diff --git a/AGENTS.md b/AGENTS.md
new file mode 100644
index 000000000000..4469efa2f494
--- /dev/null
+++ b/AGENTS.md
@@ -0,0 +1,32 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# Agent Guide for Apache CloudStack
+
+This file is read by automated agents (security scanners, code
+analyzers, AI assistants) operating on this repository.
+
+## Security
+
+Security model: [SECURITY.md](./SECURITY.md)
+
+Agents that scan this repository should consult `SECURITY.md` and the
+threat model it links before reporting issues.
+
+The project-wide security threat model is linked from `SECURITY.md`.
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000000..018f2fa8cb86
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,34 @@
+<!--
+Licensed to the Apache Software Foundation (ASF) under one
+or more contributor license agreements.  See the NOTICE file
+distributed with this work for additional information
+regarding copyright ownership.  The ASF licenses this file
+to you under the Apache License, Version 2.0 (the
+"License"); you may not use this file except in compliance
+with the License.  You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing,
+software distributed under the License is distributed on an
+"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+KIND, either express or implied.  See the License for the
+specific language governing permissions and limitations
+under the License.
+-->
+
+# Security Policy
+
+## Reporting a Vulnerability
+
+`apache/cloudstack` follows the [Apache Software Foundation security process](https://www.apache.org/security/). Please report suspected
+vulnerabilities privately to `security@apache.org`; do not open public GitHub issues or pull requests for security reports.
+
+For more details, see https://cloudstack.apache.org/security.html.
+
+## Threat Model
+
+What the project treats as in scope and out of scope, the security
+properties it provides and disclaims, the adversary model, and how
+findings are triaged are documented in the project-wide threat model:
+[THREAT_MODEL.md](THREAT_MODEL.md).
diff --git a/draft-THREAT-MODEL.md b/THREAT_MODEL.md
similarity index 100%
rename from draft-THREAT-MODEL.md
rename to THREAT_MODEL.md
diff --git a/agent/conf/agent.properties b/agent/conf/agent.properties
index 2d244e00edaf..4e36eff4d75f 100644
--- a/agent/conf/agent.properties
+++ b/agent/conf/agent.properties
@@ -488,3 +488,15 @@ iscsi.session.cleanup.enabled=false
 # Optional vCenter SHA1 thumbprint for VMware to KVM conversion via VDDK, passed as
 # -io vddk-thumbprint=<value>. If unset, CloudStack computes it on the KVM host via openssl.
 #vddk.thumbprint=
+
+# Timeout (in seconds) for QCOW2 delta merge operations, mainly used for classic volume snapshots, disk-only VM snapshots on file-based storage, and the KBOSS plugin.
+# If a value of 0 or less is informed, the default will be used.
+# qcow2.delta.merge.timeout=259200
+
+# Maximum number of backup validation jobs that can be executed at the same time. Values lower than 0 remove the limit, meaning that as many validations as possible will be done at
+# the same time.
+# backup.validation.max.concurrent.operations.per.host=
+
+# Maximum number of backup compression jobs that can be executed at the same time. Values lower than 0 remove the limit, meaning that as many compressions as possible will be
+# done at the same time.
+# backup.compression.max.concurrent.operations.per.host=
diff --git a/agent/src/main/java/com/cloud/agent/properties/AgentProperties.java b/agent/src/main/java/com/cloud/agent/properties/AgentProperties.java
index e2fe028453f9..e4775188d0ca 100644
--- a/agent/src/main/java/com/cloud/agent/properties/AgentProperties.java
+++ b/agent/src/main/java/com/cloud/agent/properties/AgentProperties.java
@@ -170,7 +170,8 @@ public class AgentProperties{
     public static final Property<Integer> CMDS_TIMEOUT = new Property<>("cmds.timeout", 7200);
 
     /**
-     * The timeout (in seconds) for the snapshot merge operation, mainly used for classic volume snapshots and disk-only VM snapshots on file-based storage.<br>
+     * The timeout (in seconds) for QCOW2 delta merge operations, mainly used for classic volume snapshots, disk-only VM snapshots on file-based storage, and the KBOSS plugin.
+     * If a value of 0 or less is informed, the default will be used.<br>
      * This configuration is only considered if libvirt.events.enabled is also true. <br>
      * Data type: Integer.<br>
      * Default value: <code>259200</code>
@@ -937,6 +938,33 @@ public Property<Integer> getWorkers() {
      * */
     public static final Property<Integer> INCREMENTAL_SNAPSHOT_RETRY_REBASE_WAIT = new Property<>("incremental.snapshot.retry.rebase.wait", 60);
 
+    /**
+     * When set to <code>true</code>, executes <code>modifymacip.sh</code> (resolved via the
+     * network scripts directory) on VM NIC plug (VM start) and unplug (VM stop) to manage static
+     * ARP/NDP entries and host routes for VM interfaces.<br>
+     * The script is invoked with:<br>
+     * &nbsp;&nbsp;add:    <code>-o add -b &lt;bridge&gt; -m &lt;mac&gt; [-4 &lt;ipv4&gt;] [-6 &lt;ipv6&gt;]</code><br>
+     * &nbsp;&nbsp;delete: <code>-o delete -b &lt;bridge&gt; -m &lt;mac&gt;</code><br>
+     * A bundled reference implementation is available at
+     * <code>scripts/vm/network/vnet/modifymacip.sh</code>.<br>
+     * Set to <code>false</code> or leave unset to disable this feature.<br>
+     * Data type: Boolean.<br>
+     * Default value: <code>false</code>
+     */
+    public static final Property<Boolean> VM_NETWORK_MACIP_STATIC = new Property<>("vm.network.macip.static", false, Boolean.class);
+
+
+    /**
+     * Maximum number of backup validation jobs that can be executed at the same time. Values lower than 0 remove the limit, meaning that as many validations as possible will be done at
+     * the same time.
+     */
+    public static final Property<Integer> BACKUP_VALIDATION_MAX_CONCURRENT_OPERATIONS_PER_HOST = new Property<>("backup.validation.max.concurrent.operations.per.host", null, Integer.class);
+
+    /**
+     * Maximum number of backup compression jobs that can be executed at the same time. Values lower than 0 remove the limit, meaning that as many compressions as possible will be
+     * done at the same time.
+     */
+    public static final Property<Integer> BACKUP_COMPRESSION_MAX_CONCURRENT_OPERATIONS_PER_HOST = new Property<>("backup.compression.max.concurrent.operations.per.host", null, Integer.class);
 
     public static class Property <T>{
         private String name;
diff --git a/api/src/main/java/com/cloud/agent/api/to/DataObjectType.java b/api/src/main/java/com/cloud/agent/api/to/DataObjectType.java
index 26294cfbb223..76a75e03ba55 100644
--- a/api/src/main/java/com/cloud/agent/api/to/DataObjectType.java
+++ b/api/src/main/java/com/cloud/agent/api/to/DataObjectType.java
@@ -19,5 +19,5 @@
 package com.cloud.agent.api.to;
 
 public enum DataObjectType {
-    VOLUME, SNAPSHOT, TEMPLATE, ARCHIVE
+    VOLUME, SNAPSHOT, TEMPLATE, ARCHIVE, BACKUP
 }
diff --git a/api/src/main/java/com/cloud/event/EventTypes.java b/api/src/main/java/com/cloud/event/EventTypes.java
index c97e916fe430..f7d13343d469 100644
--- a/api/src/main/java/com/cloud/event/EventTypes.java
+++ b/api/src/main/java/com/cloud/event/EventTypes.java
@@ -668,6 +668,7 @@ public class EventTypes {
     public static final String EVENT_VM_BACKUP_USAGE_METRIC = "BACKUP.USAGE.METRIC";
     public static final String EVENT_VM_BACKUP_EDIT = "BACKUP.OFFERING.EDIT";
     public static final String EVENT_VM_CREATE_FROM_BACKUP = "VM.CREATE.FROM.BACKUP";
+    public static final String EVENT_SCREENSHOT_DOWNLOAD = "BACKUP.VALIDATION.SCREENSHOT.DOWNLOAD";
 
     // external network device events
     public static final String EVENT_EXTERNAL_NVP_CONTROLLER_ADD = "PHYSICAL.NVPCONTROLLER.ADD";
@@ -875,6 +876,7 @@ public class EventTypes {
     public static final String EVENT_EXTENSION_DELETE = "EXTENSION.DELETE";
     public static final String EVENT_EXTENSION_RESOURCE_REGISTER = "EXTENSION.RESOURCE.REGISTER";
     public static final String EVENT_EXTENSION_RESOURCE_UNREGISTER = "EXTENSION.RESOURCE.UNREGISTER";
+    public static final String EVENT_EXTENSION_RESOURCE_UPDATE = "EXTENSION.RESOURCE.UPDATE";
     public static final String EVENT_EXTENSION_CUSTOM_ACTION_ADD = "EXTENSION.CUSTOM.ACTION.ADD";
     public static final String EVENT_EXTENSION_CUSTOM_ACTION_UPDATE = "EXTENSION.CUSTOM.ACTION.UPDATE";
     public static final String EVENT_EXTENSION_CUSTOM_ACTION_DELETE = "EXTENSION.CUSTOM.ACTION.DELETE";
diff --git a/api/src/main/java/com/cloud/hypervisor/HypervisorGuru.java b/api/src/main/java/com/cloud/hypervisor/HypervisorGuru.java
index 0c821b4e36c0..67db19b7cc54 100644
--- a/api/src/main/java/com/cloud/hypervisor/HypervisorGuru.java
+++ b/api/src/main/java/com/cloud/hypervisor/HypervisorGuru.java
@@ -20,6 +20,7 @@
 import java.util.Map;
 
 import org.apache.cloudstack.backup.Backup;
+import org.apache.cloudstack.backup.BackupProvider;
 import org.apache.cloudstack.framework.config.ConfigKey;
 
 import com.cloud.agent.api.Command;
@@ -94,10 +95,10 @@ public interface HypervisorGuru extends Adapter {
     Map<String, String> getClusterSettings(long vmId);
 
     VirtualMachine importVirtualMachineFromBackup(long zoneId, long domainId, long accountId, long userId,
-                                                  String vmInternalName, Backup backup) throws Exception;
+                                                  String vmInternalName, Backup backup, BackupProvider backupProvider) throws Exception;
 
     boolean attachRestoredVolumeToVirtualMachine(long zoneId, String location, Backup.VolumeInfo volumeInfo,
-                                                 VirtualMachine vm, long poolId, Backup backup) throws Exception;
+                                                 VirtualMachine vm, long poolId, Backup backup, BackupProvider backupProvider) throws Exception;
     /**
      * Will generate commands to migrate a vm to a pool. For now this will only work for stopped VMs on Vmware.
      *
diff --git a/api/src/main/java/com/cloud/network/Network.java b/api/src/main/java/com/cloud/network/Network.java
index e41eb880ffd5..2f0bcdd5ef9a 100644
--- a/api/src/main/java/com/cloud/network/Network.java
+++ b/api/src/main/java/com/cloud/network/Network.java
@@ -116,6 +116,7 @@ class Service {
         public static final Service NetworkACL = new Service("NetworkACL", Capability.SupportedProtocols);
         public static final Service Connectivity = new Service("Connectivity", Capability.DistributedRouter, Capability.RegionLevelVpc, Capability.StretchedL2Subnet,
                 Capability.NoVlan, Capability.PublicAccess);
+        public static final Service CustomAction = new Service("CustomAction");
 
         private final String name;
         private final Capability[] caps;
@@ -207,6 +208,7 @@ public static class Provider {
 
         public static final Provider Nsx = new Provider("Nsx", false);
         public static final Provider Netris = new Provider("Netris", false);
+        public static final Provider NetworkExtension = new Provider("NetworkExtension", false, true);
 
         private final String name;
         private final boolean isExternal;
@@ -250,11 +252,47 @@ public static Provider getProvider(String providerName) {
             return null;
         }
 
+        /** Private constructor for transient (non-registered) providers. */
+        private Provider(String name) {
+            this.name = name;
+            this.isExternal = false;
+            this.needCleanupOnShutdown = true;
+            // intentionally NOT added to supportedProviders
+        }
+
+        /**
+         * Creates a transient (non-registered) {@link Provider} with the given name.
+         *
+         * <p>The new instance is <em>not</em> added to {@code supportedProviders}, so it
+         * will never be returned by {@link #getProvider(String)} and will not pollute the
+         * global provider registry.  Use this for dynamic / extension-backed providers
+         * whose names are only known at runtime (e.g. NetworkOrchestrator extensions).</p>
+         *
+         * @param name the provider name (typically the extension name)
+         * @return a transient {@link Provider} instance with the given name
+         */
+        public static Provider createTransientProvider(String name) {
+            return new Provider(name);
+        }
+
         @Override public String toString() {
             return new ToStringBuilder(this, ToStringStyle.SHORT_PREFIX_STYLE)
                     .append("name", name)
                     .toString();
         }
+
+        @Override
+        public boolean equals(Object obj) {
+            if (this == obj) return true;
+            if (!(obj instanceof Provider)) return false;
+            Provider provider = (Provider) obj;
+            return this.name.equals(provider.name);
+        }
+
+        @Override
+        public int hashCode() {
+            return name.hashCode();
+        }
     }
 
     public static class Capability {
diff --git a/api/src/main/java/com/cloud/network/NetworkModel.java b/api/src/main/java/com/cloud/network/NetworkModel.java
index c212e6319eb4..7e1a07ebeb69 100644
--- a/api/src/main/java/com/cloud/network/NetworkModel.java
+++ b/api/src/main/java/com/cloud/network/NetworkModel.java
@@ -187,6 +187,8 @@ public interface NetworkModel {
 
     boolean canElementEnableIndividualServices(Provider provider);
 
+    boolean canElementEnableIndividualServicesByName(String providerName);
+
     boolean areServicesSupportedInNetwork(long networkId, Service... services);
 
     boolean isNetworkSystem(Network network);
@@ -237,6 +239,18 @@ public interface NetworkModel {
 
     String getDefaultGuestTrafficLabel(long dcId, HypervisorType vmware);
 
+    /**
+     * Resolves a provider name to a {@link Provider} instance.
+     * For known static providers, delegates to {@link Provider#getProvider(String)}.
+     * For dynamically-registered NetworkOrchestrator extension providers whose names
+     * are not in the static registry, returns a transient {@link Provider} with the
+     * given name so callers can still dispatch correctly.
+     *
+     * @param providerName the provider name from {@code ntwk_service_map} or similar
+     * @return a {@link Provider} instance, or {@code null} if not resolvable
+     */
+    Provider resolveProvider(String providerName);
+
     /**
      * @param providerName
      * @return
diff --git a/api/src/main/java/com/cloud/network/NetworkRuleApplier.java b/api/src/main/java/com/cloud/network/NetworkRuleApplier.java
index b9942e71eb26..69b712bc6ca2 100644
--- a/api/src/main/java/com/cloud/network/NetworkRuleApplier.java
+++ b/api/src/main/java/com/cloud/network/NetworkRuleApplier.java
@@ -21,8 +21,13 @@
 
 import com.cloud.exception.ResourceUnavailableException;
 import com.cloud.network.rules.FirewallRule;
+import com.cloud.network.vpc.Vpc;
 
 public interface NetworkRuleApplier {
-    public boolean applyRules(Network network, FirewallRule.Purpose purpose, List<? extends FirewallRule> rules) throws ResourceUnavailableException;
+    default boolean applyRules(Network network, FirewallRule.Purpose purpose, List<? extends FirewallRule> rules) throws ResourceUnavailableException {
+        return applyRules(network, null, purpose, rules);
+    }
+
+    boolean applyRules(Network network, Vpc vpc, FirewallRule.Purpose purpose, List<? extends FirewallRule> rules) throws ResourceUnavailableException;
 
 }
diff --git a/api/src/main/java/com/cloud/network/Networks.java b/api/src/main/java/com/cloud/network/Networks.java
index 5f767686dc97..61a1c820723f 100644
--- a/api/src/main/java/com/cloud/network/Networks.java
+++ b/api/src/main/java/com/cloud/network/Networks.java
@@ -81,7 +81,11 @@ public String getValueFrom(URI uri) {
                 return uri == null ? null : uri.getAuthority();
             }
         },
-        Vswitch("vs", String.class), LinkLocal(null, null), Vnet("vnet", Long.class), Storage("storage", Integer.class), Lswitch("lswitch", String.class) {
+        Vswitch("vs", String.class),
+        LinkLocal(null, null),
+        Vnet("vnet", Long.class),
+        Storage("storage", Integer.class),
+        Lswitch("lswitch", String.class) {
             @Override
             public <T> URI toUri(T value) {
                 try {
@@ -99,7 +103,8 @@ public String getValueFrom(URI uri) {
                 return uri == null ? null : uri.getSchemeSpecificPart();
             }
         },
-        Mido("mido", String.class), Pvlan("pvlan", String.class),
+        Mido("mido", String.class),
+        Pvlan("pvlan", String.class),
         Vxlan("vxlan", Long.class) {
             @Override
             public <T> URI toUri(T value) {
diff --git a/api/src/main/java/com/cloud/network/element/DnsServiceProvider.java b/api/src/main/java/com/cloud/network/element/DnsServiceProvider.java
index 7abce537221c..2942e76965a7 100644
--- a/api/src/main/java/com/cloud/network/element/DnsServiceProvider.java
+++ b/api/src/main/java/com/cloud/network/element/DnsServiceProvider.java
@@ -33,4 +33,6 @@ boolean configDnsSupportForSubnet(Network network, NicProfile nic, VirtualMachin
         throws ConcurrentOperationException, InsufficientCapacityException, ResourceUnavailableException;
 
     boolean removeDnsSupportForSubnet(Network network) throws ResourceUnavailableException;
+
+    default boolean removeDnsEntry(Network network, NicProfile nic, VirtualMachineProfile vmProfile) throws ResourceUnavailableException  { return true; }
 }
diff --git a/api/src/main/java/com/cloud/network/element/FirewallServiceProvider.java b/api/src/main/java/com/cloud/network/element/FirewallServiceProvider.java
index c091142d9353..6b0f932e8c22 100644
--- a/api/src/main/java/com/cloud/network/element/FirewallServiceProvider.java
+++ b/api/src/main/java/com/cloud/network/element/FirewallServiceProvider.java
@@ -21,14 +21,20 @@
 import com.cloud.exception.ResourceUnavailableException;
 import com.cloud.network.Network;
 import com.cloud.network.rules.FirewallRule;
+import com.cloud.network.vpc.Vpc;
 
 public interface FirewallServiceProvider extends NetworkElement {
     /**
-     * Apply rules
-     * @param network
-     * @param rules
-     * @return
-     * @throws ResourceUnavailableException
+     * Apply firewall rules in a network context.
      */
-    boolean applyFWRules(Network network, List<? extends FirewallRule> rules) throws ResourceUnavailableException;
+    default boolean applyFWRules(Network network, List<? extends FirewallRule> rules) throws ResourceUnavailableException {
+        return false;
+    }
+
+    /**
+     * Apply firewall rules in a VPC context.
+     */
+    default boolean applyFWRulesInVPC(Vpc vpc, List<? extends FirewallRule> rules) throws ResourceUnavailableException {
+        return false;
+    }
 }
diff --git a/api/src/main/java/com/cloud/network/element/NetworkElement.java b/api/src/main/java/com/cloud/network/element/NetworkElement.java
index cb0fc2fca981..67be7b9ba2e2 100644
--- a/api/src/main/java/com/cloud/network/element/NetworkElement.java
+++ b/api/src/main/java/com/cloud/network/element/NetworkElement.java
@@ -146,4 +146,8 @@ boolean shutdownProviderInstances(PhysicalNetworkServiceProvider provider, Reser
      * @return true/false
      */
     boolean verifyServicesCombination(Set<Service> services);
+
+    default boolean rollingRestartSupported() {
+        return true;
+    }
 }
diff --git a/api/src/main/java/com/cloud/network/rules/FirewallRule.java b/api/src/main/java/com/cloud/network/rules/FirewallRule.java
index 369c6aa57eb8..38ba009163ce 100644
--- a/api/src/main/java/com/cloud/network/rules/FirewallRule.java
+++ b/api/src/main/java/com/cloud/network/rules/FirewallRule.java
@@ -69,7 +69,9 @@ enum TrafficType {
 
     State getState();
 
-    long getNetworkId();
+    Long getNetworkId();
+
+    Long getVpcId();
 
     Long getSourceIpAddressId();
 
diff --git a/api/src/main/java/com/cloud/storage/Storage.java b/api/src/main/java/com/cloud/storage/Storage.java
index ddf5978497ba..3511b4e88cb9 100644
--- a/api/src/main/java/com/cloud/storage/Storage.java
+++ b/api/src/main/java/com/cloud/storage/Storage.java
@@ -35,7 +35,8 @@ public static enum ImageFormat {
         VDI(true, true, false, "vdi"),
         TAR(false, false, false, "tar"),
         ZIP(false, false, false, "zip"),
-        DIR(false, false, false, "dir");
+        DIR(false, false, false, "dir"),
+        PNG(false, false, false, "png");
 
         private final boolean supportThinProvisioning;
         private final boolean supportSparse;
diff --git a/api/src/main/java/com/cloud/storage/Volume.java b/api/src/main/java/com/cloud/storage/Volume.java
index c7a13d5780d0..89298e04587f 100644
--- a/api/src/main/java/com/cloud/storage/Volume.java
+++ b/api/src/main/java/com/cloud/storage/Volume.java
@@ -60,7 +60,9 @@ enum State {
         UploadError(false, "Volume upload encountered some error"),
         UploadAbandoned(false, "Volume upload is abandoned since the upload was never initiated within a specified time"),
         Attaching(true, "The volume is attaching to a VM from Ready state."),
-        Restoring(true, "The volume is being restored from backup.");
+        Restoring(true, "The volume is being restored from backup."),
+        Consolidating(true, "The volume is being flattened."),
+        RestoreError(false, "The volume restore encountered an error.");
 
         boolean _transitional;
 
@@ -153,6 +155,10 @@ public String getDescription() {
             s_fsm.addTransition(new StateMachine2.Transition<State, Event>(Destroy, Event.RestoreRequested, Restoring, null));
             s_fsm.addTransition(new StateMachine2.Transition<State, Event>(Restoring, Event.RestoreSucceeded, Ready, null));
             s_fsm.addTransition(new StateMachine2.Transition<State, Event>(Restoring, Event.RestoreFailed, Ready, null));
+            s_fsm.addTransition(new StateMachine2.Transition<>(Ready, Event.ConsolidationRequested, Consolidating, null));
+            s_fsm.addTransition(new StateMachine2.Transition<>(Consolidating, Event.OperationSucceeded, Ready, null));
+            s_fsm.addTransition(new StateMachine2.Transition<>(Consolidating, Event.OperationFailed, RestoreError, null));
+            s_fsm.addTransition(new StateMachine2.Transition<>(RestoreError, Event.RestoreFailed, RestoreError, null));
         }
     }
 
@@ -179,7 +185,8 @@ enum Event {
         OperationTimeout,
         RestoreRequested,
         RestoreSucceeded,
-        RestoreFailed;
+        RestoreFailed,
+        ConsolidationRequested
     }
 
     /**
diff --git a/api/src/main/java/com/cloud/storage/VolumeApiService.java b/api/src/main/java/com/cloud/storage/VolumeApiService.java
index d287cc335eed..372eb0385618 100644
--- a/api/src/main/java/com/cloud/storage/VolumeApiService.java
+++ b/api/src/main/java/com/cloud/storage/VolumeApiService.java
@@ -114,7 +114,7 @@ Volume allocVolume(long ownerId, Long zoneId, Long diskOfferingId, Long vmId, Lo
 
     Volume attachVolumeToVM(AttachVolumeCmd command);
 
-    Volume attachVolumeToVM(Long vmId, Long volumeId, Long deviceId, Boolean allowAttachForSharedFS);
+    Volume attachVolumeToVM(Long vmId, Long volumeId, Long deviceId, Boolean allowAttachForSharedFS, boolean allowAttachOnRestoring);
 
     Volume detachVolumeViaDestroyVM(long vmId, long volumeId);
 
@@ -189,7 +189,7 @@ Volume updateVolume(long volumeId, String path, String state, Long storageId,
 
     boolean validateConditionsToReplaceDiskOfferingOfVolume(Volume volume, DiskOffering newDiskOffering, StoragePool destPool);
 
-    Volume destroyVolume(long volumeId, Account caller, boolean expunge, boolean forceExpunge);
+    Volume destroyVolume(long volumeId, Account caller, boolean expunge, boolean forceExpunge, Boolean countDisplayFalseInResourceCount);
 
     void destroyVolume(long volumeId);
 
diff --git a/api/src/main/java/com/cloud/user/ResourceLimitService.java b/api/src/main/java/com/cloud/user/ResourceLimitService.java
index 9c493fb383c9..89128f87829e 100644
--- a/api/src/main/java/com/cloud/user/ResourceLimitService.java
+++ b/api/src/main/java/com/cloud/user/ResourceLimitService.java
@@ -254,14 +254,14 @@ public interface ResourceLimitService {
     void updateTaggedResourceLimitsAndCountsForAccounts(List<AccountResponse> responses, String tag);
     void updateTaggedResourceLimitsAndCountsForDomains(List<DomainResponse> responses, String tag);
     void checkVolumeResourceLimit(Account owner, Boolean display, Long size, DiskOffering diskOffering, List<Reserver> reservations) throws ResourceAllocationException;
-    List<String> getResourceLimitStorageTagsForResourceCountOperation(Boolean display, DiskOffering diskOffering);
+    List<String> getResourceLimitStorageTagsForResourceCountOperation(Boolean display, DiskOffering diskOffering, Boolean enforceResourceLimitOnDisplayFalse);
     void checkVolumeResourceLimitForDiskOfferingChange(Account owner, Boolean display, Long currentSize, Long newSize,
             DiskOffering currentOffering, DiskOffering newOffering, List<Reserver> reservations) throws ResourceAllocationException;
 
     void checkPrimaryStorageResourceLimit(Account owner, Boolean display, Long size, DiskOffering diskOffering, List<Reserver> reservations) throws ResourceAllocationException;
 
     void incrementVolumeResourceCount(long accountId, Boolean display, Long size, DiskOffering diskOffering);
-    void decrementVolumeResourceCount(long accountId, Boolean display, Long size, DiskOffering diskOffering);
+    void decrementVolumeResourceCount(long accountId, Boolean display, Long size, DiskOffering diskOffering, Boolean countDisplayFalseInResourceCount);
 
     void updateVmResourceCountForTemplateChange(long accountId, Boolean display, ServiceOffering offering, VirtualMachineTemplate currentTemplate, VirtualMachineTemplate newTemplate);
 
@@ -276,8 +276,8 @@ void updateVolumeResourceCountForDiskOfferingChange(long accountId, Boolean disp
     void incrementVolumePrimaryStorageResourceCount(long accountId, Boolean display, Long size, DiskOffering diskOffering);
     void decrementVolumePrimaryStorageResourceCount(long accountId, Boolean display, Long size, DiskOffering diskOffering);
     void checkVmResourceLimit(Account owner, Boolean display, ServiceOffering serviceOffering, VirtualMachineTemplate template, List<Reserver> reservations) throws ResourceAllocationException;
-    void incrementVmResourceCount(long accountId, Boolean display, ServiceOffering serviceOffering, VirtualMachineTemplate template);
-    void decrementVmResourceCount(long accountId, Boolean display, ServiceOffering serviceOffering, VirtualMachineTemplate template);
+    void incrementVmResourceCount(long accountId, Boolean display, ServiceOffering serviceOffering, VirtualMachineTemplate template, Boolean countDisplayFalseInResourceLimit);
+    void decrementVmResourceCount(long accountId, Boolean display, ServiceOffering serviceOffering, VirtualMachineTemplate template, Boolean countDisplayFalseInResourceCount);
 
     void checkVmResourceLimitsForServiceOfferingChange(Account owner, Boolean display, Long currentCpu, Long newCpu,
             Long currentMemory, Long newMemory, ServiceOffering currentOffering, ServiceOffering newOffering, VirtualMachineTemplate template, List<Reserver> reservations) throws ResourceAllocationException;
diff --git a/api/src/main/java/com/cloud/vm/NicProfile.java b/api/src/main/java/com/cloud/vm/NicProfile.java
index d3ed7b4b87d2..54a32bbcb181 100644
--- a/api/src/main/java/com/cloud/vm/NicProfile.java
+++ b/api/src/main/java/com/cloud/vm/NicProfile.java
@@ -463,6 +463,6 @@ public String toString() {
         return String.format("NicProfile %s",
                 ReflectionToStringBuilderUtils.reflectOnlySelectedFields(
                         this, "id", "uuid", "vmId", "deviceId",
-                        "broadcastUri", "reservationId", "iPv4Address"));
+                        "broadcastType", "broadcastUri", "reservationId", "iPv4Address"));
     }
 }
diff --git a/api/src/main/java/com/cloud/vm/UserVmService.java b/api/src/main/java/com/cloud/vm/UserVmService.java
index ffa00734d575..5864e91cd7f4 100644
--- a/api/src/main/java/com/cloud/vm/UserVmService.java
+++ b/api/src/main/java/com/cloud/vm/UserVmService.java
@@ -75,10 +75,11 @@ public interface UserVmService {
      * Destroys one virtual machine
      *
      * @param cmd the API Command Object containg the parameters to use for this service action
+     * @param checkExpunge
      * @throws ConcurrentOperationException
      * @throws ResourceUnavailableException
      */
-    UserVm destroyVm(DestroyVMCmd cmd) throws ResourceUnavailableException, ConcurrentOperationException;
+    UserVm destroyVm(DestroyVMCmd cmd, boolean checkExpunge) throws ResourceUnavailableException, ConcurrentOperationException;
 
     /**
      * Destroys one virtual machine
diff --git a/api/src/main/java/com/cloud/vm/VirtualMachine.java b/api/src/main/java/com/cloud/vm/VirtualMachine.java
index 41c9a864c9d0..3adcc85d28a1 100644
--- a/api/src/main/java/com/cloud/vm/VirtualMachine.java
+++ b/api/src/main/java/com/cloud/vm/VirtualMachine.java
@@ -58,7 +58,10 @@ public enum State {
         Error(false, "VM is in error"),
         Unknown(false, "VM state is unknown."),
         Shutdown(false, "VM state is shutdown from inside"),
-        Restoring(true, "VM is being restored from backup");
+        Restoring(true, "VM is being restored from backup"),
+        BackingUp(true, "VM is being backed up"),
+        BackupError(false, "VM backup is in an inconsistent state. Operator should analyse the logs and restore the VM"),
+        RestoreError(false, "VM restore left the VM in an inconsistent state. Operator should analyse the logs and restore the VM");
 
         private final boolean _transitional;
         String _description;
@@ -134,6 +137,14 @@ public static StateMachine2<State, VirtualMachine.Event, VirtualMachine> getStat
             s_fsm.addTransition(new Transition<State, Event>(State.Destroyed, Event.RestoringRequested, State.Restoring, null));
             s_fsm.addTransition(new Transition<State, Event>(State.Restoring, Event.RestoringSuccess, State.Stopped, null));
             s_fsm.addTransition(new Transition<State, Event>(State.Restoring, Event.RestoringFailed, State.Stopped, null));
+            s_fsm.addTransition(new Transition<>(State.Running, Event.BackupRequested, State.BackingUp, null));
+            s_fsm.addTransition(new Transition<>(State.Stopped, Event.BackupRequested, State.BackingUp, null));
+            s_fsm.addTransition(new Transition<>(State.BackingUp, Event.BackupSucceededRunning, State.Running, null));
+            s_fsm.addTransition(new Transition<>(State.BackingUp, Event.BackupSucceededStopped, State.Stopped, null));
+            s_fsm.addTransition(new Transition<>(State.BackingUp, Event.OperationFailedToError, State.BackupError, null));
+            s_fsm.addTransition(new Transition<>(State.BackingUp, Event.OperationFailedToRunning, State.Running, null));
+            s_fsm.addTransition(new Transition<>(State.BackingUp, Event.OperationFailedToStopped, State.Stopped, null));
+            s_fsm.addTransition(new Transition<State, Event>(State.RestoreError, Event.RestoringFailed, State.RestoreError, null));
 
             s_fsm.addTransition(new Transition<State, Event>(State.Starting, VirtualMachine.Event.FollowAgentPowerOnReport, State.Running, Arrays.asList(new Impact[]{Impact.USAGE})));
             s_fsm.addTransition(new Transition<State, Event>(State.Stopping, VirtualMachine.Event.FollowAgentPowerOnReport, State.Running, null));
@@ -212,6 +223,8 @@ public enum Event {
         ExpungeOperation,
         OperationSucceeded,
         OperationFailed,
+        OperationFailedToRunning,
+        OperationFailedToStopped,
         OperationFailedToError,
         OperationRetry,
         AgentReportShutdowned,
@@ -221,6 +234,10 @@ public enum Event {
         RestoringRequested,
         RestoringFailed,
         RestoringSuccess,
+        BackupRequested,
+        BackupSucceededStopped,
+        BackupSucceededRunning,
+        FinalizedBackupChain,
 
         // added for new VMSync logic
         FollowAgentPowerOnReport,
diff --git a/api/src/main/java/com/cloud/vm/VmDetailConstants.java b/api/src/main/java/com/cloud/vm/VmDetailConstants.java
index 33cc6da70812..877df55c6d67 100644
--- a/api/src/main/java/com/cloud/vm/VmDetailConstants.java
+++ b/api/src/main/java/com/cloud/vm/VmDetailConstants.java
@@ -136,4 +136,14 @@ public interface VmDetailConstants {
     String ACTIVE_CHECKPOINT_CREATE_TIME = "active.checkpoint.create.time";
     String LAST_CHECKPOINT_ID = "last.checkpoint.id";
     String LAST_CHECKPOINT_CREATE_TIME = "last.checkpoint.create.time";
+
+    // KBOSS specific
+    String LINKED_VOLUMES_SECONDARY_STORAGE_UUIDS = "linkedVolumesSecondaryStorageUuids";
+    String VALIDATION_COMMAND = "backupValidationCommand";
+    String VALIDATION_COMMAND_ARGUMENTS = "backupValidationCommandArguments";
+    String VALIDATION_COMMAND_EXPECTED_RESULT = "backupValidationCommandExpectedResult";
+    String VALIDATION_COMMAND_TIMEOUT = "backupValidationCommandTimeout";
+    String VALIDATION_SCREENSHOT_WAIT = "backupValidationScreenshotWait";
+    String VALIDATION_BOOT_TIMEOUT = "backupValidationBootTimeout";
+    String LAST_KNOWN_STATE = "last_known_state";
 }
diff --git a/api/src/main/java/org/apache/cloudstack/alert/AlertService.java b/api/src/main/java/org/apache/cloudstack/alert/AlertService.java
index fcc87908bd5d..a9c2abc11ce7 100644
--- a/api/src/main/java/org/apache/cloudstack/alert/AlertService.java
+++ b/api/src/main/java/org/apache/cloudstack/alert/AlertService.java
@@ -83,6 +83,9 @@ private AlertType(short type, String name, boolean isDefault) {
         public static final AlertType ALERT_TYPE_VPN_GATEWAY_OBSOLETE_PARAMETERS = new AlertType((short)34, "ALERT.S2S.VPN.GATEWAY.OBSOLETE.PARAMETERS", true, true);
         public static final AlertType ALERT_TYPE_BACKUP_STORAGE = new AlertType(Capacity.CAPACITY_TYPE_BACKUP_STORAGE, "ALERT.STORAGE.BACKUP", true);
         public static final AlertType ALERT_TYPE_OBJECT_STORAGE = new AlertType(Capacity.CAPACITY_TYPE_OBJECT_STORAGE, "ALERT.STORAGE.OBJECT", true);
+        public static final AlertType ALERT_TYPE_BACKUP_VALIDATION_FAILED = new AlertType((short)35, "ALERT.BACKUP.VALIDATION.FAILED", true, true);
+        public static final AlertType ALERT_TYPE_BACKUP_VALIDATION_UNABLE_TO_VALIDATE = new AlertType((short)36, "ALERT.BACKUP.VALIDATION.UNABLE.TO.VALIDATE", true, true);
+        public static final AlertType ALERT_TYPE_BACKUP_VALIDATION_CLEANUP_FAILED = new AlertType((short)37, "ALERT.BACKUP.VALIDATION.CLEANUP_FAILED", true, true);
 
         public short getType() {
             return type;
diff --git a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
index 5c53430388da..ac6acdf42516 100644
--- a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
+++ b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
@@ -63,6 +63,7 @@ public class ApiConstants {
     public static final String BACKUP_LIMIT = "backuplimit";
     public static final String BACKUP_OFFERING_NAME = "backupofferingname";
     public static final String BACKUP_OFFERING_ID = "backupofferingid";
+    public static final String BACKUP_OFFERING_DETAILS = "backupofferingdetails";
     public static final String BACKUP_STORAGE_AVAILABLE = "backupstorageavailable";
     public static final String BACKUP_STORAGE_LIMIT = "backupstoragelimit";
     public static final String BACKUP_STORAGE_TOTAL = "backupstoragetotal";
@@ -286,6 +287,7 @@ public class ApiConstants {
     public static final String HEALTH = "health";
     public static final String HEADERS = "headers";
     public static final String HIDE_IP_ADDRESS_USAGE = "hideipaddressusage";
+    public static final String HISTORY = "history";
     public static final String HOST_ID = "hostid";
     public static final String HOST_IDS = "hostids";
     public static final String HOST_IP = "hostip";
@@ -533,6 +535,7 @@ public class ApiConstants {
     public static final String QUALIFIERS = "qualifiers";
     public static final String QUERY_FILTER = "queryfilter";
     public static final String QUIESCE_VM = "quiescevm";
+    public static final String QUICK_RESTORE = "quickrestore";
     public static final String SCHEDULE = "schedule";
     public static final String SCHEDULE_ID = "scheduleid";
     public static final String SCOPE = "scope";
@@ -583,6 +586,8 @@ public class ApiConstants {
     public static final String STATE = "state";
     public static final String STATS = "stats";
     public static final String STATUS = "status";
+    public static final String COMPRESSION_STATUS = "compressionstatus";
+    public static final String VALIDATION_STATUS = "validationstatus";
     public static final String STORAGE_TYPE = "storagetype";
     public static final String STORAGE_POLICY = "storagepolicy";
     public static final String STORAGE_MOTION_ENABLED = "storagemotionenabled";
@@ -681,6 +686,7 @@ public class ApiConstants {
     public static final String ETCD_SERVICE_OFFERING_NAME = "etcdofferingname";
     public static final String REMOVE_VLAN = "removevlan";
     public static final String VLAN_ID = "vlanid";
+    public static final String ISOLATED = "isolated";
     public static final String ISOLATED_PVLAN = "isolatedpvlan";
     public static final String ISOLATED_PVLAN_TYPE = "isolatedpvlantype";
     public static final String ISOLATION_URI = "isolationuri";
@@ -1205,6 +1211,7 @@ public class ApiConstants {
     public static final String CLEAN_UP_EXTRA_CONFIG = "cleanupextraconfig";
     public static final String CLEAN_UP_PARAMETERS = "cleanupparameters";
     public static final String VIRTUAL_SIZE = "virtualsize";
+    public static final String UNCOMPRESSED_SIZE = "uncompressedsize";
     public static final String NETSCALER_CONTROLCENTER_ID = "netscalercontrolcenterid";
     public static final String NETSCALER_SERVICEPACKAGE_ID = "netscalerservicepackageid";
     public static final String FETCH_ROUTER_HEALTH_CHECK_RESULTS = "fetchhealthcheckresults";
@@ -1341,7 +1348,7 @@ public class ApiConstants {
     public static final String IMPORT_SOURCE = "importsource";
     public static final String TEMP_PATH = "temppath";
     public static final String HEURISTIC_RULE = "heuristicrule";
-    public static final String HEURISTIC_TYPE_VALID_OPTIONS = "Valid options are: ISO, SNAPSHOT, TEMPLATE and VOLUME.";
+    public static final String HEURISTIC_TYPE_VALID_OPTIONS = "Valid options are: ISO, SNAPSHOT, BACKUP, TEMPLATE and VOLUME.";
     public static final String MANAGEMENT = "management";
     public static final String IS_VNF = "isvnf";
     public static final String VNF_NICS = "vnfnics";
@@ -1437,6 +1444,10 @@ public class ApiConstants {
 
     public static final String VMWARE_DC = "vmwaredc";
 
+    public static final String PARAMETER_DESCRIPTION_ISOLATED_BACKUPS = "Whether the backup will be isolated, defaults to false. " +
+            "Isolated backups are always created as full backups in independent chains. Therefore, they will never depend on any existing backup chain " +
+            "and no backup chain will depend on them. Currently only supported for the KBOSS provider.";
+
     public static final String CSS = "css";
 
     public static final String JSON_CONFIGURATION = "jsonconfiguration";
@@ -1458,6 +1469,27 @@ public class ApiConstants {
     public static final String OBSOLETE_PARAMETERS = "obsoleteparameters";
     public static final String EXCLUDED_PARAMETERS = "excludedparameters";
 
+    public static final String COMPRESS = "compress";
+
+    public static final String VALIDATE = "validate";
+
+    public static final String VALIDATION_STEPS = "validationsteps";
+
+    public static final String ALLOW_QUICK_RESTORE = "allowquickrestore";
+
+    public static final String ALLOW_EXTRACT_FILE = "allowextractfile";
+
+    public static final String BACKUP_CHAIN_SIZE = "backupchainsize";
+
+    public static final String COMPRESSION_LIBRARY = "compressionlibrary";
+    public static final String ATTEMPTS = "attempts";
+
+    public static final String EXECUTING = "executing";
+
+    public static final String SCHEDULED = "scheduled";
+    public static final String SCHEDULED_DATE = "scheduleddate";
+    public static final String BACKUP_PROVIDER = "backupprovider";
+
     /**
      * This enum specifies IO Drivers, each option controls specific policies on I/O.
      * Qemu guests support "threads" and "native" options Since 0.8.8 ; "io_uring" is supported Since 6.3.0 (QEMU 5.0).
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/network/NetworkOfferingBaseCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/network/NetworkOfferingBaseCmd.java
index 1c832b7217ef..9b42be137314 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/network/NetworkOfferingBaseCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/network/NetworkOfferingBaseCmd.java
@@ -216,6 +216,8 @@ public abstract class NetworkOfferingBaseCmd extends BaseCmd {
             description = "the routing mode for the network offering. Supported types are: Static or Dynamic.")
     private String routingMode;
 
+    private Map<String, String> sourceDetailsMap;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -430,9 +432,8 @@ public Map<Network.Capability, String> getServiceCapabilities(Network.Service se
 
     public Map<String, String> getDetails() {
         if (details == null || details.isEmpty()) {
-            return null;
+            return sourceDetailsMap;
         }
-
         Collection paramsCollection = details.values();
         Object objlist[] = paramsCollection.toArray();
         Map<String, String> params = (Map<String, String>) (objlist[0]);
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/CreateVMFromBackupCmdByAdmin.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/CreateVMFromBackupCmdByAdmin.java
index d95f17ef304c..280e4a8bab77 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/CreateVMFromBackupCmdByAdmin.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/CreateVMFromBackupCmdByAdmin.java
@@ -45,6 +45,8 @@ public class CreateVMFromBackupCmdByAdmin extends CreateVMFromBackupCmd implemen
     @Parameter(name = ApiConstants.CLUSTER_ID, type = CommandType.UUID, entityType = ClusterResponse.class, description = "destination Cluster ID to deploy the VM to - parameter available for root admin only", since = "4.21")
     private Long clusterId;
 
+    private String instanceType;
+
     public Long getPodId() {
         return podId;
     }
@@ -52,4 +54,17 @@ public Long getPodId() {
     public Long getClusterId() {
         return clusterId;
     }
+
+    @Override
+    public String getInstanceType() {
+        return instanceType;
+    }
+
+    public CreateVMFromBackupCmdByAdmin(){}
+
+    public CreateVMFromBackupCmdByAdmin(String hypervisor, String instanceType) {
+        this.displayVm = false;
+        this.hypervisor = hypervisor;
+        this.instanceType = instanceType;
+    }
 }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/volume/DestroyVolumeCmdByAdmin.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/volume/DestroyVolumeCmdByAdmin.java
index 0840b4ce6f99..de90fee102de 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/volume/DestroyVolumeCmdByAdmin.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/volume/DestroyVolumeCmdByAdmin.java
@@ -40,7 +40,7 @@ public class DestroyVolumeCmdByAdmin extends DestroyVolumeCmd implements AdminCm
     @Override
     public void execute() {
         CallContext.current().setEventDetails("Volume Id: " + getId());
-        Volume result = _volumeService.destroyVolume(getId(), CallContext.current().getCallingAccount(), getExpunge(), false);
+        Volume result = _volumeService.destroyVolume(getId(), CallContext.current().getCallingAccount(), getExpunge(), false, null);
         if (result != null) {
             VolumeResponse response = _responseGenerator.createVolumeResponse(ResponseView.Full, result);
             response.setResponseName(getCommandName());
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/CreateBackupCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/CreateBackupCmd.java
index 8a4053aa15da..5b7bd518df0e 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/CreateBackupCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/CreateBackupCmd.java
@@ -75,12 +75,18 @@ public class CreateBackupCmd extends BaseAsyncCreateCmd {
     @Parameter(name = ApiConstants.QUIESCE_VM,
             type = CommandType.BOOLEAN,
             required = false,
-            description = "Quiesce the instance before checkpointing the disks for backup. Applicable only to NAS backup provider. " +
+            description = "Quiesce the instance before checkpointing the disks for backup. Applicable only to NAS and KBOSS backup providers. " +
                     "The filesystem is frozen before the backup starts and thawed immediately after. " +
                     "Requires the instance to have the QEMU Guest Agent installed and running.",
             since = "4.21.0")
     private Boolean quiesceVM;
 
+    @Parameter(name = ApiConstants.ISOLATED,
+            type = CommandType.BOOLEAN,
+            description = ApiConstants.PARAMETER_DESCRIPTION_ISOLATED_BACKUPS,
+            since = "4.23.0")
+    private boolean isolated;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -101,6 +107,10 @@ public Boolean getQuiesceVM() {
         return quiesceVM;
     }
 
+    public boolean isIsolated() {
+        return isolated;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/CreateBackupOfferingCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/CreateBackupOfferingCmd.java
new file mode 100644
index 000000000000..c5d29b615439
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/CreateBackupOfferingCmd.java
@@ -0,0 +1,185 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.user.backup;
+
+import com.cloud.exception.ConcurrentOperationException;
+import com.cloud.exception.InsufficientCapacityException;
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.exception.NetworkRuleConflictException;
+import com.cloud.exception.ResourceAllocationException;
+import com.cloud.exception.ResourceUnavailableException;
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.BackupOfferingResponse;
+import org.apache.cloudstack.api.response.DomainResponse;
+import org.apache.cloudstack.api.response.ZoneResponse;
+import org.apache.cloudstack.backup.Backup;
+import org.apache.cloudstack.backup.BackupManager;
+import org.apache.cloudstack.backup.BackupOffering;
+
+
+import javax.inject.Inject;
+import java.util.List;
+
+@APICommand(name = "createBackupOffering", description = "Creates a backup offering", responseObject = BackupOfferingResponse.class,
+        requestHasSensitiveInfo = false, responseHasSensitiveInfo = false, authorized = {RoleType.Admin}, since = "4.23.0")
+public class CreateBackupOfferingCmd extends BaseCmd {
+
+    @Inject
+    protected BackupManager backupManager;
+
+    /////////////////////////////////////////////////////
+    //////////////// API parameters /////////////////////
+    /////////////////////////////////////////////////////
+
+    @Parameter(name = ApiConstants.NAME, type = CommandType.STRING, description = "Backup offering name.", required = true)
+    private String name;
+
+    @Parameter(name = ApiConstants.DESCRIPTION, type = CommandType.STRING, required = true,
+            description = "The description of the backup offering")
+    private String description;
+
+    @Parameter(name = ApiConstants.COMPRESS, type = CommandType.BOOLEAN, description = "Whether the backups should be compressed or not.")
+    private Boolean compress;
+
+    @Parameter(name = ApiConstants.VALIDATE, type = CommandType.BOOLEAN, description = "Whether the backups should be validated or not.")
+    private Boolean validate;
+
+    @Parameter(name = ApiConstants.VALIDATION_STEPS, type = CommandType.STRING, description = "Which validation steps should be performed. Accepts a comma-separated list of " +
+            "steps. Accepted values are: wait_for_boot, screenshot and execute_command.")
+    private String validationSteps;
+
+    @Parameter(name = ApiConstants.ALLOW_QUICK_RESTORE, type = CommandType.BOOLEAN, description = "Whether quick restore is enabled for the backups or not.")
+    private Boolean allowQuickRestore;
+
+    @Parameter(name = ApiConstants.ALLOW_EXTRACT_FILE, type = CommandType.BOOLEAN, description = "Whether files may be extracted from backups or not.")
+    private Boolean allowExtractFile;
+
+    @Parameter(name = ApiConstants.BACKUP_CHAIN_SIZE, type = CommandType.INTEGER, description = "Backup chain size for backups created with this offering.")
+    private Integer backupChainSize;
+
+    @Parameter(name = ApiConstants.COMPRESSION_LIBRARY, type = CommandType.STRING, description = "Compression library, for offerings that support compression. Accepted values " +
+            "are zstd and zlib. By default, zstd is used for images that support it. If the image only supports zlib, it will be used regardless of this parameter.")
+    private String compressionLibrary;
+
+    @Parameter(name = ApiConstants.ZONE_ID, type = BaseCmd.CommandType.UUID, entityType = ZoneResponse.class,
+            description = "Restrict the backup offering to the Zone identified by this ID.", required = true)
+    private Long zoneId;
+
+    @Parameter(name = ApiConstants.ALLOW_USER_DRIVEN_BACKUPS, type = CommandType.BOOLEAN,
+            description = "Whether users are allowed to create ad-hoc backups and backup schedules when using this offering.", required = true)
+    private Boolean userDrivenBackups;
+
+    @Parameter(name = ApiConstants.DOMAIN_ID, type = CommandType.LIST, collectionType = CommandType.UUID, entityType = DomainResponse.class,
+            description = "Restrict the backup offering to the Domains identified by these IDs.")
+    private List<Long> domainIds;
+
+    /////////////////////////////////////////////////////
+    /////////////////// Accessors ///////////////////////
+    /////////////////////////////////////////////////////
+
+    public String getName() {
+        return name;
+    }
+
+    public boolean isCompress() {
+        return Boolean.TRUE.equals(compress);
+    }
+
+    public boolean isValidate() {
+        return Boolean.TRUE.equals(validate);
+    }
+
+    public boolean isAllowQuickRestore() {
+        return Boolean.TRUE.equals(allowQuickRestore);
+    }
+
+    public boolean isAllowExtractFile() {
+        return Boolean.TRUE.equals(allowExtractFile);
+    }
+
+    public Integer getBackupChainSize() {
+        return backupChainSize;
+    }
+
+    public Backup.CompressionLibrary getCompressionLibrary() {
+        if (compressionLibrary == null) {
+            return null;
+        }
+        try {
+            return Backup.CompressionLibrary.valueOf(compressionLibrary);
+        } catch (IllegalArgumentException e) {
+            throw new InvalidParameterValueException(String.format("Invalid compression library, accepted values are zstd and zlib, received [%s].", compressionLibrary));
+        }
+    }
+
+    public String getValidationSteps() {
+        if (validationSteps == null) {
+            return Backup.ValidationSteps.screenshot.name();
+        }
+        StringBuilder sb = new StringBuilder();
+        for (String step : validationSteps.strip().split(",")) {
+            try {
+                Backup.ValidationSteps enumStep = Backup.ValidationSteps.valueOf(step);
+                sb.append(enumStep.name());
+                sb.append(",");
+            } catch (IllegalArgumentException ex) {
+                logger.error("Invalid validation step informed [{}].", step, ex);
+                throw new InvalidParameterValueException(String.format("Invalid validation step [%s] informed. Accepted values are: wait_for_boot, screenshot and execute_command.", step));
+            }
+        }
+        sb.deleteCharAt(sb.lastIndexOf(","));
+        return sb.toString();
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public Long getZoneId() {
+        return zoneId;
+    }
+
+    public List<Long> getDomainIds() {
+        return domainIds;
+    }
+
+    public Boolean getUserDrivenBackups() {
+        return userDrivenBackups;
+    }
+
+    /////////////////////////////////////////////////////
+    /////////////// API Implementation///////////////////
+    /////////////////////////////////////////////////////
+    @Override
+    public void execute() throws ResourceUnavailableException, InsufficientCapacityException, ServerApiException, ConcurrentOperationException, ResourceAllocationException,
+            NetworkRuleConflictException {
+        BackupOffering offering = backupManager.createBackupOffering(this);
+        BackupOfferingResponse response = _responseGenerator.createBackupOfferingResponse(offering);
+        response.setResponseName(getCommandName());
+        this.setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return 0;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/CreateBackupScheduleCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/CreateBackupScheduleCmd.java
index f6e17a2b3908..812d78425e89 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/CreateBackupScheduleCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/CreateBackupScheduleCmd.java
@@ -82,12 +82,18 @@ public class CreateBackupScheduleCmd extends BaseCmd {
     @Parameter(name = ApiConstants.QUIESCE_VM,
             type = CommandType.BOOLEAN,
             required = false,
-            description = "Quiesce the Instance before checkpointing the disks for backup. Applicable only to NAS backup provider. " +
+            description = "Quiesce the Instance before checkpointing the disks for backup. Applicable only to NAS and KBOSS backup providers. " +
                     "The filesystem is frozen before the backup starts and thawed immediately after. " +
                     "Requires the instance to have the QEMU Guest Agent installed and running.",
             since = "4.21.0")
     private Boolean quiesceVM;
 
+    @Parameter(name = ApiConstants.ISOLATED,
+            type = CommandType.BOOLEAN,
+            description = ApiConstants.PARAMETER_DESCRIPTION_ISOLATED_BACKUPS,
+            since = "4.23.0")
+    private boolean isolated;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -116,6 +122,10 @@ public Boolean getQuiesceVM() {
         return quiesceVM;
     }
 
+    public boolean isIsolated() {
+        return isolated;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/DownloadValidationScreenshotCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/DownloadValidationScreenshotCmd.java
new file mode 100644
index 000000000000..997d0d24c6f0
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/DownloadValidationScreenshotCmd.java
@@ -0,0 +1,94 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.user.backup;
+
+import com.cloud.event.EventTypes;
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.user.Account;
+import org.apache.cloudstack.api.ACL;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseAsyncCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.response.BackupResponse;
+import org.apache.cloudstack.api.response.ExtractResponse;
+import org.apache.cloudstack.backup.Backup;
+import org.apache.cloudstack.backup.InternalBackupService;
+
+import javax.inject.Inject;
+
+@APICommand(name = "downloadValidationScreenshot", description = "Download validation screenshot of given backup.",
+        responseObject = ExtractResponse.class, since = "4.23.0", requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false)
+public class DownloadValidationScreenshotCmd extends BaseAsyncCmd {
+
+    @Inject
+    private InternalBackupService internalBackupService;
+
+    /////////////////////////////////////////////////////
+    //////////////// API parameters /////////////////////
+    /////////////////////////////////////////////////////
+
+    @ACL
+    @Parameter(name = ApiConstants.BACKUP_ID, type = CommandType.UUID, entityType = BackupResponse.class, required = true,
+            description = "ID of the backup.")
+    private Long backupId;
+
+    /////////////////////////////////////////////////////
+    /////////////////// Accessors ///////////////////////
+    /////////////////////////////////////////////////////
+
+    public Long getBackupId() {
+        return backupId;
+    }
+
+    /////////////////////////////////////////////////////
+    /////////////// API Implementation///////////////////
+    /////////////////////////////////////////////////////
+
+    @Override
+    public String getEventType() {
+        return EventTypes.EVENT_SCREENSHOT_DOWNLOAD;
+    }
+
+    @Override
+    public String getEventDescription() {
+        Backup backup = _entityMgr.findById(Backup.class, getBackupId());
+        if (backup == null) {
+            throw new InvalidParameterValueException(String.format("Unable to find backup with ID [%s].", getBackupId()));
+        }
+        return "Downloading validation screenshot of backup " + backup.getUuid();
+    }
+
+    @Override
+    public void execute() {
+        ExtractResponse response = internalBackupService.downloadScreenshot(getBackupId());
+        response.setResponseName(getCommandName());
+        response.setObjectName(getCommandName());
+        this.setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        Backup backup = _entityMgr.findById(Backup.class, getBackupId());
+        if (backup != null) {
+            return backup.getAccountId();
+        }
+
+        return Account.ACCOUNT_ID_SYSTEM;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/FinishBackupChainCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/FinishBackupChainCmd.java
new file mode 100644
index 000000000000..575df7ae0831
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/FinishBackupChainCmd.java
@@ -0,0 +1,86 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.user.backup;
+
+import com.cloud.exception.ConcurrentOperationException;
+import com.cloud.exception.InsufficientCapacityException;
+import com.cloud.exception.NetworkRuleConflictException;
+import com.cloud.exception.ResourceAllocationException;
+import com.cloud.exception.ResourceUnavailableException;
+import com.cloud.user.Account;
+import com.cloud.vm.VirtualMachine;
+import org.apache.cloudstack.api.ACL;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.SuccessResponse;
+import org.apache.cloudstack.api.response.VirtualMachineResponse;
+import org.apache.cloudstack.backup.InternalBackupService;
+
+import javax.inject.Inject;
+
+@APICommand(name = "finishBackupChain", description = "Finish the backup chain of VM. Currently only has effect on VMs with KBOSS backup offerings.",
+        responseObject = SuccessResponse.class, since = "4.23.0", requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false)
+public class FinishBackupChainCmd extends BaseCmd {
+    @Inject
+    private InternalBackupService internalBackupService;
+
+    /////////////////////////////////////////////////////
+    //////////////// API parameters /////////////////////
+    /////////////////////////////////////////////////////
+
+    @ACL
+    @Parameter(name = ApiConstants.VIRTUAL_MACHINE_ID, type = CommandType.UUID, entityType = VirtualMachineResponse.class, required = true,
+            description = "ID of the VM to finish the chain.")
+    private Long vmId;
+
+    /////////////////////////////////////////////////////
+    /////////////////// Accessors ///////////////////////
+    /////////////////////////////////////////////////////
+
+    public Long getVmId() {
+        return vmId;
+    }
+
+    /////////////////////////////////////////////////////
+    /////////////// API Implementation///////////////////
+    /////////////////////////////////////////////////////
+
+    @Override
+    public void execute() throws ResourceUnavailableException, InsufficientCapacityException, ServerApiException, ConcurrentOperationException, ResourceAllocationException,
+            NetworkRuleConflictException {
+        boolean result = internalBackupService.finishBackupChain(getVmId());
+        SuccessResponse response = new SuccessResponse();
+        response.setSuccess(result);
+        response.setResponseName(getCommandName());
+        response.setObjectName(getCommandName());
+        this.setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        VirtualMachine vm = _entityMgr.findById(VirtualMachine.class, getVmId());
+        if (vm != null) {
+            return vm.getAccountId();
+        }
+
+        return Account.ACCOUNT_ID_SYSTEM;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/ListBackupServiceJobsCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/ListBackupServiceJobsCmd.java
new file mode 100644
index 000000000000..39ca444ae2ee
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/ListBackupServiceJobsCmd.java
@@ -0,0 +1,105 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.command.user.backup;
+
+import com.cloud.exception.ConcurrentOperationException;
+import com.cloud.exception.InsufficientCapacityException;
+import com.cloud.exception.NetworkRuleConflictException;
+import com.cloud.exception.ResourceAllocationException;
+import com.cloud.exception.ResourceUnavailableException;
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseListCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.BackupServiceJobResponse;
+import org.apache.cloudstack.api.response.BackupResponse;
+import org.apache.cloudstack.api.response.HostResponse;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.api.response.ZoneResponse;
+
+@APICommand(name = "listBackupServiceJobs", description = "List backup service jobs", responseObject = BackupServiceJobResponse.class,
+        requestHasSensitiveInfo = false, responseHasSensitiveInfo = false, authorized = {RoleType.Admin}, since = "4.23.0")
+public class ListBackupServiceJobsCmd extends BaseListCmd {
+
+    @Parameter(name = ApiConstants.ID, type = CommandType.LONG, entityType = BackupServiceJobResponse.class, description = "List only job with given ID.")
+    private Long id;
+
+    @Parameter(name = ApiConstants.BACKUP_ID, type = CommandType.UUID, entityType = BackupResponse.class, description = "List jobs for the given backup.")
+    private Long backupId;
+
+    @Parameter(name = ApiConstants.HOST_ID, type = CommandType.UUID, entityType = HostResponse.class, description = "List jobs in the given host. When passing this parameter, only jobs that are currently executing will be returned.")
+    private Long hostId;
+
+    @Parameter(name = ApiConstants.ZONE_ID, type = CommandType.UUID, entityType = ZoneResponse.class, description = "List jobs in the given zone.")
+    private Long zoneId;
+
+    @Parameter(name = ApiConstants.TYPE, type = CommandType.STRING, description = "List jobs with the given type. Accepted values are StartCompression, FinalizeCompression and " +
+            "BackupValidation.")
+    private String type;
+
+    @Parameter(name = ApiConstants.EXECUTING, type = CommandType.BOOLEAN, description = "List executing jobs.")
+    private Boolean executing;
+
+    @Parameter(name = ApiConstants.SCHEDULED, type = CommandType.BOOLEAN, description = "List scheduled jobs.")
+    private Boolean scheduled;
+
+    /////////////////////////////////////////////////////
+    /////////////////// Accessors ///////////////////////
+    /////////////////////////////////////////////////////
+
+    public Long getId() {
+        return id;
+    }
+
+    public Long getBackupId() {
+        return backupId;
+    }
+
+    public Long getHostId() {
+        return hostId;
+    }
+
+    public Long getZoneId() {
+        return zoneId;
+    }
+
+    public String getType() {
+        return type;
+    }
+
+    public boolean getExecuting() {
+        return Boolean.TRUE.equals(executing);
+    }
+
+    public boolean getScheduled() {
+        return Boolean.TRUE.equals(scheduled);
+    }
+
+    /////////////////////////////////////////////////////
+    /////////////// API Implementation///////////////////
+    /////////////////////////////////////////////////////
+
+    @Override
+    public void execute() throws ResourceUnavailableException, InsufficientCapacityException, ServerApiException, ConcurrentOperationException, ResourceAllocationException,
+            NetworkRuleConflictException {
+        ListResponse<BackupServiceJobResponse> response = _queryService.listBackupServiceJobs(this);
+        response.setResponseName(getCommandName());
+        this.setResponseObject(response);
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/RestoreBackupCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/RestoreBackupCmd.java
index c29d117161f2..9c67aa6a9f69 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/RestoreBackupCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/RestoreBackupCmd.java
@@ -26,6 +26,7 @@
 import org.apache.cloudstack.api.BaseAsyncCmd;
 import org.apache.cloudstack.api.Parameter;
 import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.HostResponse;
 import org.apache.cloudstack.api.response.SuccessResponse;
 import org.apache.cloudstack.api.response.BackupResponse;
 import org.apache.cloudstack.backup.BackupManager;
@@ -38,6 +39,7 @@
 import com.cloud.exception.ResourceAllocationException;
 import com.cloud.exception.ResourceUnavailableException;
 import com.cloud.utils.exception.CloudRuntimeException;
+import org.apache.commons.lang3.BooleanUtils;
 
