMachine.Event.OperationSucceeded);
+
+                _volumeDao.updateUuid(srcVolumeInfo.getId(), destVolumeInfo.getId());
+
+                VolumeVO volumeVO = _volumeDao.findById(destVolumeInfo.getId());
+
+                volumeVO.setFormat(Storage.ImageFormat.QCOW2);
+
+                _volumeDao.update(volumeVO.getId(), volumeVO);
+
+                // remove exact size property
+                removeExactSizeProperty(destVolumeInfo);
+
+                try {
+                    _volumeService.destroyVolume(srcVolumeInfo.getId());
+
+                    srcVolumeInfo = _volumeDataFactory.getVolume(srcVolumeInfo.getId());
+
+                    AsyncCallFuture<VolumeService.VolumeApiResult> destroyFuture =
+                            _volumeService.expungeVolumeAsync(srcVolumeInfo);
+
+                    if (destroyFuture.get().isFailed()) {
+                        logger.debug("Failed to clean up source volume on storage");
+                    }
+                } catch (Exception e) {
+                    logger.debug("Failed to clean up source volume on storage", e);
+                }
+
+                // Update the volume ID for snapshots on secondary storage
+                if (!_snapshotDao.listByVolumeId(srcVolumeInfo.getId()).isEmpty()) {
+                    _snapshotDao.updateVolumeIds(srcVolumeInfo.getId(), destVolumeInfo.getId());
+                    _snapshotStoreDao.updateVolumeIds(srcVolumeInfo.getId(), destVolumeInfo.getId());
+                }
+            } else {
+                try {
+                    _volumeService.revokeAccess(destVolumeInfo, destHost, destVolumeInfo.getDataStore());
+                } catch (Exception e) {
+                    logger.debug("Failed to revoke access from dest volume", e);
+                }
+
+                destVolumeInfo.processEvent(ObjectInDataStoreStateMachine.Event.OperationFailed);
+                srcVolumeInfo.processEvent(ObjectInDataStoreStateMachine.Event.OperationFailed);
+
+                try {
+                    _volumeService.destroyVolume(destVolumeInfo.getId());
+
+                    destVolumeInfo = _volumeDataFactory.getVolume(destVolumeInfo.getId());
+
+                    AsyncCallFuture<VolumeService.VolumeApiResult> destroyFuture =
+                            _volumeService.expungeVolumeAsync(destVolumeInfo);
+
+                    if (destroyFuture.get().isFailed()) {
+                        logger.debug("Failed to clean up dest volume on storage");
+                    }
+                } catch (Exception e) {
+                    logger.debug("Failed to clean up dest volume on storage", e);
+                }
+            }
+        }
+    }
+
+    /**
+     * Determines whether the destination volume should have the DRBD exact-size property set
+     * during migration.
+     *
+     * <p>This method queries the Linstor API to check if the source volume's resource definition
+     * has the exact-size DRBD option enabled. The exact-size property ensures that DRBD uses
+     * the precise volume size rather than rounding, which is important for maintaining size
+     * consistency during migrations.</p>
+     *
+     * @param srcVolumeInfo the source volume information to check
+     * @return {@code true} if the exact-size property should be set on the destination volume,
+     *         which occurs when the source volume has this property enabled, or when the
+     *         property cannot be determined (defaults to {@code true} for safety);
+     *         {@code false} only when the source is confirmed to not have the exact-size property
+     */
+    private boolean needsExactSizeProp(VolumeInfo srcVolumeInfo) {
+        StoragePoolVO srcStoragePool = _storagePool.findById(srcVolumeInfo.getDataStore().getId());
+        if (srcStoragePool.getPoolType() == Storage.StoragePoolType.Linstor) {
+            DevelopersApi api = LinstorUtil.getLinstorAPI(srcStoragePool.getHostAddress());
+
+            String rscName = LinstorUtil.RSC_PREFIX + srcVolumeInfo.getPath();
+            try {
+                List<ResourceDefinition> rscDfns = api.resourceDefinitionList(
+                        Collections.singletonList(rscName),
+                        false,
+                        Collections.emptyList(),
+                        null,
+                        null);
+                if (!CollectionUtils.isEmpty(rscDfns)) {
+                    ResourceDefinition srcRsc = rscDfns.get(0);
+                    String exactSizeProp = srcRsc.getProps().get(LinstorUtil.LIN_PROP_DRBDOPT_EXACT_SIZE);
+                    return "true".equalsIgnoreCase(exactSizeProp);
+                } else {
+                    logger.warn("Unknown resource {} on {}", rscName, srcStoragePool.getHostAddress());
+                }
+            } catch (ApiException apiEx) {
+                logger.error("Unable to fetch resource definition {}: {}", rscName, apiEx.getBestMessage());
+            }
+        }
+        return true;
+    }
+
+    @Override
+    public void copyAsync(Map<VolumeInfo, DataStore> volumeDataStoreMap, VirtualMachineTO vmTO, Host srcHost,
+            Host destHost, AsyncCompletionCallback<CopyCommandResult> callback) {
+
+        if (srcHost.getHypervisorType() != Hypervisor.HypervisorType.KVM) {
+            throw new CloudRuntimeException(
+                    String.format("Invalid hypervisor type [%s]. Only KVM supported", srcHost.getHypervisorType()));
+        }
+
+        String errMsg = null;
+        VMInstanceVO vmInstance = _vmDao.findById(vmTO.getId());
+        vmTO.setState(vmInstance.getState());
+        List<MigrateCommand.MigrateDiskInfo> migrateDiskInfoList = new ArrayList<>();
+
+        Map<String, MigrateCommand.MigrateDiskInfo> migrateStorage = new HashMap<>();
+        Map<VolumeInfo, VolumeInfo> srcVolumeInfoToDestVolumeInfo = new HashMap<>();
+
+        try {
+            for (Map.Entry<VolumeInfo, DataStore> entry : volumeDataStoreMap.entrySet()) {
+                VolumeInfo srcVolumeInfo = entry.getKey();
+                DataStore destDataStore = entry.getValue();
+                VolumeVO srcVolume = _volumeDao.findById(srcVolumeInfo.getId());
+                StoragePoolVO destStoragePool = _storagePool.findById(destDataStore.getId());
+
+                if (srcVolumeInfo.getPassphraseId() != null) {
+                    throw new CloudRuntimeException(
+                            String.format("Cannot live migrate encrypted volume: %s", srcVolumeInfo.getVolume()));
+                }
+
+                VolumeVO destVolume = createNewVolumeVO(srcVolume, destStoragePool);
+
+                VolumeInfo destVolumeInfo = _volumeDataFactory.getVolume(destVolume.getId(), destDataStore);
+
+                destVolumeInfo.processEvent(ObjectInDataStoreStateMachine.Event.MigrationCopyRequested);
+                destVolumeInfo.processEvent(ObjectInDataStoreStateMachine.Event.MigrationCopySucceeded);
+                destVolumeInfo.processEvent(ObjectInDataStoreStateMachine.Event.MigrationRequested);
+
+                boolean exactSize = needsExactSizeProp(srcVolumeInfo);
+
+                String devPath = LinstorUtil.createResource(
+                        destVolumeInfo, destStoragePool, _storagePoolDao, exactSize);
+
+                _volumeDao.update(destVolume.getId(), destVolume);
+                destVolume = _volumeDao.findById(destVolume.getId());
+
+                destVolumeInfo = _volumeDataFactory.getVolume(destVolume.getId(), destDataStore);
+
+                MigrateCommand.MigrateDiskInfo migrateDiskInfo = new MigrateCommand.MigrateDiskInfo(
+                        srcVolumeInfo.getPath(),
+                        MigrateCommand.MigrateDiskInfo.DiskType.BLOCK,
+                        MigrateCommand.MigrateDiskInfo.DriverType.RAW,
+                        MigrateCommand.MigrateDiskInfo.Source.DEV,
+                        devPath);
+                migrateDiskInfoList.add(migrateDiskInfo);
+
+                migrateStorage.put(srcVolumeInfo.getPath(), migrateDiskInfo);
+
+                srcVolumeInfoToDestVolumeInfo.put(srcVolumeInfo, destVolumeInfo);
+            }
+
+            PrepareForMigrationCommand pfmc = new PrepareForMigrationCommand(vmTO);
+            try {
+                Answer pfma = _agentManager.send(destHost.getId(), pfmc);
+
+                if (pfma == null || !pfma.getResult()) {
+                    String details = pfma != null ? pfma.getDetails() : "null answer returned";
+                    errMsg = String.format("Unable to prepare for migration due to the following: %s", details);
+
+                    throw new AgentUnavailableException(errMsg, destHost.getId());
+                }
+            } catch (final OperationTimedoutException e) {
+                errMsg = String.format("Operation timed out due to %s", e.getMessage());
+                throw new AgentUnavailableException(errMsg, destHost.getId());
+            }
+
+            VMInstanceVO vm = _vmDao.findById(vmTO.getId());
+            boolean isWindows = _guestOsCategoryDao.findById(_guestOsDao.findById(vm.getGuestOSId()).getCategoryId())
+                    .getName().equalsIgnoreCase("Windows");
+
+            MigrateCommand migrateCommand = new MigrateCommand(vmTO.getName(),
+                    destHost.getPrivateIpAddress(), isWindows, vmTO, true);
+            migrateCommand.setWait(StorageManager.KvmStorageOnlineMigrationWait.value());
+            migrateCommand.setMigrateStorage(migrateStorage);
+            migrateCommand.setMigrateStorageManaged(true);
+            migrateCommand.setNewVmCpuShares(
+                    vmTO.getCpus() * ObjectUtils.defaultIfNull(vmTO.getMinSpeed(), vmTO.getSpeed()));
+            migrateCommand.setMigrateDiskInfoList(migrateDiskInfoList);
+
+            boolean kvmAutoConvergence = StorageManager.KvmAutoConvergence.value();
+            migrateCommand.setAutoConvergence(kvmAutoConvergence);
+
+            MigrateAnswer migrateAnswer = (MigrateAnswer) _agentManager.send(srcHost.getId(), migrateCommand);
+            boolean success = migrateAnswer != null && migrateAnswer.getResult();
+
+            handlePostMigration(success, srcVolumeInfoToDestVolumeInfo, vmTO, destHost);
+
+            if (migrateAnswer == null) {
+                throw new CloudRuntimeException("Unable to get an answer to the migrate command");
+            }
+
+            if (!migrateAnswer.getResult()) {
+                errMsg = migrateAnswer.getDetails();
+
+                throw new CloudRuntimeException(errMsg);
+            }
+        } catch (AgentUnavailableException | OperationTimedoutException | CloudRuntimeException ex) {
+            errMsg = String.format(
+                    "Copy volume(s) of VM [%s] to storage(s) [%s] and VM to host [%s] failed in LinstorDataMotionStrategy.copyAsync. Error message: [%s].",
+                    vmTO, srcHost, destHost, ex.getMessage());
+            logger.error(errMsg, ex);
+
+            throw new CloudRuntimeException(errMsg);
+        } finally {
+            CopyCmdAnswer copyCmdAnswer = new CopyCmdAnswer(errMsg);
+
+            CopyCommandResult result = new CopyCommandResult(null, copyCmdAnswer);
+            result.setResult(errMsg);
+            callback.complete(result);
+        }
+    }
+}
diff --git a/plugins/storage/volume/linstor/src/main/resources/META-INF/cloudstack/storage-volume-linstor/spring-storage-volume-linstor-context.xml b/plugins/storage/volume/linstor/src/main/resources/META-INF/cloudstack/storage-volume-linstor/spring-storage-volume-linstor-context.xml
index a900323ede53..88d1051c71e4 100644
--- a/plugins/storage/volume/linstor/src/main/resources/META-INF/cloudstack/storage-volume-linstor/spring-storage-volume-linstor-context.xml
+++ b/plugins/storage/volume/linstor/src/main/resources/META-INF/cloudstack/storage-volume-linstor/spring-storage-volume-linstor-context.xml
@@ -33,4 +33,6 @@
           class="org.apache.cloudstack.storage.snapshot.LinstorVMSnapshotStrategy" />
     <bean id="linstorConfigManager"
           class="org.apache.cloudstack.storage.datastore.util.LinstorConfigurationManager" />
+    <bean id="linstorDataMotionStrategy"
+          class="org.apache.cloudstack.storage.motion.LinstorDataMotionStrategy" />
 </beans>
diff --git a/plugins/storage/volume/linstor/src/test/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImplTest.java b/plugins/storage/volume/linstor/src/test/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImplTest.java
index 75276739468b..4653cfa358b0 100644
--- a/plugins/storage/volume/linstor/src/test/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImplTest.java
+++ b/plugins/storage/volume/linstor/src/test/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImplTest.java
@@ -26,6 +26,7 @@
 import java.util.Collections;
 import java.util.List;
 
+import org.apache.cloudstack.storage.datastore.util.LinstorUtil;
 import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;
@@ -75,13 +76,13 @@ public void testGetEncryptedLayerList() throws ApiException  {
         when(api.resourceGroupList(Collections.singletonList("EncryptedGrp"), Collections.emptyList(), null, null))
                 .thenReturn(Collections.singletonList(encryptedGrp));
 
-        List<LayerType> layers = linstorPrimaryDataStoreDriver.getEncryptedLayerList(api, "DfltRscGrp");
+        List<LayerType> layers = LinstorUtil.getEncryptedLayerList(api, "DfltRscGrp");
         Assert.assertEquals(Arrays.asList(LayerType.DRBD, LayerType.LUKS, LayerType.STORAGE), layers);
 
-        layers = linstorPrimaryDataStoreDriver.getEncryptedLayerList(api, "BcacheGrp");
+        layers = LinstorUtil.getEncryptedLayerList(api, "BcacheGrp");
         Assert.assertEquals(Arrays.asList(LayerType.DRBD, LayerType.BCACHE, LayerType.LUKS, LayerType.STORAGE), layers);
 
-        layers = linstorPrimaryDataStoreDriver.getEncryptedLayerList(api, "EncryptedGrp");
+        layers = LinstorUtil.getEncryptedLayerList(api, "EncryptedGrp");
         Assert.assertEquals(Arrays.asList(LayerType.DRBD, LayerType.LUKS, LayerType.STORAGE), layers);
     }
 }

From 3ba5c2b610f1a13cae612462720ffaf624b76501 Mon Sep 17 00:00:00 2001
From: Andrija Panic <45762285+andrijapanicsb@users.noreply.github.com>
Date: Thu, 29 Jan 2026 11:27:46 +0100
Subject: [PATCH 092/117] Fix logs mismatch between Network GC wait and
 interval (#10776)

Co-authored-by: nvazquez <nicovazquez90@gmail.com>
Co-authored-by: dahn <daan@onecht.net>
Co-authored-by: Wei Zhou <weizhou@apache.org>
---
 .../engine/orchestration/NetworkOrchestrator.java        | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java
index d19a4f1d4a00..899ce51022ba 100644
--- a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java
+++ b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java
@@ -3559,8 +3559,9 @@ public void reallyRun() {
                 final HashMap<Long, Long> stillFree = new HashMap<Long, Long>();
 
                 final List<Long> networkIds = _networksDao.findNetworksToGarbageCollect();
-                final int netGcWait = NumbersUtil.parseInt(_configDao.getValue(NetworkGcWait.key()), 60);
-                logger.info("NetworkGarbageCollector uses '{}' seconds for GC interval.", netGcWait);
+                final int netGcWait = NetworkGcWait.value();
+                final int netGcInterval = NetworkGcInterval.value();
+                logger.info("NetworkGarbageCollector uses '{}' seconds for GC wait and '{}' seconds for GC interval.", netGcWait, netGcInterval);
 
                 for (final Long networkId : networkIds) {
                     if (!_networkModel.isNetworkReadyForGc(networkId)) {
@@ -4882,9 +4883,9 @@ public String getConfigComponentName() {
     }
 
     public static final ConfigKey<Integer> NetworkGcWait = new ConfigKey<Integer>(Integer.class, "network.gc.wait", "Advanced", "600",
-            "Time (in seconds) to wait before shutting down a network that's not in used", false, Scope.Global, null);
+            "Time (in seconds) to wait before shutting down a network that's not in used", true, Scope.Global, null);
     public static final ConfigKey<Integer> NetworkGcInterval = new ConfigKey<Integer>(Integer.class, "network.gc.interval", "Advanced", "600",
-            "Seconds to wait before checking for networks to shutdown", true, Scope.Global, null);
+            "Seconds to wait before checking for networks to shutdown", false, Scope.Global, null);
 
     @Override
     public ConfigKey<?>[] getConfigKeys() {

From 0b62fb5e20c27116f11bd8af72255b45d5703c02 Mon Sep 17 00:00:00 2001
From: Manoj Kumar <manojkr.itbhu@gmail.com>
Date: Thu, 29 Jan 2026 16:06:19 +0530
Subject: [PATCH 093/117] Add cloud image downloader script (#11918)

---
 tools/utils/cloud-image-downloader.sh | 259 ++++++++++++++++++++++++++
 1 file changed, 259 insertions(+)
 create mode 100755 tools/utils/cloud-image-downloader.sh

diff --git a/tools/utils/cloud-image-downloader.sh b/tools/utils/cloud-image-downloader.sh
new file mode 100755
index 000000000000..90f234906e1a
--- /dev/null
+++ b/tools/utils/cloud-image-downloader.sh
@@ -0,0 +1,259 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+#-------------------------------------------------------------------------------
+# Configuration
+#-------------------------------------------------------------------------------
+# This section contains the variables you might want to change.
+
+# The temporary directory where files will be downloaded.
+# It's a good practice to create a unique temporary directory for each script run.
+TEMP_DIR=$(mktemp -d)
+
+# The BASE destination directory for the downloaded image files.
+# Subdirectories for each distro will be created inside this one.
+# Make sure this directory exists before running the script.
+# Must be executed by the cloudstack user on machine hosting the public download site.
+# It will be publicly available at https://download.cloudstack.org/templates/cloud-images/
+DEST_DIR="${HOME}/repository/templates/cloud-images"
+
+# The directory where log files will be stored.
+# Make sure this directory exists.
+LOG_DIR="${HOME}/log/cloud-image-downloader"
+LOG_FILE="${LOG_DIR}/cloud-image-downloader_$(date +%Y%m%d_%H%M%S).log"
+LOG_RETENTION_DAYS=30
+
+LOGGER_TAG="cloud-image-downloader"
+LOGGER_FACILITY="user"
+LOGGER_AVAILABLE=false
+
+log_message() {
+    local priority=$1
+    shift
+    local message="$*"
+    local timestamp=$(date +'%Y-%m-%d %H:%M:%S')
+
+    # Log to file
+    echo "${timestamp} [${priority}] ${message}" | tee -a "${LOG_FILE}"
+
+    # Log to syslog using logger utility
+    if [ "${LOGGER_AVAILABLE}" = true ]; then
+        logger -t "${LOGGER_TAG}" -p "${LOGGER_FACILITY}.${priority}" -- "${message}"
+    fi
+}
+
+log_info() {
+    log_message "info" "$@"
+}
+
+log_warn() {
+    log_message "warning" "$@"
+}
+
+log_error() {
+    log_message "err" "$@"
+}
+
+cleanup_old_logs() {
+    log_info "Cleaning up log files older than ${LOG_RETENTION_DAYS} days..."
+
+    if [ ! -d "$LOG_DIR" ]; then
+        log_warn "Log directory does not exist: $LOG_DIR"
+        return
+    fi
+
+    local deleted_count=0
+
+    # Find and delete log files older than retention period
+    while IFS= read -r -d '' log_file; do
+        rm -f "$log_file"
+        deleted_count=$((deleted_count + 1))
+    done < <(find "$LOG_DIR" -name "*.log" -type f -mtime +${LOG_RETENTION_DAYS} -print0 2>/dev/null)
+
+    if [ $deleted_count -gt 0 ]; then
+        log_info "Deleted $deleted_count old log file(s)"
+    else
+        log_info "No old log files to delete"
+    fi
+}
+
+#-------------------------------------------------------------------------------
+# Image Definitions
+#-------------------------------------------------------------------------------
+# To add a new image, you must add an entry to BOTH arrays below.
+
+# 1. Add the destination filename and the download URL.
+declare -A IMAGE_URLS=(
+    ["Rocky-9-GenericCloud.latest.x86_64.qcow2"]="https://dl.rockylinux.org/pub/rocky/9/images/x86_64/Rocky-9-GenericCloud.latest.x86_64.qcow2"
+    ["Rocky-9-GenericCloud.latest.aarch64.qcow2"]="https://dl.rockylinux.org/pub/rocky/9/images/aarch64/Rocky-9-GenericCloud.latest.aarch64.qcow2"
+    ["Rocky-8-GenericCloud.latest.x86_64.qcow2"]="https://dl.rockylinux.org/pub/rocky/8/images/x86_64/Rocky-8-GenericCloud.latest.x86_64.qcow2"
+    ["Rocky-8-GenericCloud.latest.aarch64.qcow2"]="https://dl.rockylinux.org/pub/rocky/8/images/aarch64/Rocky-8-GenericCloud.latest.aarch64.qcow2"
+    ["openSUSE-Leap-15.5-Minimal-VM.x86_64-Cloud.qcow2"]="https://download.opensuse.org/distribution/leap/15.5/appliances/openSUSE-Leap-15.5-Minimal-VM.x86_64-Cloud.qcow2"
+    ["openSUSE-Leap-15.5-Minimal-VM.aarch64-Cloud.qcow2"]="https://download.opensuse.org/distribution/leap/15.5/appliances/openSUSE-Leap-15.5-Minimal-VM.aarch64-Cloud.qcow2"
+    ["debian-12-genericcloud-amd64.qcow2"]="https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-amd64.qcow2"
+    ["debian-12-genericcloud-arm64.qcow2"]="https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-genericcloud-arm64.qcow2"
+    ["ubuntu-24.04-server-cloudimg-amd64.img"]="https://cloud-images.ubuntu.com/releases/24.04/release/ubuntu-24.04-server-cloudimg-amd64.img"
+    ["ubuntu-24.04-server-cloudimg-arm64.img"]="https://cloud-images.ubuntu.com/releases/24.04/release/ubuntu-24.04-server-cloudimg-arm64.img"
+    ["ubuntu-22.04-server-cloudimg-amd64.img"]="https://cloud-images.ubuntu.com/releases/22.04/release/ubuntu-22.04-server-cloudimg-amd64.img"
+    ["ubuntu-22.04-server-cloudimg-arm64.img"]="https://cloud-images.ubuntu.com/releases/22.04/release/ubuntu-22.04-server-cloudimg-arm64.img"
+    ["ubuntu-20.04-server-cloudimg-amd64.img"]="https://cloud-images.ubuntu.com/releases/20.04/release/ubuntu-20.04-server-cloudimg-amd64.img"
+    ["ubuntu-20.04-server-cloudimg-arm64.img"]="https://cloud-images.ubuntu.com/releases/20.04/release/ubuntu-20.04-server-cloudimg-arm64.img"
+    ["OL9U5_x86_64-kvm-b259.qcow2"]="https://yum.oracle.com/templates/OracleLinux/OL9/u5/x86_64/OL9U5_x86_64-kvm-b259.qcow2"
+    ["OL9U5_aarch64-kvm-b126.qcow2"]="https://yum.oracle.com/templates/OracleLinux/OL9/u5/aarch64/OL9U5_aarch64-kvm-b126.qcow2"
+    ["OL8U10_x86_64-kvm-b258.qcow2"]="https://yum.oracle.com/templates/OracleLinux/OL8/u10/x86_64/OL8U10_x86_64-kvm-b258.qcow2"
+    ["OL8U10_aarch64-kvm-b122.qcow2"]="https://yum.oracle.com/templates/OracleLinux/OL8/u10/aarch64/OL8U10_aarch64-kvm-b122.qcow2"
+)
+
+# 2. Add the destination filename and its corresponding distribution subdirectory name.
+declare -A IMAGE_DISTROS=(
+    ["Rocky-9-GenericCloud.latest.x86_64.qcow2"]="rockylinux"
+    ["Rocky-9-GenericCloud.latest.aarch64.qcow2"]="rockylinux"
+    ["Rocky-8-GenericCloud.latest.x86_64.qcow2"]="rockylinux"
+    ["Rocky-8-GenericCloud.latest.aarch64.qcow2"]="rockylinux"
+    ["openSUSE-Leap-15.5-Minimal-VM.x86_64-Cloud.qcow2"]="opensuse"
+    ["openSUSE-Leap-15.5-Minimal-VM.aarch64-Cloud.qcow2"]="opensuse"
+    ["debian-12-genericcloud-amd64.qcow2"]="debian"
+    ["debian-12-genericcloud-arm64.qcow2"]="debian"
+    ["ubuntu-24.04-server-cloudimg-amd64.img"]="ubuntu"
+    ["ubuntu-24.04-server-cloudimg-arm64.img"]="ubuntu"
+    ["ubuntu-22.04-server-cloudimg-amd64.img"]="ubuntu"
+    ["ubuntu-22.04-server-cloudimg-arm64.img"]="ubuntu"
+    ["ubuntu-20.04-server-cloudimg-amd64.img"]="ubuntu"
+    ["ubuntu-20.04-server-cloudimg-arm64.img"]="ubuntu"
+    ["OL9U5_x86_64-kvm-b259.qcow2"]="oraclelinux"
+    ["OL9U5_aarch64-kvm-b126.qcow2"]="oraclelinux"
+    ["OL8U10_x86_64-kvm-b258.qcow2"]="oraclelinux"
+    ["OL8U10_aarch64-kvm-b122.qcow2"]="oraclelinux"
+)
+
+#-------------------------------------------------------------------------------
+# Cleanup Handler
+#-------------------------------------------------------------------------------
+
+cleanup_on_exit() {
+    local exit_code=$?
+    if [ -d "$TEMP_DIR" ]; then
+        rm -rf "$TEMP_DIR"
+        log_info "Temporary directory $TEMP_DIR removed."
+    fi
+
+    if [ $exit_code -ne 0 ]; then
+        log_error "Script exited with error code: $exit_code"
+    fi
+}
+
+trap cleanup_on_exit EXIT INT TERM
+
+#-------------------------------------------------------------------------------
+# Main Script Logic
+#-------------------------------------------------------------------------------
+
+if command -v logger &> /dev/null; then
+    LOGGER_AVAILABLE=true
+fi
+
+# Ensure base destination and log directories exist
+mkdir -p "$DEST_DIR"
+mkdir -p "$LOG_DIR"
+
+# Clean up old logs first
+cleanup_old_logs
+
+log_info "Starting image download process."
+log_info "Temporary directory: $TEMP_DIR"
+log_info "Base destination directory: $DEST_DIR"
+log_info "Log file: $LOG_FILE"
+
+# Inform about logger status
+if [ "${LOGGER_AVAILABLE}" = true ]; then
+    log_info "Syslog logging enabled (tag: ${LOGGER_TAG})"
+else
+    log_warn "Syslog logging disabled - logger utility not found"
+fi
+
+# Loop through the image URLs
+for filename in "${!IMAGE_URLS[@]}"; do
+    url="${IMAGE_URLS[$filename]}"
+    distro="${IMAGE_DISTROS[$filename]}"
+
+    # Check if a distro is defined for the file
+    if [ -z "$distro" ]; then
+        log_error "No distribution directory defined for $filename. Skipping."
+        continue
+    fi
+
+    distro_dest_dir="${DEST_DIR}/${distro}"
+    temp_filepath="${TEMP_DIR}/${filename}"
+    dest_filepath="${distro_dest_dir}/${filename}"
+
+    log_info "--------------------------------------------------"
+    log_info "Starting download for: $filename"
+    log_info "URL: $url"
+
+    # Download the file to the temporary directory
+    wget --progress=bar:force:noscroll -O "$temp_filepath" "$url"
+    download_status=$?
+
+    if [ $download_status -ne 0 ]; then
+        # Handle download failure
+        log_error "Failed to download $filename from $url. wget exit code: $download_status"
+    else
+        # Handle download success
+        log_info "Successfully downloaded $filename to temporary location."
+
+        # Ensure the specific distro directory exists
+        log_info "Ensuring destination directory exists: $distro_dest_dir"
+        mkdir -p "$distro_dest_dir"
+
+        # Move the file to the destination directory, replacing any existing file
+        log_info "Moving $filename to $dest_filepath"
+        mv -f "$temp_filepath" "$dest_filepath"
+        move_status=$?
+
+        if [ $move_status -ne 0 ]; then
+            log_error "Failed to move $filename to $dest_filepath. mv exit code: $move_status"
+        else
+            log_info "Successfully moved $filename."
+        fi
+    fi
+done
+
+log_info "Generate checksum"
+# Create md5 checksum
+checksum_file="md5sum.txt"
+sha512_checksum_file="sha512sum.txt"
+
+cd "$DEST_DIR"
+find . -type f ! -iname '*.txt' -exec md5sum {} \; > "$checksum_file"
+checksum_status=$?
+if [ $checksum_status -ne 0 ]; then
+    log_error "Failed to create md5 checksum. md5sum exit code: $checksum_status"
+else
+    log_info "Successfully created checksum file: $checksum_file"
+fi
+
+find . -type f ! -iname '*.txt' -exec sha512sum {} \; > "$sha512_checksum_file"
+sha512_checksum_status=$?
+if [ $sha512_checksum_status -ne 0 ]; then
+    log_error "Failed to create sha512 checksum. sha512sum exit code: $sha512_checksum_status"
+else
+    log_info "Successfully created checksum file: $sha512_checksum_file"
+fi
+
+log_info "--------------------------------------------------"
+log_info "Image download process finished."