 @APICommand(name = "restoreBackup",
         description = "Restores an existing stopped or deleted Instance using an Instance backup",
@@ -59,6 +61,14 @@ public class RestoreBackupCmd extends BaseAsyncCmd {
             description = "ID of the backup")
     private Long backupId;
 
+    @Parameter(name = ApiConstants.QUICK_RESTORE, type = CommandType.BOOLEAN, entityType = BackupResponse.class, description = "Whether to use the quick restore process or not. " +
+            "Currently this parameter is only supported by the KBOSS provider.", since = "4.23.0")
+    private Boolean quickRestore;
+
+    @Parameter(name = ApiConstants.HOST_ID, type = CommandType.UUID, entityType = HostResponse.class, description = "If quickrestore is true, which host to start the VM on;" +
+            " otherwise, ignored. Currently this parameter is only supported by the KBOSS provider.", since = "4.23.0", authorized = {RoleType.Admin})
+    private Long hostId;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -67,6 +77,14 @@ public Long getBackupId() {
         return backupId;
     }
 
+    public boolean isQuickRestore() {
+        return BooleanUtils.isTrue(quickRestore);
+    }
+
+    public Long getHostId() {
+        return hostId;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
@@ -74,7 +92,7 @@ public Long getBackupId() {
     @Override
     public void execute() throws ResourceUnavailableException, InsufficientCapacityException, ServerApiException, ConcurrentOperationException, ResourceAllocationException, NetworkRuleConflictException {
         try {
-            boolean result = backupManager.restoreBackup(backupId);
+            boolean result = backupManager.restoreBackup(backupId, isQuickRestore(), getHostId());
             if (result) {
                 SuccessResponse response = new SuccessResponse(getCommandName());
                 response.setResponseName(getCommandName());
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/RestoreVolumeFromBackupAndAttachToVMCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/RestoreVolumeFromBackupAndAttachToVMCmd.java
index c15e6f8de684..e05845866c2b 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/RestoreVolumeFromBackupAndAttachToVMCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/RestoreVolumeFromBackupAndAttachToVMCmd.java
@@ -28,6 +28,7 @@
 import org.apache.cloudstack.api.BaseAsyncCmd;
 import org.apache.cloudstack.api.Parameter;
 import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.HostResponse;
 import org.apache.cloudstack.api.response.SuccessResponse;
 import org.apache.cloudstack.api.response.UserVmResponse;
 import org.apache.cloudstack.api.response.BackupResponse;
@@ -78,6 +79,14 @@ public class RestoreVolumeFromBackupAndAttachToVMCmd extends BaseAsyncCmd {
             description = "ID of the Instance where to attach the restored volume")
     private Long vmId;
 
+    @Parameter(name = ApiConstants.QUICK_RESTORE, type = CommandType.BOOLEAN, description = "Whether to use the quick restore process or not. " +
+            "Currently this parameter is only supported by the KBOSS provider.", since = "4.23.0")
+    private Boolean quickRestore;
+
+    @Parameter(name = ApiConstants.HOST_ID, type = CommandType.UUID, entityType = HostResponse.class, description = "If quickrestore is true, which host to start the VM on;" +
+            " otherwise, ignored. Currently this parameter is only supported by the KBOSS provider.", since = "4.23.0", authorized = {RoleType.Admin})
+    private Long hostId;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -94,6 +103,14 @@ public Long getBackupId() {
         return backupId;
     }
 
+    public boolean isQuickRestore() {
+        return org.apache.commons.lang3.BooleanUtils.isTrue(quickRestore);
+    }
+
+    public Long getHostId() {
+        return hostId;
+    }
+
     @Override
     public long getEntityOwnerId() {
         return CallContext.current().getCallingAccount().getId();
@@ -106,7 +123,7 @@ public long getEntityOwnerId() {
     @Override
     public void execute() throws ResourceUnavailableException, InsufficientCapacityException, ServerApiException, ConcurrentOperationException, ResourceAllocationException, NetworkRuleConflictException {
         try {
-            boolean result = backupManager.restoreBackupVolumeAndAttachToVM(volumeUuid, backupId, vmId);
+            boolean result = backupManager.restoreBackupVolumeAndAttachToVM(volumeUuid, backupId, vmId, isQuickRestore(), getHostId());
             if (result) {
                 SuccessResponse response = new SuccessResponse(getCommandName());
                 response.setResponseName(getCommandName());
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/firewall/CreateEgressFirewallRuleCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/firewall/CreateEgressFirewallRuleCmd.java
index 3fd571b7a479..e2c84ac85c7a 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/firewall/CreateEgressFirewallRuleCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/firewall/CreateEgressFirewallRuleCmd.java
@@ -212,7 +212,7 @@ public State getState() {
     }
 
     @Override
-    public long getNetworkId() {
+    public Long getNetworkId() {
         return networkId;
     }
 
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/firewall/CreateFirewallRuleCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/firewall/CreateFirewallRuleCmd.java
index bc65126f33bd..30dd1a2d015a 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/firewall/CreateFirewallRuleCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/firewall/CreateFirewallRuleCmd.java
@@ -223,13 +223,9 @@ public State getState() {
     }
 
     @Override
-    public long getNetworkId() {
-        IpAddress ip = _entityMgr.findById(IpAddress.class, getIpAddressId());
-        Long ntwkId = null;
-
-        if (ip.getAssociatedWithNetworkId() != null) {
-            ntwkId = ip.getAssociatedWithNetworkId();
-        }
+    public Long getNetworkId() {
+        IpAddress ip = getIp();
+        Long ntwkId = isVpcIp(ip) ? getVpcNetworkIdForFirewallRule(ip) : getIsolatedNetworkIdForFirewallRule(ip);
 
         if (ntwkId == null) {
             throw new InvalidParameterValueException("Unable to create firewall rule for the IP address ID=" + ipAddressId +
@@ -238,6 +234,12 @@ public long getNetworkId() {
         return ntwkId;
     }
 
+    @Override
+    public Long getVpcId() {
+        IpAddress ip = getIp();
+        return isVpcIp(ip) ? ip.getVpcId() : null;
+    }
+
     @Override
     public long getEntityOwnerId() {
         Account account = CallContext.current().getCallingAccount();
@@ -300,7 +302,21 @@ public String getSyncObjType() {
 
     @Override
     public Long getSyncObjId() {
-        return getIp().getAssociatedWithNetworkId();
+        Long syncObjId = getIp().getAssociatedWithNetworkId();
+        return syncObjId != null ? syncObjId : getNetworkId();
+    }
+
+    private boolean isVpcIp(IpAddress ip) {
+        return ip.getVpcId() != null;
+    }
+
+    private Long getIsolatedNetworkIdForFirewallRule(IpAddress ip) {
+        return ip.getAssociatedWithNetworkId();
+    }
+
+    private Long getVpcNetworkIdForFirewallRule(IpAddress ip) {
+        // VPC flow is independent from tier association; manager resolves execution network.
+        return ip.getNetworkId();
     }
 
     private IpAddress getIp() {
@@ -311,6 +327,7 @@ private IpAddress getIp() {
         return ip;
     }
 
+
     @Override
     public Integer getIcmpCode() {
         if (icmpCode != null) {
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/firewall/CreatePortForwardingRuleCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/firewall/CreatePortForwardingRuleCmd.java
index 2bc5fc2ee68b..66fc118395ea 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/firewall/CreatePortForwardingRuleCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/firewall/CreatePortForwardingRuleCmd.java
@@ -176,7 +176,7 @@ public Boolean getOpenFirewall() {
         }
     }
 
-    private Long getVpcId() {
+    public Long getVpcId() {
         if (ipAddressId != null) {
             IpAddress ipAddr = _networkService.getIp(ipAddressId);
             if (ipAddr == null || !ipAddr.readyToUse()) {
@@ -275,7 +275,7 @@ public State getState() {
     }
 
     @Override
-    public long getNetworkId() {
+    public Long getNetworkId() {
         IpAddress ip = _entityMgr.findById(IpAddress.class, getIpAddressId());
         Long ntwkId = _networkService.getPreferredNetworkIdForPublicIpRuleAssignment(ip, networkId);
         if (ntwkId == null) {
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/nat/CreateIpForwardingRuleCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/nat/CreateIpForwardingRuleCmd.java
index 7963dfe5c7d3..98487ddeb19a 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/nat/CreateIpForwardingRuleCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/nat/CreateIpForwardingRuleCmd.java
@@ -229,8 +229,13 @@ public FirewallRule.State getState() {
     }
 
     @Override
-    public long getNetworkId() {
-        return -1;
+    public Long getNetworkId() {
+        return -1L;
+    }
+
+    @Override
+    public Long getVpcId() {
+        return null;
     }
 
     @Override
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/network/CreateNetworkCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/network/CreateNetworkCmd.java
index ee5b8568e835..79fb5f6d01cf 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/network/CreateNetworkCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/network/CreateNetworkCmd.java
@@ -419,6 +419,27 @@ public Long getAsNumber() {
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
+
+    public CreateNetworkCmd() {
+    }
+
+    public CreateNetworkCmd(long networkOfferingId, String name, String displayText, String gateway, String netmask, String startIp, String endIp, long domainId,
+            String accountName, long zoneId, String aclType, boolean subdomainAccess, boolean displayNetwork) {
+        this.networkOfferingId = networkOfferingId;
+        this.name = name;
+        this.displayText = displayText;
+        this.gateway = gateway;
+        this.netmask = netmask;
+        this.startIp = startIp;
+        this.endIp = endIp;
+        this.domainId = domainId;
+        this.accountName = accountName;
+        this.zoneId = zoneId;
+        this.aclType = aclType;
+        this.subdomainAccess = subdomainAccess;
+        this.displayNetwork = displayNetwork;
+    }
+
     @Override
     public String getCommandName() {
         return s_name;
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/CreateVMFromBackupCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/CreateVMFromBackupCmd.java
index a719062e1bca..7743c031006b 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/CreateVMFromBackupCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/CreateVMFromBackupCmd.java
@@ -36,6 +36,7 @@
 import com.cloud.exception.ResourceUnavailableException;
 import com.cloud.uservm.UserVm;
 import com.cloud.vm.VirtualMachine;
+import org.apache.commons.lang3.ObjectUtils;
 
 @APICommand(name = "createVMFromBackup",
         description = "Creates and automatically starts a VM from a backup.",
@@ -70,6 +71,10 @@ public class CreateVMFromBackupCmd extends BaseDeployVMCmd {
     @Parameter(name = ApiConstants.PRESERVE_IP, type = CommandType.BOOLEAN, description = "Use the same IP/MAC addresses as stored in the backup metadata. Works only if the original Instance is deleted and the IP/MAC address is available.")
     private Boolean preserveIp;
 
+    @Parameter(name = ApiConstants.QUICK_RESTORE, type = CommandType.BOOLEAN, entityType = BackupResponse.class, description = "Whether to use the quick restore process or not. " +
+            "Currently this parameter is only supported by the KBOSS provider.", since = "4.23.0")
+    private Boolean quickRestore;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -90,6 +95,10 @@ public boolean getPreserveIp() {
         return (preserveIp != null) ? preserveIp : false;
     }
 
+    public Boolean getQuickRestore() {
+        return ObjectUtils.defaultIfNull(this.quickRestore, false);
+    }
+
     @Override
     public void create() {
         UserVm vm;
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DestroyVMCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DestroyVMCmd.java
index aec0688f1779..0a3e510d3d53 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DestroyVMCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DestroyVMCmd.java
@@ -98,6 +98,14 @@ public boolean isForced() {
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
 
+    public DestroyVMCmd() {
+    }
+
+    public DestroyVMCmd(Long id, Boolean expunge) {
+        this.id = id;
+        this.expunge = expunge;
+    }
+
     @Override
     public String getCommandName() {
         return s_name;
@@ -136,7 +144,7 @@ public Long getApiResourceId() {
     @Override
     public void execute() throws ResourceUnavailableException, ConcurrentOperationException {
         CallContext.current().setEventDetails("Instance ID: " + getResourceUuid(ApiConstants.ID));
-        UserVm result = _userVmService.destroyVm(this);
+        UserVm result = _userVmService.destroyVm(this, true);
 
         UserVmResponse response = new UserVmResponse();
         if (result != null) {
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/DeleteVolumeCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/DeleteVolumeCmd.java
index e102d51f0378..ab6cda651b06 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/DeleteVolumeCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/DeleteVolumeCmd.java
@@ -85,7 +85,7 @@ public ApiCommandResourceType getApiResourceType() {
     @Override
     public void execute() throws ConcurrentOperationException {
         CallContext.current().setEventDetails("Volume ID: " + getResourceUuid(ApiConstants.ID));
-        Volume result = _volumeService.destroyVolume(id, CallContext.current().getCallingAccount(), true, false);
+        Volume result = _volumeService.destroyVolume(id, CallContext.current().getCallingAccount(), true, false, null);
         if (result != null) {
             SuccessResponse response = new SuccessResponse(getCommandName());
             setResponseObject(response);
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/DestroyVolumeCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/DestroyVolumeCmd.java
index 12a44f76ea15..e9e388436642 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/DestroyVolumeCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/DestroyVolumeCmd.java
@@ -116,7 +116,7 @@ public Long getApiResourceId() {
     @Override
     public void execute() {
         CallContext.current().setEventDetails("Volume ID: " + getResourceUuid(ApiConstants.ID));
-        Volume result = _volumeService.destroyVolume(getId(), CallContext.current().getCallingAccount(), getExpunge(), false);
+        Volume result = _volumeService.destroyVolume(getId(), CallContext.current().getCallingAccount(), getExpunge(), false, null);
         if (result != null) {
             VolumeResponse response = _responseGenerator.createVolumeResponse(ResponseView.Restricted, result);
             response.setResponseName(getCommandName());
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/BackupOfferingResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/BackupOfferingResponse.java
index c4f3ee31dadc..69bee63e652f 100644
--- a/api/src/main/java/org/apache/cloudstack/api/response/BackupOfferingResponse.java
+++ b/api/src/main/java/org/apache/cloudstack/api/response/BackupOfferingResponse.java
@@ -17,6 +17,7 @@
 package org.apache.cloudstack.api.response;
 
 import java.util.Date;
+import java.util.Map;
 
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.BaseResponse;
@@ -79,6 +80,10 @@ public class BackupOfferingResponse extends BaseResponse {
     @Param(description = "The date this backup offering was created")
     private Date created;
 
+    @SerializedName(ApiConstants.BACKUP_OFFERING_DETAILS)
+    @Param(description = "Details for the backup offering", since = "4.23.0")
+    private Map<String, String> details;
+
     public void setId(String id) {
         this.id = id;
     }
@@ -127,4 +132,7 @@ public void setDomain(String domain) {
         this.domain = domain;
     }
 
+    public void setDetails(Map<String, String> details) {
+        this.details = details;
+    }
 }
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/BackupResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/BackupResponse.java
index 51fcaa9836e9..70db01445edd 100644
--- a/api/src/main/java/org/apache/cloudstack/api/response/BackupResponse.java
+++ b/api/src/main/java/org/apache/cloudstack/api/response/BackupResponse.java
@@ -71,10 +71,22 @@ public class BackupResponse extends BaseResponse {
     @Param(description = "Backup protected (virtual) size in bytes")
     private Long protectedSize;
 
+    @SerializedName(ApiConstants.UNCOMPRESSED_SIZE)
+    @Param(description = "Backup uncompressed size in bytes. Only defined if backup is compressed.")
+    private Long uncompressedSize;
+
     @SerializedName(ApiConstants.STATUS)
     @Param(description = "Backup status")
     private Backup.Status status;
 
+    @SerializedName(ApiConstants.COMPRESSION_STATUS)
+    @Param(description = "Backup compression status.")
+    private Backup.CompressionStatus compressionStatus;
+
+    @SerializedName(ApiConstants.VALIDATION_STATUS)
+    @Param(description = "Backup validation status.")
+    private Backup.ValidationStatus validationStatus;
+
     @SerializedName(ApiConstants.VOLUMES)
     @Param(description = "Backed up volumes")
     private String volumes;
@@ -219,6 +231,14 @@ public void setProtectedSize(Long protectedSize) {
         this.protectedSize = protectedSize;
     }
 
+    public Long getUncompressedSize() {
+        return uncompressedSize;
+    }
+
+    public void setUncompressedSize(Long uncompressedSize) {
+        this.uncompressedSize = uncompressedSize;
+    }
+
     public Backup.Status getStatus() {
         return status;
     }
@@ -227,6 +247,22 @@ public void setStatus(Backup.Status status) {
         this.status = status;
     }
 
+    public Backup.CompressionStatus getCompressionStatus() {
+        return compressionStatus;
+    }
+
+    public void setCompressionStatus(Backup.CompressionStatus compressionStatus) {
+        this.compressionStatus = compressionStatus;
+    }
+
+    public Backup.ValidationStatus getValidationStatus() {
+        return validationStatus;
+    }
+
+    public void setValidationStatus(Backup.ValidationStatus validationStatus) {
+        this.validationStatus = validationStatus;
+    }
+
     public String getVolumes() {
         return volumes;
     }
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/BackupScheduleResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/BackupScheduleResponse.java
index 13d0c5d8c562..5da07864603a 100644
--- a/api/src/main/java/org/apache/cloudstack/api/response/BackupScheduleResponse.java
+++ b/api/src/main/java/org/apache/cloudstack/api/response/BackupScheduleResponse.java
@@ -56,6 +56,10 @@ public class BackupScheduleResponse extends BaseResponse {
     @Param(description = "maximum number of backups retained")
     private Integer maxBackups;
 
+    @SerializedName(ApiConstants.ISOLATED)
+    @Param(description = ApiConstants.PARAMETER_DESCRIPTION_ISOLATED_BACKUPS)
+    private boolean isolated;
+
     public void setId(String id) {
         this.id = id;
     }
@@ -111,4 +115,8 @@ public void setMaxBackups(Integer maxBackups) {
     public void setQuiesceVM(Boolean quiesceVM) {
         this.quiesceVM = quiesceVM;
     }
+
+    public void setIsolated(boolean isolated) {
+        this.isolated = isolated;
+    }
 }
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/BackupServiceJobResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/BackupServiceJobResponse.java
new file mode 100644
index 000000000000..0d4984fe34f5
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/response/BackupServiceJobResponse.java
@@ -0,0 +1,79 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.api.response;
+
+import com.cloud.serializer.Param;
+import com.google.gson.annotations.SerializedName;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseResponse;
+
+import java.util.Date;
+
+public class BackupServiceJobResponse extends BaseResponse {
+
+    @SerializedName(ApiConstants.ID)
+    @Param(description = "Compression job ID.")
+    private Long id;
+
+    @SerializedName(ApiConstants.BACKUP_ID)
+    @Param(description = "Backup ID.")
+    private String backupId;
+
+    @SerializedName(ApiConstants.HOST_ID)
+    @Param(description = "Host where the job is being executed.")
+    private String hostId;
+
+    @SerializedName(ApiConstants.ZONE_ID)
+    @Param(description = "Zone where the job is being executed.")
+    private String zoneId;
+
+    @SerializedName(ApiConstants.ATTEMPTS)
+    @Param(description = "Number of attempts already made to complete this job.")
+    private Integer attempts;
+
+    @SerializedName(ApiConstants.TYPE)
+    @Param(description = "Compression job type.")
+    private String type;
+
+    @SerializedName(ApiConstants.START_DATE)
+    @Param(description = "Compression job start date.")
+    private Date startDate;
+
+    @SerializedName(ApiConstants.SCHEDULED_DATE)
+    @Param(description = "Compression job scheduled start date.")
+    private Date scheduledDate;
+
+    @SerializedName(ApiConstants.REMOVED)
+    @Param(description = "Compression job scheduled removed date.")
+    private Date removed;
+
+    public BackupServiceJobResponse(Long id, String backupId, String zoneId, Integer attempts, String type, Date startDate, Date scheduledDate, Date removed) {
+        super("backupservicejob");
+        this.id = id;
+        this.backupId = backupId;
+        this.zoneId = zoneId;
+        this.attempts = attempts;
+        this.type = type;
+        this.startDate = startDate;
+        this.scheduledDate = scheduledDate;
+        this.removed = removed;
+    }
+
+    public void setHostId(String hostId) {
+        this.hostId = hostId;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/FirewallResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/FirewallResponse.java
index 5986c16dc8c0..f6cc9e5d9499 100644
--- a/api/src/main/java/org/apache/cloudstack/api/response/FirewallResponse.java
+++ b/api/src/main/java/org/apache/cloudstack/api/response/FirewallResponse.java
@@ -51,6 +51,10 @@ public class FirewallResponse extends BaseResponse {
     @Param(description = "The Network ID of the firewall rule")
     private String networkId;
 
+    @SerializedName(ApiConstants.VPC_ID)
+    @Param(description = "The VPC ID of the firewall rule")
+    private String vpcId;
+
     @SerializedName(ApiConstants.IP_ADDRESS)
     @Param(description = "The public IP address for the firewall rule")
     private String publicIpAddress;
@@ -115,6 +119,10 @@ public void setNetworkId(String networkId) {
         this.networkId = networkId;
     }
 
+    public void setVpcId(String vpcId) {
+        this.vpcId = vpcId;
+    }
+
     public void setState(String state) {
         this.state = state;
     }
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/UserVmResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/UserVmResponse.java
index 4d6eae2fad23..e08c6019f150 100644
--- a/api/src/main/java/org/apache/cloudstack/api/response/UserVmResponse.java
+++ b/api/src/main/java/org/apache/cloudstack/api/response/UserVmResponse.java
@@ -234,6 +234,10 @@ public class UserVmResponse extends BaseResponseWithTagInformation implements Co
     @Param(description = "The name of the backup offering of the Instance", since = "4.14")
     private String backupOfferingName;
 
+    @SerializedName(ApiConstants.BACKUP_PROVIDER)
+    @Param(description = "The name of the backup provider of the offering attached to the Instance", since = "4.23.0")
+    private String backupProvider;
+
     @SerializedName("forvirtualnetwork")
     @Param(description = "The virtual Network for the service offering")
     private Boolean forVirtualNetwork;
@@ -1362,4 +1366,11 @@ public void setLeaseExpiryDate(Date leaseExpiryDate) {
         this.leaseExpiryDate = leaseExpiryDate;
     }
 
+    public String getBackupProvider() {
+        return backupProvider;
+    }
+
+    public void setBackupProvider(String backupProvider) {
+        this.backupProvider = backupProvider;
+    }
 }
diff --git a/api/src/main/java/org/apache/cloudstack/auth/UserOAuth2Authenticator.java b/api/src/main/java/org/apache/cloudstack/auth/UserOAuth2Authenticator.java
index ee3b98b8a4b6..cccc1fff9823 100644
--- a/api/src/main/java/org/apache/cloudstack/auth/UserOAuth2Authenticator.java
+++ b/api/src/main/java/org/apache/cloudstack/auth/UserOAuth2Authenticator.java
@@ -42,8 +42,19 @@ public interface UserOAuth2Authenticator extends Adapter {
      * Verifies the code provided by provider and fetches email
      * @return returns email
      */
-    String verifyCodeAndFetchEmail(String secretCode);
+    String verifySecretCodeAndFetchEmail(String secretCode);
 
+    /**
+     * Verifies if the logged in user is valid for a specific domain
+     * @return true if it's a valid user, otherwise false
+     */
+    boolean verifyUser(String email, String secretCode, Long domainId);
+
+    /**
+     * Verifies the secret code provided by provider and fetches email for a specific domain
+     * @return email for the specified domain
+     */
+    String verifySecretCodeAndFetchEmail(String secretCode, Long domainId);
 
     /**
      * Fetches email using the accessToken
diff --git a/api/src/main/java/org/apache/cloudstack/backup/Backup.java b/api/src/main/java/org/apache/cloudstack/backup/Backup.java
index 2d68f18b953f..2124423da108 100644
--- a/api/src/main/java/org/apache/cloudstack/backup/Backup.java
+++ b/api/src/main/java/org/apache/cloudstack/backup/Backup.java
@@ -17,6 +17,7 @@
 
 package org.apache.cloudstack.backup;
 
+import java.io.Serializable;
 import java.util.Date;
 import java.util.List;
 import java.util.Map;
@@ -39,7 +40,27 @@ public interface Backup extends ControlledEntity, InternalIdentity, Identity {
     Long getHostId();
 
     enum Status {
-        Allocated, Queued, BackingUp, ReadyForImageTransfer, FinalizingImageTransfer, BackedUp, Error, Failed, Restoring, Removed, Expunged
+        Allocated, Queued, BackingUp, ReadyForImageTransfer, FinalizingImageTransfer, BackedUp, Error, Failed, Restoring, Removed, Expunged,
+        // Hidden: a chain backup kept as a tombstone after the user deleted it while it still has
+        // live descendants (incremental chains). Excluded from listBackups and from all backup
+        // operations (which require BackedUp); swept from the DB once its last descendant is gone.
+        Hidden
+    }
+
+    enum CompressionStatus {
+        Uncompressed, Compressing, FinalizingCompression, Compressed, CompressionError
+    }
+
+    enum ValidationStatus {
+        NotValidated, Validating, Valid, UnableToValidate, NotValid
+    }
+
+    enum ValidationSteps {
+        wait_for_boot, screenshot, execute_command
+    }
+
+    enum CompressionLibrary {
+        zstd, zlib
     }
 
     class Metric {
@@ -128,7 +149,7 @@ public void setDataSize(Long dataSize) {
         }
     }
 
-    class VolumeInfo {
+    class VolumeInfo implements Serializable {
         private String uuid;
         private Volume.Type type;
         private Long size;
@@ -197,11 +218,14 @@ public String toString() {
     String getType();
     Date getDate();
     Backup.Status getStatus();
+    Backup.CompressionStatus getCompressionStatus();
+    Backup.ValidationStatus getValidationStatus();
     Long getSize();
     Long getProtectedSize();
     void setName(String name);
     String getDescription();
     void setDescription(String description);
+    Long getUncompressedSize();
     List<VolumeInfo> getBackedUpVolumes();
     long getZoneId();
     Map<String, String> getDetails();
diff --git a/api/src/main/java/org/apache/cloudstack/backup/BackupManager.java b/api/src/main/java/org/apache/cloudstack/backup/BackupManager.java
index 0da11bbd651a..30fc2bbec40d 100644
--- a/api/src/main/java/org/apache/cloudstack/backup/BackupManager.java
+++ b/api/src/main/java/org/apache/cloudstack/backup/BackupManager.java
@@ -20,6 +20,8 @@
 import java.util.List;
 import java.util.Map;
 
+import com.cloud.storage.Volume;
+import com.cloud.vm.VirtualMachine;
 import com.cloud.capacity.Capacity;
 import com.cloud.exception.ResourceAllocationException;
 import org.apache.cloudstack.api.command.admin.backup.CloneBackupOfferingCmd;
@@ -31,18 +33,16 @@
 import org.apache.cloudstack.api.command.user.backup.ListBackupOfferingsCmd;
 import org.apache.cloudstack.api.command.user.backup.ListBackupScheduleCmd;
 import org.apache.cloudstack.api.command.user.backup.ListBackupsCmd;
+import org.apache.cloudstack.api.command.user.backup.CreateBackupOfferingCmd;
 import org.apache.cloudstack.api.response.BackupResponse;
 import org.apache.cloudstack.framework.config.ConfigKey;
-import org.apache.cloudstack.framework.config.ValidatedConfigKey;
 import org.apache.cloudstack.framework.config.Configurable;
 
 import com.cloud.exception.ResourceUnavailableException;
 import com.cloud.network.Network;
-import com.cloud.storage.Volume;
 import com.cloud.utils.Pair;
 import com.cloud.utils.component.Manager;
 import com.cloud.utils.component.PluggableService;
-import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.VmDiskInfo;
 
 /**
@@ -55,11 +55,11 @@ public interface BackupManager extends BackupService, Configurable, PluggableSer
             "false",
             "Is backup and recovery framework enabled.", false, ConfigKey.Scope.Zone);
 
-    ConfigKey<String> BackupProviderPlugin = new ValidatedConfigKey<>("Advanced", String.class,
+    ConfigKey<String> BackupProviderPlugin = new ConfigKey<>("Advanced", String.class,
             "backup.framework.provider.plugin",
             "dummy",
-            "The backup and recovery provider plugin. Valid plugin values: dummy, veeam, networker and nas",
-            true, ConfigKey.Scope.Zone, BackupFrameworkEnabled.key(), value -> validateBackupProviderConfig((String)value));
+            "The backup and recovery provider plugin.",
+            true, ConfigKey.Scope.Zone, BackupFrameworkEnabled.key());
 
     ConfigKey<Long> BackupSyncPollingInterval = new ConfigKey<>("Advanced", Long.class,
             "backup.framework.sync.interval",
@@ -139,6 +139,12 @@ public interface BackupManager extends BackupService, Configurable, PluggableSer
      */
     BackupOffering importBackupOffering(final ImportBackupOfferingCmd cmd);
 
+    /**
+     * Create a new Backup and Recovery policy to CloudStack. Currently only supported for KBOSS.
+     * @param cmd create backup offering cmd
+     */
+    BackupOffering createBackupOffering(final CreateBackupOfferingCmd cmd);
+
     List<Long> getBackupOfferingDomains(final Long offeringId);
 
     /**
@@ -211,7 +217,7 @@ public interface BackupManager extends BackupService, Configurable, PluggableSer
     /**
      * Restore a full VM from backup
      */
-    boolean restoreBackup(final Long backupId);
+    boolean restoreBackup(final Long backupId, boolean quickRestore, Long hostId);
 
     Map<Long, Network.IpAddresses> getIpToNetworkMapFromBackup(Backup backup, boolean preserveIps, List<Long> networkIds);
 
@@ -222,12 +228,12 @@ public interface BackupManager extends BackupService, Configurable, PluggableSer
     /**
      * Restore a backup to a new Instance
      */
-    boolean restoreBackupToVM(Long backupId, Long vmId) throws ResourceUnavailableException;
+    boolean restoreBackupToVM(Long backupId, Long vmId, boolean quickrestore) throws ResourceUnavailableException;
 
     /**
      * Restore a backed up volume and attach it to a VM
      */
-    boolean restoreBackupVolumeAndAttachToVM(final String backedUpVolumeUuid, final Long backupId, final Long vmId) throws Exception;
+    boolean restoreBackupVolumeAndAttachToVM(final String backedUpVolumeUuid, final Long backupId, final Long vmId, boolean isQuickRestore, Long hostId) throws Exception;
 
     /**
      * Deletes a backup
@@ -258,14 +264,4 @@ public interface BackupManager extends BackupService, Configurable, PluggableSer
     Capacity getBackupStorageUsedStats(Long zoneId);
 
     void checkAndRemoveBackupOfferingBeforeExpunge(VirtualMachine vm);
-
-    static void validateBackupProviderConfig(String value) {
-        if (value != null && (value.contains(",") || value.trim().contains(" "))) {
-            throw new IllegalArgumentException("Multiple backup provider plugins are not supported. Please provide a single plugin value.");
-        }
-        List<String> validPlugins = List.of("dummy", "veeam", "networker", "nas");
-        if (value != null && !validPlugins.contains(value)) {
-            throw new IllegalArgumentException("Invalid backup provider plugin: " + value + ". Valid plugin values are: " + String.join(", ", validPlugins));
-        }
-    }
 }
diff --git a/api/src/main/java/org/apache/cloudstack/backup/BackupProvider.java b/api/src/main/java/org/apache/cloudstack/backup/BackupProvider.java
index 23b8092425d9..66e4501c460e 100644
--- a/api/src/main/java/org/apache/cloudstack/backup/BackupProvider.java
+++ b/api/src/main/java/org/apache/cloudstack/backup/BackupProvider.java
@@ -63,6 +63,7 @@ public interface BackupProvider {
      */
     boolean removeVMFromBackupOffering(VirtualMachine vm);
 
+
     /**
      * Whether the provider will delete backups on removal of VM from the offering
      * @return boolean result
@@ -73,11 +74,14 @@ public interface BackupProvider {
      * Starts and creates an adhoc backup process
      * for a previously registered VM backup
      *
-     * @param vm        the machine to make a backup of
-     * @param quiesceVM instance will be quiesced for checkpointing for backup. Applicable only to NAS plugin.
+     * @param vm
+     *         the machine to make a backup of
+     * @param quiesceVM
+     *         instance will be quiesced for checkpointing for backup. Applicable only to NAS plugin.
+     * @param isolated
      * @return the result and {code}Backup{code} {code}Object{code}
      */
-    Pair<Boolean, Backup> takeBackup(VirtualMachine vm, Boolean quiesceVM);
+    Pair<Boolean, Backup> takeBackup(VirtualMachine vm, Boolean quiesceVM, boolean isolated);
 
     /**
      * Delete an existing backup
@@ -87,17 +91,30 @@ public interface BackupProvider {
      */
     boolean deleteBackup(Backup backup, boolean forced);
 
-    Pair<Boolean, String> restoreBackupToVM(VirtualMachine vm, Backup backup, String hostIp, String dataStoreUuid);
+    /**
+     * Whether {@link #deleteBackup(Backup, boolean)} owns DB-row removal and resource-count /
+     * usage accounting for every backup it physically removes. Providers that manage incremental
+     * chains (e.g. NAS) delete several backups per call — the leaf plus swept delete-pending
+     * ancestors — and decrement once per removed backup themselves, so the manager must NOT
+     * decrement or remove the row again. Defaults to {@code false}: the manager does the
+     * single-backup accounting (the historical behaviour for non-chain providers).
+     */
+    default boolean handlesChainDeleteResourceAccounting() {
+        return false;
+    }
+
+    Pair<Boolean, String> restoreBackupToVM(VirtualMachine vm, Backup backup, String hostIp, String dataStoreUuid, boolean quickrestore);
 
     /**
      * Restore VM from backup
      */
-    boolean restoreVMFromBackup(VirtualMachine vm, Backup backup);
+    boolean restoreVMFromBackup(VirtualMachine vm, Backup backup, boolean quickRestore, Long hostId);
 
     /**
      * Restore a volume from a backup
      */
-    Pair<Boolean, String> restoreBackedUpVolume(Backup backup, Backup.VolumeInfo backupVolumeInfo, String hostIp, String dataStoreUuid, Pair<String, VirtualMachine.State> vmNameAndState);
+    Pair<Boolean, String> restoreBackedUpVolume(Backup backup, Backup.VolumeInfo backupVolumeInfo, String hostIp, String dataStoreUuid,
+            Pair<String, VirtualMachine.State> vmNameAndState, VirtualMachine vm, boolean quickRestore);
 
     /**
      * Syncs backup metrics (backup size, protected size) from the plugin and stores it within the provider
@@ -140,5 +157,4 @@ default boolean supportsMemoryVmSnapshot() {
      * @param zoneId the zone for which to return metrics
      */
     void syncBackupStorageStats(Long zoneId);
-
 }
diff --git a/api/src/main/java/org/apache/cloudstack/backup/BackupSchedule.java b/api/src/main/java/org/apache/cloudstack/backup/BackupSchedule.java
index 44fdf70c4c15..ddc823a14ff5 100644
--- a/api/src/main/java/org/apache/cloudstack/backup/BackupSchedule.java
+++ b/api/src/main/java/org/apache/cloudstack/backup/BackupSchedule.java
@@ -34,4 +34,5 @@ public interface BackupSchedule extends ControlledEntity, InternalIdentity {
     Boolean getQuiesceVM();
     int getMaxBackups();
     String getUuid();
+    boolean isIsolated();
 }
diff --git a/api/src/main/java/org/apache/cloudstack/backup/InternalBackupProvider.java b/api/src/main/java/org/apache/cloudstack/backup/InternalBackupProvider.java
new file mode 100644
index 000000000000..0543fb10af36
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/backup/InternalBackupProvider.java
@@ -0,0 +1,142 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.storage.Volume;
+import com.cloud.uservm.UserVm;
+import com.cloud.utils.Pair;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.snapshot.VMSnapshot;
+import org.apache.cloudstack.framework.config.ConfigKey;
+
+import java.util.Set;
+
+public interface InternalBackupProvider extends BackupProvider {
+    String VM_WORK_JOB_HANDLER = InternalBackupService.class.getSimpleName();
+
+    ConfigKey<Integer> backupCompressionTimeout = new ConfigKey<>("Advanced", Integer.class, "backup.compression.timeout", "28800", "Backup compression timeout (in " +
+            "seconds). Will only start counting once the backup compression async job actually starts. This setting is currently only applicable to KBOSS.", true,
+            ConfigKey.Scope.Cluster);
+
+    ConfigKey<Double> backupCompressionMinimumFreeStorage = new ConfigKey<>("Advanced", Double.class, "backup.compression.minimum.free.storage", "1", "The minimum " +
+            "amount of free storage that should be available to start the compression. This configuration uses a multiplier on the backup size, by default, it needs the same " +
+            "amount of free storage as the backup uses while uncompressed. This setting is currently only applicable to KBOSS.", true, ConfigKey.Scope.Zone);
+
+    ConfigKey<Integer> backupCompressionCoroutines = new ConfigKey<>("Advanced", Integer.class, "backup.compression.coroutines", "1", "Number of parallel coroutines " +
+            "for the compression process. This is translated to qemu-img '-m' parameter. This setting is currently only applicable to KBOSS.", true, ConfigKey.Scope.Cluster);
+
+    ConfigKey<Integer> backupCompressionRateLimit = new ConfigKey<>("Advanced", Integer.class, "backup.compression.rate.limit", "0", "Limit the compression rate to " +
+            "this configuration's value (in MB/s). Values lower than 1 disable the limit. This setting is currently only applicable to KBOSS.", true, ConfigKey.Scope.Cluster);
+
+    ConfigKey<Integer> backupValidationTimeout = new ConfigKey<>("Advanced", Integer.class, "backup.validation.timeout", "3600", "Backup validation job timeout (in " +
+            "seconds). Will only start counting once the backup validation async job actually starts. This setting is currently only applicable to KBOSS.", true, ConfigKey.Scope.Cluster);
+
+    /**
+     * Actually execute the backup after being queued.
+     * */
+    default Pair<Boolean, Long> orchestrateTakeBackup(Backup backup, boolean quiesceVm, boolean isolated) {
+        return null;
+    }
+
+    /**
+     * Actually delete the backup after being queued.
+     * */
+    default Boolean orchestrateDeleteBackup(Backup backup, boolean forced) {
+        return null;
+    }
+
+    /**
+     * Actually restore the backup after being queued.
+     * */
+    default Boolean orchestrateRestoreVMFromBackup(Backup backup, VirtualMachine vm, boolean quickRestore, Long hostId, boolean sameVmAsBackup) {
+        return null;
+    }
+
+    /**
+     * This method should be overwritten by any backup providers that want to schedule their backup restore jobs in the same queue as the VM jobs.
+     * Otherwise, just use the restoreBackedUpVolume method.
+     * */
+    default Pair<Boolean, String> orchestrateRestoreBackedUpVolume(Backup backup, VirtualMachine vm, Backup.VolumeInfo backupVolumeInfo, String hostIp, boolean quickRestore) {
+        return null;
+    }
+
+    /**
+     * This method should be overwritten by any native backup providers that want to allow backup compression through ACS.<br/>
+     * The compression is done in two steps:<br/>
+     * 1) Compress the backup to a different file;<br/>
+     * 2) Switch the old file for the newly compressed one.<br/>
+     * <br/> <br/>
+     * This method is supposed to execute step 1.
+     *
+     * @return
+     */
+    default boolean startBackupCompression(long backupId, long hostId) {
+        return false;
+    }
+
+    /**
+     * This method should be overwritten by any native backup providers that want to allow backup compression through ACS.<br/>
+     * The compression is done in two steps:<br/>
+     * 1) Compress the backup to a different file;<br/>
+     * 2) Switch the old file for the newly compressed one.<br/>
+     * <br/> <br/>
+     * This method is supposed to execute step 2.
+     *
+     * @return
+     */
+    default boolean finalizeBackupCompression(long backupId, long hostId) {
+        return false;
+    }
+
+    default boolean validateBackup(long backupId, long hostId) {
+        return false;
+    }
+
+    /**
+     * This method should be overwritten by any native backup providers that allow volume detach but need to prepare it beforehand.
+     * */
+    default void prepareVolumeForDetach(Volume volume, VirtualMachine virtualMachine) {
+    }
+
+    /**
+     * This method should be overwritten by any native backup providers that allow volume migration but need to prepare it beforehand.
+     * */
+    default void prepareVolumeForMigration(Volume volume, VirtualMachine virtualMachine) {
+    }
+
+    /**
+     * This method should be overwritten by any native backup providers that must update metadata regarding a volume after certain operations (such as after a volume migration).
+     * */
+    default void updateVolumeId(VirtualMachine virtualMachine, long oldVolumeId, long newVolumeId) {
+    }
+
+    default Set<String> getSecondaryStorageUrls(UserVm userVm) {
+        return Set.of();
+    }
+
+    /**
+     * This method should be overwritten by any native backup providers that are compatible with VM Snapshots but need to prepare the VM to be reverted.
+     * Currently, the only strategy that calls this method is the {@code KvmFileBasedStorageVmSnapshotStrategy}.
+     * */
+    default void prepareVmForSnapshotRevert(VMSnapshot vmSnapshot, VirtualMachine virtualMachine) {
+    }
+
+    default boolean finishBackupChain(VirtualMachine virtualMachine) {
+        return false;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/backup/InternalBackupService.java b/api/src/main/java/org/apache/cloudstack/backup/InternalBackupService.java
new file mode 100644
index 000000000000..76c71f0eb4ce
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/backup/InternalBackupService.java
@@ -0,0 +1,54 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+import com.cloud.agent.api.to.DataTO;
+import com.cloud.storage.Volume;
+import com.cloud.uservm.UserVm;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.snapshot.VMSnapshot;
+import org.apache.cloudstack.api.response.ExtractResponse;
+
+import java.util.Set;
+
+public interface InternalBackupService {
+
+    void configureChainInfo(DataTO volumeTo, Command cmd);
+
+    void cleanupBackupMetadata(long volumeId);
+
+    void prepareVolumeForDetach(Volume volume, VirtualMachine virtualMachine);
+
+    void prepareVolumeForMigration(Volume volume);
+
+    void prepareVmForSnapshotRevert(VMSnapshot vmSnapshot);
+
+    void updateVolumeId(long oldVolumeId, long newVolumeId);
+
+    Set<String> getSecondaryStorageUrls(UserVm userVm);
+
+    boolean startBackupCompression(long backupId, long hostId, long zoneId);
+
+    boolean finalizeBackupCompression(long backupId, long hostId, long zoneId);
+
+    boolean validateBackup(long backupId, long hostId, long zoneId);
+
+    ExtractResponse downloadScreenshot(long backupId);
+
+    boolean finishBackupChain(long vmId);
+}
diff --git a/api/src/main/java/org/apache/cloudstack/extension/CustomActionResultResponse.java b/api/src/main/java/org/apache/cloudstack/extension/CustomActionResultResponse.java
index 33ff70fcace5..558340694b8a 100644
--- a/api/src/main/java/org/apache/cloudstack/extension/CustomActionResultResponse.java
+++ b/api/src/main/java/org/apache/cloudstack/extension/CustomActionResultResponse.java
@@ -62,4 +62,12 @@ public Boolean getSuccess() {
     public void setResult(Map<String, String> result) {
         this.result = result;
     }
+
+    public Map<String, String> getResult() {
+        return result;
+    }
+
+    public boolean isSuccess() {
+        return Boolean.TRUE.equals(success);
+    }
 }
diff --git a/api/src/main/java/org/apache/cloudstack/extension/Extension.java b/api/src/main/java/org/apache/cloudstack/extension/Extension.java
index 3068612ed6fe..c1d905718b24 100644
--- a/api/src/main/java/org/apache/cloudstack/extension/Extension.java
+++ b/api/src/main/java/org/apache/cloudstack/extension/Extension.java
@@ -24,7 +24,8 @@
 
 public interface Extension extends InternalIdentity, Identity {
     enum Type {
-        Orchestrator
+        Orchestrator,
+        NetworkOrchestrator
     }
     enum State {
         Enabled, Disabled;
diff --git a/api/src/main/java/org/apache/cloudstack/extension/ExtensionCustomAction.java b/api/src/main/java/org/apache/cloudstack/extension/ExtensionCustomAction.java
index 776b42f671b7..245faa762a2f 100644
--- a/api/src/main/java/org/apache/cloudstack/extension/ExtensionCustomAction.java
+++ b/api/src/main/java/org/apache/cloudstack/extension/ExtensionCustomAction.java
@@ -48,7 +48,9 @@
 
 public interface ExtensionCustomAction extends InternalIdentity, Identity {
     enum ResourceType {
-        VirtualMachine(com.cloud.vm.VirtualMachine.class);
+        VirtualMachine(com.cloud.vm.VirtualMachine.class),
+        Network(com.cloud.network.Network.class),
+        Vpc(com.cloud.network.vpc.Vpc.class);
 
         private final Class<?> clazz;
 
diff --git a/api/src/main/java/org/apache/cloudstack/extension/ExtensionHelper.java b/api/src/main/java/org/apache/cloudstack/extension/ExtensionHelper.java
index a01131278a76..e3d84745f997 100644
--- a/api/src/main/java/org/apache/cloudstack/extension/ExtensionHelper.java
+++ b/api/src/main/java/org/apache/cloudstack/extension/ExtensionHelper.java
@@ -18,10 +18,125 @@
 package org.apache.cloudstack.extension;
 
 import java.util.List;
+import java.util.Map;
+
+import com.cloud.network.Network.Capability;
+import com.cloud.network.Network.Service;
 
 public interface ExtensionHelper {
     Long getExtensionIdForCluster(long clusterId);
     Extension getExtension(long id);
+    Extension getExtensionByNameAndType(String name, Extension.Type type);
     Extension getExtensionForCluster(long clusterId);
     List<String> getExtensionReservedResourceDetails(long extensionId);
+
+    /**
+     * Network Guru of Network Extension
+     */
+    String NETWORK_EXTENSION_GURU_NAME = "NetworkExtensionGuestNetworkGuru";
+
+    /**
+     * Extension resource-map detail key holding the isolation method for the physical
+     * network (e.g. {@code "NetworkExtension"}).
+     * If not specified, the isolation method of physical network will be used.
+     */
+    String NETWORK_ISOLATION_METHOD_DETAIL_KEY = "network.isolation.method";
+
+    /**
+     * Value of {@link #NETWORK_ISOLATION_METHOD_DETAIL_KEY} that indicates
+     * the extension owns the network isolation.
+     */
+    String NETWORK_EXTENSION_ISOLATION_METHOD = "NetworkExtension";
+
+    /**
+     * Detail key used to store the comma-separated list of network services provided
+     * by a NetworkOrchestrator extension (e.g. {@code "SourceNat,StaticNat,Firewall"}).
+     */
+    String NETWORK_SERVICES_DETAIL_KEY = "network.services";
+
+    /**
+     * Detail key used to store a JSON object mapping each service name to its
+     * CloudStack {@link com.cloud.network.Network.Capability} key/value pairs.
+     * Example: {@code {"SourceNat":{"SupportedSourceNatTypes":"peraccount"}}}.
+     * Used together with {@link #NETWORK_SERVICES_DETAIL_KEY}.
+     */
+    String NETWORK_SERVICE_CAPABILITIES_DETAIL_KEY = "network.service.capabilities";
+
+    String getExtensionScriptPath(Extension extension);
+
+    /**
+     * Finds the extension registered with the given physical network whose name
+     * matches the given provider name (case-insensitive).  Returns {@code null}
+     * if no matching extension is found.
+     *
+     * <p>This is the preferred lookup when multiple extensions are registered on
+     * the same physical network: the provider name stored in
+     * {@code ntwk_service_map} is used to pinpoint the exact extension that
+     * handles a given network.</p>
+     *
+     * @param physicalNetworkId the physical network ID
+     * @param providerName      the provider name (must equal the extension name)
+     * @return the matching {@link Extension}, or {@code null}
+     */
+    Extension getExtensionForPhysicalNetworkAndProvider(long physicalNetworkId, String providerName);
+
+    /**
+     * Returns ALL {@code extension_resource_map_details} (including hidden) for
+     * the specific extension registered on the given physical network.  Used by
+     * {@code NetworkExtensionElement} to inject device credentials into the script
+     * environment for the correct extension when multiple different extensions are
+     * registered on the same physical network.
+     *
+     * @param physicalNetworkId the physical network ID
+     * @param extensionId       the extension ID
+     * @return all key/value details including non-display ones, or an empty map
+     */
+    Map<String, String> getAllResourceMapDetailsForExtensionOnPhysicalNetwork(long physicalNetworkId, long extensionId);
+
+    /**
+     * Returns {@code true} if the given provider name is backed by a
+     * {@code NetworkOrchestrator} extension registered on any physical network.
+     * This is used by {@code NetworkModelImpl} to detect extension-backed providers
+     * that are not in the static {@code s_providerToNetworkElementMap}.
+     *
+     * @param providerName the provider / extension name
+     * @return true if the provider is a NetworkExtension provider
+     */
+    boolean isNetworkExtensionProvider(String providerName);
+
+    /**
+     * List all registered extensions filtered by extension {@link Extension.Type}.
+     * Useful for callers that need to discover available providers of a given
+     * type (e.g. Orchestrator, NetworkOrchestrator).
+     *
+     * @param type extension type to filter by
+     * @return list of matching {@link Extension} instances (empty list if none)
+     */
+    List<Extension> listExtensionsByType(Extension.Type type);
+
+    /**
+     * Returns {@code true} when the extension registered for {@code providerName} on
+     * the given physical network has its {@link #NETWORK_ISOLATION_METHOD_DETAIL_KEY}
+     * resource-map detail set to {@link #NETWORK_EXTENSION_ISOLATION_METHOD}.
+     *
+     * @param providerName      provider / extension name
+     * @return true if the extension uses NetworkExtension isolation
+     */
+    boolean usesNetworkExtensionIsolation(String providerName);
+
+    /**
+     * Returns the effective {@link Service} → ({@link Capability} → value) capabilities
+     * for the given external network provider, looking it up by name on the given
+     * physical network.
+     *
+     * <p>If {@code physicalNetworkId} is {@code null}, the method searches across all
+     * physical networks that have extensions registered and returns the capabilities for
+     * the first matching extension.</p>
+     *
+     * @param physicalNetworkId physical network ID, or {@code null} for offering-level queries
+     * @param providerName      provider / extension name
+     * @return capabilities map, or the default capabilities if no matching extension is found
+     */
+    Map<Service, Map<Capability, String>> getNetworkCapabilitiesForProvider(Long physicalNetworkId, String providerName);
+
 }
diff --git a/api/src/main/java/org/apache/cloudstack/extension/ExtensionResourceMap.java b/api/src/main/java/org/apache/cloudstack/extension/ExtensionResourceMap.java
index 40ebc19eb5e3..604e64a1f894 100644
--- a/api/src/main/java/org/apache/cloudstack/extension/ExtensionResourceMap.java
+++ b/api/src/main/java/org/apache/cloudstack/extension/ExtensionResourceMap.java
@@ -24,7 +24,8 @@
 
 public interface ExtensionResourceMap extends InternalIdentity, Identity {
     enum ResourceType {
-        Cluster
+        Cluster,
+        PhysicalNetwork
     }
 
     long getExtensionId();
diff --git a/api/src/main/java/org/apache/cloudstack/extension/NetworkCustomActionProvider.java b/api/src/main/java/org/apache/cloudstack/extension/NetworkCustomActionProvider.java
new file mode 100644
index 000000000000..1c281c15f286
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/extension/NetworkCustomActionProvider.java
@@ -0,0 +1,74 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.extension;
+
+import java.util.Map;
+
+import com.cloud.network.Network;
+import com.cloud.network.vpc.Vpc;
+
+/**
+ * Implemented by network elements that support running custom actions on a
+ * managed network or VPC (e.g. NetworkExtensionElement).
+ *
+ * <p>This interface is looked up by {@code ExtensionsManagerImpl} to dispatch
+ * {@code runCustomAction} requests whose resource type is {@code Network}
+ * or {@code Vpc}.</p>
+ */
+public interface NetworkCustomActionProvider {
+
+    /**
+     * Returns {@code true} if this provider handles networks whose physical
+     * network has an ExternalNetwork service provider registered.
+     *
+     * @param network the target network
+     * @return {@code true} if this provider can handle the network
+     */
+    boolean canHandleCustomAction(Network network);
+
+    /**
+     * Returns {@code true} if this provider can handle custom actions for
+     * the given VPC.
+     *
+     * @param vpc the target VPC
+     * @return {@code true} if this provider can handle the VPC
+     */
+    boolean canHandleVpcCustomAction(Vpc vpc);
+
+    /**
+     * Runs a named custom action against the external network device that
+     * manages the given network.
+     *
+     * @param network    the CloudStack network on which to run the action
+     * @param actionName the action name (e.g. {@code "reboot-device"}, {@code "dump-config"})
+     * @param parameters optional parameters supplied by the caller
+     * @return output from the action script, or {@code null} on failure
+     */
+    String runCustomAction(Network network, String actionName, Map<String, Object> parameters);
+
+    /**
+     * Runs a named custom action against the external network device that
+     * manages the given VPC.
+     *
+     * @param vpc        the CloudStack VPC on which to run the action
+     * @param actionName the action name
+     * @param parameters optional parameters supplied by the caller
+     * @return output from the action script, or {@code null} on failure
+     */
+    String runCustomAction(Vpc vpc, String actionName, Map<String, Object> parameters);
+}
diff --git a/api/src/main/java/org/apache/cloudstack/query/QueryService.java b/api/src/main/java/org/apache/cloudstack/query/QueryService.java
index 5b053aafd84b..b6362e9a9c9b 100644
--- a/api/src/main/java/org/apache/cloudstack/query/QueryService.java
+++ b/api/src/main/java/org/apache/cloudstack/query/QueryService.java
@@ -41,6 +41,7 @@
 import org.apache.cloudstack.api.command.user.account.ListProjectAccountsCmd;
 import org.apache.cloudstack.api.command.user.address.ListQuarantinedIpsCmd;
 import org.apache.cloudstack.api.command.user.affinitygroup.ListAffinityGroupsCmd;
+import org.apache.cloudstack.api.command.user.backup.ListBackupServiceJobsCmd;
 import org.apache.cloudstack.api.command.user.bucket.ListBucketsCmd;
 import org.apache.cloudstack.api.command.user.event.ListEventsCmd;
 import org.apache.cloudstack.api.command.user.iso.ListIsosCmd;
@@ -63,6 +64,7 @@
 import org.apache.cloudstack.api.command.user.zone.ListZonesCmd;
 import org.apache.cloudstack.api.response.AccountResponse;
 import org.apache.cloudstack.api.response.AsyncJobResponse;
+import org.apache.cloudstack.api.response.BackupServiceJobResponse;
 import org.apache.cloudstack.api.response.BucketResponse;
 import org.apache.cloudstack.api.response.DetailOptionsResponse;
 import org.apache.cloudstack.api.response.DiskOfferingResponse;
@@ -119,7 +121,7 @@ public interface QueryService {
             "Determines whether users can view certain VM settings. When set to empty, default value used is: rootdisksize, cpuOvercommitRatio, memoryOvercommitRatio, Message.ReservedCapacityFreed.Flag.", true, ConfigKey.Scope.Global, null, null, null, null, null, ConfigKey.Kind.CSV, null);
 
     ConfigKey<String> UserVMReadOnlyDetails = new ConfigKey<>(String.class,
-    "user.vm.readonly.details", "Advanced", "dataDiskController, rootDiskController",
+    "user.vm.readonly.details", "Advanced", "dataDiskController, rootDiskController, backupValidationCommandTimeout, backupValidationScreenshotWait, backupValidationBootTimeout",
             "List of read-only VM settings/details as comma separated string", true, ConfigKey.Scope.Global, null, null, null, null, null, ConfigKey.Kind.CSV, null, "");
 
     ConfigKey<Boolean> SortKeyAscending = new ConfigKey<>("Advanced", Boolean.class, "sortkey.algorithm", "true",
@@ -224,4 +226,6 @@ public interface QueryService {
     ListResponse<ObjectStoreResponse> searchForObjectStores(ListObjectStoragePoolsCmd listObjectStoragePoolsCmd);
 
     ListResponse<BucketResponse> searchForBuckets(ListBucketsCmd listBucketsCmd);
+
+    ListResponse<BackupServiceJobResponse> listBackupServiceJobs(ListBackupServiceJobsCmd cmd);
 }
diff --git a/api/src/main/java/org/apache/cloudstack/secstorage/heuristics/HeuristicType.java b/api/src/main/java/org/apache/cloudstack/secstorage/heuristics/HeuristicType.java
index f23e4b0b633b..489e9bf54f23 100644
--- a/api/src/main/java/org/apache/cloudstack/secstorage/heuristics/HeuristicType.java
+++ b/api/src/main/java/org/apache/cloudstack/secstorage/heuristics/HeuristicType.java
@@ -18,8 +18,8 @@
 
 /**
  * The type of the heuristic used in the allocation process of secondary storage resources.
- * Valid options are: {@link #ISO}, {@link #SNAPSHOT}, {@link #TEMPLATE} and {@link #VOLUME}
+ * Valid options are: {@link #ISO}, {@link #SNAPSHOT}, {@link #TEMPLATE}, {@link #VOLUME} and {@link #BACKUP}
  */
 public enum HeuristicType {
-    ISO, SNAPSHOT, TEMPLATE, VOLUME
+    ISO, SNAPSHOT, TEMPLATE, VOLUME, BACKUP
 }
diff --git a/api/src/test/java/com/cloud/network/NetworkTest.java b/api/src/test/java/com/cloud/network/NetworkTest.java
new file mode 100644
index 000000000000..dba4d1fb7eb5
--- /dev/null
+++ b/api/src/test/java/com/cloud/network/NetworkTest.java
@@ -0,0 +1,73 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.network;
+
+import org.junit.Test;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+
+public class NetworkTest {
+
+    @Test
+    public void testProviderContains() {
+        List<Network.Provider> providers = new ArrayList<>();
+        providers.add(Network.Provider.VirtualRouter);
+
+        // direct instance present
+        assertTrue("List should contain VirtualRouter provider", providers.contains(Network.Provider.VirtualRouter));
+
+        // resolved provider by name (registered provider)
+        Network.Provider resolved = Network.Provider.getProvider("VirtualRouter");
+        assertNotNull("Resolved provider should not be null", resolved);
+        assertTrue("List should contain resolved VirtualRouter provider", providers.contains(resolved));
+
+        // transient provider with same name should be considered equal (equals by name)
+        Network.Provider transientProvider = Network.Provider.createTransientProvider("NetworkExtension");
+        assertFalse("List should not contain the transient provider", providers.contains(transientProvider));
+
+        providers.add(transientProvider);
+        assertTrue("List should contain the transient provider", providers.contains(transientProvider));
+
+        // another transient provider with same name should be considered equal
+        Network.Provider transientProviderNew = Network.Provider.createTransientProvider("NetworkExtension");
+        assertTrue("List should contain the new transient provider with same name", providers.contains(transientProviderNew));
+    }
+
+    @Test
+    public void testCustomActionServiceLookup() {
+        Network.Service customAction = Network.Service.getService("CustomAction");
+        assertNotNull("CustomAction service should be available", customAction);
+        assertTrue("CustomAction should be part of the supported services list",
+                Network.Service.listAllServices().contains(customAction));
+    }
+
+    @Test
+    public void testTransientProviderIsNotGloballyRegistered() {
+        Network.Provider transientProvider = Network.Provider.createTransientProvider("TransientOnly");
+        assertNotNull(transientProvider);
+        assertNull("Transient provider should not be retrievable from the global registry",
+                Network.Provider.getProvider("TransientOnly"));
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/user/firewall/CreateFirewallRuleCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/user/firewall/CreateFirewallRuleCmdTest.java
index c905974b2be9..504d3914b70e 100644
--- a/api/src/test/java/org/apache/cloudstack/api/command/user/firewall/CreateFirewallRuleCmdTest.java
+++ b/api/src/test/java/org/apache/cloudstack/api/command/user/firewall/CreateFirewallRuleCmdTest.java
@@ -21,10 +21,15 @@
 import java.util.Collections;
 import java.util.List;
 
+import com.cloud.network.IpAddress;
+import com.cloud.network.NetworkService;
+import com.cloud.utils.db.EntityManager;
 import org.apache.commons.collections.CollectionUtils;
 import org.junit.Assert;
 import org.junit.Test;
 import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.Mockito;
 import org.mockito.junit.MockitoJUnitRunner;
 import org.springframework.test.util.ReflectionTestUtils;
 
@@ -33,6 +38,12 @@
 @RunWith(MockitoJUnitRunner.class)
 public class CreateFirewallRuleCmdTest {
 