From 3626c515e8e801e7d4f9179508af7bbd2985098c Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Thu, 29 Jan 2026 17:06:16 +0530
Subject: [PATCH 094/117] server: fix listing resource limits (#12188)

---
 .../ResourceLimitManagerImpl.java             | 74 ++++++++++---------
 .../ResourceLimitManagerImplTest.java         | 65 ++++++++++++++--
 2 files changed, 95 insertions(+), 44 deletions(-)

diff --git a/server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java b/server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java
index 3ee3da504a38..f4548ed5e8f1 100644
--- a/server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java
+++ b/server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java
@@ -21,6 +21,7 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Date;
+import java.util.EnumSet;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.Iterator;
@@ -36,9 +37,6 @@
 import javax.inject.Inject;
 import javax.naming.ConfigurationException;
 
-import com.cloud.event.ActionEventUtils;
-import com.cloud.event.EventTypes;
-import com.cloud.utils.Ternary;
 import org.apache.cloudstack.acl.SecurityChecker.AccessType;
 import org.apache.cloudstack.api.ApiCommandResourceType;
 import org.apache.cloudstack.api.response.AccountResponse;
@@ -86,6 +84,8 @@
 import com.cloud.domain.Domain;
 import com.cloud.domain.DomainVO;
 import com.cloud.domain.dao.DomainDao;
+import com.cloud.event.ActionEventUtils;
+import com.cloud.event.EventTypes;
 import com.cloud.exception.InvalidParameterValueException;
 import com.cloud.exception.PermissionDeniedException;
 import com.cloud.exception.ResourceAllocationException;
@@ -118,6 +118,7 @@
 import com.cloud.user.ResourceLimitService;
 import com.cloud.user.dao.AccountDao;
 import com.cloud.utils.Pair;
+import com.cloud.utils.Ternary;
 import com.cloud.utils.component.ManagerBase;
 import com.cloud.utils.concurrency.NamedThreadFactory;
 import com.cloud.utils.db.DB;
@@ -804,42 +805,43 @@ public List<ResourceLimitVO> searchForLimits(Long id, Long accountId, Long domai
                 limits.addAll(foundLimits);
             }
         } else {
-            limits.addAll(foundLimits);
-
-            // see if any limits are missing from the table, and if yes - get it from the config table and add
-            ResourceType[] resourceTypes = ResourceCount.ResourceType.values();
-            if (foundLimits.size() != resourceTypes.length) {
-                List<String> accountLimitStr = new ArrayList<>();
-                List<String> domainLimitStr = new ArrayList<>();
-                for (ResourceLimitVO foundLimit : foundLimits) {
-                    if (foundLimit.getAccountId() != null) {
-                        accountLimitStr.add(foundLimit.getType().toString());
-                    } else {
-                        domainLimitStr.add(foundLimit.getType().toString());
-                    }
-                }
+            limits = getConsolidatedResourceLimitsForAllResourceTypes(accountId, domainId, foundLimits, isAccount);
+        }
+        addTaggedResourceLimits(limits, resourceType, isAccount ? ResourceOwnerType.Account : ResourceOwnerType.Domain, isAccount ? accountId : domainId, hostTags, storageTags);
+        return limits;
+    }
 
-                // get default from config values
-                if (isAccount) {
-                    if (accountLimitStr.size() < resourceTypes.length) {
-                        for (ResourceType rt : resourceTypes) {
-                            if (!accountLimitStr.contains(rt.toString())) {
-                                limits.add(new ResourceLimitVO(rt, findCorrectResourceLimitForAccount(_accountMgr.getAccount(accountId), rt, null), accountId, ResourceOwnerType.Account));
-                            }
-                        }
-                    }
-                } else {
-                    if (domainLimitStr.size() < resourceTypes.length) {
-                        for (ResourceType rt : resourceTypes) {
-                            if (!domainLimitStr.contains(rt.toString())) {
-                                limits.add(new ResourceLimitVO(rt, findCorrectResourceLimitForDomain(_domainDao.findById(domainId), rt, null), domainId, ResourceOwnerType.Domain));
-                            }
-                        }
-                    }
-                }
+    protected List<ResourceLimitVO> getConsolidatedResourceLimitsForAllResourceTypes(Long accountId, Long domainId,
+                      List<ResourceLimitVO> foundLimits, boolean isAccount) {
+        List<ResourceLimitVO> limits = new ArrayList<>(foundLimits);
+
+        Set<ResourceType> allResourceTypes = EnumSet.allOf(ResourceType.class);
+        Set<ResourceType> foundUntaggedTypes = foundLimits.stream()
+                .filter(l -> StringUtils.isEmpty(l.getTag()))
+                .map(ResourceLimitVO::getType)
+                .collect(Collectors.toSet());
+
+        if (foundUntaggedTypes.containsAll(allResourceTypes)) {
+            return limits;
+        }
+
+        ResourceOwnerType ownerType = isAccount ? ResourceOwnerType.Account : ResourceOwnerType.Domain;
+        long ownerId = isAccount ? accountId : domainId;
+
+        for (ResourceType rt : allResourceTypes) {
+            if (foundUntaggedTypes.contains(rt)) {
+                continue;
             }
+            long max;
+            if (isAccount) {
+                Account acct = _accountMgr.getAccount(accountId);
+                max = findCorrectResourceLimitForAccount(acct, rt, null);
+            } else {
+                DomainVO dom = _domainDao.findById(domainId);
+                max = findCorrectResourceLimitForDomain(dom, rt, null);
+            }
+            limits.add(new ResourceLimitVO(rt, max, ownerId, ownerType));
         }
-        addTaggedResourceLimits(limits, resourceType, isAccount ? ResourceOwnerType.Account : ResourceOwnerType.Domain, isAccount ? accountId : domainId, hostTags, storageTags);
         return limits;
     }
 
diff --git a/server/src/test/java/com/cloud/resourcelimit/ResourceLimitManagerImplTest.java b/server/src/test/java/com/cloud/resourcelimit/ResourceLimitManagerImplTest.java
index e04ccc0ca13c..42022ced75ee 100644
--- a/server/src/test/java/com/cloud/resourcelimit/ResourceLimitManagerImplTest.java
+++ b/server/src/test/java/com/cloud/resourcelimit/ResourceLimitManagerImplTest.java
@@ -16,17 +16,17 @@
 // under the License.
 package com.cloud.resourcelimit;
 
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
 import java.lang.reflect.Field;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.EnumSet;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
-import com.cloud.event.ActionEventUtils;
-import com.cloud.event.EventTypes;
-import com.cloud.utils.db.EntityManager;
-
 import org.apache.cloudstack.api.ApiCommandResourceType;
 import org.apache.cloudstack.api.response.AccountResponse;
 import org.apache.cloudstack.api.response.DomainResponse;
@@ -62,6 +62,8 @@
 import com.cloud.domain.Domain;
 import com.cloud.domain.DomainVO;
 import com.cloud.domain.dao.DomainDao;
+import com.cloud.event.ActionEventUtils;
+import com.cloud.event.EventTypes;
 import com.cloud.exception.ResourceAllocationException;
 import com.cloud.offering.DiskOffering;
 import com.cloud.offering.ServiceOffering;
@@ -75,21 +77,19 @@
 import com.cloud.storage.dao.VolumeDao;
 import com.cloud.template.VirtualMachineTemplate;
 import com.cloud.user.Account;
-import com.cloud.user.User;
 import com.cloud.user.AccountManager;
 import com.cloud.user.AccountVO;
 import com.cloud.user.ResourceLimitService;
+import com.cloud.user.User;
 import com.cloud.user.dao.AccountDao;
 import com.cloud.utils.Pair;
+import com.cloud.utils.db.EntityManager;
 import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.VirtualMachineManager;
 import com.cloud.vm.dao.UserVmDao;
 import com.cloud.vm.dao.VMInstanceDao;
 import com.cloud.vpc.MockResourceLimitManagerImpl;
 
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
-
 @RunWith(MockitoJUnitRunner.class)
 public class ResourceLimitManagerImplTest {
     private Logger logger = LogManager.getLogger(ResourceLimitManagerImplTest.class);
@@ -1397,4 +1397,53 @@ public void testUpdateResourceLimitForDomain() {
                     domainId, ApiCommandResourceType.Domain.toString()));
         }
     }
+
+    @Test
+    public void consolidatedResourceLimitsForAllResourceTypesWithAccountId() {
+        Long accountId = 1L;
+        Long domainId = null;
+        List<ResourceLimitVO> foundLimits = new ArrayList<>();
+        ResourceLimitVO limit = new ResourceLimitVO(Resource.ResourceType.cpu, 10L, accountId, Resource.ResourceOwnerType.Account);
+        foundLimits.add(limit);
+
+        Mockito.when(accountManager.getAccount(accountId)).thenReturn(Mockito.mock(Account.class));
+        Mockito.doReturn(20L).when(resourceLimitManager).findCorrectResourceLimitForAccount(Mockito.any(Account.class), Mockito.any(Resource.ResourceType.class), Mockito.isNull());
+
+        List<ResourceLimitVO> result = resourceLimitManager.getConsolidatedResourceLimitsForAllResourceTypes(accountId, domainId, foundLimits, true);
+
+        Assert.assertEquals(EnumSet.allOf(Resource.ResourceType.class).size(), result.size());
+        Assert.assertTrue(result.contains(limit));
+    }
+
+    @Test
+    public void consolidatedResourceLimitsForAllResourceTypesWithDomainId() {
+        Long accountId = null;
+        Long domainId = 1L;
+        List<ResourceLimitVO> foundLimits = new ArrayList<>();
+        ResourceLimitVO limit = new ResourceLimitVO(Resource.ResourceType.memory, 15L, domainId, Resource.ResourceOwnerType.Domain);
+        foundLimits.add(limit);
+
+        Mockito.when(domainDao.findById(domainId)).thenReturn(Mockito.mock(DomainVO.class));
+        Mockito.doReturn(30L).when(resourceLimitManager).findCorrectResourceLimitForDomain(Mockito.any(Domain.class), Mockito.any(Resource.ResourceType.class), Mockito.isNull());
+
+        List<ResourceLimitVO> result = resourceLimitManager.getConsolidatedResourceLimitsForAllResourceTypes(accountId, domainId, foundLimits, false);
+
+        Assert.assertEquals(EnumSet.allOf(Resource.ResourceType.class).size(), result.size());
+        Assert.assertTrue(result.contains(limit));
+    }
+
+    @Test
+    public void consolidatedResourceLimitsForAllResourceTypesWithEmptyFoundLimits() {
+        Long accountId = 1L;
+        Long domainId = null;
+        List<ResourceLimitVO> foundLimits = new ArrayList<>();
+
+        Mockito.when(accountManager.getAccount(accountId)).thenReturn(Mockito.mock(Account.class));
+        Mockito.doReturn(25L).when(resourceLimitManager).findCorrectResourceLimitForAccount(Mockito.any(Account.class), Mockito.any(Resource.ResourceType.class), Mockito.isNull());
+
+        List<ResourceLimitVO> result = resourceLimitManager.getConsolidatedResourceLimitsForAllResourceTypes(accountId, domainId, foundLimits, true);
+
+        Assert.assertEquals(EnumSet.allOf(Resource.ResourceType.class).size(), result.size());
+        Assert.assertEquals(25L, result.get(0).getMax().longValue());
+    }
 }

From aef3df75771ecb2eaf237b3b803b87cf332a8554 Mon Sep 17 00:00:00 2001
From: Wei Zhou <weizhou@apache.org>
Date: Thu, 29 Jan 2026 13:47:08 +0100
Subject: [PATCH 095/117] server: pass network label of physical network when
 plug nic for private gateway on hypervisor (#11846)

---
 .../network/dao/PhysicalNetworkTrafficTypeDaoImpl.java      | 4 +++-
 .../com/cloud/hypervisor/kvm/resource/BridgeVifDriver.java  | 2 +-
 .../src/main/java/com/cloud/network/NetworkModelImpl.java   | 6 +++++-
 3 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/engine/schema/src/main/java/com/cloud/network/dao/PhysicalNetworkTrafficTypeDaoImpl.java b/engine/schema/src/main/java/com/cloud/network/dao/PhysicalNetworkTrafficTypeDaoImpl.java
index 4811b59d31e5..6504bb1f3c8c 100644
--- a/engine/schema/src/main/java/com/cloud/network/dao/PhysicalNetworkTrafficTypeDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/network/dao/PhysicalNetworkTrafficTypeDaoImpl.java
@@ -137,7 +137,9 @@ public String getNetworkTag(long physicalNetworkId, TrafficType trafficType, Hyp
         }
 
         sc.setParameters("physicalNetworkId", physicalNetworkId);
-        sc.setParameters("trafficType", trafficType);
+        if (trafficType != null) {
+            sc.setParameters("trafficType", trafficType);
+        }
         List<String> tag = customSearch(sc, null);
 
         return tag.size() == 0 ? null : tag.get(0);
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/BridgeVifDriver.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/BridgeVifDriver.java
index 3b66529ccaf7..b4f7fbd6dac6 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/BridgeVifDriver.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/BridgeVifDriver.java
@@ -232,7 +232,7 @@ public LibvirtVMDef.InterfaceDef plug(NicTO nic, String guestOsType, String nicA
                         String brName = createVnetBr(vNetId, trafficLabel, protocol);
                         intf.defBridgeNet(brName, null, nic.getMac(), getGuestNicModel(guestOsType, nicAdapter), networkRateKBps);
                     } else {
-                        String brName = createVnetBr(vNetId, _bridges.get("private"), protocol);
+                        String brName = createVnetBr(vNetId, _bridges.get("guest"), protocol);
                         intf.defBridgeNet(brName, null, nic.getMac(), getGuestNicModel(guestOsType, nicAdapter), networkRateKBps);
                     }
             } else {
diff --git a/server/src/main/java/com/cloud/network/NetworkModelImpl.java b/server/src/main/java/com/cloud/network/NetworkModelImpl.java
index 4a5b7199430b..86791b87851f 100644
--- a/server/src/main/java/com/cloud/network/NetworkModelImpl.java
+++ b/server/src/main/java/com/cloud/network/NetworkModelImpl.java
@@ -1442,11 +1442,11 @@ public String getNetworkTag(HypervisorType hType, Network network) {
             return null;
         }
 
+        NetworkOffering offering = _entityMgr.findById(NetworkOffering.class, network.getNetworkOfferingId());
         Long physicalNetworkId = null;
         if (effectiveTrafficType != TrafficType.Guest) {
             physicalNetworkId = getNonGuestNetworkPhysicalNetworkId(network, effectiveTrafficType);
         } else {
-            NetworkOffering offering = _entityMgr.findById(NetworkOffering.class, network.getNetworkOfferingId());
             physicalNetworkId = network.getPhysicalNetworkId();
             if (physicalNetworkId == null) {
                 physicalNetworkId = findPhysicalNetworkId(network.getDataCenterId(), offering.getTags(), offering.getTrafficType());
@@ -1459,6 +1459,10 @@ public String getNetworkTag(HypervisorType hType, Network network) {
             return null;
         }
 
+        if (offering != null && TrafficType.Guest.equals(offering.getTrafficType()) && offering.isSystemOnly()) {
+            // For private gateway, do not check the Guest traffic type
+            return _pNTrafficTypeDao.getNetworkTag(physicalNetworkId, null, hType);
+        }
         return _pNTrafficTypeDao.getNetworkTag(physicalNetworkId, effectiveTrafficType, hType);
     }
 

From 8c2a0308165173812d146d835bf31c3e515daff4 Mon Sep 17 00:00:00 2001
From: Daniel Augusto Veronezi Salvador
 <38945620+GutoVeronezi@users.noreply.github.com>
Date: Thu, 29 Jan 2026 09:51:22 -0300
Subject: [PATCH 096/117] Fix query filter and units tests (#12184)

---
 .../com/cloud/network/dao/NetworkDaoImpl.java |  2 +-
 .../cloud/network/dao/NetworkDaoImplTest.java | 31 +++++++------------
 2 files changed, 13 insertions(+), 20 deletions(-)

diff --git a/engine/schema/src/main/java/com/cloud/network/dao/NetworkDaoImpl.java b/engine/schema/src/main/java/com/cloud/network/dao/NetworkDaoImpl.java
index 8066b89b4b9a..4e8b6204f720 100644
--- a/engine/schema/src/main/java/com/cloud/network/dao/NetworkDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/network/dao/NetworkDaoImpl.java
@@ -598,7 +598,7 @@ public List<NetworkVO> listByPhysicalNetwork(final long physicalNetworkId) {
     public List<NetworkVO> listByPhysicalNetworkTrafficType(final long physicalNetworkId, final TrafficType trafficType) {
         final SearchCriteria<NetworkVO> sc = AllFieldsSearch.create();
         sc.setParameters("trafficType", trafficType);
-        sc.setParameters("physicalNetwork", physicalNetworkId);
+        sc.setParameters("physicalNetworkId", physicalNetworkId);
         return listBy(sc);
     }
 
diff --git a/engine/schema/src/test/java/com/cloud/network/dao/NetworkDaoImplTest.java b/engine/schema/src/test/java/com/cloud/network/dao/NetworkDaoImplTest.java
index ab5f43521052..a78eab568af0 100644
--- a/engine/schema/src/test/java/com/cloud/network/dao/NetworkDaoImplTest.java
+++ b/engine/schema/src/test/java/com/cloud/network/dao/NetworkDaoImplTest.java
@@ -22,7 +22,6 @@
 import com.cloud.network.Networks;
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
-import com.cloud.utils.db.TransactionLegacy;
 import org.junit.Assert;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -30,7 +29,6 @@
 import org.mockito.Mockito;
 import org.mockito.junit.MockitoJUnitRunner;
 
-
 import java.util.List;
 
 @RunWith(MockitoJUnitRunner.class)
@@ -46,26 +44,21 @@ public class NetworkDaoImplTest {
     List<NetworkVO> listNetworkVoMock;
 
     @Test
-    public void listByPhysicalNetworkTrafficTypeTestSetParametersValidation() throws Exception {
+    public void listByPhysicalNetworkTrafficTypeTestSetParametersValidation() {
         NetworkDaoImpl networkDaoImplSpy = Mockito.spy(NetworkDaoImpl.class);
-        TransactionLegacy txn = TransactionLegacy.open("runNetworkDaoImplTest");
-        try {
-            networkDaoImplSpy.AllFieldsSearch = searchBuilderNetworkVoMock;
-            Mockito.doReturn(searchCriteriaNetworkVoMock).when(searchBuilderNetworkVoMock).create();
-            Mockito.doNothing().when(searchCriteriaNetworkVoMock).setParameters(Mockito.anyString(), Mockito.any());
-            Mockito.doReturn(listNetworkVoMock).when(networkDaoImplSpy).listBy(Mockito.any(SearchCriteria.class));
-
-            long expectedPhysicalNetwork = 2513l;
+        networkDaoImplSpy.AllFieldsSearch = searchBuilderNetworkVoMock;
+        Mockito.doReturn(searchCriteriaNetworkVoMock).when(searchBuilderNetworkVoMock).create();
+        Mockito.doNothing().when(searchCriteriaNetworkVoMock).setParameters(Mockito.anyString(), Mockito.any());
+        Mockito.doReturn(listNetworkVoMock).when(networkDaoImplSpy).listBy(Mockito.any(SearchCriteria.class));
 
-            for (Networks.TrafficType trafficType : Networks.TrafficType.values()) {
-                List<NetworkVO> result = networkDaoImplSpy.listByPhysicalNetworkTrafficType(expectedPhysicalNetwork, trafficType);
-                Assert.assertEquals(listNetworkVoMock, result);
-                Mockito.verify(searchCriteriaNetworkVoMock).setParameters("trafficType", trafficType);
-            }
+        long expectedPhysicalNetwork = 2513l;
 
-            Mockito.verify(searchCriteriaNetworkVoMock, Mockito.times(Networks.TrafficType.values().length)).setParameters("physicalNetwork", expectedPhysicalNetwork);
-        } finally {
-            txn.close();
+        for (Networks.TrafficType trafficType : Networks.TrafficType.values()) {
+            List<NetworkVO> result = networkDaoImplSpy.listByPhysicalNetworkTrafficType(expectedPhysicalNetwork, trafficType);
+            Assert.assertEquals(listNetworkVoMock, result);
+            Mockito.verify(searchCriteriaNetworkVoMock).setParameters("trafficType", trafficType);
         }
+
+        Mockito.verify(searchCriteriaNetworkVoMock, Mockito.times(Networks.TrafficType.values().length)).setParameters("physicalNetworkId", expectedPhysicalNetwork);
     }
 }

From 7d52cd0e43a5e225f10bce251f7cd357060382cd Mon Sep 17 00:00:00 2001
From: Fabricio Duarte <fabricio.duarte.jr@gmail.com>
Date: Thu, 29 Jan 2026 10:38:12 -0300
Subject: [PATCH 097/117] Fix calculation of the next time that Usage will
 execute in `removeRawUsageRecords` (#12518)

* Fix calculation of the next time that Usage will execute in `removeRawUsageRecords`

* Address copilot reviews
---
 .../com/cloud/usage/UsageServiceImpl.java     |  60 ++++----
 .../com/cloud/usage/UsageManagerImpl.java     |  35 ++---
 .../cloudstack/utils/usage/UsageUtils.java    |  51 +++++++
 .../utils/usage/UsageUtilsTest.java           | 135 ++++++++++++++++++
 4 files changed, 230 insertions(+), 51 deletions(-)
 create mode 100644 utils/src/test/java/org/apache/cloudstack/utils/usage/UsageUtilsTest.java

diff --git a/server/src/main/java/com/cloud/usage/UsageServiceImpl.java b/server/src/main/java/com/cloud/usage/UsageServiceImpl.java
index edaa22c3bcfa..de8d4633d224 100644
--- a/server/src/main/java/com/cloud/usage/UsageServiceImpl.java
+++ b/server/src/main/java/com/cloud/usage/UsageServiceImpl.java
@@ -17,7 +17,6 @@
 package com.cloud.usage;
 
 import java.util.ArrayList;
-import java.util.Calendar;
 import java.util.Date;
 import java.util.List;
 import java.util.Map;
@@ -35,6 +34,7 @@
 import org.apache.cloudstack.usage.Usage;
 import org.apache.cloudstack.usage.UsageService;
 import org.apache.cloudstack.usage.UsageTypes;
+import org.apache.cloudstack.utils.usage.UsageUtils;
 import org.apache.commons.lang3.ObjectUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.jetbrains.annotations.NotNull;
@@ -127,14 +127,25 @@ public class UsageServiceImpl extends ManagerBase implements UsageService, Manag
     @Inject
     private NetworkOfferingDao _networkOfferingDao;
 
+    private TimeZone usageExecutionTimeZone = TimeZone.getTimeZone("GMT");
+
+    private static final long REMOVE_RAW_USAGE_RECORDS_WINDOW_IN_MS = 15 * 60 * 1000;
+
     public UsageServiceImpl() {
     }
 
     @Override
     public boolean configure(String name, Map<String, Object> params) throws ConfigurationException {
         super.configure(name, params);
+
         String timeZoneStr = ObjectUtils.defaultIfNull(_configDao.getValue(Config.UsageAggregationTimezone.toString()), "GMT");
         _usageTimezone = TimeZone.getTimeZone(timeZoneStr);
+
+        String executionTimeZone = _configDao.getValue(Config.UsageExecutionTimezone.toString());
+        if (executionTimeZone != null) {
+            usageExecutionTimeZone = TimeZone.getTimeZone(executionTimeZone);
+        }
+
         return true;
     }
 
@@ -465,35 +476,28 @@ public TimeZone getUsageTimezone() {
     @Override
     public boolean removeRawUsageRecords(RemoveRawUsageRecordsCmd cmd) throws InvalidParameterValueException {
         Integer interval = cmd.getInterval();
-        if (interval != null && interval > 0 ) {
-            String jobExecTime = _configDao.getValue(Config.UsageStatsJobExecTime.toString());
-            if (jobExecTime != null ) {
-                String[] segments = jobExecTime.split(":");
-                if (segments.length == 2) {
-                    String timeZoneStr = _configDao.getValue(Config.UsageExecutionTimezone.toString());
-                    if (timeZoneStr == null) {
-                        timeZoneStr = "GMT";
-                    }
-                    TimeZone tz = TimeZone.getTimeZone(timeZoneStr);
-                    Calendar cal = Calendar.getInstance(tz);
-                    cal.setTime(new Date());
-                    long curTS = cal.getTimeInMillis();
-                    cal.set(Calendar.HOUR_OF_DAY, Integer.parseInt(segments[0]));
-                    cal.set(Calendar.MINUTE, Integer.parseInt(segments[1]));
-                    cal.set(Calendar.SECOND, 0);
-                    cal.set(Calendar.MILLISECOND, 0);
-                    long execTS = cal.getTimeInMillis();
-                    logger.debug("Trying to remove old raw cloud_usage records older than " + interval + " day(s), current time=" + curTS + " next job execution time=" + execTS);
-                    // Let's avoid cleanup when job runs and around a 15 min interval
-                    if (Math.abs(curTS - execTS) < 15 * 60 * 1000) {
-                        return false;
-                    }
-                }
+        if (interval == null || interval <= 0) {
+            throw new InvalidParameterValueException("Interval should be greater than 0.");
+        }
+
+        String jobExecTime = _configDao.getValue(Config.UsageStatsJobExecTime.toString());
+        Date previousJobExecTime = UsageUtils.getPreviousJobExecutionTime(usageExecutionTimeZone, jobExecTime);
+        Date nextJobExecTime = UsageUtils.getNextJobExecutionTime(usageExecutionTimeZone, jobExecTime);
+        if (ObjectUtils.allNotNull(previousJobExecTime, nextJobExecTime)) {
+            logger.debug("Next Usage job is scheduled to execute at [{}]; previous execution was at [{}].",
+                    DateUtil.displayDateInTimezone(usageExecutionTimeZone, nextJobExecTime), DateUtil.displayDateInTimezone(usageExecutionTimeZone, previousJobExecTime));
+            Date now = new Date();
+            if (nextJobExecTime.getTime() - now.getTime() < REMOVE_RAW_USAGE_RECORDS_WINDOW_IN_MS) {
+                logger.info("Not removing any cloud_usage records because the next Usage job is scheduled to execute in less than {} minute(s).", REMOVE_RAW_USAGE_RECORDS_WINDOW_IN_MS / 60000);
+                return false;
+            } else if (now.getTime() - previousJobExecTime.getTime() < REMOVE_RAW_USAGE_RECORDS_WINDOW_IN_MS) {
+                logger.info("Not removing any cloud_usage records because the last Usage job executed in less than {} minute(s) ago.", REMOVE_RAW_USAGE_RECORDS_WINDOW_IN_MS / 60000);
+                return false;
             }
-            _usageDao.expungeAllOlderThan(interval, ConfigurationManagerImpl.DELETE_QUERY_BATCH_SIZE.value());
-        } else {
-            throw new InvalidParameterValueException("Invalid interval value. Interval to remove cloud_usage records should be greater than 0");
         }
+
+        logger.info("Removing cloud_usage records older than {} day(s).", interval);
+        _usageDao.expungeAllOlderThan(interval, ConfigurationManagerImpl.DELETE_QUERY_BATCH_SIZE.value());
         return true;
     }
 }
diff --git a/usage/src/main/java/com/cloud/usage/UsageManagerImpl.java b/usage/src/main/java/com/cloud/usage/UsageManagerImpl.java
index 30cdfcf21f08..9da64889fc36 100644
--- a/usage/src/main/java/com/cloud/usage/UsageManagerImpl.java
+++ b/usage/src/main/java/com/cloud/usage/UsageManagerImpl.java
@@ -198,7 +198,9 @@ public class UsageManagerImpl extends ManagerBase implements UsageManager, Runna
     private Future _heartbeat = null;
     private Future _sanity = null;
     private boolean  usageSnapshotSelection = false;
+
     private static TimeZone usageAggregationTimeZone = TimeZone.getTimeZone("GMT");
+    private static TimeZone usageExecutionTimeZone = TimeZone.getTimeZone("GMT");
 
     public UsageManagerImpl() {
     }
@@ -253,6 +255,9 @@ public boolean configure(String name, Map<String, Object> params) throws Configu
         if (aggregationTimeZone != null && !aggregationTimeZone.isEmpty()) {
             usageAggregationTimeZone = TimeZone.getTimeZone(aggregationTimeZone);
         }
+        if (execTimeZone != null) {
+            usageExecutionTimeZone = TimeZone.getTimeZone(execTimeZone);
+        }
 
         try {
             if ((execTime == null) || (aggregationRange == null)) {
@@ -261,34 +266,18 @@ public boolean configure(String name, Map<String, Object> params) throws Configu
                 throw new ConfigurationException("Missing configuration values for usage job, usage.stats.job.exec.time = " + execTime +
                         ", usage.stats.job.aggregation.range = " + aggregationRange);
             }
-            String[] execTimeSegments = execTime.split(":");
-            if (execTimeSegments.length != 2) {
-                logger.error("Unable to parse usage.stats.job.exec.time");
-                throw new ConfigurationException("Unable to parse usage.stats.job.exec.time '" + execTime + "'");
-            }
-            int hourOfDay = Integer.parseInt(execTimeSegments[0]);
-            int minutes = Integer.parseInt(execTimeSegments[1]);
-
-            Date currentDate = new Date();
-            _jobExecTime.setTime(currentDate);
-
-            _jobExecTime.set(Calendar.HOUR_OF_DAY, hourOfDay);
-            _jobExecTime.set(Calendar.MINUTE, minutes);
-            _jobExecTime.set(Calendar.SECOND, 0);
-            _jobExecTime.set(Calendar.MILLISECOND, 0);
-
-            TimeZone jobExecTimeZone = execTimeZone != null ? TimeZone.getTimeZone(execTimeZone) : Calendar.getInstance().getTimeZone();
-            _jobExecTime.setTimeZone(jobExecTimeZone);
 
-            // if the hour to execute the job has already passed, roll the day forward to the next day
-            if (_jobExecTime.getTime().before(currentDate)) {
-                _jobExecTime.roll(Calendar.DAY_OF_YEAR, true);
+            Date nextJobExecTime = UsageUtils.getNextJobExecutionTime(usageExecutionTimeZone, execTime);
+            if (nextJobExecTime == null) {
+                throw new ConfigurationException(String.format("Unable to parse configuration 'usage.stats.job.exec.time' value [%s].", execTime));
             }
+            _jobExecTime.setTimeZone(usageExecutionTimeZone);
+            _jobExecTime.setTime(nextJobExecTime);
 
             logger.info("Usage is configured to execute in time zone [{}], at [{}], each [{}] minutes; the current time in that timezone is [{}] and the " +
                             "next job is scheduled to execute at [{}]. During its execution, Usage will aggregate stats according to the time zone [{}] defined in global setting [usage.aggregation.timezone].",
-                    jobExecTimeZone.getID(), execTime, aggregationRange, DateUtil.displayDateInTimezone(jobExecTimeZone, currentDate),
-                    DateUtil.displayDateInTimezone(jobExecTimeZone, _jobExecTime.getTime()), usageAggregationTimeZone.getID());
+                    usageExecutionTimeZone.getID(), execTime, aggregationRange, DateUtil.displayDateInTimezone(usageExecutionTimeZone, new Date()),
+                    DateUtil.displayDateInTimezone(usageExecutionTimeZone, _jobExecTime.getTime()), usageAggregationTimeZone.getID());
 
             _aggregationDuration = Integer.parseInt(aggregationRange);
             if (_aggregationDuration < UsageUtils.USAGE_AGGREGATION_RANGE_MIN) {
diff --git a/utils/src/main/java/org/apache/cloudstack/utils/usage/UsageUtils.java b/utils/src/main/java/org/apache/cloudstack/utils/usage/UsageUtils.java
index a97aed15d360..861788d1918b 100644
--- a/utils/src/main/java/org/apache/cloudstack/utils/usage/UsageUtils.java
+++ b/utils/src/main/java/org/apache/cloudstack/utils/usage/UsageUtils.java
@@ -19,6 +19,57 @@
 
 package org.apache.cloudstack.utils.usage;
 