+    @Mock
+    private EntityManager entityManager;
+
+    @Mock
+    private NetworkService networkService;
+
     private void validateAllIp4Cidr(final CreateFirewallRuleCmd cmd) {
         Assert.assertTrue(CollectionUtils.isNotEmpty(cmd.getSourceCidrList()));
         Assert.assertEquals(1, cmd.getSourceCidrList().size());
@@ -88,4 +99,22 @@ public void testGetSourceCidrList_EmptyFirstElementButMore() {
         Assert.assertEquals(2, cmd.getSourceCidrList().size());
         Assert.assertEquals(cidr, cmd.getSourceCidrList().get(1));
     }
+
+    @Test
+    public void testGetNetworkIdVpcWithoutAssociatedNetworkUsesVpcFallbackAndSyncObjId() {
+        final CreateFirewallRuleCmd cmd = new CreateFirewallRuleCmd();
+        final IpAddress ip = Mockito.mock(IpAddress.class);
+
+        cmd._entityMgr = entityManager;
+        cmd._networkService = networkService;
+        ReflectionTestUtils.setField(cmd, "ipAddressId", 42L);
+
+        Mockito.when(networkService.getIp(42L)).thenReturn(ip);
+        Mockito.when(ip.getAssociatedWithNetworkId()).thenReturn(null);
+        Mockito.when(ip.getVpcId()).thenReturn(100L);
+        Mockito.when(ip.getNetworkId()).thenReturn(2L);
+
+        Assert.assertEquals(Long.valueOf(2L), cmd.getNetworkId());
+        Assert.assertEquals(Long.valueOf(2L), cmd.getSyncObjId());
+    }
 }
diff --git a/api/src/test/java/org/apache/cloudstack/extension/CustomActionResultResponseTest.java b/api/src/test/java/org/apache/cloudstack/extension/CustomActionResultResponseTest.java
new file mode 100644
index 000000000000..9b7346f332cb
--- /dev/null
+++ b/api/src/test/java/org/apache/cloudstack/extension/CustomActionResultResponseTest.java
@@ -0,0 +1,92 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.extension;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+import java.util.Map;
+
+import org.junit.Before;
+import org.junit.Test;
+
+public class CustomActionResultResponseTest {
+
+    private CustomActionResultResponse response;
+
+    @Before
+    public void setUp() {
+        response = new CustomActionResultResponse();
+    }
+
+    @Test
+    public void getResultReturnsNullByDefault() {
+        assertNull(response.getResult());
+    }
+
+    @Test
+    public void getResultReturnsSetValue() {
+        Map<String, String> result = Map.of("message", "OK", "details", "All good");
+        response.setResult(result);
+        assertEquals(result, response.getResult());
+        assertEquals("OK", response.getResult().get("message"));
+    }
+
+    @Test
+    public void isSuccessReturnsFalseWhenSuccessIsNull() {
+        // success is null by default
+        assertFalse(response.isSuccess());
+    }
+
+    @Test
+    public void isSuccessReturnsFalseWhenSuccessIsFalse() {
+        response.setSuccess(false);
+        assertFalse(response.isSuccess());
+    }
+
+    @Test
+    public void isSuccessReturnsTrueWhenSuccessIsTrue() {
+        response.setSuccess(true);
+        assertTrue(response.isSuccess());
+    }
+
+    @Test
+    public void getSuccessReturnsNullByDefault() {
+        assertNull(response.getSuccess());
+    }
+
+    @Test
+    public void getSuccessReturnsTrueAfterSetSuccessTrue() {
+        response.setSuccess(true);
+        assertTrue(response.getSuccess());
+    }
+
+    @Test
+    public void getSuccessReturnsFalseAfterSetSuccessFalse() {
+        response.setSuccess(false);
+        assertFalse(response.getSuccess());
+    }
+
+    @Test
+    public void setAndGetResultWithNullResult() {
+        response.setResult(null);
+        assertNull(response.getResult());
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/extension/ExtensionCustomActionTest.java b/api/src/test/java/org/apache/cloudstack/extension/ExtensionCustomActionTest.java
index ae4314aa11a8..a6bd49a2d8be 100644
--- a/api/src/test/java/org/apache/cloudstack/extension/ExtensionCustomActionTest.java
+++ b/api/src/test/java/org/apache/cloudstack/extension/ExtensionCustomActionTest.java
@@ -40,6 +40,12 @@ public void testResourceType() {
         assertEquals(com.cloud.vm.VirtualMachine.class, vmType.getAssociatedClass());
     }
 
+    @Test
+    public void testNetworkResourceType() {
+        ExtensionCustomAction.ResourceType networkType = ExtensionCustomAction.ResourceType.Network;
+        assertEquals(com.cloud.network.Network.class, networkType.getAssociatedClass());
+    }
+
     @Test
     public void testParameterTypeSupportsOptions() {
         assertTrue(ExtensionCustomAction.Parameter.Type.STRING.canSupportsOptions());
diff --git a/client/pom.xml b/client/pom.xml
index 90b839112ce9..968f735af600 100644
--- a/client/pom.xml
+++ b/client/pom.xml
@@ -627,6 +627,11 @@
             <artifactId>cloud-plugin-integrations-veeam-control-service</artifactId>
             <version>${project.version}</version>
         </dependency>
+        <dependency>
+            <groupId>org.apache.cloudstack</groupId>
+            <artifactId>cloud-plugin-backup-kvm-backup-on-secondary-storage</artifactId>
+            <version>${project.version}</version>
+        </dependency>
         <dependency>
             <groupId>org.apache.cloudstack</groupId>
             <artifactId>cloud-plugin-integrations-kubernetes-service</artifactId>
diff --git a/core/src/main/java/com/cloud/agent/api/CleanupConvertedInstanceDisksCommand.java b/core/src/main/java/com/cloud/agent/api/CleanupConvertedInstanceDisksCommand.java
new file mode 100644
index 000000000000..00373ec75364
--- /dev/null
+++ b/core/src/main/java/com/cloud/agent/api/CleanupConvertedInstanceDisksCommand.java
@@ -0,0 +1,57 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package com.cloud.agent.api;
+
+import com.cloud.agent.api.to.DataStoreTO;
+
+/**
+ * This command is used to cleanup the converted instance disks from the storage pool: vmVolumesStore and the prefix: vmVolumesPrefix.
+ */
+public class CleanupConvertedInstanceDisksCommand extends Command {
+
+    private DataStoreTO vmVolumesStore;
+    private String vmVolumesPrefix;
+
+    public CleanupConvertedInstanceDisksCommand(DataStoreTO vmVolumesStore, String vmVolumesPrefix) {
+        this.vmVolumesStore = vmVolumesStore;
+        this.vmVolumesPrefix = vmVolumesPrefix;
+    }
+
+    public DataStoreTO getVmVolumesStore() {
+        return vmVolumesStore;
+    }
+
+    public void setVmVolumesStore(DataStoreTO vmVolumesStore) {
+        this.vmVolumesStore = vmVolumesStore;
+    }
+
+    public String getVmVolumesPrefix() {
+        return vmVolumesPrefix;
+    }
+
+    public void setVmVolumesPrefix(String vmVolumesPrefix) {
+        this.vmVolumesPrefix = vmVolumesPrefix;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return false;
+    }
+}
diff --git a/core/src/main/java/com/cloud/agent/api/MigrateBackupsBetweenSecondaryStoragesCommand.java b/core/src/main/java/com/cloud/agent/api/MigrateBackupsBetweenSecondaryStoragesCommand.java
new file mode 100644
index 000000000000..7794b4a53083
--- /dev/null
+++ b/core/src/main/java/com/cloud/agent/api/MigrateBackupsBetweenSecondaryStoragesCommand.java
@@ -0,0 +1,41 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package com.cloud.agent.api;
+
+import com.cloud.agent.api.to.DataStoreTO;
+import com.cloud.agent.api.to.DataTO;
+
+import java.util.List;
+
+public class MigrateBackupsBetweenSecondaryStoragesCommand extends MigrateBetweenSecondaryStoragesCommand {
+
+    List<List<DataTO>> backupChain;
+
+    public MigrateBackupsBetweenSecondaryStoragesCommand() {
+    }
+
+    public MigrateBackupsBetweenSecondaryStoragesCommand(List<List<DataTO>> backupChain, DataStoreTO srcDataStore, DataStoreTO destDataStore) {
+        super(srcDataStore, destDataStore);
+        this.backupChain = backupChain;
+    }
+
+    public List<List<DataTO>> getBackupChain() {
+        return backupChain;
+    }
+}
diff --git a/core/src/main/java/com/cloud/agent/api/MigrateBetweenSecondaryStoragesCommand.java b/core/src/main/java/com/cloud/agent/api/MigrateBetweenSecondaryStoragesCommand.java
new file mode 100644
index 000000000000..48dc7e2c85f4
--- /dev/null
+++ b/core/src/main/java/com/cloud/agent/api/MigrateBetweenSecondaryStoragesCommand.java
@@ -0,0 +1,48 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package com.cloud.agent.api;
+
+import com.cloud.agent.api.to.DataStoreTO;
+
+public abstract class MigrateBetweenSecondaryStoragesCommand extends Command {
+
+    DataStoreTO srcDataStore;
+    DataStoreTO destDataStore;
+
+    public MigrateBetweenSecondaryStoragesCommand() {
+    }
+
+    public MigrateBetweenSecondaryStoragesCommand(DataStoreTO srcDataStore, DataStoreTO destDataStore) {
+        this.srcDataStore = srcDataStore;
+        this.destDataStore = destDataStore;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return false;
+    }
+
+    public DataStoreTO getSrcDataStore() {
+        return srcDataStore;
+    }
+
+    public DataStoreTO getDestDataStore() {
+        return destDataStore;
+    }
+}
diff --git a/core/src/main/java/com/cloud/agent/api/MigrateBetweenSecondaryStoragesCommandAnswer.java b/core/src/main/java/com/cloud/agent/api/MigrateBetweenSecondaryStoragesCommandAnswer.java
new file mode 100644
index 000000000000..fd303093e092
--- /dev/null
+++ b/core/src/main/java/com/cloud/agent/api/MigrateBetweenSecondaryStoragesCommandAnswer.java
@@ -0,0 +1,41 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package com.cloud.agent.api;
+
+import com.cloud.utils.Pair;
+
+import java.util.List;
+
+public class MigrateBetweenSecondaryStoragesCommandAnswer extends Answer {
+
+    List<Pair<Long, String>> migratedResourcesIdAndCheckpointPath;
+
+    public MigrateBetweenSecondaryStoragesCommandAnswer() {
+    }
+
+    public MigrateBetweenSecondaryStoragesCommandAnswer(MigrateBetweenSecondaryStoragesCommand cmd, boolean success, String result, List<Pair<Long, String>> migratedResourcesIdAndCheckpointPath) {
+        super(cmd, success, result);
+        this.migratedResourcesIdAndCheckpointPath = migratedResourcesIdAndCheckpointPath;
+    }
+
+    public List<Pair<Long, String>> getMigratedResources() {
+        return migratedResourcesIdAndCheckpointPath;
+    }
+}
diff --git a/core/src/main/java/com/cloud/agent/api/StartCommand.java b/core/src/main/java/com/cloud/agent/api/StartCommand.java
index 24b0ac3787b5..ea763d6cd4bd 100644
--- a/core/src/main/java/com/cloud/agent/api/StartCommand.java
+++ b/core/src/main/java/com/cloud/agent/api/StartCommand.java
@@ -22,13 +22,15 @@
 import com.cloud.agent.api.to.VirtualMachineTO;
 import com.cloud.host.Host;
 
+import java.util.List;
+
 /**
  */
 public class StartCommand extends Command {
     VirtualMachineTO vm;
     String hostIp;
     boolean executeInSequence = false;
-    String secondaryStorage;
+    private List<String> secondaryStorages;
 
     public VirtualMachineTO getVirtualMachine() {
         return vm;
@@ -50,18 +52,18 @@ public StartCommand(VirtualMachineTO vm, Host host, boolean executeInSequence) {
         this.vm = vm;
         this.hostIp = host.getPrivateIpAddress();
         this.executeInSequence = executeInSequence;
-        this.secondaryStorage = null;
+        this.secondaryStorages = null;
     }
 
     public String getHostIp() {
         return this.hostIp;
     }
 
-    public String getSecondaryStorage() {
-        return this.secondaryStorage;
+    public List<String> getSecondaryStorages() {
+        return this.secondaryStorages;
     }
 
-    public void setSecondaryStorage(String secondary) {
-        this.secondaryStorage = secondary;
+    public void setSecondaryStorages(List<String> secondary) {
+        this.secondaryStorages = secondary;
     }
 }
diff --git a/core/src/main/java/com/cloud/agent/api/routing/DhcpEntryCommand.java b/core/src/main/java/com/cloud/agent/api/routing/DhcpEntryCommand.java
index 7fb65fe15cf9..67ca447e3853 100644
--- a/core/src/main/java/com/cloud/agent/api/routing/DhcpEntryCommand.java
+++ b/core/src/main/java/com/cloud/agent/api/routing/DhcpEntryCommand.java
@@ -36,6 +36,7 @@ public class DhcpEntryCommand extends NetworkElementCommand {
     private boolean isDefault;
     boolean executeInSequence = false;
     boolean remove;
+    Long leaseTime;
 
     public boolean isRemove() {
         return remove;
@@ -152,4 +153,12 @@ public boolean isDefault() {
     public void setDefault(boolean isDefault) {
         this.isDefault = isDefault;
     }
+
+    public Long getLeaseTime() {
+        return leaseTime;
+    }
+
+    public void setLeaseTime(Long leaseTime) {
+        this.leaseTime = leaseTime;
+    }
 }
diff --git a/core/src/main/java/com/cloud/agent/api/routing/NetworkElementCommand.java b/core/src/main/java/com/cloud/agent/api/routing/NetworkElementCommand.java
index 400b6bb80917..20d2ea0a443d 100644
--- a/core/src/main/java/com/cloud/agent/api/routing/NetworkElementCommand.java
+++ b/core/src/main/java/com/cloud/agent/api/routing/NetworkElementCommand.java
@@ -37,6 +37,7 @@ public abstract class NetworkElementCommand extends Command {
     public static final String ZONE_NETWORK_TYPE = "zone.network.type";
     public static final String GUEST_BRIDGE = "guest.bridge";
     public static final String VPC_PRIVATE_GATEWAY = "vpc.gateway.private";
+    public static final String VPC_ID = "vpc.id";
     public static final String FIREWALL_EGRESS_DEFAULT = "firewall.egress.default";
     public static final String NETWORK_PUB_LAST_IP = "network.public.last.ip";
     public static final String HYPERVISOR_HOST_PRIVATE_IP = "hypervisor.private.ip";
diff --git a/core/src/main/java/com/cloud/agent/api/routing/SetFirewallRulesCommand.java b/core/src/main/java/com/cloud/agent/api/routing/SetFirewallRulesCommand.java
index c56f8d20fbe6..ff81ab7749c5 100644
--- a/core/src/main/java/com/cloud/agent/api/routing/SetFirewallRulesCommand.java
+++ b/core/src/main/java/com/cloud/agent/api/routing/SetFirewallRulesCommand.java
@@ -32,6 +32,7 @@
  */
 public class SetFirewallRulesCommand extends NetworkElementCommand {
     FirewallRuleTO[] rules;
+    Long vpcId;
 
     protected SetFirewallRulesCommand() {
     }
@@ -40,10 +41,19 @@ public SetFirewallRulesCommand(List<FirewallRuleTO> rules) {
         this.rules = rules.toArray(new FirewallRuleTO[rules.size()]);
     }
 
+    public SetFirewallRulesCommand(List<FirewallRuleTO> rules, Long vpcId) {
+        this.rules = rules.toArray(new FirewallRuleTO[rules.size()]);
+        this.vpcId = vpcId;
+    }
+
     public FirewallRuleTO[] getRules() {
         return rules;
     }
 
+    public Long getVpcId() {
+        return vpcId;
+    }
+
     public String[][] generateFwRules() {
         String[][] result = new String[2][];
         Set<String> toAdd = new HashSet<String>();
diff --git a/core/src/main/java/com/cloud/agent/api/storage/CreateDiskOnlyVmSnapshotAnswer.java b/core/src/main/java/com/cloud/agent/api/storage/CreateDiskOnlyVmSnapshotAnswer.java
index 4d61249c7cbc..9a571e34c7e6 100644
--- a/core/src/main/java/com/cloud/agent/api/storage/CreateDiskOnlyVmSnapshotAnswer.java
+++ b/core/src/main/java/com/cloud/agent/api/storage/CreateDiskOnlyVmSnapshotAnswer.java
@@ -20,20 +20,19 @@
 
 import com.cloud.agent.api.Answer;
 import com.cloud.agent.api.Command;
-import com.cloud.utils.Pair;
 
 import java.util.Map;
 
 public class CreateDiskOnlyVmSnapshotAnswer extends Answer {
 
-    protected Map<String, Pair<Long, String>> mapVolumeToSnapshotSizeAndNewVolumePath;
+    protected Map<String, Long> mapVolumeToSnapshotSize;
 
-    public CreateDiskOnlyVmSnapshotAnswer(Command command, boolean success, String details, Map<String, Pair<Long, String>> mapVolumeToSnapshotSizeAndNewVolumePath) {
+    public CreateDiskOnlyVmSnapshotAnswer(Command command, boolean success, String details, Map<String, Long> mapVolumeToSnapshotSize) {
         super(command, success, details);
-        this.mapVolumeToSnapshotSizeAndNewVolumePath = mapVolumeToSnapshotSizeAndNewVolumePath;
+        this.mapVolumeToSnapshotSize = mapVolumeToSnapshotSize;
     }
 
-    public Map<String, Pair<Long, String>> getMapVolumeToSnapshotSizeAndNewVolumePath() {
-        return mapVolumeToSnapshotSizeAndNewVolumePath;
+    public Map<String, Long> getMapVolumeToSnapshotSize() {
+        return mapVolumeToSnapshotSize;
     }
 }
diff --git a/core/src/main/java/com/cloud/agent/api/storage/CreateDiskOnlyVmSnapshotCommand.java b/core/src/main/java/com/cloud/agent/api/storage/CreateDiskOnlyVmSnapshotCommand.java
index 952bf0c971de..da1b420625f8 100644
--- a/core/src/main/java/com/cloud/agent/api/storage/CreateDiskOnlyVmSnapshotCommand.java
+++ b/core/src/main/java/com/cloud/agent/api/storage/CreateDiskOnlyVmSnapshotCommand.java
@@ -21,6 +21,7 @@
 
 import com.cloud.agent.api.VMSnapshotBaseCommand;
 import com.cloud.agent.api.VMSnapshotTO;
+import com.cloud.utils.Pair;
 import com.cloud.vm.VirtualMachine;
 import org.apache.cloudstack.storage.to.VolumeObjectTO;
 
@@ -30,12 +31,19 @@ public class CreateDiskOnlyVmSnapshotCommand extends VMSnapshotBaseCommand {
 
     protected VirtualMachine.State vmState;
 
-    public CreateDiskOnlyVmSnapshotCommand(String vmName, VMSnapshotTO snapshot, List<VolumeObjectTO> volumeTOs, String guestOSType, VirtualMachine.State vmState) {
-        super(vmName, snapshot, volumeTOs, guestOSType);
+    List<Pair<VolumeObjectTO, String>> volumeTosAndNewPaths;
+
+    public CreateDiskOnlyVmSnapshotCommand(String vmName, VMSnapshotTO snapshot, List<Pair<VolumeObjectTO, String>> volumeTosAndNewPaths, String guestOSType, VirtualMachine.State vmState) {
+        super(vmName, snapshot, null, guestOSType);
         this.vmState = vmState;
+        this.volumeTosAndNewPaths = volumeTosAndNewPaths;
     }
 
     public VirtualMachine.State getVmState() {
         return vmState;
     }
+
+    public List<Pair<VolumeObjectTO, String>> getVolumeTosAndNewPaths() {
+        return volumeTosAndNewPaths;
+    }
 }
diff --git a/core/src/main/java/com/cloud/agent/api/storage/MergeDiskOnlyVmSnapshotCommand.java b/core/src/main/java/com/cloud/agent/api/storage/MergeDiskOnlyVmSnapshotCommand.java
index b6396c24d10a..1a47d97d5e25 100644
--- a/core/src/main/java/com/cloud/agent/api/storage/MergeDiskOnlyVmSnapshotCommand.java
+++ b/core/src/main/java/com/cloud/agent/api/storage/MergeDiskOnlyVmSnapshotCommand.java
@@ -19,28 +19,28 @@
 package com.cloud.agent.api.storage;
 
 import com.cloud.agent.api.Command;
-import com.cloud.vm.VirtualMachine;
+import org.apache.cloudstack.storage.to.DeltaMergeTreeTO;
 
 import java.util.List;
 
 public class MergeDiskOnlyVmSnapshotCommand extends Command {
 
-    private List<SnapshotMergeTreeTO> snapshotMergeTreeToList;
-    private VirtualMachine.State vmState;
+    private List<DeltaMergeTreeTO> snapshotMergeTreeToList;
+    private boolean isVmRunning;
     private String vmName;
 
-    public MergeDiskOnlyVmSnapshotCommand(List<SnapshotMergeTreeTO> snapshotMergeTreeToList, VirtualMachine.State vmState, String vmName) {
+    public MergeDiskOnlyVmSnapshotCommand(List<DeltaMergeTreeTO> snapshotMergeTreeToList, boolean isVmRunning, String vmName) {
         this.snapshotMergeTreeToList = snapshotMergeTreeToList;
-        this.vmState = vmState;
+        this.isVmRunning = isVmRunning;
         this.vmName = vmName;
     }
 
-    public List<SnapshotMergeTreeTO> getSnapshotMergeTreeToList() {
+    public List<DeltaMergeTreeTO> getDeltaMergeTreeToList() {
         return snapshotMergeTreeToList;
     }
 
-    public VirtualMachine.State getVmState() {
-        return vmState;
+    public boolean isVmRunning() {
+        return isVmRunning;
     }
 
     public String getVmName() {
diff --git a/core/src/main/java/com/cloud/agent/resource/virtualnetwork/facade/DhcpEntryConfigItem.java b/core/src/main/java/com/cloud/agent/resource/virtualnetwork/facade/DhcpEntryConfigItem.java
index 9c5b657bb4e4..041645046b23 100644
--- a/core/src/main/java/com/cloud/agent/resource/virtualnetwork/facade/DhcpEntryConfigItem.java
+++ b/core/src/main/java/com/cloud/agent/resource/virtualnetwork/facade/DhcpEntryConfigItem.java
@@ -35,7 +35,7 @@ public List<ConfigItem> generateConfig(final NetworkElementCommand cmd) {
         final DhcpEntryCommand command = (DhcpEntryCommand) cmd;
 
         final VmDhcpConfig vmDhcpConfig = new VmDhcpConfig(command.getVmName(), command.getVmMac(), command.getVmIpAddress(), command.getVmIp6Address(), command.getDuid(), command.getDefaultDns(),
-                command.getDefaultRouter(), command.getStaticRoutes(), command.isDefault(), command.isRemove());
+                command.getDefaultRouter(), command.getStaticRoutes(), command.isDefault(), command.isRemove(), command.getLeaseTime());
 
         return generateConfigItems(vmDhcpConfig);
     }
diff --git a/core/src/main/java/com/cloud/agent/resource/virtualnetwork/model/VmDhcpConfig.java b/core/src/main/java/com/cloud/agent/resource/virtualnetwork/model/VmDhcpConfig.java
index d9cb8b0b2645..1c43cd1823b9 100644
--- a/core/src/main/java/com/cloud/agent/resource/virtualnetwork/model/VmDhcpConfig.java
+++ b/core/src/main/java/com/cloud/agent/resource/virtualnetwork/model/VmDhcpConfig.java
@@ -29,6 +29,7 @@ public class VmDhcpConfig extends ConfigBase {
     private String defaultGateway;
     private String staticRoutes;
     private boolean defaultEntry;
+    private Long leaseTime;
 
     // Indicate if the entry should be removed when set to true
     private boolean remove;
@@ -39,6 +40,11 @@ public VmDhcpConfig() {
 
     public VmDhcpConfig(String hostName, String macAddress, String ipv4Address, String ipv6Address, String ipv6Duid, String dnsAddresses, String defaultGateway,
             String staticRoutes, boolean defaultEntry, boolean remove) {
+        this(hostName, macAddress, ipv4Address, ipv6Address, ipv6Duid, dnsAddresses, defaultGateway, staticRoutes, defaultEntry, remove, null);
+    }
+
+    public VmDhcpConfig(String hostName, String macAddress, String ipv4Address, String ipv6Address, String ipv6Duid, String dnsAddresses, String defaultGateway,
+            String staticRoutes, boolean defaultEntry, boolean remove, Long leaseTime) {
         super(VM_DHCP);
         this.hostName = hostName;
         this.macAddress = macAddress;
@@ -50,6 +56,7 @@ public VmDhcpConfig(String hostName, String macAddress, String ipv4Address, Stri
         this.staticRoutes = staticRoutes;
         this.defaultEntry = defaultEntry;
         this.remove = remove;
+        this.leaseTime = leaseTime;
     }
 
     public String getHostName() {
@@ -132,4 +139,12 @@ public void setDefaultEntry(boolean defaultEntry) {
         this.defaultEntry = defaultEntry;
     }
 
+    public Long getLeaseTime() {
+        return leaseTime;
+    }
+
+    public void setLeaseTime(Long leaseTime) {
+        this.leaseTime = leaseTime;
+    }
+
 }
diff --git a/core/src/main/java/com/cloud/storage/resource/StorageProcessor.java b/core/src/main/java/com/cloud/storage/resource/StorageProcessor.java
index dd8e2abcd643..31c384eab3a0 100644
--- a/core/src/main/java/com/cloud/storage/resource/StorageProcessor.java
+++ b/core/src/main/java/com/cloud/storage/resource/StorageProcessor.java
@@ -85,4 +85,8 @@ public interface StorageProcessor {
     public Answer checkDataStoreStoragePolicyCompliance(CheckDataStoreStoragePolicyComplianceCommand cmd);
 
     public Answer syncVolumePath(SyncVolumePathCommand cmd);
+
+    default Answer deleteBackup(DeleteCommand cmd) {
+        return new Answer(cmd, false, "Operation not implemented");
+    }
 }
diff --git a/core/src/main/java/com/cloud/storage/resource/StorageSubsystemCommandHandlerBase.java b/core/src/main/java/com/cloud/storage/resource/StorageSubsystemCommandHandlerBase.java
index 318c069b0b0b..3d2608c0c4b8 100644
--- a/core/src/main/java/com/cloud/storage/resource/StorageSubsystemCommandHandlerBase.java
+++ b/core/src/main/java/com/cloud/storage/resource/StorageSubsystemCommandHandlerBase.java
@@ -154,6 +154,8 @@ protected Answer execute(DeleteCommand cmd) {
             answer = processor.deleteVolume(cmd);
         } else if (data.getObjectType() == DataObjectType.SNAPSHOT) {
             answer = processor.deleteSnapshot(cmd);
+        } else if (data.getObjectType() == DataObjectType.BACKUP) {
+            answer = processor.deleteBackup(cmd);
         } else {
             answer = new Answer(cmd, false, "unsupported type");
         }
diff --git a/core/src/main/java/org/apache/cloudstack/backup/BackupAnswer.java b/core/src/main/java/org/apache/cloudstack/backup/BackupAnswer.java
index ffc67b628a7e..abe78ee5553d 100644
--- a/core/src/main/java/org/apache/cloudstack/backup/BackupAnswer.java
+++ b/core/src/main/java/org/apache/cloudstack/backup/BackupAnswer.java
@@ -29,6 +29,12 @@ public class BackupAnswer extends Answer {
     private Long virtualSize;
     private Map<String, String> volumes;
     Boolean needsCleanup;
+    // Set by the NAS backup provider after a checkpoint/bitmap was created during this backup.
+    // The provider persists it in backup_details under NASBackupChainKeys.BITMAP_NAME.
+    private String bitmapCreated;
+    // Set when an incremental was requested but the agent had to fall back to a full
+    // (e.g. VM was stopped). Provider should record this backup as type=full.
+    private Boolean incrementalFallback;
 
     public BackupAnswer(final Command command, final boolean success, final String details) {
         super(command, success, details);
@@ -68,4 +74,21 @@ public Boolean getNeedsCleanup() {
     public void setNeedsCleanup(Boolean needsCleanup) {
         this.needsCleanup = needsCleanup;
     }
+
+    public String getBitmapCreated() {
+        return bitmapCreated;
+    }
+
+    public void setBitmapCreated(String bitmapCreated) {
+        this.bitmapCreated = bitmapCreated;
+    }
+
+    public Boolean getIncrementalFallback() {
+        return incrementalFallback != null && incrementalFallback;
+    }
+
+    public void setIncrementalFallback(Boolean incrementalFallback) {
+        this.incrementalFallback = incrementalFallback;
+    }
+
 }
diff --git a/core/src/main/java/org/apache/cloudstack/backup/CleanupKbossBackupErrorAnswer.java b/core/src/main/java/org/apache/cloudstack/backup/CleanupKbossBackupErrorAnswer.java
new file mode 100644
index 000000000000..34b65adc2467
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/CleanupKbossBackupErrorAnswer.java
@@ -0,0 +1,46 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cloudstack.backup;
+
+import java.util.List;
+
+import org.apache.cloudstack.storage.to.VolumeObjectTO;
+import org.apache.commons.collections4.CollectionUtils;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.Command;
+
+public class CleanupKbossBackupErrorAnswer extends Answer {
+    private List<VolumeObjectTO> volumeObjectTos;
+    private boolean vmRunning;
+
+    public CleanupKbossBackupErrorAnswer(Command cmd, List<VolumeObjectTO> volumeObjectTos, boolean vmRunning) {
+        super(cmd, CollectionUtils.isNotEmpty(volumeObjectTos), null);
+        this.volumeObjectTos = volumeObjectTos;
+        this.vmRunning = vmRunning;
+    }
+
+    public List<VolumeObjectTO> getVolumeObjectTos() {
+        return volumeObjectTos;
+    }
+
+    public boolean isVmRunning() {
+        return vmRunning;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/CleanupKbossBackupErrorCommand.java b/core/src/main/java/org/apache/cloudstack/backup/CleanupKbossBackupErrorCommand.java
new file mode 100644
index 000000000000..3257851d11ba
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/CleanupKbossBackupErrorCommand.java
@@ -0,0 +1,61 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+import org.apache.cloudstack.storage.to.KbossTO;
+
+import java.util.List;
+
+public class CleanupKbossBackupErrorCommand extends Command {
+
+    private boolean runningVM;
+
+    private String vmName;
+
+    private String imageStoreUrl;
+
+    private List<KbossTO> kbossTOS;
+
+    public CleanupKbossBackupErrorCommand(boolean runningVM, String vmName, String imageStoreUrl, List<KbossTO> kbossTOS) {
+        this.runningVM = runningVM;
+        this.vmName = vmName;
+        this.imageStoreUrl = imageStoreUrl;
+        this.kbossTOS = kbossTOS;
+    }
+
+    public boolean isRunningVM() {
+        return runningVM;
+    }
+
+    public String getVmName() {
+        return vmName;
+    }
+
+    public String getImageStoreUrl() {
+        return imageStoreUrl;
+    }
+
+    public List<KbossTO> getKbossTOs() {
+        return kbossTOS;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return false;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/CleanupKbossValidationCommand.java b/core/src/main/java/org/apache/cloudstack/backup/CleanupKbossValidationCommand.java
new file mode 100644
index 000000000000..8a345aeba176
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/CleanupKbossValidationCommand.java
@@ -0,0 +1,49 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+
+import java.util.Set;
+
+public class CleanupKbossValidationCommand extends Command {
+
+    private String vmName;
+
+    private Set<String> secondaryStorages;
+
+    public CleanupKbossValidationCommand(String vmName, Set<String> secondaryStorages) {
+        this.vmName = vmName;
+        this.secondaryStorages = secondaryStorages;
+    }
+
+    public String getVmName() {
+        return vmName;
+    }
+
+    public Set<String> getSecondaryStorages() {
+        return secondaryStorages;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return false;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/CompressBackupCommand.java b/core/src/main/java/org/apache/cloudstack/backup/CompressBackupCommand.java
new file mode 100644
index 000000000000..a551f246a0bb
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/CompressBackupCommand.java
@@ -0,0 +1,78 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+import org.apache.cloudstack.storage.to.DeltaMergeTreeTO;
+
+import java.util.List;
+
+public class CompressBackupCommand extends Command {
+
+    private List<DeltaMergeTreeTO> backupDeltasToCompress;
+
+    private List<String> backupChainImageStoreUrls;
+
+    private long minFreeStorage;
+
+    private Backup.CompressionLibrary compressionLib;
+
+    private int coroutines;
+
+    private int rateLimit;
+
+    public CompressBackupCommand(List<DeltaMergeTreeTO> backupDeltasToCompress, List<String> backupChainImageStoreUrls, long minFreeStorage, Backup.CompressionLibrary compressionLib, int coroutines, int rateLimit) {
+        this.backupChainImageStoreUrls = backupChainImageStoreUrls;
+        this.backupDeltasToCompress = backupDeltasToCompress;
+        this.minFreeStorage = minFreeStorage;
+        this.compressionLib = compressionLib;
+        this.coroutines = coroutines;
+        this.rateLimit = rateLimit;
+    }
+
+    public List<DeltaMergeTreeTO> getBackupDeltasToCompress() {
+        return backupDeltasToCompress;
+    }
+
+    public List<String> getBackupChainImageStoreUrls() {
+        return backupChainImageStoreUrls;
+    }
+
+    public long getMinFreeStorage() {
+        return minFreeStorage;
+    }
+
+    public Backup.CompressionLibrary getCompressionLib() {
+        return compressionLib;
+    }
+
+    public int getCoroutines() {
+        return coroutines;
+    }
+
+    public int getRateLimit() {
+        return rateLimit;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return false;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/ConsolidateVolumesAnswer.java b/core/src/main/java/org/apache/cloudstack/backup/ConsolidateVolumesAnswer.java
new file mode 100644
index 000000000000..9f230deb8d75
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/ConsolidateVolumesAnswer.java
@@ -0,0 +1,37 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.Command;
+import org.apache.cloudstack.storage.to.VolumeObjectTO;
+
+import java.util.List;
+
+public class ConsolidateVolumesAnswer extends Answer {
+
+    private List<VolumeObjectTO> successfullyConsolidatedVolumes;
+
+    public ConsolidateVolumesAnswer(Command command, boolean success, String details, List<VolumeObjectTO> successfullyConsolidatedVolumes) {
+        super(command, success, details);
+        this.successfullyConsolidatedVolumes = successfullyConsolidatedVolumes;
+    }
+
+    public List<VolumeObjectTO> getSuccessfullyConsolidatedVolumes() {
+        return successfullyConsolidatedVolumes;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/ConsolidateVolumesCommand.java b/core/src/main/java/org/apache/cloudstack/backup/ConsolidateVolumesCommand.java
new file mode 100644
index 000000000000..7b2bc2245939
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/ConsolidateVolumesCommand.java
@@ -0,0 +1,56 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
+import org.apache.cloudstack.storage.to.VolumeObjectTO;
+
+import java.util.List;
+import java.util.stream.Collectors;
+
+public class ConsolidateVolumesCommand extends Command {
+
+    private List<VolumeObjectTO> volumesToConsolidate;
+
+    private List<String> secondaryStorageUuids;
+
+    private String vmName;
+
+    public ConsolidateVolumesCommand(List<VolumeInfo> volumesToConsolidate, List<String> secondaryStorageUuids, String vmName) {
+        this.volumesToConsolidate = volumesToConsolidate.stream().map(vol -> (VolumeObjectTO)vol.getTO()).collect(Collectors.toList());
+        this.secondaryStorageUuids = secondaryStorageUuids;
+        this.vmName = vmName;
+    }
+
+    public List<VolumeObjectTO> getVolumesToConsolidate() {
+        return volumesToConsolidate;
+    }
+
+    public List<String> getSecondaryStorageUuids() {
+        return secondaryStorageUuids;
+    }
+
+    public String getVmName() {
+        return vmName;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return false;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/FinalizeBackupCompressionCommand.java b/core/src/main/java/org/apache/cloudstack/backup/FinalizeBackupCompressionCommand.java
new file mode 100644
index 000000000000..a4cbb69611f7
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/FinalizeBackupCompressionCommand.java
@@ -0,0 +1,49 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+import org.apache.cloudstack.storage.to.BackupDeltaTO;
+
+import java.util.List;
+
+public class FinalizeBackupCompressionCommand extends Command {
+    private boolean cleanup;
+
+    private List<BackupDeltaTO> backupDeltaTO;
+
+    public FinalizeBackupCompressionCommand(boolean cleanup, List<BackupDeltaTO> backupDeltaTO) {
+        this.cleanup = cleanup;
+        this.backupDeltaTO = backupDeltaTO;
+    }
+
+    public boolean isCleanup() {
+        return cleanup;
+    }
+
+    public List<BackupDeltaTO> getBackupDeltaTOList() {
+        return backupDeltaTO;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return false;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/PrepareValidationCommand.java b/core/src/main/java/org/apache/cloudstack/backup/PrepareValidationCommand.java
new file mode 100644
index 000000000000..bae2fee95774
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/PrepareValidationCommand.java
@@ -0,0 +1,52 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+import com.cloud.utils.Pair;
+import org.apache.cloudstack.storage.to.BackupDeltaTO;
+import org.apache.cloudstack.storage.to.VolumeObjectTO;
+
+import java.util.List;
+import java.util.Set;
+
+public class PrepareValidationCommand extends Command {
+
+    private List<Pair<BackupDeltaTO, VolumeObjectTO>> backupToVolumeList;
+
+    private Set<String> imageStoreSet;
+
+    public PrepareValidationCommand(List<Pair<BackupDeltaTO, VolumeObjectTO>> backupToVolumeList, Set<String> imageStoreSet) {
+        this.backupToVolumeList = backupToVolumeList;
+        this.imageStoreSet = imageStoreSet;
+    }
+
+    public List<Pair<BackupDeltaTO, VolumeObjectTO>> getBackupToVolumeList() {
+        return backupToVolumeList;
+    }
+
+    public Set<String> getImageStoreSet() {
+        return imageStoreSet;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return false;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/RestoreKbossBackupAnswer.java b/core/src/main/java/org/apache/cloudstack/backup/RestoreKbossBackupAnswer.java
new file mode 100644
index 000000000000..925ceca6b3b3
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/RestoreKbossBackupAnswer.java
@@ -0,0 +1,41 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.Command;
+
+import java.util.Set;
+
+public class RestoreKbossBackupAnswer extends Answer {
+
+    private Set<String> secondaryStorageUuids;
+
+    public RestoreKbossBackupAnswer(Command command, Set<String> secondaryStorageUuids) {
+        super(command);
+        this.secondaryStorageUuids = secondaryStorageUuids;
+    }
+
+    public RestoreKbossBackupAnswer(Command command, Exception e, Set<String> secondaryStorageUuids) {
+        super(command, e);
+        this.secondaryStorageUuids = secondaryStorageUuids;
+    }
+
+    public Set<String> getSecondaryStorageUuids() {
+        return secondaryStorageUuids;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/RestoreKbossBackupCommand.java b/core/src/main/java/org/apache/cloudstack/backup/RestoreKbossBackupCommand.java
new file mode 100644
index 000000000000..d173aab324a2
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/RestoreKbossBackupCommand.java
@@ -0,0 +1,66 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+import com.cloud.utils.Pair;
+import org.apache.cloudstack.storage.to.BackupDeltaTO;
+import org.apache.cloudstack.storage.to.VolumeObjectTO;
+
+import java.util.Set;
+
+public class RestoreKbossBackupCommand extends Command {
+
+    private Set<BackupDeltaTO> deltasToRemove;
+
+    private Set<Pair<BackupDeltaTO, VolumeObjectTO>> backupAndVolumePairs;
+
+    private Set<String> secondaryStorageUrls;
+
+    private boolean quickRestore;
+
+    public RestoreKbossBackupCommand(Set<BackupDeltaTO> deltasToRemove, Set<Pair<BackupDeltaTO, VolumeObjectTO>> backupAndVolumePairs, Set<String> secondaryStorageUrls,
+            boolean quickRestore) {
+        this.deltasToRemove = deltasToRemove;
+        this.backupAndVolumePairs = backupAndVolumePairs;
+        this.secondaryStorageUrls = secondaryStorageUrls;
+        this.quickRestore = quickRestore;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return false;
+    }
+
+    public Set<BackupDeltaTO> getDeltasToRemove() {
+        return deltasToRemove;
+    }
+
+    public Set<Pair<BackupDeltaTO, VolumeObjectTO>> getBackupAndVolumePairs() {
+        return backupAndVolumePairs;
+    }
+
+    public Set<String> getSecondaryStorageUrls() {
+        return secondaryStorageUrls;
+    }
+
+    public boolean isQuickRestore() {
+        return quickRestore;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/TakeBackupCommand.java b/core/src/main/java/org/apache/cloudstack/backup/TakeBackupCommand.java
index 5402b6b24760..34f8d7b8bcdd 100644
--- a/core/src/main/java/org/apache/cloudstack/backup/TakeBackupCommand.java
+++ b/core/src/main/java/org/apache/cloudstack/backup/TakeBackupCommand.java
@@ -36,6 +36,17 @@ public class TakeBackupCommand extends Command {
     @LogLevel(LogLevel.Log4jLevel.Off)
     private String mountOptions;
 
+    // Incremental backup fields (NAS provider; null/empty for legacy full-only callers).
+    private String mode;          // "full" or "incremental"; null => legacy behaviour (script default)
+    private String bitmapNew;     // Checkpoint/bitmap name to create with this backup (timestamp-based)
+    private String bitmapParent;  // Incremental: parent bitmap to read changes since
+
+    // Per-volume parent backup file paths (one per VM volume, ordered by deviceId — same
+    // order as volumePaths). The script rebases each new qcow2 onto the matching parent.
+    // Backup file UUIDs differ across volumes, so a single parentPath would have rebased
+    // every data disk onto the root file. New callers MUST populate parentPaths.
+    private List<String> parentPaths;
+
     public TakeBackupCommand(String vmName, String backupPath) {
         super();
         this.vmName = vmName;
@@ -106,6 +117,38 @@ public void setQuiesce(Boolean quiesce) {
         this.quiesce = quiesce;
     }
 
+    public String getMode() {
+        return mode;
+    }
+
+    public void setMode(String mode) {
+        this.mode = mode;
+    }
+
+    public String getBitmapNew() {
+        return bitmapNew;
+    }
+
+    public void setBitmapNew(String bitmapNew) {
+        this.bitmapNew = bitmapNew;
+    }
+
+    public String getBitmapParent() {
+        return bitmapParent;
+    }
+
+    public void setBitmapParent(String bitmapParent) {
+        this.bitmapParent = bitmapParent;
+    }
+
+    public List<String> getParentPaths() {
+        return parentPaths;
+    }
+
+    public void setParentPaths(List<String> parentPaths) {
+        this.parentPaths = parentPaths;
+    }
+
     @Override
     public boolean executeInSequence() {
         return true;
diff --git a/core/src/main/java/org/apache/cloudstack/backup/TakeBackupHashCommand.java b/core/src/main/java/org/apache/cloudstack/backup/TakeBackupHashCommand.java
new file mode 100644
index 000000000000..7effe40686b2
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/TakeBackupHashCommand.java
@@ -0,0 +1,47 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+import org.apache.cloudstack.storage.to.BackupDeltaTO;
+
+import java.util.List;
+
+public class TakeBackupHashCommand extends Command {
+
+    private List<BackupDeltaTO> backupDeltaTOList;
+
+    private String backupUuid;
+
+    public TakeBackupHashCommand(List<BackupDeltaTO> backupDeltaTOList, String backupUuid) {
+        this.backupDeltaTOList = backupDeltaTOList;
+        this.backupUuid = backupUuid;
+    }
+
+    public List<BackupDeltaTO> getBackupDeltaTOList() {
+        return backupDeltaTOList;
+    }
+
+    public String getBackupUuid() {
+        return backupUuid;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return false;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/TakeKbossBackupAnswer.java b/core/src/main/java/org/apache/cloudstack/backup/TakeKbossBackupAnswer.java
new file mode 100644
index 000000000000..1827c766f573
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/TakeKbossBackupAnswer.java
@@ -0,0 +1,59 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.Command;
+import com.cloud.utils.Pair;
+import com.cloud.utils.exception.BackupException;
+
+import java.util.Map;
+
+public class TakeKbossBackupAnswer extends Answer {
+
+    private Map<String, String> mapVolumeUuidToNewVolumePath;
+    private Map<String, Pair<String, Long>> mapVolumeUuidToDeltaPathOnSecondaryAndSize;
+    private boolean isVmConsistent = true;
+
+    public TakeKbossBackupAnswer(Command command, boolean success, Map<String, String> mapVolumeUuidToNewVolumePath,
+            Map<String, Pair<String, Long>> mapVolumeUuidToDeltaPathOnSecondaryAndSize) {
+        super(command, success, null);
+        this.mapVolumeUuidToNewVolumePath = mapVolumeUuidToNewVolumePath;
+        this.mapVolumeUuidToDeltaPathOnSecondaryAndSize = mapVolumeUuidToDeltaPathOnSecondaryAndSize;
+    }
+
+    public TakeKbossBackupAnswer(Command command, Exception e) {
+        super(command, e);
+        if (e instanceof BackupException) {
+            this.isVmConsistent = ((BackupException)e).isVmConsistent();
+        }
+    }
+
+    public Map<String, String> getMapVolumeUuidToNewVolumePath() {
+        return mapVolumeUuidToNewVolumePath;
+    }
+
+    public Map<String, Pair<String, Long>> getMapVolumeUuidToDeltaPathOnSecondaryAndSize() {
+        return mapVolumeUuidToDeltaPathOnSecondaryAndSize;
+    }
+
+    public boolean isVmConsistent() {
+        return isVmConsistent;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/TakeKbossBackupCommand.java b/core/src/main/java/org/apache/cloudstack/backup/TakeKbossBackupCommand.java
new file mode 100644
index 000000000000..b145fa6257b1
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/TakeKbossBackupCommand.java
@@ -0,0 +1,92 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+import org.apache.cloudstack.storage.to.KbossTO;
+
+import java.util.List;
+
+public class TakeKbossBackupCommand extends Command {
+
+    private boolean quiesceVm;
+
+    private boolean runningVM;
+
+    private boolean endChain;
+
+    private String vmName;
+
+    private String imageStoreUrl;
+
+    private List<String> backupChainImageStoreUrls;
+
+    private List<KbossTO> kbossTOS;
+
+    private boolean isolated;
+
+    public TakeKbossBackupCommand(boolean quiesceVm, boolean runningVM, boolean endChain, String vmName, String imageStoreUrl, List<String> backupChainImageStoreUrls, List<KbossTO> kbossTOS, boolean isolated) {
+        this.quiesceVm = quiesceVm;
+        this.runningVM = runningVM;
+        this.endChain = endChain;
+        this.vmName = vmName;
+        this.imageStoreUrl = imageStoreUrl;
+        this.backupChainImageStoreUrls = backupChainImageStoreUrls;
+        this.kbossTOS = kbossTOS;
+        this.isolated = isolated;
+    }
+
+    public boolean isQuiesceVm() {
+        return quiesceVm;
+    }
+
+    public boolean isRunningVM() {
+        return runningVM;
+    }
+
+    public boolean isEndChain() {
+        return endChain;
+    }
+
+    public String getVmName() {
+        return vmName;
+    }
+
+    public String getImageStoreUrl() {
+        return imageStoreUrl;
+    }
+
+    public List<String> getBackupChainImageStoreUrls() {
+        return backupChainImageStoreUrls;
+    }
+
+    public List<KbossTO> getKbossTOs() {
+        return kbossTOS;
+    }
+
+    public boolean isIsolated() {
+        return isolated;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return false;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/ValidateKbossVmAnswer.java b/core/src/main/java/org/apache/cloudstack/backup/ValidateKbossVmAnswer.java
new file mode 100644
index 000000000000..fcff6a8cce8c
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/ValidateKbossVmAnswer.java
@@ -0,0 +1,46 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.Command;
+
+public class ValidateKbossVmAnswer extends Answer {
+
+    private boolean bootValidated;
+    private String screenshotPath;
+    private String scriptResult;
+
+    public ValidateKbossVmAnswer(Command command, boolean bootValidated, String screenshotPath, String scriptResult) {
+        super(command);
+        this.bootValidated = bootValidated;
+        this.screenshotPath = screenshotPath;
+        this.scriptResult = scriptResult;
+    }
+
+    public boolean isBootValidated() {
+        return bootValidated;
+    }
+
+    public String getScreenshotPath() {
+        return screenshotPath;
+    }
+
+    public String getScriptResult() {
+        return scriptResult;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/ValidateKbossVmCommand.java b/core/src/main/java/org/apache/cloudstack/backup/ValidateKbossVmCommand.java
new file mode 100644
index 000000000000..9e10499f53d9
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/ValidateKbossVmCommand.java
@@ -0,0 +1,133 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+import com.cloud.agent.api.to.VirtualMachineTO;
+import org.apache.cloudstack.storage.to.BackupDeltaTO;
+
+public class ValidateKbossVmCommand extends Command {
+
+    private VirtualMachineTO vm;
+    private BackupDeltaTO backupDeltaTO;
+
+    private String scriptToExecute;
+
+    private String scriptArguments;
+    private String expectedResult;
+
+    private Integer scriptTimeout;
+    private Integer bootTimeout;
+    private Integer screenshotWait;
+
+    private boolean takeScreenshot;
+    private boolean waitForBoot;
+    private boolean executeScript;
+
+    public ValidateKbossVmCommand(VirtualMachineTO vm, BackupDeltaTO backupDeltaTO) {
+        this.vm = vm;
+        this.backupDeltaTO = backupDeltaTO;
+    }
+
+    public void setScriptToExecute(String scriptToExecute) {
+        this.scriptToExecute = scriptToExecute;
+    }
+
+    public void setScriptArguments(String scriptArguments) {
+        this.scriptArguments = scriptArguments;
+    }
+
+    public void setExpectedResult(String expectedResult) {
+        this.expectedResult = expectedResult;
+    }
+
+    public void setScriptTimeout(Integer scriptTimeout) {
+        this.scriptTimeout = scriptTimeout;
+    }
+
+    public void setTakeScreenshot(boolean takeScreenshot) {
+        this.takeScreenshot = takeScreenshot;
+    }
+
+    public void setWaitForBoot(boolean waitForBoot) {
+        this.waitForBoot = waitForBoot;
+    }
+
+    public void setExecuteScript(boolean executeScript) {
+        this.executeScript = executeScript;
+    }
+
+    public void setBootTimeout(Integer bootTimeout) {
+        this.bootTimeout = bootTimeout;
+    }
+
+    public void setScreenshotWait(Integer screenshotWait) {
+        this.screenshotWait = screenshotWait;
+    }
+
+    public VirtualMachineTO getVm() {
+        return vm;
+    }
+
+    public BackupDeltaTO getBackupDeltaTO() {
+        return backupDeltaTO;
+    }
+
+    public String getScriptToExecute() {
+        return scriptToExecute;
+    }
+
+    public String getScriptArguments() {
+        return scriptArguments;
+    }
+
+    public String getExpectedResult() {
+        return expectedResult;
+    }
+
+    public Integer getScriptTimeout() {
+        return scriptTimeout;
+    }
+
+    public Integer getBootTimeout() {
+        return bootTimeout;
+    }
+
+    public Integer getScreenshotWait() {
+        return screenshotWait;
+    }
+
+    public boolean isTakeScreenshot() {
+        return takeScreenshot;
+    }
+
+    public boolean isWaitForBoot() {
+        return waitForBoot;
+    }
+
+    public boolean isExecuteScript() {
+        return executeScript;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return false;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/storage/command/BackupDeleteAnswer.java b/core/src/main/java/org/apache/cloudstack/storage/command/BackupDeleteAnswer.java
new file mode 100644
index 000000000000..6cc48ea296d1
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/storage/command/BackupDeleteAnswer.java
@@ -0,0 +1,36 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+package org.apache.cloudstack.storage.command;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.Command;
+
+public class BackupDeleteAnswer extends Answer {
+
+    private long backupId;
+
+    public BackupDeleteAnswer(Command command, boolean success, String details) {
+        super(command, success, details);
+        backupId = ((DeleteCommand) command).getData().getId();
+    }
+
+    public long getBackupId() {
+        return backupId;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/storage/command/DeleteCommand.java b/core/src/main/java/org/apache/cloudstack/storage/command/DeleteCommand.java
index 6f82fa97818d..9aa6f26b5d9c 100644
--- a/core/src/main/java/org/apache/cloudstack/storage/command/DeleteCommand.java
+++ b/core/src/main/java/org/apache/cloudstack/storage/command/DeleteCommand.java
@@ -24,6 +24,8 @@
 public final class DeleteCommand extends StorageSubSystemCommand {
     private DataTO data;
 
+    private boolean deleteChain;
+
     public DeleteCommand(final DataTO data) {
         super();
         this.data = data;
@@ -42,6 +44,14 @@ public DataTO getData() {
         return data;
     }
 
+    public void setDeleteChain(boolean deleteChain) {
+        this.deleteChain = deleteChain;
+    }
+
+    public boolean isDeleteChain() {
+        return deleteChain;
+    }
+
     @Override
     public void setExecuteInSequence(final boolean inSeq) {
 
diff --git a/core/src/main/java/org/apache/cloudstack/storage/command/RevertSnapshotCommand.java b/core/src/main/java/org/apache/cloudstack/storage/command/RevertSnapshotCommand.java
index 174302252a55..42926d37cdfe 100644
--- a/core/src/main/java/org/apache/cloudstack/storage/command/RevertSnapshotCommand.java
+++ b/core/src/main/java/org/apache/cloudstack/storage/command/RevertSnapshotCommand.java
@@ -25,6 +25,8 @@ public final class RevertSnapshotCommand extends StorageSubSystemCommand {
     private SnapshotObjectTO dataOnPrimaryStorage;
     private boolean _executeInSequence = false;
 
+    private boolean deleteChain;
+
     public RevertSnapshotCommand(SnapshotObjectTO data, SnapshotObjectTO dataOnPrimaryStorage) {
         super();
         this.data = data;
@@ -43,6 +45,14 @@ public SnapshotObjectTO getDataOnPrimaryStorage() {
         return dataOnPrimaryStorage;
     }
 
+    public boolean isDeleteChain() {
+        return deleteChain;
+    }
+
+    public void setDeleteChain(boolean deleteChain) {
+        this.deleteChain = deleteChain;
+    }
+
     @Override
     public void setExecuteInSequence(final boolean executeInSequence) {
         _executeInSequence = executeInSequence;
diff --git a/core/src/main/java/org/apache/cloudstack/storage/to/BackupDeltaTO.java b/core/src/main/java/org/apache/cloudstack/storage/to/BackupDeltaTO.java
new file mode 100644
index 000000000000..662a2d486560
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/storage/to/BackupDeltaTO.java
@@ -0,0 +1,102 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.storage.to;
+
+import com.cloud.agent.api.to.DataObjectType;
+import com.cloud.agent.api.to.DataStoreTO;
+import com.cloud.agent.api.to.DataTO;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.storage.Storage;
+import org.apache.commons.lang3.builder.ReflectionToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringStyle;
+
+public class BackupDeltaTO implements DataTO {
+    private DataStoreTO dataStoreTO;
+
+    private Hypervisor.HypervisorType hypervisorType;
+
+    private String path;
+
+    private String screenshotPath;
+
+    private Storage.ImageFormat format;
+
+    // When set, represents the Backup ID, not the delta ID.
+    private long id = 0;
+
+    public BackupDeltaTO(DataStoreTO dataStoreTO, Hypervisor.HypervisorType hypervisorType, String path) {
+        this.dataStoreTO = dataStoreTO;
+        this.hypervisorType = hypervisorType;
+        this.path = path;
+        this.format = Storage.ImageFormat.QCOW2;
+    }
+
+    public BackupDeltaTO(long id, DataStoreTO dataStoreTO, Hypervisor.HypervisorType hypervisorType, String path) {
+        this(dataStoreTO, hypervisorType, path);
+        this.id = id;
+    }
+
+    @Override
+    public DataObjectType getObjectType() {
+        return DataObjectType.BACKUP;
+    }
+
+    @Override
+    public DataStoreTO getDataStore() {
+        return dataStoreTO;
+    }
+
+    @Override
+    public Hypervisor.HypervisorType getHypervisorType() {
+        return hypervisorType;
+    }
+
+    @Override
+    public String getPath() {
+        return path;
+    }
+
+    @Override
+    public long getId() {
+        return id;
+    }
+
+    public void setId(long id) {
+        this.id = id;
+    }
+
+    public Storage.ImageFormat getFormat() {
+        return this.format;
+    }
+
+    public void setScreenshotPath(String screenshotPath) {
+        this.screenshotPath = screenshotPath;
+    }
+
+    public String getScreenshotPath() {
+        return screenshotPath;
+    }
+
+    public void setPath(String path) {
+        this.path = path;
+    }
+
+    @Override
+    public String toString() {
+        return new ReflectionToStringBuilder(this, ToStringStyle.JSON_STYLE).setExcludeFieldNames("id").toString();
+    }
+}
diff --git a/core/src/main/java/com/cloud/agent/api/storage/SnapshotMergeTreeTO.java b/core/src/main/java/org/apache/cloudstack/storage/to/DeltaMergeTreeTO.java
similarity index 71%
rename from core/src/main/java/com/cloud/agent/api/storage/SnapshotMergeTreeTO.java
rename to core/src/main/java/org/apache/cloudstack/storage/to/DeltaMergeTreeTO.java
index 78f23105e192..143cf6fe22bb 100644
--- a/core/src/main/java/com/cloud/agent/api/storage/SnapshotMergeTreeTO.java
+++ b/core/src/main/java/org/apache/cloudstack/storage/to/DeltaMergeTreeTO.java
@@ -16,28 +16,40 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-package com.cloud.agent.api.storage;
+package org.apache.cloudstack.storage.to;
 
 import com.cloud.agent.api.to.DataTO;
 import org.apache.commons.lang3.builder.ReflectionToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringStyle;
 
 import java.util.List;
 
-public class SnapshotMergeTreeTO {
+public class DeltaMergeTreeTO {
+
+    VolumeObjectTO volumeObjectTO;
     DataTO parent;
     DataTO child;
     List<DataTO> grandChildren;
 
-    public SnapshotMergeTreeTO(DataTO parent, DataTO child, List<DataTO> grandChildren) {
+    public DeltaMergeTreeTO(VolumeObjectTO volumeObjectTO, DataTO parent, DataTO child, List<DataTO> grandChildren) {
+        this.volumeObjectTO = volumeObjectTO;
         this.parent = parent;
         this.child = child;
         this.grandChildren = grandChildren;
     }
 
+    public VolumeObjectTO getVolumeObjectTO() {
+        return volumeObjectTO;
+    }
+
     public DataTO getParent() {
         return parent;
     }
 
+    public void setParent(DataTO parent) {
+        this.parent = parent;
+    }
+
     public DataTO getChild() {
         return child;
     }
@@ -52,6 +64,6 @@ public void addGrandChild(DataTO grandChild) {
 
     @Override
     public String toString() {
-        return ReflectionToStringBuilder.toString(this);
+        return ReflectionToStringBuilder.toString(this, ToStringStyle.JSON_STYLE);
     }
 }
diff --git a/core/src/main/java/org/apache/cloudstack/storage/to/KbossTO.java b/core/src/main/java/org/apache/cloudstack/storage/to/KbossTO.java
new file mode 100644
index 000000000000..0280ffa27a1f
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/storage/to/KbossTO.java
@@ -0,0 +1,101 @@
+package org.apache.cloudstack.storage.to;
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import java.util.List;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreVO;
+import org.apache.commons.lang3.builder.ReflectionToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringStyle;
+
+public class KbossTO {
+
+    private String pathBackupParentOnSecondary;
+    private VolumeObjectTO volumeObjectTO;
+    private String deltaPathOnPrimary;
+    private String parentDeltaPathOnPrimary;
+    private String deltaPathOnSecondary;
+
+    private DeltaMergeTreeTO deltaMergeTreeTO;
+
+    private List<String> vmSnapshotDeltaPaths;
+
+    public KbossTO(VolumeObjectTO volumeObjectTO, List<SnapshotDataStoreVO> snapshotDataStoreVOs) {
+        this.volumeObjectTO = volumeObjectTO;
+        this.vmSnapshotDeltaPaths = snapshotDataStoreVOs.stream().map(SnapshotDataStoreVO::getInstallPath).collect(Collectors.toList());
+    }
+
+    public KbossTO(VolumeObjectTO volumeObjectTO, String deltaPathOnPrimary, String deltaPathOnSecondary) {
+        this.volumeObjectTO = volumeObjectTO;
+        this.deltaPathOnPrimary = deltaPathOnPrimary;
+        this.deltaPathOnSecondary = deltaPathOnSecondary;
+    }
+
+    public String getPathBackupParentOnSecondary() {
+        return pathBackupParentOnSecondary;
+    }
+
+    public VolumeObjectTO getVolumeObjectTO() {
+        return volumeObjectTO;
+    }
+
+    public DeltaMergeTreeTO getDeltaMergeTreeTO() {
+        return deltaMergeTreeTO;
+    }
+
+    public List<String> getVmSnapshotDeltaPaths() {
+        return vmSnapshotDeltaPaths;
+    }
+
+    public String getDeltaPathOnPrimary() {
+        return deltaPathOnPrimary;
+    }
+
+    public String getDeltaPathOnSecondary() {
+        return deltaPathOnSecondary;
+    }
+
+    public String getParentDeltaPathOnPrimary() {
+        return parentDeltaPathOnPrimary;
+    }
+
+    public void setParentDeltaPathOnPrimary(String parentDeltaPathOnPrimary) {
+        this.parentDeltaPathOnPrimary = parentDeltaPathOnPrimary;
+    }
+
+    public void setPathBackupParentOnSecondary(String pathBackupParentOnSecondary) {
+        this.pathBackupParentOnSecondary = pathBackupParentOnSecondary;
+    }
+
+    public void setDeltaMergeTreeTO(DeltaMergeTreeTO deltaMergeTreeTO) {
+        this.deltaMergeTreeTO = deltaMergeTreeTO;
+    }
+
+    public void setDeltaPathOnPrimary(String deltaPathOnPrimary) {
+        this.deltaPathOnPrimary = deltaPathOnPrimary;
+    }
+
+    public void setDeltaPathOnSecondary(String deltaPathOnSecondary) {
+        this.deltaPathOnSecondary = deltaPathOnSecondary;
+    }
+
+    @Override
+    public String toString() {
+        return ReflectionToStringBuilder.toString(this, ToStringStyle.JSON_STYLE);
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/storage/to/VolumeObjectTO.java b/core/src/main/java/org/apache/cloudstack/storage/to/VolumeObjectTO.java
index 827403ac5ef8..df98149faab6 100644
--- a/core/src/main/java/org/apache/cloudstack/storage/to/VolumeObjectTO.java
+++ b/core/src/main/java/org/apache/cloudstack/storage/to/VolumeObjectTO.java
@@ -32,11 +32,12 @@
 import com.cloud.storage.Volume;
 import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;
 