+import com.cloud.utils.DateUtil;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import java.util.Calendar;
+import java.util.Date;
+import java.util.TimeZone;
+
 public class UsageUtils {
+    protected static Logger logger = LogManager.getLogger(UsageUtils.class);
+
     public static final int USAGE_AGGREGATION_RANGE_MIN = 1;
+
+    public static Date getNextJobExecutionTime(TimeZone usageTimeZone, String jobExecTimeConfig) {
+        return getJobExecutionTime(usageTimeZone, jobExecTimeConfig, true);
+    }
+
+    public static Date getPreviousJobExecutionTime(TimeZone usageTimeZone, String jobExecTimeConfig) {
+        return getJobExecutionTime(usageTimeZone, jobExecTimeConfig, false);
+    }
+
+    protected static Date getJobExecutionTime(TimeZone usageTimeZone, String jobExecTimeConfig, boolean next) {
+        String[] execTimeSegments = jobExecTimeConfig.split(":");
+        if (execTimeSegments.length != 2) {
+            logger.warn("Unable to parse configuration 'usage.stats.job.exec.time'.");
+            return null;
+        }
+        int hourOfDay;
+        int minutes;
+        try {
+            hourOfDay = Integer.parseInt(execTimeSegments[0]);
+            minutes = Integer.parseInt(execTimeSegments[1]);
+        } catch (NumberFormatException e) {
+            logger.warn("Unable to parse configuration 'usage.stats.job.exec.time' due to non-numeric values in [{}].", jobExecTimeConfig, e);
+            return null;
+        }
+
+        Date currentDate = DateUtil.currentGMTTime();
+        Calendar jobExecTime = Calendar.getInstance(usageTimeZone);
+        jobExecTime.setTime(currentDate);
+        jobExecTime.set(Calendar.HOUR_OF_DAY, hourOfDay);
+        jobExecTime.set(Calendar.MINUTE, minutes);
+        jobExecTime.set(Calendar.SECOND, 0);
+        jobExecTime.set(Calendar.MILLISECOND, 0);
+
+        if (next && jobExecTime.getTime().before(currentDate)) {
+            jobExecTime.add(Calendar.DAY_OF_YEAR, 1);
+        } else if (!next && jobExecTime.getTime().after(currentDate)) {
+            jobExecTime.add(Calendar.DAY_OF_YEAR, -1);
+        }
+
+        return jobExecTime.getTime();
+    }
 }
diff --git a/utils/src/test/java/org/apache/cloudstack/utils/usage/UsageUtilsTest.java b/utils/src/test/java/org/apache/cloudstack/utils/usage/UsageUtilsTest.java
new file mode 100644
index 000000000000..8b9b4910e39d
--- /dev/null
+++ b/utils/src/test/java/org/apache/cloudstack/utils/usage/UsageUtilsTest.java
@@ -0,0 +1,135 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package org.apache.cloudstack.utils.usage;
+
+import com.cloud.utils.DateUtil;
+import junit.framework.TestCase;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import java.util.Date;
+import java.util.TimeZone;
+
+@RunWith(MockitoJUnitRunner.class)
+public class UsageUtilsTest extends TestCase {
+
+    TimeZone usageTimeZone = TimeZone.getTimeZone("GMT-3");
+
+    @Test
+    public void getJobExecutionTimeTestReturnsNullWhenConfigurationValueIsInvalid() {
+        Date result = UsageUtils.getNextJobExecutionTime(usageTimeZone, "test");
+        assertNull(result);
+    }
+
+    @Test
+    public void getJobExecutionTimeTestReturnsExpectedDateWhenNextIsTrueAndExecutionTimeHasNotPassed() {
+        Date currentDate = new Date();
+        currentDate.setTime(1724296800000L);
+
+        try (MockedStatic<DateUtil> dateUtilMockedStatic = Mockito.mockStatic(DateUtil.class)) {
+            dateUtilMockedStatic.when(DateUtil::currentGMTTime).thenReturn(currentDate);
+
+            Date result = UsageUtils.getJobExecutionTime(usageTimeZone, "00:30", true);
+
+            Assert.assertNotNull(result);
+            Assert.assertEquals(1724297400000L, result.getTime());
+        }
+    }
+
+    @Test
+    public void getJobExecutionTimeTestReturnsExpectedDateWhenNextIsTrueAndExecutionTimeHasPassed() {
+        Date currentDate = new Date();
+        currentDate.setTime(1724297460000L);
+
+        try (MockedStatic<DateUtil> dateUtilMockedStatic = Mockito.mockStatic(DateUtil.class)) {
+            dateUtilMockedStatic.when(DateUtil::currentGMTTime).thenReturn(currentDate);
+
+            Date result = UsageUtils.getJobExecutionTime(usageTimeZone, "00:30", true);
+
+            Assert.assertNotNull(result);
+            Assert.assertEquals(1724383800000L, result.getTime());
+        }
+    }
+
+    @Test
+    public void getJobExecutionTimeTestReturnsExpectedDateWhenNextIsFalseAndExecutionTimeHasNotPassed() {
+        Date currentDate = new Date();
+        currentDate.setTime(1724296800000L);
+
+        try (MockedStatic<DateUtil> dateUtilMockedStatic = Mockito.mockStatic(DateUtil.class)) {
+            dateUtilMockedStatic.when(DateUtil::currentGMTTime).thenReturn(currentDate);
+
+            Date result = UsageUtils.getJobExecutionTime(usageTimeZone, "00:30", false);
+
+            Assert.assertNotNull(result);
+            Assert.assertEquals(1724211000000L, result.getTime());
+        }
+    }
+
+    @Test
+    public void getJobExecutionTimeTestReturnsExpectedDateWhenNextIsFalseAndExecutionTimeHasPassed() {
+        Date currentDate = new Date();
+        currentDate.setTime(1724297460000L);
+
+        try (MockedStatic<DateUtil> dateUtilMockedStatic = Mockito.mockStatic(DateUtil.class)) {
+            dateUtilMockedStatic.when(DateUtil::currentGMTTime).thenReturn(currentDate);
+
+            Date result = UsageUtils.getJobExecutionTime(usageTimeZone, "00:30", false);
+
+            Assert.assertNotNull(result);
+            Assert.assertEquals(1724297400000L, result.getTime());
+        }
+    }
+
+    @Test
+    public void getJobExecutionTimeTestReturnsExpectedDateWhenNextExecutionIsOnNextYear() {
+        Date currentDate = new Date();
+        currentDate.setTime(1767236340000L);
+
+        try (MockedStatic<DateUtil> dateUtilMockedStatic = Mockito.mockStatic(DateUtil.class)) {
+            dateUtilMockedStatic.when(DateUtil::currentGMTTime).thenReturn(currentDate);
+
+            Date result = UsageUtils.getJobExecutionTime(usageTimeZone, "00:00", true);
+
+            Assert.assertNotNull(result);
+            Assert.assertEquals(1767236400000L, result.getTime());
+        }
+    }
+
+    @Test
+    public void getJobExecutionTimeTestReturnsExpectedDateWhenPreviousExecutionWasOnPreviousYear() {
+        Date currentDate = new Date();
+        currentDate.setTime(1767236460000L);
+
+        try (MockedStatic<DateUtil> dateUtilMockedStatic = Mockito.mockStatic(DateUtil.class)) {
+            dateUtilMockedStatic.when(DateUtil::currentGMTTime).thenReturn(currentDate);
+
+            Date result = UsageUtils.getJobExecutionTime(usageTimeZone, "23:59", false);
+
+            Assert.assertNotNull(result);
+            Assert.assertEquals(1767236340000L, result.getTime());
+        }
+    }
+
+}

From 0e94f7d7717857884bd2568bd7917faf10cd6e48 Mon Sep 17 00:00:00 2001
From: Vishesh <8760112+vishesh92@users.noreply.github.com>
Date: Thu, 29 Jan 2026 19:47:11 +0530
Subject: [PATCH 098/117] UI: Show applied search filters (#9520)

---
 ui/public/config.json                   |   3 +-
 ui/src/components/view/SearchFilter.vue | 559 ++++++++++++++++++++++++
 ui/src/views/AutogenView.vue            |  48 ++
 ui/tests/unit/views/AutogenView.spec.js |   4 +
 4 files changed, 613 insertions(+), 1 deletion(-)
 create mode 100644 ui/src/components/view/SearchFilter.vue

diff --git a/ui/public/config.json b/ui/public/config.json
index 64d102841862..e3d1d30b95fb 100644
--- a/ui/public/config.json
+++ b/ui/public/config.json
@@ -98,5 +98,6 @@
   "multipleServer": false,
   "allowSettingTheme": true,
   "docHelpMappings": {},
-  "notifyLatestCSVersion": true
+  "notifyLatestCSVersion": true,
+  "showSearchFilters": true
 }
diff --git a/ui/src/components/view/SearchFilter.vue b/ui/src/components/view/SearchFilter.vue
new file mode 100644
index 000000000000..ed950c094a3b
--- /dev/null
+++ b/ui/src/components/view/SearchFilter.vue
@@ -0,0 +1,559 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+<template>
+  <a-row
+    style="overflow: auto"
+    :wrap="false"
+  >
+    <template
+      v-for="filter in this.searchFilters"
+      :key="filter.key + filter.value"
+    >
+      <a-col v-if="!['page', 'pagesize', 'q', 'keyword', 'tags'].includes(filter.key)">
+        <a-tag
+          v-if="!filter.isTag"
+          closable
+          @close="() => $emit('removeFilter', filter)"
+        >
+          <a-tooltip
+            :title="retrieveFieldLabel(filter.key) + ': ' + filter.value"
+            placement="bottom"
+          >
+            {{ retrieveFieldLabel(filter.key) }} : {{ getTrimmedText(filter.value, 20) }}
+          </a-tooltip>
+        </a-tag>
+        <a-tag
+          v-else
+          closable
+          @close="() => $emit('removeFilter', filter)"
+        >
+          <a-tooltip
+            :title="$t('label.tag') + ': ' + filter.key + '=' + filter.value"
+            placement="bottom"
+          >
+            {{ $t('label.tag') }}: {{ filter.key }}={{ getTrimmedText(filter.value, 20) }}
+          </a-tooltip>
+        </a-tag>
+      </a-col>
+    </template>
+  </a-row>
+</template>
+
+<script>
+
+import { api } from '@/api/index'
+
+export default {
+  name: 'SearchFilter',
+  props: {
+    filters: {
+      type: Array,
+      default: () => []
+    },
+    apiName: {
+      type: String,
+      default: () => ''
+    },
+    filterKey: {
+      type: String,
+      default: () => ''
+    },
+    filterValue: {
+      type: String,
+      default: () => ''
+    },
+    isTag: {
+      type: Boolean,
+      default: () => false
+    }
+  },
+  emits: ['removeFilter'],
+  data () {
+    return {
+      searchFilters: [],
+      apiMap: {
+        type: (value) => this.getType(value),
+        hypervisor: (value) => this.getHypervisor(value),
+        zoneid: {
+          apiName: 'listZones',
+          responseKey1: 'listzonesresponse',
+          responseKey2: 'zone',
+          field: 'name'
+        },
+        domainid: {
+          apiName: 'listDomains',
+          responseKey1: 'listdomainsresponse',
+          responseKey2: 'domain',
+          field: 'name'
+        },
+        account: {
+          apiName: 'listAccounts',
+          responseKey1: 'listaccountsresponse',
+          responseKey2: 'account',
+          field: 'name'
+        },
+        imagestoreid: {
+          apiName: 'listImageStores',
+          responseKey1: 'listimagestoresresponse',
+          responseKey2: 'imagestore',
+          field: 'name'
+        },
+        storageid: {
+          apiName: 'listStoragePools',
+          responseKey1: 'liststoragepoolsresponse',
+          responseKey2: 'storagepool',
+          field: 'name'
+        },
+        podid: {
+          apiName: 'listPods',
+          responseKey1: 'listpodsresponse',
+          responseKey2: 'pod',
+          field: 'name'
+        },
+        clusterid: {
+          apiName: 'listClusters',
+          responseKey1: 'listclustersresponse',
+          responseKey2: 'cluster',
+          field: 'name'
+        },
+        hostid: {
+          apiName: 'listHosts',
+          responseKey1: 'listhostsresponse',
+          responseKey2: 'host',
+          field: 'name'
+        },
+        groupid: {
+          apiName: 'listInstanceGroups',
+          responseKey1: 'listinstancegroupsresponse',
+          responseKey2: 'instancegroup',
+          field: 'name'
+        },
+        managementserverid: {
+          apiName: 'listManagementServers',
+          responseKey1: 'listmanagementserversresponse',
+          responseKey2: 'managementserver',
+          field: 'name'
+        },
+        serviceofferingid: {
+          apiName: 'listServiceOfferings',
+          responseKey1: 'listserviceofferingsresponse',
+          responseKey2: 'serviceoffering',
+          field: 'name'
+        },
+        diskofferingid: {
+          apiName: 'listDiskOfferings',
+          responseKey1: 'listdiskofferingsresponse',
+          responseKey2: 'diskoffering',
+          field: 'name'
+        },
+        networkid: {
+          apiName: 'listNetworks',
+          responseKey1: 'listnetworksresponse',
+          responseKey2: 'network',
+          field: 'name'
+        }
+      }
+    }
+  },
+  watch: {
+    filters: {
+      immediate: true,
+      handler (newFilters) {
+        const clonedFilters = newFilters.map(filter => ({ ...filter }))
+        const promises = []
+        for (let idx = 0; idx < clonedFilters.length; idx++) {
+          const filter = clonedFilters[idx]
+          promises.push(new Promise((resolve) => {
+            if (filter.key === 'tags') {
+              clonedFilters[idx] = {
+                key: filter.key,
+                value: filter.value,
+                isTag: true
+              }
+              resolve()
+            } else {
+              this.getSearchFilters(filter.key, filter.value).then((value) => {
+                clonedFilters[idx] = {
+                  key: filter.key,
+                  value: value,
+                  isTag: filter.isTag
+                }
+                resolve()
+              })
+            }
+          }))
+        }
+        Promise.all(promises).then(() => {
+          this.searchFilters = clonedFilters
+        })
+      }
+    }
+  },
+  methods: {
+    getTrimmedText (text, length) {
+      if (!text) {
+        return ''
+      }
+      return (text.length <= length) ? text : (text.substring(0, length - 3) + '...')
+    },
+    retrieveFieldLabel (fieldName) {
+      if (fieldName === 'groupid') {
+        fieldName = 'group'
+      }
+      if (fieldName === 'keyword') {
+        if ('listAnnotations' in this.$store.getters.apis) {
+          return this.$t('label.annotation')
+        } else {
+          return this.$t('label.name')
+        }
+      }
+      return this.$t('label.' + fieldName)
+    },
+    async getSearchFilters (key, value) {
+      const val = this.getStaticFieldValue(key, value)
+      if (val !== '') {
+        return val
+      } else {
+        return this.getDynamicFieldValue(key, value)
+      }
+    },
+    getStaticFieldValue (key, value) {
+      let formattedValue = ''
+      if (key.includes('type')) {
+        if (this.$route.path === '/guestnetwork' || this.$route.path.includes('/guestnetwork/')) {
+          formattedValue = this.getGuestNetworkType(value)
+        } else if (this.$route.path === '/role' || this.$route.path.includes('/role/')) {
+          formattedValue = this.getRoleType(value)
+        }
+      }
+
+      if (key.includes('scope')) {
+        // Check storage pool scope first (more specific), then fall back to general scope
+        const storagePoolScope = this.getStoragePoolScope(value)
+        formattedValue = storagePoolScope && storagePoolScope.length > 0 ? storagePoolScope : this.getScope(value)
+      }
+
+      if (key.includes('state')) {
+        formattedValue = this.getState(value)
+      }
+
+      if (key.includes('level')) {
+        formattedValue = this.getLevel(value)
+      }
+
+      if (key.includes('entitytype')) {
+        formattedValue = this.getEntityType(value)
+      }
+
+      if (key.includes('accounttype')) {
+        formattedValue = this.getAccountType(value)
+      }
+
+      if (key.includes('systemvmtype')) {
+        formattedValue = this.getSystemVmType(value)
+      }
+
+      if (key.includes('provider')) {
+        formattedValue = this.getImageStoreProvider(value)
+      }
+
+      if (key.includes('resourcetype')) {
+        formattedValue = value
+      }
+      return formattedValue
+    },
+    async getDynamicFieldValue (key, value) {
+      let formattedValue = ''
+
+      if (typeof this.apiMap[key] === 'function') {
+        formattedValue = await this.apiMap[key](value)
+      } else if (this.apiMap[key]) {
+        const apiName = this.apiMap[key].apiName
+        const responseKey1 = this.apiMap[key].responseKey1
+        const responseKey2 = this.apiMap[key].responseKey2
+        const field = this.apiMap[key].field
+        formattedValue = await this.getResourceNameById(apiName, responseKey1, responseKey2, value, field)
+      }
+      if (formattedValue === '') {
+        formattedValue = value
+      }
+      return formattedValue
+    },
+    getHypervisor (value) {
+      return new Promise((resolve) => {
+        api('listHypervisors').then(json => {
+          if (json?.listhypervisorsresponse?.hypervisor) {
+            for (const key in json.listhypervisorsresponse.hypervisor) {
+              const hypervisor = json.listhypervisorsresponse.hypervisor[key]
+              if (hypervisor.name === value) {
+                return resolve(hypervisor.name)
+              }
+            }
+          }
+          resolve(null)
+        }).catch(() => {
+          resolve(null)
+        })
+      })
+    },
+    getResourceNameById (apiName, responseKey1, responseKey2, id, field) {
+      return new Promise((resolve) => {
+        if (!this.$isValidUuid(id)) {
+          return resolve('')
+        }
+        api(apiName, { listAll: true, id: id }).then(json => {
+          const items = json && json[responseKey1] && json[responseKey1][responseKey2]
+          if (Array.isArray(items) && items.length > 0 && items[0] && items[0][field] !== undefined) {
+            resolve(items[0][field])
+          } else {
+            resolve('')
+          }
+        }).catch(() => {
+          resolve('')
+        })
+      })
+    },
+    getType (type) {
+      if (this.$route.path === '/alert') {
+        return this.getAlertType(type)
+      } else if (this.$route.path === '/affinitygroup') {
+        return this.getAffinityGroupType(type)
+      }
+    },
+    getAlertType (type) {
+      return new Promise((resolve) => {
+        api('listAlertTypes').then(json => {
+          const alertTypes = {}
+          for (const key in json.listalerttypesresponse.alerttype) {
+            const alerttype = json.listalerttypesresponse.alerttype[key]
+            alertTypes[alerttype.id] = alerttype.name
+          }
+          resolve(alertTypes[type])
+        }).catch(() => {
+          resolve(null)
+        })
+      })
+    },
+    getAffinityGroupType (type) {
+      return new Promise((resolve) => {
+        api('listAffinityGroupTypes').then(json => {
+          const alertTypes = {}
+          for (const key in json.listaffinitygrouptypesresponse.affinityGroupType) {
+            const affinityGroupType = json.listaffinitygrouptypesresponse.affinityGroupType[key]
+            if (affinityGroupType.type === 'host anti-affinity') {
+              alertTypes[affinityGroupType.type] = 'host anti-affinity (Strict)'
+            } else if (affinityGroupType.type === 'host affinity') {
+              alertTypes[affinityGroupType.type] = 'host affinity (Strict)'
+            } else if (affinityGroupType.type === 'non-strict host anti-affinity') {
+              alertTypes[affinityGroupType.type] = 'host anti-affinity (Non-Strict)'
+            } else if (affinityGroupType.type === 'non-strict host affinity') {
+              alertTypes[affinityGroupType.type] = 'host affinity (Non-Strict)'
+            }
+          }
+          this.alertTypes = alertTypes
+          resolve(alertTypes[type])
+        }).catch(() => {
+          resolve(null)
+        })
+      })
+    },
+    getGuestNetworkType (value) {
+      switch (value.toLowerCase()) {
+        case 'isolated':
+          return this.$t('label.isolated')
+        case 'shared':
+          return this.$t('label.shared')
+        case 'l2':
+          return this.$t('label.l2')
+      }
+    },
+    getAccountType (type) {
+      const types = []
+      if (this.apiName.indexOf('listAccounts') > -1) {
+        switch (type) {
+          case '1':
+            return 'Admin'
+          case '2':
+            return 'DomainAdmin'
+          case '0':
+            return 'User'
+        }
+      }
+      return types
+    },
+    getSystemVmType (type) {
+      if (this.apiName.indexOf('listSystemVms') > -1) {
+        switch (type.toLowerCase()) {
+          case 'consoleproxy':
+            return this.$t('label.console.proxy.vm')
+          case 'secondarystoragevm':
+            return this.$t('label.secondary.storage.vm')
+        }
+      }
+    },
+    getStoragePoolScope (scope) {
+      if (this.apiName.indexOf('listStoragePools') > -1) {
+        switch (scope.toUpperCase()) {
+          case 'CLUSTER':
+            return this.$t('label.cluster')
+          case 'ZONE':
+            return this.$t('label.zone')
+          case 'REGION':
+            return this.$t('label.region')
+          case 'GLOBAL':
+            return this.$t('label.global')
+        }
+      }
+    },
+    getImageStoreProvider (provider) {
+      if (this.apiName.indexOf('listImageStores') > -1) {
+        switch (provider.toUpperCase()) {
+          case 'NFS':
+            return 'NFS'
+          case 'SMB':
+            return 'SMB/CIFS'
+          case 'S3':
+            return 'S3'
+          case 'SWIFT':
+            return 'Swift'
+        }
+      }
+    },
+    getRoleType (role) {
+      switch (role.toLowerCase()) {
+        case 'Admin'.toLowerCase():
+          return 'Admin'
+        case 'ResourceAdmin'.toLowerCase():
+          return 'ResourceAdmin'
+        case 'DomainAdmin'.toLowerCase():
+          return 'DomainAdmin'
+        case 'User'.toLowerCase():
+          return 'User'
+      }
+    },
+    getScope (scope) {
+      switch (scope.toLowerCase()) {
+        case 'local':
+          return this.$t('label.local')
+        case 'domain':
+          return this.$t('label.domain')
+        case 'global':
+          return this.$t('label.global')
+      }
+    },
+    getState (state) {
+      if (this.apiName.includes('listVolumes')) {
+        switch (state.toLowerCase()) {
+          case 'allocated':
+            return this.$t('label.allocated')
+          case 'ready':
+            return this.$t('label.isready')
+          case 'destroy':
+            return this.$t('label.destroy')
+          case 'expunging':
+            return this.$t('label.expunging')
+          case 'expunged':
+            return this.$t('label.expunged')
+          case 'migrating':
+            return this.$t('label.migrating')
+        }
+      } else if (this.apiName.includes('listKubernetesClusters')) {
+        switch (state.toLowerCase()) {
+          case 'created':
+            return this.$t('label.created')
+          case 'starting':
+            return this.$t('label.starting')
+          case 'running':
+            return this.$t('label.running')
+          case 'stopping':
+            return this.$t('label.stopping')
+          case 'stopped':
+            return this.$t('label.stopped')
+          case 'scaling':
+            return this.$t('label.scaling')
+          case 'upgrading':
+            return this.$t('label.upgrading')
+          case 'alert':
+            return this.$t('label.alert')
+          case 'recovering':
+            return this.$t('label.recovering')
+          case 'destroyed':
+            return this.$t('label.destroyed')
+          case 'destroying':
+            return this.$t('label.destroying')
+          case 'error':
+            return this.$t('label.error')
+        }
+      } else if (this.apiName.indexOf('listWebhooks') > -1) {
+        switch (state.toLowerCase()) {
+          case 'enabled':
+            return this.$t('label.enabled')
+          case 'disabled':
+            return this.$t('label.disabled')
+        }
+      }
+    },
+    getEntityType (type) {
+      let entityType = ''
+      if (this.apiName.indexOf('listAnnotations') > -1) {
+        const allowedTypes = {
+          VM: 'Virtual Machine',
+          HOST: 'Host',
+          VOLUME: 'Volume',
+          SNAPSHOT: 'Snapshot',
+          VM_SNAPSHOT: 'VM Snapshot',
+          INSTANCE_GROUP: 'Instance Group',
+          NETWORK: 'Network',
+          VPC: 'VPC',
+          PUBLIC_IP_ADDRESS: 'Public IP Address',
+          VPN_CUSTOMER_GATEWAY: 'VPC Customer Gateway',
+          TEMPLATE: 'Template',
+          ISO: 'ISO',
+          SSH_KEYPAIR: 'SSH Key Pair',
+          DOMAIN: 'Domain',
+          SERVICE_OFFERING: 'Service Offering',
+          DISK_OFFERING: 'Disk Offering',
+          NETWORK_OFFERING: 'Network Offering',
+          POD: 'Pod',
+          ZONE: 'Zone',
+          CLUSTER: 'Cluster',
+          PRIMARY_STORAGE: 'Primary Storage',
+          SECONDARY_STORAGE: 'Secondary Storage',
+          VR: 'Virtual Router',
+          SYSTEM_VM: 'System VM',
+          KUBERNETES_CLUSTER: 'Kubernetes Cluster'
+        }
+        entityType = allowedTypes[type.toUpperCase()]
+      }
+      return entityType
+    },
+    getLevel (level) {
+      switch (level.toUpperCase()) {
+        case 'INFO':
+          return this.$t('label.info.upper')
+
+        case 'WARN':
+          return this.$t('label.warn.upper')
+
+        case 'ERROR':
+          return this.$t('label.error.upper')
+      }
+    }
+  }
+}
+</script>
diff --git a/ui/src/views/AutogenView.vue b/ui/src/views/AutogenView.vue
index a01e300c1c9a..6acc81d6a029 100644
--- a/ui/src/views/AutogenView.vue
+++ b/ui/src/views/AutogenView.vue
@@ -106,6 +106,16 @@
               @change-filter="changeFilter"/>
           </a-col>
         </a-row>
+        <a-row
+          v-if="!dataView && $config.showSearchFilters"
+          style="min-height: 36px; padding-top: 12px;"
+        >
+          <search-filter
+            :filters="getActiveFilters()"
+            :apiName="apiName"
+            @removeFilter="removeFilter"
+          />
+        </a-row>
       </a-card>
     </a-affix>
 
@@ -469,6 +479,7 @@ import ListView from '@/components/view/ListView'
 import ResourceView from '@/components/view/ResourceView'
 import ActionButton from '@/components/view/ActionButton'
 import SearchView from '@/components/view/SearchView'
+import SearchFilter from '@/components/view/SearchFilter'
 import OsLogo from '@/components/widgets/OsLogo'
 import ResourceIcon from '@/components/view/ResourceIcon'
 import BulkActionProgress from '@/components/view/BulkActionProgress'
@@ -482,6 +493,7 @@ export default {
     ListView,
     ActionButton,
     SearchView,
+    SearchFilter,
     BulkActionProgress,
     TooltipLabel,
     OsLogo,
@@ -1126,6 +1138,42 @@ export default {
       eventBus.emit('action-closing', { action: this.currentAction })
       this.closeAction()
     },
+    getActiveFilters () {
+      const queryParams = Object.assign({}, this.$route.query)
+      const activeFilters = []
+      for (const filter in queryParams) {
+        if (!filter.startsWith('tags[')) {
+          activeFilters.push({
+            key: filter,
+            value: queryParams[filter],
+            isTag: false
+          })
+        } else if (filter.endsWith('].key')) {
+          const tagIdx = filter.split('[')[1].split(']')[0]
+          const tagKey = queryParams[`tags[${tagIdx}].key`]
+          const tagValue = queryParams[`tags[${tagIdx}].value`]
+          activeFilters.push({
+            key: tagKey,
+            value: tagValue,
+            isTag: true,
+            tagIdx: tagIdx
+          })
+        }
+      }
+      return activeFilters
+    },
+    removeFilter (filter) {
+      const queryParams = Object.assign({}, this.$route.query)
+      if (filter.isTag) {
+        delete queryParams[`tags[${filter.tagIdx}].key`]
+        delete queryParams[`tags[${filter.tagIdx}].value`]
+      } else {
+        delete queryParams[filter.key]
+      }
+      queryParams.page = '1'
+      queryParams.pagesize = String(this.pageSize)
+      this.$router.push({ query: queryParams })
+    },
     onRowSelectionChange (selection) {
       this.selectedRowKeys = selection
       if (selection?.length > 0) {
diff --git a/ui/tests/unit/views/AutogenView.spec.js b/ui/tests/unit/views/AutogenView.spec.js
index eb0352f99d1e..05b565ab9c9c 100644
--- a/ui/tests/unit/views/AutogenView.spec.js
+++ b/ui/tests/unit/views/AutogenView.spec.js
@@ -113,6 +113,10 @@ store = common.createMockStore(state, actions, mutations)
 i18n = common.createMockI18n('en', mockData.messages)
 
 mocks = {
+  $config: {
+    showSearchFilters: true,
+    docBase: 'http://docs.cloudstack.apache.org/en/latest'
+  },
   $notifyError: jest.fn((error) => {
     return error
   }),

From a6ccde44c4bc3c2b4623aca6b55500a722144763 Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Thu, 29 Jan 2026 21:41:21 +0530
Subject: [PATCH 099/117] kvm: honour disk controller for vm during attach
 volume (#12452)

---
 .../resource/LibvirtComputingResource.java    |  11 +-
 .../hypervisor/kvm/resource/LibvirtVMDef.java |   9 ++
 .../kvm/storage/KVMStorageProcessor.java      | 121 ++++++++++--------
 3 files changed, 82 insertions(+), 59 deletions(-)

diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
index b66a838a3a52..c7b2747a777d 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
@@ -4371,12 +4371,11 @@ public DiskDef.DiskBus getDataDiskModelFromVMDetail(final VirtualMachineTO vmTO)
 
         String dataDiskController = details.get(VmDetailConstants.DATA_DISK_CONTROLLER);
         if (StringUtils.isNotBlank(dataDiskController)) {
-            LOGGER.debug("Passed custom disk controller for DATA disk " + dataDiskController);
-            for (DiskDef.DiskBus bus : DiskDef.DiskBus.values()) {
-                if (bus.toString().equalsIgnoreCase(dataDiskController)) {
-                    LOGGER.debug("Found matching enum for disk controller for DATA disk " + dataDiskController);
-                    return bus;
-                }
+            LOGGER.debug("Passed custom disk controller for DATA disk {}", dataDiskController);
+            DiskDef.DiskBus bus = DiskDef.DiskBus.fromValue(dataDiskController);
+            if (bus != null) {
+                LOGGER.debug("Found matching enum for disk controller for DATA disk {}", dataDiskController);
+                return bus;
             }
         }
         return null;
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtVMDef.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtVMDef.java
index a38e7a02357c..696e71bea80c 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtVMDef.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtVMDef.java
@@ -686,6 +686,15 @@ public enum DiskBus {
                 _bus = bus;
             }
 