+import java.io.Serializable;
 import java.util.Arrays;
 import java.util.List;
 import java.util.Set;
 
-public class VolumeObjectTO extends DownloadableObjectTO implements DataTO {
+public class VolumeObjectTO extends DownloadableObjectTO implements DataTO, Serializable {
     private String uuid;
     private Volume.Type volumeType;
     private DataStoreTO dataStore;
diff --git a/core/src/main/resources/META-INF/cloudstack/backup/spring-core-lifecycle-backup-context-inheritable.xml b/core/src/main/resources/META-INF/cloudstack/backup/spring-core-lifecycle-backup-context-inheritable.xml
index 175d45e26752..fcbcb18c2bdf 100644
--- a/core/src/main/resources/META-INF/cloudstack/backup/spring-core-lifecycle-backup-context-inheritable.xml
+++ b/core/src/main/resources/META-INF/cloudstack/backup/spring-core-lifecycle-backup-context-inheritable.xml
@@ -29,4 +29,9 @@
         <property name="typeClass" value="org.apache.cloudstack.backup.BackupProvider" />
     </bean>
 
+    <bean class="org.apache.cloudstack.spring.lifecycle.registry.RegistryLifecycle">
+        <property name="registry" ref="internalBackupProvidersRegistry" />
+        <property name="typeClass" value="org.apache.cloudstack.backup.InternalBackupProvider" />
+    </bean>
+
 </beans>
diff --git a/core/src/main/resources/META-INF/cloudstack/core/spring-core-registry-core-context.xml b/core/src/main/resources/META-INF/cloudstack/core/spring-core-registry-core-context.xml
index 0a92e8a637bc..cf43b8527a97 100644
--- a/core/src/main/resources/META-INF/cloudstack/core/spring-core-registry-core-context.xml
+++ b/core/src/main/resources/META-INF/cloudstack/core/spring-core-registry-core-context.xml
@@ -339,6 +339,10 @@
           class="org.apache.cloudstack.spring.lifecycle.registry.ExtensionRegistry">
     </bean>
 
+    <bean id="internalBackupProvidersRegistry"
+          class="org.apache.cloudstack.spring.lifecycle.registry.ExtensionRegistry">
+    </bean>
+
     <bean id="kubernetesServiceHelperRegistry"
           class="org.apache.cloudstack.spring.lifecycle.registry.ExtensionRegistry">
     </bean>
diff --git a/debian/cloudstack-common.postinst b/debian/cloudstack-common.postinst
index aa99edaee064..b11e6a3fe502 100644
--- a/debian/cloudstack-common.postinst
+++ b/debian/cloudstack-common.postinst
@@ -19,14 +19,14 @@
 
 set -e
 CLOUDUTILS_DIR="/usr/share/pyshared/"
-DIST_DIR=$(python3 -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(1))")
 
-if which pycompile >/dev/null 2>&1; then
-    pycompile -p cloudstack-common
-fi
+# distutils was removed in Python 3.12 (Ubuntu 24.04); the Debian/Ubuntu-patched
+# sysconfig 'deb_system' scheme gives the same /usr/lib/python3/dist-packages path.
+DIST_DIR=$(python3 -c "import sysconfig; print(sysconfig.get_path('platlib', 'deb_system'))")
 
-if which pycompile >/dev/null 2>&1; then
-    pycompile -p cloudstack-common /usr/share/cloudstack-common
+if command -v py3compile >/dev/null 2>&1; then
+    py3compile -p cloudstack-common 2>/dev/null || echo "Warning: py3compile failed for cloudstack-common" >&2
+    py3compile -p cloudstack-common /usr/share/cloudstack-common 2>/dev/null || echo "Warning: py3compile failed for cloudstack-common (/usr/share/cloudstack-common)" >&2
 fi
 
 cp $CLOUDUTILS_DIR/cloud_utils.py $DIST_DIR
diff --git a/debian/rules b/debian/rules
index 842fc2408af7..327447823308 100755
--- a/debian/rules
+++ b/debian/rules
@@ -95,6 +95,7 @@ override_dh_auto_install:
 	# nast hack for a couple of configuration files
 	mv $(DESTDIR)/$(SYSCONFDIR)/$(PACKAGE)/server/cloudstack-limits.conf $(DESTDIR)/$(SYSCONFDIR)/security/limits.d/
 	mv $(DESTDIR)/$(SYSCONFDIR)/$(PACKAGE)/server/cloudstack-sudoers $(DESTDIR)/$(SYSCONFDIR)/sudoers.d/$(PACKAGE)
+	sed -i '/requiretty/d' $(DESTDIR)/$(SYSCONFDIR)/sudoers.d/$(PACKAGE)
 	chmod 0440 $(DESTDIR)/$(SYSCONFDIR)/sudoers.d/$(PACKAGE)
 
 	install -D client/target/utilities/bin/cloud-update-xenserver-licenses $(DESTDIR)/usr/bin/cloudstack-update-xenserver-licenses
diff --git a/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/NetworkOrchestrationService.java b/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/NetworkOrchestrationService.java
index 030c1277efe2..109a44488ec4 100644
--- a/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/NetworkOrchestrationService.java
+++ b/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/NetworkOrchestrationService.java
@@ -91,6 +91,10 @@ public interface NetworkOrchestrationService {
     ConfigKey<Integer> NetworkThrottlingRate = new ConfigKey<>("Network", Integer.class, NetworkThrottlingRateCK, "200",
             "Default data transfer rate in megabits per second allowed in network.", true, ConfigKey.Scope.Zone);
 
+    ConfigKey<Integer> DhcpLeaseTimeout = new ConfigKey<>("Network", Integer.class, "dhcp.lease.timeout", "0",
+            "DHCP lease time in seconds for VMs. Use 0 for infinite lease time (default). A non-zero value sets the lease duration in seconds.",
+            true, ConfigKey.Scope.Zone);
+
     ConfigKey<Boolean> PromiscuousMode = new ConfigKey<>("Advanced", Boolean.class, "network.promiscuous.mode", "false",
             "Whether to allow or deny promiscuous mode on NICs for applicable network elements such as for vswitch/dvswitch portgroups.", true);
 
@@ -131,6 +135,9 @@ public interface NetworkOrchestrationService {
                     true,
                     Scope.Global);
 
+    ConfigKey<Integer> VmNetworkThrottlingRate = new ConfigKey<Integer>("Network", Integer.class, "vm.network.throttling.rate", "200",
+            "Default data transfer rate in megabits per second allowed in User vm's default network.", true, ConfigKey.Scope.Zone);
+
     List<? extends Network> setupNetwork(Account owner, NetworkOffering offering, DeploymentPlan plan, String name, String displayText, boolean isDefault)
         throws ConcurrentOperationException;
 
@@ -138,6 +145,8 @@ List<? extends Network> setupNetwork(Account owner, NetworkOffering offering, Ne
         boolean errorIfAlreadySetup, Long domainId, ACLType aclType, Boolean subdomainAccess, Long vpcId, Boolean isDisplayNetworkEnabled)
         throws ConcurrentOperationException;
 
+    boolean isIsolationMethodNetworkExtension(Long networkOfferingId);
+
     void allocate(VirtualMachineProfile vm, LinkedHashMap<? extends Network, List<? extends NicProfile>> networks, Map<String, Map<Integer, String>> extraDhcpOptions) throws InsufficientCapacityException,
         ConcurrentOperationException;
 
diff --git a/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/VolumeOrchestrationService.java b/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/VolumeOrchestrationService.java
index 56624df1346b..141596407fe8 100644
--- a/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/VolumeOrchestrationService.java
+++ b/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/VolumeOrchestrationService.java
@@ -122,7 +122,7 @@ VolumeInfo moveVolume(VolumeInfo volume, long destPoolDcId, Long destPoolPodId,
     DiskProfile allocateRawVolume(Type type, String name, DiskOffering offering, Long size, Long minIops, Long maxIops, VirtualMachine vm, VirtualMachineTemplate template,
             Account owner, Long deviceId, Long kmsKeyId, boolean incrementResourceCount);
 
-    VolumeInfo createVolumeOnPrimaryStorage(VirtualMachine vm, VolumeInfo volume, HypervisorType rootDiskHyperType, StoragePool storagePool) throws NoTransitionException;
+    VolumeInfo createVolumeOnPrimaryStorage(VirtualMachine vm, VolumeInfo volume, HypervisorType rootDiskHyperType, StoragePool storagePool, Long clusterId, Long podId) throws NoTransitionException;
 
     void release(VirtualMachineProfile profile);
 
diff --git a/engine/components-api/src/main/java/com/cloud/network/rules/StaticNatRuleImpl.java b/engine/components-api/src/main/java/com/cloud/network/rules/StaticNatRuleImpl.java
index 4d8270ca078d..980606176024 100644
--- a/engine/components-api/src/main/java/com/cloud/network/rules/StaticNatRuleImpl.java
+++ b/engine/components-api/src/main/java/com/cloud/network/rules/StaticNatRuleImpl.java
@@ -80,10 +80,15 @@ public long getDomainId() {
     }
 
     @Override
-    public long getNetworkId() {
+    public Long getNetworkId() {
         return networkId;
     }
 
+    @Override
+    public Long getVpcId() {
+        return null;
+    }
+
     @Override
     public long getId() {
         return id;
diff --git a/engine/components-api/src/main/java/com/cloud/storage/StorageManager.java b/engine/components-api/src/main/java/com/cloud/storage/StorageManager.java
index 3c62738f9ed5..032fcbe76dce 100644
--- a/engine/components-api/src/main/java/com/cloud/storage/StorageManager.java
+++ b/engine/components-api/src/main/java/com/cloud/storage/StorageManager.java
@@ -195,6 +195,14 @@ public interface StorageManager extends StorageService {
             true,
             ConfigKey.Scope.StoragePool,
             null);
+    ConfigKey<Boolean> XenserverCreateCloneFull = new ConfigKey<>(Boolean.class,
+            "xenserver.create.full.clone",
+            "Storage",
+            "false",
+            "If set to true, creates VMs as full clones on XenServer hypervisor (uses VDI.copy instead of VDI.clone, removing the linked-clone parent relationship).",
+            true,
+            ConfigKey.Scope.StoragePool,
+            null);
     ConfigKey<Boolean> VmwareAllowParallelExecution = new ConfigKey<>(Boolean.class,
             "vmware.allow.parallel.command.execution",
             "Advanced",
@@ -233,6 +241,9 @@ public interface StorageManager extends StorageService {
             "while adding a new Secondary Storage. If the copy operation fails, the system falls back to downloading the template from the source URL.",
             true, ConfigKey.Scope.Zone, null);
 
+    ConfigKey<Integer> AgentMaxDataMigrationWaitTime = new ConfigKey<>("Advanced", Integer.class, "agent.max.data.migration.wait.time", "3600",
+            "The maximum time (in seconds) that the secondary storage data migration command sent to the KVM Agent will be executed before a timeout occurs.", true, ConfigKey.Scope.Cluster);
+
     /**
      * should we execute in sequence not involving any storages?
      * @return true if commands should execute in sequence
diff --git a/engine/components-api/src/main/java/com/cloud/vm/VmWorkDeleteBackup.java b/engine/components-api/src/main/java/com/cloud/vm/VmWorkDeleteBackup.java
new file mode 100644
index 000000000000..b9d2907ef780
--- /dev/null
+++ b/engine/components-api/src/main/java/com/cloud/vm/VmWorkDeleteBackup.java
@@ -0,0 +1,38 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.vm;
+
+public class VmWorkDeleteBackup extends VmWork {
+
+    private long backupId;
+
+    private boolean forced;
+
+    public VmWorkDeleteBackup(long userId, long accountId, long vmId, String handlerName, long backupId, boolean forced) {
+        super(userId, accountId, vmId, handlerName);
+        this.backupId = backupId;
+        this.forced = forced;
+    }
+
+    public long getBackupId() {
+        return backupId;
+    }
+
+    public boolean isForced() {
+        return forced;
+    }
+}
diff --git a/engine/components-api/src/main/java/com/cloud/vm/VmWorkRestoreBackup.java b/engine/components-api/src/main/java/com/cloud/vm/VmWorkRestoreBackup.java
new file mode 100644
index 000000000000..421430cfbe9d
--- /dev/null
+++ b/engine/components-api/src/main/java/com/cloud/vm/VmWorkRestoreBackup.java
@@ -0,0 +1,45 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.vm;
+
+public class VmWorkRestoreBackup extends VmWork {
+
+    private long backupId;
+
+    private boolean quickRestore;
+
+    private Long hostId;
+
+    public VmWorkRestoreBackup(long userId, long accountId, long vmId, String handlerName, long backupId, boolean quickRestore, Long hostId) {
+        super(userId, accountId, vmId, handlerName);
+        this.backupId = backupId;
+        this.quickRestore = quickRestore;
+        this.hostId = hostId;
+    }
+
+    public long getBackupId() {
+        return backupId;
+    }
+
+    public boolean isQuickRestore() {
+        return quickRestore;
+    }
+
+    public Long getHostId() {
+        return hostId;
+    }
+}
diff --git a/engine/components-api/src/main/java/com/cloud/vm/VmWorkRestoreVolumeBackupAndAttach.java b/engine/components-api/src/main/java/com/cloud/vm/VmWorkRestoreVolumeBackupAndAttach.java
new file mode 100644
index 000000000000..a34b11abbdb4
--- /dev/null
+++ b/engine/components-api/src/main/java/com/cloud/vm/VmWorkRestoreVolumeBackupAndAttach.java
@@ -0,0 +1,55 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.vm;
+
+import org.apache.cloudstack.backup.Backup;
+
+public class VmWorkRestoreVolumeBackupAndAttach extends VmWork {
+
+    private long backupId;
+
+    private Backup.VolumeInfo backupVolumeInfo;
+
+    private String hostIp;
+
+    private boolean quickRestore;
+
+    public VmWorkRestoreVolumeBackupAndAttach(long userId, long accountId, long vmId, String handlerName, long backupId, Backup.VolumeInfo backupVolumeInfo,
+            String hostIp, boolean quickRestore) {
+        super(userId, accountId, vmId, handlerName);
+        this.backupId = backupId;
+        this.backupVolumeInfo = backupVolumeInfo;
+        this.hostIp = hostIp;
+        this.quickRestore = quickRestore;
+    }
+
+    public long getBackupId() {
+        return backupId;
+    }
+
+    public Backup.VolumeInfo getBackupVolumeInfo() {
+        return backupVolumeInfo;
+    }
+
+    public String getHostIp() {
+        return hostIp;
+    }
+
+    public boolean isQuickRestore() {
+        return quickRestore;
+    }
+}
diff --git a/engine/components-api/src/main/java/com/cloud/vm/VmWorkTakeBackup.java b/engine/components-api/src/main/java/com/cloud/vm/VmWorkTakeBackup.java
new file mode 100644
index 000000000000..57367d368b86
--- /dev/null
+++ b/engine/components-api/src/main/java/com/cloud/vm/VmWorkTakeBackup.java
@@ -0,0 +1,50 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.vm;
+
+public class VmWorkTakeBackup extends VmWork {
+
+    private long backupId;
+
+    private boolean quiesceVm;
+
+    private boolean isolated;
+
+    public VmWorkTakeBackup(long userId, long accountId, long vmId, long backupId, String handlerName, boolean quiesceVm, boolean isolated) {
+        super(userId, accountId, vmId, handlerName);
+        this.quiesceVm = quiesceVm;
+        this.backupId = backupId;
+        this.isolated = isolated;
+    }
+
+    public boolean isQuiesceVm() {
+        return quiesceVm;
+    }
+
+    public long getBackupId() {
+        return backupId;
+    }
+
+    public boolean isIsolated() {
+        return isolated;
+    }
+
+    @Override
+    public String toString() {
+        return super.toStringAfterRemoveParams(null, null);
+    }
+}
diff --git a/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java b/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java
index a232bdd05daa..364db685c9de 100755
--- a/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java
+++ b/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java
@@ -499,7 +499,7 @@ public class VirtualMachineManagerImpl extends ManagerBase implements VirtualMac
     static final ConfigKey<Integer> ClusterVMMetaDataSyncInterval = new ConfigKey<Integer>("Advanced", Integer.class, "vmmetadata.sync.interval", "180", "Cluster VM metadata sync interval in seconds",
             false);
 
-    static final ConfigKey<Long> VmJobCheckInterval = new ConfigKey<Long>("Advanced",
+    public static final ConfigKey<Long> VmJobCheckInterval = new ConfigKey<Long>("Advanced",
             Long.class, "vm.job.check.interval", "3000",
             "Interval in milliseconds to check if the job is complete", false);
     static final ConfigKey<Long> VmJobTimeout = new ConfigKey<Long>("Advanced",
@@ -1029,7 +1029,7 @@ public Ternary<VMInstanceVO, ReservationContext, ItWorkVO> doInTransaction(final
                                 if (stateTransitTo(vm, Event.StartRequested, null, work.getId())) {
                                     logger.debug("Successfully transitioned to start state for {} reservation id = {}", vm, work.getId());
                                     if (VirtualMachine.Type.User.equals(vm.type) && ResourceCountRunningVMsonly.value()) {
-                                        _resourceLimitMgr.incrementVmResourceCount(owner.getAccountId(), vm.isDisplay(), offering, template);
+                                        _resourceLimitMgr.incrementVmResourceCount(owner.getAccountId(), vm.isDisplay(), offering, template, null);
                                     }
                                     return new Ternary<>(vm, context, work);
                                 }
@@ -1396,6 +1396,7 @@ public void orchestrateStart(final String vmUuid, final Map<VirtualMachineProfil
         Throwable lastKnownError = null;
         boolean canRetry = true;
         ExcludeList avoids = null;
+        long deployedHostId = -1;
         try {
             final Journal journal = start.second().getJournal();
 
@@ -1527,6 +1528,7 @@ public void orchestrateStart(final String vmUuid, final Map<VirtualMachineProfil
                     if (params != null) {
                         Boolean returnAfterVolumePrepare = (Boolean) params.get(VirtualMachineProfile.Param.ReturnAfterVolumePrepare);
                         if (Boolean.TRUE.equals(returnAfterVolumePrepare)) {
+                            deployedHostId = vm.getHostId();
                             logger.info("Returning from VM start command execution for VM {} as requested. Volumes are prepared and ready.", vm.getUuid());
 
                             if (!changeState(vm, Event.AgentReportStopped, destHostId, work, Step.Done)) {
@@ -1715,7 +1717,7 @@ public void orchestrateStart(final String vmUuid, final Map<VirtualMachineProfil
         } finally {
             if (startedVm == null) {
                 if (VirtualMachine.Type.User.equals(vm.type) && ResourceCountRunningVMsonly.value()) {
-                    _resourceLimitMgr.decrementVmResourceCount(owner.getAccountId(), vm.isDisplay(), offering, template);
+                    _resourceLimitMgr.decrementVmResourceCount(owner.getAccountId(), vm.isDisplay(), offering, template, null);
                 }
                 if (canRetry) {
                     try {
@@ -1730,6 +1732,12 @@ public void orchestrateStart(final String vmUuid, final Map<VirtualMachineProfil
             if (planToDeploy != null) {
                 planToDeploy.setAvoids(avoids);
             }
+
+            if (params != null && Boolean.TRUE.equals(params.get(VirtualMachineProfile.Param.ReturnAfterVolumePrepare))) {
+                vm.setHostId(null);
+                vm.setLastHostId(deployedHostId);
+                _vmDao.update(vm.getId(), vm);
+            }
         }
 
         if (startedVm == null) {
@@ -2646,7 +2654,7 @@ public Boolean doInTransaction(TransactionStatus status) throws NoTransitionExce
                     if (result && VirtualMachine.Type.User.equals(vm.type) && ResourceCountRunningVMsonly.value()) {
                         ServiceOfferingVO offering = _offeringDao.findById(vm.getId(), vm.getServiceOfferingId());
                         VMTemplateVO template = _templateDao.findByIdIncludingRemoved(vm.getTemplateId());
-                        _resourceLimitMgr.decrementVmResourceCount(vm.getAccountId(), vm.isDisplay(), offering, template);
+                        _resourceLimitMgr.decrementVmResourceCount(vm.getAccountId(), vm.isDisplay(), offering, template, null);
                     }
                     return result;
                 }
@@ -3543,7 +3551,8 @@ protected void createStoragePoolMappingsForVolumes(VirtualMachineProfile profile
     protected boolean shouldMapVolume(VirtualMachineProfile profile, StoragePoolVO currentPool) {
         boolean isManaged = currentPool.isManaged();
         boolean isNotKvm = HypervisorType.KVM != profile.getHypervisorType();
-        return isNotKvm || isManaged;
+        boolean isClvm = ClvmPoolManager.isClvmPoolType(currentPool.getPoolType());
+        return isNotKvm || isManaged || isClvm;
     }
 
     /**
diff --git a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/DataMigrationUtility.java b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/DataMigrationUtility.java
index 5a8dc3038aa8..1441a9957772 100644
--- a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/DataMigrationUtility.java
+++ b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/DataMigrationUtility.java
@@ -28,9 +28,13 @@
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
+import java.util.stream.Collectors;
 
 import javax.inject.Inject;
 
+import org.apache.cloudstack.backup.Backup;
+import org.apache.cloudstack.backup.InternalBackupJoinVO;
+import org.apache.cloudstack.backup.dao.InternalBackupJoinDao;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataObject;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
 import org.apache.cloudstack.engine.subsystem.api.storage.ObjectInDataStoreStateMachine;
@@ -42,6 +46,7 @@
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeDataFactory;
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
 import org.apache.cloudstack.storage.ImageStoreService;
+import org.apache.cloudstack.storage.backup.BackupObject;
 import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreVO;
 import org.apache.cloudstack.storage.datastore.db.TemplateDataStoreDao;
@@ -89,12 +94,15 @@ public class DataMigrationUtility {
     HostDao hostDao;
     @Inject
     SnapshotDao snapshotDao;
+
+    @Inject
+    InternalBackupJoinDao internalBackupJoinDao;
     /**
      *  This function verifies if the given image store contains data objects that are not in any of the following states:
      *  "Ready" "Allocated", "Destroying", "Destroyed", "Failed". If this is the case, and if the migration policy is complete,
      *  the migration is terminated.
      */
-    public boolean filesReadyToMigrate(Long srcDataStoreId, List<TemplateDataStoreVO> templates, List<SnapshotDataStoreVO> snapshots, List<VolumeDataStoreVO> volumes) {
+    public boolean filesReadyToMigrate(Long srcDataStoreId, List<TemplateDataStoreVO> templates, List<SnapshotDataStoreVO> snapshots, List<VolumeDataStoreVO> volumes, List<InternalBackupJoinVO> backups) {
         State[] validStates = {State.Ready, State.Allocated, State.Destroying, State.Destroyed, State.Failed};
         boolean isReady = true;
         for (TemplateDataStoreVO template : templates) {
@@ -109,14 +117,48 @@ public boolean filesReadyToMigrate(Long srcDataStoreId, List<TemplateDataStoreVO
             isReady &= (Arrays.asList(validStates).contains(volume.getState()));
             logger.trace("volume state: {}", volume.getState());
         }
+        isReady &= checkIfBackupsMigrationIsPossible(backups);
         return isReady;
     }
 
+    private boolean checkIfBackupsMigrationIsPossible(List<InternalBackupJoinVO> backups) {
+        List<Backup.Status> invalidBackupStates = Arrays.asList(Backup.Status.BackingUp, Backup.Status.Restoring);
+        List<Backup.CompressionStatus> invalidBackupCompressionStatus = Arrays.asList(Backup.CompressionStatus.Compressing, Backup.CompressionStatus.FinalizingCompression);
+
+        List<List<BackupObject>> backupChains;
+        Set<Long> backupIdsAlreadyInChain = new HashSet<>();
+
+        for (InternalBackupJoinVO backup : backups) {
+            if (backup.getStatus() == Backup.Status.BackedUp && !backupIdsAlreadyInChain.contains(backup.getId())) {
+                backupChains = createBackupChain(backup);
+                backupChains.forEach(list -> backupIdsAlreadyInChain.add(list.stream().map(BackupObject::getId).findFirst().get()));
+
+                for (List<BackupObject> backupVolumeChain : backupChains) {
+                    BackupObject backupObject = backupVolumeChain.get(0);
+
+                    if (invalidBackupStates.contains(backupObject.getStatus())) {
+                        logger.debug("Migration is not possible because backup {} is in {} state.", backupObject.getUuid(), backupObject.getStatus());
+                        return false;
+                    }
+
+                    if (invalidBackupCompressionStatus.contains(backupObject.getCompressionStatus())) {
+                        logger.debug("Migration is not possible because backup {} is currently being compressed. Current compression status: {}.", backupObject.getUuid(), backupObject.getCompressionStatus());
+                        return false;
+                    }
+                }
+            }
+        }
+
+        return true;
+    }
+
     private boolean filesReadyToMigrate(Long srcDataStoreId) {
         List<TemplateDataStoreVO> templates = templateDataStoreDao.listByStoreId(srcDataStoreId);
         List<SnapshotDataStoreVO> snapshots = snapshotDataStoreDao.listByStoreId(srcDataStoreId, DataStoreRole.Image);
         List<VolumeDataStoreVO> volumes = volumeDataStoreDao.listByStoreId(srcDataStoreId);
-        return filesReadyToMigrate(srcDataStoreId, templates, snapshots, volumes);
+        List<InternalBackupJoinVO> backups = internalBackupJoinDao.listByImageStoreId(srcDataStoreId);
+
+        return filesReadyToMigrate(srcDataStoreId, templates, snapshots, volumes, backups);
     }
 
     protected void checkIfCompleteMigrationPossible(ImageStoreService.MigrationPolicy policy, Long srcDataStoreId) {
@@ -175,19 +217,58 @@ protected List<DataObject> getSortedValidSourcesList(DataStore srcDataStore, Map
 
         return files;
     }
-
     protected List<DataObject> getSortedValidSourcesList(DataStore srcDataStore, Map<DataObject, Pair<List<SnapshotInfo>, Long>> snapshotChains,
-            Map<DataObject, Pair<List<TemplateInfo>, Long>> childTemplates) {
+            Map<DataObject, Pair<List<TemplateInfo>, Long>> childTemplates, Map<DataObject, Pair<List<List<BackupObject>>, Long>> backupChains) {
         List<DataObject> files = new ArrayList<>();
         files.addAll(getAllReadyTemplates(srcDataStore, childTemplates));
         files.addAll(getAllReadySnapshotsAndChains(srcDataStore, snapshotChains));
         files.addAll(getAllReadyVolumes(srcDataStore));
+        files.addAll(getAllReadyBackupsAndChains(srcDataStore, backupChains));
 
         files = sortFilesOnSize(files, snapshotChains);
 
         return files;
     }
 
+    protected List<DataObject> getAllReadyBackupsAndChains(DataStore srcDataStore, Map<DataObject, Pair<List<List<BackupObject>>, Long>> backupChains) {
+        List<InternalBackupJoinVO> backups = internalBackupJoinDao.listByImageStoreId(srcDataStore.getId());
+        return getAllReadyBackupsAndChains(backupChains, backups);
+    }
+
+    private List<DataObject> getAllReadyBackupsAndChains(Map<DataObject, Pair<List<List<BackupObject>>, Long>> backupsChains, List<InternalBackupJoinVO> backups) {
+        Set<Long> backupIdsToMigrate = backups.stream().map(InternalBackupJoinVO::getId).collect(Collectors.toSet());
+        List<List<BackupObject>> backupChains;
+        Set<Long> backupIdsAlreadyInChain = new HashSet<>();
+        List<BackupObject> files = new LinkedList<>();
+
+        for (InternalBackupJoinVO backup : backups) {
+            long backupId = backup.getId();
+
+            if (backup.getStatus() == Backup.Status.BackedUp && !backupIdsAlreadyInChain.contains(backupId)) {
+                backupChains = createBackupChain(backup);
+                backupChains.forEach(list -> backupIdsAlreadyInChain.add(list.stream().map(BackupObject::getId).findFirst().get()));
+                BackupObject parent = backupChains.get(0).get(0);
+                files.add(parent);
+                backupsChains.put(parent, new Pair<>(backupChains, backupChains.stream().map(list -> getTotalChainSize(list.stream()
+                        .filter(back -> backupIdsToMigrate.contains(parent.getId())).collect(Collectors.toList()))
+                ).reduce(Long::sum).get()));
+            }
+        }
+
+        return (List<DataObject>) (List<?>) files;
+    }
+
+    private List<List<BackupObject>> createBackupChain(InternalBackupJoinVO backup) {
+        List<List<BackupObject>> chain = new LinkedList<>();
+        BackupObject backupObject = BackupObject.getBackupObject(backup);
+
+        chain.addAll(backupObject.getParents(backup.getParentId()));
+        chain.add(internalBackupJoinDao.listById(backup.getId()).stream().map(BackupObject::getBackupObject).collect(Collectors.toList()));
+        chain.addAll(backupObject.getChildren());
+
+        return chain;
+    }
+
     protected List<DataObject> sortFilesOnSize(List<DataObject> files, Map<DataObject, Pair<List<SnapshotInfo>, Long>> snapshotChains) {
         Collections.sort(files, new Comparator<DataObject>() {
             @Override
diff --git a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java
index 4262ee701aab..84a397349cec 100644
--- a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java
+++ b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java
@@ -177,6 +177,10 @@
 import com.cloud.network.dao.RemoteAccessVpnDao;
 import com.cloud.network.dao.RemoteAccessVpnVO;
 import com.cloud.network.dao.RouterNetworkDao;
+import org.apache.cloudstack.extension.Extension;
+import org.apache.cloudstack.extension.ExtensionHelper;
+import org.apache.cloudstack.framework.extensions.network.NetworkExtensionElement;
+
 import com.cloud.network.element.AggregatedCommandExecutor;
 import com.cloud.network.element.ConfigDriveNetworkElement;
 import com.cloud.network.element.DhcpServiceProvider;
@@ -313,6 +317,8 @@ public class NetworkOrchestrator extends ManagerBase implements NetworkOrchestra
     @Inject
     NetworkOfferingDetailsDao _ntwkOffDetailsDao;
     @Inject
+    NetworkOfferingServiceMapDao networkOfferingServiceMapDao;
+    @Inject
     AccountGuestVlanMapDao _accountGuestVlanMapDao;
     @Inject
     DataCenterVnetDao _datacenterVnetDao;
@@ -368,6 +374,10 @@ public class NetworkOrchestrator extends ManagerBase implements NetworkOrchestra
     private BGPService bgpService;
     @Inject
     private Ipv6GuestPrefixSubnetNetworkMapDao ipv6GuestPrefixSubnetNetworkMapDao;
+    @Inject
+    protected ExtensionHelper extensionHelper;
+    @Inject
+    private NetworkExtensionElement networkExtensionElement;
 
     @Override
     public List<NetworkGuru> getNetworkGurus() {
@@ -461,6 +471,28 @@ public void setDhcpProviders(final List<DhcpServiceProvider> dhcpProviders) {
 
     HashMap<Long, Long> _lastNetworkIdsToFree = new HashMap<>();
 
+    /**
+     * Returns the full list of network elements to iterate when implementing,
+     * shutting down, or otherwise orchestrating a network.
+     *
+     * <p>The base list ({@link #networkElements}, wired by Spring) is extended
+     * at runtime with one transient {@link NetworkExtensionElement} per
+     * registered {@code NetworkOrchestrator} extension.  This keeps the
+     * Spring bean list free from {@code NetworkExtensionElement} and allows
+     * dynamic discovery of extensions without a restart.</p>
+     */
+    protected List<NetworkElement> getNetworkElementsIncludingExtensions() {
+        List<Extension> extensions = extensionHelper.listExtensionsByType(Extension.Type.NetworkOrchestrator);
+        if (CollectionUtils.isEmpty(extensions)) {
+            return networkElements;
+        }
+        List<NetworkElement> combined = new ArrayList<>(networkElements);
+        for (Extension ext : extensions) {
+            combined.add(networkExtensionElement.withProviderName(ext.getName()));
+        }
+        return combined;
+    }
+
     private void updateRouterDefaultDns(final VirtualMachineProfile vmProfile, final NicProfile nicProfile) {
         if (!Type.DomainRouter.equals(vmProfile.getType()) || !nicProfile.isDefaultNic()) {
             return;
@@ -561,6 +593,7 @@ public boolean configure(final String name, final Map<String, Object> params) th
         defaultVPCOffProviders.put(Service.StaticNat, defaultProviders);
         defaultVPCOffProviders.put(Service.PortForwarding, defaultProviders);
         defaultVPCOffProviders.put(Service.Vpn, defaultProviders);
+        defaultVPCOffProviders.put(Service.Firewall, defaultProviders);
 
         Transaction.execute(new TransactionCallbackNoReturn() {
             @Override
@@ -776,7 +809,7 @@ public List<? extends Network> setupNetwork(final Account owner, final NetworkOf
 
             long related = -1;
 
-            for (final NetworkGuru guru : networkGurus) {
+            for (final NetworkGuru guru : getDesignNetworkGurus(offering)) {
                 final Network network = guru.design(offering, plan, predefined, name, vpcId, owner);
                 if (network == null) {
                     continue;
@@ -852,6 +885,46 @@ public void doInTransactionWithoutResult(final TransactionStatus status) {
         }
     }
 
+    private List<NetworkGuru> getDesignNetworkGurus(final NetworkOffering offering) {
+        if (!isIsolationMethodNetworkExtension(offering.getId())) {
+            return networkGurus;
+        }
+
+        List<NetworkGuru> extensionGurus = networkGurus.stream()
+                .filter(guru -> ExtensionHelper.NETWORK_EXTENSION_GURU_NAME.equals(guru.getName()))
+                .collect(Collectors.toList());
+        if (CollectionUtils.isNotEmpty(extensionGurus)) {
+            return extensionGurus;
+        }
+
+        logger.warn("Network offering {} requests {}={}, but {} is not registered; using default guru ordering",
+                offering.getUuid(), ExtensionHelper.NETWORK_ISOLATION_METHOD_DETAIL_KEY,
+                ExtensionHelper.NETWORK_EXTENSION_ISOLATION_METHOD, ExtensionHelper.NETWORK_EXTENSION_GURU_NAME);
+        return networkGurus;
+    }
+
+    @Override
+    public boolean isIsolationMethodNetworkExtension(final Long networkOfferingId) {
+        if (networkOfferingId == null) {
+            return false;
+        }
+
+        List<String> providers = networkOfferingServiceMapDao.getDistinctProviders(networkOfferingId);
+        if (CollectionUtils.isEmpty(providers)) {
+            return false;
+        }
+
+        for (String providerName : providers) {
+            if (!extensionHelper.isNetworkExtensionProvider(providerName)) {
+                continue;
+            }
+            if (extensionHelper.usesNetworkExtensionIsolation(providerName)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
     @NotNull
     private static NetworkVO getNetworkVO(long id, final NetworkOffering offering, final DeploymentPlan plan, final Network predefined,
                                           Network network, final NetworkGuru guru, final Account owner,
@@ -1593,6 +1666,9 @@ public Pair<NetworkGuru, NetworkVO> implementNetwork(final long networkId, final
             // implement network elements and re-apply all the network rules
             implementNetworkElementsAndResources(dest, context, network, offering);
 
+            // reload network after implementing the network
+            network = _networksDao.findById(networkId);
+
             long dcId = dest.getDataCenter().getId();
             if (networkMeetsPersistenceCriteria(network, offering, false)) {
                 setupPersistentNetwork(network, offering, dcId);
@@ -1686,7 +1762,8 @@ public void implementNetworkElementsAndResources(final DeployDestination dest, f
             }
         }
 
-        for (final NetworkElement element : networkElements) {
+        List<NetworkElement> allNetworkElements = getNetworkElementsIncludingExtensions();
+        for (final NetworkElement element : allNetworkElements) {
             if (element instanceof AggregatedCommandExecutor && providersToImplement.contains(element.getProvider())) {
                 ((AggregatedCommandExecutor) element).prepareAggregatedExecution(network, dest);
             }
@@ -1703,7 +1780,7 @@ public void implementNetworkElementsAndResources(final DeployDestination dest, f
                 ex.addProxyObject(_entityMgr.findById(DataCenter.class, network.getDataCenterId()).getUuid());
                 throw ex;
             }
-            for (final NetworkElement element : networkElements) {
+            for (final NetworkElement element : allNetworkElements) {
                 if (element instanceof AggregatedCommandExecutor && providersToImplement.contains(element.getProvider())) {
                     if (!((AggregatedCommandExecutor) element).completeAggregatedExecution(network, dest)) {
                         logger.warn("Failed to re-program the network as a part of network {} implement due to aggregated commands execution failure!", network);
@@ -1717,7 +1794,7 @@ public void implementNetworkElementsAndResources(final DeployDestination dest, f
             }
             reconfigureAndApplyStaticRouteForVpcVpn(network);
         } finally {
-            for (final NetworkElement element : networkElements) {
+            for (final NetworkElement element : allNetworkElements) {
                 if (element instanceof AggregatedCommandExecutor && providersToImplement.contains(element.getProvider())) {
                     ((AggregatedCommandExecutor) element).cleanupAggregatedExecution(network, dest);
                 }
@@ -1738,7 +1815,7 @@ private void reconfigureAndApplyStaticRouteForVpcVpn(Network network) {
 
     private void implementNetworkElements(final DeployDestination dest, final ReservationContext context, final Network network, final NetworkOffering offering, final List<Provider> providersToImplement)
             throws ConcurrentOperationException, ResourceUnavailableException, InsufficientCapacityException {
-        for (NetworkElement element : networkElements) {
+        for (NetworkElement element : getNetworkElementsIncludingExtensions()) {
             if (providersToImplement.contains(element.getProvider())) {
                 if (!_networkModel.isProviderEnabledInPhysicalNetwork(_networkModel.getPhysicalNetworkId(network), element.getProvider().getName())) {
                     // The physicalNetworkId will not get translated into a uuid by the response serializer,
@@ -2031,7 +2108,7 @@ public void doInTransactionWithoutResult(TransactionStatus status) {
     @Override
     public void configureUpdateInSequence(Network network) {
         List<Provider> providers = getNetworkProviders(network.getId());
-        for (NetworkElement element : networkElements) {
+        for (NetworkElement element : getNetworkElementsIncludingExtensions()) {
             if (providers.contains(element.getProvider())) {
                 if (element instanceof RedundantResource) {
                     ((RedundantResource) element).configureResource(network);
@@ -2044,7 +2121,7 @@ public void configureUpdateInSequence(Network network) {
     public int getResourceCount(Network network) {
         List<Provider> providers = getNetworkProviders(network.getId());
         int resourceCount = 0;
-        for (NetworkElement element : networkElements) {
+        for (NetworkElement element : getNetworkElementsIncludingExtensions()) {
             if (providers.contains(element.getProvider())) {
                 //currently only one element implements the redundant resource interface
                 if (element instanceof RedundantResource) {
@@ -2075,7 +2152,7 @@ public void configureExtraDhcpOptions(Network network, long nicId) {
     @Override
     public void finalizeUpdateInSequence(Network network, boolean success) {
         List<Provider> providers = getNetworkProviders(network.getId());
-        for (NetworkElement element : networkElements) {
+        for (NetworkElement element : getNetworkElementsIncludingExtensions()) {
             if (providers.contains(element.getProvider())) {
                 //currently only one element implements the redundant resource interface
                 if (element instanceof RedundantResource) {
@@ -2102,7 +2179,7 @@ public void setHypervisorHostname(VirtualMachineProfile vm, DeployDestination de
     }
 
     private void setHypervisorHostnameInNetwork(VirtualMachineProfile vm, DeployDestination dest, Network network, NicProfile profile, boolean migrationSuccessful) {
-        for (final NetworkElement element : networkElements) {
+        for (final NetworkElement element : getNetworkElementsIncludingExtensions()) {
             if (_networkModel.areServicesSupportedInNetwork(network.getId(), Service.UserData) && element instanceof UserDataServiceProvider
                 && (element instanceof ConfigDriveNetworkElement && !migrationSuccessful || element instanceof VirtualRouterElement && migrationSuccessful)) {
                 String errorMsg = String.format("Failed to add hypervisor host name while applying the userdata during the migration of VM %s, " +
@@ -2230,7 +2307,7 @@ public NicProfile prepareNic(final VirtualMachineProfile vmProfile, final Deploy
         updateNic(nic, network, 1);
 
         final List<Provider> providersToImplement = getNetworkProviders(network.getId());
-        for (final NetworkElement element : networkElements) {
+        for (final NetworkElement element : getNetworkElementsIncludingExtensions()) {
             if (providersToImplement.contains(element.getProvider())) {
                 if (!_networkModel.isProviderEnabledInPhysicalNetwork(_networkModel.getPhysicalNetworkId(network), element.getProvider().getName())) {
                     throw new CloudRuntimeException("Service provider " + element.getProvider().getName() + " either doesn't exist or is not enabled in physical network id: "
@@ -2285,7 +2362,7 @@ public void prepareNicForMigration(final VirtualMachineProfile vm, final DeployD
             }
 
             final List<Provider> providersToImplement = getNetworkProviders(network.getId());
-            for (final NetworkElement element : networkElements) {
+            for (final NetworkElement element : getNetworkElementsIncludingExtensions()) {
                 if (providersToImplement.contains(element.getProvider())) {
                     if (!_networkModel.isProviderEnabledInPhysicalNetwork(_networkModel.getPhysicalNetworkId(network), element.getProvider().getName())) {
                         throw new CloudRuntimeException("Service provider " + element.getProvider().getName() + " either doesn't exist or is not enabled in physical network id: "
@@ -2329,7 +2406,7 @@ public void prepareAllNicsForMigration(final VirtualMachineProfile vm, final Dep
                 }
             }
             final List<Provider> providersToImplement = getNetworkProviders(network.getId());
-            for (final NetworkElement element : networkElements) {
+            for (final NetworkElement element : getNetworkElementsIncludingExtensions()) {
                 if (providersToImplement.contains(element.getProvider())) {
                     if (!_networkModel.isProviderEnabledInPhysicalNetwork(_networkModel.getPhysicalNetworkId(network), element.getProvider().getName())) {
                         throw new CloudRuntimeException(String.format("Service provider %s either doesn't exist or is not enabled in physical network: %s",
@@ -2411,7 +2488,7 @@ public void commitNicForMigration(final VirtualMachineProfile src, final Virtual
             }
 
             final List<Provider> providersToImplement = getNetworkProviders(network.getId());
-            for (final NetworkElement element : networkElements) {
+            for (final NetworkElement element : getNetworkElementsIncludingExtensions()) {
                 if (providersToImplement.contains(element.getProvider())) {
                     if (!_networkModel.isProviderEnabledInPhysicalNetwork(_networkModel.getPhysicalNetworkId(network), element.getProvider().getName())) {
                         throw new CloudRuntimeException("Service provider " + element.getProvider().getName() + " either doesn't exist or is not enabled in physical network id: "
@@ -2447,7 +2524,7 @@ public void rollbackNicForMigration(final VirtualMachineProfile src, final Virtu
             }
 
             final List<Provider> providersToImplement = getNetworkProviders(network.getId());
-            for (final NetworkElement element : networkElements) {
+            for (final NetworkElement element : getNetworkElementsIncludingExtensions()) {
                 if (providersToImplement.contains(element.getProvider())) {
                     if (!_networkModel.isProviderEnabledInPhysicalNetwork(_networkModel.getPhysicalNetworkId(network), element.getProvider().getName())) {
                         throw new CloudRuntimeException("Service provider " + element.getProvider().getName() + " either doesn't exist or is not enabled in physical network id: "
@@ -2534,7 +2611,7 @@ public Pair<Network, NicProfile> doInTransaction(final TransactionStatus status)
             final Network network = networkToRelease.first();
             final NicProfile profile = networkToRelease.second();
             final List<Provider> providersToImplement = getNetworkProviders(network.getId());
-            for (final NetworkElement element : networkElements) {
+            for (final NetworkElement element : getNetworkElementsIncludingExtensions()) {
                 if (providersToImplement.contains(element.getProvider())) {
                     logger.debug("Asking {} to release {}", element.getName(), profile);
                     //NOTE: Context appear to never be used in release method
@@ -2597,7 +2674,7 @@ protected void removeNic(final VirtualMachineProfile vm, final NicVO nic) {
          */
         if (nic.getReservationStrategy() == Nic.ReservationStrategy.Create) {
             final List<Provider> providersToImplement = getNetworkProviders(network.getId());
-            for (final NetworkElement element : networkElements) {
+            for (final NetworkElement element : getNetworkElementsIncludingExtensions()) {
                 if (providersToImplement.contains(element.getProvider())) {
                     logger.debug("Asking {} to release {}, according to the reservation strategy {}.", element.getName(), nic, nic.getReservationStrategy());
                     try {
@@ -3328,7 +3405,7 @@ public boolean shutdownNetworkElementsAndResources(final ReservationContext cont
 
         // 2) Shutdown all the network elements
         boolean success = true;
-        for (final NetworkElement element : networkElements) {
+        for (final NetworkElement element : getNetworkElementsIncludingExtensions()) {
             if (providersToShutdown.contains(element.getProvider())) {
                 try {
                     logger.debug("Sending network shutdown to {}", element.getName());
@@ -3439,7 +3516,7 @@ public boolean destroyNetwork(final long networkId, final ReservationContext con
 
         // get providers to destroy
         final List<Provider> providersToDestroy = getNetworkProviders(network.getId());
-        for (final NetworkElement element : networkElements) {
+        for (final NetworkElement element : getNetworkElementsIncludingExtensions()) {
             if (providersToDestroy.contains(element.getProvider())) {
                 try {
                     logger.debug("Sending destroy to {}", element);
@@ -3810,7 +3887,7 @@ public boolean areRoutersRunning(final List<? extends VirtualRouter> routers) {
     public void cleanupNicDhcpDnsEntry(Network network, VirtualMachineProfile vmProfile, NicProfile nicProfile) {
 
         final List<Provider> networkProviders = getNetworkProviders(network.getId());
-        for (final NetworkElement element : networkElements) {
+        for (final NetworkElement element : getNetworkElementsIncludingExtensions()) {
             if (networkProviders.contains(element.getProvider())) {
                 if (!_networkModel.isProviderEnabledInPhysicalNetwork(_networkModel.getPhysicalNetworkId(network), element.getProvider().getName())) {
                     throw new CloudRuntimeException("Service provider " + element.getProvider().getName() + " either doesn't exist or is not enabled in physical network id: "
@@ -3827,6 +3904,17 @@ public void cleanupNicDhcpDnsEntry(Network network, VirtualMachineProfile vmProf
                         }
                     }
                 }
+                if (vmProfile.getType() == Type.User && element.getProvider() != null) {
+                    if (_networkModel.areServicesSupportedInNetwork(network.getId(), Service.Dns)
+                            && _networkModel.isProviderSupportServiceInNetwork(network.getId(), Service.Dns, element.getProvider()) && element instanceof DnsServiceProvider) {
+                        final DnsServiceProvider sp = (DnsServiceProvider) element;
+                        try {
+                            sp.removeDnsEntry(network, nicProfile, vmProfile);
+                        } catch (ResourceUnavailableException e) {
+                            logger.error("Failed to remove dns entry due to: ", e);
+                        }
+                    }
+                }
             }
         }
     }
@@ -3846,7 +3934,7 @@ public void cleanupNicDhcpDnsEntry(Network network, VirtualMachineProfile vmProf
      * @throws InsufficientCapacityException
      */
     private boolean rollingRestartRouters(final NetworkVO network, final NetworkOffering offering, final DeployDestination dest, final ReservationContext context) throws ResourceUnavailableException, ConcurrentOperationException, InsufficientCapacityException {
-        if (!NetworkOrchestrationService.RollingRestartEnabled.value()) {
+        if (!isRollingRestartSupport(network)) {
             if (shutdownNetworkElementsAndResources(context, true, network)) {
                 implementNetworkElementsAndResources(dest, context, network, offering);
                 return true;
@@ -3894,6 +3982,20 @@ private boolean rollingRestartRouters(final NetworkVO network, final NetworkOffe
         return areRoutersRunning(routerDao.findByNetwork(network.getId()));
     }
 
+    private boolean isRollingRestartSupport(final NetworkVO network) {
+        if (!NetworkOrchestrator.RollingRestartEnabled.value()) {
+             return false;
+        }
+        List<NetworkServiceMapVO> services = _ntwkSrvcDao.getServicesInNetwork(network.getId());
+        for (NetworkServiceMapVO service : services) {
+            NetworkElement element = _networkModel.getElementImplementingProvider(service.getProvider());
+            if (element == null || !element.rollingRestartSupported()) {
+                return false;
+            }
+        }
+        return true;
+    }
+
     private void setRestartRequired(final NetworkVO network, final boolean restartRequired) {
         logger.debug("Marking network {} with restartRequired={}", network, restartRequired);
         network.setRestartRequired(restartRequired);
@@ -4455,6 +4557,12 @@ public Map<String, String> finalizeServicesAndProvidersForNetwork(final NetworkO
 
             if (provider == null) {
                 provider = _networkModel.getDefaultUniqueProviderForService(service).getName();
+            } else {
+                final Provider resolvedProvider = _networkModel.resolveProvider(provider);
+                if (resolvedProvider == null) {
+                    throw new InvalidParameterValueException("Invalid provider " + provider + " configured for service " + service);
+                }
+                provider = resolvedProvider.getName();
             }
 
             // check that provider is supported
@@ -4480,7 +4588,10 @@ private List<Provider> getNetworkProviders(final long networkId) {
         final List<String> providerNames = _ntwkSrvcDao.getDistinctProviders(networkId);
         final List<Provider> providers = new ArrayList<>();
         for (final String providerName : providerNames) {
-            providers.add(Network.Provider.getProvider(providerName));
+            final Provider provider = _networkModel.resolveProvider(providerName);
+            if (provider != null) {
+                providers.add(provider);
+            }
         }
 
         return providers;
@@ -4646,7 +4757,7 @@ private Map<Service, Set<Provider>> getServiceProvidersMap(final long networkId)
             if (providers == null) {
                 providers = new HashSet<>();
             }
-            providers.add(Provider.getProvider(nsm.getProvider()));
+            providers.add(_networkModel.resolveProvider(nsm.getProvider()));
             map.put(Service.getService(nsm.getService()), providers);
         }
         return map;
@@ -4931,10 +5042,10 @@ public void unmanageNics(VirtualMachineProfile vm) {
 
     @Override
     public void expungeLbVmRefs(List<Long> vmIds, Long batchSize) {
-        if (CollectionUtils.isEmpty(networkElements) || CollectionUtils.isEmpty(vmIds)) {
+        if (CollectionUtils.isEmpty(vmIds)) {
             return;
         }
-        for (NetworkElement element : networkElements) {
+        for (NetworkElement element : getNetworkElementsIncludingExtensions()) {
             if (element instanceof LoadBalancingServiceProvider) {
                 LoadBalancingServiceProvider lbProvider = (LoadBalancingServiceProvider)element;
                 lbProvider.expungeLbVmRefs(vmIds, batchSize);
@@ -4955,7 +5066,7 @@ public String getConfigComponentName() {
     @Override
     public ConfigKey<?>[] getConfigKeys() {
         return new ConfigKey<?>[]{NetworkGcWait, NetworkGcInterval, NetworkLockTimeout, DeniedRoutes,
-                GuestDomainSuffix, NetworkThrottlingRate, MinVRVersion,
+                GuestDomainSuffix, NetworkThrottlingRate, VmNetworkThrottlingRate, MinVRVersion, DhcpLeaseTimeout,
                 PromiscuousMode, MacAddressChanges, ForgedTransmits, MacLearning, RollingRestartEnabled,
                 TUNGSTEN_ENABLED, NSX_ENABLED, NETRIS_ENABLED, NETWORK_LB_HAPROXY_MAX_CONN,
                 NETWORK_LB_HAPROXY_IDLE_TIMEOUT};
diff --git a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/StorageOrchestrator.java b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/StorageOrchestrator.java
index 933b4e0c5ce6..403e83bccf99 100644
--- a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/StorageOrchestrator.java
+++ b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/StorageOrchestrator.java
@@ -25,9 +25,13 @@
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Map;
+import java.util.Random;
 import java.util.concurrent.ArrayBlockingQueue;
 import java.util.concurrent.Callable;
+import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.ExecutionException;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
 import java.util.concurrent.Future;
 import java.util.concurrent.ThreadPoolExecutor;
 import java.util.concurrent.TimeUnit;
@@ -36,10 +40,22 @@
 import javax.inject.Inject;
 import javax.naming.ConfigurationException;
 
+import com.cloud.agent.AgentManager;
+import com.cloud.agent.api.MigrateBackupsBetweenSecondaryStoragesCommand;
+import com.cloud.agent.api.MigrateBetweenSecondaryStoragesCommandAnswer;
 import com.cloud.dc.dao.DataCenterDao;
+import com.cloud.exception.AgentUnavailableException;
+import com.cloud.exception.OperationTimedoutException;
+import com.cloud.host.HostVO;
+import com.cloud.host.dao.HostDao;
+import com.cloud.hypervisor.Hypervisor;
 import com.cloud.storage.dao.VMTemplateDao;
 import com.cloud.template.TemplateManager;
+import com.cloud.utils.db.Transaction;
+import com.cloud.utils.db.TransactionCallback;
 import org.apache.cloudstack.api.response.MigrationResponse;
+import org.apache.cloudstack.backup.BackupDetailVO;
+import org.apache.cloudstack.backup.dao.BackupDetailsDao;
 import org.apache.cloudstack.engine.orchestration.service.StorageOrchestrationService;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataObject;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
@@ -57,6 +73,7 @@
 import org.apache.cloudstack.framework.config.Configurable;
 import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
 import org.apache.cloudstack.storage.ImageStoreService.MigrationPolicy;
+import org.apache.cloudstack.storage.backup.BackupObject;
 import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreVO;
 import org.apache.cloudstack.storage.datastore.db.TemplateDataStoreDao;
@@ -115,6 +132,12 @@ public class StorageOrchestrator extends ManagerBase implements StorageOrchestra
     TemplateDataFactory templateDataFactory;
     @Inject
     DataCenterDao dcDao;
+    @Inject
+    AgentManager agentManager;
+    @Inject
+    HostDao hostDao;
+    @Inject
+    BackupDetailsDao backupDetailDao;
 
 
     ConfigKey<Double> ImageStoreImbalanceThreshold = new ConfigKey<>("Advanced", Double.class,
@@ -128,6 +151,7 @@ public class StorageOrchestrator extends ManagerBase implements StorageOrchestra
 
     private final Map<Long, ThreadPoolExecutor> zoneExecutorMap = new HashMap<>();
     private final Map<Long, Integer> zonePendingWorkCountMap = new HashMap<>();
+    private final Map<Long, ExecutorService> zoneKvmIncrementalExecutorMap = new ConcurrentHashMap<>();
 
     @Override
     public String getConfigComponentName() {
@@ -171,7 +195,9 @@ public MigrationResponse migrateData(Long srcDataStoreId, List<Long> destDatasto
         DataStore srcDatastore = dataStoreManager.getDataStore(srcDataStoreId, DataStoreRole.Image);
         Map<DataObject, Pair<List<SnapshotInfo>, Long>> snapshotChains = new HashMap<>();
         Map<DataObject, Pair<List<TemplateInfo>, Long>> childTemplates = new HashMap<>();
-        files = migrationHelper.getSortedValidSourcesList(srcDatastore, snapshotChains, childTemplates);
+        Map<DataObject, Pair<List<List<BackupObject>>, Long>> backupChains = new HashMap<>();
+        files = migrationHelper.getSortedValidSourcesList(srcDatastore, snapshotChains, childTemplates, backupChains);
+
 
         if (files.isEmpty()) {
             return new MigrationResponse(String.format("No files in Image store: %s to migrate", srcDatastore), migrationPolicy.toString(), true);
@@ -227,7 +253,7 @@ public MigrationResponse migrateData(Long srcDataStoreId, List<Long> destDatasto
             }
 
             if (shouldMigrate(chosenFileForMigration, srcDatastore.getId(), destDatastoreId, storageCapacities, snapshotChains, childTemplates, migrationPolicy)) {
-                storageCapacities = migrateAway(chosenFileForMigration, storageCapacities, snapshotChains, childTemplates, srcDatastore, destDatastoreId, futures);
+                storageCapacities = migrateAway(chosenFileForMigration, storageCapacities, snapshotChains, childTemplates, backupChains, srcDatastore, destDatastoreId, futures);
             } else {
                 if (migrationPolicy == MigrationPolicy.BALANCE) {
                     continue;
@@ -256,7 +282,7 @@ public MigrationResponse migrateResources(Long srcImgStoreId, Long destImgStoreI
         List<TemplateDataStoreVO> templates = templateDataStoreDao.listByStoreIdAndTemplateIds(srcImgStoreId, templateIdList);
         List<SnapshotDataStoreVO> snapshots = snapshotDataStoreDao.listByStoreAndSnapshotIds(srcImgStoreId, DataStoreRole.Image, snapshotIdList);
 
-        if (!migrationHelper.filesReadyToMigrate(srcImgStoreId, templates, snapshots, Collections.emptyList())) {
+        if (!migrationHelper.filesReadyToMigrate(srcImgStoreId, templates, snapshots, Collections.emptyList(), Collections.emptyList())) {
             throw new CloudRuntimeException("Migration failed as there are data objects which are not Ready - i.e, they may be in Migrating, creating, copying, etc. states");
         }
         files = migrationHelper.getSortedValidSourcesList(srcDatastore, snapshotChains, childTemplates, templates, snapshots);
@@ -291,7 +317,7 @@ public MigrationResponse migrateResources(Long srcImgStoreId, Long destImgStoreI
             }
 
             if (storageCapacityBelowThreshold(storageCapacities, destImgStoreId)) {
-                storageCapacities = migrateAway(chosenFileForMigration, storageCapacities, snapshotChains, childTemplates, srcDatastore, destImgStoreId, futures);
+                storageCapacities = migrateAway(chosenFileForMigration, storageCapacities, snapshotChains, childTemplates, null, srcDatastore, destImgStoreId, futures);
             } else {
                 message = "Migration failed. Destination store doesn't have enough capacity for migration";
                 success = false;
@@ -355,15 +381,89 @@ protected Map<Long, Pair<Long, Long>> migrateAway(
             Map<DataObject,
             Pair<List<SnapshotInfo>, Long>> snapshotChains,
             Map<DataObject, Pair<List<TemplateInfo>, Long>> templateChains,
+            Map<DataObject, Pair<List<List<BackupObject>>, Long>> backupChains,
             DataStore srcDatastore,
             Long destDatastoreId,
             List<Future<DataObjectResult>> futures) {
 
         Long fileSize = migrationHelper.getFileSize(chosenFileForMigration, snapshotChains, templateChains);
         storageCapacities = assumeMigrate(storageCapacities, srcDatastore.getId(), destDatastoreId, fileSize);
+        DataStore destDataStore = dataStoreManager.getDataStore(destDatastoreId, DataStoreRole.Image);
+
+        boolean isKvmIncrementalBackup = backupChains != null && chosenFileForMigration instanceof BackupObject && backupChains.containsKey(chosenFileForMigration);
+
+        if (isKvmIncrementalBackup) {
+            MigrateKvmIncrementalBackupTask task = new MigrateKvmIncrementalBackupTask(chosenFileForMigration, backupChains, srcDatastore, destDataStore);
+            futures.add(submitKvmIncrementalMigration(srcDatastore.getScope().getScopeId(), task));
+            logger.debug("Incremental backup migration {} submitted to incremental pool.", chosenFileForMigration.getUuid());
+        } else {
+            createMigrateDataTask(chosenFileForMigration, snapshotChains, templateChains, srcDatastore, destDataStore, futures);
+        }
+
+        return storageCapacities;
+    }
+
+    private void migrateKvmIncrementalBackupChain(DataObject chosenFileForMigration, Map<DataObject, Pair<List<List<BackupObject>>, Long>> backupChains, DataStore srcDatastore, DataStore destDataStore) {
+        Transaction.execute((TransactionCallback<Boolean>) status -> {
+            MigrateBetweenSecondaryStoragesCommandAnswer answer = null;
+
+            try {
+                List<List<BackupObject>> backupChain = backupChains.get(chosenFileForMigration).first();
+                MigrateBackupsBetweenSecondaryStoragesCommand migrateBetweenSecondaryStoragesCmd = new MigrateBackupsBetweenSecondaryStoragesCommand(backupChain.stream().map(list -> list.stream().map(BackupObject::getTO).collect(Collectors.toList()))
+                        .collect(Collectors.toList()), srcDatastore.getTO(), destDataStore.getTO());
+
+                HostVO host = getAvailableHost(((BackupObject) chosenFileForMigration).getZoneId());
+                if (host == null) {
+                    throw new CloudRuntimeException("No hosts found to send migrate command.");
+                }
+
+                migrateBetweenSecondaryStoragesCmd.setWait(StorageManager.AgentMaxDataMigrationWaitTime.valueIn(host.getClusterId()));
+                answer = (MigrateBetweenSecondaryStoragesCommandAnswer) agentManager.send(host.getId(), migrateBetweenSecondaryStoragesCmd);
+                if (answer == null || !answer.getResult()) {
+                    logger.warn("Unable to migrate backups [{}].", backupChain);
+                    throw new CloudRuntimeException("Unable to migrate KVM incremental backups to another secondary storage");
+                }
+
+            } catch (final OperationTimedoutException | AgentUnavailableException e) {
+                throw new CloudRuntimeException("Error while migrating KVM incremental backup chain. Check the logs for more information.", e);
+            } finally {
+                if (answer != null) {
+                    updateBackupsReference(destDataStore, answer);
+                }
+            }
+            return answer.getResult();
+        });
+    }
+
+    private void updateBackupsReference(DataStore destDataStore, MigrateBetweenSecondaryStoragesCommandAnswer answer) {
+        for (Pair<Long, String> backupIdAndUpdatedCheckpointPath : answer.getMigratedResources()) {
+            Long backupId = backupIdAndUpdatedCheckpointPath.first();
+            BackupDetailVO backupDetail = backupDetailDao.findDetail(backupId, BackupDetailsDao.IMAGE_STORE_ID);
+            String destDataStoreId = String.valueOf(destDataStore.getId());
+
+            if (backupDetail == null) {
+                logger.warn("No details found for backup [{}]. Creating new entry with image store ID [{}].", backupId, destDataStoreId);
+                backupDetailDao.addDetail(backupId, BackupDetailsDao.IMAGE_STORE_ID, destDataStoreId, false);
+                continue;
+            }
+
+            backupDetail.setValue(destDataStoreId);
+            backupDetailDao.update(backupDetail.getId(), backupDetail);
+        }
+    }
 
-        MigrateDataTask task = new MigrateDataTask(chosenFileForMigration, srcDatastore, dataStoreManager.getDataStore(destDatastoreId, DataStoreRole.Image));
-        if (chosenFileForMigration instanceof SnapshotInfo ) {
+    private HostVO getAvailableHost(long zoneId) throws AgentUnavailableException, OperationTimedoutException {
+        List<HostVO> hosts = hostDao.listByDataCenterIdAndHypervisorType(zoneId, Hypervisor.HypervisorType.KVM);
+        if (CollectionUtils.isNotEmpty(hosts)) {
+            return hosts.get(new Random().nextInt(hosts.size()));
+        }
+
+        return null;
+    }
+
+    private void createMigrateDataTask(DataObject chosenFileForMigration, Map<DataObject, Pair<List<SnapshotInfo>, Long>> snapshotChains, Map<DataObject, Pair<List<TemplateInfo>, Long>> templateChains, DataStore srcDatastore, DataStore destDataStore, List<Future<DataObjectResult>> futures) {
+        MigrateDataTask task = new MigrateDataTask(chosenFileForMigration, srcDatastore, destDataStore);
+        if (chosenFileForMigration instanceof SnapshotInfo) {
             task.setSnapshotChains(snapshotChains);
         }
         if (chosenFileForMigration instanceof TemplateInfo) {
@@ -371,7 +471,6 @@ protected Map<Long, Pair<Long, Long>> migrateAway(
         }
         futures.add(submit(srcDatastore.getScope().getScopeId(), task));
         logger.debug("Migration of {}: {} is initiated.", chosenFileForMigration.getType().name(), chosenFileForMigration.getUuid());
-        return storageCapacities;
     }
 
     protected <T> Future<T> submit(Long zoneId, Callable<T> task) {
@@ -390,6 +489,13 @@ protected <T> Future<T> submit(Long zoneId, Callable<T> task) {
 
     }
 
+    protected synchronized <T> Future<T> submitKvmIncrementalMigration(Long zoneId, Callable<T> task) {
+        if (!zoneKvmIncrementalExecutorMap.containsKey(zoneId)) {
+            zoneKvmIncrementalExecutorMap.put(zoneId, Executors.newSingleThreadExecutor());
+        }
+        return zoneKvmIncrementalExecutorMap.get(zoneId).submit(task);
+    }
+
     protected void scaleExecutorIfNecessary(Long zoneId) {
         long activeSsvms = migrationHelper.activeSSVMCount(zoneId);
         long totalJobs = activeSsvms * numConcurrentCopyTasksPerSSVM;
@@ -666,4 +772,32 @@ public TemplateApiResult call() {
             return result;
         }
     }
+
+    private class MigrateKvmIncrementalBackupTask implements Callable<DataObjectResult> {
+        private final DataObject chosenFile;
+        private final Map<DataObject, Pair<List<List<BackupObject>>, Long>> backupChains;
+        private final DataStore srcDataStore;
+        private final DataStore destDataStore;
+
+        public MigrateKvmIncrementalBackupTask(DataObject chosenFile, Map<DataObject, Pair<List<List<BackupObject>>, Long>> backupChains, DataStore srcDataStore, DataStore destDataStore) {
+            this.chosenFile = chosenFile;
+            this.backupChains = backupChains;
+            this.srcDataStore = srcDataStore;
+            this.destDataStore = destDataStore;
+        }
+
+        @Override
+        public DataObjectResult call() {
+            try {
+                migrateKvmIncrementalBackupChain(chosenFile, backupChains, srcDataStore, destDataStore);
+                return new DataObjectResult(chosenFile);
+            } catch (Exception e) {
+                logger.warn("Failed migrating incremental backup {} due to {}.", chosenFile.getUuid(), e);
+                DataObjectResult result = new DataObjectResult(chosenFile);
+                result.setResult(e.toString());
+                return result;
+            }
+        }
+    }
+
 }
diff --git a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestrator.java b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestrator.java
index b4c104da07e7..f4198819dd16 100644
--- a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestrator.java
+++ b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/VolumeOrchestrator.java
@@ -53,6 +53,7 @@
 import org.apache.cloudstack.api.command.admin.vm.MigrateVMCmd;
 import org.apache.cloudstack.api.command.admin.volume.MigrateVolumeCmdByAdmin;
 import org.apache.cloudstack.api.command.user.volume.MigrateVolumeCmd;
+import org.apache.cloudstack.backup.InternalBackupService;
 import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.engine.orchestration.service.VolumeOrchestrationService;
 import org.apache.cloudstack.engine.subsystem.api.storage.ChapInfo;
@@ -301,6 +302,9 @@ public enum UserVmCloneType {
     @Inject
     private KMSWrappedKeyDao kmsWrappedKeyDao;
 
+    @Inject
+    private InternalBackupService internalBackupService;
+
     private final StateMachine2<Volume.State, Volume.Event, Volume> _volStateMachine;
     protected List<StoragePoolAllocator> _storagePoolAllocators;
 
@@ -1358,21 +1362,27 @@ private VolumeInfo copyVolume(StoragePool rootDiskPool, VolumeInfo volumeInfo, V
     }
 
     @Override
-    public VolumeInfo createVolumeOnPrimaryStorage(VirtualMachine vm, VolumeInfo volumeInfo, HypervisorType rootDiskHyperType, StoragePool storagePool) throws NoTransitionException {
+    public VolumeInfo createVolumeOnPrimaryStorage(VirtualMachine vm, VolumeInfo volumeInfo, HypervisorType rootDiskHyperType, StoragePool storagePool, Long clusterId, Long podId)
+            throws NoTransitionException {
         String volumeToString = getReflectOnlySelectedFields(volumeInfo.getVolume());
 
         VirtualMachineTemplate rootDiskTmplt = _entityMgr.findById(VirtualMachineTemplate.class, vm.getTemplateId());
         DataCenter dcVO = _entityMgr.findById(DataCenter.class, vm.getDataCenterId());
-        logger.trace("storage-pool {}/{} is associated with pod {}",storagePool.getName(), storagePool.getUuid(), storagePool.getPodId());
-        Long podId = storagePool.getPodId() != null ? storagePool.getPodId() : vm.getPodIdToDeployIn();
+
+        if (storagePool != null) {
+            logger.trace("storage-pool {}/{} is associated with pod {}", storagePool.getName(), storagePool.getUuid(), storagePool.getPodId());
+            podId = storagePool.getPodId() != null ? storagePool.getPodId() : vm.getPodIdToDeployIn();
+            clusterId = storagePool.getClusterId();
+            logger.trace("storage-pool {}/{} is associated with cluster {}",storagePool.getName(), storagePool.getUuid(), clusterId);
+        }
+
         Pod pod = _entityMgr.findById(Pod.class, podId);
 
         ServiceOffering svo = _entityMgr.findById(ServiceOffering.class, vm.getServiceOfferingId());
         DiskOffering diskVO = _entityMgr.findById(DiskOffering.class, volumeInfo.getDiskOfferingId());
-        Long clusterId = storagePool.getClusterId();
-        logger.trace("storage-pool {}/{} is associated with cluster {}",storagePool.getName(), storagePool.getUuid(), clusterId);
+
         Long hostId = vm.getHostId();
-        if (hostId == null && (storagePool.isLocal() || ClvmPoolManager.isClvmPoolType(storagePool.getPoolType()))) {
+        if (hostId == null && storagePool != null && (storagePool.isLocal() || ClvmPoolManager.isClvmPoolType(storagePool.getPoolType()))) {
             if (ClvmPoolManager.isClvmPoolType(storagePool.getPoolType())) {
                 hostId = getClvmLockHostFromVmVolumes(vm.getId());
                 if (hostId != null) {
@@ -1632,6 +1642,7 @@ public Volume migrateVolume(Volume volume, StoragePool destPool) throws StorageU
                     _snapshotDao.updateVolumeIds(vol.getId(), result.getVolume().getId());
                     _snapshotDataStoreDao.updateVolumeIds(vol.getId(), result.getVolume().getId());
                 }
+                internalBackupService.updateVolumeId(vol.getId(), result.getVolume().getId());
 
                 // For CLVM volumes attached to a VM, update the CLVM_LOCK_HOST_ID after migration
                 updateClvmLockHostAfterMigration(result.getVolume(), destPool, "migrated");
@@ -1695,6 +1706,8 @@ public void migrateVolumes(VirtualMachine vm, VirtualMachineTO vmTo, Host srcHos
                 throw new CloudRuntimeException(String.format("Failed to find the destination storage pool [%s] to migrate the volume [%s] to.", storagePoolToString, volumeToString));
             }
 
+            internalBackupService.prepareVolumeForMigration(volume);
+
             volumeMap.put(volFactory.getVolume(volume.getId()), (DataStore)destPool);
         }
 
@@ -2531,7 +2544,8 @@ public void destroyVolume(Volume volume) {
             if (volume.getState() == Volume.State.Allocated) {
                 _volsDao.remove(volume.getId());
                 stateTransitTo(volume, Volume.Event.DestroyRequested);
-                _resourceLimitMgr.decrementVolumeResourceCount(volume.getAccountId(), volume.isDisplay(), volume.getSize(), diskOfferingDao.findByIdIncludingRemoved(volume.getDiskOfferingId()));
+                _resourceLimitMgr.decrementVolumeResourceCount(volume.getAccountId(), volume.isDisplay(), volume.getSize(), diskOfferingDao.findByIdIncludingRemoved(volume.getDiskOfferingId()),
+                        null);
             } else {
                 destroyVolumeInContext(volume);
             }
diff --git a/engine/orchestration/src/main/resources/META-INF/cloudstack/core/spring-engine-orchestration-core-context.xml b/engine/orchestration/src/main/resources/META-INF/cloudstack/core/spring-engine-orchestration-core-context.xml
index 8f93ae5b35a3..e17302e68a1f 100644
--- a/engine/orchestration/src/main/resources/META-INF/cloudstack/core/spring-engine-orchestration-core-context.xml
+++ b/engine/orchestration/src/main/resources/META-INF/cloudstack/core/spring-engine-orchestration-core-context.xml
@@ -91,6 +91,7 @@
                 <entry key="VolumeApiServiceImpl" value-ref="volumeApiServiceImpl" />
                 <entry key="VMSnapshotManagerImpl" value-ref="vMSnapshotManagerImpl" />
                 <entry key="KVMBackupExportServiceImpl" value-ref="kvmBackupExportService" />
+                <entry key="InternalBackupService" value-ref="internalBackupServiceImpl" />
             </map>
         </property>
     </bean>
diff --git a/engine/orchestration/src/test/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestratorTest.java b/engine/orchestration/src/test/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestratorTest.java
index e3989737112d..66f5b699cc46 100644
--- a/engine/orchestration/src/test/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestratorTest.java
+++ b/engine/orchestration/src/test/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestratorTest.java
@@ -27,6 +27,7 @@
 import java.net.URI;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -35,11 +36,15 @@
 import com.cloud.exception.InsufficientVirtualNetworkCapacityException;
 import com.cloud.network.IpAddressManager;
 import com.cloud.utils.Pair;
+import org.apache.cloudstack.extension.Extension;
+import org.apache.cloudstack.extension.ExtensionHelper;
+import org.apache.cloudstack.framework.extensions.network.NetworkExtensionElement;
 import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.junit.runners.JUnit4;
+import org.springframework.test.util.ReflectionTestUtils;
 import org.mockito.ArgumentMatchers;
 import org.mockito.MockedStatic;
 import org.mockito.Mockito;
@@ -68,6 +73,7 @@
 import com.cloud.network.dao.PhysicalNetworkVO;
 import com.cloud.network.dao.RouterNetworkDao;
 import com.cloud.network.element.DhcpServiceProvider;
+import com.cloud.network.element.NetworkElement;
 import com.cloud.network.guru.GuestNetworkGuru;
 import com.cloud.network.guru.NetworkGuru;
 import com.cloud.network.vpc.VpcManager;
@@ -105,6 +111,7 @@ public class NetworkOrchestratorTest extends TestCase {
     private String guruName = "GuestNetworkGuru";
     private String dhcpProvider = "VirtualRouter";
     private NetworkGuru guru = mock(NetworkGuru.class);
+    private NetworkExtensionElement networkExtensionElement;
 
     NetworkOfferingVO networkOffering = mock(NetworkOfferingVO.class);
 
@@ -135,6 +142,9 @@ public void setUp() {
         testOrchestrator.routerJoinDao = mock(DomainRouterJoinDao.class);
         testOrchestrator._ipAddrMgr = mock(IpAddressManager.class);
         testOrchestrator._entityMgr = mock(EntityManager.class);
+        testOrchestrator.extensionHelper = mock(ExtensionHelper.class);
+        networkExtensionElement = mock(NetworkExtensionElement.class);
+        ReflectionTestUtils.setField(testOrchestrator, "networkExtensionElement", networkExtensionElement);
         DhcpServiceProvider provider = mock(DhcpServiceProvider.class);
 
         Map<Network.Capability, String> capabilities = new HashMap<Network.Capability, String>();
@@ -388,7 +398,7 @@ private void configureTestConfigureNicProfileBasedOnRequestedIpTests(NicProfile
             when(testOrchestrator._ipAddressDao.findByIpAndSourceNetworkId(Mockito.anyLong(), Mockito.anyString())).thenReturn(ipVoSpy);
         }
 
-        VlanVO vlanSpy = Mockito.spy(new VlanVO(Vlan.VlanType.DirectAttached, "vlanTag", vlanGateway, vlanNetmask, 0l, "192.168.100.100 - 192.168.100.200", 0l, new Long(0l),
+        VlanVO vlanSpy = Mockito.spy(new VlanVO(Vlan.VlanType.DirectAttached, "vlanTag", vlanGateway, vlanNetmask, 0l, "192.168.100.100 - 192.168.100.200", 0l, 0l,
                 "ip6Gateway", "ip6Cidr", "ip6Range"));
 
         Mockito.doReturn(0l).when(vlanSpy).getId();
@@ -1010,4 +1020,57 @@ public void testImportNicWithIP4Address() throws Exception {
             assertEquals("testtag", nicProfile.getName());
         }
     }
+
+    // -----------------------------------------------------------------------
+    // Tests for getNetworkElementsIncludingExtensions
+    // -----------------------------------------------------------------------
+
+    @Test
+    public void getNetworkElementsIncludingExtensionsReturnsBaseListWhenNoExtensions() {
+        when(testOrchestrator.extensionHelper.listExtensionsByType(Extension.Type.NetworkOrchestrator))
+                .thenReturn(Collections.emptyList());
+
+        DhcpServiceProvider dhcpProvider = mock(DhcpServiceProvider.class);
+        List<NetworkElement> elements = new ArrayList<>(List.of(dhcpProvider));
+        testOrchestrator.networkElements = elements;
+
+        List<NetworkElement> result = testOrchestrator.getNetworkElementsIncludingExtensions();
+
+        assertNotNull(result);
+        assertEquals(elements.size(), result.size());
+    }
+
+    @Test
+    public void getNetworkElementsIncludingExtensionsAddsExtensionElements() {
+        Extension ext = mock(Extension.class);
+        when(ext.getName()).thenReturn("my-net-ext");
+        when(testOrchestrator.extensionHelper.listExtensionsByType(Extension.Type.NetworkOrchestrator))
+                .thenReturn(List.of(ext));
+
+        NetworkExtensionElement extElement = mock(NetworkExtensionElement.class);
+        when(networkExtensionElement.withProviderName("my-net-ext")).thenReturn(extElement);
+
+        DhcpServiceProvider dhcpProvider = mock(DhcpServiceProvider.class);
+        testOrchestrator.networkElements = new ArrayList<>(List.of(dhcpProvider));
+
+        List<NetworkElement> result = testOrchestrator.getNetworkElementsIncludingExtensions();
+
+        assertNotNull(result);
+        assertEquals(2, result.size());
+        assertTrue(result.contains(extElement));
+    }
+
+    @Test
+    public void getNetworkElementsIncludingExtensionsReturnsBaseListWhenExtensionHelperReturnsNull() {
+        when(testOrchestrator.extensionHelper.listExtensionsByType(Extension.Type.NetworkOrchestrator))
+                .thenReturn(null);
+
+        DhcpServiceProvider dhcpProvider = mock(DhcpServiceProvider.class);
+        testOrchestrator.networkElements = new ArrayList<>(List.of(dhcpProvider));
+
+        List<NetworkElement> result = testOrchestrator.getNetworkElementsIncludingExtensions();
+
+        assertNotNull(result);
+        assertEquals(1, result.size());
+    }
 }
diff --git a/engine/schema/src/main/java/com/cloud/host/dao/HostDao.java b/engine/schema/src/main/java/com/cloud/host/dao/HostDao.java
index 5c0d04fb2be8..d8bdabc3dcbb 100644
--- a/engine/schema/src/main/java/com/cloud/host/dao/HostDao.java
+++ b/engine/schema/src/main/java/com/cloud/host/dao/HostDao.java
@@ -121,6 +121,8 @@ public interface HostDao extends GenericDao<HostVO, Long>, StateDao<Status, Stat
 
     List<Long> listIdsForUpEnabledByZoneAndHypervisor(Long zoneId, HypervisorType hypervisorType);
 
+    List<HostVO> findRoutingByClusterId(Long clusterId);
+
     List<HostVO> findByClusterIdAndEncryptionSupport(Long clusterId);
 
     /**
@@ -139,6 +141,8 @@ public interface HostDao extends GenericDao<HostVO, Long>, StateDao<Status, Stat
 
     List<HostVO> listAllHostsByZoneAndHypervisorType(long zoneId, HypervisorType hypervisorType);
 
+    List<HostVO> listAllRoutingHostsByZoneAndHypervisorType(long zoneId, HypervisorType hypervisorType);
+
     List<HostVO> listAllHostsThatHaveNoRuleTag(Host.Type type, Long clusterId, Long podId, Long dcId);
 
     HostVO findByPublicIp(String publicIp);
diff --git a/engine/schema/src/main/java/com/cloud/host/dao/HostDaoImpl.java b/engine/schema/src/main/java/com/cloud/host/dao/HostDaoImpl.java
index 5b8a38b8e5b4..15727d9d8e66 100644
--- a/engine/schema/src/main/java/com/cloud/host/dao/HostDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/host/dao/HostDaoImpl.java
@@ -1341,6 +1341,14 @@ public List<Long> listIdsForUpEnabledByZoneAndHypervisor(Long zoneId, Hypervisor
         return listIdsBy(null, Status.Up, ResourceState.Enabled, hypervisorType, zoneId, null, null);
     }
 
+    @Override
+    public List<HostVO> findRoutingByClusterId(Long clusterId) {
+        SearchCriteria<HostVO> sc = ClusterSearch.create();
+        sc.setParameters("clusterId", clusterId);
+        sc.setParameters("type", Type.Routing);
+        return listBy(sc);
+    }
+
     @Override
     public List<HostVO> findByClusterIdAndEncryptionSupport(Long clusterId) {
         SearchBuilder<DetailVO> hostCapabilitySearch = _detailsDao.createSearchBuilder();
@@ -1456,6 +1464,16 @@ public List<HostVO> listAllHostsByZoneAndHypervisorType(long zoneId, HypervisorT
         return listBy(sc);
     }
 
+    @Override
+    public List<HostVO> listAllRoutingHostsByZoneAndHypervisorType(long zoneId, HypervisorType hypervisorType) {
+        SearchCriteria<HostVO> sc = DcSearch.create();
+        sc.setParameters("dc", zoneId);
+        sc.setParameters("hypervisorType", hypervisorType.toString());
+        sc.setParameters("type", Type.Routing);
+
+        return listBy(sc);
+    }
+
     @Override
     public List<HostVO> listAllHostsThatHaveNoRuleTag(Type type, Long clusterId, Long podId, Long dcId) {
         SearchCriteria<HostVO> sc = searchBuilderFindByIdTypeClusterIdPodIdDcIdAndWithoutRuleTag.create();
diff --git a/engine/schema/src/main/java/com/cloud/network/dao/FirewallRulesDao.java b/engine/schema/src/main/java/com/cloud/network/dao/FirewallRulesDao.java
index 7f322ae6c037..3527ce84dcf6 100644
--- a/engine/schema/src/main/java/com/cloud/network/dao/FirewallRulesDao.java
+++ b/engine/schema/src/main/java/com/cloud/network/dao/FirewallRulesDao.java
@@ -69,6 +69,8 @@ public interface FirewallRulesDao extends GenericDao<FirewallRuleVO, Long> {
 
     List<FirewallRuleVO> listByNetworkPurposeTrafficType(long networkId, FirewallRule.Purpose purpose, FirewallRule.TrafficType trafficType);
 
+    List<FirewallRuleVO> listByVpcPurposeTrafficType(long vpcId, FirewallRule.Purpose purpose, FirewallRule.TrafficType trafficType);
+
     List<FirewallRuleVO> listByIpAndPurposeWithState(Long addressId, FirewallRule.Purpose purpose, FirewallRule.State state);
 
     void loadSourceCidrs(FirewallRuleVO rule);
diff --git a/engine/schema/src/main/java/com/cloud/network/dao/FirewallRulesDaoImpl.java b/engine/schema/src/main/java/com/cloud/network/dao/FirewallRulesDaoImpl.java
index 57d53f92572c..5a1e1aae6b66 100644
--- a/engine/schema/src/main/java/com/cloud/network/dao/FirewallRulesDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/network/dao/FirewallRulesDaoImpl.java
@@ -74,6 +74,7 @@ protected FirewallRulesDaoImpl() {
         AllFieldsSearch.and("domain", AllFieldsSearch.entity().getDomainId(), Op.EQ);
         AllFieldsSearch.and("id", AllFieldsSearch.entity().getId(), Op.EQ);
         AllFieldsSearch.and("networkId", AllFieldsSearch.entity().getNetworkId(), Op.EQ);
+        AllFieldsSearch.and("vpcId", AllFieldsSearch.entity().getVpcId(), Op.EQ);
         AllFieldsSearch.and("related", AllFieldsSearch.entity().getRelated(), Op.EQ);
         AllFieldsSearch.and("trafficType", AllFieldsSearch.entity().getTrafficType(), Op.EQ);
         AllFieldsSearch.done();
@@ -356,6 +357,22 @@ public List<FirewallRuleVO> listByNetworkPurposeTrafficType(long networkId, Purp
         return listBy(sc);
     }
 
+    @Override
+    public List<FirewallRuleVO> listByVpcPurposeTrafficType(long vpcId, Purpose purpose, TrafficType trafficType) {
+        SearchCriteria<FirewallRuleVO> sc = AllFieldsSearch.create();
+        sc.setParameters("vpcId", vpcId);
+
+        if (purpose != null) {
+            sc.setParameters("purpose", purpose);
+        }
+
+        if (trafficType != null) {
+            sc.setParameters("trafficType", trafficType);
+        }
+
+        return listBy(sc);
+    }
+
     @Override
     @DB
     public boolean remove(Long id) {
diff --git a/engine/schema/src/main/java/com/cloud/network/dao/NetworkDao.java b/engine/schema/src/main/java/com/cloud/network/dao/NetworkDao.java
index 8406f80ed09d..b656d896e37f 100644
--- a/engine/schema/src/main/java/com/cloud/network/dao/NetworkDao.java
+++ b/engine/schema/src/main/java/com/cloud/network/dao/NetworkDao.java
@@ -141,4 +141,6 @@ List<NetworkVO> listByZonesTrafficTypeAndOwners(List<Long> zoneIds, final Traffi
     List<NetworkVO> listByPhysicalNetworkPvlan(long physicalNetworkId, String broadcastUri);
 
     List<NetworkVO> getAllPersistentNetworksFromZone(long dataCenterId);
+
+    NetworkVO findByZoneIdAndAccountIdAndGuestTypeAndName(long zoneId, long accountId, GuestType guestType, String name);
 }
diff --git a/engine/schema/src/main/java/com/cloud/network/dao/NetworkDaoImpl.java b/engine/schema/src/main/java/com/cloud/network/dao/NetworkDaoImpl.java
index f3ece4879040..fbf6a2ac2261 100644
--- a/engine/schema/src/main/java/com/cloud/network/dao/NetworkDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/network/dao/NetworkDaoImpl.java
@@ -38,7 +38,6 @@
 import com.cloud.network.Network;
 import com.cloud.network.Network.Event;
 import com.cloud.network.Network.GuestType;
-import com.cloud.network.Network.Provider;
 import com.cloud.network.Network.Service;
 import com.cloud.network.Network.State;
 import com.cloud.network.Networks.BroadcastDomainType;
@@ -392,7 +391,7 @@ public void persistNetworkServiceProviders(final long networkId, final Map<Strin
         final TransactionLegacy txn = TransactionLegacy.currentTxn();
         txn.start();
         for (final String service : serviceProviderMap.keySet()) {
-            final NetworkServiceMapVO serviceMap = new NetworkServiceMapVO(networkId, Service.getService(service), Provider.getProvider(serviceProviderMap.get(service)));
+            final NetworkServiceMapVO serviceMap = new NetworkServiceMapVO(networkId, Service.getService(service).getName(), serviceProviderMap.get(service));
             _ntwkSvcMap.persist(serviceMap);
         }
         txn.commit();
@@ -944,4 +943,16 @@ public List<NetworkVO> listByPhysicalNetworkPvlan(long physicalNetworkId, String
 
         return overlappingNetworks;
     }
+
+    @Override
+    public NetworkVO findByZoneIdAndAccountIdAndGuestTypeAndName(long zoneId, long accountId, GuestType guestType, String name) {
+        SearchCriteria<NetworkVO> sc = AllFieldsSearch.create();
+
+        sc.setParameters("datacenter", zoneId);
+        sc.setParameters("account", accountId);
+        sc.setParameters("guestType", guestType);
+        sc.setParameters("name", name);
+
+        return findOneBy(sc);
+    }
 }
diff --git a/engine/schema/src/main/java/com/cloud/network/dao/NetworkServiceMapVO.java b/engine/schema/src/main/java/com/cloud/network/dao/NetworkServiceMapVO.java
index 4e1e9aff4561..65598eda7399 100644
--- a/engine/schema/src/main/java/com/cloud/network/dao/NetworkServiceMapVO.java
+++ b/engine/schema/src/main/java/com/cloud/network/dao/NetworkServiceMapVO.java
@@ -81,6 +81,12 @@ public NetworkServiceMapVO(long networkId, Service service, Provider provider) {
         this.provider = provider.getName();
     }
 
+    public NetworkServiceMapVO(long networkId, String serviceName, String providerName) {
+        this.networkId = networkId;
+        this.service = serviceName;
+        this.provider = providerName;
+    }
+
     @Override
     public String toString() {
         StringBuilder buf = new StringBuilder("[Network Service[");
diff --git a/engine/schema/src/main/java/com/cloud/network/dao/PhysicalNetworkServiceProviderVO.java b/engine/schema/src/main/java/com/cloud/network/dao/PhysicalNetworkServiceProviderVO.java
index 9557c7465bff..4be6c5bc344d 100644
--- a/engine/schema/src/main/java/com/cloud/network/dao/PhysicalNetworkServiceProviderVO.java
+++ b/engine/schema/src/main/java/com/cloud/network/dao/PhysicalNetworkServiceProviderVO.java
@@ -97,6 +97,9 @@ public class PhysicalNetworkServiceProviderVO implements PhysicalNetworkServiceP
     @Column(name = "networkacl_service_provided")
     boolean networkAclServiceProvided;
 
+    @Column(name = "custom_action_service_provided")
+    boolean customActionServiceProvided;
+
     @Column(name = GenericDao.REMOVED_COLUMN)
     Date removed;
 
@@ -278,6 +281,7 @@ public void setEnabledServices(List<Service> services) {
         this.setUserdataServiceProvided(services.contains(Service.UserData));
         this.setSecuritygroupServiceProvided(services.contains(Service.SecurityGroup));
         this.setNetworkAclServiceProvided(services.contains(Service.NetworkACL));
+        this.setCustomActionServiceProvided(services.contains(Service.CustomAction));
     }
 
     @Override
@@ -301,21 +305,27 @@ public List<Service> getEnabledServices() {
         if (this.isLbServiceProvided()) {
             services.add(Service.Lb);
         }
-        if (this.sourcenatServiceProvided) {
+        if (this.isSourcenatServiceProvided()) {
             services.add(Service.SourceNat);
         }
-        if (this.staticnatServiceProvided) {
+        if (this.isStaticnatServiceProvided()) {
             services.add(Service.StaticNat);
         }
-        if (this.portForwardingServiceProvided) {
+        if (this.isPortForwardingServiceProvided()) {
             services.add(Service.PortForwarding);
         }
+        if (this.isNetworkAclServiceProvided()) {
+            services.add(Service.NetworkACL);
+        }
         if (this.isUserdataServiceProvided()) {
             services.add(Service.UserData);
         }
         if (this.isSecuritygroupServiceProvided()) {
             services.add(Service.SecurityGroup);
         }
+        if (this.isCustomActionServiceProvided()) {
+            services.add(Service.CustomAction);
+        }
         return services;
     }
 
@@ -327,4 +337,12 @@ public boolean isNetworkAclServiceProvided() {
     public void setNetworkAclServiceProvided(boolean networkAclServiceProvided) {
         this.networkAclServiceProvided = networkAclServiceProvided;
     }
+
+    public boolean isCustomActionServiceProvided() {
+        return customActionServiceProvided;
+    }
+
+    public void setCustomActionServiceProvided(boolean customActionServiceProvided) {
+        this.customActionServiceProvided = customActionServiceProvided;
+    }
 }
diff --git a/engine/schema/src/main/java/com/cloud/network/rules/FirewallRuleVO.java b/engine/schema/src/main/java/com/cloud/network/rules/FirewallRuleVO.java
index 6ce9e6a118b7..2b34e23fa4d4 100644
--- a/engine/schema/src/main/java/com/cloud/network/rules/FirewallRuleVO.java
+++ b/engine/schema/src/main/java/com/cloud/network/rules/FirewallRuleVO.java
@@ -91,6 +91,9 @@ public class FirewallRuleVO implements FirewallRule {
     @Column(name = "network_id")
     Long networkId;
 
+    @Column(name = "vpc_id")
+    Long vpcId;
+
     @Column(name = "icmp_code")
     Integer icmpCode;
 
@@ -196,10 +199,18 @@ public State getState() {
     }
 
     @Override
-    public long getNetworkId() {
+    public Long getNetworkId() {
         return networkId;
     }
 
+    public Long getVpcId() {
+        return vpcId;
+    }
+
+    public void setVpcId(Long vpcId) {
+        this.vpcId = vpcId;
+    }
+
     @Override
     public FirewallRuleType getType() {
         return type;
@@ -217,7 +228,7 @@ protected FirewallRuleVO() {
         uuid = UUID.randomUUID().toString();
     }
 
-    public FirewallRuleVO(String xId, Long ipAddressId, Integer portStart, Integer portEnd, String protocol, long networkId, long accountId, long domainId,
+    public FirewallRuleVO(String xId, Long ipAddressId, Integer portStart, Integer portEnd, String protocol, Long networkId, long accountId, long domainId,
             Purpose purpose, List<String> sourceCidrs, Integer icmpCode, Integer icmpType, Long related, TrafficType trafficType) {
         this.xId = xId;
         if (xId == null) {
@@ -261,7 +272,7 @@ public FirewallRuleVO(String xId, long ipAddressId, int port, String protocol, l
     }
 
 
-    public FirewallRuleVO(String xId, Long ipAddressId, Integer portStart, Integer portEnd, String protocol, long networkId, long accountId, long domainId,
+    public FirewallRuleVO(String xId, Long ipAddressId, Integer portStart, Integer portEnd, String protocol, Long networkId, long accountId, long domainId,
                           Purpose purpose, List<String> sourceCidrs, List<String> destCidrs, Integer icmpCode, Integer icmpType, Long related, TrafficType trafficType) {
         this(xId,ipAddressId, portStart, portEnd, protocol, networkId, accountId, domainId, purpose, sourceCidrs, icmpCode, icmpType, related, trafficType);
         this.destinationCidrs = destCidrs;
diff --git a/engine/schema/src/main/java/com/cloud/network/vpc/VpcServiceMapVO.java b/engine/schema/src/main/java/com/cloud/network/vpc/VpcServiceMapVO.java
index 9fa4b505c650..ae156d7d4304 100644
--- a/engine/schema/src/main/java/com/cloud/network/vpc/VpcServiceMapVO.java
+++ b/engine/schema/src/main/java/com/cloud/network/vpc/VpcServiceMapVO.java
@@ -25,8 +25,6 @@
 import javax.persistence.Id;
 import javax.persistence.Table;
 
-import com.cloud.network.Network.Provider;
-import com.cloud.network.Network.Service;
 import com.cloud.utils.db.GenericDao;
 
 @Entity
@@ -72,10 +70,10 @@ public Date getCreated() {
     public VpcServiceMapVO() {
     }
 
-    public VpcServiceMapVO(long vpcId, Service service, Provider provider) {
+    public VpcServiceMapVO(long vpcId, String serviceName, String providerName) {
         this.vpcId = vpcId;
-        this.service = service.getName();
-        this.provider = provider.getName();
+        this.service = serviceName;
+        this.provider = providerName;
     }
 
     @Override
diff --git a/engine/schema/src/main/java/com/cloud/network/vpc/dao/VpcDaoImpl.java b/engine/schema/src/main/java/com/cloud/network/vpc/dao/VpcDaoImpl.java
index 4e13fe4f5d0d..cecdce1aba42 100644
--- a/engine/schema/src/main/java/com/cloud/network/vpc/dao/VpcDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/network/vpc/dao/VpcDaoImpl.java
@@ -142,7 +142,7 @@ public void persistVpcServiceProviders(long vpcId, Map<String, List<String>> ser
         txn.start();
         for (String service : serviceProviderMap.keySet()) {
             for (String provider : serviceProviderMap.get(service)) {
-                VpcServiceMapVO serviceMap = new VpcServiceMapVO(vpcId, Network.Service.getService(service), Network.Provider.getProvider(provider));
+                VpcServiceMapVO serviceMap = new VpcServiceMapVO(vpcId, Network.Service.getService(service).getName(), provider);
                 _vpcSvcMap.persist(serviceMap);
             }
         }
diff --git a/engine/schema/src/main/java/com/cloud/network/vpc/dao/VpcOfferingServiceMapDao.java b/engine/schema/src/main/java/com/cloud/network/vpc/dao/VpcOfferingServiceMapDao.java
index 020536e97ec9..4bc9ad646d38 100644
--- a/engine/schema/src/main/java/com/cloud/network/vpc/dao/VpcOfferingServiceMapDao.java
+++ b/engine/schema/src/main/java/com/cloud/network/vpc/dao/VpcOfferingServiceMapDao.java
@@ -42,4 +42,6 @@ public interface VpcOfferingServiceMapDao extends GenericDao<VpcOfferingServiceM
 
     List<VpcOfferingServiceMapVO> listProvidersForServiceForVpcOffering(long vpcOfferingId, Service service);
 
+    List<Long> listOfferingIdsByServiceAndProvider(Service service, String provider);
+
 }
diff --git a/engine/schema/src/main/java/com/cloud/network/vpc/dao/VpcOfferingServiceMapDaoImpl.java b/engine/schema/src/main/java/com/cloud/network/vpc/dao/VpcOfferingServiceMapDaoImpl.java
index dcb1becf9e88..de36b6c3219b 100644
--- a/engine/schema/src/main/java/com/cloud/network/vpc/dao/VpcOfferingServiceMapDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/network/vpc/dao/VpcOfferingServiceMapDaoImpl.java
@@ -37,6 +37,7 @@ public class VpcOfferingServiceMapDaoImpl extends GenericDaoBase<VpcOfferingServ
     final SearchBuilder<VpcOfferingServiceMapVO> AllFieldsSearch;
     final SearchBuilder<VpcOfferingServiceMapVO> MultipleServicesSearch;
     final GenericSearchBuilder<VpcOfferingServiceMapVO, String> ServicesSearch;
+    final GenericSearchBuilder<VpcOfferingServiceMapVO, Long> OfferingIdsByServiceAndProviderSearch;
 
     protected VpcOfferingServiceMapDaoImpl() {
         super();
@@ -56,6 +57,12 @@ protected VpcOfferingServiceMapDaoImpl() {
         ServicesSearch.and("offeringId", ServicesSearch.entity().getVpcOfferingId(), SearchCriteria.Op.EQ);
         ServicesSearch.select(null, Func.DISTINCT, ServicesSearch.entity().getService());
         ServicesSearch.done();
+
+        OfferingIdsByServiceAndProviderSearch = createSearchBuilder(Long.class);
+        OfferingIdsByServiceAndProviderSearch.selectFields(OfferingIdsByServiceAndProviderSearch.entity().getVpcOfferingId());
+        OfferingIdsByServiceAndProviderSearch.and("service", OfferingIdsByServiceAndProviderSearch.entity().getService(), SearchCriteria.Op.EQ);
+        OfferingIdsByServiceAndProviderSearch.and("provider", OfferingIdsByServiceAndProviderSearch.entity().getProvider(), SearchCriteria.Op.EQ);
+        OfferingIdsByServiceAndProviderSearch.done();
     }
 
     @Override
@@ -129,4 +136,12 @@ public List<VpcOfferingServiceMapVO> listProvidersForServiceForVpcOffering(long
 
         return customSearch(sc, null);
     }
+
+    @Override
+    public List<Long> listOfferingIdsByServiceAndProvider(Service service, String provider) {
+        SearchCriteria<Long> sc = OfferingIdsByServiceAndProviderSearch.create();
+        sc.setParameters("service", service.getName());
+        sc.setParameters("provider", provider);
+        return customSearch(sc, null);
+    }
 }
diff --git a/engine/schema/src/main/java/com/cloud/offerings/dao/NetworkOfferingServiceMapDao.java b/engine/schema/src/main/java/com/cloud/offerings/dao/NetworkOfferingServiceMapDao.java
index 8fb5d6dff84b..5954f95b3c57 100644
--- a/engine/schema/src/main/java/com/cloud/offerings/dao/NetworkOfferingServiceMapDao.java
+++ b/engine/schema/src/main/java/com/cloud/offerings/dao/NetworkOfferingServiceMapDao.java
@@ -44,4 +44,6 @@ public interface NetworkOfferingServiceMapDao extends GenericDao<NetworkOffering
     List<String> listServicesForNetworkOffering(long networkOfferingId);
 
     List<String> getDistinctProviders(long offId);
+
+    List<Long> listOfferingIdsByServiceAndProvider(Service service, String provider);
 }
diff --git a/engine/schema/src/main/java/com/cloud/offerings/dao/NetworkOfferingServiceMapDaoImpl.java b/engine/schema/src/main/java/com/cloud/offerings/dao/NetworkOfferingServiceMapDaoImpl.java
index 67b341a93618..5fe86760d50a 100644
--- a/engine/schema/src/main/java/com/cloud/offerings/dao/NetworkOfferingServiceMapDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/offerings/dao/NetworkOfferingServiceMapDaoImpl.java
@@ -40,6 +40,7 @@ public class NetworkOfferingServiceMapDaoImpl extends GenericDaoBase<NetworkOffe
     final GenericSearchBuilder<NetworkOfferingServiceMapVO, String> ProvidersSearch;
     final GenericSearchBuilder<NetworkOfferingServiceMapVO, String> ServicesSearch;
     final GenericSearchBuilder<NetworkOfferingServiceMapVO, String> DistinctProvidersSearch;
+    final GenericSearchBuilder<NetworkOfferingServiceMapVO, Long> OfferingIdsByServiceAndProviderSearch;
 
     protected NetworkOfferingServiceMapDaoImpl() {
         super();
@@ -71,6 +72,12 @@ protected NetworkOfferingServiceMapDaoImpl() {
         DistinctProvidersSearch.and("provider", DistinctProvidersSearch.entity().getProvider(), SearchCriteria.Op.EQ);
         DistinctProvidersSearch.selectFields(DistinctProvidersSearch.entity().getProvider());
         DistinctProvidersSearch.done();
+
+        OfferingIdsByServiceAndProviderSearch = createSearchBuilder(Long.class);
+        OfferingIdsByServiceAndProviderSearch.selectFields(OfferingIdsByServiceAndProviderSearch.entity().getNetworkOfferingId());
+        OfferingIdsByServiceAndProviderSearch.and("service", OfferingIdsByServiceAndProviderSearch.entity().getService(), SearchCriteria.Op.EQ);
+        OfferingIdsByServiceAndProviderSearch.and("provider", OfferingIdsByServiceAndProviderSearch.entity().getProvider(), SearchCriteria.Op.EQ);
+        OfferingIdsByServiceAndProviderSearch.done();
     }
 
     @Override
@@ -170,4 +177,12 @@ public List<String> getDistinctProviders(long offId) {
         List<String> results = customSearch(sc, null);
         return results;
     }
+
+    @Override
+    public List<Long> listOfferingIdsByServiceAndProvider(Service service, String provider) {
+        SearchCriteria<Long> sc = OfferingIdsByServiceAndProviderSearch.create();
+        sc.setParameters("service", service.getName());
+        sc.setParameters("provider", provider);
+        return customSearch(sc, null);
+    }
 }
diff --git a/engine/schema/src/main/java/com/cloud/storage/SnapshotVO.java b/engine/schema/src/main/java/com/cloud/storage/SnapshotVO.java
index 4a504333344f..be7ba2843321 100644
--- a/engine/schema/src/main/java/com/cloud/storage/SnapshotVO.java
+++ b/engine/schema/src/main/java/com/cloud/storage/SnapshotVO.java
@@ -248,6 +248,10 @@ public Date getRemoved() {
         return removed;
     }
 
+    public void setRemoved(Date removed) {
+        this.removed = removed;
+    }
+
     @Override
     public State getState() {
         return state;
diff --git a/engine/schema/src/main/java/com/cloud/storage/dao/SnapshotDaoImpl.java b/engine/schema/src/main/java/com/cloud/storage/dao/SnapshotDaoImpl.java
index f167b5731878..a5596ed840cc 100755
--- a/engine/schema/src/main/java/com/cloud/storage/dao/SnapshotDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/storage/dao/SnapshotDaoImpl.java
@@ -56,10 +56,18 @@ public class SnapshotDaoImpl extends GenericDaoBase<SnapshotVO, Long> implements
     // TODO: we should remove these direct sqls
     private static final String GET_LAST_SNAPSHOT =
         "SELECT snapshots.id FROM snapshot_store_ref, snapshots where snapshots.id = snapshot_store_ref.snapshot_id AND snapshosts.volume_id = ? AND snapshot_store_ref.role = ? ORDER BY created DESC";
-
     private static final String VOLUME_ID = "volumeId";
-    private static final String NOT_TYPE = "notType";
+    private static final String TYPE = "type";
     private static final String STATUS = "status";
+    private static final String VERSION = "version";
+    private static final String ACCOUNT_ID = "accountId";
+    private static final String REMOVED = "removed";
+    private static final String NOT_TYPE = "notType";
+    private static final String ID = "id";
+    private static final String INSTANCE_ID = "instanceId";
+    private static final String STATE = "state";
+    private static final String INSTANCE_VOLUMES = "instanceVolumes";
+    private static final String INSTANCE_SNAPSHOTS = "instanceSnapshots";
 
     private SearchBuilder<SnapshotVO> snapshotIdsSearch;
     private SearchBuilder<SnapshotVO> VolumeIdSearch;
@@ -83,9 +91,9 @@ public class SnapshotDaoImpl extends GenericDaoBase<SnapshotVO, Long> implements
     @Override
     public List<SnapshotVO> listByVolumeIdTypeNotDestroyed(long volumeId, Type type) {
         SearchCriteria<SnapshotVO> sc = VolumeIdTypeNotDestroyedSearch.create();
-        sc.setParameters("volumeId", volumeId);
-        sc.setParameters("type", type.ordinal());
-        sc.setParameters("status", State.Destroyed);
+        sc.setParameters(VOLUME_ID, volumeId);
+        sc.setParameters(TYPE, type.ordinal());
+        sc.setParameters(STATUS, State.Destroyed);
         return listBy(sc, null);
     }
 
@@ -102,28 +110,28 @@ public List<SnapshotVO> listByVolumeId(long volumeId) {
     @Override
     public List<SnapshotVO> listByVolumeId(Filter filter, long volumeId) {
         SearchCriteria<SnapshotVO> sc = VolumeIdSearch.create();
-        sc.setParameters("volumeId", volumeId);
+        sc.setParameters(VOLUME_ID, volumeId);
         return listBy(sc, filter);
     }
 
     @Override
     public List<SnapshotVO> listByVolumeIdIncludingRemoved(long volumeId) {
         SearchCriteria<SnapshotVO> sc = VolumeIdSearch.create();
-        sc.setParameters("volumeId", volumeId);
+        sc.setParameters(VOLUME_ID, volumeId);
         return listIncludingRemovedBy(sc, null);
     }
 
     public List<SnapshotVO> listByVolumeIdType(Filter filter, long volumeId, Type type) {
         SearchCriteria<SnapshotVO> sc = VolumeIdTypeSearch.create();
-        sc.setParameters("volumeId", volumeId);
-        sc.setParameters("type", type.ordinal());
+        sc.setParameters(VOLUME_ID, volumeId);
+        sc.setParameters(TYPE, type.ordinal());
         return listBy(sc, filter);
     }
 
     public List<SnapshotVO> listByVolumeIdVersion(Filter filter, long volumeId, String version) {
         SearchCriteria<SnapshotVO> sc = VolumeIdVersionSearch.create();
-        sc.setParameters("volumeId", volumeId);
-        sc.setParameters("version", version);
+        sc.setParameters(VOLUME_ID, volumeId);
+        sc.setParameters(VERSION, version);
         return listBy(sc, filter);
     }
 
@@ -133,61 +141,61 @@ public SnapshotDaoImpl() {
     @PostConstruct
     protected void init() {
         VolumeIdSearch = createSearchBuilder();
-        VolumeIdSearch.and("volumeId", VolumeIdSearch.entity().getVolumeId(), SearchCriteria.Op.EQ);
+        VolumeIdSearch.and(VOLUME_ID, VolumeIdSearch.entity().getVolumeId(), SearchCriteria.Op.EQ);
         VolumeIdSearch.done();
 
         VolumeIdTypeSearch = createSearchBuilder();
-        VolumeIdTypeSearch.and("volumeId", VolumeIdTypeSearch.entity().getVolumeId(), SearchCriteria.Op.EQ);
-        VolumeIdTypeSearch.and("type", VolumeIdTypeSearch.entity().getSnapshotType(), SearchCriteria.Op.EQ);
+        VolumeIdTypeSearch.and(VOLUME_ID, VolumeIdTypeSearch.entity().getVolumeId(), SearchCriteria.Op.EQ);
+        VolumeIdTypeSearch.and(TYPE, VolumeIdTypeSearch.entity().getSnapshotType(), SearchCriteria.Op.EQ);
         VolumeIdTypeSearch.done();
 
         VolumeIdTypeNotDestroyedSearch = createSearchBuilder();
-        VolumeIdTypeNotDestroyedSearch.and("volumeId", VolumeIdTypeNotDestroyedSearch.entity().getVolumeId(), SearchCriteria.Op.EQ);
-        VolumeIdTypeNotDestroyedSearch.and("type", VolumeIdTypeNotDestroyedSearch.entity().getSnapshotType(), SearchCriteria.Op.EQ);
-        VolumeIdTypeNotDestroyedSearch.and("status", VolumeIdTypeNotDestroyedSearch.entity().getState(), SearchCriteria.Op.NEQ);
+        VolumeIdTypeNotDestroyedSearch.and(VOLUME_ID, VolumeIdTypeNotDestroyedSearch.entity().getVolumeId(), SearchCriteria.Op.EQ);
+        VolumeIdTypeNotDestroyedSearch.and(TYPE, VolumeIdTypeNotDestroyedSearch.entity().getSnapshotType(), SearchCriteria.Op.EQ);
+        VolumeIdTypeNotDestroyedSearch.and(STATUS, VolumeIdTypeNotDestroyedSearch.entity().getState(), SearchCriteria.Op.NEQ);
         VolumeIdTypeNotDestroyedSearch.done();
 
         VolumeIdVersionSearch = createSearchBuilder();
-        VolumeIdVersionSearch.and("volumeId", VolumeIdVersionSearch.entity().getVolumeId(), SearchCriteria.Op.EQ);
-        VolumeIdVersionSearch.and("version", VolumeIdVersionSearch.entity().getVersion(), SearchCriteria.Op.EQ);
+        VolumeIdVersionSearch.and(VOLUME_ID, VolumeIdVersionSearch.entity().getVolumeId(), SearchCriteria.Op.EQ);
+        VolumeIdVersionSearch.and(VERSION, VolumeIdVersionSearch.entity().getVersion(), SearchCriteria.Op.EQ);
         VolumeIdVersionSearch.done();
 
         AccountIdSearch = createSearchBuilder();
-        AccountIdSearch.and("accountId", AccountIdSearch.entity().getAccountId(), SearchCriteria.Op.EQ);
+        AccountIdSearch.and(ACCOUNT_ID, AccountIdSearch.entity().getAccountId(), SearchCriteria.Op.EQ);
         AccountIdSearch.done();
 
         StatusSearch = createSearchBuilder();
-        StatusSearch.and("volumeId", StatusSearch.entity().getVolumeId(), SearchCriteria.Op.EQ);
-        StatusSearch.and("status", StatusSearch.entity().getState(), SearchCriteria.Op.IN);
+        StatusSearch.and(VOLUME_ID, StatusSearch.entity().getVolumeId(), SearchCriteria.Op.EQ);
+        StatusSearch.and(STATUS, StatusSearch.entity().getState(), SearchCriteria.Op.IN);
         StatusSearch.done();
 
         notInStatusSearch  = createSearchBuilder();
-        notInStatusSearch.and("volumeId", notInStatusSearch.entity().getVolumeId(), SearchCriteria.Op.EQ);
-        notInStatusSearch.and("status", notInStatusSearch.entity().getState(), SearchCriteria.Op.NOTIN);
+        notInStatusSearch.and(VOLUME_ID, notInStatusSearch.entity().getVolumeId(), SearchCriteria.Op.EQ);
+        notInStatusSearch.and(STATUS, notInStatusSearch.entity().getState(), SearchCriteria.Op.NOTIN);
         notInStatusSearch.done();
 
         CountSnapshotsByAccount = createSearchBuilder(Long.class);
         CountSnapshotsByAccount.select(null, Func.COUNT, null);
-        CountSnapshotsByAccount.and("account", CountSnapshotsByAccount.entity().getAccountId(), SearchCriteria.Op.EQ);
-        CountSnapshotsByAccount.and("status", CountSnapshotsByAccount.entity().getState(), SearchCriteria.Op.NIN);
+        CountSnapshotsByAccount.and(ACCOUNT_ID, CountSnapshotsByAccount.entity().getAccountId(), SearchCriteria.Op.EQ);
+        CountSnapshotsByAccount.and(STATUS, CountSnapshotsByAccount.entity().getState(), SearchCriteria.Op.NIN);
         CountSnapshotsByAccount.and("snapshotTypeNEQ", CountSnapshotsByAccount.entity().getSnapshotType(), SearchCriteria.Op.NIN);
-        CountSnapshotsByAccount.and("removed", CountSnapshotsByAccount.entity().getRemoved(), SearchCriteria.Op.NULL);
+        CountSnapshotsByAccount.and(REMOVED, CountSnapshotsByAccount.entity().getRemoved(), SearchCriteria.Op.NULL);
         CountSnapshotsByAccount.done();
 
         InstanceIdSearch = createSearchBuilder();
-        InstanceIdSearch.and("status", InstanceIdSearch.entity().getState(), SearchCriteria.Op.IN);
+        InstanceIdSearch.and(STATUS, InstanceIdSearch.entity().getState(), SearchCriteria.Op.IN);
 
         snapshotIdsSearch = createSearchBuilder();
-        snapshotIdsSearch.and("id", snapshotIdsSearch.entity().getId(), SearchCriteria.Op.IN);
+        snapshotIdsSearch.and(ID, snapshotIdsSearch.entity().getId(), SearchCriteria.Op.IN);
 
         SearchBuilder<VMInstanceVO> instanceSearch = _instanceDao.createSearchBuilder();
-        instanceSearch.and("instanceId", instanceSearch.entity().getId(), SearchCriteria.Op.EQ);
+        instanceSearch.and(INSTANCE_ID, instanceSearch.entity().getId(), SearchCriteria.Op.EQ);
 
         SearchBuilder<VolumeVO> volumeSearch = _volumeDao.createSearchBuilder();
-        volumeSearch.and("state", volumeSearch.entity().getState(), SearchCriteria.Op.EQ);
-        volumeSearch.join("instanceVolumes", instanceSearch, instanceSearch.entity().getId(), volumeSearch.entity().getInstanceId(), JoinType.INNER);
+        volumeSearch.and(STATE, volumeSearch.entity().getState(), SearchCriteria.Op.EQ);
+        volumeSearch.join(INSTANCE_VOLUMES, instanceSearch, instanceSearch.entity().getId(), volumeSearch.entity().getInstanceId(), JoinType.INNER);
 
-        InstanceIdSearch.join("instanceSnapshots", volumeSearch, volumeSearch.entity().getId(), InstanceIdSearch.entity().getVolumeId(), JoinType.INNER);
+        InstanceIdSearch.join(INSTANCE_SNAPSHOTS, volumeSearch, volumeSearch.entity().getId(), InstanceIdSearch.entity().getVolumeId(), JoinType.INNER);
         InstanceIdSearch.done();
 
         volumeIdAndTypeNotInSearch = createSearchBuilder();
@@ -219,8 +227,8 @@ public long getLastSnapshot(long volumeId, DataStoreRole role) {
     @Override
     public Long countSnapshotsForAccount(long accountId) {
         SearchCriteria<Long> sc = CountSnapshotsByAccount.create();
-        sc.setParameters("account", accountId);
-        sc.setParameters("status", State.Error, State.Destroyed);
+        sc.setParameters(ACCOUNT_ID, accountId);
+        sc.setParameters(STATUS, State.Error, State.Destroyed);
         sc.setParameters("snapshotTypeNEQ", Snapshot.Type.GROUP.ordinal());
         return customSearch(sc, null).get(0);
     }
@@ -230,19 +238,19 @@ public List<SnapshotVO> listByInstanceId(long instanceId, Snapshot.State... stat
         SearchCriteria<SnapshotVO> sc = InstanceIdSearch.create();
 
         if (status != null && status.length != 0) {
-            sc.setParameters("status", (Object[])status);
+            sc.setParameters(STATUS, (Object[])status);
         }
 
-        sc.setJoinParameters("instanceSnapshots", "state", Volume.State.Ready);
-        sc.setJoinParameters("instanceVolumes", "instanceId", instanceId);
+        sc.setJoinParameters(INSTANCE_SNAPSHOTS, STATE, Volume.State.Ready);
+        sc.setJoinParameters(INSTANCE_VOLUMES, INSTANCE_ID, instanceId);
         return listBy(sc, null);
     }
 
     @Override
     public List<SnapshotVO> listByStatus(long volumeId, Snapshot.State... status) {
         SearchCriteria<SnapshotVO> sc = StatusSearch.create();
-        sc.setParameters("volumeId", volumeId);
-        sc.setParameters("status", (Object[])status);
+        sc.setParameters(VOLUME_ID, volumeId);
+        sc.setParameters(STATUS, (Object[])status);
         return listBy(sc, null);
     }
 
@@ -263,7 +271,7 @@ public boolean remove(Long id) {
     @Override
     public List<SnapshotVO> listAllByStatus(Snapshot.State... status) {
         SearchCriteria<SnapshotVO> sc = StatusSearch.create();
-        sc.setParameters("status", (Object[])status);
+        sc.setParameters(STATUS, (Object[])status);
         return listBy(sc, null);
     }
 
@@ -277,7 +285,7 @@ public List<SnapshotVO> listAllByStatusIncludingRemoved(Snapshot.State... status
     @Override
     public List<SnapshotVO> listByIds(Object... ids) {
         SearchCriteria<SnapshotVO> sc = snapshotIdsSearch.create();
-        sc.setParameters("id", ids);
+        sc.setParameters(ID, ids);
         return listBy(sc, null);
     }
 
@@ -295,7 +303,7 @@ public boolean updateState(State currentState, Event event, State nextState, Sna
     @Override
     public void updateVolumeIds(long oldVolId, long newVolId) {
         SearchCriteria<SnapshotVO> sc = VolumeIdSearch.create();
-        sc.setParameters("volumeId", oldVolId);
+        sc.setParameters(VOLUME_ID, oldVolId);
         SnapshotVO snapshot = createForUpdate();
         snapshot.setVolumeId(newVolId);
         UpdateBuilder ub = getUpdateBuilder(snapshot);
@@ -305,8 +313,8 @@ public void updateVolumeIds(long oldVolId, long newVolId) {
     @Override
     public List<SnapshotVO> listByStatusNotIn(long volumeId, Snapshot.State... status) {
         SearchCriteria<SnapshotVO> sc = this.notInStatusSearch.create();
-        sc.setParameters("volumeId", volumeId);
-        sc.setParameters("status", (Object[]) status);
+        sc.setParameters(VOLUME_ID, volumeId);
+        sc.setParameters(STATUS, (Object[]) status);
         return listBy(sc, null);
     }
 
diff --git a/engine/schema/src/main/java/com/cloud/upgrade/DatabaseUpgradeChecker.java b/engine/schema/src/main/java/com/cloud/upgrade/DatabaseUpgradeChecker.java
index 0e784d961b3d..c3a982aa70e5 100644
--- a/engine/schema/src/main/java/com/cloud/upgrade/DatabaseUpgradeChecker.java
+++ b/engine/schema/src/main/java/com/cloud/upgrade/DatabaseUpgradeChecker.java
@@ -88,7 +88,9 @@
 import com.cloud.upgrade.dao.Upgrade41900to41910;
 import com.cloud.upgrade.dao.Upgrade41910to42000;
 import com.cloud.upgrade.dao.Upgrade42000to42010;
-import com.cloud.upgrade.dao.Upgrade42010to42100;
+import com.cloud.upgrade.dao.Upgrade42020to42030;
+import com.cloud.upgrade.dao.Upgrade42030to42040;
+import com.cloud.upgrade.dao.Upgrade42040to42100;
 import com.cloud.upgrade.dao.Upgrade42100to42200;
 import com.cloud.upgrade.dao.Upgrade42200to42210;
 import com.cloud.upgrade.dao.Upgrade420to421;
@@ -240,7 +242,9 @@ public DatabaseUpgradeChecker() {
                 .next("4.19.0.0", new Upgrade41900to41910())
                 .next("4.19.1.0", new Upgrade41910to42000())
                 .next("4.20.0.0", new Upgrade42000to42010())
-                .next("4.20.1.0", new Upgrade42010to42100())
+                .next("4.20.2.0", new Upgrade42020to42030())
+                .next("4.20.3.0", new Upgrade42030to42040())
+                .next("4.20.4.0", new Upgrade42040to42100())
                 .next("4.21.0.0", new Upgrade42100to42200())
                 .next("4.22.0.0", new Upgrade42200to42210())
                 .next("4.22.1.0", new Upgrade42210to42300())
diff --git a/engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42030to42040.java b/engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42030to42040.java
new file mode 100644
index 000000000000..90f69a87cb03
--- /dev/null
+++ b/engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42030to42040.java
@@ -0,0 +1,58 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.upgrade.dao;
+
+import java.io.InputStream;
+import java.sql.Connection;
+import java.util.ArrayList;
+import java.util.List;
+
+public class Upgrade42030to42040 extends DbUpgradeAbstractImpl implements DbUpgrade, DbUpgradeSystemVmTemplate {
+
+    @Override
+    public String[] getUpgradableVersionRange() {
+        return new String[]{"4.20.3.0", "4.20.4.0"};
+    }
+
+    @Override
+    public String getUpgradedVersion() {
+        return "4.20.4.0";
+    }
+
+    @Override
+    public boolean supportsRollingUpgrade() {
+        return false;
+    }
+
+    @Override
+    public InputStream[] getPrepareScripts() {
+        return null;
+    }
+
+    @Override
+    public void performDataMigration(Connection conn) {
+        final List<String> indexList = new ArrayList<String>();
+        logger.debug("Dropping index vm_instance_id from usage_vm_instance table if it exists");
+        indexList.add("vm_instance_id");
+        DbUpgradeUtils.dropKeysIfExist(conn, "cloud_usage.usage_vm_instance", indexList, false);
+    }
+
+    @Override
+    public InputStream[] getCleanupScripts() {
+        return null;
+    }
+}
diff --git a/engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42010to42100.java b/engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42040to42100.java
similarity index 97%
rename from engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42010to42100.java
rename to engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42040to42100.java
index 786ee5afbc8e..64ac2c90bc07 100644
--- a/engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42010to42100.java
+++ b/engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42040to42100.java
@@ -32,12 +32,12 @@
 import com.cloud.utils.db.TransactionLegacy;
 import com.cloud.utils.exception.CloudRuntimeException;
 