+            public static DiskBus fromValue(String bus) {
+                for (DiskBus b : DiskBus.values()) {
+                    if (b.toString().equalsIgnoreCase(bus)) {
+                        return b;
+                    }
+                }
+                return null;
+            }
+
             @Override
             public String toString() {
                 return _bus;
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java
index 33bd41ee6ba3..87ca531bb74f 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java
@@ -1320,26 +1320,27 @@ protected boolean checkDetachSuccess(String diskPath, Domain dm) throws LibvirtE
 
     /**
      * Attaches or detaches a disk to an instance.
-     * @param conn libvirt connection
-     * @param attach boolean that determines whether the device will be attached or detached
-     * @param vmName instance name
-     * @param attachingDisk kvm physical disk
-     * @param devId device id in instance
+     * @param conn                    libvirt connection
+     * @param attach                  boolean that determines whether the device will be attached or detached
+     * @param vmName                  instance name
+     * @param attachingDisk           kvm physical disk
+     * @param devId                   device id in instance
      * @param serial
-     * @param bytesReadRate bytes read rate
-     * @param bytesReadRateMax bytes read rate max
-     * @param bytesReadRateMaxLength bytes read rate max length
-     * @param bytesWriteRate bytes write rate
-     * @param bytesWriteRateMax bytes write rate amx
+     * @param bytesReadRate           bytes read rate
+     * @param bytesReadRateMax        bytes read rate max
+     * @param bytesReadRateMaxLength  bytes read rate max length
+     * @param bytesWriteRate          bytes write rate
+     * @param bytesWriteRateMax       bytes write rate amx
      * @param bytesWriteRateMaxLength bytes write rate max length
-     * @param iopsReadRate iops read rate
-     * @param iopsReadRateMax iops read rate max
-     * @param iopsReadRateMaxLength iops read rate max length
-     * @param iopsWriteRate iops write rate
-     * @param iopsWriteRateMax iops write rate max
-     * @param iopsWriteRateMaxLength iops write rate max length
-     * @param cacheMode cache mode
-     * @param encryptDetails encrypt details
+     * @param iopsReadRate            iops read rate
+     * @param iopsReadRateMax         iops read rate max
+     * @param iopsReadRateMaxLength   iops read rate max length
+     * @param iopsWriteRate           iops write rate
+     * @param iopsWriteRateMax        iops write rate max
+     * @param iopsWriteRateMaxLength  iops write rate max length
+     * @param cacheMode               cache mode
+     * @param encryptDetails          encrypt details
+     * @param controllerInfo
      * @throws LibvirtException
      * @throws InternalErrorException
      */
@@ -1347,37 +1348,38 @@ protected synchronized void attachOrDetachDisk(final Connect conn, final boolean
                                                    final String serial, final Long bytesReadRate, final Long bytesReadRateMax, final Long bytesReadRateMaxLength,
                                                    final Long bytesWriteRate, final Long bytesWriteRateMax, final Long bytesWriteRateMaxLength, final Long iopsReadRate,
                                                    final Long iopsReadRateMax, final Long iopsReadRateMaxLength, final Long iopsWriteRate, final Long iopsWriteRateMax,
-                                                   final Long iopsWriteRateMaxLength, final String cacheMode, final DiskDef.LibvirtDiskEncryptDetails encryptDetails, Map<String, String> details)
+                                                   final Long iopsWriteRateMaxLength, final String cacheMode, final DiskDef.LibvirtDiskEncryptDetails encryptDetails, Map<String, String> details, Map<String, String> controllerInfo)
             throws LibvirtException, InternalErrorException {
         attachOrDetachDisk(conn, attach, vmName, attachingDisk, devId, serial, bytesReadRate, bytesReadRateMax, bytesReadRateMaxLength,
                 bytesWriteRate, bytesWriteRateMax, bytesWriteRateMaxLength, iopsReadRate, iopsReadRateMax, iopsReadRateMaxLength, iopsWriteRate,
-                iopsWriteRateMax, iopsWriteRateMaxLength, cacheMode, encryptDetails, 0l, details);
+                iopsWriteRateMax, iopsWriteRateMaxLength, cacheMode, encryptDetails, 0l, details, controllerInfo);
     }
 
     /**
      *
      * Attaches or detaches a disk to an instance.
-     * @param conn libvirt connection
-     * @param attach boolean that determines whether the device will be attached or detached
-     * @param vmName instance name
-     * @param attachingDisk kvm physical disk
-     * @param devId device id in instance
+     * @param conn                    libvirt connection
+     * @param attach                  boolean that determines whether the device will be attached or detached
+     * @param vmName                  instance name
+     * @param attachingDisk           kvm physical disk
+     * @param devId                   device id in instance
      * @param serial
-     * @param bytesReadRate bytes read rate
-     * @param bytesReadRateMax bytes read rate max
-     * @param bytesReadRateMaxLength bytes read rate max length
-     * @param bytesWriteRate bytes write rate
-     * @param bytesWriteRateMax bytes write rate amx
+     * @param bytesReadRate           bytes read rate
+     * @param bytesReadRateMax        bytes read rate max
+     * @param bytesReadRateMaxLength  bytes read rate max length
+     * @param bytesWriteRate          bytes write rate
+     * @param bytesWriteRateMax       bytes write rate amx
      * @param bytesWriteRateMaxLength bytes write rate max length
-     * @param iopsReadRate iops read rate
-     * @param iopsReadRateMax iops read rate max
-     * @param iopsReadRateMaxLength iops read rate max length
-     * @param iopsWriteRate iops write rate
-     * @param iopsWriteRateMax iops write rate max
-     * @param iopsWriteRateMaxLength iops write rate max length
-     * @param cacheMode cache mode
-     * @param encryptDetails encrypt details
-     * @param waitDetachDevice value set in milliseconds to wait before assuming device removal failed
+     * @param iopsReadRate            iops read rate
+     * @param iopsReadRateMax         iops read rate max
+     * @param iopsReadRateMaxLength   iops read rate max length
+     * @param iopsWriteRate           iops write rate
+     * @param iopsWriteRateMax        iops write rate max
+     * @param iopsWriteRateMaxLength  iops write rate max length
+     * @param cacheMode               cache mode
+     * @param encryptDetails          encrypt details
+     * @param waitDetachDevice        value set in milliseconds to wait before assuming device removal failed
+     * @param controllerInfo
      * @throws LibvirtException
      * @throws InternalErrorException
      */
@@ -1386,7 +1388,7 @@ protected synchronized void attachOrDetachDisk(final Connect conn, final boolean
                                                    final Long bytesWriteRate, final Long bytesWriteRateMax, final Long bytesWriteRateMaxLength, final Long iopsReadRate,
                                                    final Long iopsReadRateMax, final Long iopsReadRateMaxLength, final Long iopsWriteRate, final Long iopsWriteRateMax,
                                                    final Long iopsWriteRateMaxLength, final String cacheMode, final DiskDef.LibvirtDiskEncryptDetails encryptDetails,
-                                                   long waitDetachDevice, Map<String, String> details)
+                                                   long waitDetachDevice, Map<String, String> details, Map<String, String> controllerInfo)
             throws LibvirtException, InternalErrorException {
 
         List<DiskDef> disks = null;
@@ -1423,17 +1425,7 @@ protected synchronized void attachOrDetachDisk(final Connect conn, final boolean
                     return;
                 }
             } else {
-                DiskDef.DiskBus busT = DiskDef.DiskBus.VIRTIO;
-                for (final DiskDef disk : disks) {
-                    if (disk.getDeviceType() == DeviceType.DISK) {
-                        if (disk.getBusType() == DiskDef.DiskBus.SCSI) {
-                            busT = DiskDef.DiskBus.SCSI;
-                        } else if (disk.getBusType() == DiskDef.DiskBus.VIRTIOBLK) {
-                            busT = DiskDef.DiskBus.VIRTIOBLK;
-                        }
-                        break;
-                    }
-                }
+                DiskDef.DiskBus busT = getAttachDiskBusType(devId, disks, controllerInfo);
                 diskdef = new DiskDef();
                 if (busT == DiskDef.DiskBus.SCSI || busT == DiskDef.DiskBus.VIRTIOBLK) {
                     diskdef.setQemuDriver(true);
@@ -1538,6 +1530,28 @@ protected synchronized void attachOrDetachDisk(final Connect conn, final boolean
         }
     }
 
+    protected DiskDef.DiskBus getAttachDiskBusType(int deviceId, List<DiskDef> disks, Map<String, String> controllerInfo) {
+        String controllerKey = deviceId == 0 ? VmDetailConstants.ROOT_DISK_CONTROLLER : VmDetailConstants.DATA_DISK_CONTROLLER;
+        String diskController = MapUtils.getString(controllerInfo, controllerKey);
+        DiskDef.DiskBus busType = DiskDef.DiskBus.fromValue(diskController);
+        if (diskController != null) {
+            logger.debug("Using controller '{}' from command specified as {} while attaching disk (deviceId={})",
+                    diskController, controllerKey, deviceId);
+            return busType;
+        }
+        for (final DiskDef disk : disks) {
+            if (disk.getDeviceType() != DeviceType.DISK) {
+                continue;
+            }
+            if (disk.getBusType() == DiskDef.DiskBus.SCSI) {
+                return DiskDef.DiskBus.SCSI;
+            } else if (disk.getBusType() == DiskDef.DiskBus.VIRTIOBLK) {
+                return DiskDef.DiskBus.VIRTIOBLK;
+            }
+        }
+        return DiskDef.DiskBus.VIRTIO;
+    }
+
     @Override
     public Answer attachVolume(final AttachCommand cmd) {
         final DiskTO disk = cmd.getDisk();
@@ -1565,7 +1579,8 @@ public Answer attachVolume(final AttachCommand cmd) {
                     vol.getBytesReadRate(), vol.getBytesReadRateMax(), vol.getBytesReadRateMaxLength(),
                     vol.getBytesWriteRate(), vol.getBytesWriteRateMax(), vol.getBytesWriteRateMaxLength(),
                     vol.getIopsReadRate(), vol.getIopsReadRateMax(), vol.getIopsReadRateMaxLength(),
-                    vol.getIopsWriteRate(), vol.getIopsWriteRateMax(), vol.getIopsWriteRateMaxLength(), volCacheMode, encryptDetails, disk.getDetails());
+                    vol.getIopsWriteRate(), vol.getIopsWriteRateMax(), vol.getIopsWriteRateMaxLength(), volCacheMode,
+                    encryptDetails, disk.getDetails(), cmd.getControllerInfo());
 
             return new AttachAnswer(disk);
         } catch (final LibvirtException e) {
@@ -1602,7 +1617,7 @@ public Answer dettachVolume(final DettachCommand cmd) {
                     vol.getBytesReadRate(), vol.getBytesReadRateMax(), vol.getBytesReadRateMaxLength(),
                     vol.getBytesWriteRate(), vol.getBytesWriteRateMax(), vol.getBytesWriteRateMaxLength(),
                     vol.getIopsReadRate(), vol.getIopsReadRateMax(), vol.getIopsReadRateMaxLength(),
-                    vol.getIopsWriteRate(), vol.getIopsWriteRateMax(), vol.getIopsWriteRateMaxLength(), volCacheMode, null, waitDetachDevice, null);
+                    vol.getIopsWriteRate(), vol.getIopsWriteRateMax(), vol.getIopsWriteRateMaxLength(), volCacheMode, null, waitDetachDevice, null, null);
 
             storagePoolMgr.disconnectPhysicalDisk(primaryStore.getPoolType(), primaryStore.getUuid(), vol.getPath());
 

From d7bdbcc4ed7a9b71ea7581c30b83e36ea3571a8e Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Fri, 30 Jan 2026 10:05:50 +0530
Subject: [PATCH 100/117] pre-commit: fix inconsistent license (#12551)

Fix inconsistent license with UI .vue file.

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
---
 ui/src/views/network/ImportNetworkACL.vue | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/ui/src/views/network/ImportNetworkACL.vue b/ui/src/views/network/ImportNetworkACL.vue
index 2456a75af45d..cb0c4a404ef5 100644
--- a/ui/src/views/network/ImportNetworkACL.vue
+++ b/ui/src/views/network/ImportNetworkACL.vue
@@ -1,17 +1,17 @@
 // Licensed to the Apache Software Foundation (ASF) under one
-// or more contributor license agreements. See the NOTICE file
+// or more contributor license agreements.  See the NOTICE file
 // distributed with this work for additional information
-// regarding copyright ownership. The ASF licenses this file
+// regarding copyright ownership.  The ASF licenses this file
 // to you under the Apache License, Version 2.0 (the
 // "License"); you may not use this file except in compliance
-// with the License. You may obtain a copy of the License at
+// with the License.  You may obtain a copy of the License at
 //
-// http://www.apache.org/licenses/LICENSE-2.0
+//   http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing,
 // software distributed under the License is distributed on an
 // "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied. See the License for the
+// KIND, either express or implied.  See the License for the
 // specific language governing permissions and limitations
 // under the License.
 

From bb8e7d39e6efc0a68f3536b607df6b5c2a01946e Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Fri, 30 Jan 2026 12:11:25 +0530
Subject: [PATCH 101/117] api,server: allow configuring repetitive alerts
 (#11325)

* api,server: allow configuring repetitive alerts

Fixes #6613

Introduces support for configuring additional alert types that can be published repeatedly, beyond the default set.

Operators can now use the dynamic configuration `alert.allowed.repetitive.types` to specify a comma-separated list of alert type names that should be allowed for repetitive publication.

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* add tests

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* fix

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* test fix

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* allow repetition for custom alerts

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* remove refactoring

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

---------

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
---
 .../apache/cloudstack/alert/AlertService.java | 44 +++++----
 .../apache/cloudstack/api/ApiConstants.java   |  1 +
 .../admin/resource/ListAlertTypesCmd.java     | 12 ++-
 .../api/response/AlertTypeResponse.java       | 12 ++-
 .../java/com/cloud/alert/AlertManager.java    |  4 +
 .../com/cloud/alert/AlertManagerImpl.java     | 72 +++++++++-----
 .../com/cloud/alert/AlertManagerImplTest.java | 98 +++++++++++++++++--
 7 files changed, 187 insertions(+), 56 deletions(-)

diff --git a/api/src/main/java/org/apache/cloudstack/alert/AlertService.java b/api/src/main/java/org/apache/cloudstack/alert/AlertService.java
index c051ebb2da20..fcc87908bd5d 100644
--- a/api/src/main/java/org/apache/cloudstack/alert/AlertService.java
+++ b/api/src/main/java/org/apache/cloudstack/alert/AlertService.java
@@ -24,18 +24,24 @@
 
 public interface AlertService {
     public static class AlertType {
-        private static Set<AlertType> defaultAlertTypes = new HashSet<AlertType>();
+        private static final Set<AlertType> defaultAlertTypes = new HashSet<>();
         private final String name;
         private final short type;
+        private final boolean repetitionAllowed;
 
-        private AlertType(short type, String name, boolean isDefault) {
+        private AlertType(short type, String name, boolean isDefault, boolean repetitionAllowed) {
             this.name = name;
             this.type = type;
+            this.repetitionAllowed = repetitionAllowed;
             if (isDefault) {
                 defaultAlertTypes.add(this);
             }
         }
 
+        private AlertType(short type, String name, boolean isDefault) {
+            this(type, name, isDefault, false);
+        }
+
         public static final AlertType ALERT_TYPE_MEMORY = new AlertType(Capacity.CAPACITY_TYPE_MEMORY, "ALERT.MEMORY", true);
         public static final AlertType ALERT_TYPE_CPU = new AlertType(Capacity.CAPACITY_TYPE_CPU, "ALERT.CPU", true);
         public static final AlertType ALERT_TYPE_STORAGE = new AlertType(Capacity.CAPACITY_TYPE_STORAGE, "ALERT.STORAGE", true);
@@ -45,36 +51,36 @@ private AlertType(short type, String name, boolean isDefault) {
         public static final AlertType ALERT_TYPE_VIRTUAL_NETWORK_IPV6_SUBNET = new AlertType(Capacity.CAPACITY_TYPE_VIRTUAL_NETWORK_IPV6_SUBNET, "ALERT.NETWORK.IPV6SUBNET", true);
         public static final AlertType ALERT_TYPE_PRIVATE_IP = new AlertType(Capacity.CAPACITY_TYPE_PRIVATE_IP, "ALERT.NETWORK.PRIVATEIP", true);
         public static final AlertType ALERT_TYPE_SECONDARY_STORAGE = new AlertType(Capacity.CAPACITY_TYPE_SECONDARY_STORAGE, "ALERT.STORAGE.SECONDARY", true);
-        public static final AlertType ALERT_TYPE_HOST = new AlertType((short)7, "ALERT.COMPUTE.HOST", true);
-        public static final AlertType ALERT_TYPE_USERVM = new AlertType((short)8, "ALERT.USERVM", true);
-        public static final AlertType ALERT_TYPE_DOMAIN_ROUTER = new AlertType((short)9, "ALERT.SERVICE.DOMAINROUTER", true);
-        public static final AlertType ALERT_TYPE_CONSOLE_PROXY = new AlertType((short)10, "ALERT.SERVICE.CONSOLEPROXY", true);
+        public static final AlertType ALERT_TYPE_HOST = new AlertType((short)7, "ALERT.COMPUTE.HOST", true, true);
+        public static final AlertType ALERT_TYPE_USERVM = new AlertType((short)8, "ALERT.USERVM", true, true);
+        public static final AlertType ALERT_TYPE_DOMAIN_ROUTER = new AlertType((short)9, "ALERT.SERVICE.DOMAINROUTER", true, true);
+        public static final AlertType ALERT_TYPE_CONSOLE_PROXY = new AlertType((short)10, "ALERT.SERVICE.CONSOLEPROXY", true, true);
         public static final AlertType ALERT_TYPE_ROUTING = new AlertType((short)11, "ALERT.NETWORK.ROUTING", true);
-        public static final AlertType ALERT_TYPE_STORAGE_MISC = new AlertType((short)12, "ALERT.STORAGE.MISC", true);
+        public static final AlertType ALERT_TYPE_STORAGE_MISC = new AlertType((short)12, "ALERT.STORAGE.MISC", true, true);
         public static final AlertType ALERT_TYPE_USAGE_SERVER = new AlertType((short)13, "ALERT.USAGE", true);
-        public static final AlertType ALERT_TYPE_MANAGEMENT_NODE = new AlertType((short)14, "ALERT.MANAGEMENT", true);
+        public static final AlertType ALERT_TYPE_MANAGEMENT_NODE = new AlertType((short)14, "ALERT.MANAGEMENT", true, true);
         public static final AlertType ALERT_TYPE_DOMAIN_ROUTER_MIGRATE = new AlertType((short)15, "ALERT.NETWORK.DOMAINROUTERMIGRATE", true);
         public static final AlertType ALERT_TYPE_CONSOLE_PROXY_MIGRATE = new AlertType((short)16, "ALERT.SERVICE.CONSOLEPROXYMIGRATE", true);
         public static final AlertType ALERT_TYPE_USERVM_MIGRATE = new AlertType((short)17, "ALERT.USERVM.MIGRATE", true);
         public static final AlertType ALERT_TYPE_VLAN = new AlertType((short)18, "ALERT.NETWORK.VLAN", true);
-        public static final AlertType ALERT_TYPE_SSVM = new AlertType((short)19, "ALERT.SERVICE.SSVM", true);
+        public static final AlertType ALERT_TYPE_SSVM = new AlertType((short)19, "ALERT.SERVICE.SSVM", true, true);
         public static final AlertType ALERT_TYPE_USAGE_SERVER_RESULT = new AlertType((short)20, "ALERT.USAGE.RESULT", true);
         public static final AlertType ALERT_TYPE_STORAGE_DELETE = new AlertType((short)21, "ALERT.STORAGE.DELETE", true);
         public static final AlertType ALERT_TYPE_UPDATE_RESOURCE_COUNT = new AlertType((short)22, "ALERT.RESOURCE.COUNT", true);
         public static final AlertType ALERT_TYPE_USAGE_SANITY_RESULT = new AlertType((short)23, "ALERT.USAGE.SANITY", true);
         public static final AlertType ALERT_TYPE_DIRECT_ATTACHED_PUBLIC_IP = new AlertType((short)24, "ALERT.NETWORK.DIRECTPUBLICIP", true);
         public static final AlertType ALERT_TYPE_LOCAL_STORAGE = new AlertType((short)25, "ALERT.STORAGE.LOCAL", true);
-        public static final AlertType ALERT_TYPE_RESOURCE_LIMIT_EXCEEDED = new AlertType((short)26, "ALERT.RESOURCE.EXCEED", true);
+        public static final AlertType ALERT_TYPE_RESOURCE_LIMIT_EXCEEDED = new AlertType((short)26, "ALERT.RESOURCE.EXCEED", true, true);
         public static final AlertType ALERT_TYPE_SYNC = new AlertType((short)27, "ALERT.TYPE.SYNC", true);
-        public static final AlertType ALERT_TYPE_UPLOAD_FAILED = new AlertType((short)28, "ALERT.UPLOAD.FAILED", true);
-        public static final AlertType ALERT_TYPE_OOBM_AUTH_ERROR = new AlertType((short)29, "ALERT.OOBM.AUTHERROR", true);
-        public static final AlertType ALERT_TYPE_HA_ACTION = new AlertType((short)30, "ALERT.HA.ACTION", true);
-        public static final AlertType ALERT_TYPE_CA_CERT = new AlertType((short)31, "ALERT.CA.CERT", true);
+        public static final AlertType ALERT_TYPE_UPLOAD_FAILED = new AlertType((short)28, "ALERT.UPLOAD.FAILED", true, true);
+        public static final AlertType ALERT_TYPE_OOBM_AUTH_ERROR = new AlertType((short)29, "ALERT.OOBM.AUTHERROR", true, true);
+        public static final AlertType ALERT_TYPE_HA_ACTION = new AlertType((short)30, "ALERT.HA.ACTION", true, true);
+        public static final AlertType ALERT_TYPE_CA_CERT = new AlertType((short)31, "ALERT.CA.CERT", true, true);
         public static final AlertType ALERT_TYPE_VM_SNAPSHOT = new AlertType((short)32, "ALERT.VM.SNAPSHOT", true);
         public static final AlertType ALERT_TYPE_VR_PUBLIC_IFACE_MTU = new AlertType((short)33, "ALERT.VR.PUBLIC.IFACE.MTU", true);
         public static final AlertType ALERT_TYPE_VR_PRIVATE_IFACE_MTU = new AlertType((short)34, "ALERT.VR.PRIVATE.IFACE.MTU", true);
-        public static final AlertType ALERT_TYPE_EXTENSION_PATH_NOT_READY = new AlertType((short)33, "ALERT.TYPE.EXTENSION.PATH.NOT.READY", true);
-        public static final AlertType ALERT_TYPE_VPN_GATEWAY_OBSOLETE_PARAMETERS = new AlertType((short)34, "ALERT.S2S.VPN.GATEWAY.OBSOLETE.PARAMETERS", true);
+        public static final AlertType ALERT_TYPE_EXTENSION_PATH_NOT_READY = new AlertType((short)33, "ALERT.TYPE.EXTENSION.PATH.NOT.READY", true, true);
+        public static final AlertType ALERT_TYPE_VPN_GATEWAY_OBSOLETE_PARAMETERS = new AlertType((short)34, "ALERT.S2S.VPN.GATEWAY.OBSOLETE.PARAMETERS", true, true);
         public static final AlertType ALERT_TYPE_BACKUP_STORAGE = new AlertType(Capacity.CAPACITY_TYPE_BACKUP_STORAGE, "ALERT.STORAGE.BACKUP", true);
         public static final AlertType ALERT_TYPE_OBJECT_STORAGE = new AlertType(Capacity.CAPACITY_TYPE_OBJECT_STORAGE, "ALERT.STORAGE.OBJECT", true);
 
@@ -86,6 +92,10 @@ public String getName() {
             return name;
         }
 
+        public boolean isRepetitionAllowed() {
+            return repetitionAllowed;
+        }
+
         private static AlertType getAlertType(short type) {
             for (AlertType alertType : defaultAlertTypes) {
                 if (alertType.getType() == type) {
@@ -109,7 +119,7 @@ public static AlertType generateAlert(short type, String name) {
             if (defaultAlert != null && !defaultAlert.getName().equalsIgnoreCase(name)) {
                 throw new InvalidParameterValueException("There is a default alert having type " + type + " and name " + defaultAlert.getName());
             } else {
-                return new AlertType(type, name, false);
+                return new AlertType(type, name, false, false);
             }
         }
     }
diff --git a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
index d00e339de2fd..790070e5244b 100644
--- a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
+++ b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
@@ -503,6 +503,7 @@ public class ApiConstants {
     public static final String RECONNECT = "reconnect";
     public static final String RECOVER = "recover";
     public static final String REPAIR = "repair";
+    public static final String REPETITION_ALLOWED = "repetitionallowed";
     public static final String REQUIRES_HVM = "requireshvm";
     public static final String RESOURCES = "resources";
     public static final String RESOURCE_COUNT = "resourcecount";
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/resource/ListAlertTypesCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/resource/ListAlertTypesCmd.java
index e7bfbdbc6254..dcd4f2c89ef2 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/resource/ListAlertTypesCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/resource/ListAlertTypesCmd.java
@@ -16,7 +16,10 @@
 // under the License.
 package org.apache.cloudstack.api.command.admin.resource;
 
-import com.cloud.user.Account;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Set;
+
 import org.apache.cloudstack.alert.AlertService;
 import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.BaseCmd;
@@ -24,9 +27,7 @@
 import org.apache.cloudstack.api.response.AlertTypeResponse;
 import org.apache.cloudstack.api.response.ListResponse;
 
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Set;
+import com.cloud.user.Account;
 
 @APICommand(name = "listAlertTypes", description = "Lists all alerts types", responseObject = AlertResponse.class,
         requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
@@ -43,7 +44,8 @@ public void execute() {
         ListResponse<AlertTypeResponse> response = new ListResponse<>();
         List<AlertTypeResponse> typeResponseList = new ArrayList<>();
         for (AlertService.AlertType alertType : result) {
-            AlertTypeResponse alertResponse = new AlertTypeResponse(alertType.getType(), alertType.getName());
+            AlertTypeResponse alertResponse = new AlertTypeResponse(alertType.getType(), alertType.getName(),
+                    alertType.isRepetitionAllowed());
             alertResponse.setObjectName("alerttype");
             typeResponseList.add(alertResponse);
         }
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/AlertTypeResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/AlertTypeResponse.java
index 3f91cde01788..e8c3cf6c4ac7 100644
--- a/api/src/main/java/org/apache/cloudstack/api/response/AlertTypeResponse.java
+++ b/api/src/main/java/org/apache/cloudstack/api/response/AlertTypeResponse.java
@@ -16,11 +16,12 @@
 // under the License.
 package org.apache.cloudstack.api.response;
 
-import com.cloud.serializer.Param;
-import com.google.gson.annotations.SerializedName;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.BaseResponse;
 
+import com.cloud.serializer.Param;
+import com.google.gson.annotations.SerializedName;
+
 public class AlertTypeResponse extends BaseResponse {
 
     @SerializedName("alerttypeid")
@@ -31,6 +32,10 @@ public class AlertTypeResponse extends BaseResponse {
     @Param(description = "description of alert type")
     private String name;
 
+    @SerializedName(ApiConstants.REPETITION_ALLOWED)
+    @Param(description = "Whether repetitive alerts allowed for the alert type", since = "4.22.0")
+    private boolean repetitionAllowed = true;
+
     public String getName() {
         return name;
     }
@@ -47,9 +52,10 @@ public void setUsageType(short alertType) {
         this.alertType = alertType;
     }
 
-    public AlertTypeResponse(short alertType, String name) {
+    public AlertTypeResponse(short alertType, String name, boolean repetitionAllowed) {
         this.alertType = alertType;
         this.name = name;
+        this.repetitionAllowed = repetitionAllowed;
         setObjectName("alerttype");
     }
 }
diff --git a/engine/components-api/src/main/java/com/cloud/alert/AlertManager.java b/engine/components-api/src/main/java/com/cloud/alert/AlertManager.java
index 7fe19c3ba9f8..46993b066a49 100644
--- a/engine/components-api/src/main/java/com/cloud/alert/AlertManager.java
+++ b/engine/components-api/src/main/java/com/cloud/alert/AlertManager.java
@@ -49,6 +49,10 @@ public interface AlertManager extends Manager, AlertService {
             "Percentage (as a value between 0 and 1) of guest network IPv6 subnet utilization above which alerts will be sent.",
             true);
 
+    ConfigKey<String> AllowedRepetitiveAlertTypes = new ConfigKey<>(ConfigKey.CATEGORY_ALERT, String.class,
+            "alert.allowed.repetitive.types", "",
+            "Comma-separated list of alert types (by name) that can be sent multiple times", true);
+
     void clearAlert(AlertType alertType, long dataCenterId, long podId);
 
     void recalculateCapacity();
diff --git a/server/src/main/java/com/cloud/alert/AlertManagerImpl.java b/server/src/main/java/com/cloud/alert/AlertManagerImpl.java
index 308c4443cb8b..27b445ba3769 100644
--- a/server/src/main/java/com/cloud/alert/AlertManagerImpl.java
+++ b/server/src/main/java/com/cloud/alert/AlertManagerImpl.java
@@ -19,7 +19,6 @@
 import java.io.UnsupportedEncodingException;
 import java.text.DecimalFormat;
 import java.util.ArrayList;
-import java.util.Arrays;
 import java.util.Date;
 import java.util.HashMap;
 import java.util.HashSet;
@@ -37,15 +36,12 @@
 import javax.mail.MessagingException;
 import javax.naming.ConfigurationException;
 