-public class Upgrade42010to42100 extends DbUpgradeAbstractImpl implements DbUpgrade, DbUpgradeSystemVmTemplate {
+public class Upgrade42040to42100 extends DbUpgradeAbstractImpl implements DbUpgrade, DbUpgradeSystemVmTemplate {
     private SystemVmTemplateRegistration systemVmTemplateRegistration;
 
     @Override
     public String[] getUpgradableVersionRange() {
-        return new String[] {"4.20.1.0", "4.21.0.0"};
+        return new String[] {"4.20.4.0", "4.21.0.0"};
     }
 
     @Override
@@ -52,7 +52,7 @@ public boolean supportsRollingUpgrade() {
 
     @Override
     public InputStream[] getPrepareScripts() {
-        final String scriptFile = "META-INF/db/schema-42010to42100.sql";
+        final String scriptFile = "META-INF/db/schema-42040to42100.sql";
         final InputStream script = Thread.currentThread().getContextClassLoader().getResourceAsStream(scriptFile);
         if (script == null) {
             throw new CloudRuntimeException("Unable to find " + scriptFile);
@@ -69,7 +69,7 @@ public void performDataMigration(Connection conn) {
 
     @Override
     public InputStream[] getCleanupScripts() {
-        final String scriptFile = "META-INF/db/schema-42010to42100-cleanup.sql";
+        final String scriptFile = "META-INF/db/schema-42040to42100-cleanup.sql";
         final InputStream script = Thread.currentThread().getContextClassLoader().getResourceAsStream(scriptFile);
         if (script == null) {
             throw new CloudRuntimeException("Unable to find " + scriptFile);
diff --git a/engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42210to42300.java b/engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42210to42300.java
index 393f20399503..b60a52bba88b 100644
--- a/engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42210to42300.java
+++ b/engine/schema/src/main/java/com/cloud/upgrade/dao/Upgrade42210to42300.java
@@ -21,6 +21,8 @@
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
+import java.util.ArrayList;
+import java.util.List;
 
 import com.cloud.utils.crypt.DBEncryptionUtil;
 import com.cloud.utils.exception.CloudRuntimeException;
@@ -51,6 +53,7 @@ public InputStream[] getPrepareScripts() {
     @Override
     public void performDataMigration(Connection conn) {
         unhideJsInterpretationEnabled(conn);
+        dropUsageVmInstanceIndex(conn);
     }
 
     protected void unhideJsInterpretationEnabled(Connection conn) {
@@ -89,4 +92,11 @@ protected void updateJsInterpretationEnabledFields(Connection conn, String encry
             logger.warn("Error while decrypting configuration 'js.interpretation.enabled'. The configuration may already be decrypted.");
         }
     }
+
+    private void dropUsageVmInstanceIndex(Connection conn) {
+        final List<String> indexList = new ArrayList<>();
+        logger.debug("Dropping index vm_instance_id from usage_vm_instance table if it exists");
+        indexList.add("vm_instance_id");
+        DbUpgradeUtils.dropKeysIfExist(conn, "cloud_usage.usage_vm_instance", indexList, false);
+    }
 }
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupOfferingVO.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupOfferingVO.java
index ebeb7d4a2d59..9156f8f5ff84 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupOfferingVO.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupOfferingVO.java
@@ -83,6 +83,11 @@ public BackupOfferingVO(final long zoneId, final String externalId, final String
         this.created = new Date();
     }
 
+    public BackupOfferingVO(final long zoneId, final String provider, final String name, final String description, final boolean userDrivenBackupAllowed) {
+        this(zoneId, null, provider, name, description, userDrivenBackupAllowed);
+        this.externalId = this.uuid;
+    }
+
     public String getUuid() {
         return uuid;
     }
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupScheduleVO.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupScheduleVO.java
index 1ee2cff78b65..aa02bb077163 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupScheduleVO.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupScheduleVO.java
@@ -74,10 +74,14 @@ public class BackupScheduleVO implements BackupSchedule {
     @Column(name = "domain_id")
     Long domainId;
 
+    @Column(name = "isolated")
+    private boolean isolated;
+
     public BackupScheduleVO() {
     }
 
-    public BackupScheduleVO(Long vmId, DateUtil.IntervalType scheduleType, String schedule, String timezone, Date scheduledTimestamp, int maxBackups, Boolean quiesceVM, Long accountId, Long domainId) {
+    public BackupScheduleVO(Long vmId, DateUtil.IntervalType scheduleType, String schedule, String timezone, Date scheduledTimestamp, int maxBackups, Boolean quiesceVM,
+            Long accountId, Long domainId, boolean isolated) {
         this.vmId = vmId;
         this.scheduleType = (short) scheduleType.ordinal();
         this.schedule = schedule;
@@ -87,6 +91,7 @@ public BackupScheduleVO(Long vmId, DateUtil.IntervalType scheduleType, String sc
         this.quiesceVM = quiesceVM;
         this.accountId = accountId;
         this.domainId = domainId;
+        this.isolated = isolated;
     }
 
     @Override
@@ -197,4 +202,13 @@ public void setAccountId(Long accountId) {
     public void setDomainId(Long domainId) {
         this.domainId = domainId;
     }
+
+    @Override
+    public boolean isIsolated() {
+        return isolated;
+    }
+
+    public void setIsolated(boolean isolated) {
+        this.isolated = isolated;
+    }
 }
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupVO.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupVO.java
index d589f9e6bef8..b4cad92d8770 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupVO.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupVO.java
@@ -19,7 +19,6 @@
 
 import com.cloud.utils.db.GenericDao;
 import com.google.gson.Gson;
-
 import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;
 import org.apache.commons.lang3.StringUtils;
 
@@ -66,7 +65,7 @@ public class BackupVO implements Backup {
     private String externalId;
 
     @Column(name = "type")
-    private String backupType;
+    private String type;
 
     @Column(name = "date")
     @Temporal(value = TemporalType.DATE)
@@ -81,6 +80,9 @@ public class BackupVO implements Backup {
     @Column(name = "protected_size")
     private Long protectedSize;
 
+    @Column(name = "uncompressed_size")
+    private Long uncompressedSize;
+
     @Enumerated(value = EnumType.STRING)
     @Column(name = "status")
     private Backup.Status status;
@@ -103,6 +105,12 @@ public class BackupVO implements Backup {
     @Column(name = "backup_schedule_id")
     private Long backupScheduleId;
 
+    @Column(name = "compression_status")
+    private CompressionStatus compressionStatus;
+
+    @Column(name = "validation_status")
+    private ValidationStatus validationStatus;
+
     @Column(name = "from_checkpoint_id")
     private String fromCheckpointId;
 
@@ -122,10 +130,27 @@ public BackupVO() {
         this.uuid = UUID.randomUUID().toString();
     }
 
+    public BackupVO(String name, long vmId, long backupOfferingId, long accountId, long domainId, long zoneId, long virtualSize,
+                    Status status, Long backupScheduleId, CompressionStatus compressionStatus, ValidationStatus validationStatus) {
+        this.name = name;
+        this.vmId = vmId;
+        this.backupOfferingId = backupOfferingId;
+        this.accountId = accountId;
+        this.domainId = domainId;
+        this.zoneId = zoneId;
+        this.protectedSize = virtualSize;
+        this.status = status;
+        this.setType("FULL");
+        this.uuid = UUID.randomUUID().toString();
+        this.backupScheduleId = backupScheduleId;
+        this.compressionStatus = compressionStatus;
+        this.validationStatus = validationStatus;
+    }
+
     @Override
     public String toString() {
         return String.format("Backup %s", ReflectionToStringBuilderUtils.reflectOnlySelectedFields(
-                this, "id", "uuid", "vmId", "backupType", "externalId"));
+                this, "id", "uuid", "vmId", "type", "externalId"));
     }
 
     @Override
@@ -156,12 +181,13 @@ public void setExternalId(String externalId) {
         this.externalId = externalId;
     }
 
+    @Override
     public String getType() {
-        return backupType;
+        return type;
     }
 
     public void setType(String type) {
-        this.backupType = type;
+        this.type = type;
     }
 
     @Override
@@ -301,6 +327,32 @@ public void setBackupScheduleId(Long backupScheduleId) {
         this.backupScheduleId = backupScheduleId;
     }
 
+    @Override
+    public CompressionStatus getCompressionStatus() {
+        return compressionStatus;
+    }
+
+    public void setCompressionStatus(CompressionStatus compressionStatus) {
+        this.compressionStatus = compressionStatus;
+    }
+
+    @Override
+    public ValidationStatus getValidationStatus() {
+        return validationStatus;
+    }
+
+    public void setValidationStatus(ValidationStatus validationStatus) {
+        this.validationStatus = validationStatus;
+    }
+
+    public Long getUncompressedSize() {
+        return uncompressedSize;
+    }
+
+    public void setUncompressedSize(Long uncompressedSize) {
+        this.uncompressedSize = uncompressedSize;
+    }
+
     @Override
     public String getFromCheckpointId() {
         return fromCheckpointId;
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/InternalBackupDataStoreVO.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/InternalBackupDataStoreVO.java
new file mode 100644
index 000000000000..5266a4129905
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/InternalBackupDataStoreVO.java
@@ -0,0 +1,95 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+package org.apache.cloudstack.backup;
+
+import org.apache.cloudstack.api.InternalIdentity;
+import org.apache.commons.lang3.builder.ReflectionToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringStyle;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Table;
+
+
+@Entity
+@Table(name = "internal_backup_store_ref")
+public class InternalBackupDataStoreVO implements InternalIdentity {
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "id")
+    private long id;
+
+    @Column(name = "backup_id")
+    private long backupId;
+
+    @Column(name = "volume_id")
+    private long volumeId;
+
+    @Column (name = "device_id")
+    private long deviceId;
+
+    @Column(name = "path")
+    private String backupPath;
+
+    public InternalBackupDataStoreVO() {
+    }
+
+    public InternalBackupDataStoreVO(long backupId, long volumeId, long deviceId, String backupPath) {
+        this.backupId = backupId;
+        this.volumeId = volumeId;
+        this.deviceId = deviceId;
+        this.backupPath = backupPath;
+    }
+
+    @Override
+    public long getId() {
+        return id;
+    }
+
+    public long getBackupId() {
+        return backupId;
+    }
+
+    public long getVolumeId() {
+        return volumeId;
+    }
+
+    public long getDeviceId() {
+        return deviceId;
+    }
+
+    public String getBackupPath() {
+        return backupPath;
+    }
+
+    public void setVolumeId(long volumeId) {
+        this.volumeId = volumeId;
+    }
+
+    public void setBackupPath(String backupPath) {
+        this.backupPath = backupPath;
+    }
+
+    @Override
+    public String toString() {
+        return ReflectionToStringBuilder.toString(this, ToStringStyle.JSON_STYLE);
+    }
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/InternalBackupJoinVO.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/InternalBackupJoinVO.java
new file mode 100644
index 000000000000..acc54ccd41fa
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/InternalBackupJoinVO.java
@@ -0,0 +1,190 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.google.gson.Gson;
+import org.apache.commons.lang3.BooleanUtils;
+import org.apache.commons.lang3.builder.ReflectionToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringStyle;
+import org.apache.commons.lang3.StringUtils;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.EnumType;
+import javax.persistence.Enumerated;
+import javax.persistence.Id;
+import javax.persistence.Table;
+import javax.persistence.Temporal;
+import javax.persistence.TemporalType;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.Date;
+import java.util.List;
+
+@Entity
+@Table(name = "internal_backup_view")
+public class InternalBackupJoinVO {
+
+    @Id
+    @Column(name="id")
+    private long id;
+
+    @Column(name = "uuid")
+    private String uuid;
+
+    @Column(name = "vm_id")
+    private long vmId;
+
+    @Column(name = "backed_volumes", length = 65535)
+    private String backedUpVolumes;
+
+    @Column(name = "backup_offering_id")
+    private long backupOfferingId;
+
+    @Column(name = "image_store_id")
+    private long imageStoreId;
+
+    @Column(name = "parent_id")
+    private long parentId;
+
+    @Column(name = "type")
+    private String type;
+
+    @Column(name = "date")
+    @Temporal(value = TemporalType.DATE)
+    private Date date;
+
+    @Enumerated(value = EnumType.STRING)
+    @Column(name = "status")
+    private Backup.Status status;
+
+    @Enumerated(value = EnumType.STRING)
+    @Column(name = "compression_status")
+    private Backup.CompressionStatus compressionStatus;
+
+    @Column(name = "end_of_chain")
+    private Boolean endOfChain;
+
+    @Column(name = "current")
+    private Boolean current;
+
+    @Column(name = "image_store_path")
+    private String imageStorePath;
+
+    @Column(name = "zone_id")
+    private long zoneId;
+
+    @Column(name = "size")
+    private long size;
+
+    @Column(name = "protected_size")
+    private long protectedSize;
+
+    @Column(name = "volume_id")
+    private long volumeId;
+
+    @Column(name = "isolated")
+    private Boolean isolated;
+
+    public InternalBackupJoinVO() {
+    }
+
+    public long getId() {
+        return id;
+    }
+
+    public String getUuid() {
+        return uuid;
+    }
+
+    public long getVmId() {
+        return vmId;
+    }
+
+    public List<Backup.VolumeInfo> getBackedUpVolumes() {
+        if (StringUtils.isEmpty(this.backedUpVolumes)) {
+            return Collections.emptyList();
+        }
+        return Arrays.asList(new Gson().fromJson(this.backedUpVolumes, Backup.VolumeInfo[].class));
+    }
+
+    public long getBackupOfferingId() {
+        return backupOfferingId;
+    }
+
+    public long getImageStoreId() {
+        return imageStoreId;
+    }
+
+    public long getParentId() {
+        return parentId;
+    }
+
+    public String getType() {
+        return type;
+    }
+
+    public Date getDate() {
+        return date;
+    }
+
+    public Backup.Status getStatus() {
+        return status;
+    }
+
+    public Boolean getEndOfChain() {
+        return BooleanUtils.isTrue(endOfChain);
+    }
+
+    public Boolean getCurrent() {
+        return BooleanUtils.isTrue(current);
+    }
+
+    public String getImageStorePath() {
+        return imageStorePath;
+    }
+
+    public long getZoneId() {
+        return zoneId;
+    }
+
+    public long getSize() {
+        return size;
+    }
+
+    public long getProtectedSize() {
+        return protectedSize;
+    }
+
+    public long getVolumeId() {
+        return volumeId;
+    }
+
+    public Boolean getIsolated() {
+        return BooleanUtils.isTrue(isolated);
+    }
+
+    public Backup.CompressionStatus getCompressionStatus() {
+        return compressionStatus;
+    }
+
+    @Override
+    public String toString() {
+        return ReflectionToStringBuilder.toString(this, ToStringStyle.JSON_STYLE);
+    }
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/InternalBackupServiceJobType.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/InternalBackupServiceJobType.java
new file mode 100644
index 000000000000..287b64c2e6fc
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/InternalBackupServiceJobType.java
@@ -0,0 +1,21 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.backup;
+
+public enum InternalBackupServiceJobType {
+    StartCompression, FinalizeCompression, BackupValidation
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/InternalBackupServiceJobVO.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/InternalBackupServiceJobVO.java
new file mode 100644
index 000000000000..87b4a53cb615
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/InternalBackupServiceJobVO.java
@@ -0,0 +1,179 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.backup;
+
+import com.cloud.utils.db.GenericDao;
+import org.apache.cloudstack.api.InternalIdentity;
+import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Table;
+import javax.persistence.Temporal;
+import javax.persistence.TemporalType;
+import java.util.Date;
+
+@Entity
+@Table(name = "internal_backup_service_job")
+public class InternalBackupServiceJobVO implements InternalIdentity, Comparable<InternalBackupServiceJobVO> {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "id")
+    private long id;
+
+    @Column(name = "backup_id")
+    private long backupId;
+
+    @Column(name = "instance_id")
+    private long instanceId;
+
+    @Column(name = "account_id")
+    private long accountId;
+
+    @Column(name = "host_id")
+    private Long hostId;
+
+    @Column(name = "zone_id")
+    private long zoneId;
+
+    @Column(name = "attempts")
+    private int attempts;
+
+    @Column (name = "type")
+    private InternalBackupServiceJobType type;
+
+    @Column(name = GenericDao.CREATED_COLUMN)
+    private Date created;
+
+    @Column(name = "scheduled_start_time")
+    @Temporal(value = TemporalType.TIMESTAMP)
+    private Date scheduledStartTime;
+
+    @Column(name = "start_time")
+    @Temporal(value = TemporalType.TIMESTAMP)
+    private Date startTime;
+
+    @Column(name = GenericDao.REMOVED_COLUMN)
+    @Temporal(value = TemporalType.TIMESTAMP)
+    private Date removed;
+
+    public InternalBackupServiceJobVO() {
+    }
+
+    public InternalBackupServiceJobVO(long backupId, long zoneId, long instanceId, long accountId, InternalBackupServiceJobType type) {
+        this.created = new Date();
+        this.backupId = backupId;
+        this.zoneId = zoneId;
+        this.instanceId = instanceId;
+        this.accountId = accountId;
+        this.type = type;
+        this.scheduledStartTime = this.created;
+    }
+
+    public InternalBackupServiceJobVO(long backupId, long zoneId, long instanceId, long accountId, InternalBackupServiceJobType type, Date scheduledStartTime) {
+        this(backupId, zoneId, instanceId, accountId, type);
+        this.scheduledStartTime = scheduledStartTime;
+    }
+
+    @Override
+    public long getId() {
+        return id;
+    }
+
+    public long getBackupId() {
+        return backupId;
+    }
+
+    public long getInstanceId() {
+        return instanceId;
+    }
+
+    public long getAccountId() {
+        return accountId;
+    }
+
+    public Long getHostId() {
+        return hostId;
+    }
+
+    public void setHostId(Long hostId) {
+        this.hostId = hostId;
+    }
+
+    public long getZoneId() {
+        return zoneId;
+    }
+
+    public void setZoneId(Long zoneId) {
+        this.zoneId = zoneId;
+    }
+
+    public int getAttempts() {
+        return attempts;
+    }
+
+    public void setAttempts(int attempts) {
+        this.attempts = attempts;
+    }
+
+    public InternalBackupServiceJobType getType() {
+        return type;
+    }
+
+    public Date getCreated() {
+        return created;
+    }
+
+    public Date getScheduledStartTime() {
+        return scheduledStartTime;
+    }
+
+    public void setScheduledStartTime(Date scheduledStartTime) {
+        this.scheduledStartTime = scheduledStartTime;
+    }
+
+    public Date getStartTime() {
+        return startTime;
+    }
+
+    public void setStartTime(Date startTime) {
+        this.startTime = startTime;
+    }
+
+    public Date getRemoved() {
+        return removed;
+    }
+
+    public void setRemoved(Date removed) {
+        this.removed = removed;
+    }
+
+    @Override
+    public int compareTo(InternalBackupServiceJobVO that) {
+        return this.created.compareTo(that.created);
+    }
+
+    @Override
+    public String toString() {
+        return ReflectionToStringBuilderUtils.reflectOnlySelectedFields(this, "id", "backupId", "zoneId", "hostId", "created", "scheduledStartTime", "startTime", "attempts",
+                "type");
+    }
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/InternalBackupStoragePoolVO.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/InternalBackupStoragePoolVO.java
new file mode 100644
index 000000000000..f6d4cd10ffb7
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/InternalBackupStoragePoolVO.java
@@ -0,0 +1,101 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+package org.apache.cloudstack.backup;
+
+import org.apache.cloudstack.api.InternalIdentity;
+import org.apache.commons.lang3.builder.ReflectionToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringStyle;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Table;
+
+@Entity
+@Table(name = "internal_backup_pool_ref")
+public class InternalBackupStoragePoolVO implements InternalIdentity {
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "id")
+    private long id;
+
+    @Column(name = "backup_id")
+    private long backupId;
+
+    @Column(name = "storage_pool_id")
+    private long storagePoolId;
+
+    @Column(name = "volume_id")
+    private long volumeId;
+
+    @Column(name = "backup_delta_path")
+    private String backupDeltaPath;
+
+    @Column(name = "backup_parent_path")
+    private String backupDeltaParentPath;
+
+    public InternalBackupStoragePoolVO() {
+    }
+
+    public InternalBackupStoragePoolVO(long backupId, long storagePoolId, long volumeId, String backupDeltaPath, String backupDeltaParentPath) {
+        this.backupId = backupId;
+        this.storagePoolId = storagePoolId;
+        this.volumeId = volumeId;
+        this.backupDeltaPath = backupDeltaPath;
+        this.backupDeltaParentPath = backupDeltaParentPath;
+    }
+
+    @Override
+    public long getId() {
+        return id;
+    }
+
+    public long getBackupId() {
+        return backupId;
+    }
+
+    public long getStoragePoolId() {
+        return storagePoolId;
+    }
+
+    public long getVolumeId() {
+        return volumeId;
+    }
+
+    public String getBackupDeltaPath() {
+        return backupDeltaPath;
+    }
+
+    public String getBackupDeltaParentPath() {
+        return backupDeltaParentPath;
+    }
+
+    public void setBackupDeltaPath(String backupDeltaPath) {
+        this.backupDeltaPath = backupDeltaPath;
+    }
+
+    public void setBackupDeltaParentPath(String backupDeltaParentPath) {
+        this.backupDeltaParentPath = backupDeltaParentPath;
+    }
+
+    @Override
+    public String toString() {
+        return ReflectionToStringBuilder.toString(this, ToStringStyle.JSON_STYLE);
+    }
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/BackupDao.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/BackupDao.java
index e60e49e1a0c2..3829777d9d8f 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/BackupDao.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/BackupDao.java
@@ -42,4 +42,5 @@ public interface BackupDao extends GenericDao<BackupVO, Long> {
     void loadDetails(BackupVO backup);
     void saveDetails(BackupVO backup);
     List<BackupVO> listBySchedule(Long backupScheduleId);
+    BackupVO findLatestByStatusAndVmId(Backup.Status status, long vmId);
 }
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/BackupDaoImpl.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/BackupDaoImpl.java
index fd29da72c718..9859f29701b7 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/BackupDaoImpl.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/BackupDaoImpl.java
@@ -90,6 +90,7 @@ protected void init() {
         backupSearch.and("external_id", backupSearch.entity().getExternalId(), SearchCriteria.Op.EQ);
         backupSearch.and("backup_offering_id", backupSearch.entity().getBackupOfferingId(), SearchCriteria.Op.EQ);
         backupSearch.and("zone_id", backupSearch.entity().getZoneId(), SearchCriteria.Op.EQ);
+        backupSearch.and("status", backupSearch.entity().getStatus(), SearchCriteria.Op.IN);
         backupSearch.done();
 
         backupVmSearchInZone = createSearchBuilder(Long.class);
@@ -280,4 +281,13 @@ public List<Long> listVmIdsWithBackupsInZone(Long zoneId) {
         sc.setParameters("zone_id", zoneId);
         return customSearchIncludingRemoved(sc, null);
     }
+
+    @Override
+    public BackupVO findLatestByStatusAndVmId(Backup.Status status, long vmId) {
+        SearchCriteria<BackupVO> sc = backupSearch.create();
+        sc.setParameters("vm_id", vmId);
+        sc.setParameters("status", status);
+        Filter filter = new Filter(BackupVO.class, "date", false, 0L, 1L);
+        return findOneBy(sc, filter);
+    }
 }
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/BackupDetailsDao.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/BackupDetailsDao.java
index 664650074bce..c6c8fc3a322e 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/BackupDetailsDao.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/BackupDetailsDao.java
@@ -23,4 +23,19 @@
 
 public interface BackupDetailsDao extends GenericDao<BackupDetailVO, Long>, ResourceDetailsDao<BackupDetailVO> {
 
+    String END_OF_CHAIN = "end_of_chain";
+
+    String CURRENT = "current";
+
+    String IMAGE_STORE_ID = "image_store_id";
+
+    String PARENT_ID = "parent_id";
+
+    String ISOLATED = "isolated";
+
+    String SCREENSHOT_PATH = "screenshot_path";
+
+    String BACKUP_HASH = "backup_hash";
+
+    void removeDetailsExcept(long backupId, String exception);
 }
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/BackupDetailsDaoImpl.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/BackupDetailsDaoImpl.java
index 08c7192af909..5f257c23892c 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/BackupDetailsDaoImpl.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/BackupDetailsDaoImpl.java
@@ -17,13 +17,39 @@
 package org.apache.cloudstack.backup.dao;
 
 
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
 import org.apache.cloudstack.backup.BackupDetailVO;
 import org.apache.cloudstack.resourcedetail.ResourceDetailsDaoBase;
 import org.springframework.stereotype.Component;
 
+import javax.annotation.PostConstruct;
+
 @Component
 public class BackupDetailsDaoImpl extends ResourceDetailsDaoBase<BackupDetailVO> implements BackupDetailsDao {
 
+    private SearchBuilder<BackupDetailVO> backupDetailSearch;
+
+    private static final String BACKUP_ID = "backup_id";
+
+    private static final String KEY = "key";
+
+    @PostConstruct
+    protected void init() {
+        backupDetailSearch = createSearchBuilder();
+        backupDetailSearch.and(BACKUP_ID, backupDetailSearch.entity().getResourceId(), SearchCriteria.Op.EQ);
+        backupDetailSearch.and(KEY, backupDetailSearch.entity().getName(), SearchCriteria.Op.NEQ);
+        backupDetailSearch.done();
+    }
+
+    @Override
+    public void removeDetailsExcept(long backupId, String exception) {
+        SearchCriteria<BackupDetailVO> sc = backupDetailSearch.create();
+        sc.setParameters(BACKUP_ID, backupId);
+        sc.setParameters(KEY, exception);
+        super.expunge(sc);
+    }
+
     @Override
     public void addDetail(long resourceId, String key, String value, boolean display) {
         super.addDetail(new BackupDetailVO(resourceId, key, value, display));
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/BackupOfferingDaoImpl.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/BackupOfferingDaoImpl.java
index 708faeef4643..1d7a55d7caf7 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/BackupOfferingDaoImpl.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/BackupOfferingDaoImpl.java
@@ -22,8 +22,10 @@
 
 import com.cloud.domain.DomainVO;
 import com.cloud.domain.dao.DomainDao;
+import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.response.BackupOfferingResponse;
 import org.apache.cloudstack.backup.BackupOffering;
+import org.apache.cloudstack.backup.BackupOfferingDetailsVO;
 import org.apache.cloudstack.backup.BackupOfferingVO;
 
 import com.cloud.dc.DataCenterVO;
@@ -32,7 +34,9 @@
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
 
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 
 public class BackupOfferingDaoImpl extends GenericDaoBase<BackupOfferingVO, Long> implements BackupOfferingDao {
 
@@ -62,6 +66,7 @@ public BackupOfferingResponse newBackupOfferingResponse(BackupOffering offering,
 
         DataCenterVO zone = dataCenterDao.findById(offering.getZoneId());
         List<Long> domainIds = backupOfferingDetailsDao.findDomainIds(offering.getId());
+        List<BackupOfferingDetailsVO> details = backupOfferingDetailsDao.listDetails(offering.getId());
         BackupOfferingResponse response = new BackupOfferingResponse();
         response.setId(offering.getUuid());
         response.setName(offering.getName());
@@ -88,6 +93,14 @@ public BackupOfferingResponse newBackupOfferingResponse(BackupOffering offering,
         if (crossZoneInstanceCreation) {
             response.setCrossZoneInstanceCreation(true);
         }
+        details.removeIf(backupOfferingDetailsVO -> ApiConstants.DOMAIN_ID.equals(backupOfferingDetailsVO.getName()));
+        Map<String, String> detailString = new HashMap<>();
+        for (BackupOfferingDetailsVO detail : details) {
+            detailString.put(detail.getName(), detail.getValue());
+        }
+        if (!detailString.isEmpty()) {
+            response.setDetails(detailString);
+        }
         response.setCreated(offering.getCreated());
         response.setObjectName("backupoffering");
         return response;
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupDataStoreDao.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupDataStoreDao.java
new file mode 100644
index 000000000000..e71ffe5ebde9
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupDataStoreDao.java
@@ -0,0 +1,33 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+package org.apache.cloudstack.backup.dao;
+
+import com.cloud.utils.db.GenericDao;
+import org.apache.cloudstack.backup.InternalBackupDataStoreVO;
+
+import java.util.List;
+
+public interface InternalBackupDataStoreDao extends GenericDao<InternalBackupDataStoreVO, Long> {
+
+    List<InternalBackupDataStoreVO> listByBackupId(long backupId);
+
+    InternalBackupDataStoreVO findByBackupIdAndVolumeId(long backupId, long volumeId);
+
+    void expungeByBackupId(long backupId);
+
+    void updateVolumeId(long oldVolumeId, long newVolumeId);
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupDataStoreDaoImpl.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupDataStoreDaoImpl.java
new file mode 100644
index 000000000000..34a064ff62a2
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupDataStoreDaoImpl.java
@@ -0,0 +1,74 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+package org.apache.cloudstack.backup.dao;
+
+import com.cloud.utils.db.GenericDaoBase;
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
+import com.cloud.utils.db.UpdateBuilder;
+import org.apache.cloudstack.backup.InternalBackupDataStoreVO;
+
+import javax.annotation.PostConstruct;
+import java.util.List;
+
+public class InternalBackupDataStoreDaoImpl extends GenericDaoBase<InternalBackupDataStoreVO, Long> implements InternalBackupDataStoreDao {
+
+    private SearchBuilder<InternalBackupDataStoreVO> backupSearch;
+
+    private static final String BACKUP_ID = "backup_id";
+    private static final String VOLUME_ID = "volume_id";
+
+    @PostConstruct
+    protected void init() {
+        backupSearch = createSearchBuilder();
+        backupSearch.and(BACKUP_ID, backupSearch.entity().getBackupId(), SearchCriteria.Op.EQ);
+        backupSearch.and(VOLUME_ID, backupSearch.entity().getVolumeId(), SearchCriteria.Op.EQ);
+        backupSearch.done();
+    }
+
+    @Override
+    public List<InternalBackupDataStoreVO> listByBackupId(long backupId) {
+        SearchCriteria<InternalBackupDataStoreVO> sc = backupSearch.create();
+        sc.setParameters(BACKUP_ID, backupId);
+        return listBy(sc);
+    }
+
+    @Override
+    public InternalBackupDataStoreVO findByBackupIdAndVolumeId(long backupId, long volumeId) {
+        SearchCriteria<InternalBackupDataStoreVO> sc = backupSearch.create();
+        sc.setParameters(BACKUP_ID, backupId);
+        sc.setParameters(VOLUME_ID, volumeId);
+        return findOneBy(sc);
+    }
+
+    @Override
+    public void expungeByBackupId(long backupId) {
+        SearchCriteria<InternalBackupDataStoreVO> sc = backupSearch.create();
+        sc.setParameters(BACKUP_ID, backupId);
+        expunge(sc);
+    }
+
+    @Override
+    public void updateVolumeId(long oldVolumeId, long newVolumeId) {
+        SearchCriteria<InternalBackupDataStoreVO> sc = backupSearch.create();
+        sc.setParameters(VOLUME_ID, oldVolumeId);
+        InternalBackupDataStoreVO delta = createForUpdate();
+        delta.setVolumeId(newVolumeId);
+        UpdateBuilder ub = getUpdateBuilder(delta);
+        update(ub, sc, null);
+    }
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupJoinDao.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupJoinDao.java
new file mode 100644
index 000000000000..2f9c3dd1ff8f
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupJoinDao.java
@@ -0,0 +1,40 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+package org.apache.cloudstack.backup.dao;
+
+import com.cloud.utils.db.GenericDao;
+import org.apache.cloudstack.backup.InternalBackupJoinVO;
+
+import java.util.Date;
+import java.util.List;
+
+public interface InternalBackupJoinDao extends GenericDao<InternalBackupJoinVO, Long> {
+
+    List<InternalBackupJoinVO> listByBackedUpAndVmIdAndDateBeforeOrAfterOrderBy(long vmId, Date date, boolean before, boolean ascending);
+
+    List<InternalBackupJoinVO> listIncludingRemovedByVmIdAndBeforeDateOrderByCreatedDesc(long vmId, Date beforeDate);
+
+    InternalBackupJoinVO findCurrent(long vmId);
+
+    InternalBackupJoinVO findByParentId(long parentId);
+
+    List<InternalBackupJoinVO> listByImageStoreId(long imageStoreId);
+
+    List<InternalBackupJoinVO> listById(long id);
+
+    List<InternalBackupJoinVO> listByParentId(long parentId);
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupJoinDaoImpl.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupJoinDaoImpl.java
new file mode 100644
index 000000000000..e8d823bb69c5
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupJoinDaoImpl.java
@@ -0,0 +1,130 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.backup.dao;
+
+import com.cloud.utils.db.Filter;
+import com.cloud.utils.db.GenericDaoBase;
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
+import org.apache.cloudstack.backup.Backup;
+import org.apache.cloudstack.backup.InternalBackupJoinVO;
+
+import javax.annotation.PostConstruct;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.List;
+
+public class InternalBackupJoinDaoImpl extends GenericDaoBase<InternalBackupJoinVO, Long> implements InternalBackupJoinDao {
+
+    private static final String ID = "id";
+    private static final String VM_ID = "vm_id";
+    private static final String STATUS = "status";
+    private static final String CREATED_BEFORE = "created_before";
+    private static final String CREATED_AFTER = "created_after";
+    private static final String CURRENT = "current";
+    private static final String ISOLATED = "isolated";
+    private static final String PARENT_ID = "parent_id";
+    private static final String IMAGE_STORE_ID = "image_store_id";
+    private SearchBuilder<InternalBackupJoinVO> backupSearch;
+    private SearchBuilder<InternalBackupJoinVO> allBackupsSearch;
+
+    @PostConstruct
+    protected void init() {
+        backupSearch = createSearchBuilder();
+        backupSearch.and(VM_ID, backupSearch.entity().getVmId(), SearchCriteria.Op.EQ);
+        backupSearch.and(STATUS, backupSearch.entity().getStatus(), SearchCriteria.Op.IN);
+        backupSearch.and(CREATED_BEFORE, backupSearch.entity().getDate(), SearchCriteria.Op.LT);
+        backupSearch.and(CREATED_AFTER, backupSearch.entity().getDate(), SearchCriteria.Op.GT);
+        backupSearch.and(CURRENT, backupSearch.entity().getCurrent(), SearchCriteria.Op.EQ);
+        backupSearch.and(PARENT_ID, backupSearch.entity().getParentId(), SearchCriteria.Op.EQ);
+        backupSearch.and(ISOLATED, backupSearch.entity().getIsolated(), SearchCriteria.Op.EQ);
+        backupSearch.groupBy(backupSearch.entity().getId());
+        backupSearch.done();
+
+        allBackupsSearch = createSearchBuilder();
+        allBackupsSearch.and(ID, allBackupsSearch.entity().getId(), SearchCriteria.Op.EQ);
+        allBackupsSearch.and(STATUS, allBackupsSearch.entity().getStatus(), SearchCriteria.Op.IN);
+        allBackupsSearch.and(PARENT_ID, allBackupsSearch.entity().getParentId(), SearchCriteria.Op.EQ);
+        allBackupsSearch.and(IMAGE_STORE_ID, allBackupsSearch.entity().getImageStoreId(), SearchCriteria.Op.EQ);
+        allBackupsSearch.done();
+    }
+
+    @Override
+    public List<InternalBackupJoinVO> listByBackedUpAndVmIdAndDateBeforeOrAfterOrderBy(long vmId, Date date, boolean before, boolean ascending) {
+        SearchCriteria<InternalBackupJoinVO> sc = backupSearch.create();
+        sc.setParameters(VM_ID, vmId);
+        sc.setParameters(STATUS, Backup.Status.BackedUp);
+        if (before) {
+            sc.setParameters(CREATED_BEFORE, date);
+        } else {
+            sc.setParameters(CREATED_AFTER, date);
+        }
+        sc.setParameters(ISOLATED, Boolean.FALSE.toString());
+        Filter filter = new Filter(InternalBackupJoinVO.class, "date", ascending);
+        return new ArrayList<>(listBy(sc, filter));
+    }
+
+    @Override
+    public List<InternalBackupJoinVO> listIncludingRemovedByVmIdAndBeforeDateOrderByCreatedDesc(long vmId, Date beforeDate) {
+        SearchCriteria<InternalBackupJoinVO> sc = backupSearch.create();
+        sc.setParameters(VM_ID, vmId);
+        sc.setParameters(STATUS, Backup.Status.BackedUp, Backup.Status.Removed);
+        sc.setParameters(CREATED_BEFORE, beforeDate);
+        sc.setParameters(ISOLATED, Boolean.FALSE.toString());
+        Filter filter = new Filter(InternalBackupJoinVO.class, "date", false);
+        return new ArrayList<>(listIncludingRemovedBy(sc, filter));
+    }
+
+    @Override
+    public InternalBackupJoinVO findCurrent(long vmId) {
+        SearchCriteria<InternalBackupJoinVO> sc = backupSearch.create();
+        sc.setParameters(VM_ID, vmId);
+        sc.setParameters(CURRENT, Boolean.TRUE.toString());
+        return findOneBy(sc);
+    }
+
+    @Override
+    public InternalBackupJoinVO findByParentId(long parentId) {
+        SearchCriteria<InternalBackupJoinVO> sc = backupSearch.create();
+        sc.setParameters(PARENT_ID, parentId);
+        return findOneIncludingRemovedBy(sc);
+    }
+
+    @Override
+    public List<InternalBackupJoinVO> listByImageStoreId(long imageStoreId) {
+        SearchCriteria<InternalBackupJoinVO> sc = allBackupsSearch.create();
+        sc.setParameters(IMAGE_STORE_ID, imageStoreId);
+        sc.setParameters(STATUS, Backup.Status.BackedUp);
+        return listBy(sc);
+    }
+
+    @Override
+    public List<InternalBackupJoinVO> listById(long id) {
+        SearchCriteria<InternalBackupJoinVO> sc = allBackupsSearch.create();
+        sc.setParameters(ID, id);
+        sc.setParameters(STATUS, Backup.Status.BackedUp);
+        return listBy(sc);
+    }
+
+    @Override
+    public List<InternalBackupJoinVO> listByParentId(long parentId) {
+        SearchCriteria<InternalBackupJoinVO> sc = allBackupsSearch.create();
+        sc.setParameters(PARENT_ID, parentId);
+        sc.setParameters(STATUS, Backup.Status.BackedUp);
+        return listBy(sc);
+    }
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupServiceJobDao.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupServiceJobDao.java
new file mode 100644
index 000000000000..c80734b9cb3c
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupServiceJobDao.java
@@ -0,0 +1,39 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+package org.apache.cloudstack.backup.dao;
+
+import com.cloud.utils.Pair;
+import com.cloud.utils.db.GenericDao;
+import org.apache.cloudstack.backup.InternalBackupServiceJobType;
+import org.apache.cloudstack.backup.InternalBackupServiceJobVO;
+
+import java.util.Date;
+import java.util.List;
+
+public interface InternalBackupServiceJobDao extends GenericDao<InternalBackupServiceJobVO, Long> {
+
+    List<InternalBackupServiceJobVO> listExecutingJobsByZoneIdAndJobType(long zoneId, InternalBackupServiceJobType... jobTypes);
+
+    List<InternalBackupServiceJobVO> listWaitingJobsAndScheduledToBeforeNow(long zoneId, InternalBackupServiceJobType... jobTypes);
+
+    List<InternalBackupServiceJobVO> listExecutingJobsByHostsAndStartTimeBeforeAndTypeIn(Object[] hostIds, Date date, InternalBackupServiceJobType... jobTypes);
+
+    Pair<List<InternalBackupServiceJobVO>, Integer> searchAndCountForListApi(Long id, Long backupId, Long hostId, Long zoneId, InternalBackupServiceJobType type, boolean executing,
+            boolean scheduled, Long startIndex, Long pageSize);
+
+    void update(InternalBackupServiceJobVO job);
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupServiceJobDaoImpl.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupServiceJobDaoImpl.java
new file mode 100644
index 000000000000..32e81261838d
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupServiceJobDaoImpl.java
@@ -0,0 +1,138 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+package org.apache.cloudstack.backup.dao;
+
+import com.cloud.utils.DateUtil;
+import com.cloud.utils.Pair;
+import com.cloud.utils.db.DB;
+import com.cloud.utils.db.Filter;
+import com.cloud.utils.db.GenericDaoBase;
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
+import org.apache.cloudstack.backup.InternalBackupServiceJobType;
+import org.apache.cloudstack.backup.InternalBackupServiceJobVO;
+
+import javax.annotation.PostConstruct;
+import java.util.Date;
+import java.util.List;
+
+public class InternalBackupServiceJobDaoImpl extends GenericDaoBase<InternalBackupServiceJobVO, Long> implements InternalBackupServiceJobDao {
+    private static final String ID = "id";
+    private static final String BACKUP_ID = "backup_id";
+    private SearchBuilder<InternalBackupServiceJobVO> executingBeforeAndHostInAndTypeInSearch;
+    private SearchBuilder<InternalBackupServiceJobVO> scheduledAndNotStartedSearch;
+
+    private SearchBuilder<InternalBackupServiceJobVO> executingAndZoneIdAndTypeSearch;
+
+    private static final String HOST_ID = "host_id";
+    private static final String TYPE = "type";
+    private static final String START_TIME = "start_time";
+    private static final String SCHEDULED = "scheduled";
+    private static final String ZONE_ID = "zone_id";
+
+    @PostConstruct
+    protected void init() {
+        executingBeforeAndHostInAndTypeInSearch = createSearchBuilder();
+        executingBeforeAndHostInAndTypeInSearch.and(HOST_ID, executingBeforeAndHostInAndTypeInSearch.entity().getHostId(), SearchCriteria.Op.IN);
+        executingBeforeAndHostInAndTypeInSearch.and(START_TIME, executingBeforeAndHostInAndTypeInSearch.entity().getStartTime(), SearchCriteria.Op.LTEQ);
+        executingBeforeAndHostInAndTypeInSearch.and(TYPE, executingBeforeAndHostInAndTypeInSearch.entity().getType(), SearchCriteria.Op.IN);
+        executingBeforeAndHostInAndTypeInSearch.done();
+
+        scheduledAndNotStartedSearch = createSearchBuilder();
+        scheduledAndNotStartedSearch.and(SCHEDULED, scheduledAndNotStartedSearch.entity().getScheduledStartTime(), SearchCriteria.Op.LTEQ);
+        scheduledAndNotStartedSearch.and(START_TIME, scheduledAndNotStartedSearch.entity().getStartTime(), SearchCriteria.Op.NULL);
+        scheduledAndNotStartedSearch.and(ZONE_ID, scheduledAndNotStartedSearch.entity().getZoneId(), SearchCriteria.Op.EQ);
+        scheduledAndNotStartedSearch.and(TYPE, scheduledAndNotStartedSearch.entity().getType(), SearchCriteria.Op.IN);
+        scheduledAndNotStartedSearch.done();
+
+        executingAndZoneIdAndTypeSearch = createSearchBuilder();
+        executingAndZoneIdAndTypeSearch.and(START_TIME, executingAndZoneIdAndTypeSearch.entity().getStartTime(), SearchCriteria.Op.NNULL);
+        executingAndZoneIdAndTypeSearch.and(ZONE_ID, executingAndZoneIdAndTypeSearch.entity().getZoneId(), SearchCriteria.Op.EQ);
+        executingAndZoneIdAndTypeSearch.and(TYPE, executingAndZoneIdAndTypeSearch.entity().getType(), SearchCriteria.Op.IN);
+        executingAndZoneIdAndTypeSearch.done();
+    }
+
+    @Override
+    public List<InternalBackupServiceJobVO> listExecutingJobsByZoneIdAndJobType(long zoneId, InternalBackupServiceJobType... jobTypes) {
+        SearchCriteria<InternalBackupServiceJobVO> sc = executingAndZoneIdAndTypeSearch.create();
+        sc.setParameters(TYPE, (Object[]) jobTypes);
+        sc.setParameters(ZONE_ID, zoneId);
+
+        return listBy(sc);
+    }
+
+    @Override
+    public List<InternalBackupServiceJobVO> listWaitingJobsAndScheduledToBeforeNow(long zoneId, InternalBackupServiceJobType... jobTypes) {
+        SearchCriteria<InternalBackupServiceJobVO> sc = scheduledAndNotStartedSearch.create();
+
+        sc.setParameters(SCHEDULED, DateUtil.now());
+        sc.setParameters(ZONE_ID, zoneId);
+        sc.setParameters(TYPE, (Object[]) jobTypes);
+
+        Filter filter = new Filter(InternalBackupServiceJobVO.class, "scheduledStartTime", true);
+        return listBy(sc, filter);
+    }
+
+    @Override
+    public List<InternalBackupServiceJobVO> listExecutingJobsByHostsAndStartTimeBeforeAndTypeIn(Object[] hostIds, Date date, InternalBackupServiceJobType... jobTypes) {
+        SearchCriteria<InternalBackupServiceJobVO> sc = executingBeforeAndHostInAndTypeInSearch.create();
+        sc.setParameters(HOST_ID, hostIds);
+        sc.setParameters(START_TIME, date);
+        sc.setParameters(TYPE, (Object[]) jobTypes);
+
+        return listBy(sc);
+    }
+
+    @Override
+    public Pair<List<InternalBackupServiceJobVO>, Integer> searchAndCountForListApi(Long id, Long backupId, Long hostId, Long zoneId, InternalBackupServiceJobType type, boolean executing,
+            boolean scheduled, Long startIndex, Long pageSize) {
+        SearchBuilder<InternalBackupServiceJobVO> sb = createSearchBuilder();
+
+        sb.and(ID, sb.entity().getId(), SearchCriteria.Op.EQ);
+        sb.and(BACKUP_ID, sb.entity().getBackupId(), SearchCriteria.Op.EQ);
+        sb.and(HOST_ID, sb.entity().getHostId(), SearchCriteria.Op.EQ);
+        sb.and(ZONE_ID, sb.entity().getZoneId(), SearchCriteria.Op.EQ);
+        sb.and(TYPE, sb.entity().getType(), SearchCriteria.Op.EQ);
+
+        boolean removed = !executing && !scheduled;
+        if (executing && !scheduled) {
+            sb.and("executing", sb.entity().getStartTime(), SearchCriteria.Op.NNULL);
+        } else if (scheduled && !executing) {
+            sb.and("scheduled", sb.entity().getStartTime(), SearchCriteria.Op.NULL);
+        }
+
+        SearchCriteria<InternalBackupServiceJobVO> sc = sb.create();
+
+        sc.setParametersIfNotNull(ID, id);
+        sc.setParametersIfNotNull(BACKUP_ID, backupId);
+        sc.setParametersIfNotNull(HOST_ID, hostId);
+        sc.setParametersIfNotNull(ZONE_ID, zoneId);
+        if (type != null) {
+            sc.setParameters(TYPE, type);
+        }
+
+        Filter filter = new Filter(InternalBackupServiceJobVO.class, "created", false, startIndex, pageSize);
+
+        return searchAndCount(sc, filter, removed);
+    }
+
+    @Override
+    @DB
+    public void update(InternalBackupServiceJobVO job) {
+        super.update(job.getId(), job);
+    }
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupStoragePoolDao.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupStoragePoolDao.java
new file mode 100644
index 000000000000..7e2ac5a249e4
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupStoragePoolDao.java
@@ -0,0 +1,33 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+package org.apache.cloudstack.backup.dao;
+
+import com.cloud.utils.db.GenericDao;
+import org.apache.cloudstack.backup.InternalBackupStoragePoolVO;
+
+import java.util.List;
+
+public interface InternalBackupStoragePoolDao extends GenericDao<InternalBackupStoragePoolVO, Long> {
+
+    List<InternalBackupStoragePoolVO> listByBackupId(long backupId);
+
+    InternalBackupStoragePoolVO findOneByVolumeId(long volumeId);
+
+    void expungeByBackupId(long backupId);
+
+    void expungeByVolumeId(long volumeId);
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupStoragePoolDaoImpl.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupStoragePoolDaoImpl.java
new file mode 100644
index 000000000000..443ceed02e7d
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/InternalBackupStoragePoolDaoImpl.java
@@ -0,0 +1,70 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+package org.apache.cloudstack.backup.dao;
+
+import com.cloud.utils.db.GenericDaoBase;
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
+import org.apache.cloudstack.backup.InternalBackupStoragePoolVO;
+
+import javax.annotation.PostConstruct;
+import java.util.List;
+
+public class InternalBackupStoragePoolDaoImpl extends GenericDaoBase<InternalBackupStoragePoolVO, Long> implements InternalBackupStoragePoolDao {
+
+    private SearchBuilder<InternalBackupStoragePoolVO> backupSearch;
+
+    private static final String BACKUP_ID = "backup_id";
+
+    private static final String VOLUME_ID = "volume_id";
+
+    @PostConstruct
+    protected void init() {
+        backupSearch = createSearchBuilder();
+        backupSearch.and(BACKUP_ID, backupSearch.entity().getBackupId(), SearchCriteria.Op.EQ);
+        backupSearch.and(VOLUME_ID, backupSearch.entity().getVolumeId(), SearchCriteria.Op.EQ);
+        backupSearch.done();
+    }
+
+    @Override
+    public List<InternalBackupStoragePoolVO> listByBackupId(long backupId) {
+        SearchCriteria<InternalBackupStoragePoolVO> sc = backupSearch.create();
+        sc.setParameters(BACKUP_ID, backupId);
+        return listBy(sc);
+    }
+
+    @Override
+    public InternalBackupStoragePoolVO findOneByVolumeId(long volumeId) {
+        SearchCriteria<InternalBackupStoragePoolVO> sc = backupSearch.create();
+        sc.setParameters(VOLUME_ID, volumeId);
+        return findOneBy(sc);
+    }
+
+    @Override
+    public void expungeByBackupId(long backupId) {
+        SearchCriteria<InternalBackupStoragePoolVO> sc = backupSearch.create();
+        sc.setParameters(BACKUP_ID, backupId);
+        expunge(sc);
+    }
+
+    @Override
+    public void expungeByVolumeId(long volumeId) {
+        SearchCriteria<InternalBackupStoragePoolVO> sc = backupSearch.create();
+        sc.setParameters(VOLUME_ID, volumeId);
+        expunge(sc);
+    }
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/resourcedetail/ResourceDetailsDao.java b/engine/schema/src/main/java/org/apache/cloudstack/resourcedetail/ResourceDetailsDao.java
index 1102de16e4ea..4383278d7c48 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/resourcedetail/ResourceDetailsDao.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/resourcedetail/ResourceDetailsDao.java
@@ -113,4 +113,6 @@ public interface ResourceDetailsDao<R extends ResourceDetail> extends GenericDao
     long batchExpungeForResources(List<Long> ids, Long batchSize);
 
     String getActualValue(ResourceDetail resourceDetail);
+
+    List<R> listDetailsForResourceIdsAndKey(List<Long> resourceIds, String key);
 }
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/resourcedetail/ResourceDetailsDaoBase.java b/engine/schema/src/main/java/org/apache/cloudstack/resourcedetail/ResourceDetailsDaoBase.java
index eafaed182abd..8f376a71f66f 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/resourcedetail/ResourceDetailsDaoBase.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/resourcedetail/ResourceDetailsDaoBase.java
@@ -16,11 +16,13 @@
 // under the License.
 package org.apache.cloudstack.resourcedetail;
 
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 import java.util.stream.Collectors;
 
+import com.cloud.utils.StringUtils;
 import org.apache.commons.collections.CollectionUtils;
 
 import com.cloud.utils.Pair;
@@ -48,6 +50,7 @@ public abstract class ResourceDetailsDaoBase<R extends ResourceDetail> extends G
     public ResourceDetailsDaoBase() {
         AllFieldsSearch = createSearchBuilder();
         AllFieldsSearch.and("resourceId", AllFieldsSearch.entity().getResourceId(), SearchCriteria.Op.EQ);
+        AllFieldsSearch.and("resourceIdIn", AllFieldsSearch.entity().getResourceId(), SearchCriteria.Op.IN);
         AllFieldsSearch.and("name", AllFieldsSearch.entity().getName(), SearchCriteria.Op.EQ);
         AllFieldsSearch.and("value", AllFieldsSearch.entity().getValue(), SearchCriteria.Op.EQ);
         // FIXME SnapshotDetailsVO doesn't have a display field
@@ -266,4 +269,15 @@ public String getActualValue(ResourceDetail resourceDetail) {
         }
         return resourceDetail.getValue();
     }
+
+    @Override
+    public List<R> listDetailsForResourceIdsAndKey(List<Long> resourceIds, String key) {
+        if (CollectionUtils.isEmpty(resourceIds) || StringUtils.isBlank(key)) {
+            return Collections.emptyList();
+        }
+        SearchCriteria<R> sc = AllFieldsSearch.create();
+        sc.setParameters("name", key);
+        sc.setParameters("resourceIdIn", resourceIds.toArray());
+        return search(sc, null);
+    }
 }
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/SnapshotDataStoreDao.java b/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/SnapshotDataStoreDao.java
index 3329983d711e..2d337fe07fc7 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/SnapshotDataStoreDao.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/SnapshotDataStoreDao.java
@@ -99,6 +99,8 @@ public interface SnapshotDataStoreDao extends GenericDao<SnapshotDataStoreVO, Lo
 
     List<SnapshotDataStoreVO> findByVolume(long snapshotId, long volumeId, DataStoreRole role);
 
+    void expungeBySnapshotIdAndStoreRole(long snapshotId, DataStoreRole role);
+
     /**
      * List all snapshots in 'snapshot_store_ref' by volume and data store role. Therefore, it is possible to list all snapshots that are in the primary storage or in the secondary storage.
      */
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/SnapshotDataStoreDaoImpl.java b/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/SnapshotDataStoreDaoImpl.java
index 8b7a2b78de7e..cb88e21cf9d6 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/SnapshotDataStoreDaoImpl.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/storage/datastore/db/SnapshotDataStoreDaoImpl.java
@@ -63,7 +63,7 @@ public class SnapshotDataStoreDaoImpl extends GenericDaoBase<SnapshotDataStoreVO
     private static final String URL_CREATED_BEFORE = "url_created_before";
     public static final String DOWNLOAD_URL = "downloadUrl";
     public static final String DATA_CENTER_ID = "data_center_id";
-
+    private static final String INSTALL_PATH = "install_path";
     private SearchBuilder<SnapshotDataStoreVO> searchFilteringStoreIdEqStoreRoleEqStateNeqRefCntNeq;
     protected SearchBuilder<SnapshotDataStoreVO> searchFilteringStoreIdEqStateEqStoreRoleEqIdEqUpdateCountEqSnapshotIdEqVolumeIdEq;
     private SearchBuilder<SnapshotDataStoreVO> stateSearch;
@@ -76,7 +76,9 @@ public class SnapshotDataStoreDaoImpl extends GenericDaoBase<SnapshotDataStoreVO
     private SearchBuilder<SnapshotDataStoreVO> storeSnapshotDownloadStatusSearch;
     private SearchBuilder<SnapshotDataStoreVO> searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEqKVMCheckpointNotNull;
     private SearchBuilder<SnapshotDataStoreVO> searchFilterStateAndDownloadUrlNotNullAndDownloadUrlCreatedBefore;
-    private SearchBuilder<SnapshotDataStoreVO> searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEq;
+    private SearchBuilder<SnapshotDataStoreVO> searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEqPathEq;
+
+    private SearchBuilder<SnapshotDataStoreVO> searchFilteringVolumeIdAndStateAndCreatedAfter;
 
     private SearchBuilder<SnapshotDataStoreVO> searchBySnapshotId;
 
@@ -198,17 +200,24 @@ public boolean configure(String name, Map<String, Object> params) throws Configu
         searchFilterStateAndDownloadUrlNotNullAndDownloadUrlCreatedBefore.and(URL_CREATED_BEFORE, searchFilterStateAndDownloadUrlNotNullAndDownloadUrlCreatedBefore.entity().getExtractUrlCreated(), SearchCriteria.Op.LT);
         searchFilterStateAndDownloadUrlNotNullAndDownloadUrlCreatedBefore.done();
 
-        searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEq = createSearchBuilder();
-        searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEq.and(STATE, searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEq.entity().getState(), SearchCriteria.Op.EQ);
-        searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEq.and(VOLUME_ID, searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEq.entity().getVolumeId(), SearchCriteria.Op.EQ);
-        searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEq.and(STORE_ROLE, searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEq.entity().getRole(), SearchCriteria.Op.EQ);
-        searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEq.and(STORE_ID, searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEq.entity().getDataStoreId(), SearchCriteria.Op.IN);
+        searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEqPathEq = createSearchBuilder();
+        searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEqPathEq.and(STATE, searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEqPathEq.entity().getState(), SearchCriteria.Op.EQ);
+        searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEqPathEq.and(VOLUME_ID, searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEqPathEq.entity().getVolumeId(), SearchCriteria.Op.EQ);
+        searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEqPathEq.and(STORE_ROLE, searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEqPathEq.entity().getRole(), SearchCriteria.Op.EQ);
+        searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEqPathEq.and(STORE_ID, searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEqPathEq.entity().getDataStoreId(), SearchCriteria.Op.IN);
+        searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEqPathEq.and(INSTALL_PATH, searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEqPathEq.entity().getInstallPath(), SearchCriteria.Op.EQ);
+        searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEqPathEq.done();
 
         searchBySnapshotId = createSearchBuilder();
         searchBySnapshotId.and(SNAPSHOT_ID, searchBySnapshotId.entity().getSnapshotId(), SearchCriteria.Op.EQ);
         searchBySnapshotId.and(STATE, searchBySnapshotId.entity().getState(), SearchCriteria.Op.EQ);
         searchBySnapshotId.done();
 
+        searchFilteringVolumeIdAndStateAndCreatedAfter = createSearchBuilder();
+        searchFilteringVolumeIdAndStateAndCreatedAfter.and(STATE, searchFilteringVolumeIdAndStateAndCreatedAfter.entity().getState(), SearchCriteria.Op.EQ);
+        searchFilteringVolumeIdAndStateAndCreatedAfter.and(VOLUME_ID, searchFilteringVolumeIdAndStateAndCreatedAfter.entity().getVolumeId(), SearchCriteria.Op.EQ);
+        searchFilteringVolumeIdAndStateAndCreatedAfter.and(CREATED, searchFilteringVolumeIdAndStateAndCreatedAfter.entity().getCreated(), SearchCriteria.Op.GT);
+        searchFilteringVolumeIdAndStateAndCreatedAfter.done();
         return true;
     }
 
@@ -356,7 +365,7 @@ public SnapshotDataStoreVO findParent(DataStoreRole role, Long storeId, Long zon
         if (kvmIncrementalSnapshot && Hypervisor.HypervisorType.KVM.equals(hypervisorType)) {
             sc = searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEqKVMCheckpointNotNull.create();
         } else {
-            sc = searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEq.create();
+            sc = searchFilteringStoreIdInVolumeIdEqStoreRoleEqStateEqPathEq.create();
         }
 
         sc.setParameters(VOLUME_ID, volumeId);
@@ -469,6 +478,12 @@ public SnapshotDataStoreVO findBySnapshotIdInAnyState(long snapshotId, DataStore
         return findOneBy(sc);
     }
 
+    @Override
+    public void expungeBySnapshotIdAndStoreRole(long snapshotId, DataStoreRole role) {
+        SearchCriteria<SnapshotDataStoreVO> sc = createSearchCriteriaBySnapshotIdAndStoreRole(snapshotId, role);
+        expunge(sc);
+    }
+
     @Override
     public List<SnapshotDataStoreVO> listAllByVolumeAndDataStore(long volumeId, DataStoreRole role) {
         SearchCriteria<SnapshotDataStoreVO> sc = searchFilteringStoreIdEqStateEqStoreRoleEqIdEqUpdateCountEqSnapshotIdEqVolumeIdEq.create();
diff --git a/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-common-daos-between-management-and-usage-context.xml b/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-common-daos-between-management-and-usage-context.xml
index 2c6869bd81e3..a0dada545617 100644
--- a/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-common-daos-between-management-and-usage-context.xml
+++ b/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-common-daos-between-management-and-usage-context.xml
@@ -46,6 +46,7 @@
 	<bean id="hostTransferMapDaoImpl" class="com.cloud.cluster.agentlb.dao.HostTransferMapDaoImpl" />
 	<bean id="imageStoreDaoImpl" class="org.apache.cloudstack.storage.datastore.db.ImageStoreDaoImpl" />
 	<bean id="imageStoreObjectDownloadDaoImpl" class="org.apache.cloudstack.storage.datastore.db.ImageStoreObjectDownloadDaoImpl" />
+	<bean id="kmsWrappedKeyDaoImpl" class="org.apache.cloudstack.kms.dao.KMSWrappedKeyDaoImpl" />
 	<bean id="networkOfferingDaoImpl" class="com.cloud.offerings.dao.NetworkOfferingDaoImpl" />
 	<bean id="networkOfferingDetailsDaoImpl" class="com.cloud.offerings.dao.NetworkOfferingDetailsDaoImpl" />
 	<bean id="networkOfferingServiceMapDaoImpl" class="com.cloud.offerings.dao.NetworkOfferingServiceMapDaoImpl" />
diff --git a/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-daos-context.xml b/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-daos-context.xml
index d7cacd09b9a8..932db538f30b 100644
--- a/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-daos-context.xml
+++ b/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-daos-context.xml
@@ -272,6 +272,10 @@
   <bean id="backupScheduleDaoImpl" class="org.apache.cloudstack.backup.dao.BackupScheduleDaoImpl" />
   <bean id="backupDaoImpl" class="org.apache.cloudstack.backup.dao.BackupDaoImpl" />
   <bean id="backupDetailsDaoImpl" class="org.apache.cloudstack.backup.dao.BackupDetailsDaoImpl" />
+  <bean id="internalBackupStoragePoolDaoImpl" class="org.apache.cloudstack.backup.dao.InternalBackupStoragePoolDaoImpl" />
+  <bean id="internalBackupDataStoreDaoImpl" class="org.apache.cloudstack.backup.dao.InternalBackupDataStoreDaoImpl" />
+  <bean id="internalBackupJoinDaoImpl" class="org.apache.cloudstack.backup.dao.InternalBackupJoinDaoImpl" />
+  <bean id="internalBackupServiceJobDaoImpl" class="org.apache.cloudstack.backup.dao.InternalBackupServiceJobDaoImpl" />
   <bean id="backupRepositoryDaoImpl" class="org.apache.cloudstack.backup.dao.BackupRepositoryDaoImpl" />
   <bean id="imageTransferDaoImpl" class="org.apache.cloudstack.backup.dao.ImageTransferDaoImpl" />
   <bean id="directDownloadCertificateDaoImpl" class="org.apache.cloudstack.direct.download.DirectDownloadCertificateDaoImpl" />
@@ -316,7 +320,6 @@
   <bean id="apiKeyPairPermissionsDaoImpl" class="org.apache.cloudstack.acl.dao.ApiKeyPairPermissionsDaoImpl" />
   <bean id="kmsKeyDaoImpl" class="org.apache.cloudstack.kms.dao.KMSKeyDaoImpl" />
   <bean id="kmsKekVersionDaoImpl" class="org.apache.cloudstack.kms.dao.KMSKekVersionDaoImpl" />
-  <bean id="kmsWrappedKeyDaoImpl" class="org.apache.cloudstack.kms.dao.KMSWrappedKeyDaoImpl" />
   <bean id="hsmProfileDaoImpl" class="org.apache.cloudstack.kms.dao.HSMProfileDaoImpl" />
   <bean id="hsmProfileDetailsDaoImpl" class="org.apache.cloudstack.kms.dao.HSMProfileDetailsDaoImpl" />
   <bean id="dnsServerDao" class="org.apache.cloudstack.dns.dao.DnsServerDaoImpl" />
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42010to42100-cleanup.sql b/engine/schema/src/main/resources/META-INF/db/schema-42040to42100-cleanup.sql
similarity index 93%
rename from engine/schema/src/main/resources/META-INF/db/schema-42010to42100-cleanup.sql
rename to engine/schema/src/main/resources/META-INF/db/schema-42040to42100-cleanup.sql
index 5f257f2965bd..b63e918b389b 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-42010to42100-cleanup.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42040to42100-cleanup.sql
@@ -16,5 +16,5 @@
 -- under the License.
 