-import com.cloud.dc.DataCenter;
-import com.cloud.dc.Pod;
-import com.cloud.org.Cluster;
-
 import org.apache.cloudstack.backup.BackupManager;
 import org.apache.cloudstack.framework.config.ConfigDepot;
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.framework.config.Configurable;
 import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
+import org.apache.cloudstack.framework.messagebus.MessageBus;
 import org.apache.cloudstack.managed.context.ManagedContextTimerTask;
 import org.apache.cloudstack.storage.datastore.db.ObjectStoreDao;
 import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
@@ -54,6 +50,7 @@
 import org.apache.cloudstack.utils.mailing.SMTPMailProperties;
 import org.apache.cloudstack.utils.mailing.SMTPMailSender;
 import org.apache.commons.lang3.ArrayUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.math.NumberUtils;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
@@ -70,9 +67,11 @@
 import com.cloud.configuration.Config;
 import com.cloud.configuration.ConfigurationManager;
 import com.cloud.dc.ClusterVO;
+import com.cloud.dc.DataCenter;
 import com.cloud.dc.DataCenter.NetworkType;
 import com.cloud.dc.DataCenterVO;
 import com.cloud.dc.HostPodVO;
+import com.cloud.dc.Pod;
 import com.cloud.dc.Vlan.VlanType;
 import com.cloud.dc.dao.ClusterDao;
 import com.cloud.dc.dao.DataCenterDao;
@@ -86,10 +85,12 @@
 import com.cloud.host.dao.HostDao;
 import com.cloud.network.Ipv6Service;
 import com.cloud.network.dao.IPAddressDao;
+import com.cloud.org.Cluster;
 import com.cloud.org.Grouping.AllocationState;
 import com.cloud.resource.ResourceManager;
 import com.cloud.storage.StorageManager;
 import com.cloud.utils.Pair;
+import com.cloud.utils.Ternary;
 import com.cloud.utils.component.ManagerBase;
 import com.cloud.utils.concurrency.NamedThreadFactory;
 import com.cloud.utils.db.SearchCriteria;
@@ -100,21 +101,6 @@
 public class AlertManagerImpl extends ManagerBase implements AlertManager, Configurable {
     protected Logger logger = LogManager.getLogger(AlertManagerImpl.class.getName());
 
-    public static final List<AlertType> ALERTS = Arrays.asList(AlertType.ALERT_TYPE_HOST
-            , AlertType.ALERT_TYPE_USERVM
-            , AlertType.ALERT_TYPE_DOMAIN_ROUTER
-            , AlertType.ALERT_TYPE_CONSOLE_PROXY
-            , AlertType.ALERT_TYPE_SSVM
-            , AlertType.ALERT_TYPE_STORAGE_MISC
-            , AlertType.ALERT_TYPE_MANAGEMENT_NODE
-            , AlertType.ALERT_TYPE_RESOURCE_LIMIT_EXCEEDED
-            , AlertType.ALERT_TYPE_UPLOAD_FAILED
-            , AlertType.ALERT_TYPE_OOBM_AUTH_ERROR
-            , AlertType.ALERT_TYPE_HA_ACTION
-            , AlertType.ALERT_TYPE_CA_CERT
-            , AlertType.ALERT_TYPE_EXTENSION_PATH_NOT_READY
-            , AlertType.ALERT_TYPE_VPN_GATEWAY_OBSOLETE_PARAMETERS);
-
     private static final long INITIAL_CAPACITY_CHECK_DELAY = 30L * 1000L; // Thirty seconds expressed in milliseconds.
 
     private static final DecimalFormat DfPct = new DecimalFormat("###.##");
@@ -156,6 +142,8 @@ public class AlertManagerImpl extends ManagerBase implements AlertManager, Confi
     Ipv6Service ipv6Service;
     @Inject
     HostDao hostDao;
+    @Inject
+    MessageBus messageBus;
 
     private Timer _timer = null;
     private long _capacityCheckPeriod = 60L * 60L * 1000L; // One hour by default.
@@ -175,6 +163,8 @@ public class AlertManagerImpl extends ManagerBase implements AlertManager, Confi
     protected String[] recipients = null;
     protected String senderAddress = null;
 
+    private final List<String> allowedRepetitiveAlertTypeNames = new ArrayList<>();
+
     public AlertManagerImpl() {
         _executor = Executors.newCachedThreadPool(new NamedThreadFactory("Email-Alerts-Sender"));
     }
@@ -254,12 +244,32 @@ public boolean configure(String name, Map<String, Object> params) throws Configu
                 _capacityCheckPeriod = Long.parseLong(Config.CapacityCheckPeriod.getDefaultValue());
             }
         }
+        initMessageBusListener();
+        setupRepetitiveAlertTypes();
 
         _timer = new Timer("CapacityChecker");
 
         return true;
     }
 
+    protected void setupRepetitiveAlertTypes() {
+        allowedRepetitiveAlertTypeNames.clear();
+        String allowedRepetitiveAlertsStr = AllowedRepetitiveAlertTypes.value();
+        logger.trace("Allowed repetitive alert types specified by {}: {} ", AllowedRepetitiveAlertTypes.key(),
+                allowedRepetitiveAlertsStr);
+        if (StringUtils.isBlank(allowedRepetitiveAlertsStr)) {
+            return;
+        }
+        String[] allowedRepetitiveAlertTypesArray = allowedRepetitiveAlertsStr.split(",");
+        for (String allowedTypeName : allowedRepetitiveAlertTypesArray) {
+            if (StringUtils.isBlank(allowedTypeName)) {
+                continue;
+            }
+            allowedRepetitiveAlertTypeNames.add(allowedTypeName.toLowerCase());
+        }
+        logger.trace("{} alert types specified for repetitive alerts", allowedRepetitiveAlertTypeNames.size());
+    }
+
     @Override
     public boolean start() {
         _timer.schedule(new CapacityChecker(), INITIAL_CAPACITY_CHECK_DELAY, _capacityCheckPeriod);
@@ -850,11 +860,11 @@ public void sendAlert(AlertType alertType, DataCenter dataCenter, Pod pod, Clust
 
     @Nullable
     private AlertVO getAlertForTrivialAlertType(AlertType alertType, long dataCenterId, Long podId, Long clusterId) {
-        AlertVO alert = null;
-        if (!ALERTS.contains(alertType)) {
-            alert = _alertDao.getLastAlert(alertType.getType(), dataCenterId, podId, clusterId);
+        if (alertType.isRepetitionAllowed() || (StringUtils.isNotBlank(alertType.getName()) &&
+                allowedRepetitiveAlertTypeNames.contains(alertType.getName().toLowerCase()))) {
+            return null;
         }
-        return alert;
+        return _alertDao.getLastAlert(alertType.getType(), dataCenterId, podId, clusterId);
     }
 
     protected void sendMessage(SMTPMailProperties mailProps) {
@@ -883,7 +893,7 @@ public String getConfigComponentName() {
     @Override
     public ConfigKey<?>[] getConfigKeys() {
         return new ConfigKey<?>[] {CPUCapacityThreshold, MemoryCapacityThreshold, StorageAllocatedCapacityThreshold, StorageCapacityThreshold, AlertSmtpEnabledSecurityProtocols,
-            AlertSmtpUseStartTLS, Ipv6SubnetCapacityThreshold, AlertSmtpUseAuth};
+            AlertSmtpUseStartTLS, Ipv6SubnetCapacityThreshold, AlertSmtpUseAuth, AllowedRepetitiveAlertTypes};
     }
 
     @Override
@@ -897,4 +907,16 @@ public boolean generateAlert(AlertType alertType, long dataCenterId, Long podId,
             return false;
         }
     }
+
+    @SuppressWarnings("unchecked")
+    protected void initMessageBusListener() {
+        messageBus.subscribe(EventTypes.EVENT_CONFIGURATION_VALUE_EDIT, (senderAddress, subject, args) -> {
+            Ternary<String, ConfigKey.Scope, Long> updatedSetting = (Ternary<String, ConfigKey.Scope, Long>) args;
+            String updatedSettingName = updatedSetting.first();
+            if (!AllowedRepetitiveAlertTypes.key().equals(updatedSettingName)) {
+                return;
+            }
+            setupRepetitiveAlertTypes();
+        });
+    }
 }
diff --git a/server/src/test/java/com/cloud/alert/AlertManagerImplTest.java b/server/src/test/java/com/cloud/alert/AlertManagerImplTest.java
index 170fceae9861..b5932e8a071a 100644
--- a/server/src/test/java/com/cloud/alert/AlertManagerImplTest.java
+++ b/server/src/test/java/com/cloud/alert/AlertManagerImplTest.java
@@ -16,6 +16,12 @@
 // under the License.
 package com.cloud.alert;
 
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.verify;
+
 import java.io.UnsupportedEncodingException;
 import java.util.HashMap;
 import java.util.List;
@@ -25,7 +31,10 @@
 import javax.naming.ConfigurationException;
 
 import org.apache.cloudstack.backup.BackupManager;
+import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
+import org.apache.cloudstack.framework.messagebus.MessageBus;
+import org.apache.cloudstack.framework.messagebus.MessageSubscriber;
 import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
 import org.apache.cloudstack.utils.mailing.SMTPMailSender;
@@ -40,6 +49,7 @@
 import org.mockito.Mockito;
 import org.mockito.Spy;
 import org.mockito.junit.MockitoJUnitRunner;
+import org.springframework.test.util.ReflectionTestUtils;
 
 import com.cloud.alert.dao.AlertDao;
 import com.cloud.capacity.Capacity;
@@ -52,16 +62,12 @@
 import com.cloud.dc.dao.ClusterDao;
 import com.cloud.dc.dao.DataCenterDao;
 import com.cloud.dc.dao.HostPodDao;
+import com.cloud.event.EventTypes;
 import com.cloud.host.Host;
 import com.cloud.host.HostVO;
 import com.cloud.host.dao.HostDao;
 import com.cloud.storage.StorageManager;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertNull;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.Mockito.verify;
+import com.cloud.utils.Ternary;
 
 @RunWith(MockitoJUnitRunner.class)
 public class AlertManagerImplTest {
@@ -112,6 +118,9 @@ public class AlertManagerImplTest {
     @Mock
     ConfigurationDao configDao;
 
+    @Mock
+    MessageBus messageBus;
+
     private final String[] recipients = new String[]{"test@test.com"};
     private final String senderAddress = "sender@test.com";
 
@@ -268,4 +277,81 @@ public void testCheckForAlerts() throws ConfigurationException {
         assertEquals("Available backup storage space is low, total: 200.0 MB, used: 180.0 MB (90%)", capturedAlert.getContent());
         assertEquals(AlertManager.AlertType.ALERT_TYPE_BACKUP_STORAGE.getType(), capturedAlert.getType());
     }
+
+    @Test
+    public void initMessageBusListenerSubscribesToConfigurationEditEvent() {
+        MessageBus messageBusMock = Mockito.mock(MessageBus.class);
+        alertManagerImplMock.messageBus = messageBusMock;
+        alertManagerImplMock.initMessageBusListener();
+        Mockito.verify(messageBusMock).subscribe(Mockito.eq(EventTypes.EVENT_CONFIGURATION_VALUE_EDIT), Mockito.any());
+    }
+
+    @Test
+    public void initMessageBusListenerTriggersSetupRepetitiveAlertTypesOnAllowedKeyEdit() {
+        MessageBus messageBusMock = Mockito.mock(MessageBus.class);
+        alertManagerImplMock.messageBus = messageBusMock;
+        alertManagerImplMock.initMessageBusListener();
+        ArgumentCaptor<MessageSubscriber> captor = ArgumentCaptor.forClass(MessageSubscriber.class);
+        Mockito.verify(messageBusMock).subscribe(Mockito.eq(EventTypes.EVENT_CONFIGURATION_VALUE_EDIT), captor.capture());
+        Ternary<String, ConfigKey.Scope, Long> args = new Ternary<>(AlertManager.AllowedRepetitiveAlertTypes.key(), ConfigKey.Scope.Global, 1L);
+        captor.getValue().onPublishMessage(null, null, args);
+        Mockito.verify(alertManagerImplMock).setupRepetitiveAlertTypes();
+    }
+
+    @Test
+    public void initMessageBusListenerDoesNotTriggerSetupRepetitiveAlertTypesOnOtherKeyEdit() {
+        MessageBus messageBusMock = Mockito.mock(MessageBus.class);
+        alertManagerImplMock.messageBus = messageBusMock;
+        alertManagerImplMock.initMessageBusListener();
+        ArgumentCaptor<MessageSubscriber> captor = ArgumentCaptor.forClass(MessageSubscriber.class);
+        Mockito.verify(messageBusMock).subscribe(Mockito.eq(EventTypes.EVENT_CONFIGURATION_VALUE_EDIT), captor.capture());
+        Ternary<String, ConfigKey.Scope, Long> args = new Ternary<>("some.other.key", ConfigKey.Scope.Global, 1L);
+        captor.getValue().onPublishMessage(null, null, args);
+        Mockito.verify(alertManagerImplMock, Mockito.never()).setupRepetitiveAlertTypes();
+    }
+
+    private void mockAllowedRepetitiveAlertTypesConfigKey(String value) {
+        ReflectionTestUtils.setField(AlertManager.AllowedRepetitiveAlertTypes, "_defaultValue", value);
+    }
+
+    @Test
+    public void setupRepetitiveAlertTypesParsesValidAlertTypesCorrectly() {
+        mockAllowedRepetitiveAlertTypesConfigKey(AlertManager.AlertType.ALERT_TYPE_CPU.getName() + "," + AlertManager.AlertType.ALERT_TYPE_MEMORY.getName());
+        alertManagerImplMock.setupRepetitiveAlertTypes();
+        List<String> expectedTypes = (List<String>)ReflectionTestUtils.getField(alertManagerImplMock, "allowedRepetitiveAlertTypeNames");
+        Assert.assertNotNull(expectedTypes);
+        Assert.assertEquals(2, expectedTypes.size());
+        Assert.assertTrue(expectedTypes.contains(AlertManager.AlertType.ALERT_TYPE_CPU.getName().toLowerCase()));
+        Assert.assertTrue(expectedTypes.contains(AlertManager.AlertType.ALERT_TYPE_MEMORY.getName().toLowerCase()));
+    }
+
+    @Test
+    public void setupRepetitiveAlertTypesHandlesEmptyConfigValue() {
+        mockAllowedRepetitiveAlertTypesConfigKey("");
+        alertManagerImplMock.setupRepetitiveAlertTypes();
+        List<String> expectedTypes = (List<String>)ReflectionTestUtils.getField(alertManagerImplMock, "allowedRepetitiveAlertTypeNames");
+        Assert.assertNotNull(expectedTypes);
+        Assert.assertTrue(expectedTypes.isEmpty());
+    }
+
+    @Test
+    public void setupRepetitiveAlertTypesIgnoresCustomAlertTypes() {
+        String customAlertTypeName = "CUSTOM_ALERT_TYPE";
+        mockAllowedRepetitiveAlertTypesConfigKey(AlertManager.AlertType.ALERT_TYPE_CPU.getName() + "," + customAlertTypeName);
+        alertManagerImplMock.setupRepetitiveAlertTypes();
+        List<String> expectedTypes = (List<String>)ReflectionTestUtils.getField(alertManagerImplMock, "allowedRepetitiveAlertTypeNames");
+        Assert.assertNotNull(expectedTypes);
+        Assert.assertEquals(2, expectedTypes.size());
+        Assert.assertTrue(expectedTypes.contains(AlertManager.AlertType.ALERT_TYPE_CPU.getName().toLowerCase()));
+        Assert.assertTrue(expectedTypes.contains(customAlertTypeName.toLowerCase()));
+    }
+
+    @Test
+    public void setupRepetitiveAlertTypesHandlesNullConfigValue() {
+        mockAllowedRepetitiveAlertTypesConfigKey(null);
+        alertManagerImplMock.setupRepetitiveAlertTypes();
+        List<String> expectedTypes = (List<String>)ReflectionTestUtils.getField(alertManagerImplMock, "allowedRepetitiveAlertTypeNames");
+        Assert.assertNotNull(expectedTypes);
+        Assert.assertTrue(expectedTypes.isEmpty());
+    }
 }

From bac3421da437d0d3415e83fb3350a8584756e4a7 Mon Sep 17 00:00:00 2001
From: Dattu <aravapalli.pavan51@gmail.com>
Date: Fri, 30 Jan 2026 12:12:41 +0530
Subject: [PATCH 102/117]  Fixed: unnecessary regeneration of SSH keys in
 developer mode when they already existed. (#12059)

---
 .../src/main/java/com/cloud/server/ConfigurationServerImpl.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/server/src/main/java/com/cloud/server/ConfigurationServerImpl.java b/server/src/main/java/com/cloud/server/ConfigurationServerImpl.java
index 51793f22e908..8f10dd84b54d 100644
--- a/server/src/main/java/com/cloud/server/ConfigurationServerImpl.java
+++ b/server/src/main/java/com/cloud/server/ConfigurationServerImpl.java
@@ -614,7 +614,7 @@ public void updateKeyPairs() {
             }
             // FIXME: take a global database lock here for safety.
             boolean onWindows = isOnWindows();
-            if(!onWindows) {
+            if (!onWindows && !(privkeyfile.exists() && pubkeyfile.exists())) {
                 Script.runSimpleBashScript("if [ -f " + privkeyfile + " ]; then rm -f " + privkeyfile + "; fi; ssh-keygen -t ecdsa -m PEM -N '' -f " + privkeyfile + " -q 2>/dev/null || ssh-keygen -t ecdsa -N '' -f " + privkeyfile + " -q");
             }
 

From bb391c3deb1c4a4172f91a60898decac33854246 Mon Sep 17 00:00:00 2001
From: Wei Zhou <weizhou@apache.org>
Date: Fri, 30 Jan 2026 07:50:44 +0100
Subject: [PATCH 103/117] test: increase timeout in test_human_readable_logs.py
 (#11972)

---
 test/integration/smoke/test_human_readable_logs.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/test/integration/smoke/test_human_readable_logs.py b/test/integration/smoke/test_human_readable_logs.py
index fb972511f9c1..c2478bfe5766 100644
--- a/test/integration/smoke/test_human_readable_logs.py
+++ b/test/integration/smoke/test_human_readable_logs.py
@@ -48,9 +48,9 @@ def test_01_disableHumanReadableLogs(self):
         sshClient.execute(command)
 
         # CapacityChecker runs as soon as management server is up
-        # Check if "usedMem: (" is printed out within 60 seconds while server is starting
-        command = "timeout 60 tail -f /var/log/cloudstack/management/management-server.log | grep 'usedMem: ('"
-        sshClient.timeout = 60
+        # Check if "usedMem: (" is printed out within 120 seconds while server is starting
+        command = "timeout 120 tail -f /var/log/cloudstack/management/management-server.log | grep 'usedMem: ('"
+        sshClient.timeout = 120
         result = sshClient.runCommand(command)
         self.assertTrue(result['status'] == "FAILED")
 
@@ -70,7 +70,7 @@ def test_02_enableHumanReadableLogs(self):
         sshClient.execute(command)
 
         # CapacityChecker runs as soon as management server is up
-        # Check if "usedMem: (" is printed out within 60 seconds while server is restarting
+        # Check if "usedMem: (" is printed out within 120 seconds while server is restarting
         command = "timeout 120 tail -f /var/log/cloudstack/management/management-server.log | grep 'usedMem: ('"
         sshClient.timeout = 120
         result = sshClient.runCommand(command)

From 45d623ec0d86ef040028b7cbc8339f7d0c7456f4 Mon Sep 17 00:00:00 2001
From: Vishesh <8760112+vishesh92@users.noreply.github.com>
Date: Fri, 30 Jan 2026 12:21:47 +0530
Subject: [PATCH 104/117] Update search filter size dynamically (#12552)

---
 ui/src/components/view/SearchFilter.vue |  3 ++-
 ui/src/views/AutogenView.vue            | 13 ++++++++++---
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/ui/src/components/view/SearchFilter.vue b/ui/src/components/view/SearchFilter.vue
index ed950c094a3b..9849ba8de442 100644
--- a/ui/src/components/view/SearchFilter.vue
+++ b/ui/src/components/view/SearchFilter.vue
@@ -24,7 +24,7 @@
       v-for="filter in this.searchFilters"
       :key="filter.key + filter.value"
     >
-      <a-col v-if="!['page', 'pagesize', 'q', 'keyword', 'tags'].includes(filter.key)">
+      <a-col v-if="!['page', 'pagesize', 'q', 'keyword', 'tags', 'projectid'].includes(filter.key)">
         <a-tag
           v-if="!filter.isTag"
           closable
@@ -175,6 +175,7 @@ export default {
       immediate: true,
       handler (newFilters) {
         const clonedFilters = newFilters.map(filter => ({ ...filter }))
+        this.searchFilters = clonedFilters.map(f => ({ ...f }))
         const promises = []
         for (let idx = 0; idx < clonedFilters.length; idx++) {
           const filter = clonedFilters[idx]
diff --git a/ui/src/views/AutogenView.vue b/ui/src/views/AutogenView.vue
index 6acc81d6a029..6c146875ece6 100644
--- a/ui/src/views/AutogenView.vue
+++ b/ui/src/views/AutogenView.vue
@@ -17,7 +17,10 @@
 
 <template>
   <div>
-    <a-affix :offsetTop="this.$store.getters.shutdownTriggered ? 103 : 78">
+    <a-affix
+      :key="'affix-' + showSearchFilters"
+      :offsetTop="this.$store.getters.shutdownTriggered ? 103 : 78"
+    >
       <a-card class="breadcrumb-card" style="z-index: 10">
         <a-row>
           <a-col :span="device === 'mobile' ? 24 : 12" style="padding-left: 12px; margin-top: 10px">
@@ -107,8 +110,8 @@
           </a-col>
         </a-row>
         <a-row
-          v-if="!dataView && $config.showSearchFilters"
-          style="min-height: 36px; padding-top: 12px;"
+          v-if="showSearchFilters"
+          style="min-height: 36px; padding-top: 12px; padding-left: 12px;"
         >
           <search-filter
             :filters="getActiveFilters()"
@@ -687,6 +690,10 @@ export default {
     }
   },
   computed: {
+    showSearchFilters () {
+      const excludedKeys = ['page', 'pagesize', 'q', 'keyword', 'tags', 'projectid']
+      return !this.dataView && this.$config.showSearchFilters && this.getActiveFilters().some(f => !excludedKeys.includes(f.key))
+    },
     hasSelected () {
       return this.selectedRowKeys.length > 0
     },

From 9d523cbbfef6c097f7dd1488c282637b3b63c256 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 30 Jan 2026 08:57:24 +0200
Subject: [PATCH 105/117] Bump org.apache.maven.plugins:maven-war-plugin from
 3.4.0 to 3.5.1 (#12497)

Bumps [org.apache.maven.plugins:maven-war-plugin](https://github.com/apache/maven-war-plugin) from 3.4.0 to 3.5.1.
- [Release notes](https://github.com/apache/maven-war-plugin/releases)
- [Commits](https://github.com/apache/maven-war-plugin/compare/maven-war-plugin-3.4.0...maven-war-plugin-3.5.1)

---
updated-dependencies:
- dependency-name: org.apache.maven.plugins:maven-war-plugin
  dependency-version: 3.5.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 engine/service/pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/engine/service/pom.xml b/engine/service/pom.xml
index 9b833804064e..673d9c418d77 100644
--- a/engine/service/pom.xml
+++ b/engine/service/pom.xml
@@ -69,7 +69,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-war-plugin</artifactId>
-                <version>3.4.0</version>
+                <version>3.5.1</version>
             </plugin>
             <plugin>
                 <groupId>org.eclipse.jetty</groupId>

From 81f16b626163aa8a076be21a333c8e1dea8d1dc7 Mon Sep 17 00:00:00 2001
From: Wei Zhou <weizhou@apache.org>
Date: Fri, 30 Jan 2026 08:01:50 +0100
Subject: [PATCH 106/117] engine/schema: prepend algorithm to checksum during
 systemvm template registration (#12165)

* engine/schema: prepend algorithm to checksum during systemvm template registration

* Update utils/src/main/java/org/apache/cloudstack/utils/security/DigestHelper.java
---
 .../upgrade/SystemVmTemplateRegistration.java     |  4 ++--
 .../cloudstack/utils/security/DigestHelper.java   | 15 +++++++++++++++
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/engine/schema/src/main/java/com/cloud/upgrade/SystemVmTemplateRegistration.java b/engine/schema/src/main/java/com/cloud/upgrade/SystemVmTemplateRegistration.java
index f13fe2c6bc38..d8cf070ae4c7 100644
--- a/engine/schema/src/main/java/com/cloud/upgrade/SystemVmTemplateRegistration.java
+++ b/engine/schema/src/main/java/com/cloud/upgrade/SystemVmTemplateRegistration.java
@@ -513,7 +513,7 @@ private VMTemplateVO createTemplateObjectInDB(SystemVMTemplateDetails details) {
         template.setBits(64);
         template.setAccountId(Account.ACCOUNT_ID_SYSTEM);
         template.setUrl(details.getUrl());
-        template.setChecksum(details.getChecksum());
+        template.setChecksum(DigestHelper.prependAlgorithm(details.getChecksum()));
         template.setEnablePassword(false);
         template.setDisplayText(details.getName());
         template.setFormat(details.getFormat());
@@ -1008,7 +1008,7 @@ private void updateRegisteredTemplateDetails(Long templateId, MetadataTemplateDe
 
     private void updateTemplateUrlChecksumAndGuestOsId(VMTemplateVO templateVO, MetadataTemplateDetails templateDetails) {
         templateVO.setUrl(templateDetails.getUrl());
-        templateVO.setChecksum(templateDetails.getChecksum());
+        templateVO.setChecksum(DigestHelper.prependAlgorithm(templateDetails.getChecksum()));
         GuestOSVO guestOS = guestOSDao.findOneByDisplayName(templateDetails.getGuestOs());
         if (guestOS != null) {
             templateVO.setGuestOSId(guestOS.getId());
diff --git a/utils/src/main/java/org/apache/cloudstack/utils/security/DigestHelper.java b/utils/src/main/java/org/apache/cloudstack/utils/security/DigestHelper.java
index 0b74dc503d8e..19fc700e293d 100644
--- a/utils/src/main/java/org/apache/cloudstack/utils/security/DigestHelper.java
+++ b/utils/src/main/java/org/apache/cloudstack/utils/security/DigestHelper.java
@@ -142,4 +142,19 @@ public static String calculateChecksum(File file) {
             throw new CloudRuntimeException(errMsg, e);
         }
     }
+
+    public static String prependAlgorithm(String checksum) {
+        if (StringUtils.isEmpty(checksum)) {
+            return checksum;
+        }
+        int checksumLength = checksum.length();
+        Map<String, Integer> paddingLengths = getChecksumLengthsMap();
+        for (Map.Entry<String, Integer> entry : paddingLengths.entrySet()) {
+            if (entry.getValue().equals(checksumLength)) {
+                String algorithm = entry.getKey();
+                return String.format("{%s}%s", algorithm, checksum);
+            }
+        }
+        return checksum;
+    }
 }

From 25eacaa1ff1a1c01aa51a9ae745734961ca33956 Mon Sep 17 00:00:00 2001
From: dahn <daan@onecht.net>
Date: Fri, 30 Jan 2026 08:33:21 +0100
Subject: [PATCH 107/117] set `displayName` to `name` by default (#9719)

* set `desplayName` to `name` by default

* list by displayname instead of name

* back to using name

* Update api/src/main/java/org/apache/cloudstack/api/command/user/vm/DeployVMCmd.java

---------

Co-authored-by: Daan Hoogland <dahn@apache.org>
---
 .../apache/cloudstack/api/command/user/vm/DeployVMCmd.java   | 5 ++++-
 .../apache/cloudstack/api/command/user/vm/UpdateVMCmd.java   | 4 ++++
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DeployVMCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DeployVMCmd.java
index e3b7e3436239..f08f906997cd 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DeployVMCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DeployVMCmd.java
@@ -56,7 +56,6 @@
 import org.apache.commons.collections.CollectionUtils;
 import org.apache.commons.collections.MapUtils;
 import org.apache.commons.lang3.BooleanUtils;
-import org.apache.commons.lang3.StringUtils;
 
 import com.cloud.agent.api.LogLevel;
 import com.cloud.event.EventTypes;
@@ -74,6 +73,7 @@
 import com.cloud.uservm.UserVm;
 import com.cloud.utils.net.Dhcp;
 import com.cloud.utils.net.NetUtils;
+import com.cloud.utils.StringUtils;
 import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.VmDetailConstants;
 
@@ -298,6 +298,9 @@ public String getDeploymentPlanner() {
     }
 
     public String getDisplayName() {
+        if (StringUtils.isEmpty(displayName)) {
+            displayName = name;
+        }
         return displayName;
     }
 
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/UpdateVMCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/UpdateVMCmd.java
index 2185c0428201..67a929bc6c26 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/UpdateVMCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/UpdateVMCmd.java
@@ -21,6 +21,7 @@
 import java.util.List;
 import java.util.Map;
 
+import com.cloud.utils.StringUtils;
 import com.cloud.utils.exception.CloudRuntimeException;
 
 import org.apache.cloudstack.api.ApiArgValidator;
@@ -159,6 +160,9 @@ public class UpdateVMCmd extends BaseCustomIdCmd implements SecurityGroupAction,
     /////////////////////////////////////////////////////
 
     public String getDisplayName() {
+        if (StringUtils.isBlank(displayName)) {
+            displayName = name;
+        }
         return displayName;
     }
 

From 18972caf5f1cfc90bdad59669dc7f8cb031ba64d Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Fri, 30 Jan 2026 13:54:01 +0530
Subject: [PATCH 108/117] api,server: allow cleaning up vm extraconfig (#11974)

---
 .../apache/cloudstack/api/ApiConstants.java   |  1 +
 .../api/command/user/vm/UpdateVMCmd.java      | 18 +++-
 .../cloud/vm/dao/VMInstanceDetailsDao.java    |  1 +
 .../vm/dao/VMInstanceDetailsDaoImpl.java      | 17 ++++
 .../vm/dao/VMInstanceDetailsDaoImplTest.java  | 86 +++++++++++++++++++
 .../java/com/cloud/vm/UserVmManagerImpl.java  | 28 ++++--
 .../com/cloud/vm/UserVmManagerImplTest.java   | 75 +++++++++++++++-
 ui/src/views/compute/EditVM.vue               |  2 +
 8 files changed, 212 insertions(+), 16 deletions(-)
 create mode 100644 engine/schema/src/test/java/com/cloud/vm/dao/VMInstanceDetailsDaoImplTest.java

diff --git a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
index 790070e5244b..1ab6fba6081f 100644
--- a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
+++ b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
@@ -1168,6 +1168,7 @@ public class ApiConstants {
     public static final String OVM3_VIP = "ovm3vip";
     public static final String CLEAN_UP_DETAILS = "cleanupdetails";
     public static final String CLEAN_UP_EXTERNAL_DETAILS = "cleanupexternaldetails";
+    public static final String CLEAN_UP_EXTRA_CONFIG = "cleanupextraconfig";
     public static final String CLEAN_UP_PARAMETERS = "cleanupparameters";
     public static final String VIRTUAL_SIZE = "virtualsize";
     public static final String NETSCALER_CONTROLCENTER_ID = "netscalercontrolcenterid";
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/UpdateVMCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/UpdateVMCmd.java
index ddc2c06eb097..e0da954d381f 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/UpdateVMCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/UpdateVMCmd.java
@@ -163,6 +163,12 @@ public class UpdateVMCmd extends BaseCustomIdCmd implements SecurityGroupAction,
             description = "Lease expiry action, valid values are STOP and DESTROY")
     private String leaseExpiryAction;
 
+    @Parameter(name = ApiConstants.CLEAN_UP_EXTRA_CONFIG, type = CommandType.BOOLEAN, since = "4.23.0",
+            description = "Optional boolean field, which indicates if extraconfig for the instance should be " +
+                    "cleaned up or not (If set to true, extraconfig removed for this instance, extraconfig field " +
+                    "ignored; if false or not set, no action)")
+    private Boolean cleanupExtraConfig;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -271,14 +277,18 @@ public String getExtraConfig() {
         return extraConfig;
     }
 
-    /////////////////////////////////////////////////////
-    /////////////// API Implementation///////////////////
-    /////////////////////////////////////////////////////
-
     public Long getOsTypeId() {
         return osTypeId;
     }
 
+    public boolean isCleanupExtraConfig() {
+        return Boolean.TRUE.equals(cleanupExtraConfig);
+    }
+
+    /////////////////////////////////////////////////////
+    /////////////// API Implementation///////////////////
+    /////////////////////////////////////////////////////
+
     @Override
     public String getCommandName() {
         return s_name;
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDetailsDao.java b/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDetailsDao.java
index ea9ac5afba67..4cbdc516ba0b 100644
--- a/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDetailsDao.java
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDetailsDao.java
@@ -22,4 +22,5 @@
 import com.cloud.vm.VMInstanceDetailVO;
 
 public interface VMInstanceDetailsDao extends GenericDao<VMInstanceDetailVO, Long>, ResourceDetailsDao<VMInstanceDetailVO> {
+    int removeDetailsWithPrefix(long vmId, String prefix);
 }
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDetailsDaoImpl.java b/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDetailsDaoImpl.java
index ca11b005fb2b..4c2fdd6f8d45 100644
--- a/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDetailsDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDetailsDaoImpl.java
@@ -17,10 +17,13 @@
 package com.cloud.vm.dao;
 
 
+import org.apache.commons.lang3.StringUtils;
 import org.springframework.stereotype.Component;
 
 import org.apache.cloudstack.resourcedetail.ResourceDetailsDaoBase;
 
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
 import com.cloud.vm.VMInstanceDetailVO;
 
 @Component
@@ -31,4 +34,18 @@ public void addDetail(long resourceId, String key, String value, boolean display
         super.addDetail(new VMInstanceDetailVO(resourceId, key, value, display));
     }
 
+    @Override
+    public int removeDetailsWithPrefix(long vmId, String prefix) {
+        if (StringUtils.isBlank(prefix)) {
+            return 0;
+        }
+        SearchBuilder<VMInstanceDetailVO> sb = createSearchBuilder();
+        sb.and("vmId", sb.entity().getResourceId(), SearchCriteria.Op.EQ);
+        sb.and("prefix", sb.entity().getName(), SearchCriteria.Op.LIKE);
+        sb.done();
+        SearchCriteria<VMInstanceDetailVO> sc = sb.create();
+        sc.setParameters("vmId", vmId);
+        sc.setParameters("prefix", prefix + "%");
+        return super.remove(sc);
+    }
 }
diff --git a/engine/schema/src/test/java/com/cloud/vm/dao/VMInstanceDetailsDaoImplTest.java b/engine/schema/src/test/java/com/cloud/vm/dao/VMInstanceDetailsDaoImplTest.java
new file mode 100644
index 000000000000..06238e386d5e
--- /dev/null
+++ b/engine/schema/src/test/java/com/cloud/vm/dao/VMInstanceDetailsDaoImplTest.java
@@ -0,0 +1,86 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.vm.dao;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mockito;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
+import com.cloud.vm.VMInstanceDetailVO;
+
+@RunWith(MockitoJUnitRunner.class)
+public class VMInstanceDetailsDaoImplTest {
+    @Spy
+    @InjectMocks
+    private VMInstanceDetailsDaoImpl vmInstanceDetailsDaoImpl;
+
+    @Test
+    public void removeDetailsWithPrefixReturnsZeroWhenPrefixIsBlank() {
+        Assert.assertEquals(0, vmInstanceDetailsDaoImpl.removeDetailsWithPrefix(1L, ""));
+        Assert.assertEquals(0, vmInstanceDetailsDaoImpl.removeDetailsWithPrefix(1L, "   "));
+        Assert.assertEquals(0, vmInstanceDetailsDaoImpl.removeDetailsWithPrefix(1L, null));
+    }
+
+    @Test
+    public void removeDetailsWithPrefixRemovesMatchingDetails() {
+        SearchBuilder<VMInstanceDetailVO> sb = mock(SearchBuilder.class);
+        VMInstanceDetailVO entity = mock(VMInstanceDetailVO.class);
+        when(sb.entity()).thenReturn(entity);
+        when(sb.and(anyString(), any(), any(SearchCriteria.Op.class))).thenReturn(sb);
+        SearchCriteria<VMInstanceDetailVO> sc = mock(SearchCriteria.class);
+        when(sb.create()).thenReturn(sc);
+        when(vmInstanceDetailsDaoImpl.createSearchBuilder()).thenReturn(sb);
+        doReturn(3).when(vmInstanceDetailsDaoImpl).remove(sc);
+        int removedCount = vmInstanceDetailsDaoImpl.removeDetailsWithPrefix(1L, "testPrefix");
+        Assert.assertEquals(3, removedCount);
+        Mockito.verify(sc).setParameters("vmId", 1L);
+        Mockito.verify(sc).setParameters("prefix", "testPrefix%");
+        Mockito.verify(vmInstanceDetailsDaoImpl, Mockito.times(1)).remove(sc);
+    }
+
+    @Test
+    public void removeDetailsWithPrefixDoesNotRemoveWhenNoMatch() {
+        SearchBuilder<VMInstanceDetailVO> sb = mock(SearchBuilder.class);
+        VMInstanceDetailVO entity = mock(VMInstanceDetailVO.class);
+        when(sb.entity()).thenReturn(entity);
+        when(sb.and(anyString(), any(), any(SearchCriteria.Op.class))).thenReturn(sb);
+        SearchCriteria<VMInstanceDetailVO> sc = mock(SearchCriteria.class);
+        when(sb.create()).thenReturn(sc);
+        when(vmInstanceDetailsDaoImpl.createSearchBuilder()).thenReturn(sb);
+        doReturn(0).when(vmInstanceDetailsDaoImpl).remove(sc);
+
+        int removedCount = vmInstanceDetailsDaoImpl.removeDetailsWithPrefix(1L, "nonExistentPrefix");
+
+        Assert.assertEquals(0, removedCount);
+        Mockito.verify(sc).setParameters("vmId", 1L);
+        Mockito.verify(sc).setParameters("prefix", "nonExistentPrefix%");
+        Mockito.verify(vmInstanceDetailsDaoImpl, Mockito.times(1)).remove(sc);
+    }
+}
diff --git a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
index eccea944fe62..b9b6e5a68391 100644
--- a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
+++ b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
@@ -2866,6 +2866,22 @@ private void adjustVmLimits(Account owner, UserVmVO vmInstance, ServiceOfferingV
         }
     }
 
+    protected void updateVmExtraConfig(UserVmVO userVm, String extraConfig, boolean cleanupExtraConfig) {
+        if (cleanupExtraConfig) {
+            logger.info("Cleaning up extraconfig from user vm: {}", userVm.getUuid());
+            vmInstanceDetailsDao.removeDetailsWithPrefix(userVm.getId(), ApiConstants.EXTRA_CONFIG);
+            return;
+        }
+        if (StringUtils.isNotBlank(extraConfig)) {
+            if (EnableAdditionalVmConfig.valueIn(userVm.getAccountId())) {
+                logger.info("Adding extra configuration to user vm: {}", userVm.getUuid());
+                addExtraConfig(userVm, extraConfig);
+            } else {
+                throw new InvalidParameterValueException("attempted setting extraconfig but enable.additional.vm.configuration is disabled");
+            }
+        }
+    }
+
     @Override
     @ActionEvent(eventType = EventTypes.EVENT_VM_UPDATE, eventDescription = "updating Vm")
     public UserVm updateVirtualMachine(UpdateVMCmd cmd) throws ResourceUnavailableException, InsufficientCapacityException {
@@ -2883,6 +2899,7 @@ public UserVm updateVirtualMachine(UpdateVMCmd cmd) throws ResourceUnavailableEx
         List<Long> securityGroupIdList = getSecurityGroupIdList(cmd);
         boolean cleanupDetails = cmd.isCleanupDetails();
         String extraConfig = cmd.getExtraConfig();
+        boolean cleanupExtraConfig = cmd.isCleanupExtraConfig();
 
         UserVmVO vmInstance = _vmDao.findById(cmd.getId());
         VMTemplateVO template = _templateDao.findById(vmInstance.getTemplateId());
@@ -2919,7 +2936,7 @@ public UserVm updateVirtualMachine(UpdateVMCmd cmd) throws ResourceUnavailableEx
                 .map(item -> (item).trim())
                 .collect(Collectors.toList());
         List<VMInstanceDetailVO> existingDetails = vmInstanceDetailsDao.listDetails(id);
-        if (cleanupDetails){
+        if (cleanupDetails) {
             if (caller != null && caller.getType() == Account.Type.ADMIN) {
                 for (final VMInstanceDetailVO detail : existingDetails) {
                     if (detail != null && detail.isDisplay() && !isExtraConfig(detail.getName())) {
@@ -2982,15 +2999,8 @@ public UserVm updateVirtualMachine(UpdateVMCmd cmd) throws ResourceUnavailableEx
                 vmInstance.setDetails(details);
                 _vmDao.saveDetails(vmInstance);
             }
-            if (StringUtils.isNotBlank(extraConfig)) {
-                if (EnableAdditionalVmConfig.valueIn(accountId)) {
-                    logger.info("Adding extra configuration to user vm: " + vmInstance.getUuid());
-                    addExtraConfig(vmInstance, extraConfig);
-                } else {
-                    throw new InvalidParameterValueException("attempted setting extraconfig but enable.additional.vm.configuration is disabled");
-                }
-            }
         }
+        updateVmExtraConfig(userVm, extraConfig, cleanupExtraConfig);
 
         if (VMLeaseManager.InstanceLeaseEnabled.value() && cmd.getLeaseDuration() != null) {
             applyLeaseOnUpdateInstance(vmInstance, cmd.getLeaseDuration(), cmd.getLeaseExpiryAction());
diff --git a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
index 4ec9caab5aa8..4edafb3a05a8 100644
--- a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
+++ b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
@@ -40,8 +40,10 @@
 import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoMoreInteractions;
 import static org.mockito.Mockito.when;
 
+import java.lang.reflect.Field;
 import java.text.SimpleDateFormat;
 import java.time.LocalDateTime;
 import java.time.ZoneOffset;
@@ -59,8 +61,6 @@
 import java.util.TimeZone;
 import java.util.UUID;
 
-import com.cloud.domain.Domain;
-import com.cloud.storage.dao.SnapshotPolicyDao;
 import org.apache.cloudstack.acl.ControlledEntity;
 import org.apache.cloudstack.acl.SecurityChecker;
 import org.apache.cloudstack.api.ApiCommandResourceType;
@@ -88,6 +88,7 @@
 import org.apache.cloudstack.engine.subsystem.api.storage.Scope;
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeDataFactory;
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
+import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
 import org.apache.cloudstack.storage.template.VnfTemplateManager;
@@ -117,6 +118,7 @@
 import com.cloud.deploy.DeployDestination;
 import com.cloud.deploy.DeploymentPlanner;
 import com.cloud.deploy.DeploymentPlanningManager;
+import com.cloud.domain.Domain;
 import com.cloud.domain.DomainVO;
 import com.cloud.domain.dao.DomainDao;
 import com.cloud.event.ActionEventUtils;
@@ -142,9 +144,9 @@
 import com.cloud.network.dao.LoadBalancerVMMapVO;
 import com.cloud.network.dao.NetworkDao;
 import com.cloud.network.dao.NetworkVO;
-import com.cloud.network.element.UserDataServiceProvider;
 import com.cloud.network.dao.PhysicalNetworkDao;
 import com.cloud.network.dao.PhysicalNetworkVO;
+import com.cloud.network.element.UserDataServiceProvider;
 import com.cloud.network.guru.NetworkGuru;
 import com.cloud.network.rules.FirewallRuleVO;
 import com.cloud.network.rules.PortForwardingRule;
@@ -172,6 +174,7 @@
 import com.cloud.storage.dao.DiskOfferingDao;
 import com.cloud.storage.dao.GuestOSDao;
 import com.cloud.storage.dao.SnapshotDao;
+import com.cloud.storage.dao.SnapshotPolicyDao;
 import com.cloud.storage.dao.VMTemplateDao;
 import com.cloud.storage.dao.VolumeDao;
 import com.cloud.template.VirtualMachineTemplate;
@@ -467,6 +470,24 @@ public class UserVmManagerImplTest {
     Class<InvalidParameterValueException> expectedInvalidParameterValueException = InvalidParameterValueException.class;
     Class<CloudRuntimeException> expectedCloudRuntimeException = CloudRuntimeException.class;
 
+    private Map<ConfigKey, Object> originalConfigValues = new HashMap<>();
+
+
+    private void updateDefaultConfigValue(final ConfigKey configKey, final Object o, boolean revert) {
+        try {
+            final String name = "_defaultValue";
+            Field f = ConfigKey.class.getDeclaredField(name);
+            f.setAccessible(true);
+            String stringVal = String.valueOf(o);
+            if (!revert) {
+                originalConfigValues.put(configKey, f.get(configKey));
+            }
+            f.set(configKey, stringVal);
+        } catch (IllegalAccessException | NoSuchFieldException  e) {
+            Assert.fail("Failed to mock config " + configKey.key() + " value due to " + e.getMessage());
+        }
+    }
+
     @Before
     public void beforeTest() {
         userVmManagerImpl.resourceLimitService = resourceLimitMgr;
@@ -496,6 +517,9 @@ public void beforeTest() {
     public void afterTest() {
         CallContext.unregister();
         unmanagedVMsManagerMockedStatic.close();
+        for (Map.Entry<ConfigKey, Object> entry : originalConfigValues.entrySet()) {
+            updateDefaultConfigValue(entry.getKey(), entry.getValue(), true);
+        }
     }
 
     @Test
@@ -4178,4 +4202,49 @@ public void testUnmanageUserVMSuccess() {
         verify(userVmDao, times(1)).releaseFromLockTable(vmId);
     }
 
+    @Test
+    public void updateVmExtraConfigCleansUpWhenCleanupFlagIsTrue() {
+        UserVmVO userVm = mock(UserVmVO.class);
+        when(userVm.getUuid()).thenReturn("test-uuid");
+        when(userVm.getId()).thenReturn(1L);
+
+        userVmManagerImpl.updateVmExtraConfig(userVm, "someConfig", true);
+
+        verify(vmInstanceDetailsDao, times(1)).removeDetailsWithPrefix(1L, ApiConstants.EXTRA_CONFIG);
+        verifyNoMoreInteractions(vmInstanceDetailsDao);
+    }
+
+    @Test
+    public void updateVmExtraConfigAddsConfigWhenValidAndEnabled() {
+        UserVmVO userVm = mock(UserVmVO.class);
+        when(userVm.getUuid()).thenReturn("test-uuid");
+        when(userVm.getAccountId()).thenReturn(1L);
+        when(userVm.getHypervisorType()).thenReturn(Hypervisor.HypervisorType.KVM);
+        doNothing().when(userVmManagerImpl).persistExtraConfigKvm(anyString(), eq(userVm));
+        updateDefaultConfigValue(UserVmManagerImpl.EnableAdditionalVmConfig, true, false);
+
+        userVmManagerImpl.updateVmExtraConfig(userVm, "validConfig", false);
+
+        verify(vmInstanceDetailsDao, never()).removeDetailsWithPrefix(anyLong(), anyString());
+        verify(userVmManagerImpl, times(1)).addExtraConfig(userVm, "validConfig");
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void updateVmExtraConfigThrowsExceptionWhenConfigDisabled() {
+        UserVmVO userVm = mock(UserVmVO.class);
+        when(userVm.getAccountId()).thenReturn(1L);
+        updateDefaultConfigValue(UserVmManagerImpl.EnableAdditionalVmConfig, false, false);
+
+        userVmManagerImpl.updateVmExtraConfig(userVm, "validConfig", false);
+    }
+
+    @Test
+    public void updateVmExtraConfigDoesNothingWhenExtraConfigIsBlank() {
+        UserVmVO userVm = mock(UserVmVO.class);
+
+        userVmManagerImpl.updateVmExtraConfig(userVm, "", false);
+
+        verify(vmInstanceDetailsDao, never()).removeDetailsWithPrefix(anyLong(), anyString());
+        verify(userVmManagerImpl, never()).addExtraConfig(any(UserVmVO.class), anyString());
+    }
 }
diff --git a/ui/src/views/compute/EditVM.vue b/ui/src/views/compute/EditVM.vue
index 19055afde973..9f08a3368a2b 100644
--- a/ui/src/views/compute/EditVM.vue
+++ b/ui/src/views/compute/EditVM.vue
@@ -425,6 +425,8 @@ export default {
         }
         if (values.extraconfig && values.extraconfig.length > 0) {
           params.extraconfig = encodeURIComponent(values.extraconfig)
+        } else if (this.combinedExtraConfig) {
+          params.cleanupextraconfig = true
         }
         this.loading = true
 

From a7178ee687ac4d3808c1a9f1772d3b08a295b834 Mon Sep 17 00:00:00 2001
From: Vishesh <8760112+vishesh92@users.noreply.github.com>
Date: Fri, 30 Jan 2026 14:01:57 +0530
Subject: [PATCH 109/117] Fix mvn warnings (#10909)

* Replace maven-jgit-buildnumber-plugin with thread safe buildnumber-maven-plugin

* Fix mysql-connector-java warning

* Fix thread safe warning for properties-maven-plugin

* Fix mvn build - marvin warnings

* Update tools/marvin/README.md

* Update tools/marvin/README.md

Co-authored-by: dahn <daan.hoogland@gmail.com>

---------

Co-authored-by: dahn <daan.hoogland@gmail.com>
---
 client/pom.xml                            | 24 ++++++++++++-------
 engine/storage/snapshot/pom.xml           |  4 ++--
 framework/db/pom.xml                      |  4 ++--
 plugins/network-elements/globodns/pom.xml |  4 ++--
 plugins/network-elements/tungsten/pom.xml |  4 ++--
 pom.xml                                   | 10 ++------
 tools/marvin/README.md                    | 29 +++++++++++++++++++++++
 tools/marvin/mvn-setup.py                 |  2 +-
 tools/marvin/setup.py                     |  2 +-
 9 files changed, 56 insertions(+), 27 deletions(-)
 create mode 100644 tools/marvin/README.md

diff --git a/client/pom.xml b/client/pom.xml
index d8fa433d5be3..b8dffe65d4fb 100644
--- a/client/pom.xml
+++ b/client/pom.xml
@@ -666,16 +666,22 @@
     <build>
         <plugins>
             <plugin>
-                <groupId>ru.concerteza.buildnumber</groupId>
-                <artifactId>maven-jgit-buildnumber-plugin</artifactId>
-                <version>1.2.6</version>
+                <groupId>org.codehaus.mojo</groupId>
+                <artifactId>buildnumber-maven-plugin</artifactId>
+                <version>3.2.0</version>
                 <executions>
                     <execution>
                         <id>git-buildnumber</id>
                         <goals>
-                            <goal>extract-buildnumber</goal>
+                            <goal>create</goal>
                         </goals>
                         <phase>prepare-package</phase>
+                        <configuration>
+                            <doCheck>false</doCheck>
+                            <doUpdate>false</doUpdate>
+                            <getRevisionOnlyOnce>true</getRevisionOnlyOnce>
+                            <revisionOnScmFailure>unknown</revisionOnScmFailure>
+                        </configuration>
                     </execution>
                 </executions>
             </plugin>
@@ -688,11 +694,11 @@
                             <mainClass>org.apache.cloudstack.ServerDaemon</mainClass>
                         </manifest>
                         <manifestEntries>
-                            <X-Git-Branch>${git.branch}</X-Git-Branch>
-                            <X-Git-Tag>${git.tag}</X-Git-Tag>
-                            <X-Git-Revision>${git.revision}</X-Git-Revision>
-                            <Implementation-Revision>${git.revision}</Implementation-Revision>
-                            <Implementation-Branch>${git.branch}</Implementation-Branch>
+                            <X-Git-Branch>${scmBranch}</X-Git-Branch>
+                            <X-Git-Tag>${project.version}</X-Git-Tag>
+                            <X-Git-Revision>${buildNumber}</X-Git-Revision>
+                            <Implementation-Revision>${buildNumber}</Implementation-Revision>
+                            <Implementation-Branch>${scmBranch}</Implementation-Branch>
                         </manifestEntries>
                     </archive>
                 </configuration>
diff --git a/engine/storage/snapshot/pom.xml b/engine/storage/snapshot/pom.xml
index 177ab1069d9f..0966082b45ed 100644
--- a/engine/storage/snapshot/pom.xml
+++ b/engine/storage/snapshot/pom.xml
@@ -57,8 +57,8 @@
             <scope>compile</scope>
         </dependency>
         <dependency>
-            <groupId>mysql</groupId>
-            <artifactId>mysql-connector-java</artifactId>
+            <groupId>com.mysql</groupId>
+            <artifactId>mysql-connector-j</artifactId>
             <scope>test</scope>
         </dependency>
     </dependencies>
diff --git a/framework/db/pom.xml b/framework/db/pom.xml
index 04d0fcc7e899..ced0f64c663d 100644
--- a/framework/db/pom.xml
+++ b/framework/db/pom.xml
@@ -53,8 +53,8 @@
             <artifactId>commons-pool2</artifactId>
         </dependency>
         <dependency>
-            <groupId>mysql</groupId>
-            <artifactId>mysql-connector-java</artifactId>
+            <groupId>com.mysql</groupId>
+            <artifactId>mysql-connector-j</artifactId>
         </dependency>
         <dependency>
             <groupId>org.apache.cloudstack</groupId>
diff --git a/plugins/network-elements/globodns/pom.xml b/plugins/network-elements/globodns/pom.xml
index 70bf2287e2ac..11e84d777c15 100644
--- a/plugins/network-elements/globodns/pom.xml
+++ b/plugins/network-elements/globodns/pom.xml
@@ -33,8 +33,8 @@
             <artifactId>globodns-client</artifactId>
         </dependency>
         <dependency>
-            <groupId>mysql</groupId>
-            <artifactId>mysql-connector-java</artifactId>
+            <groupId>com.mysql</groupId>
+            <artifactId>mysql-connector-j</artifactId>
             <scope>test</scope>
         </dependency>
     </dependencies>
diff --git a/plugins/network-elements/tungsten/pom.xml b/plugins/network-elements/tungsten/pom.xml
index eb83c468f0c4..12214afebcb1 100644
--- a/plugins/network-elements/tungsten/pom.xml
+++ b/plugins/network-elements/tungsten/pom.xml
@@ -41,8 +41,8 @@
             <artifactId>reload4j</artifactId>
         </dependency>
         <dependency>
-            <groupId>mysql</groupId>
-            <artifactId>mysql-connector-java</artifactId>
+            <groupId>com.mysql</groupId>
+            <artifactId>mysql-connector-j</artifactId>
             <scope>test</scope>
         </dependency>
     </dependencies>
diff --git a/pom.xml b/pom.xml
index d5b5ba121c94..883e7a4e4db6 100644
--- a/pom.xml
+++ b/pom.xml
@@ -470,8 +470,8 @@
                 <version>${cs.reload4j.version}</version>
             </dependency>
             <dependency>
-                <groupId>mysql</groupId>
-                <artifactId>mysql-connector-java</artifactId>
+                <groupId>com.mysql</groupId>
+                <artifactId>mysql-connector-j</artifactId>
                 <version>${cs.mysql.version}</version>
                 <scope>test</scope>
             </dependency>
@@ -486,12 +486,6 @@
                     </exclusion>
                 </exclusions>
             </dependency>
-            <dependency>
-                <groupId>com.mysql</groupId>
-                <artifactId>mysql-connector-j</artifactId>
-                <version>${cs.mysql.version}</version>
-                <scope>test</scope>
-            </dependency>
             <dependency>
                 <groupId>net.sf.ehcache</groupId>
                 <artifactId>ehcache-core</artifactId>
diff --git a/tools/marvin/README.md b/tools/marvin/README.md
new file mode 100644
index 000000000000..0d43605fc0a3
--- /dev/null
+++ b/tools/marvin/README.md
@@ -0,0 +1,29 @@
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements.  See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership.  The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License.  You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied.  See the License for the
+ specific language governing permissions and limitations
+ under the License.
+ -->
+# Marvin
+
+Marvin is the Apache CloudStack Python client written for running smoke tests.
+
+## Overview
+
+Marvin provides a Python-based client for Apache CloudStack. It offers utilities for testing and interacting with CloudStack deployments.
+
+## License
+
+Licensed under the Apache License, Version 2.0. See the LICENSE.txt file for details.
diff --git a/tools/marvin/mvn-setup.py b/tools/marvin/mvn-setup.py
index cabcf0dc6596..0eab94955120 100755
--- a/tools/marvin/mvn-setup.py
+++ b/tools/marvin/mvn-setup.py
@@ -33,7 +33,7 @@ def replaceVersion(fname, version):
     """replace VERSION in setup.py"""
     with open(fname, 'r') as f:
         content = f.read()
-    needle = '\nVERSION\s*=\s*[\'"][^\'"]*[\'"]'
+    needle = r'\nVERSION\s*=\s*[\'"][^\'"]*[\'"]'
     # Ensure the version is PEP440 compliant
     version = version.replace('-', '+', 1)
     replacement = '\nVERSION = "%s"' % version
diff --git a/tools/marvin/setup.py b/tools/marvin/setup.py
index 6c9aa087bc7d..4694cecc8a53 100644
--- a/tools/marvin/setup.py
+++ b/tools/marvin/setup.py
@@ -38,7 +38,7 @@
       maintainer_email="dev@cloudstack.apache.org",
       long_description="Marvin is the Apache CloudStack python "
                        "client written around the unittest framework",
-      platforms=("Any",),
+      platforms=["Any"],
       url="https://builds.apache.org/job/cloudstack-marvin/",
       packages=["marvin", "marvin.cloudstackAPI",
                 "marvin.lib", "marvin.config", "marvin.sandbox",

From c1c1b0e7659d82a1abeb450ff40a3013cc0084eb Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Fri, 30 Jan 2026 14:07:22 +0530
Subject: [PATCH 110/117] extension: improve host vm power reporting (#11619)

* extension/proxmox: improve host vm power reporting

Add `statuses` action in extensions to report VM power states

This PR introduces support for retrieving the power state of all VMs on a host directly from an extension using the new `statuses` action.
When available, this provides a single aggregated response, reducing the need for multiple calls.

If the extension does not implement `statuses`, the server will gracefully fall back to querying individual VMs using the existing `status` action.

This helps with updating the host in CloudStack after out-of-band migrations for the VM.