 --;
--- Schema upgrade cleanup from 4.20.1.0 to 4.21.0.0
+-- Schema upgrade cleanup from 4.20.4.0 to 4.21.0.0
 --;
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42010to42100.sql b/engine/schema/src/main/resources/META-INF/db/schema-42040to42100.sql
similarity index 99%
rename from engine/schema/src/main/resources/META-INF/db/schema-42010to42100.sql
rename to engine/schema/src/main/resources/META-INF/db/schema-42040to42100.sql
index 000b54b72078..bf7f3aeaf0f8 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-42010to42100.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42040to42100.sql
@@ -16,7 +16,7 @@
 -- under the License.
 
 --;
--- Schema upgrade from 4.20.1.0 to 4.21.0.0
+-- Schema upgrade from 4.20.4.0 to 4.21.0.0
 --;
 
 CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.backup_schedule', 'max_backups', 'INT(8) UNSIGNED NOT NULL DEFAULT 0 COMMENT ''Maximum number of backups to be retained''');
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql b/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
index 9f4353490956..ab5ac7b2b875 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
@@ -19,6 +19,12 @@
 -- Schema upgrade from 4.22.1.0 to 4.23.0.0
 --;
 
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.oauth_provider', 'domain_id', 'bigint unsigned DEFAULT NULL COMMENT "NULL for global provider, domain ID for domain-specific" AFTER `redirect_uri`');
+CALL `cloud`.`IDEMPOTENT_ADD_FOREIGN_KEY`('cloud.oauth_provider', 'fk_oauth_provider__domain_id', '(`domain_id`)', '`domain`(`id`)');
+CALL `cloud`.`IDEMPOTENT_ADD_KEY`('i_oauth_provider__domain_id', 'cloud.oauth_provider', '(`domain_id`)');
+
+CALL `cloud`.`IDEMPOTENT_ADD_UNIQUE_KEY`('cloud.oauth_provider', 'uk_oauth_provider__provider_domain', '(`provider`, `domain_id`)');
+
 CREATE TABLE `cloud`.`backup_offering_details` (
     `id` bigint unsigned NOT NULL auto_increment,
     `backup_offering_id` bigint unsigned NOT NULL COMMENT 'Backup offering id',
@@ -464,6 +470,13 @@ SELECT uuid(), role_id, 'quotaResourceStatement', permission, sort_order
 FROM cloud.role_permissions rp
 WHERE rule = 'quotaStatement' AND NOT EXISTS(SELECT 1 FROM cloud.role_permissions rp_ WHERE rp.role_id = rp_.role_id AND rp_.rule = 'quotaResourceStatement');
 
+-- Increase length of value of extension details from 255 to 4096 to support longer details value
+CALL `cloud`.`IDEMPOTENT_CHANGE_COLUMN`('cloud.extension_details', 'value', 'value', 'VARCHAR(4096)');
+CALL `cloud`.`IDEMPOTENT_CHANGE_COLUMN`('cloud.extension_resource_map_details', 'value', 'value', 'VARCHAR(4096)');
+
+-- Add CustomAction service support to physical_network_service_providers
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.physical_network_service_providers', 'custom_action_service_provided', 'tinyint(1) unsigned NOT NULL DEFAULT 0 COMMENT "Is Custom Action service provided" AFTER `networkacl_service_provided`');
+
 --- Gui theme login base domain
 CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.gui_themes', 'login_base_domain', 'TEXT DEFAULT NULL');
 
@@ -575,3 +588,61 @@ CREATE TABLE IF NOT EXISTS `cloud`.`dns_zone_network_map` (
   CONSTRAINT `fk_dns_map__zone_id` FOREIGN KEY (`dns_zone_id`) REFERENCES `dns_zone` (`id`) ON DELETE CASCADE,
   CONSTRAINT `fk_dns_map__network_id` FOREIGN KEY (`network_id`) REFERENCES `networks` (`id`) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4;
+
+-- This is part of allowing firewall rules on public IP addresses in VPC network
+ALTER TABLE `cloud`.`firewall_rules` MODIFY COLUMN `network_id` BIGINT UNSIGNED NULL;
+
+-- KBOSS
+
+CREATE TABLE IF NOT EXISTS `cloud`.`internal_backup_pool_ref` (
+    `id` bigint NOT NULL UNIQUE AUTO_INCREMENT,
+    `backup_id` bigint unsigned NOT NULL COMMENT 'The backup ID. Foreign key that points to the backups table.',
+    `storage_pool_id` bigint unsigned NOT NULL COMMENT 'The storage ID. Foreign key that points to the storage_pool table.',
+    `volume_id` bigint unsigned NOT NULL COMMENT 'The volumes ID. Foreign key that points to the volumes table.',
+    `backup_delta_path` varchar(255) COMMENT 'Path of the created delta.',
+    `backup_parent_path` varchar(255) COMMENT 'Path of the created delta parent.',
+    PRIMARY KEY (`id`),
+    CONSTRAINT `fk_internal_backup_pool_ref__backup_id` FOREIGN KEY (`backup_id`) REFERENCES `backups`(`id`),
+    CONSTRAINT `fk_internal_backup_pool_ref__storage_pool_id` FOREIGN KEY (`storage_pool_id`) REFERENCES `storage_pool`(`id`),
+    CONSTRAINT `fk_internal_backup_pool_ref__volume_id` FOREIGN KEY (`volume_id`) REFERENCES `volumes`(`id`)
+    );
+
+CREATE TABLE IF NOT EXISTS `cloud`.`internal_backup_store_ref` (
+     `id` bigint NOT NULL UNIQUE AUTO_INCREMENT,
+     `backup_id` bigint unsigned NOT NULL COMMENT 'The backup ID. Foreign key that points to the backups table.',
+     `volume_id` bigint unsigned NOT NULL COMMENT 'The volume ID. Foreign key that points to the volumes table.',
+     `device_id` bigint unsigned COMMENT 'device ID of the volume',
+     `path` varchar(255) COMMENT 'Path of the backup.',
+    PRIMARY KEY (`id`),
+    CONSTRAINT `fk_internal_backup_store_ref__backup_id` FOREIGN KEY (`backup_id`) REFERENCES `backups`(`id`),
+    CONSTRAINT `fk_internal_backup_store_ref__volume_id` FOREIGN KEY (`volume_id`) REFERENCES `volumes`(`id`)
+    );
+
+CREATE TABLE IF NOT EXISTS `cloud`.`internal_backup_service_job` (
+    `id` bigint NOT NULL UNIQUE AUTO_INCREMENT,
+    `backup_id` bigint unsigned NOT NULL COMMENT 'The backup ID. Foreign key that points to the backups table.',
+    `instance_id` bigint unsigned NOT NULL COMMENT 'The instance ID. Foreign key that points to the vm_instance table.',
+    `account_id` bigint(20) unsigned COMMENT 'Account ID of the owner of the VM.',
+    `host_id` bigint unsigned COMMENT 'The host ID that is executing the compression. Foreign key that points to the host table.',
+    `zone_id` bigint unsigned NOT NULL COMMENT 'The zone ID of the where the VM is. Foreign key that points to the data_center table',
+    `attempts` int(32) unsigned NOT NULL DEFAULT 0,
+    `type` varchar(55) NOT NULL,
+    `created` datetime NOT NULL,
+    `scheduled_start_time` datetime NOT NULL,
+    `start_time` datetime,
+    `removed` datetime,
+    PRIMARY KEY (`id`),
+    CONSTRAINT `fk_internal_backup_service_job__backup_id` FOREIGN KEY (`backup_id`) REFERENCES `backups`(`id`) ON DELETE CASCADE,
+    CONSTRAINT `fk_internal_backup_service_job__instance_id` FOREIGN KEY (`instance_id`) REFERENCES `vm_instance`(`id`) ON DELETE CASCADE,
+    CONSTRAINT `fk_internal_backup_service_job__host_id` FOREIGN KEY (`host_id`) REFERENCES `host`(`id`) ON DELETE CASCADE,
+    CONSTRAINT `fk_internal_backup_service_job__zone_id` FOREIGN KEY (`zone_id`) REFERENCES `data_center`(`id`) ON DELETE CASCADE,
+    CONSTRAINT `fk_internal_backup_service_job__account_id` FOREIGN KEY (`account_id`) REFERENCES `account`(`id`) ON DELETE CASCADE
+    );
+
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.backups', 'uncompressed_size', 'bigint unsigned');
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.backups', 'compression_status', 'varchar(55)');
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.backups', 'validation_status', 'varchar(55)');
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.backup_schedule', 'isolated', 'TINYINT(1) NOT NULL DEFAULT 0 COMMENT "Whether the scheduled backups will be isolated or not."');
+
+UPDATE `cloud`.`configuration` SET `value`=CONCAT(`value`, ', backupValidationCommandTimeout, backupValidationScreenshotWait, backupValidationBootTimeout')
+WHERE `name`='user.vm.readonly.details' AND `value` IS NOT NULL;
diff --git a/engine/schema/src/main/resources/META-INF/db/views/cloud.internal_backup_view.sql b/engine/schema/src/main/resources/META-INF/db/views/cloud.internal_backup_view.sql
new file mode 100644
index 000000000000..a1fbd102630b
--- /dev/null
+++ b/engine/schema/src/main/resources/META-INF/db/views/cloud.internal_backup_view.sql
@@ -0,0 +1,47 @@
+-- Licensed to the Apache Software Foundation (ASF) under one
+-- or more contributor license agreements.  See the NOTICE file
+-- distributed with this work for additional information
+-- regarding copyright ownership.  The ASF licenses this file
+-- to you under the Apache License, Version 2.0 (the
+-- "License"); you may not use this file except in compliance
+-- with the License.  You may obtain a copy of the License at
+--
+--   http://www.apache.org/licenses/LICENSE-2.0
+--
+-- Unless required by applicable law or agreed to in writing,
+-- software distributed under the License is distributed on an
+-- "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+-- KIND, either express or implied.  See the License for the
+-- specific language governing permissions and limitations
+-- under the License.
+
+-- VIEW `cloud`.`internal_backup_view`;
+
+DROP VIEW IF EXISTS `cloud`.`internal_backup_view`;
+CREATE VIEW `cloud`.`internal_backup_view` AS
+SELECT  b.id,
+        b.uuid,
+        b.vm_id,
+        b.backed_volumes,
+        b.type,
+        b.date,
+        b.status,
+        b.compression_status,
+        b.backup_offering_id,
+        b.size,
+        b.protected_size,
+        b.zone_id,
+        MAX(CASE WHEN bd.name = 'image_store_id' THEN bd.value END) image_store_id,
+        MAX(CASE WHEN bd.name = 'parent_id' THEN bd.value END) parent_id,
+        MAX(CASE WHEN bd.name = 'end_of_chain' THEN bd.value END) end_of_chain,
+        MAX(CASE WHEN bd.name = 'current' THEN bd.value END) current,
+        COALESCE(MAX(CASE WHEN bd.name = 'isolated' THEN bd.value END), 'false') isolated,
+        nbpr.volume_id,
+        nbsr.path image_store_path
+FROM    backups b
+LEFT    JOIN backup_details bd ON b.id = bd.backup_id
+LEFT    JOIN backup_offering bo ON b.backup_offering_id = bo.id
+LEFT    JOIN internal_backup_store_ref nbsr ON b.id = nbsr.backup_id
+LEFT    JOIN internal_backup_pool_ref nbpr ON nbpr.volume_id = nbsr.volume_id
+WHERE   bo.provider='kboss'
+GROUP BY b.id, nbsr.volume_id;
diff --git a/engine/schema/src/test/java/com/cloud/upgrade/DatabaseUpgradeCheckerTest.java b/engine/schema/src/test/java/com/cloud/upgrade/DatabaseUpgradeCheckerTest.java
index ab64e4698f01..884398cf410d 100644
--- a/engine/schema/src/test/java/com/cloud/upgrade/DatabaseUpgradeCheckerTest.java
+++ b/engine/schema/src/test/java/com/cloud/upgrade/DatabaseUpgradeCheckerTest.java
@@ -44,7 +44,9 @@
 import com.cloud.upgrade.dao.Upgrade41120to41200;
 import com.cloud.upgrade.dao.Upgrade41510to41520;
 import com.cloud.upgrade.dao.Upgrade41610to41700;
-import com.cloud.upgrade.dao.Upgrade42010to42100;
+import com.cloud.upgrade.dao.Upgrade42020to42030;
+import com.cloud.upgrade.dao.Upgrade42030to42040;
+import com.cloud.upgrade.dao.Upgrade42040to42100;
 import com.cloud.upgrade.dao.Upgrade452to453;
 import com.cloud.upgrade.dao.Upgrade453to460;
 import com.cloud.upgrade.dao.Upgrade460to461;
@@ -382,12 +384,12 @@ public void isNotStandalone() throws SQLException {
     }
 
     @Test
-    public void testCalculateUpgradePath42010to42100() {
+    public void testCalculateUpgradePath42010to42030() {
 
         final CloudStackVersion dbVersion = CloudStackVersion.parse("4.20.1.0");
         assertNotNull(dbVersion);
 
-        final CloudStackVersion currentVersion = CloudStackVersion.parse("4.21.0.0");
+        final CloudStackVersion currentVersion = CloudStackVersion.parse("4.20.3.0");
         assertNotNull(currentVersion);
 
         final DatabaseUpgradeChecker checker = new DatabaseUpgradeChecker();
@@ -395,9 +397,29 @@ public void testCalculateUpgradePath42010to42100() {
 
         assertNotNull(upgrades);
         assertEquals(1, upgrades.length);
-        assertTrue(upgrades[0] instanceof Upgrade42010to42100);
+        assertTrue(upgrades[0] instanceof Upgrade42020to42030);
 
-        assertArrayEquals(new String[]{"4.20.1.0", "4.21.0.0"}, upgrades[0].getUpgradableVersionRange());
+        assertArrayEquals(new String[]{"4.20.2.0", "4.20.3.0"}, upgrades[0].getUpgradableVersionRange());
         assertEquals(currentVersion.toString(), upgrades[0].getUpgradedVersion());
     }
+
+    @Test
+    public void testCalculateUpgradePath42010to42100() {
+
+        final CloudStackVersion dbVersion = CloudStackVersion.parse("4.20.1.0");
+        assertNotNull(dbVersion);
+
+        final CloudStackVersion currentVersion = CloudStackVersion.parse("4.21.0.0");
+        assertNotNull(currentVersion);
+
+        final DatabaseUpgradeChecker checker = new DatabaseUpgradeChecker();
+        final DbUpgrade[] upgrades = checker.calculateUpgradePath(dbVersion, currentVersion);
+
+        assertNotNull(upgrades);
+        assertEquals(3, upgrades.length);
+        assertTrue(upgrades[0] instanceof Upgrade42020to42030);
+        assertTrue(upgrades[1] instanceof Upgrade42030to42040);
+        assertTrue(upgrades[2] instanceof Upgrade42040to42100);
+        assertEquals(currentVersion.toString(), upgrades[2].getUpgradedVersion());
+    }
 }
diff --git a/engine/schema/src/test/java/com/cloud/upgrade/dao/Upgrade42010to42100Test.java b/engine/schema/src/test/java/com/cloud/upgrade/dao/Upgrade42040to42100Test.java
similarity index 98%
rename from engine/schema/src/test/java/com/cloud/upgrade/dao/Upgrade42010to42100Test.java
rename to engine/schema/src/test/java/com/cloud/upgrade/dao/Upgrade42040to42100Test.java
index 16908f6aaac0..5a2b55f03384 100644
--- a/engine/schema/src/test/java/com/cloud/upgrade/dao/Upgrade42010to42100Test.java
+++ b/engine/schema/src/test/java/com/cloud/upgrade/dao/Upgrade42040to42100Test.java
@@ -35,9 +35,9 @@
 import com.cloud.utils.db.TransactionLegacy;
 
 @RunWith(MockitoJUnitRunner.class)
-public class Upgrade42010to42100Test {
+public class Upgrade42040to42100Test {
     @Spy
-    Upgrade42010to42100 upgrade;
+    Upgrade42040to42100 upgrade;
 
     @Mock
     private Connection conn;
diff --git a/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/AncientDataMotionStrategy.java b/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/AncientDataMotionStrategy.java
index 1144a29986a6..bbf775de27ad 100644
--- a/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/AncientDataMotionStrategy.java
+++ b/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/AncientDataMotionStrategy.java
@@ -191,7 +191,7 @@ protected Answer copyObject(DataObject srcData, DataObject destData, Host destHo
                 srcForCopy = cacheData = cacheMgr.createCacheObject(srcData, destScope);
             }
 
-            CopyCommand cmd = new CopyCommand(srcForCopy.getTO(), addFullCloneAndDiskprovisiongStrictnessFlagOnVMwareDest(destData.getTO()), primaryStorageDownloadWait,
+            CopyCommand cmd = new CopyCommand(srcForCopy.getTO(), addFullCloneAndDiskprovisiongStrictnessFlagOnDest(destData.getTO()), primaryStorageDownloadWait,
                     VirtualMachineManager.ExecuteInSequence.value());
             EndPoint ep = destHost != null ? RemoteHostEndPoint.getHypervisorHostEndPoint(destHost) : selector.select(srcForCopy, destData);
             if (ep == null) {
@@ -257,6 +257,43 @@ protected DataTO addFullCloneAndDiskprovisiongStrictnessFlagOnVMwareDest(DataTO
         return dataTO;
     }
 
+    /**
+     * Adds {@code 'xenserver.create.full.clone'} value for a given primary storage, whose HV is XenServer, on datastore's {@code fullCloneFlag} field
+     * @param dataTO Dest data store TO
+     * @return dataTO including fullCloneFlag, if provided
+     */
+    protected DataTO addFullCloneAndDiskprovisiongStrictnessFlagOnXenServerDest(DataTO dataTO) {
+        if (dataTO != null && dataTO.getHypervisorType().equals(Hypervisor.HypervisorType.XenServer)){
+            DataStoreTO dataStoreTO = dataTO.getDataStore();
+            if (dataStoreTO != null && dataStoreTO instanceof PrimaryDataStoreTO){
+                PrimaryDataStoreTO primaryDataStoreTO = (PrimaryDataStoreTO) dataStoreTO;
+                primaryDataStoreTO.setFullCloneFlag(StorageManager.XenserverCreateCloneFull.valueIn(primaryDataStoreTO.getId()));
+            }
+        }
+        return dataTO;
+    }
+
+    /**
+     * Dispatches to the per-hypervisor {@code addFullCloneAndDiskprovisiongStrictnessFlagOn*Dest} helper
+     * based on {@code dataTO.getHypervisorType()}. Returns {@code dataTO} unchanged for hypervisors
+     * that do not have a full-clone toggle.
+     * @param dataTO Dest data store TO
+     * @return dataTO including fullCloneFlag, if provided
+     */
+    protected DataTO addFullCloneAndDiskprovisiongStrictnessFlagOnDest(DataTO dataTO) {
+        if (dataTO == null) {
+            return dataTO;
+        }
+        Hypervisor.HypervisorType hypervisorType = dataTO.getHypervisorType();
+        if (Hypervisor.HypervisorType.VMware.equals(hypervisorType)) {
+            return addFullCloneAndDiskprovisiongStrictnessFlagOnVMwareDest(dataTO);
+        }
+        if (Hypervisor.HypervisorType.XenServer.equals(hypervisorType)) {
+            return addFullCloneAndDiskprovisiongStrictnessFlagOnXenServerDest(dataTO);
+        }
+        return dataTO;
+    }
+
     protected Answer copyObject(DataObject srcData, DataObject destData) {
         return copyObject(srcData, destData, null);
     }
@@ -315,7 +352,7 @@ protected Answer copyVolumeFromSnapshot(DataObject snapObj, DataObject volObj) {
 
             updateLockHostForVolume(ep, volObj);
 
-            CopyCommand cmd = new CopyCommand(srcData.getTO(), addFullCloneAndDiskprovisiongStrictnessFlagOnVMwareDest(volObj.getTO()), _createVolumeFromSnapshotWait, VirtualMachineManager.ExecuteInSequence.value());
+            CopyCommand cmd = new CopyCommand(srcData.getTO(), addFullCloneAndDiskprovisiongStrictnessFlagOnDest(volObj.getTO()), _createVolumeFromSnapshotWait, VirtualMachineManager.ExecuteInSequence.value());
 
             Answer answer = null;
             if (ep == null) {
@@ -361,7 +398,7 @@ private void updateLockHostForVolume(EndPoint ep, DataObject volObj) {
     }
 
     protected Answer cloneVolume(DataObject template, DataObject volume) {
-        CopyCommand cmd = new CopyCommand(template.getTO(), addFullCloneAndDiskprovisiongStrictnessFlagOnVMwareDest(volume.getTO()), 0, VirtualMachineManager.ExecuteInSequence.value());
+        CopyCommand cmd = new CopyCommand(template.getTO(), addFullCloneAndDiskprovisiongStrictnessFlagOnDest(volume.getTO()), 0, VirtualMachineManager.ExecuteInSequence.value());
         try {
             EndPoint ep = selector.select(volume, anyVolumeRequiresEncryption(volume));
             Answer answer = null;
@@ -408,6 +445,9 @@ protected Answer copyVolumeBetweenPools(DataObject srcData, DataObject destData)
                     answer = new Answer(cmd, false, errMsg);
                 } else {
                     answer = ep.sendMessage(cmd);
+                    if (answer != null && answer.getResult()) {
+                        setClvmLockHostIdIfApplicable(destData, ep);
+                    }
                 }
                 return answer;
             }
@@ -445,7 +485,7 @@ protected Answer copyVolumeBetweenPools(DataObject srcData, DataObject destData)
 
                 objOnImageStore.processEvent(Event.CopyingRequested);
 
-                CopyCommand cmd = new CopyCommand(objOnImageStore.getTO(), addFullCloneAndDiskprovisiongStrictnessFlagOnVMwareDest(destData.getTO()), _copyvolumewait, VirtualMachineManager.ExecuteInSequence.value());
+                CopyCommand cmd = new CopyCommand(objOnImageStore.getTO(), addFullCloneAndDiskprovisiongStrictnessFlagOnDest(destData.getTO()), _copyvolumewait, VirtualMachineManager.ExecuteInSequence.value());
                 EndPoint ep = selector.select(objOnImageStore, destData, encryptionRequired);
                 if (ep == null) {
                     String errMsg = String.format(NO_REMOTE_ENDPOINT_WITH_ENCRYPTION, encryptionRequired);
@@ -463,6 +503,7 @@ protected Answer copyVolumeBetweenPools(DataObject srcData, DataObject destData)
                     imageStore.delete(objOnImageStore);
                     return answer;
                 }
+                setClvmLockHostIdIfApplicable(destData, ep);
             } catch (Exception e) {
                 if (imageStore.exists(objOnImageStore)) {
                     objOnImageStore.processEvent(Event.OperationFailed);
@@ -486,6 +527,9 @@ protected Answer copyVolumeBetweenPools(DataObject srcData, DataObject destData)
                 answer = new Answer(cmd, false, errMsg);
             } else {
                 answer = ep.sendMessage(cmd);
+                if (answer != null && answer.getResult()) {
+                    setClvmLockHostIdIfApplicable(destData, ep);
+                }
             }
             // delete volume on cache store
             if (cacheData != null) {
@@ -495,6 +539,17 @@ protected Answer copyVolumeBetweenPools(DataObject srcData, DataObject destData)
         }
     }
 
+    private void setClvmLockHostIdIfApplicable(DataObject destData, EndPoint ep) {
+        if (ep == null || !(destData instanceof VolumeInfo)) {
+            return;
+        }
+        VolumeInfo destVolume = (VolumeInfo) destData;
+        if (ClvmPoolManager.isClvmPoolType(destVolume.getStoragePoolType())) {
+            clvmPoolManager.setClvmLockHostId(destVolume.getId(), ep.getId());
+            logger.debug("Set CLVM lock host {} for migrated volume {}", ep.getId(), destVolume.getUuid());
+        }
+    }
+
     private boolean canBypassSecondaryStorage(DataObject srcData, DataObject destData) {
         if (srcData instanceof VolumeInfo) {
             if (((VolumeInfo)srcData).isDirectDownload()) {
@@ -613,6 +668,9 @@ protected Answer migrateVolumeToPool(DataObject srcData, DataObject destData) {
             if (destPool.getPoolType() == StoragePoolType.CLVM) {
                 volumeVo.setFormat(ImageFormat.RAW);
             }
+            if (ClvmPoolManager.isClvmPoolType(destPool.getPoolType())) {
+                clvmPoolManager.setClvmLockHostId(volume.getId(), ep.getId());
+            }
             // For SMB, pool credentials are also stored in the uri query string.  We trim the query string
             // part  here to make sure the credentials do not get stored in the db unencrypted.
             String folder = destPool.getPath();
@@ -692,7 +750,7 @@ protected Answer createTemplateFromSnapshot(DataObject srcData, DataObject destD
             ep = selector.select(srcData, destData);
         }
 
-        CopyCommand cmd = new CopyCommand(srcData.getTO(), addFullCloneAndDiskprovisiongStrictnessFlagOnVMwareDest(destData.getTO()), _createprivatetemplatefromsnapshotwait, VirtualMachineManager.ExecuteInSequence.value());
+        CopyCommand cmd = new CopyCommand(srcData.getTO(), addFullCloneAndDiskprovisiongStrictnessFlagOnDest(destData.getTO()), _createprivatetemplatefromsnapshotwait, VirtualMachineManager.ExecuteInSequence.value());
         Answer answer = null;
         if (ep == null) {
             logger.error(NO_REMOTE_ENDPOINT_SSVM);
@@ -730,7 +788,7 @@ protected Answer copySnapshot(DataObject srcData, DataObject destData) {
                 Scope selectedScope = pickCacheScopeForCopy(srcData, destData);
                 cacheData = cacheMgr.getCacheObject(srcData, selectedScope);
 
-                CopyCommand cmd = new CopyCommand(srcData.getTO(), addFullCloneAndDiskprovisiongStrictnessFlagOnVMwareDest(destData.getTO()), _backupsnapshotwait, VirtualMachineManager.ExecuteInSequence.value());
+                CopyCommand cmd = new CopyCommand(srcData.getTO(), addFullCloneAndDiskprovisiongStrictnessFlagOnDest(destData.getTO()), _backupsnapshotwait, VirtualMachineManager.ExecuteInSequence.value());
                 cmd.setCacheTO(cacheData.getTO());
                 cmd.setOptions(options);
                 EndPoint ep = selector.select(srcData, destData, encryptionRequired);
@@ -741,7 +799,7 @@ protected Answer copySnapshot(DataObject srcData, DataObject destData) {
                     answer = ep.sendMessage(cmd);
                 }
             } else {
-                addFullCloneAndDiskprovisiongStrictnessFlagOnVMwareDest(destData.getTO());
+                addFullCloneAndDiskprovisiongStrictnessFlagOnDest(destData.getTO());
                 CopyCommand cmd = new CopyCommand(srcData.getTO(), destData.getTO(), _backupsnapshotwait, VirtualMachineManager.ExecuteInSequence.value());
                 cmd.setOptions(options);
                 EndPoint ep = selector.select(srcData, destData, StorageAction.BACKUPSNAPSHOT, encryptionRequired);
diff --git a/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/StorageSystemDataMotionStrategy.java b/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/StorageSystemDataMotionStrategy.java
index 2be0b981455d..7674f1ce25a1 100644
--- a/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/StorageSystemDataMotionStrategy.java
+++ b/engine/storage/datamotion/src/main/java/org/apache/cloudstack/storage/motion/StorageSystemDataMotionStrategy.java
@@ -37,6 +37,7 @@
 import com.cloud.agent.api.PrepareForMigrationAnswer;
 import com.cloud.resource.ResourceManager;
 import com.cloud.storage.clvm.ClvmPoolManager;
+import org.apache.cloudstack.backup.InternalBackupService;
 import org.apache.cloudstack.storage.clvm.command.ClvmLockTransferCommand;
 import org.apache.cloudstack.engine.subsystem.api.storage.ChapInfo;
 import org.apache.cloudstack.engine.subsystem.api.storage.ClusterScope;
@@ -212,6 +213,9 @@ public class StorageSystemDataMotionStrategy implements DataMotionStrategy {
     @Inject
     private ClvmPoolManager clvmPoolManager;
 
+    @Inject
+    private InternalBackupService internalBackupService;
+
     @Override
     public StrategyPriority canHandle(DataObject srcData, DataObject destData) {
         if (srcData instanceof SnapshotInfo) {
@@ -2527,6 +2531,7 @@ private void handlePostMigration(boolean success, Map<VolumeInfo, VolumeInfo> sr
                     _snapshotDao.updateVolumeIds(srcVolumeInfo.getId(), destVolumeInfo.getId());
                     _snapshotDataStoreDao.updateVolumeIds(srcVolumeInfo.getId(), destVolumeInfo.getId());
                 }
+                internalBackupService.updateVolumeId(srcVolumeInfo.getId(), destVolumeInfo.getId());
             }
             else {
                 try {
diff --git a/engine/storage/datamotion/src/test/java/org/apache/cloudstack/storage/motion/AncientDataMotionStrategyTest.java b/engine/storage/datamotion/src/test/java/org/apache/cloudstack/storage/motion/AncientDataMotionStrategyTest.java
index e84163656b10..86af81899e8f 100755
--- a/engine/storage/datamotion/src/test/java/org/apache/cloudstack/storage/motion/AncientDataMotionStrategyTest.java
+++ b/engine/storage/datamotion/src/test/java/org/apache/cloudstack/storage/motion/AncientDataMotionStrategyTest.java
@@ -113,6 +113,14 @@ public void testAddFullCloneFlagOnVMwareDest(){
         verify(dataStoreTO).setFullCloneFlag(FULL_CLONE_FLAG);
     }
 
+    @Test
+    public void testAddFullCloneFlagOnXenServerDest() throws IllegalAccessException, NoSuchFieldException {
+        overrideDefaultConfigValue(StorageManager.XenserverCreateCloneFull, String.valueOf(FULL_CLONE_FLAG));
+        when(dataTO.getHypervisorType()).thenReturn(HypervisorType.XenServer);
+        strategy.addFullCloneAndDiskprovisiongStrictnessFlagOnXenServerDest(dataTO);
+        verify(dataStoreTO).setFullCloneFlag(FULL_CLONE_FLAG);
+    }
+
     @Test
     public void testAddFullCloneFlagOnNotVmwareDest(){
         verify(dataStoreTO, never()).setFullCloneFlag(any(Boolean.class));
diff --git a/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/snapshot/SnapshotServiceImpl.java b/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/snapshot/SnapshotServiceImpl.java
index 95345bdf9e0e..a94c04ff4aae 100644
--- a/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/snapshot/SnapshotServiceImpl.java
+++ b/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/snapshot/SnapshotServiceImpl.java
@@ -30,6 +30,7 @@
 import com.cloud.storage.Volume;
 import com.cloud.storage.snapshot.SnapshotManager;
 import com.cloud.vm.VirtualMachine;
+import org.apache.cloudstack.backup.InternalBackupService;
 import org.apache.cloudstack.engine.subsystem.api.storage.CopyCommandResult;
 import org.apache.cloudstack.engine.subsystem.api.storage.CreateCmdResult;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataMotionService;
@@ -116,6 +117,8 @@ public class SnapshotServiceImpl implements SnapshotService {
     ConfigurationDao _configDao;
     @Inject
     HostDao hostDao;
+    @Inject
+    private InternalBackupService internalBackupService;
 
     @Inject
     private HeuristicRuleHelper heuristicRuleHelper;
@@ -603,6 +606,7 @@ protected Void revertSnapshotCallback(AsyncCallbackDispatcher<SnapshotServiceImp
                 res = new SnapshotResult(context.snapshot, null);
                 res.setResult(result.getResult());
             } else {
+                internalBackupService.cleanupBackupMetadata(context.snapshot.getVolumeId());
                 res = new SnapshotResult(context.snapshot, null);
             }
         } catch (Exception e) {
diff --git a/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/vmsnapshot/KvmFileBasedStorageVmSnapshotStrategy.java b/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/vmsnapshot/KvmFileBasedStorageVmSnapshotStrategy.java
index 655e0f961db5..14e6e2b12edc 100644
--- a/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/vmsnapshot/KvmFileBasedStorageVmSnapshotStrategy.java
+++ b/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/vmsnapshot/KvmFileBasedStorageVmSnapshotStrategy.java
@@ -18,6 +18,40 @@
  */
 package org.apache.cloudstack.storage.vmsnapshot;
 
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.NoSuchElementException;
+import java.util.Objects;
+import java.util.UUID;
+import java.util.stream.Collectors;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.backup.BackupManagerImpl;
+import org.apache.cloudstack.backup.BackupOfferingVO;
+import org.apache.cloudstack.backup.InternalBackupService;
+import org.apache.cloudstack.backup.InternalBackupStoragePoolVO;
+import org.apache.cloudstack.backup.dao.BackupOfferingDao;
+import org.apache.cloudstack.backup.dao.InternalBackupStoragePoolDao;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreProvider;
+import org.apache.cloudstack.engine.subsystem.api.storage.ObjectInDataStoreStateMachine;
+import org.apache.cloudstack.engine.subsystem.api.storage.SnapshotInfo;
+import org.apache.cloudstack.engine.subsystem.api.storage.StrategyPriority;
+import org.apache.cloudstack.engine.subsystem.api.storage.VMSnapshotOptions;
+import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
+import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreVO;
+import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.apache.cloudstack.storage.snapshot.SnapshotObject;
+import org.apache.cloudstack.storage.to.BackupDeltaTO;
+import org.apache.cloudstack.storage.to.DeltaMergeTreeTO;
+import org.apache.cloudstack.storage.to.SnapshotObjectTO;
+import org.apache.cloudstack.storage.to.VolumeObjectTO;
+import org.apache.commons.collections.CollectionUtils;
+
 import com.cloud.agent.api.Answer;
 import com.cloud.agent.api.VMSnapshotTO;
 import com.cloud.agent.api.storage.CreateDiskOnlyVmSnapshotAnswer;
@@ -26,7 +60,6 @@
 import com.cloud.agent.api.storage.MergeDiskOnlyVmSnapshotCommand;
 import com.cloud.agent.api.storage.RevertDiskOnlyVmSnapshotAnswer;
 import com.cloud.agent.api.storage.RevertDiskOnlyVmSnapshotCommand;
-import com.cloud.agent.api.storage.SnapshotMergeTreeTO;
 import com.cloud.agent.api.to.DataTO;
 import com.cloud.configuration.Resource;
 import com.cloud.event.EventTypes;
@@ -38,6 +71,7 @@
 import com.cloud.storage.Storage;
 import com.cloud.storage.Volume;
 import com.cloud.storage.VolumeVO;
+import com.cloud.storage.dao.SnapshotDao;
 import com.cloud.user.ResourceLimitService;
 import com.cloud.uservm.UserVm;
 import com.cloud.utils.DateUtil;
@@ -49,30 +83,6 @@
 import com.cloud.vm.snapshot.VMSnapshot;
 import com.cloud.vm.snapshot.VMSnapshotDetailsVO;
 import com.cloud.vm.snapshot.VMSnapshotVO;
-import org.apache.cloudstack.backup.BackupOfferingVO;
-import org.apache.cloudstack.backup.dao.BackupOfferingDao;
-import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreProvider;
-import org.apache.cloudstack.engine.subsystem.api.storage.ObjectInDataStoreStateMachine;
-import org.apache.cloudstack.engine.subsystem.api.storage.SnapshotInfo;
-import org.apache.cloudstack.engine.subsystem.api.storage.StrategyPriority;
-import org.apache.cloudstack.engine.subsystem.api.storage.VMSnapshotOptions;
-import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
-import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreDao;
-import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreVO;
-import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
-import org.apache.cloudstack.storage.snapshot.SnapshotObject;
-import org.apache.cloudstack.storage.to.SnapshotObjectTO;
-import org.apache.cloudstack.storage.to.VolumeObjectTO;
-import org.apache.commons.collections.CollectionUtils;
-
-import javax.inject.Inject;
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.NoSuchElementException;
-import java.util.Objects;
-import java.util.stream.Collectors;
 
 public class KvmFileBasedStorageVmSnapshotStrategy extends StorageVMSnapshotStrategy {
 
@@ -87,6 +97,16 @@ public class KvmFileBasedStorageVmSnapshotStrategy extends StorageVMSnapshotStra
     @Inject
     protected BackupOfferingDao backupOfferingDao;
 
+    @Inject
+    private InternalBackupService internalBackupService;
+
+    @Inject
+    private InternalBackupStoragePoolDao internalBackupStoragePoolDao;
+
+    @Inject
+    private SnapshotDao snapshotDao;
+
+
     @Override
     public VMSnapshot takeVMSnapshot(VMSnapshot vmSnapshot) {
         Map<VolumeInfo, SnapshotObject> volumeInfoToSnapshotObjectMap = new HashMap<>();
@@ -138,11 +158,13 @@ public boolean deleteVMSnapshot(VMSnapshot vmSnapshot) {
             mergeOldSiblingWithOldParentIfOldParentIsDead(vmSnapshotDao.findByIdIncludingRemoved(vmSnapshotBeingDeleted.getParent()), userVm, hostId, volumeTOs);
         } else if (!isCurrent && numberOfChildren == 1) {
             VMSnapshotVO childSnapshot = snapshotChildren.get(0);
-            volumeSnapshotVos = mergeSnapshots(vmSnapshotBeingDeleted, childSnapshot, userVm, volumeTOs, hostId);
+            volumeSnapshotVos = mergeSnapshots(vmSnapshotBeingDeleted, childSnapshot, userVm, hostId);
         }
 
+        Date removedDate = DateUtil.now();
         for (SnapshotVO snapshotVO : volumeSnapshotVos) {
             snapshotVO.setState(Snapshot.State.Destroyed);
+            snapshotVO.setRemoved(removedDate);
             snapshotDao.update(snapshotVO.getId(), snapshotVO);
         }
 
@@ -180,7 +202,9 @@ public boolean revertVMSnapshot(VMSnapshot vmSnapshot) {
 
         transitStateWithoutThrow(vmSnapshotBeingReverted, VMSnapshot.Event.RevertRequested);
 
-        List<SnapshotDataStoreVO> volumeSnapshots = getVolumeSnapshotsAssociatedWithVmSnapshot(vmSnapshotBeingReverted);
+        internalBackupService.prepareVmForSnapshotRevert(vmSnapshot);
+
+        List<SnapshotDataStoreVO> volumeSnapshots = vmSnapshotHelper.getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(vmSnapshotBeingReverted.getId());
         List<SnapshotObjectTO> volumeSnapshotTos = volumeSnapshots.stream()
                 .map(snapshot -> (SnapshotObjectTO) snapshotDataFactory.getSnapshot(snapshot.getSnapshotId(), snapshot.getDataStoreId(), DataStoreRole.Primary).getTO())
                 .collect(Collectors.toList());
@@ -269,7 +293,7 @@ private void mergeOldSiblingWithOldParentIfOldParentIsDead(VMSnapshotVO oldParen
             VMSnapshotVO oldSibling = oldSiblings.get(0);
             logger.debug("Merging VM snapshot [{}] with [{}] as the former was hidden and only the latter depends on it.", oldParent.getUuid(), oldSibling.getUuid());
 
-            snapshotVos = mergeSnapshots(oldParent, oldSibling, userVm, volumeTOs, hostId);
+            snapshotVos = mergeSnapshots(oldParent, oldSibling, userVm, hostId);
         }
 
         for (SnapshotVO snapshotVO : snapshotVos) {
@@ -344,8 +368,8 @@ public StrategyPriority canHandle(Long vmId, Long rootPoolId, boolean snapshotMe
         }
 
         BackupOfferingVO backupOffering = backupOfferingDao.findById(vm.getBackupOfferingId());
-        if (backupOffering != null) {
-            logger.debug("{} as the VM has a backup offering. This strategy does not support snapshots on VMs with current backup providers.", cantHandleLog);
+        if (backupOffering != null && !backupOffering.getProvider().equals(BackupManagerImpl.KBOSS_BACKUP_PROVIDER)) {
+            logger.debug("{} as the VM has a backup offering for a provider that is not supported. This strategy only supports the KBOSS backup provider.", cantHandleLog);
             return StrategyPriority.CANT_HANDLE;
         }
 
@@ -353,7 +377,7 @@ public StrategyPriority canHandle(Long vmId, Long rootPoolId, boolean snapshotMe
     }
 
     private List<SnapshotVO> deleteSnapshot(VMSnapshotVO vmSnapshotVO, Long hostId) {
-        List<SnapshotDataStoreVO> volumeSnapshots = getVolumeSnapshotsAssociatedWithVmSnapshot(vmSnapshotVO);
+        List<SnapshotDataStoreVO> volumeSnapshots = vmSnapshotHelper.getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot((vmSnapshotVO.getId()));
         List<DataTO> volumeSnapshotTOList = volumeSnapshots.stream()
                 .map(snapshotDataStoreVO -> snapshotDataFactory.getSnapshot(snapshotDataStoreVO.getSnapshotId(), snapshotDataStoreVO.getDataStoreId(), DataStoreRole.Primary).getTO())
                 .collect(Collectors.toList());
@@ -374,7 +398,7 @@ private List<SnapshotVO> deleteSnapshot(VMSnapshotVO vmSnapshotVO, Long hostId)
         return snapshotVOList;
     }
 
-    private List<SnapshotVO> mergeSnapshots(VMSnapshotVO vmSnapshotVO, VMSnapshotVO childSnapshot, UserVmVO userVm, List<VolumeObjectTO> volumeObjectTOS, Long hostId) {
+    private List<SnapshotVO> mergeSnapshots(VMSnapshotVO vmSnapshotVO, VMSnapshotVO childSnapshot, UserVmVO userVm, Long hostId) {
         logger.debug("Merging VM snapshot [{}] with its child [{}].", vmSnapshotVO.getUuid(), childSnapshot.getUuid());
 
         List<VMSnapshotVO> snapshotGrandChildren = vmSnapshotDao.listByParentAndStateIn(childSnapshot.getId(), VMSnapshot.State.Ready, VMSnapshot.State.Hidden);
@@ -384,18 +408,10 @@ private List<SnapshotVO> mergeSnapshots(VMSnapshotVO vmSnapshotVO, VMSnapshotVO
             removeCurrentBackingChainSnapshotFromVmSnapshotList(snapshotGrandChildren, userVm);
         }
 
-        List<SnapshotMergeTreeTO> snapshotMergeTreeToList = generateSnapshotMergeTrees(vmSnapshotVO, childSnapshot, snapshotGrandChildren);
-
-        if (childSnapshot.getCurrent() && !VirtualMachine.State.Running.equals(userVm.getState())) {
-            for (VolumeObjectTO volumeObjectTO : volumeObjectTOS) {
-                snapshotMergeTreeToList.stream().filter(snapshotTree -> Objects.equals(((SnapshotObjectTO) snapshotTree.getParent()).getVolume().getId(), volumeObjectTO.getId()))
-                        .findFirst()
-                        .orElseThrow(() -> new CloudRuntimeException(String.format("Failed to find volume snapshot for volume [%s].", volumeObjectTO.getUuid())))
-                        .addGrandChild(volumeObjectTO);
-            }
-        }
+        List<DeltaMergeTreeTO> deltaMergeTreeTOs = generateDeltaMergeTrees(vmSnapshotVO, childSnapshot, snapshotGrandChildren,
+                !userVm.getState().equals(VirtualMachine.State.Running));
 
-        MergeDiskOnlyVmSnapshotCommand mergeDiskOnlyVMSnapshotCommand = new MergeDiskOnlyVmSnapshotCommand(snapshotMergeTreeToList, userVm.getState(), userVm.getName());
+        MergeDiskOnlyVmSnapshotCommand mergeDiskOnlyVMSnapshotCommand = new MergeDiskOnlyVmSnapshotCommand(deltaMergeTreeTOs, userVm.getState().equals(VirtualMachine.State.Running), userVm.getName());
         Answer answer = agentMgr.easySend(hostId, mergeDiskOnlyVMSnapshotCommand);
         if (answer == null || !answer.getResult()) {
             throw new CloudRuntimeException(String.format("Failed to merge VM snapshot [%s] due to %s.", vmSnapshotVO.getUuid(), answer != null ? answer.getDetails() : "Communication failure"));
@@ -403,15 +419,23 @@ private List<SnapshotVO> mergeSnapshots(VMSnapshotVO vmSnapshotVO, VMSnapshotVO
 
         logger.debug("Updating metadata of VM snapshot [{}] and its child [{}].", vmSnapshotVO.getUuid(), childSnapshot.getUuid());
         List<SnapshotVO> snapshotVOList = new ArrayList<>();
-        for (SnapshotMergeTreeTO snapshotMergeTreeTO : snapshotMergeTreeToList) {
-            SnapshotObjectTO childTO = (SnapshotObjectTO) snapshotMergeTreeTO.getChild();
-            SnapshotObjectTO parentTO = (SnapshotObjectTO) snapshotMergeTreeTO.getParent();
-
-            SnapshotDataStoreVO childSnapshotDataStoreVO = snapshotDataStoreDao.findBySnapshotIdInAnyState(childTO.getId(), DataStoreRole.Primary);
-            childSnapshotDataStoreVO.setInstallPath(parentTO.getPath());
-            snapshotDataStoreDao.update(childSnapshotDataStoreVO.getId(), childSnapshotDataStoreVO);
+        for (DeltaMergeTreeTO deltaMergeTreeTO : deltaMergeTreeTOs) {
+            DataTO childTO =  deltaMergeTreeTO.getChild();
+            SnapshotObjectTO parentTO = (SnapshotObjectTO) deltaMergeTreeTO.getParent();
+
+            if (childTO instanceof BackupDeltaTO) {
+                InternalBackupStoragePoolVO backupDelta = internalBackupStoragePoolDao.findOneByVolumeId(parentTO.getVolume().getVolumeId());
+                backupDelta.setBackupDeltaParentPath(parentTO.getPath());
+                logger.debug("The child was also a KBOSS backup delta, will update the backup delta metadata. Updating backupDeltaParentPath of backupDelta [{}] to [{}].", backupDelta.getId(), parentTO.getPath());
+                internalBackupStoragePoolDao.update(backupDelta.getId(), backupDelta);
+            } else {
+                SnapshotDataStoreVO childSnapshotDataStoreVO = snapshotDataStoreDao.findBySnapshotIdInAnyState(childTO.getId(), DataStoreRole.Primary);
+                childSnapshotDataStoreVO.setInstallPath(parentTO.getPath());
+                logger.debug("Updating the child path [{}] to [{}].", childSnapshotDataStoreVO.getId(), parentTO.getPath());
+                snapshotDataStoreDao.update(childSnapshotDataStoreVO.getId(), childSnapshotDataStoreVO);
+            }
 
-            snapshotDataStoreDao.expungeReferenceBySnapshotIdAndDataStoreRole(parentTO.getId(), childSnapshotDataStoreVO.getDataStoreId(), DataStoreRole.Primary);
+            snapshotDataStoreDao.expungeBySnapshotIdAndStoreRole(parentTO.getId(), DataStoreRole.Primary);
             snapshotVOList.add(snapshotDao.findById(parentTO.getId()));
         }
 
@@ -423,18 +447,32 @@ private List<SnapshotVO> mergeSnapshots(VMSnapshotVO vmSnapshotVO, VMSnapshotVO
 
     private List<SnapshotVO> mergeCurrentDeltaOnSnapshot(VMSnapshotVO vmSnapshotVo, UserVmVO userVmVO, Long hostId, List<VolumeObjectTO> volumeObjectTOS) {
         logger.debug("Merging VM snapshot [{}] with the current volume delta.", vmSnapshotVo.getUuid());
-        List<SnapshotMergeTreeTO> snapshotMergeTreeTOList = new ArrayList<>();
-        List<SnapshotDataStoreVO> volumeSnapshots = getVolumeSnapshotsAssociatedWithVmSnapshot(vmSnapshotVo);
+        List<DeltaMergeTreeTO> deltaMergeTreeTOs = new ArrayList<>();
+        List<SnapshotDataStoreVO> volumeSnapshots = vmSnapshotHelper.getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(vmSnapshotVo.getId());
 
         for (VolumeObjectTO volumeObjectTO : volumeObjectTOS) {
             SnapshotDataStoreVO volumeParentSnapshot = volumeSnapshots.stream().filter(snapshot -> Objects.equals(snapshot.getVolumeId(), volumeObjectTO.getId()))
                     .findFirst()
                     .orElseThrow(() -> new CloudRuntimeException(String.format("Failed to find volume snapshot for volume [%s].", volumeObjectTO.getUuid())));
             DataTO parentSnapshot = snapshotDataFactory.getSnapshot(volumeParentSnapshot.getSnapshotId(), volumeParentSnapshot.getDataStoreId(), DataStoreRole.Primary).getTO();
-            snapshotMergeTreeTOList.add(new SnapshotMergeTreeTO(parentSnapshot, volumeObjectTO, new ArrayList<>()));
+
+            InternalBackupStoragePoolVO backupDelta = internalBackupStoragePoolDao.findOneByVolumeId(volumeObjectTO.getVolumeId());
+
+            if (backupDelta != null && backupDelta.getBackupDeltaPath().equals(volumeObjectTO.getPath())) {
+                logger.debug("The current volume delta is also a KBOSS backup delta. Will merge the snapshot delta of volume [{}] with the parent backup delta at [{}].",
+                        volumeObjectTO.getUuid(), backupDelta.getBackupDeltaParentPath());
+                BackupDeltaTO childTo =  new BackupDeltaTO(volumeObjectTO.getDataStore(), Hypervisor.HypervisorType.KVM, backupDelta.getBackupDeltaParentPath());
+                ArrayList<DataTO> grandChildren = new ArrayList<>();
+                if (userVmVO.getState().equals(VirtualMachine.State.Stopped)) {
+                    grandChildren.add(new BackupDeltaTO(volumeObjectTO.getDataStore(), Hypervisor.HypervisorType.KVM, backupDelta.getBackupDeltaPath()));
+                }
+                deltaMergeTreeTOs.add(new DeltaMergeTreeTO(volumeObjectTO, parentSnapshot, childTo, grandChildren));
+            } else {
+                deltaMergeTreeTOs.add(new DeltaMergeTreeTO(volumeObjectTO, parentSnapshot, volumeObjectTO, new ArrayList<>()));
+            }
         }
 
-        MergeDiskOnlyVmSnapshotCommand mergeDiskOnlyVMSnapshotCommand = new MergeDiskOnlyVmSnapshotCommand(snapshotMergeTreeTOList, userVmVO.getState(), userVmVO.getName());
+        MergeDiskOnlyVmSnapshotCommand mergeDiskOnlyVMSnapshotCommand = new MergeDiskOnlyVmSnapshotCommand(deltaMergeTreeTOs, userVmVO.getState().equals(VirtualMachine.State.Running), userVmVO.getName());
 
         Answer answer = agentMgr.easySend(hostId, mergeDiskOnlyVMSnapshotCommand);
         if (answer == null || !answer.getResult()) {
@@ -443,13 +481,20 @@ private List<SnapshotVO> mergeCurrentDeltaOnSnapshot(VMSnapshotVO vmSnapshotVo,
 
         logger.debug("Updating metadata of VM snapshot [{}].", vmSnapshotVo.getUuid());
         List<SnapshotVO> snapshotVOList = new ArrayList<>();
-        for (SnapshotMergeTreeTO snapshotMergeTreeTO : snapshotMergeTreeTOList) {
-            VolumeObjectTO volumeObjectTO = (VolumeObjectTO) snapshotMergeTreeTO.getChild();
-            SnapshotObjectTO parentTO = (SnapshotObjectTO) snapshotMergeTreeTO.getParent();
-
-            VolumeVO volumeVO = volumeDao.findById(volumeObjectTO.getId());
-            volumeVO.setPath(parentTO.getPath());
-            volumeDao.update(volumeVO.getId(), volumeVO);
+        for (DeltaMergeTreeTO deltaMergeTreeTO : deltaMergeTreeTOs) {
+            DataTO dataTO = deltaMergeTreeTO.getChild();
+            SnapshotObjectTO parentTO = (SnapshotObjectTO) deltaMergeTreeTO.getParent();
+            VolumeVO volumeVO = volumeDao.findById(parentTO.getVolume().getId());
+
+            if (dataTO instanceof BackupDeltaTO) {
+                logger.debug("The child of deltaMergeTree [{}] is a backupDeltaTO, thus, we will update the backup delta metadata.", deltaMergeTreeTO);
+                InternalBackupStoragePoolVO backupDelta = internalBackupStoragePoolDao.findOneByVolumeId(parentTO.getVolume().getVolumeId());
+                backupDelta.setBackupDeltaParentPath(parentTO.getPath());
+                internalBackupStoragePoolDao.update(backupDelta.getId(), backupDelta);
+            } else {
+                volumeVO.setPath(parentTO.getPath());
+                volumeDao.update(volumeVO.getId(), volumeVO);
+            }
 
             snapshotDataStoreDao.expungeReferenceBySnapshotIdAndDataStoreRole(parentTO.getId(), volumeVO.getPoolId(), DataStoreRole.Primary);
             snapshotVOList.add(snapshotDao.findById(parentTO.getId()));
@@ -495,11 +540,12 @@ protected VMSnapshot takeVmSnapshotInternal(VMSnapshot vmSnapshot, Map<VolumeInf
             quiesceVm = options.needQuiesceVM();
         }
 
-        long virtualSize = createVolumeSnapshotMetadataAndCalculateVirtualSize(vmSnapshot, volumeInfoToSnapshotObjectMap, volumeTOs);
+        List<Pair<VolumeObjectTO, String>> volumeTosAndNewPaths = volumeTOs.stream().map(volume -> new Pair<>(volume, UUID.randomUUID().toString())).collect(Collectors.toList());
+        long virtualSize = createVolumeSnapshotMetadataAndCalculateVirtualSize(vmSnapshot, volumeInfoToSnapshotObjectMap, volumeTosAndNewPaths);
 
         VMSnapshotTO target = new VMSnapshotTO(vmSnapshot.getId(), vmSnapshot.getName(), vmSnapshot.getType(), null, vmSnapshot.getDescription(), false, parentSnapshotTo, quiesceVm);
 
-        CreateDiskOnlyVmSnapshotCommand ccmd = new CreateDiskOnlyVmSnapshotCommand(userVm.getInstanceName(), target, volumeTOs, null, userVm.getState());
+        CreateDiskOnlyVmSnapshotCommand ccmd = new CreateDiskOnlyVmSnapshotCommand(userVm.getInstanceName(), target, volumeTosAndNewPaths, null, userVm.getState());
 
         logger.info("Sending disk-only VM snapshot creation of VM Snapshot [{}] command for host [{}].", vmSnapshot.getUuid(), hostId);
         Answer answer = agentMgr.easySend(hostId, ccmd);
@@ -519,12 +565,12 @@ protected VMSnapshot takeVmSnapshotInternal(VMSnapshot vmSnapshot, Map<VolumeInf
      * */
     private VMSnapshot processCreateVmSnapshotAnswer(VMSnapshot vmSnapshot, Map<VolumeInfo, SnapshotObject> volumeInfoToSnapshotObjectMap, CreateDiskOnlyVmSnapshotAnswer answer, UserVm userVm, VMSnapshotVO vmSnapshotVO, long virtualSize, VMSnapshotVO parentSnapshotVo) throws NoTransitionException {
         logger.debug("Processing CreateDiskOnlyVMSnapshotCommand answer for disk-only VM snapshot [{}].", vmSnapshot.getUuid());
-        Map<String, Pair<Long, String>> volumeUuidToSnapshotSizeAndNewVolumePathMap = answer.getMapVolumeToSnapshotSizeAndNewVolumePath();
+        Map<String, Long> volumeUuidToSnapshotSize = answer.getMapVolumeToSnapshotSize();
         long vmSnapshotSize = 0;
 
         for (VolumeInfo volumeInfo : volumeInfoToSnapshotObjectMap.keySet()) {
             VolumeVO volumeVO = (VolumeVO) volumeInfo.getVolume();
-            Pair<Long, String> snapSizeAndNewVolumePath = volumeUuidToSnapshotSizeAndNewVolumePathMap.get(volumeVO.getUuid());
+            Long snapSize = volumeUuidToSnapshotSize.get(volumeVO.getUuid());
 
             SnapshotObject snapshot = volumeInfoToSnapshotObjectMap.get(volumeInfo);
             snapshot.markBackedUp();
@@ -532,14 +578,15 @@ private VMSnapshot processCreateVmSnapshotAnswer(VMSnapshot vmSnapshot, Map<Volu
             logger.debug("Updating metadata for volume [{}] and its corresponding snapshot [{}].", volumeVO, snapshot.getSnapshotVO());
 
             SnapshotDataStoreVO snapshotDataStoreVO = snapshotDataStoreDao.findBySnapshotId(snapshot.getId()).get(0);
+            String newVolumePath = snapshotDataStoreVO.getInstallPath();
             snapshotDataStoreVO.setInstallPath(volumeVO.getPath());
-            snapshotDataStoreVO.setPhysicalSize(snapSizeAndNewVolumePath.first());
+            snapshotDataStoreVO.setPhysicalSize(snapSize);
             snapshotDataStoreVO.setState(ObjectInDataStoreStateMachine.State.Ready);
             snapshotDataStoreDao.update(snapshotDataStoreVO.getId(), snapshotDataStoreVO);
 
-            vmSnapshotSize += snapSizeAndNewVolumePath.first();
+            vmSnapshotSize += snapSize;
 
-            volumeVO.setPath(snapSizeAndNewVolumePath.second());
+            volumeVO.setPath(newVolumePath);
             volumeDao.update(volumeVO.getId(), volumeVO);
             volumeInfo.stateTransit(Volume.Event.OperationSucceeded);
 
@@ -563,9 +610,11 @@ private VMSnapshot processCreateVmSnapshotAnswer(VMSnapshot vmSnapshot, Map<Volu
         return vmSnapshot;
     }
 
-    private long createVolumeSnapshotMetadataAndCalculateVirtualSize(VMSnapshot vmSnapshot, Map<VolumeInfo, SnapshotObject> volumeInfoToSnapshotObjectMap, List<VolumeObjectTO> volumeTOs) throws NoTransitionException {
+    private long createVolumeSnapshotMetadataAndCalculateVirtualSize(VMSnapshot vmSnapshot, Map<VolumeInfo, SnapshotObject> volumeInfoToSnapshotObjectMap,
+            List<Pair<VolumeObjectTO, String>> volumeToAndNewPaths) throws NoTransitionException {
         long virtualSize = 0;
-        for (VolumeObjectTO volumeObjectTO : volumeTOs) {
+        for (Pair<VolumeObjectTO, String> volumeToAndPath : volumeToAndNewPaths) {
+            VolumeObjectTO volumeObjectTO = volumeToAndPath.first();
             VolumeInfo volumeInfo = volumeDataFactory.getVolume(volumeObjectTO.getId());
             volumeInfo.stateTransit(Volume.Event.SnapshotRequested);
             virtualSize += volumeInfo.getSize();
@@ -584,61 +633,77 @@ private long createVolumeSnapshotMetadataAndCalculateVirtualSize(VMSnapshot vmSn
 
             snapshotOnPrimary.processEvent(Snapshot.Event.CreateRequested);
             snapshotOnPrimary.processEvent(ObjectInDataStoreStateMachine.Event.CreateOnlyRequested);
+            SnapshotDataStoreVO snapshotDataStoreVO = snapshotDataStoreDao.findBySnapshotId(snapshot.getId()).get(0);
+            snapshotDataStoreVO.setInstallPath(volumeToAndPath.second());
+            snapshotDataStoreDao.update(snapshotDataStoreVO.getId(), snapshotDataStoreVO);
 
             volumeInfoToSnapshotObjectMap.put(volumeInfo, snapshotOnPrimary);
         }
         return virtualSize;
     }
 