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

* address review

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

---------

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
---
 extensions/HyperV/hyperv.py                   |  24 +++
 extensions/Proxmox/proxmox.sh                 | 168 +++++++++++-------
 .../ExternalPathPayloadProvisioner.java       |  65 ++++++-
 .../ExternalPathPayloadProvisionerTest.java   | 148 +++++++++++++++
 .../external/provisioner/provisioner.sh       |  11 ++
 5 files changed, 345 insertions(+), 71 deletions(-)

diff --git a/extensions/HyperV/hyperv.py b/extensions/HyperV/hyperv.py
index c9b1d4da77e3..8e2858d3cae5 100755
--- a/extensions/HyperV/hyperv.py
+++ b/extensions/HyperV/hyperv.py
@@ -210,6 +210,29 @@ def status(self):
             power_state = "poweroff"
         succeed({"status": "success", "power_state": power_state})
 
+    def statuses(self):
+        command = 'Get-VM | Select-Object Name, State | ConvertTo-Json'
+        output = self.run_ps(command)
+        if not output or output.strip() in ("", "null"):
+            vms = []
+        else:
+            try:
+                vms = json.loads(output)
+            except json.JSONDecodeError:
+                fail("Failed to parse VM status output: " + output)
+        power_state = {}
+        if isinstance(vms, dict):
+            vms = [vms]
+        for vm in vms:
+            state = vm["State"].strip().lower()
+            if state == "running":
+                power_state[vm["Name"]] = "poweron"
+            elif state == "off":
+                power_state[vm["Name"]] = "poweroff"
+            else:
+                power_state[vm["Name"]] = "unknown"
+        succeed({"status": "success", "power_state": power_state})
+
     def delete(self):
         try:
             self.run_ps_int(f'Remove-VM -Name "{self.data["vmname"]}" -Force')
@@ -286,6 +309,7 @@ def main():
         "reboot": manager.reboot,
         "delete": manager.delete,
         "status": manager.status,
+        "statuses": manager.statuses,
         "getconsole": manager.get_console,
         "suspend": manager.suspend,
         "resume": manager.resume,
diff --git a/extensions/Proxmox/proxmox.sh b/extensions/Proxmox/proxmox.sh
index fc27f2f30757..459b744f44d9 100755
--- a/extensions/Proxmox/proxmox.sh
+++ b/extensions/Proxmox/proxmox.sh
@@ -64,7 +64,7 @@ parse_json() {
     token="${host_token:-$extension_token}"
     secret="${host_secret:-$extension_secret}"
 
-    check_required_fields vm_internal_name url user token secret node
+    check_required_fields url user token secret node
 }
 
 urlencode() {
@@ -206,6 +206,10 @@ prepare() {
 
 create() {
     if [[ -z "$vm_name" ]]; then
+        if [[ -z "$vm_internal_name" ]]; then
+            echo '{"error":"Missing required fields: vm_internal_name"}'
+            exit 1
+        fi
         vm_name="$vm_internal_name"
     fi
     validate_name "VM" "$vm_name"
@@ -331,71 +335,102 @@ get_node_host() {
     echo "$host"
 }
 
- get_console() {
-     check_required_fields node vmid
-
-     local api_resp port ticket
-     if ! api_resp="$(call_proxmox_api POST "/nodes/${node}/qemu/${vmid}/vncproxy")"; then
-         echo "$api_resp" | jq -c '{status:"error", error:(.errors.curl // (.errors|tostring))}'
-         exit 1
-     fi
-
-     port="$(echo "$api_resp"   | jq -re '.data.port // empty' 2>/dev/null || true)"
-     ticket="$(echo "$api_resp" | jq -re '.data.ticket // empty' 2>/dev/null || true)"
-
-     if [[ -z "$port" || -z "$ticket" ]]; then
-         jq -n --arg raw "$api_resp" \
-             '{status:"error", error:"Proxmox response missing port/ticket", upstream:$raw}'
-         exit 1
-     fi
-
-     # Derive host from node’s network info
-     local host
-     host="$(get_node_host)"
-     if [[ -z "$host" ]]; then
-         jq -n --arg msg "Could not determine host IP for node $node" \
-             '{status:"error", error:$msg}'
-         exit 1
-     fi
-
-     jq -n \
-         --arg host "$host" \
-         --arg port "$port" \
-         --arg password "$ticket" \
-         --argjson passwordonetimeuseonly true \
-         '{
-             status: "success",
-             message: "Console retrieved",
-             console: {
-                 host: $host,
-                 port: $port,
-                 password: $password,
-                 passwordonetimeuseonly: $passwordonetimeuseonly,
-                 protocol: "vnc"
-             }
-         }'
- }
+get_console() {
+    check_required_fields node vmid
 
-list_snapshots() {
-    snapshot_response=$(call_proxmox_api GET "/nodes/${node}/qemu/${vmid}/snapshot")
-    echo "$snapshot_response" | jq '
-      def to_date:
-        if . == "-" then "-"
-        elif . == null then "-"
-        else (. | tonumber | strftime("%Y-%m-%d %H:%M:%S"))
-        end;
+    local api_resp port ticket
+    if ! api_resp="$(call_proxmox_api POST "/nodes/${node}/qemu/${vmid}/vncproxy")"; then
+       echo "$api_resp" | jq -c '{status:"error", error:(.errors.curl // (.errors|tostring))}'
+       exit 1
+    fi
+
+    port="$(echo "$api_resp"   | jq -re '.data.port // empty' 2>/dev/null || true)"
+    ticket="$(echo "$api_resp" | jq -re '.data.ticket // empty' 2>/dev/null || true)"
+
+    if [[ -z "$port" || -z "$ticket" ]]; then
+       jq -n --arg raw "$api_resp" \
+           '{status:"error", error:"Proxmox response missing port/ticket", upstream:$raw}'
+       exit 1
+    fi
+
+    # Derive host from node’s network info
+    local host
+    host="$(get_node_host)"
+    if [[ -z "$host" ]]; then
+       jq -n --arg msg "Could not determine host IP for node $node" \
+           '{status:"error", error:$msg}'
+       exit 1
+    fi
+
+    jq -n \
+       --arg host "$host" \
+       --arg port "$port" \
+       --arg password "$ticket" \
+       --argjson passwordonetimeuseonly true \
+       '{
+           status: "success",
+           message: "Console retrieved",
+           console: {
+               host: $host,
+               port: $port,
+               password: $password,
+               passwordonetimeuseonly: $passwordonetimeuseonly,
+               protocol: "vnc"
+           }
+       }'
+}
+
+statuses() {
+    local response
+    response=$(call_proxmox_api GET "/nodes/${node}/qemu")
+
+    if [[ -z "$response" ]]; then
+        echo '{"status":"error","message":"empty response from Proxmox API"}'
+        return 1
+    fi
+
+    if ! echo "$response" | jq empty >/dev/null 2>&1; then
+        echo '{"status":"error","message":"invalid JSON response from Proxmox API"}'
+        return 1
+    fi
+
+    echo "$response" | jq -c '
+      def map_state(s):
+        if   s=="running" then "poweron"
+        elif s=="stopped" then "poweroff"
+        else "unknown" end;
 
       {
         status: "success",
-        printmessage: "true",
-        message: [.data[] | {
-          name: .name,
-          snaptime: ((.snaptime // "-") | to_date),
-          description: .description,
-          parent: (.parent // "-"),
-          vmstate: (.vmstate // "-")
-        }]
-      }
+        power_state: (
+          .data
+          | map(select(.template != 1))
+          | map({ ( (.name // (.vmid|tostring)) ): map_state(.status) })
+          | add // {}
+        )
+      }'
+}
+
+list_snapshots() {
+    snapshot_response=$(call_proxmox_api GET "/nodes/${node}/qemu/${vmid}/snapshot")
+    echo "$snapshot_response" | jq '
+        def to_date:
+            if . == "-" then "-"
+            elif . == null then "-"
+            else (. | tonumber | strftime("%Y-%m-%d %H:%M:%S"))
+            end;
+
+        {
+            status: "success",
+            printmessage: "true",
+            message: [.data[] | {
+                name: .name,
+                snaptime: ((.snaptime // "-") | to_date),
+                description: .description,
+                parent: (.parent // "-"),
+                vmstate: (.vmstate // "-")
+            }]
+        }
     '
 }
 
@@ -463,9 +498,9 @@ parse_json "$parameters" || exit 1
 
 cleanup_vm=0
 cleanup() {
-  if (( cleanup_vm == 1 )); then
-    execute_and_wait DELETE "/nodes/${node}/qemu/${vmid}"
-  fi
+    if (( cleanup_vm == 1 )); then
+        execute_and_wait DELETE "/nodes/${node}/qemu/${vmid}"
+    fi
 }
 
 trap cleanup EXIT
@@ -492,6 +527,9 @@ case $action in
     status)
         status
         ;;
+    statuses)
+        statuses
+        ;;
     getconsole)
         get_console
         ;;
diff --git a/plugins/hypervisors/external/src/main/java/org/apache/cloudstack/hypervisor/external/provisioner/ExternalPathPayloadProvisioner.java b/plugins/hypervisors/external/src/main/java/org/apache/cloudstack/hypervisor/external/provisioner/ExternalPathPayloadProvisioner.java
index 92205b13c6ff..fa3f4de50265 100644
--- a/plugins/hypervisors/external/src/main/java/org/apache/cloudstack/hypervisor/external/provisioner/ExternalPathPayloadProvisioner.java
+++ b/plugins/hypervisors/external/src/main/java/org/apache/cloudstack/hypervisor/external/provisioner/ExternalPathPayloadProvisioner.java
@@ -71,6 +71,7 @@
 import com.cloud.agent.api.StopAnswer;
 import com.cloud.agent.api.StopCommand;
 import com.cloud.agent.api.to.VirtualMachineTO;
+import com.cloud.host.Host;
 import com.cloud.host.HostVO;
 import com.cloud.host.dao.HostDao;
 import com.cloud.hypervisor.ExternalProvisioner;
@@ -128,7 +129,7 @@ public class ExternalPathPayloadProvisioner extends ManagerBase implements Exter
     private ExecutorService payloadCleanupExecutor;
     private ScheduledExecutorService payloadCleanupScheduler;
     private static final List<String> TRIVIAL_ACTIONS = Arrays.asList(
-            "status"
+            "status", "statuses"
     );
 
     @Override
@@ -456,7 +457,7 @@ public StopAnswer expungeInstance(String hostName, String extensionName, String
     @Override
     public Map<String, HostVmStateReportEntry> getHostVmStateReport(long hostId, String extensionName,
                             String extensionRelativePath) {
-        final Map<String, HostVmStateReportEntry> vmStates = new HashMap<>();
+        Map<String, HostVmStateReportEntry> vmStates = new HashMap<>();
         String extensionPath = getExtensionCheckedPath(extensionName, extensionRelativePath);
         if (StringUtils.isEmpty(extensionPath)) {
             return vmStates;
@@ -466,14 +467,20 @@ public Map<String, HostVmStateReportEntry> getHostVmStateReport(long hostId, Str
             logger.error("Host with ID: {} not found", hostId);
             return vmStates;
         }
+        Map<String, Map<String, String>> accessDetails =
+                extensionsManager.getExternalAccessDetails(host, null);
+        vmStates = getVmPowerStates(host, accessDetails, extensionName, extensionPath);
+        if (vmStates != null) {
+            logger.debug("Found {} VMs on the host {}", vmStates.size(), host);
+            return vmStates;
+        }
+        vmStates = new HashMap<>();
         List<UserVmVO> allVms = _uservmDao.listByHostId(hostId);
         allVms.addAll(_uservmDao.listByLastHostId(hostId));
         if (CollectionUtils.isEmpty(allVms)) {
             logger.debug("No VMs found for the {}", host);
             return vmStates;
         }
-        Map<String, Map<String, String>> accessDetails =
-                extensionsManager.getExternalAccessDetails(host, null);
         for (UserVmVO vm: allVms) {
             VirtualMachine.PowerState powerState = getVmPowerState(vm, accessDetails, extensionName, extensionPath);
             vmStates.put(vm.getInstanceName(), new HostVmStateReportEntry(powerState, "host-" + hostId));
@@ -714,7 +721,7 @@ protected VirtualMachine.PowerState parsePowerStateFromResponse(UserVmVO userVmV
             return getPowerStateFromString(response);
         }
         try {
-            JsonObject jsonObj = new JsonParser().parse(response).getAsJsonObject();
+            JsonObject jsonObj = JsonParser.parseString(response).getAsJsonObject();
             String powerState = jsonObj.has("power_state") ? jsonObj.get("power_state").getAsString() : null;
             return getPowerStateFromString(powerState);
         } catch (Exception e) {
@@ -724,7 +731,7 @@ protected VirtualMachine.PowerState parsePowerStateFromResponse(UserVmVO userVmV
         }
     }
 
-    private VirtualMachine.PowerState getVmPowerState(UserVmVO userVmVO, Map<String, Map<String, String>> accessDetails,
+    protected VirtualMachine.PowerState getVmPowerState(UserVmVO userVmVO, Map<String, Map<String, String>> accessDetails,
                   String extensionName, String extensionPath) {
         VirtualMachineTO virtualMachineTO = getVirtualMachineTO(userVmVO);
         accessDetails.put(ApiConstants.VIRTUAL_MACHINE, virtualMachineTO.getExternalDetails());
@@ -740,6 +747,46 @@ private VirtualMachine.PowerState getVmPowerState(UserVmVO userVmVO, Map<String,
         }
         return parsePowerStateFromResponse(userVmVO, result.second());
     }
+
+    protected Map<String, HostVmStateReportEntry> getVmPowerStates(Host host,
+                   Map<String, Map<String, String>> accessDetails, String extensionName, String extensionPath) {
+        Map<String, Object> modifiedDetails = loadAccessDetails(accessDetails, null);
+        logger.debug("Trying to get VM power statuses from the external system for {}", host);
+        Pair<Boolean, String> result = getInstanceStatusesOnExternalSystem(extensionName, extensionPath,
+                host.getName(), modifiedDetails, AgentManager.Wait.value());
+        if (!result.first()) {
+            logger.warn("Failure response received while trying to fetch the power statuses for {} : {}",
+                    host, result.second());
+            return null;
+        }
+        if (StringUtils.isBlank(result.second())) {
+            logger.warn("Empty response while trying to fetch VM power statuses for host: {}", host);
+            return null;
+        }
+        try {
+            JsonObject jsonObj = JsonParser.parseString(result.second()).getAsJsonObject();
+            if (!jsonObj.has("status") || !"success".equalsIgnoreCase(jsonObj.get("status").getAsString())) {
+                logger.warn("Invalid status in response while trying to fetch VM power statuses for host: {}: {}",
+                        host, result.second());
+                return null;
+            }
+            if (!jsonObj.has("power_state") || !jsonObj.get("power_state").isJsonObject()) {
+                logger.warn("Missing or invalid power_state in response for host: {}: {}", host, result.second());
+                return null;
+            }
+            JsonObject powerStates = jsonObj.getAsJsonObject("power_state");
+            Map<String, HostVmStateReportEntry> states = new HashMap<>();
+            for (Map.Entry<String, com.google.gson.JsonElement> entry : powerStates.entrySet()) {
+                VirtualMachine.PowerState powerState = getPowerStateFromString(entry.getValue().getAsString());
+                states.put(entry.getKey(), new HostVmStateReportEntry(powerState, "host-" + host.getId()));
+            }
+            return states;
+        } catch (Exception e) {
+            logger.warn("Failed to parse VM power statuses response for host: {}: {}", host, e.getMessage());
+            return null;
+        }
+    }
+
     public Pair<Boolean, String> prepareExternalProvisioningInternal(String extensionName, String filename,
                              String vmUUID, Map<String, Object> accessDetails, int wait) {
         return executeExternalCommand(extensionName, "prepare", accessDetails, wait,
@@ -783,6 +830,12 @@ public Pair<Boolean, String> getInstanceStatusOnExternalSystem(String extensionN
                 String.format("Failed to get the instance power status %s on external system", vmUUID), filename);
     }
 
+    public Pair<Boolean, String> getInstanceStatusesOnExternalSystem(String extensionName, String filename,
+                               String hostName, Map<String, Object> accessDetails, int wait) {
+        return executeExternalCommand(extensionName, "statuses", accessDetails, wait,
+                String.format("Failed to get the %s instances power status on external system", hostName), filename);
+    }
+
     public Pair<Boolean, String> getInstanceConsoleOnExternalSystem(String extensionName, String filename,
                             String vmUUID, Map<String, Object> accessDetails, int wait) {
         return executeExternalCommand(extensionName, "getconsole", accessDetails, wait,
diff --git a/plugins/hypervisors/external/src/test/java/org/apache/cloudstack/hypervisor/external/provisioner/ExternalPathPayloadProvisionerTest.java b/plugins/hypervisors/external/src/test/java/org/apache/cloudstack/hypervisor/external/provisioner/ExternalPathPayloadProvisionerTest.java
index d0a396f7a94c..e8ab92c986e9 100644
--- a/plugins/hypervisors/external/src/test/java/org/apache/cloudstack/hypervisor/external/provisioner/ExternalPathPayloadProvisionerTest.java
+++ b/plugins/hypervisors/external/src/test/java/org/apache/cloudstack/hypervisor/external/provisioner/ExternalPathPayloadProvisionerTest.java
@@ -79,6 +79,7 @@
 import com.cloud.agent.api.StopAnswer;
 import com.cloud.agent.api.StopCommand;
 import com.cloud.agent.api.to.VirtualMachineTO;
+import com.cloud.host.Host;
 import com.cloud.host.HostVO;
 import com.cloud.host.dao.HostDao;
 import com.cloud.hypervisor.Hypervisor;
@@ -761,6 +762,37 @@ public void getVirtualMachineTOReturnsNullWhenVmIsNull() {
         assertNull(result);
     }
 
+    @Test
+    public void getVmPowerStatesReturnsValidStatesWhenResponseIsSuccessful() {
+        Host host = mock(Host.class);
+        when(host.getId()).thenReturn(1L);
+        when(host.getName()).thenReturn("test-host");
+
+        Map<String, Map<String, String>> accessDetails = new HashMap<>();
+        doReturn(new Pair<>(true, "{\"status\":\"success\",\"power_state\":{\"vm1\":\"PowerOn\",\"vm2\":\"PowerOff\"}}"))
+            .when(provisioner).getInstanceStatusesOnExternalSystem(anyString(), anyString(), anyString(), anyMap(), anyInt());
+
+        Map<String, HostVmStateReportEntry> result = provisioner.getVmPowerStates(host, accessDetails, "test-extension", "test-path");
+
+        assertNotNull(result);
+        assertEquals(2, result.size());
+        assertEquals(VirtualMachine.PowerState.PowerOn, result.get("vm1").getState());
+        assertEquals(VirtualMachine.PowerState.PowerOff, result.get("vm2").getState());
+    }
+
+    @Test
+    public void getVmPowerStatesReturnsNullWhenResponseIsFailure() {
+        Host host = mock(Host.class);
+        when(host.getName()).thenReturn("test-host");
+
+        Map<String, Map<String, String>> accessDetails = new HashMap<>();
+        doReturn(new Pair<>(false, "Error")).when(provisioner)
+            .getInstanceStatusesOnExternalSystem(anyString(), anyString(), anyString(), anyMap(), anyInt());
+
+        Map<String, HostVmStateReportEntry> result = provisioner.getVmPowerStates(host, accessDetails, "test-extension", "test-path");
+        assertNull(result);
+    }
+
     @Test
     public void getVirtualMachineTOReturnsValidTOWhenVmIsNotNull() {
         VirtualMachine vm = mock(VirtualMachine.class);
@@ -986,4 +1018,120 @@ public void getExtensionConfigureErrorReturnsMessageWhenHostNameIsNull() {
         String result = provisioner.getExtensionConfigureError("test-extension", null);
         assertEquals("Extension: test-extension not configured", result);
     }
+
+    @Test
+    public void getVmPowerStatesReturnsNullWhenResponseIsEmpty() {
+        Host host = mock(Host.class);
+        when(host.getName()).thenReturn("test-host");
+
+        Map<String, Map<String, String>> accessDetails = new HashMap<>();
+        doReturn(new Pair<>(true, "")).when(provisioner)
+            .getInstanceStatusesOnExternalSystem(anyString(), anyString(), anyString(), anyMap(), anyInt());
+
+        Map<String, HostVmStateReportEntry> result = provisioner.getVmPowerStates(host, accessDetails, "test-extension", "test-path");
+
+        assertNull(result);
+    }
+
+    @Test
+    public void getVmPowerStatesReturnsNullWhenResponseHasInvalidStatus() {
+        Host host = mock(Host.class);
+        when(host.getName()).thenReturn("test-host");
+
+        Map<String, Map<String, String>> accessDetails = new HashMap<>();
+        doReturn(new Pair<>(true, "{\"status\":\"failure\"}")).when(provisioner)
+            .getInstanceStatusesOnExternalSystem(anyString(), anyString(), anyString(), anyMap(), anyInt());
+
+        Map<String, HostVmStateReportEntry> result = provisioner.getVmPowerStates(host, accessDetails, "test-extension", "test-path");
+
+        assertNull(result);
+    }
+
+    @Test
+    public void getVmPowerStatesReturnsNullWhenPowerStateIsMissing() {
+        Host host = mock(Host.class);
+        when(host.getName()).thenReturn("test-host");
+
+        Map<String, Map<String, String>> accessDetails = new HashMap<>();
+        doReturn(new Pair<>(true, "{\"status\":\"success\"}")).when(provisioner)
+            .getInstanceStatusesOnExternalSystem(anyString(), anyString(), anyString(), anyMap(), anyInt());
+
+        Map<String, HostVmStateReportEntry> result = provisioner.getVmPowerStates(host, accessDetails, "test-extension", "test-path");
+
+        assertNull(result);
+    }
+
+    @Test
+    public void getVmPowerStatesReturnsNullWhenResponseIsMalformed() {
+        Host host = mock(Host.class);
+        when(host.getName()).thenReturn("test-host");
+
+        Map<String, Map<String, String>> accessDetails = new HashMap<>();
+        doReturn(new Pair<>(true, "{status:success")).when(provisioner)
+            .getInstanceStatusesOnExternalSystem(anyString(), anyString(), anyString(), anyMap(), anyInt());
+
+        Map<String, HostVmStateReportEntry> result = provisioner.getVmPowerStates(host, accessDetails, "test-extension", "test-path");
+
+        assertNull(result);
+    }
+
+    @Test
+    public void getInstanceStatusesOnExternalSystemReturnsSuccessWhenCommandExecutesSuccessfully() {
+        doReturn(new Pair<>(true, "success")).when(provisioner)
+            .executeExternalCommand(eq("test-extension"), eq("statuses"), anyMap(), eq(30), anyString(), eq("test-file"));
+
+        Pair<Boolean, String> result = provisioner.getInstanceStatusesOnExternalSystem(
+            "test-extension", "test-file", "test-host", new HashMap<>(), 30);
+
+        assertTrue(result.first());
+        assertEquals("success", result.second());
+    }
+
+    @Test
+    public void getInstanceStatusesOnExternalSystemReturnsFailureWhenCommandFails() {
+        doReturn(new Pair<>(false, "error")).when(provisioner)
+            .executeExternalCommand(eq("test-extension"), eq("statuses"), anyMap(), eq(30), anyString(), eq("test-file"));
+
+        Pair<Boolean, String> result = provisioner.getInstanceStatusesOnExternalSystem(
+            "test-extension", "test-file", "test-host", new HashMap<>(), 30);
+
+        assertFalse(result.first());
+        assertEquals("error", result.second());
+    }
+
+    @Test
+    public void getInstanceStatusesOnExternalSystemHandlesEmptyResponse() {
+        doReturn(new Pair<>(true, "")).when(provisioner)
+            .executeExternalCommand(eq("test-extension"), eq("statuses"), anyMap(), eq(30), anyString(), eq("test-file"));
+
+        Pair<Boolean, String> result = provisioner.getInstanceStatusesOnExternalSystem(
+            "test-extension", "test-file", "test-host", new HashMap<>(), 30);
+
+        assertTrue(result.first());
+        assertEquals("", result.second());
+    }
+
+    @Test
+    public void getInstanceStatusesOnExternalSystemHandlesNullResponse() {
+        doReturn(new Pair<>(true, null)).when(provisioner)
+            .executeExternalCommand(eq("test-extension"), eq("statuses"), anyMap(), eq(30), anyString(), eq("test-file"));
+
+        Pair<Boolean, String> result = provisioner.getInstanceStatusesOnExternalSystem(
+            "test-extension", "test-file", "test-host", new HashMap<>(), 30);
+
+        assertTrue(result.first());
+        assertNull(result.second());
+    }
+
+    @Test
+    public void getInstanceStatusesOnExternalSystemHandlesInvalidFilePath() {
+        doReturn(new Pair<>(false, "File not found")).when(provisioner)
+            .executeExternalCommand(eq("test-extension"), eq("statuses"), anyMap(), eq(30), anyString(), eq("invalid-file"));
+
+        Pair<Boolean, String> result = provisioner.getInstanceStatusesOnExternalSystem(
+            "test-extension", "invalid-file", "test-host", new HashMap<>(), 30);
+
+        assertFalse(result.first());
+        assertEquals("File not found", result.second());
+    }
 }
diff --git a/scripts/vm/hypervisor/external/provisioner/provisioner.sh b/scripts/vm/hypervisor/external/provisioner/provisioner.sh
index f067d892f1f3..c92ac36f4669 100755
--- a/scripts/vm/hypervisor/external/provisioner/provisioner.sh
+++ b/scripts/vm/hypervisor/external/provisioner/provisioner.sh
@@ -99,6 +99,14 @@ status() {
     echo '{"status": "success", "power_state": "poweron"}'
 }
 
+statuses() {
+    parse_json "$1" || exit 1
+    # This external system can not return an output like the following:
+    # {"status":"success","power_state":{"i-3-23-VM":"poweroff","i-2-25-VM":"poweron"}}
+    # CloudStack can fallback to retrieving the power state of the single VM using the "status" action
+    echo '{"status": "error", "message": "Not supported"}'
+}
+
 get_console() {
     parse_json "$1" || exit 1
     local response
@@ -145,6 +153,9 @@ case $action in
     status)
         status "$parameters"
         ;;
+    statuses)
+        statuses "$parameters"
+        ;;
     getconsole)
         get_console "$parameters"
         ;;

From d0e21a7dba866c4a363a5dfe05d079295626fefc Mon Sep 17 00:00:00 2001
From: Vishesh <8760112+vishesh92@users.noreply.github.com>
Date: Fri, 30 Jan 2026 14:23:28 +0530
Subject: [PATCH 111/117] UI: Prevent extra API calls in search filter on
 scrolling (#12553)

---
 ui/src/components/view/SearchFilter.vue | 13 +++---
 ui/src/views/AutogenView.vue            | 55 +++++++++++++------------
 2 files changed, 36 insertions(+), 32 deletions(-)

diff --git a/ui/src/components/view/SearchFilter.vue b/ui/src/components/view/SearchFilter.vue
index 9849ba8de442..34ca438b5c5b 100644
--- a/ui/src/components/view/SearchFilter.vue
+++ b/ui/src/components/view/SearchFilter.vue
@@ -1,17 +1,17 @@
 // Licensed to the Apache Software Foundation (ASF) under one
-// or more contributor license agreements. See the NOTICE file
+// or more contributor license agreements.  See the NOTICE file
 // distributed with this work for additional information
-// regarding copyright ownership. The ASF licenses this file
+// regarding copyright ownership.  The ASF licenses this file
 // to you under the Apache License, Version 2.0 (the
 // "License"); you may not use this file except in compliance
-// with the License. You may obtain a copy of the License at
+// with the License.  You may obtain a copy of the License at
 //
-// http://www.apache.org/licenses/LICENSE-2.0
+//   http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing,
 // software distributed under the License is distributed on an
 // "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied. See the License for the
+// KIND, either express or implied.  See the License for the
 // specific language governing permissions and limitations
 // under the License.
 
@@ -189,9 +189,10 @@ export default {
               resolve()
             } else {
               this.getSearchFilters(filter.key, filter.value).then((value) => {
+                const displayValue = (value !== undefined && value !== null && value !== '') ? value : filter.value
                 clonedFilters[idx] = {
                   key: filter.key,
-                  value: value,
+                  value: displayValue,
                   isTag: filter.isTag
                 }
                 resolve()
diff --git a/ui/src/views/AutogenView.vue b/ui/src/views/AutogenView.vue
index 6c146875ece6..325df769deef 100644
--- a/ui/src/views/AutogenView.vue
+++ b/ui/src/views/AutogenView.vue
@@ -114,7 +114,7 @@
           style="min-height: 36px; padding-top: 12px; padding-left: 12px;"
         >
           <search-filter
-            :filters="getActiveFilters()"
+            :filters="activeFiltersList"
             :apiName="apiName"
             @removeFilter="removeFilter"
           />
@@ -690,9 +690,36 @@ export default {
     }
   },
   computed: {
+    activeFiltersList () {
+      const queryParams = Object.assign({}, this.$route.query)
+      const activeFilters = []
+      for (const filter in queryParams) {
+        if (this.$route.name === 'host' && filter === 'type') {
+          continue
+        }
+        if (!filter.startsWith('tags[')) {
+          activeFilters.push({
+            key: filter,
+            value: queryParams[filter],
+            isTag: false
+          })
+        } else if (filter.endsWith('].key')) {
+          const tagIdx = filter.split('[')[1].split(']')[0]
+          const tagKey = queryParams[`tags[${tagIdx}].key`]
+          const tagValue = queryParams[`tags[${tagIdx}].value`]
+          activeFilters.push({
+            key: tagKey,
+            value: tagValue,
+            isTag: true,
+            tagIdx: tagIdx
+          })
+        }
+      }
+      return activeFilters
+    },
     showSearchFilters () {
       const excludedKeys = ['page', 'pagesize', 'q', 'keyword', 'tags', 'projectid']
-      return !this.dataView && this.$config.showSearchFilters && this.getActiveFilters().some(f => !excludedKeys.includes(f.key))
+      return !this.dataView && this.$config.showSearchFilters && this.activeFiltersList.some(f => !excludedKeys.includes(f.key))
     },
     hasSelected () {
       return this.selectedRowKeys.length > 0
@@ -1145,30 +1172,6 @@ export default {
       eventBus.emit('action-closing', { action: this.currentAction })
       this.closeAction()
     },
-    getActiveFilters () {
-      const queryParams = Object.assign({}, this.$route.query)
-      const activeFilters = []
-      for (const filter in queryParams) {
-        if (!filter.startsWith('tags[')) {
-          activeFilters.push({
-            key: filter,
-            value: queryParams[filter],
-            isTag: false
-          })
-        } else if (filter.endsWith('].key')) {
-          const tagIdx = filter.split('[')[1].split(']')[0]
-          const tagKey = queryParams[`tags[${tagIdx}].key`]
-          const tagValue = queryParams[`tags[${tagIdx}].value`]
-          activeFilters.push({
-            key: tagKey,
-            value: tagValue,
-            isTag: true,
-            tagIdx: tagIdx
-          })
-        }
-      }
-      return activeFilters
-    },
     removeFilter (filter) {
       const queryParams = Object.assign({}, this.$route.query)
       if (filter.isTag) {

From d98511dddd86206c15c23b09e5180a931fd1c54e Mon Sep 17 00:00:00 2001
From: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
Date: Fri, 30 Jan 2026 15:21:38 +0530
Subject: [PATCH 112/117] Update physical size for the snapshots of the volumes
 on ceph primary storage (#12465)

---
 .../storage/to/SnapshotObjectTO.java          |  2 -
 .../storage/snapshot/SnapshotObject.java      |  5 +-
 .../resource/LibvirtComputingResource.java    | 15 ++--
 .../kvm/storage/KVMStorageProcessor.java      | 69 ++++++++++++++-----
 4 files changed, 62 insertions(+), 29 deletions(-)

diff --git a/core/src/main/java/org/apache/cloudstack/storage/to/SnapshotObjectTO.java b/core/src/main/java/org/apache/cloudstack/storage/to/SnapshotObjectTO.java
index 76b93909b8c1..9d64ab841214 100644
--- a/core/src/main/java/org/apache/cloudstack/storage/to/SnapshotObjectTO.java
+++ b/core/src/main/java/org/apache/cloudstack/storage/to/SnapshotObjectTO.java
@@ -44,9 +44,7 @@ public class SnapshotObjectTO extends DownloadableObjectTO implements DataTO {
     private Long physicalSize = (long) 0;
     private long accountId;
 
-
     public SnapshotObjectTO() {
-
     }
 
     public SnapshotObjectTO(SnapshotInfo snapshot) {
diff --git a/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/snapshot/SnapshotObject.java b/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/snapshot/SnapshotObject.java
index 7602a142f885..df7e476cc204 100644
--- a/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/snapshot/SnapshotObject.java
+++ b/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/snapshot/SnapshotObject.java
@@ -358,13 +358,16 @@ public void processEvent(ObjectInDataStoreStateMachine.Event event, Answer answe
             if (answer instanceof CreateObjectAnswer) {
                 SnapshotObjectTO snapshotTO = (SnapshotObjectTO)((CreateObjectAnswer)answer).getData();
                 snapshotStore.setInstallPath(snapshotTO.getPath());
+                if (snapshotTO.getPhysicalSize() != null && snapshotTO.getPhysicalSize() > 0L) {
+                    snapshotStore.setPhysicalSize(snapshotTO.getPhysicalSize());
+                }
                 snapshotStoreDao.update(snapshotStore.getId(), snapshotStore);
             } else if (answer instanceof CopyCmdAnswer) {
                 SnapshotObjectTO snapshotTO = (SnapshotObjectTO)((CopyCmdAnswer)answer).getNewData();
                 snapshotStore.setInstallPath(snapshotTO.getPath());
                 if (snapshotTO.getPhysicalSize() != null) {
                     // For S3 delta snapshot, physical size is currently not set
-                snapshotStore.setPhysicalSize(snapshotTO.getPhysicalSize());
+                    snapshotStore.setPhysicalSize(snapshotTO.getPhysicalSize());
                 }
                 if (snapshotTO.getParentSnapshotPath() == null) {
                     snapshotStore.setParentSnapshotId(0L);
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
index c7b2747a777d..054ef44bbe74 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
@@ -1836,7 +1836,7 @@ protected static boolean isInterface(final String fname) {
         for (final String ifNamePattern : ifNamePatterns) {
             commonPattern.append("|(").append(ifNamePattern).append(".*)");
         }
-        if(fname.matches(commonPattern.toString())) {
+        if (fname.matches(commonPattern.toString())) {
             return true;
         }
         return false;
@@ -2128,11 +2128,10 @@ private String getBroadcastUriFromBridge(final String brName) {
         final Pattern pattern = Pattern.compile("(\\D+)(\\d+)(\\D*)(\\d*)(\\D*)(\\d*)");
         final Matcher matcher = pattern.matcher(pif);
         LOGGER.debug("getting broadcast uri for pif " + pif + " and bridge " + brName);
-        if(matcher.find()) {
+        if (matcher.find()) {
             if (brName.startsWith("brvx")){
                 return BroadcastDomainType.Vxlan.toUri(matcher.group(2)).toString();
-            }
-            else{
+            } else {
                 if (!matcher.group(6).isEmpty()) {
                     return BroadcastDomainType.Vlan.toUri(matcher.group(6)).toString();
                 } else if (!matcher.group(4).isEmpty()) {
@@ -3331,7 +3330,7 @@ public int compare(final DiskTO arg0, final DiskTO arg1) {
                 } else if (volume.getType() == Volume.Type.DATADISK) {
                     final KVMPhysicalDisk physicalDisk = storagePoolManager.getPhysicalDisk(store.getPoolType(), store.getUuid(), data.getPath());
                     final KVMStoragePool pool = physicalDisk.getPool();
-                    if(StoragePoolType.RBD.equals(pool.getType())) {
+                    if (StoragePoolType.RBD.equals(pool.getType())) {
                         final int devId = volume.getDiskSeq().intValue();
                         final String device = mapRbdDevice(physicalDisk);
                         if (device != null) {
@@ -4777,7 +4776,7 @@ protected long getMemoryFreeInKBs(Domain dm) throws LibvirtException {
         }
 
         for (int i = 0; i < memoryStats.length; i++) {
-            if(memoryStats[i].getTag() == UNUSEDMEMORY) {
+            if (memoryStats[i].getTag() == UNUSEDMEMORY) {
                 freeMemory = memoryStats[i].getValue();
                 break;
             }
@@ -5243,12 +5242,12 @@ public HypervisorType getHypervisorType(){
         return hypervisorType;
     }
 
-    public String mapRbdDevice(final KVMPhysicalDisk disk){
+    public String mapRbdDevice(final KVMPhysicalDisk disk) {
         final KVMStoragePool pool = disk.getPool();
         //Check if rbd image is already mapped
         final String[] splitPoolImage = disk.getPath().split("/");
         String device = Script.runSimpleBashScript("rbd showmapped | grep \""+splitPoolImage[0]+"[ ]*"+splitPoolImage[1]+"\" | grep -o \"[^ ]*[ ]*$\"");
-        if(device == null) {
+        if (device == null) {
             //If not mapped, map and return mapped device
             Script.runSimpleBashScript("rbd map " + disk.getPath() + " --id " + pool.getAuthUserName());
             device = Script.runSimpleBashScript("rbd showmapped | grep \""+splitPoolImage[0]+"[ ]*"+splitPoolImage[1]+"\" | grep -o \"[^ ]*[ ]*$\"");
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java
index 87ca531bb74f..52740cead278 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java
@@ -43,6 +43,9 @@
 
 import javax.naming.ConfigurationException;
 
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
 import org.apache.cloudstack.agent.directdownload.DirectDownloadAnswer;
 import org.apache.cloudstack.agent.directdownload.DirectDownloadCommand;
 import org.apache.cloudstack.direct.download.DirectDownloadHelper;
@@ -305,7 +308,7 @@ public Answer copyTemplateToPrimaryStorage(final CopyCommand cmd) {
                 newTemplate.setPath(primaryVol.getName());
                 newTemplate.setSize(primaryVol.getSize());
 
-                if(List.of(
+                if (List.of(
                     StoragePoolType.RBD,
                     StoragePoolType.PowerFlex,
                     StoragePoolType.Linstor,
@@ -696,7 +699,7 @@ public Answer createTemplateFromVolume(final CopyCommand cmd) {
                 templateContent += "snapshot.name=" + dateFormat.format(date) + System.getProperty("line.separator");
 
 
-                try(FileOutputStream templFo = new FileOutputStream(templateProp);){
+                try (FileOutputStream templFo = new FileOutputStream(templateProp);) {
                     templFo.write(templateContent.getBytes());
                     templFo.flush();
                 } catch (final IOException e) {
@@ -761,11 +764,9 @@ private Answer createTemplateFromVolumeOrSnapshot(CopyCommand cmd) {
 
         if (srcData instanceof VolumeObjectTO) {
             isVolume = true;
-        }
-        else if (srcData instanceof SnapshotObjectTO) {
+        } else if (srcData instanceof SnapshotObjectTO) {
             isVolume = false;
-        }
-        else {
+        } else {
             return new CopyCmdAnswer("unsupported object type");
         }
 
@@ -831,8 +832,7 @@ else if (srcData instanceof SnapshotObjectTO) {
 
             if (isVolume) {
                 templateContent += "volume.name=" + dateFormat.format(date) + System.getProperty("line.separator");
-            }
-            else {
+            } else {
                 templateContent += "snapshot.name=" + dateFormat.format(date) + System.getProperty("line.separator");
             }
 
@@ -870,8 +870,7 @@ else if (srcData instanceof SnapshotObjectTO) {
         } catch (Exception ex) {
             if (isVolume) {
                 logger.debug("Failed to create template from volume: ", ex);
-            }
-            else {
+            } else {
                 logger.debug("Failed to create template from snapshot: ", ex);
             }
 
@@ -1034,7 +1033,7 @@ public Answer backupSnapshot(final CopyCommand cmd) {
                     q.convert(srcFile, destFile);
 
                     final File snapFile = new File(snapshotFile);
-                    if(snapFile.exists()) {
+                    if (snapFile.exists()) {
                         size = snapFile.length();
                     }
 
@@ -1067,7 +1066,7 @@ public Answer backupSnapshot(final CopyCommand cmd) {
                     return new CopyCmdAnswer(result);
                 }
                 final File snapFile = new File(snapshotDestPath + "/" + descName);
-                if(snapFile.exists()){
+                if (snapFile.exists()) {
                     size = snapFile.length();
                 }
             }
@@ -1406,7 +1405,7 @@ protected synchronized void attachOrDetachDisk(final Connect conn, final boolean
                     if (resource.getHypervisorType() == Hypervisor.HypervisorType.LXC) {
                         final String device = resource.mapRbdDevice(attachingDisk);
                         if (device != null) {
-                            logger.debug("RBD device on host is: "+device);
+                            logger.debug("RBD device on host is: " + device);
                             attachingDisk.setPath(device);
                         }
                     }
@@ -1433,11 +1432,11 @@ protected synchronized void attachOrDetachDisk(final Connect conn, final boolean
                 }
                 diskdef.setSerial(serial);
                 if (attachingPool.getType() == StoragePoolType.RBD) {
-                    if(resource.getHypervisorType() == Hypervisor.HypervisorType.LXC){
+                    if (resource.getHypervisorType() == Hypervisor.HypervisorType.LXC) {
                         // For LXC, map image to host and then attach to Vm
                         final String device = resource.mapRbdDevice(attachingDisk);
                         if (device != null) {
-                            logger.debug("RBD device on host is: "+device);
+                            logger.debug("RBD device on host is: " + device);
                             diskdef.defBlockBasedDisk(device, devId, busT);
                         } else {
                             throw new InternalErrorException("Error while mapping disk "+attachingDisk.getPath()+" on host");
@@ -1507,7 +1506,7 @@ protected synchronized void attachOrDetachDisk(final Connect conn, final boolean
                 if ((iopsWriteRateMaxLength != null) && (iopsWriteRateMaxLength > 0)) {
                     diskdef.setIopsWriteRateMaxLength(iopsWriteRateMaxLength);
                 }
-                if(cacheMode != null) {
+                if (cacheMode != null) {
                     diskdef.setCacheMode(DiskDef.DiskCacheMode.valueOf(cacheMode.toUpperCase()));
                 }
 
@@ -1690,7 +1689,7 @@ public Answer createVolume(final CreateObjectCommand cmd) {
             }
 
             final VolumeObjectTO newVol = new VolumeObjectTO();
-            if(vol != null) {
+            if (vol != null) {
                 newVol.setPath(vol.getName());
                 if (vol.getQemuEncryptFormat() != null) {
                     newVol.setEncryptFormat(vol.getQemuEncryptFormat().toString());
@@ -1793,6 +1792,7 @@ public Answer createSnapshot(final CreateObjectCommand cmd) {
 
             String diskPath = disk.getPath();
             String snapshotPath = diskPath + File.separator + snapshotName;
+            Long snapshotSize = null;
             if (state == DomainInfo.DomainState.VIR_DOMAIN_RUNNING && !primaryPool.isExternalSnapshot()) {
 
                 validateAvailableSizeOnPoolToTakeVolumeSnapshot(primaryPool, disk);
@@ -1853,6 +1853,11 @@ public Answer createSnapshot(final CreateObjectCommand cmd) {
                         logger.debug("Attempting to create RBD snapshot " + disk.getName() + "@" + snapshotName);
                         image.snapCreate(snapshotName);
 
+                        long rbdSnapshotSize = getRbdSnapshotSize(primaryPool.getSourceDir(), disk.getName(), snapshotName, primaryPool.getSourceHost(), primaryPool.getAuthUserName(), primaryPool.getAuthSecret());
+                        if (rbdSnapshotSize > 0) {
+                            snapshotSize = rbdSnapshotSize;
+                        }
+
                         rbd.close(image);
                         r.ioCtxDestroy(io);
                     } catch (final Exception e) {
@@ -1876,8 +1881,11 @@ public Answer createSnapshot(final CreateObjectCommand cmd) {
             }
 
             final SnapshotObjectTO newSnapshot = new SnapshotObjectTO();
-
             newSnapshot.setPath(snapshotPath);
+            if (snapshotSize != null) {
+                newSnapshot.setPhysicalSize(snapshotSize);
+            }
+
             return new CreateObjectAnswer(newSnapshot);
         } catch (CloudRuntimeException | LibvirtException | IOException ex) {
             String errorMsg = String.format("Failed take snapshot for volume [%s], in VM [%s], due to [%s].", volume, vmName, ex.getMessage());
@@ -1888,6 +1896,31 @@ public Answer createSnapshot(final CreateObjectCommand cmd) {
         }
     }
 
+    private long getRbdSnapshotSize(String poolPath, String diskName, String snapshotName, String rbdMonitor, String authUser, String authSecret) {
+        logger.debug("Get RBD snapshot size for {}/{}@{}", poolPath, diskName, snapshotName);
+        //cmd: rbd du <pool>/<disk-name>@<snapshot-name> --format json --mon-host <monitor-host> --id <user> --key <key> 2>/dev/null
+        String snapshotDetailsInJson = Script.runSimpleBashScript(String.format("rbd du %s/%s@%s --format json --mon-host %s --id %s --key %s 2>/dev/null", poolPath, diskName, snapshotName, rbdMonitor, authUser, authSecret));
+        if (StringUtils.isNotBlank(snapshotDetailsInJson)) {
+            ObjectMapper mapper = new ObjectMapper();
+            try {
+                JsonNode root = mapper.readTree(snapshotDetailsInJson);
+                for (JsonNode image : root.path("images")) {
+                    if (snapshotName.equals(image.path("snapshot").asText())) {
+                        long usedSizeInBytes = image.path("used_size").asLong();
+                        logger.debug("RBD snapshot {}/{}@{} used size in bytes: {}", poolPath, diskName, snapshotName, usedSizeInBytes);
+                        return usedSizeInBytes;
+                    }
+                }
+            } catch (JsonProcessingException e) {
+                logger.error("Unable to get the RBD snapshot size, RBD snapshot cmd output: {}", snapshotDetailsInJson, e);
+            }
+        } else {
+                logger.warn("Failed to get RBD snapshot size for {}/{}@{} - no output for RBD snapshot cmd", poolPath, diskName, snapshotName);
+        }
+
+        return 0;
+    }
+
     protected void deleteFullVmSnapshotAfterConvertingItToExternalDiskSnapshot(Domain vm, String snapshotName, VolumeObjectTO volume, String vmName) throws LibvirtException {
         logger.debug(String.format("Deleting full Instance Snapshot [%s] of Instance [%s] as we already converted it to an external disk Snapshot of the volume [%s].", snapshotName, vmName,
                 volume));

From e1d512e5fd1b2893fb3d729aed7d6e2b38623c42 Mon Sep 17 00:00:00 2001
From: salfers <97662717+salfers@users.noreply.github.com>
Date: Fri, 30 Jan 2026 10:53:44 +0100
Subject: [PATCH 113/117] Set CORS headers for both http/https in SSVM apache
 config (#9389)

---
 systemvm/debian/etc/apache2/vhost.template    |  8 +++----
 systemvm/debian/opt/cloud/bin/setup/common.sh |  3 ---
 .../debian/opt/cloud/bin/setup/secstorage.sh  | 23 ++-----------------
 3 files changed, 6 insertions(+), 28 deletions(-)

diff --git a/systemvm/debian/etc/apache2/vhost.template b/systemvm/debian/etc/apache2/vhost.template
index 7f6a51460995..d1c7a2960ee1 100644
--- a/systemvm/debian/etc/apache2/vhost.template
+++ b/systemvm/debian/etc/apache2/vhost.template
@@ -39,8 +39,8 @@
         Allow from 127.0.0.0/255.0.0.0 ::1/128
     </Directory>
 
-    # Include HTTP configuration **IF SET**
-    IncludeOptional /etc/apache2/http.conf
+	# Include CORS configuration **IF SET**
+	IncludeOptional /etc/apache2/cors.conf
 
 </VirtualHost>
 
@@ -86,8 +86,8 @@
 		Allow from 127.0.0.0/255.0.0.0 ::1/128
 	</Directory>
 
-	# Include HTTPS configuration **IF SET**
-	IncludeOptional /etc/apache2/https.conf
+	# Include CORS configuration **IF SET**
+	IncludeOptional /etc/apache2/cors.conf
 
 	#   SSL Engine Switch:
 	#   Enable/Disable SSL for this virtual host.
diff --git a/systemvm/debian/opt/cloud/bin/setup/common.sh b/systemvm/debian/opt/cloud/bin/setup/common.sh
index 85b78ee16aee..ef1576ab588c 100755
--- a/systemvm/debian/opt/cloud/bin/setup/common.sh
+++ b/systemvm/debian/opt/cloud/bin/setup/common.sh
@@ -924,9 +924,6 @@ parse_cmd_line() {
         privateMtu)
           export PRIVATEMTU=$VALUE
           ;;
-        useHttpsToUpload)
-          export USEHTTPS=$VALUE
-          ;;
         vncport)
           export VNCPORT=$VALUE
           ;;
diff --git a/systemvm/debian/opt/cloud/bin/setup/secstorage.sh b/systemvm/debian/opt/cloud/bin/setup/secstorage.sh
index b8ed7b543119..5baed567f8f1 100755
--- a/systemvm/debian/opt/cloud/bin/setup/secstorage.sh
+++ b/systemvm/debian/opt/cloud/bin/setup/secstorage.sh
@@ -50,33 +50,14 @@ setup_secstorage() {
   a2enmod proxy_http
   a2enmod headers
 
-  if [ -z $USEHTTPS ] | $USEHTTPS ; then
-    if [ -f /etc/apache2/http.conf ]; then
-      rm -rf /etc/apache2/http.conf
-    fi
-      cat >/etc/apache2/https.conf <<HTTPS
+  cat >/etc/apache2/cors.conf <<CORS
 RewriteEngine On
-RewriteCond %{HTTPS} =on
 RewriteCond %{REQUEST_METHOD} =POST
 RewriteRule ^/upload/(.*) http://127.0.0.1:8210/upload?uuid=\$1 [P,L]
 Header always set Access-Control-Allow-Origin "*"
 Header always set Access-Control-Allow-Methods "POST, OPTIONS"
 Header always set Access-Control-Allow-Headers "x-requested-with, content-type, origin, authorization, accept, client-security-token, x-signature, x-metadata, x-expires"
-HTTPS
-  else
-    if [ -f /etc/apache2/https.conf ]; then
-      rm -rf /etc/apache2/https.conf
-    fi
-      cat >/etc/apache2/http.conf <<HTTP
-RewriteEngine On
-RewriteCond %{REQUEST_METHOD} =POST
-RewriteRule ^/upload/(.*) http://127.0.0.1:8210/upload?uuid=\$1 [P,L]
-Header always set Access-Control-Allow-Origin "*"
-Header always set Access-Control-Allow-Methods "POST, OPTIONS"
-Header always set Access-Control-Allow-Headers "x-requested-with, content-type, origin, authorization, accept, client-security-token, x-signature, x-metadata, x-expires"
-HTTP
-  fi
-
+CORS
 
   disable_rpfilter
   enable_fwding 0

From a38205ebf0e21ac8ba355d60c4f84824c6ca612a Mon Sep 17 00:00:00 2001
From: K Viddya <62757458+viddya673@users.noreply.github.com>
Date: Fri, 30 Jan 2026 15:52:07 +0530
Subject: [PATCH 114/117] =?UTF-8?q?=C2=A0=C2=A0Add=20s390x=20Support=20for?=
 =?UTF-8?q?=20Cloudstack=20Simulator=20(#12337)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Viddya K <viddya.k@ibm.com>
Signed-off-by: Niyam Siwach <niyam@ibm.com>
Co-authored-by: root <root@c63716v1.fyre.ibm.com>
---
 tools/docker/Dockerfile.s390x | 91 +++++++++++++++++++++++++++++++++++
 1 file changed, 91 insertions(+)
 create mode 100644 tools/docker/Dockerfile.s390x

diff --git a/tools/docker/Dockerfile.s390x b/tools/docker/Dockerfile.s390x
new file mode 100644
index 000000000000..f995cb3058dc
--- /dev/null
+++ b/tools/docker/Dockerfile.s390x
@@ -0,0 +1,91 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+# CloudStack-simulator build
+
+FROM ubuntu:22.04
+
+LABEL Vendor="Apache.org" License="ApacheV2" Version="4.23.0.0-SNAPSHOT" Author="Apache CloudStack <dev@cloudstack.apache.org>"
+
+ARG DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get -y update && apt-get install -y \
+    genisoimage \
+    libffi-dev \
+    libssl-dev \
+    curl \
+    gcc-10 \
+    git \
+    sudo \
+    ipmitool \
+    iproute2 \
+    maven \
+    openjdk-11-jdk \
+    python3-dev \
+    python-is-python3 \
+    python3-setuptools \
+    python3-pip \
+    python3-mysql.connector \
+    # Required on s390x as pre-built wheels for bcrypt, cryptography, and cffi are unavailable, necessitating source builds.
+    python3-bcrypt \
+    python3-cryptography \
+    python3-cffi \
+    supervisor
+
+RUN apt-get install -qqy mysql-server && \
+    apt-get clean all && \
+    mkdir -p /var/run/mysqld; \
+    chown mysql /var/run/mysqld
+
+RUN echo '''sql_mode = "STRICT_TRANS_TABLES,NO_ZERO_IN_DATE,NO_ZERO_DATE,ERROR_FOR_DIVISION_BY_ZERO,NO_ENGINE_SUBSTITUTION"''' >> /etc/mysql/mysql.conf.d/mysqld.cnf
+
+COPY tools/docker/supervisord.conf /etc/supervisor/conf.d/supervisord.conf
+COPY . ./root
+WORKDIR /root
+
+RUN mvn -Pdeveloper -Dsimulator -DskipTests clean install
+
+RUN find /var/lib/mysql -type f -exec touch {} \; && \
+    (/usr/bin/mysqld_safe &) && \
+    sleep 5; \
+    mysql -e "ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password by ''" --connect-expired-password; \
+    mvn -Pdeveloper -pl developer -Ddeploydb; \
+    mvn -Pdeveloper -pl developer -Ddeploydb-simulator; \
+    MARVIN_FILE=`find /root/tools/marvin/dist/ -name "Marvin*.tar.gz"`; \
+    rm -rf /usr/bin/s390x-linux-gnu-gcc && \
+    ln -s /usr/bin/gcc-10 /usr/bin/s390x-linux-gnu-gcc && \
+    pip3 install maturin && \
+    pip3 install $MARVIN_FILE
+
+RUN apt-get install -y nodejs npm build-essential python3 g++ make
+
+RUN curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.4/install.sh | bash && \
+    . /root/.nvm/nvm.sh && \
+    nvm install 16 && \
+    nvm use 16 && \
+    NVM_BIN="$(dirname "$(nvm which node)")" && \
+    ln -sf "$NVM_BIN/node" /usr/local/bin/node && \
+    ln -sf "$NVM_BIN/npm" /usr/local/bin/npm && \
+    cd ui && npm rebuild node-sass && npm install
+
+
+VOLUME /var/lib/mysql
+
+EXPOSE 8080 8096 5050
+
+CMD ["/usr/bin/supervisord"]
+

From 7b94ccc443fb89d11842f0611701d4410b531654 Mon Sep 17 00:00:00 2001
From: Daan Hoogland <dahn@apache.org>
Date: Fri, 30 Jan 2026 11:53:40 +0100
Subject: [PATCH 115/117] eofFix

---
 tools/docker/Dockerfile.s390x | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tools/docker/Dockerfile.s390x b/tools/docker/Dockerfile.s390x
index f995cb3058dc..7e8c49fb3866 100644
--- a/tools/docker/Dockerfile.s390x
+++ b/tools/docker/Dockerfile.s390x
@@ -88,4 +88,3 @@ VOLUME /var/lib/mysql
 EXPOSE 8080 8096 5050
 
 CMD ["/usr/bin/supervisord"]
-

From ef60aa560155572d98819885b33cb913d4a8cc72 Mon Sep 17 00:00:00 2001
From: Vishesh <8760112+vishesh92@users.noreply.github.com>
Date: Fri, 30 Jan 2026 17:46:12 +0530
Subject: [PATCH 116/117] Restart xl2tpd service when the VPN configuration is
 modified (#12422)

---
 systemvm/debian/opt/cloud/bin/configure.py | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/systemvm/debian/opt/cloud/bin/configure.py b/systemvm/debian/opt/cloud/bin/configure.py
index c3c91d90c5a8..bf48be66694c 100755
--- a/systemvm/debian/opt/cloud/bin/configure.py
+++ b/systemvm/debian/opt/cloud/bin/configure.py
@@ -1233,17 +1233,21 @@ def process(self):
                 CsHelper.start_if_stopped("ipsec")
 
                 logging.debug("Remote accessvpn  data bag %s",  self.dbag)
+                config_changed = False
                 if not self.config.has_public_network():
                     interface = self.config.address().get_guest_if_by_network_id()
                     if interface:
-                        self.configure_l2tpIpsec(interface.get_ip(), self.dbag[public_ip])
+                        config_changed = self.configure_l2tpIpsec(interface.get_ip(), self.dbag[public_ip])
                         self.remoteaccessvpn_iptables(interface.get_device(), interface.get_ip(), self.dbag[public_ip])
                 else:
-                    self.configure_l2tpIpsec(public_ip, self.dbag[public_ip])
+                    config_changed = self.configure_l2tpIpsec(public_ip, self.dbag[public_ip])
                     self.remoteaccessvpn_iptables(self.dbag[public_ip]['public_interface'], public_ip, self.dbag[public_ip])
 
                 CsHelper.execute("ipsec update")
-                CsHelper.execute("systemctl start xl2tpd")
+                if config_changed:
+                    CsHelper.execute("systemctl restart xl2tpd")
+                else:
+                    CsHelper.execute("systemctl start xl2tpd")
                 CsHelper.execute("ipsec rereadsecrets")
             else:
                 logging.debug("Disabling remote access vpn .....")
@@ -1266,21 +1270,23 @@ def configure_l2tpIpsec(self, left, obj):
         l2tpfile = CsFile(l2tpconffile)
         l2tpfile.addeq(" left=%s" % left)
         l2tpfile.addeq(" leftid=%s" % obj['vpn_server_ip'])
-        l2tpfile.commit()
+        l2tp_changed = l2tpfile.commit()
 
         secret = CsFile(vpnsecretfilte)
         secret.empty()
         secret.addeq(": PSK \"%s\"" % (psk))
-        secret.commit()
+        secret_changed = secret.commit()
 
         xl2tpdconf = CsFile(xl2tpdconffile)
         xl2tpdconf.addeq("ip range = %s" % iprange)
         xl2tpdconf.addeq("local ip = %s" % localip)
-        xl2tpdconf.commit()
+        xl2tpd_changed = xl2tpdconf.commit()
 
         xl2tpoptions = CsFile(xl2tpoptionsfile)
         xl2tpoptions.search("ms-dns ", "ms-dns %s" % localip)
-        xl2tpoptions.commit()
+        xl2tpoptions_changed = xl2tpoptions.commit()
+
+        return l2tp_changed or secret_changed or xl2tpd_changed or xl2tpoptions_changed
 
     def remoteaccessvpn_iptables(self, publicdev, publicip, obj):
         localcidr = obj['local_cidr']

From 6bed3d4e641f48822fc1b9126bd6e2c71f28ed02 Mon Sep 17 00:00:00 2001
From: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
Date: Fri, 30 Jan 2026 18:15:59 +0530
Subject: [PATCH 117/117] Update storage usage / size in backup usage response
 (#12539)

---
 server/src/main/java/com/cloud/api/ApiResponseHelper.java  | 7 +++++--
 .../java/com/cloud/usage/parser/BackupUsageParser.java     | 3 +--
 .../com/cloud/usage/parser/VMSnapshotOnPrimaryParser.java  | 2 +-
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/server/src/main/java/com/cloud/api/ApiResponseHelper.java b/server/src/main/java/com/cloud/api/ApiResponseHelper.java
index 3331053dff22..2b7ed1b11005 100644
--- a/server/src/main/java/com/cloud/api/ApiResponseHelper.java
+++ b/server/src/main/java/com/cloud/api/ApiResponseHelper.java
@@ -4364,7 +4364,7 @@ public UsageRecordResponse createUsageResponse(Usage usageRecord, Map<String, Se
         } else if (usageRecord.getUsageType() == UsageTypes.BACKUP) {
             resourceType = ResourceObjectType.Backup;
             final StringBuilder builder = new StringBuilder();
-            builder.append("Backup usage of size ").append(usageRecord.getUsageDisplay());
+            builder.append("Backup usage");
             if (vmInstance != null) {
                 resourceId = vmInstance.getId();
                 usageRecResponse.setResourceName(vmInstance.getInstanceName());
@@ -4377,9 +4377,12 @@ public UsageRecordResponse createUsageResponse(Usage usageRecord, Map<String, Se
                             .append(" (").append(backupOffering.getUuid()).append(", user ad-hoc/scheduled backup allowed: ")
                             .append(backupOffering.isUserDrivenBackupAllowed()).append(")");
                 }
-
             }
+            builder.append(" with size ").append(toHumanReadableSize(usageRecord.getSize()));
+            builder.append(" and with virtual size ").append(toHumanReadableSize(usageRecord.getVirtualSize()));
             usageRecResponse.setDescription(builder.toString());
+            usageRecResponse.setSize(usageRecord.getSize());
+            usageRecResponse.setVirtualSize(usageRecord.getVirtualSize());
         } else if (usageRecord.getUsageType() == UsageTypes.VM_SNAPSHOT) {
             resourceType = ResourceObjectType.VMSnapshot;
             VMSnapshotVO vmSnapshotVO = null;
diff --git a/usage/src/main/java/com/cloud/usage/parser/BackupUsageParser.java b/usage/src/main/java/com/cloud/usage/parser/BackupUsageParser.java
index 82370fcae3e9..257bc4683027 100644
--- a/usage/src/main/java/com/cloud/usage/parser/BackupUsageParser.java
+++ b/usage/src/main/java/com/cloud/usage/parser/BackupUsageParser.java
@@ -84,12 +84,11 @@ public static boolean parse(AccountVO account, Date startDate, Date endDate) {
             DecimalFormat dFormat = new DecimalFormat("#.######");
             String usageDisplay = dFormat.format(usage);
 
-            final Double rawUsage = (double) usageBackup.getSize();
             final String description = String.format("Backup usage VM ID: %d, backup offering: %d", vmId, offeringId);
 
             final UsageVO usageRecord =
                     new UsageVO(zoneId, account.getAccountId(), account.getDomainId(), description, usageDisplay + " Hrs",
-                            UsageTypes.BACKUP, new Double(usage), vmId, null, offeringId, null, vmId,
+                            UsageTypes.BACKUP, (double) usage, vmId, null, offeringId, null, vmId,
                             usageBackup.getSize(), usageBackup.getProtectedSize(), startDate, endDate);
             s_usageDao.persist(usageRecord);
         }
diff --git a/usage/src/main/java/com/cloud/usage/parser/VMSnapshotOnPrimaryParser.java b/usage/src/main/java/com/cloud/usage/parser/VMSnapshotOnPrimaryParser.java
index fb48bbde4bed..252f661569db 100644
--- a/usage/src/main/java/com/cloud/usage/parser/VMSnapshotOnPrimaryParser.java
+++ b/usage/src/main/java/com/cloud/usage/parser/VMSnapshotOnPrimaryParser.java
@@ -125,7 +125,7 @@ private static void createUsageRecord(int usageType, long runningTime, Date star
         String usageDesc = "VMSnapshot Id: " + vmSnapshotId + " On Primary Usage: VM Id: " + vmId;
         usageDesc += " Size: " + toHumanReadableSize(virtualSize);
 
-        UsageVO usageRecord = new UsageVO(zoneId, account.getId(), account.getDomainId(), usageDesc, usageDisplay + " Hrs", usageType, new Double(usage), vmId, name, null, null,
+        UsageVO usageRecord = new UsageVO(zoneId, account.getId(), account.getDomainId(), usageDesc, usageDisplay + " Hrs", usageType, (double) usage, vmId, name, null, null,
                 vmSnapshotId, physicalSize, virtualSize, startDate, endDate);
         s_usageDao.persist(usageRecord);
     }