-    private List<SnapshotMergeTreeTO> generateSnapshotMergeTrees(VMSnapshotVO parent, VMSnapshotVO child, List<VMSnapshotVO> grandChildren) throws NoSuchElementException {
+    /**
+     * Generates the delta merge trees, taking internal backups into account.
+     * */
+    private List<DeltaMergeTreeTO> generateDeltaMergeTrees(VMSnapshotVO parent, VMSnapshotVO child, List<VMSnapshotVO> grandChildren, boolean stoppedVm) throws NoSuchElementException {
         logger.debug("Generating list of Snapshot Merge Trees for the merge process of VM Snapshot [{}].", parent.getUuid());
 
-        List<SnapshotMergeTreeTO> snapshotMergeTrees = new ArrayList<>();
-        List<SnapshotDataStoreVO> parentVolumeSnapshots = getVolumeSnapshotsAssociatedWithVmSnapshot(parent);
-        List<SnapshotDataStoreVO> childVolumeSnapshots = getVolumeSnapshotsAssociatedWithVmSnapshot(child);
+        List<DeltaMergeTreeTO> snapshotMergeTrees = new ArrayList<>();
+        List<SnapshotDataStoreVO> parentVolumeSnapshots = vmSnapshotHelper.getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(parent.getId());
+        List<SnapshotDataStoreVO> childVolumeSnapshots = vmSnapshotHelper.getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(child.getId());
         List<SnapshotDataStoreVO> grandChildrenVolumeSnapshots = new ArrayList<>();
 
         for (VMSnapshotVO grandChild : grandChildren) {
-            grandChildrenVolumeSnapshots.addAll(getVolumeSnapshotsAssociatedWithVmSnapshot(grandChild));
+            grandChildrenVolumeSnapshots.addAll(vmSnapshotHelper.getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(grandChild.getId()));
         }
 
         for (SnapshotDataStoreVO parentSnapshotDataStoreVO : parentVolumeSnapshots) {
-            DataTO parentTO = snapshotDataFactory.getSnapshot(parentSnapshotDataStoreVO.getSnapshotId(), parentSnapshotDataStoreVO.getDataStoreId(), DataStoreRole.Primary).getTO();
+            SnapshotObjectTO parentTO = (SnapshotObjectTO) snapshotDataFactory.getSnapshot(parentSnapshotDataStoreVO.getSnapshotId(), parentSnapshotDataStoreVO.getDataStoreId(), DataStoreRole.Primary).getTO();
+            VolumeObjectTO volumeObjectTO = parentTO.getVolume();
 
-            DataTO childTO = childVolumeSnapshots.stream()
+            SnapshotDataStoreVO childVO = childVolumeSnapshots.stream()
                     .filter(childSnapshot -> Objects.equals(parentSnapshotDataStoreVO.getVolumeId(), childSnapshot.getVolumeId()))
-                    .map(snapshotDataStoreVO -> snapshotDataFactory.getSnapshot(snapshotDataStoreVO.getSnapshotId(), snapshotDataStoreVO.getDataStoreId(), DataStoreRole.Primary).getTO())
                     .findFirst().orElseThrow(() -> new CloudRuntimeException(String.format("Could not find child snapshot of parent [%s].", parentSnapshotDataStoreVO.getSnapshotId())));
 
-            List<DataTO> grandChildrenTOList = grandChildrenVolumeSnapshots.stream()
-                    .filter(grandChildSnapshot -> Objects.equals(parentSnapshotDataStoreVO.getVolumeId(), grandChildSnapshot.getVolumeId()))
-                    .map(snapshotDataStoreVO -> snapshotDataFactory.getSnapshot(snapshotDataStoreVO.getSnapshotId(), snapshotDataStoreVO.getDataStoreId(), DataStoreRole.Primary).getTO())
-                    .collect(Collectors.toList());
+            InternalBackupStoragePoolVO backupDelta = internalBackupStoragePoolDao.findOneByVolumeId(childVO.getVolumeId());
+            List<DataTO> grandChildrenTOList = new ArrayList<>();
+            DataTO childTO = getChildAndGrandChildren(child, stoppedVm, parentSnapshotDataStoreVO, backupDelta, childVO, volumeObjectTO, grandChildrenTOList,
+                    grandChildrenVolumeSnapshots);
 
-            snapshotMergeTrees.add(new SnapshotMergeTreeTO(parentTO, childTO, grandChildrenTOList));
+            snapshotMergeTrees.add(new DeltaMergeTreeTO(volumeObjectTO, parentTO, childTO, grandChildrenTOList));
         }
 
-        logger.debug("Generated the following list of Snapshot Merge Trees for the VM snapshot [{}]: [{}].", parent.getUuid(), snapshotMergeTrees);
+        logger.debug(String.format("Generated the following list of Snapshot Merge Trees for the VM snapshot [%s]: [%s].", parent.getUuid(), snapshotMergeTrees));
         return snapshotMergeTrees;
     }
 
     /**
-     * For a given {@code VMSnapshotVO}, populates the {@code associatedVolumeSnapshots} list with all the volume snapshots that are
-     * part of the VMSnapshot.
-     * @param vmSnapshot the VMSnapshotVO that will have its size calculated
-     * @return the list that will be populated with the volume snapshots associated with the VM snapshot.
+     * Gets the correct children and grandchildren, taking KBOSS backups into account.
      * */
-    private List<SnapshotDataStoreVO> getVolumeSnapshotsAssociatedWithVmSnapshot(VMSnapshotVO vmSnapshot) {
-        List<SnapshotDataStoreVO> associatedVolumeSnapshots = new ArrayList<>();
-        List<VMSnapshotDetailsVO> snapshotDetailList = vmSnapshotDetailsDao.findDetails(vmSnapshot.getId(), KVM_FILE_BASED_STORAGE_SNAPSHOT);
-        for (VMSnapshotDetailsVO vmSnapshotDetailsVO : snapshotDetailList) {
-            SnapshotDataStoreVO snapshot = snapshotDataStoreDao.findOneBySnapshotAndDatastoreRole(Long.parseLong(vmSnapshotDetailsVO.getValue()), DataStoreRole.Primary);
-            if (snapshot == null) {
-                throw new CloudRuntimeException(String.format("Could not find snapshot for VM snapshot [%s].", vmSnapshot.getUuid()));
+    private DataTO getChildAndGrandChildren(VMSnapshotVO child, boolean stoppedVm, SnapshotDataStoreVO parentSnapshotDataStoreVO, InternalBackupStoragePoolVO backupDelta,
+            SnapshotDataStoreVO childVO, VolumeObjectTO volumeObjectTO, List<DataTO> grandChildrenTOList, List<SnapshotDataStoreVO> grandChildrenVolumeSnapshots) {
+
+        DataTO childTO;
+        if (backupDelta != null && backupDelta.getBackupDeltaPath().equals(childVO.getInstallPath())) {
+            logger.debug("The child snapshot delta is also a backup delta. We will set the backup delta parent path [{}] as the child and the backup delta path [{}] " +
+                    "as the grand-child.", backupDelta.getBackupDeltaParentPath(), backupDelta.getBackupDeltaPath());
+            childTO = new BackupDeltaTO(volumeObjectTO.getDataStore(), Hypervisor.HypervisorType.KVM, backupDelta.getBackupDeltaParentPath());
+            if (!child.getCurrent() && stoppedVm) {
+                grandChildrenTOList.add(new BackupDeltaTO(volumeObjectTO.getDataStore(), Hypervisor.HypervisorType.KVM, backupDelta.getBackupDeltaPath()));
             }
-            associatedVolumeSnapshots.add(snapshot);
+        } else {
+            childTO = snapshotDataFactory.getSnapshot(childVO.getSnapshotId(), childVO.getDataStoreId(), DataStoreRole.Primary).getTO();
+            grandChildrenTOList.addAll(grandChildrenVolumeSnapshots.stream()
+                    .filter(grandChildSnapshot -> Objects.equals(parentSnapshotDataStoreVO.getVolumeId(), grandChildSnapshot.getVolumeId()))
+                    .map(snapshotDataStoreVO -> snapshotDataFactory.getSnapshot(snapshotDataStoreVO.getSnapshotId(), snapshotDataStoreVO.getDataStoreId(), DataStoreRole.Primary).getTO())
+                    .collect(Collectors.toList()));
         }
-        return associatedVolumeSnapshots;
+
+        if (child.getCurrent() && stoppedVm) {
+            grandChildrenTOList.add(volumeObjectTO);
+        }
+
+        return childTO;
     }
 
     /**
diff --git a/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/vmsnapshot/StorageVMSnapshotStrategy.java b/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/vmsnapshot/StorageVMSnapshotStrategy.java
index 4ae6e26fbd96..fd306414ad49 100644
--- a/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/vmsnapshot/StorageVMSnapshotStrategy.java
+++ b/engine/storage/snapshot/src/main/java/org/apache/cloudstack/storage/vmsnapshot/StorageVMSnapshotStrategy.java
@@ -37,6 +37,8 @@
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeDataFactory;
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
 import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreVO;
 import org.apache.cloudstack.storage.to.VolumeObjectTO;
 import org.apache.commons.collections.CollectionUtils;
 
@@ -95,6 +97,9 @@ public class StorageVMSnapshotStrategy extends DefaultVMSnapshotStrategy {
     @Inject
     VMSnapshotDetailsDao vmSnapshotDetailsDao;
 
+    @Inject
+    private SnapshotDataStoreDao snapshotDataStoreDao;
+
     @Override
     public boolean configure(String name, Map<String, Object> params) throws ConfigurationException {
        return super.configure(name, params);
@@ -374,6 +379,17 @@ public StrategyPriority canHandle(Long vmId, Long rootPoolId, boolean snapshotMe
             return StrategyPriority.CANT_HANDLE;
         }
 
+        for (VolumeVO volume : volumeDao.findByInstance(vmId)) {
+            List<SnapshotDataStoreVO> snapshots = snapshotDataStoreDao.listReadyByVolumeIdAndCheckpointPathNotNull(volume.getId());
+            if (CollectionUtils.isNotEmpty(snapshots)) {
+                logger.debug(
+                        "{} as VM has a volume with incremental snapshots {}. Incremental volume snapshots and StorageVmSnapshotStrategy are not compatible," +
+                                " as restoring VM snapshots will erase the bitmaps and destroy snapshot chains.",
+                        cantHandleLog, snapshots);
+                return StrategyPriority.CANT_HANDLE;
+            }
+        }
+
         if (SnapshotManager.VmStorageSnapshotKvm.value() && !snapshotMemory) {
             return StrategyPriority.HYPERVISOR;
         }
diff --git a/engine/storage/snapshot/src/test/java/org/apache/cloudstack/storage/vmsnapshot/VMSnapshotStrategyKVMTest.java b/engine/storage/snapshot/src/test/java/org/apache/cloudstack/storage/vmsnapshot/VMSnapshotStrategyKVMTest.java
index 7d5d3c786e87..7584ae1c986c 100644
--- a/engine/storage/snapshot/src/test/java/org/apache/cloudstack/storage/vmsnapshot/VMSnapshotStrategyKVMTest.java
+++ b/engine/storage/snapshot/src/test/java/org/apache/cloudstack/storage/vmsnapshot/VMSnapshotStrategyKVMTest.java
@@ -44,6 +44,7 @@
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
 import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
 import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
 import org.apache.cloudstack.storage.to.VolumeObjectTO;
 import org.apache.cloudstack.test.utils.SpringUtils;
@@ -442,5 +443,10 @@ public BackupOfferingDao backupOfferingDao() {
         public BackupManager backupManager() {
             return Mockito.mock(BackupManager.class);
         }
+
+        @Bean
+        public SnapshotDataStoreDao snapshotDataStoreDao() {
+            return Mockito.mock(SnapshotDataStoreDao.class);
+        }
     }
 }
diff --git a/engine/storage/src/main/java/org/apache/cloudstack/storage/backup/BackupObject.java b/engine/storage/src/main/java/org/apache/cloudstack/storage/backup/BackupObject.java
new file mode 100644
index 000000000000..7475f5619528
--- /dev/null
+++ b/engine/storage/src/main/java/org/apache/cloudstack/storage/backup/BackupObject.java
@@ -0,0 +1,198 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package org.apache.cloudstack.storage.backup;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.to.DataObjectType;
+import com.cloud.agent.api.to.DataTO;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.storage.DataStoreRole;
+import com.cloud.utils.component.ComponentContext;
+import org.apache.cloudstack.backup.Backup;
+import org.apache.cloudstack.backup.InternalBackupJoinVO;
+import org.apache.cloudstack.backup.dao.InternalBackupJoinDao;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataObject;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreManager;
+import org.apache.cloudstack.engine.subsystem.api.storage.ObjectInDataStoreStateMachine;
+import org.apache.cloudstack.storage.to.BackupDeltaTO;
+import org.apache.commons.collections.CollectionUtils;
+
+import javax.inject.Inject;
+import java.util.ArrayList;
+import java.util.LinkedList;
+import java.util.List;
+import java.util.stream.Collectors;
+
+public class BackupObject implements DataObject {
+
+    private long id;
+    private String uuid;
+    private Long zoneId;
+    private Long size;
+    private long physicalSize;
+    private DataStore dataStore;
+    private String imageStorePath;
+    private Backup.Status status;
+    private Backup.CompressionStatus compressionStatus;
+
+    @Inject
+    InternalBackupJoinDao internalBackupJoinDao;
+    @Inject
+    DataStoreManager storeManager;
+
+    public BackupObject() {
+
+    }
+
+    public static BackupObject getBackupObject(InternalBackupJoinVO internalBackupJoinVO) {
+        BackupObject backupObject = ComponentContext.inject(BackupObject.class);
+        backupObject.configure(internalBackupJoinVO);
+        return backupObject;
+    }
+
+    private void configure(InternalBackupJoinVO internalBackupJoin) {
+        this.id = internalBackupJoin.getId();
+        this.uuid = internalBackupJoin.getUuid();
+        this.zoneId = internalBackupJoin.getZoneId();
+        this.size = internalBackupJoin.getProtectedSize();
+        this.physicalSize = internalBackupJoin.getSize();
+        this.imageStorePath = internalBackupJoin.getImageStorePath();
+        this.status = internalBackupJoin.getStatus();
+        this.compressionStatus = internalBackupJoin.getCompressionStatus();
+        this.dataStore = storeManager.getDataStore(internalBackupJoin.getImageStoreId(), DataStoreRole.Image);
+    }
+
+    public List<List<BackupObject>> getChildren() {
+        List<List<BackupObject>> children = new ArrayList<>();
+
+        List<InternalBackupJoinVO> backups = internalBackupJoinDao.listByParentId(id);
+        while (CollectionUtils.isNotEmpty(backups)) {
+            children.add(backups.stream().map(BackupObject::getBackupObject).collect(Collectors.toList()));
+            backups = internalBackupJoinDao.listByParentId(backups.get(0).getId());
+        }
+
+        return children;
+    }
+
+    public List<List<BackupObject>> getParents(long parentId) {
+        LinkedList<List<BackupObject>> parents = new LinkedList<>();
+
+        List<InternalBackupJoinVO> backups = internalBackupJoinDao.listById(parentId);
+        while (CollectionUtils.isNotEmpty(backups)) {
+            parents.addFirst(backups.stream().map(BackupObject::getBackupObject).collect(Collectors.toList()));
+            backups = internalBackupJoinDao.listById(backups.get(0).getParentId());
+        }
+
+        return parents;
+    }
+
+    @Override
+    public long getId() {
+        return id;
+    }
+
+    @Override
+    public String getUri() {
+        return "";
+    }
+
+    @Override
+    public DataTO getTO() {
+        DataTO to = dataStore.getDriver().getTO(this);
+        if (to == null) {
+            return new BackupDeltaTO(id, dataStore.getTO(), Hypervisor.HypervisorType.KVM, imageStorePath);
+        }
+        return to;
+    }
+
+    @Override
+    public DataStore getDataStore() {
+        return dataStore;
+    }
+
+    @Override
+    public Long getSize() {
+        return size;
+    }
+
+    @Override
+    public long getPhysicalSize() {
+        return physicalSize;
+    }
+
+    @Override
+    public DataObjectType getType() {
+        return DataObjectType.BACKUP;
+    }
+
+    @Override
+    public String getUuid() {
+        return uuid;
+    }
+
+    @Override
+    public boolean delete() {
+        return false;
+    }
+
+    @Override
+    public void processEvent(ObjectInDataStoreStateMachine.Event event) {
+    }
+
+    @Override
+    public void processEvent(ObjectInDataStoreStateMachine.Event event, Answer answer) {
+    }
+
+    @Override
+    public void incRefCount() {
+    }
+
+    @Override
+    public void decRefCount() {
+    }
+
+    @Override
+    public Long getRefCount() {
+        return 0L;
+    }
+
+    @Override
+    public String getName() {
+        return "";
+    }
+
+    public Long getZoneId() {
+        return zoneId;
+    }
+
+    @Override
+    public String toString() {
+        return uuid;
+    }
+
+    public Backup.CompressionStatus getCompressionStatus() {
+        return compressionStatus;
+    }
+
+    public Backup.Status getStatus() {
+        return status;
+    }
+}
diff --git a/engine/storage/src/main/java/org/apache/cloudstack/storage/helper/VMSnapshotHelperImpl.java b/engine/storage/src/main/java/org/apache/cloudstack/storage/helper/VMSnapshotHelperImpl.java
index 55551772a08a..d5b96be71ee8 100644
--- a/engine/storage/src/main/java/org/apache/cloudstack/storage/helper/VMSnapshotHelperImpl.java
+++ b/engine/storage/src/main/java/org/apache/cloudstack/storage/helper/VMSnapshotHelperImpl.java
@@ -26,9 +26,16 @@
 import javax.inject.Inject;
 
 import com.cloud.uservm.UserVm;
+import com.cloud.storage.DataStoreRole;
+import com.cloud.storage.VolumeApiServiceImpl;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.vm.snapshot.VMSnapshotDetailsVO;
+import com.cloud.vm.snapshot.dao.VMSnapshotDetailsDao;
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeDataFactory;
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
 import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreVO;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
 import org.apache.cloudstack.storage.to.VolumeObjectTO;
 import org.apache.cloudstack.storage.vmsnapshot.VMSnapshotHelper;
@@ -64,6 +71,12 @@ public class VMSnapshotHelperImpl implements VMSnapshotHelper {
     @Inject
     VolumeDataFactory volumeDataFactory;
 
+    @Inject
+    private VMSnapshotDetailsDao vmSnapshotDetailsDao;
+
+    @Inject
+    private SnapshotDataStoreDao snapshotDataStoreDao;
+
     StateMachine2<VMSnapshot.State, VMSnapshot.Event, VMSnapshot> _vmSnapshottateMachine;
 
     public VMSnapshotHelperImpl() {
@@ -115,10 +128,14 @@ public List<VolumeObjectTO> getVolumeTOList(Long vmId) {
         List<VolumeObjectTO> volumeTOs = new ArrayList<VolumeObjectTO>();
         List<VolumeVO> volumeVos = volumeDao.findByInstance(vmId);
         VolumeInfo volumeInfo = null;
-        for (VolumeVO volume : volumeVos) {
-            volumeInfo = volumeDataFactory.getVolume(volume.getId());
+        try {
+            for (VolumeVO volume : volumeVos) {
+                volumeInfo = volumeDataFactory.getVolume(volume.getId());
 
-            volumeTOs.add((VolumeObjectTO)volumeInfo.getTO());
+                volumeTOs.add((VolumeObjectTO)volumeInfo.getTO());
+            }
+        } catch (NullPointerException npe) {
+            throw new CloudRuntimeException(String.format("Unable to get list of volumeTOs for VM [%s]. Have the volumes already been created on the storage?", vmId), npe);
         }
         return volumeTOs;
     }
@@ -150,6 +167,26 @@ public VMSnapshotTO getSnapshotWithParents(VMSnapshotVO snapshot) {
         return result;
     }
 
+    /**
+     * For a given {@code vmSnapshotId}, gets the list with all the volume snapshots that are part of the VMSnapshot.
+     *
+     * @param vmSnapshotId  the id of the VM snapshot;
+     * @return the list that will be populated with the volume snapshots associated with the VM snapshot.
+     */
+    @Override
+    public List<SnapshotDataStoreVO> getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(long vmSnapshotId) {
+        List<SnapshotDataStoreVO> associatedVolumeSnapshots = new ArrayList<>();
+        List<VMSnapshotDetailsVO> snapshotDetailList = vmSnapshotDetailsDao.findDetails(vmSnapshotId, VolumeApiServiceImpl.KVM_FILE_BASED_STORAGE_SNAPSHOT);
+        for (VMSnapshotDetailsVO vmSnapshotDetailsVO : snapshotDetailList) {
+            SnapshotDataStoreVO snapshot = snapshotDataStoreDao.findOneBySnapshotAndDatastoreRole(Long.parseLong(vmSnapshotDetailsVO.getValue()), DataStoreRole.Primary);
+            if (snapshot == null) {
+                throw new CloudRuntimeException(String.format("Could not find snapshot for VM snapshot [%s].", vmSnapshotId));
+            }
+            associatedVolumeSnapshots.add(snapshot);
+        }
+        return associatedVolumeSnapshots;
+    }
+
     @Override
     public StoragePoolVO getStoragePoolForVM(UserVm vm) {
         List<VolumeVO> rootVolumes = volumeDao.findReadyRootVolumesByInstance(vm.getId());
diff --git a/engine/storage/src/main/java/org/apache/cloudstack/storage/vmsnapshot/VMSnapshotHelper.java b/engine/storage/src/main/java/org/apache/cloudstack/storage/vmsnapshot/VMSnapshotHelper.java
index 6d6cb7b70a93..868d634a30a6 100644
--- a/engine/storage/src/main/java/org/apache/cloudstack/storage/vmsnapshot/VMSnapshotHelper.java
+++ b/engine/storage/src/main/java/org/apache/cloudstack/storage/vmsnapshot/VMSnapshotHelper.java
@@ -22,6 +22,7 @@
 
 import com.cloud.uservm.UserVm;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreVO;
 import org.apache.cloudstack.storage.to.VolumeObjectTO;
 
 import com.cloud.agent.api.VMSnapshotTO;
@@ -39,6 +40,8 @@ public interface VMSnapshotHelper {
 
     VMSnapshotTO getSnapshotWithParents(VMSnapshotVO snapshot);
 
+    List<SnapshotDataStoreVO> getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(long vmSnapshotId);
+
     StoragePoolVO getStoragePoolForVM(UserVm vm);
 
     Storage.StoragePoolType getStoragePoolType(Long poolId);
diff --git a/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/volume/VolumeServiceImpl.java b/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/volume/VolumeServiceImpl.java
index 8a0f93fe5fc3..6502de70a1ff 100644
--- a/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/volume/VolumeServiceImpl.java
+++ b/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/volume/VolumeServiceImpl.java
@@ -38,6 +38,7 @@
 import org.apache.cloudstack.annotation.AnnotationService;
 import org.apache.cloudstack.annotation.dao.AnnotationDao;
 import org.apache.cloudstack.api.command.user.volume.CheckAndRepairVolumeCmd;
+import org.apache.cloudstack.backup.InternalBackupService;
 import org.apache.cloudstack.engine.cloud.entity.api.VolumeEntity;
 import org.apache.cloudstack.engine.orchestration.service.VolumeOrchestrationService;
 import org.apache.cloudstack.engine.subsystem.api.storage.ChapInfo;
@@ -48,6 +49,7 @@
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreCapabilities;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreDriver;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreProvider;
 import org.apache.cloudstack.engine.subsystem.api.storage.EndPoint;
 import org.apache.cloudstack.engine.subsystem.api.storage.EndPointSelector;
 import org.apache.cloudstack.engine.subsystem.api.storage.ObjectInDataStoreStateMachine;
@@ -227,6 +229,8 @@ public class VolumeServiceImpl implements VolumeService {
     protected DiskOfferingDao diskOfferingDao;
     @Inject
     ClvmPoolManager clvmPoolManager;
+    @Inject
+    private InternalBackupService internalBackupService;
 
     @Inject
     private KMSManager kmsManager;
@@ -525,6 +529,8 @@ public Void deleteVolumeCallback(AsyncCallbackDispatcher<VolumeServiceImpl, Comm
                     volDao.remove(vo.getId());
                 }
 
+                internalBackupService.cleanupBackupMetadata(vo.getVolumeId());
+
                 List<SnapshotDataStoreVO> snapStoreVOs = _snapshotStoreDao.listAllByVolumeAndDataStore(vo.getId(), DataStoreRole.Primary);
 
                 for (SnapshotDataStoreVO snapStoreVo : snapStoreVOs) {
@@ -1363,11 +1369,13 @@ private void createManagedVolumeCopyTemplateAsync(VolumeInfo volumeInfo, Primary
             primaryDataStore.setDetails(details);
 
             grantAccess(volumeInfo, destHost, primaryDataStore);
-            volumeInfo = volFactory.getVolume(volumeInfo.getId(), primaryDataStore);
-            // For Netapp ONTAP iscsiName or Lun path  is available only after grantAccess
-            String managedStoreTarget = ObjectUtils.defaultIfNull(volumeInfo.get_iScsiName(), volumeInfo.getUuid());
-            details.put(PrimaryDataStore.MANAGED_STORE_TARGET, managedStoreTarget);
-            primaryDataStore.setDetails(details);
+            if (DataStoreProvider.ONTAP_PLUGIN_NAME.equals(primaryDataStore.getStorageProviderName())) {
+                // For Netapp ONTAP iscsiName or Lun path  is available only after grantAccess
+                volumeInfo = volFactory.getVolume(volumeInfo.getId(), primaryDataStore);
+                String managedStoreTarget = ObjectUtils.defaultIfNull(volumeInfo.get_iScsiName(), volumeInfo.getUuid());
+                details.put(PrimaryDataStore.MANAGED_STORE_TARGET, managedStoreTarget);
+                primaryDataStore.setDetails(details);
+            }
 
             try {
                 motionSrv.copyAsync(srcTemplateInfo, destTemplateInfo, destHost, caller);
@@ -1696,7 +1704,7 @@ public void destroyVolume(long volumeId) {
 
         if (vol.getAttachedVM() == null || vol.getAttachedVM().getType() == VirtualMachine.Type.User) {
             // Decrement the resource count for volumes and primary storage belonging user VM's only
-            _resourceLimitMgr.decrementVolumeResourceCount(vol.getAccountId(), vol.isDisplay(), vol.getSize(), diskOfferingDao.findById(vol.getDiskOfferingId()));
+            _resourceLimitMgr.decrementVolumeResourceCount(vol.getAccountId(), vol.isDisplay(), vol.getSize(), diskOfferingDao.findById(vol.getDiskOfferingId()), null);
         }
     }
 
@@ -3118,6 +3126,12 @@ public boolean isLockTransferRequired(VolumeInfo volumeToAttach, StoragePoolType
         }
 
         if (volumePoolId == null || !volumePoolId.equals(vmPoolId)) {
+            Long volumeLockHostId = findVolumeLockHost(volumeToAttach);
+            if (volumeLockHostId != null && vmHostId != null && !volumeLockHostId.equals(vmHostId)) {
+                logger.info("CLVM cross-pool lock transfer required: Volume {} on pool {} lock is on host {} but VM is on host {}",
+                        volumeToAttach.getUuid(), volumePoolId, volumeLockHostId, vmHostId);
+                return true;
+            }
             return false;
         }
 
diff --git a/engine/storage/volume/src/test/java/org/apache/cloudstack/storage/volume/VolumeServiceImplClvmTest.java b/engine/storage/volume/src/test/java/org/apache/cloudstack/storage/volume/VolumeServiceImplClvmTest.java
index 38af2a7550b3..8d355263a6c3 100644
--- a/engine/storage/volume/src/test/java/org/apache/cloudstack/storage/volume/VolumeServiceImplClvmTest.java
+++ b/engine/storage/volume/src/test/java/org/apache/cloudstack/storage/volume/VolumeServiceImplClvmTest.java
@@ -167,14 +167,49 @@ public void testIsLockTransferRequired_NonCLVMPool() {
     }
 
     @Test
-    public void testIsLockTransferRequired_DifferentPools() {
+    public void testIsLockTransferRequired_DifferentPools_LockOnDifferentHost() {
+        when(volumeService.findVolumeLockHost(volumeInfoMock)).thenReturn(HOST_ID_2);
+
+        assertTrue(volumeService.isLockTransferRequired(
+                volumeInfoMock, StoragePoolType.CLVM, StoragePoolType.CLVM,
+                POOL_ID_1, POOL_ID_2, HOST_ID_1));
+    }
+
+    @Test
+    public void testIsLockTransferRequired_DifferentPools_LockOnSameHost() {
+        when(volumeService.findVolumeLockHost(volumeInfoMock)).thenReturn(HOST_ID_1);
+
+        assertFalse(volumeService.isLockTransferRequired(
+                volumeInfoMock, StoragePoolType.CLVM, StoragePoolType.CLVM,
+                POOL_ID_1, POOL_ID_2, HOST_ID_1));
+    }
+
+    @Test
+    public void testIsLockTransferRequired_DifferentPools_NoLockHost() {
+        when(volumeService.findVolumeLockHost(volumeInfoMock)).thenReturn(null);
+
         assertFalse(volumeService.isLockTransferRequired(
                 volumeInfoMock, StoragePoolType.CLVM, StoragePoolType.CLVM,
                 POOL_ID_1, POOL_ID_2, HOST_ID_1));
     }
 
     @Test
-    public void testIsLockTransferRequired_NullPoolIds() {
+    public void testIsLockTransferRequired_NullPoolIds_LockOnDifferentHost() {
+        when(volumeService.findVolumeLockHost(volumeInfoMock)).thenReturn(HOST_ID_2);
+
+        assertTrue(volumeService.isLockTransferRequired(
+                volumeInfoMock, StoragePoolType.CLVM, StoragePoolType.CLVM,
+                null, POOL_ID_1, HOST_ID_1));
+
+        assertTrue(volumeService.isLockTransferRequired(
+                volumeInfoMock, StoragePoolType.CLVM, StoragePoolType.CLVM,
+                POOL_ID_1, null, HOST_ID_1));
+    }
+
+    @Test
+    public void testIsLockTransferRequired_NullPoolIds_NoLockHost() {
+        when(volumeService.findVolumeLockHost(volumeInfoMock)).thenReturn(null);
+
         assertFalse(volumeService.isLockTransferRequired(
                 volumeInfoMock, StoragePoolType.CLVM, StoragePoolType.CLVM,
                 null, POOL_ID_1, HOST_ID_1));
diff --git a/framework/config/src/main/java/org/apache/cloudstack/framework/config/ConfigKey.java b/framework/config/src/main/java/org/apache/cloudstack/framework/config/ConfigKey.java
index ef50064050f8..fd007f12957b 100644
--- a/framework/config/src/main/java/org/apache/cloudstack/framework/config/ConfigKey.java
+++ b/framework/config/src/main/java/org/apache/cloudstack/framework/config/ConfigKey.java
@@ -269,6 +269,17 @@ public String toString() {
 
     private String _defaultValueIfEmpty = null;
 
+    private boolean _strictScope = false;
+
+    public boolean isStrictScope() {
+        return _strictScope;
+    }
+
+    public ConfigKey<T> withStrictScope() {
+        this._strictScope = true;
+        return this;
+    }
+
     public static void init(ConfigDepotImpl depot) {
         s_depot = depot;
     }
@@ -429,11 +440,18 @@ public T valueInDomain(Long domainId) {
     }
 
     public T valueInScope(Scope scope, Long id) {
+        return valueInScope(scope, id, false);
+    }
+
+    public T valueInScope(Scope scope, Long id, boolean strictScope) {
         if (id == null) {
-            return value();
+            return strictScope ? null : value();
         }
         String value = s_depot != null ? s_depot.getConfigStringValue(_name, scope, id) : null;
         if (value == null) {
+            if (strictScope) {
+                return null;
+            }
             return valueInGlobalOrAvailableParentScope(scope, id);
         }
         logger.trace("Scope({}) value for config ({}): {}", scope, _name, _value);
diff --git a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/api/ListExtensionsCmd.java b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/api/ListExtensionsCmd.java
index 4426f259380b..453578a95d75 100644
--- a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/api/ListExtensionsCmd.java
+++ b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/api/ListExtensionsCmd.java
@@ -70,6 +70,11 @@ public class ListExtensionsCmd extends BaseListCmd {
                     + " When no parameters are passed, all the details are returned.")
     private List<String> details;
 
+    @Parameter(name = ApiConstants.TYPE, type = CommandType.STRING,
+            description = "Type of the extension (e.g. Orchestrator, NetworkOrchestrator)",
+            since = "4.23.0")
+    private String type;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -82,6 +87,10 @@ public Long getExtensionId() {
         return extensionId;
     }
 
+    public String getType() {
+        return type;
+    }
+
     public EnumSet<ApiConstants.ExtensionDetails> getDetails() throws InvalidParameterValueException {
         if (CollectionUtils.isEmpty(details)) {
             return EnumSet.of(ApiConstants.ExtensionDetails.all);
diff --git a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/api/UpdateRegisteredExtensionCmd.java b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/api/UpdateRegisteredExtensionCmd.java
new file mode 100644
index 000000000000..6c755ecd1a54
--- /dev/null
+++ b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/api/UpdateRegisteredExtensionCmd.java
@@ -0,0 +1,116 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.framework.extensions.api;
+
+import java.util.EnumSet;
+import java.util.Map;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.ExtensionResponse;
+import org.apache.cloudstack.extension.Extension;
+import org.apache.cloudstack.framework.extensions.manager.ExtensionsManager;
+
+import com.cloud.user.Account;
+
+@APICommand(name = "updateRegisteredExtension",
+        description = "Update details for an extension registered with a resource",
+        responseObject = ExtensionResponse.class,
+        responseHasSensitiveInfo = false,
+        entityType = {Extension.class},
+        authorized = {RoleType.Admin},
+        since = "4.23.0")
+public class UpdateRegisteredExtensionCmd extends BaseCmd {
+
+    @Inject
+    ExtensionsManager extensionsManager;
+
+    @Parameter(name = ApiConstants.EXTENSION_ID, type = CommandType.UUID, required = true,
+            entityType = ExtensionResponse.class, description = "ID of the extension")
+    private Long extensionId;
+
+    @Parameter(name = ApiConstants.RESOURCE_ID, type = CommandType.STRING, required = true,
+            description = "ID of the resource where the extension is registered")
+    private String resourceId;
+
+    @Parameter(name = ApiConstants.RESOURCE_TYPE, type = CommandType.STRING, required = true,
+            description = "Type of the resource")
+    private String resourceType;
+
+    @Parameter(name = ApiConstants.DETAILS, type = CommandType.MAP,
+            description = "Details in key/value pairs using format details[i].keyname=keyvalue. Example: details[0].endpoint.url=urlvalue")
+    protected Map details;
+
+    @Parameter(name = ApiConstants.CLEAN_UP_DETAILS,
+            type = CommandType.BOOLEAN,
+            description = "Optional boolean field, which indicates if details should be cleaned up or not " +
+                    "(If set to true, details removed for this registration, details field ignored; " +
+                    "if false or not set, details can be updated through details map)")
+    private Boolean cleanupDetails;
+
+    public Long getExtensionId() {
+        return extensionId;
+    }
+
+    public String getResourceId() {
+        return resourceId;
+    }
+
+    public String getResourceType() {
+        return resourceType;
+    }
+
+    public Map<String, String> getDetails() {
+        return convertDetailsToMap(details);
+    }
+
+    public Boolean isCleanupDetails() {
+        return cleanupDetails;
+    }
+
+    @Override
+    public void execute() throws ServerApiException {
+        Extension extension = extensionsManager.updateRegisteredExtensionWithResource(this);
+        ExtensionResponse response = extensionsManager.createExtensionResponse(extension,
+                EnumSet.of(ApiConstants.ExtensionDetails.all));
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return Account.ACCOUNT_ID_SYSTEM;
+    }
+
+    @Override
+    public ApiCommandResourceType getApiResourceType() {
+        return ApiCommandResourceType.Extension;
+    }
+
+    @Override
+    public Long getApiResourceId() {
+        return getExtensionId();
+    }
+}
diff --git a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/dao/ExtensionDao.java b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/dao/ExtensionDao.java
index 3355457ed25b..9adb625b19ed 100644
--- a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/dao/ExtensionDao.java
+++ b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/dao/ExtensionDao.java
@@ -16,6 +16,9 @@
 // under the License.
 package org.apache.cloudstack.framework.extensions.dao;
 
+import java.util.List;
+
+import org.apache.cloudstack.extension.Extension;
 import org.apache.cloudstack.framework.extensions.vo.ExtensionVO;
 
 import com.cloud.utils.db.GenericDao;
@@ -23,4 +26,8 @@
 public interface ExtensionDao extends GenericDao<ExtensionVO, Long> {
 
     ExtensionVO findByName(String name);
+
+    List<ExtensionVO> listByType(Extension.Type type);
+
+    ExtensionVO findByNameAndType(String name, Extension.Type type);
 }
diff --git a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/dao/ExtensionDaoImpl.java b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/dao/ExtensionDaoImpl.java
index 8e17199de6ca..f3c3173585b2 100644
--- a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/dao/ExtensionDaoImpl.java
+++ b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/dao/ExtensionDaoImpl.java
@@ -17,6 +17,9 @@
 
 package org.apache.cloudstack.framework.extensions.dao;
 
+import java.util.List;
+
+import org.apache.cloudstack.extension.Extension;
 import org.apache.cloudstack.framework.extensions.vo.ExtensionVO;
 
 import com.cloud.utils.db.GenericDaoBase;
@@ -39,7 +42,21 @@ public ExtensionDaoImpl() {
     public ExtensionVO findByName(String name) {
         SearchCriteria<ExtensionVO> sc = AllFieldSearch.create();
         sc.setParameters("name", name);
+        return findOneBy(sc);
+    }
+
+    @Override
+    public List<ExtensionVO> listByType(Extension.Type type) {
+        SearchCriteria<ExtensionVO> sc = AllFieldSearch.create();
+        sc.setParameters("type", type);
+        return listBy(sc);
+    }
 
+    @Override
+    public ExtensionVO findByNameAndType(String name, Extension.Type type) {
+        SearchCriteria<ExtensionVO> sc = AllFieldSearch.create();
+        sc.setParameters("name", name);
+        sc.setParameters("type", type);
         return findOneBy(sc);
     }
 }
diff --git a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/dao/ExtensionResourceMapDao.java b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/dao/ExtensionResourceMapDao.java
index 930ef8675531..b9fadb76d068 100644
--- a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/dao/ExtensionResourceMapDao.java
+++ b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/dao/ExtensionResourceMapDao.java
@@ -28,5 +28,9 @@ public interface ExtensionResourceMapDao extends GenericDao<ExtensionResourceMap
 
     ExtensionResourceMapVO findByResourceIdAndType(long resourceId, ExtensionResourceMap.ResourceType resourceType);
 
-    List<Long> listResourceIdsByExtensionIdAndType(long extensionId,ExtensionResourceMap.ResourceType resourceType);
+    ExtensionResourceMapVO findResourceByExtensionIdAndResourceIdAndType(long extensionId, long resourceId, ExtensionResourceMap.ResourceType resourceType);
+
+    List<Long> listResourceIdsByExtensionIdAndType(long extensionId, ExtensionResourceMap.ResourceType resourceType);
+
+    List<Long> listResourceIdsByType(ExtensionResourceMap.ResourceType resourceType);
 }
diff --git a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/dao/ExtensionResourceMapDaoImpl.java b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/dao/ExtensionResourceMapDaoImpl.java
index 6f19ef8b8b66..11c64e15cd21 100644
--- a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/dao/ExtensionResourceMapDaoImpl.java
+++ b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/dao/ExtensionResourceMapDaoImpl.java
@@ -55,6 +55,17 @@ public ExtensionResourceMapVO findByResourceIdAndType(long resourceId,
         return findOneBy(sc);
     }
 
+
+    @Override
+    public ExtensionResourceMapVO findResourceByExtensionIdAndResourceIdAndType(long extensionId, long resourceId,
+              ExtensionResourceMap.ResourceType resourceType) {
+        SearchCriteria<ExtensionResourceMapVO> sc = genericSearch.create();
+        sc.setParameters("extensionId", extensionId);
+        sc.setParameters("resourceId", resourceId);
+        sc.setParameters("resourceType", resourceType);
+        return findOneBy(sc);
+    }
+
     @Override
     public List<Long> listResourceIdsByExtensionIdAndType(long extensionId, ExtensionResourceMap.ResourceType resourceType) {
         GenericSearchBuilder<ExtensionResourceMapVO, Long> sb = createSearchBuilder(Long.class);
@@ -67,4 +78,15 @@ public List<Long> listResourceIdsByExtensionIdAndType(long extensionId, Extensio
         sc.setParameters("resourceType", resourceType);
         return customSearch(sc, null);
     }
+
+    @Override
+    public List<Long> listResourceIdsByType(ExtensionResourceMap.ResourceType resourceType) {
+        GenericSearchBuilder<ExtensionResourceMapVO, Long> sb = createSearchBuilder(Long.class);
+        sb.selectFields(sb.entity().getResourceId());
+        sb.and("resourceType", sb.entity().getResourceType(), SearchCriteria.Op.EQ);
+        sb.done();
+        SearchCriteria<Long> sc = sb.create();
+        sc.setParameters("resourceType", resourceType);
+        return customSearch(sc, null);
+    }
 }
diff --git a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/manager/ExtensionsManager.java b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/manager/ExtensionsManager.java
index 1b1a175c5975..cd033badff15 100644
--- a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/manager/ExtensionsManager.java
+++ b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/manager/ExtensionsManager.java
@@ -42,6 +42,7 @@
 import org.apache.cloudstack.framework.extensions.api.UnregisterExtensionCmd;
 import org.apache.cloudstack.framework.extensions.api.UpdateCustomActionCmd;
 import org.apache.cloudstack.framework.extensions.api.UpdateExtensionCmd;
+import org.apache.cloudstack.framework.extensions.api.UpdateRegisteredExtensionCmd;
 import org.apache.cloudstack.framework.extensions.command.ExtensionServerActionBaseCommand;
 
 import com.cloud.agent.api.Answer;
@@ -65,6 +66,8 @@ public interface ExtensionsManager extends Manager {
 
     Extension unregisterExtensionWithResource(UnregisterExtensionCmd cmd);
 
+    Extension updateRegisteredExtensionWithResource(UpdateRegisteredExtensionCmd cmd);
+
     Extension updateExtension(UpdateExtensionCmd cmd);
 
     Extension registerExtensionWithResource(RegisterExtensionCmd cmd);
diff --git a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/manager/ExtensionsManagerImpl.java b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/manager/ExtensionsManagerImpl.java
index f6fd08b6da2c..a209acf6442e 100644
--- a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/manager/ExtensionsManagerImpl.java
+++ b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/manager/ExtensionsManagerImpl.java
@@ -61,6 +61,7 @@
 import org.apache.cloudstack.extension.Extension;
 import org.apache.cloudstack.extension.ExtensionCustomAction;
 import org.apache.cloudstack.extension.ExtensionHelper;
+import org.apache.cloudstack.extension.NetworkCustomActionProvider;
 import org.apache.cloudstack.extension.ExtensionResourceMap;
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.framework.config.Configurable;
@@ -75,6 +76,7 @@
 import org.apache.cloudstack.framework.extensions.api.UnregisterExtensionCmd;
 import org.apache.cloudstack.framework.extensions.api.UpdateCustomActionCmd;
 import org.apache.cloudstack.framework.extensions.api.UpdateExtensionCmd;
+import org.apache.cloudstack.framework.extensions.api.UpdateRegisteredExtensionCmd;
 import org.apache.cloudstack.framework.extensions.command.CleanupExtensionFilesCommand;
 import org.apache.cloudstack.framework.extensions.command.ExtensionRoutingUpdateCommand;
 import org.apache.cloudstack.framework.extensions.command.ExtensionServerActionBaseCommand;
@@ -120,11 +122,27 @@
 import com.cloud.exception.InvalidParameterValueException;
 import com.cloud.exception.OperationTimedoutException;
 import com.cloud.host.Host;
-import com.cloud.host.HostVO;
 import com.cloud.host.dao.HostDao;
 import com.cloud.host.dao.HostDetailsDao;
 import com.cloud.hypervisor.ExternalProvisioner;
 import com.cloud.hypervisor.Hypervisor;
+import com.cloud.network.Network;
+import com.cloud.network.Network.Capability;
+import com.cloud.network.Network.Service;
+import com.cloud.network.NetworkModel;
+import com.cloud.network.PhysicalNetworkServiceProvider;
+import com.cloud.network.dao.NetworkDao;
+import com.cloud.network.dao.NetworkServiceMapDao;
+import com.cloud.network.dao.NetworkVO;
+import com.cloud.network.dao.PhysicalNetworkServiceProviderDao;
+import com.cloud.network.dao.PhysicalNetworkServiceProviderVO;
+import com.cloud.network.element.NetworkElement;
+import com.cloud.network.dao.PhysicalNetworkDao;
+import com.cloud.network.dao.PhysicalNetworkVO;
+import com.cloud.network.vpc.Vpc;
+import com.cloud.network.vpc.dao.VpcOfferingServiceMapDao;
+import com.cloud.network.vpc.dao.VpcServiceMapDao;
+import com.cloud.offerings.dao.NetworkOfferingServiceMapDao;
 import com.cloud.org.Cluster;
 import com.cloud.serializer.GsonHelper;
 import com.cloud.storage.dao.VMTemplateDao;
@@ -141,13 +159,15 @@
 import com.cloud.utils.db.SearchCriteria;
 import com.cloud.utils.db.Transaction;
 import com.cloud.utils.db.TransactionCallbackWithException;
+import com.google.gson.JsonElement;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
 import com.cloud.utils.exception.CloudRuntimeException;
 import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.VirtualMachineManager;
 import com.cloud.vm.VirtualMachineProfile;
 import com.cloud.vm.VirtualMachineProfileImpl;
 import com.cloud.vm.VmDetailConstants;
-import com.cloud.vm.dao.VMInstanceDao;
 
 public class ExtensionsManagerImpl extends ManagerBase implements ExtensionsManager, ExtensionHelper, PluggableService, Configurable {
 
@@ -171,6 +191,12 @@ public class ExtensionsManagerImpl extends ManagerBase implements ExtensionsMana
     @Inject
     ClusterDao clusterDao;
 
+    @Inject
+    PhysicalNetworkDao physicalNetworkDao;
+
+    @Inject
+    PhysicalNetworkServiceProviderDao physicalNetworkServiceProviderDao;
+
     @Inject
     AgentManager agentMgr;
 
@@ -189,9 +215,6 @@ public class ExtensionsManagerImpl extends ManagerBase implements ExtensionsMana
     @Inject
     ExtensionCustomActionDetailsDao extensionCustomActionDetailsDao;
 
-    @Inject
-    VMInstanceDao vmInstanceDao;
-
     @Inject
     VirtualMachineManager virtualMachineManager;
 
@@ -210,6 +233,24 @@ public class ExtensionsManagerImpl extends ManagerBase implements ExtensionsMana
     @Inject
     VMTemplateDao templateDao;
 
+    @Inject
+    NetworkDao networkDao;
+
+    @Inject
+    NetworkServiceMapDao networkServiceMapDao;
+
+    @Inject
+    VpcServiceMapDao vpcServiceMapDao;
+
+    @Inject
+    NetworkOfferingServiceMapDao networkOfferingServiceMapDao;
+
+    @Inject
+    VpcOfferingServiceMapDao vpcOfferingServiceMapDao;
+
+    @Inject
+    NetworkModel networkModel;
+
     @Inject
     RoleService roleService;
 
@@ -249,7 +290,7 @@ protected String getValidatedExtensionRelativePath(String name, String relativeP
 
     protected Pair<Boolean, String> getResultFromAnswersString(String answersStr, Extension extension,
                    ManagementServerHostVO msHost, String op) {
-        Answer[] answers = null;
+        Answer[] answers;
         try {
             answers = GsonHelper.getGson().fromJson(answersStr, Answer[].class);
         } catch (Exception e) {
@@ -339,6 +380,39 @@ protected Pair<Boolean, String> getChecksumForExtensionPathOnMSPeer(Extension ex
         return getResultFromAnswersString(answersStr, extension, msHost, "get path checksum");
     }
 
+    protected List<ExtensionResourceMapDetailsVO> buildExtensionResourceDetailsArray(long extensionResourceMapId,
+            Map<String, String> details) {
+        List<ExtensionResourceMapDetailsVO> detailsList = new ArrayList<>();
+        if (MapUtils.isEmpty(details)) {
+            return detailsList;
+        }
+        for (Map.Entry<String, String> entry : details.entrySet()) {
+            boolean display = !SENSITIVE_DETAIL_KEYS.contains(entry.getKey().toLowerCase());
+            detailsList.add(new ExtensionResourceMapDetailsVO(extensionResourceMapId, entry.getKey(),
+                    entry.getValue(), display));
+        }
+        return detailsList;
+    }
+
+    protected void appendHiddenExtensionResourceDetails(long extensionResourceMapId,
+            List<ExtensionResourceMapDetailsVO> detailsList) {
+        if (CollectionUtils.isEmpty(detailsList)) {
+            return;
+        }
+        Map<String, String> hiddenDetails = extensionResourceMapDetailsDao.listDetailsKeyPairs(extensionResourceMapId, false);
+        if (MapUtils.isEmpty(hiddenDetails)) {
+            return;
+        }
+        Set<String> requestedKeys = detailsList.stream()
+                .map(ExtensionResourceMapDetailsVO::getName)
+                .collect(Collectors.toSet());
+        hiddenDetails.forEach((key, value) -> {
+            if (!requestedKeys.contains(key)) {
+                detailsList.add(new ExtensionResourceMapDetailsVO(extensionResourceMapId, key, value, false));
+            }
+        });
+    }
+
     protected List<ExtensionCustomAction.Parameter> getParametersListFromMap(String actionName, Map parametersMap) {
         if (MapUtils.isEmpty(parametersMap)) {
             return Collections.emptyList();
@@ -360,26 +434,48 @@ protected void unregisterExtensionWithCluster(String clusterUuid, Long extension
         unregisterExtensionWithCluster(cluster, extensionId);
     }
 
-    protected Extension getExtensionFromResource(ExtensionCustomAction.ResourceType resourceType, String resourceUuid) {
+    protected Extension getExtensionWithCustomActionFromResource(ExtensionCustomAction.ResourceType resourceType, String resourceUuid) {
         Object object = entityManager.findByUuid(resourceType.getAssociatedClass(), resourceUuid);
         if (object == null) {
             return null;
         }
-        Long clusterId = null;
-        if (resourceType == ExtensionCustomAction.ResourceType.VirtualMachine) {
+        if (ExtensionCustomAction.ResourceType.VirtualMachine.equals(resourceType)) {
             VirtualMachine vm = (VirtualMachine) object;
             Pair<Long, Long> clusterHostId = virtualMachineManager.findClusterAndHostIdForVm(vm, false);
-            clusterId = clusterHostId.first();
-        }
-        if (clusterId == null) {
+            Long clusterId = clusterHostId.first();
+            if (clusterId == null) {
+                return null;
+            }
+            ExtensionResourceMapVO mapVO =
+                    extensionResourceMapDao.findByResourceIdAndType(clusterId, ExtensionResourceMap.ResourceType.Cluster);
+            if (mapVO == null) {
+                return null;
+            }
+            return extensionDao.findById(mapVO.getExtensionId());
+        } else if (ExtensionCustomAction.ResourceType.Network.equals(resourceType)) {
+            Network network = (Network) object;
+            Long physicalNetworkId = network.getPhysicalNetworkId();
+            if (physicalNetworkId == null) {
+                return null;
+            }
+            // Use provider-based lookup: match the network's service-map providers
+            // against extension names registered on the physical network.
+            // This correctly handles multiple different extensions on the same physical network.
+            String providerName = networkServiceMapDao.getProviderForServiceInNetwork(network.getId(), Service.CustomAction);
+            if (providerName != null) {
+                return getExtensionForPhysicalNetworkAndProvider(physicalNetworkId, providerName);
+            }
             return null;
-        }
-        ExtensionResourceMapVO mapVO =
-                extensionResourceMapDao.findByResourceIdAndType(clusterId, ExtensionResourceMap.ResourceType.Cluster);
-        if (mapVO == null) {
+        } else if (ExtensionCustomAction.ResourceType.Vpc.equals(resourceType)) {
+            Vpc vpc = (Vpc) object;
+            // Find extension via the VPC's CustomAction service provider
+            String providerName = vpcServiceMapDao.getProviderForServiceInVpc(vpc.getId(), Service.CustomAction);
+            if (providerName != null) {
+                return extensionDao.findByNameAndType(providerName, Extension.Type.NetworkOrchestrator);
+            }
             return null;
         }
-        return extensionDao.findById(mapVO.getExtensionId());
+        return null;
     }
 
     protected String getActionMessage(boolean success, ExtensionCustomAction action, Extension extension,
@@ -694,12 +790,16 @@ public List<ExtensionResponse> listExtensions(ListExtensionsCmd cmd) {
         Long id = cmd.getExtensionId();
         String name = cmd.getName();
         String keyword = cmd.getKeyword();
+        String typeStr = cmd.getType();
+
         final SearchBuilder<ExtensionVO> sb = extensionDao.createSearchBuilder();
         final Filter searchFilter = new Filter(ExtensionVO.class, "id", false, cmd.getStartIndex(), cmd.getPageSizeVal());
 
         sb.and("id", sb.entity().getId(), SearchCriteria.Op.EQ);
         sb.and("name", sb.entity().getName(), SearchCriteria.Op.EQ);
         sb.and("keyword", sb.entity().getName(), SearchCriteria.Op.LIKE);
+        sb.and("type", sb.entity().getType(), SearchCriteria.Op.EQ);
+        sb.done();
         final SearchCriteria<ExtensionVO> sc = sb.create();
 
         if (id != null) {
@@ -714,6 +814,14 @@ public List<ExtensionResponse> listExtensions(ListExtensionsCmd cmd) {
             sc.setParameters("keyword",  "%" + keyword + "%");
         }
 
+        if (typeStr != null) {
+            Extension.Type type = EnumUtils.getEnum(Extension.Type.class, typeStr);
+            if (type == null) {
+                throw new InvalidParameterValueException("Invalid type: " + typeStr);
+            }
+            sc.setParameters("type", type);
+        }
+
         final Pair<List<ExtensionVO>, Integer> result = extensionDao.searchAndCount(sc, searchFilter);
         List<ExtensionResponse> responses = new ArrayList<>();
         for (ExtensionVO extension : result.first()) {
@@ -757,6 +865,8 @@ public Extension updateExtension(UpdateExtensionCmd cmd) {
             }
         }
         final boolean updateNeededFinal = updateNeeded;
+        final Set<Service> oldNetworkServices = Extension.Type.NetworkOrchestrator.equals(extensionVO.getType()) ?
+                resolveExtensionServices(extensionVO) : Collections.emptySet();
         ExtensionVO result = Transaction.execute((TransactionCallbackWithException<ExtensionVO, CloudRuntimeException>) status -> {
             if (updateNeededFinal && !extensionDao.update(id, extensionVO)) {
                 throw new CloudRuntimeException(String.format("Failed to updated the extension: %s",
@@ -764,6 +874,13 @@ public Extension updateExtension(UpdateExtensionCmd cmd) {
             }
             updateExtensionsDetails(cleanupDetails, details, orchestratorRequiresPrepareVm, reservedResourceDetails,
                     id);
+            if (Extension.Type.NetworkOrchestrator.equals(extensionVO.getType())) {
+                Set<Service> newNetworkServices = resolveExtensionServices(extensionVO);
+                if (!newNetworkServices.equals(oldNetworkServices)) {
+                    updateNetworkExtensionServicesOnPhysicalNetworks(extensionVO, oldNetworkServices,
+                            newNetworkServices);
+                }
+            }
             return extensionVO;
         });
         if (StringUtils.isNotBlank(stateStr)) {
@@ -880,19 +997,88 @@ public Extension registerExtensionWithResource(RegisterExtensionCmd cmd) {
         String resourceType = cmd.getResourceType();
         if (!EnumUtils.isValidEnum(ExtensionResourceMap.ResourceType.class, resourceType)) {
             throw new InvalidParameterValueException(
-                    String.format("Currently only [%s] can be used to register an extension of type Orchestrator",
+                    String.format("Currently only [%s] can be used to register an extension",
                             EnumSet.allOf(ExtensionResourceMap.ResourceType.class)));
         }
-        ClusterVO clusterVO = clusterDao.findByUuid(resourceId);
-        if (clusterVO == null) {
-            throw new InvalidParameterValueException("Invalid cluster ID specified");
+        ExtensionVO extension = extensionDao.findById(extensionId);
+        if (extension == null) {
+            throw new InvalidParameterValueException("Invalid extension specified");
+        }
+        ExtensionResourceMap.ResourceType resType = EnumUtils.getEnum(ExtensionResourceMap.ResourceType.class, resourceType);
+        if (ExtensionResourceMap.ResourceType.PhysicalNetwork.equals(resType)) {
+            PhysicalNetworkVO physicalNetwork = physicalNetworkDao.findByUuid(resourceId);
+            if (physicalNetwork == null) {
+                throw new InvalidParameterValueException("Invalid physical network ID specified");
+            }
+            ExtensionResourceMap extensionResourceMap = registerExtensionWithPhysicalNetwork(physicalNetwork, extension, cmd.getDetails());
+            return extensionDao.findById(extensionResourceMap.getExtensionId());
+        } else if (ExtensionResourceMap.ResourceType.Cluster.equals(resType)) {
+            ClusterVO clusterVO = clusterDao.findByUuid(resourceId);
+            if (clusterVO == null) {
+                throw new InvalidParameterValueException("Invalid cluster ID specified");
+            }
+            ExtensionResourceMap extensionResourceMap = registerExtensionWithCluster(clusterVO, extension, cmd.getDetails());
+            return extensionDao.findById(extensionResourceMap.getExtensionId());
+        } else {
+            throw new InvalidParameterValueException("Unsupported resource type specified");
+        }
+    }
+
+    @Override
+    @ActionEvent(eventType = EventTypes.EVENT_EXTENSION_RESOURCE_UPDATE, eventDescription = "updating extension resource")
+    public Extension updateRegisteredExtensionWithResource(UpdateRegisteredExtensionCmd cmd) {
+        final String resourceId = cmd.getResourceId();
+        final Long extensionId = cmd.getExtensionId();
+        final String resourceType = cmd.getResourceType();
+        final Map<String, String> details = cmd.getDetails();
+        final Boolean cleanupDetails = cmd.isCleanupDetails();
+
+        if (!EnumUtils.isValidEnum(ExtensionResourceMap.ResourceType.class, resourceType)) {
+            throw new InvalidParameterValueException(
+                    String.format("Currently only [%s] can be used to update an extension registration",
+                            EnumSet.allOf(ExtensionResourceMap.ResourceType.class)));
         }
         ExtensionVO extension = extensionDao.findById(extensionId);
         if (extension == null) {
             throw new InvalidParameterValueException("Invalid extension specified");
         }
-        ExtensionResourceMap extensionResourceMap = registerExtensionWithCluster(clusterVO, extension, cmd.getDetails());
-        return extensionDao.findById(extensionResourceMap.getExtensionId());
+
+        ExtensionResourceMap.ResourceType resType = EnumUtils.getEnum(ExtensionResourceMap.ResourceType.class, resourceType);
+        long resolvedResourceId;
+        if (ExtensionResourceMap.ResourceType.PhysicalNetwork.equals(resType)) {
+            PhysicalNetworkVO physicalNetwork = physicalNetworkDao.findByUuid(resourceId);
+            if (physicalNetwork == null) {
+                throw new InvalidParameterValueException("Invalid physical network ID specified");
+            }
+            resolvedResourceId = physicalNetwork.getId();
+        } else {
+            ClusterVO clusterVO = clusterDao.findByUuid(resourceId);
+            if (clusterVO == null) {
+                throw new InvalidParameterValueException("Invalid cluster ID specified");
+            }
+            resolvedResourceId = clusterVO.getId();
+        }
+
+        ExtensionResourceMapVO targetMapping = extensionResourceMapDao.findResourceByExtensionIdAndResourceIdAndType(
+                extensionId, resolvedResourceId, resType);
+        if (targetMapping == null) {
+            throw new InvalidParameterValueException(String.format(
+                    "Extension '%s' is not registered with resource %s (%s)",
+                    extension.getName(), resourceId, resourceType));
+        }
+
+        if (Boolean.TRUE.equals(cleanupDetails)) {
+            extensionResourceMapDetailsDao.removeDetails(targetMapping.getId());
+        } else if (MapUtils.isNotEmpty(details)) {
+            List<ExtensionResourceMapDetailsVO> detailsList = buildExtensionResourceDetailsArray(targetMapping.getId(), details);
+            appendHiddenExtensionResourceDetails(targetMapping.getId(), detailsList);
+            detailsList = detailsList.stream()
+                    .filter(detail -> detail.getValue() != null)
+                    .collect(Collectors.toList());
+            extensionResourceMapDetailsDao.saveDetails(detailsList);
+        }
+
+        return extensionDao.findById(extensionId);
     }
 
     @Override
@@ -923,8 +1109,9 @@ public ExtensionResourceMap registerExtensionWithCluster(Cluster cluster, Extens
             List<ExtensionResourceMapDetailsVO> detailsVOList = new ArrayList<>();
             if (MapUtils.isNotEmpty(details)) {
                 for (Map.Entry<String, String> entry : details.entrySet()) {
+                    boolean display = !SENSITIVE_DETAIL_KEYS.contains(entry.getKey().toLowerCase());
                     detailsVOList.add(new ExtensionResourceMapDetailsVO(savedExtensionMap.getId(),
-                            entry.getKey(), entry.getValue()));
+                            entry.getKey(), entry.getValue(), display));
                 }
                 extensionResourceMapDetailsDao.saveDetails(detailsVOList);
             }
@@ -934,6 +1121,227 @@ public ExtensionResourceMap registerExtensionWithCluster(Cluster cluster, Extens
         return result;
     }
 
+    protected ExtensionResourceMap registerExtensionWithPhysicalNetwork(PhysicalNetworkVO physicalNetwork,
+                  Extension extension, Map<String, String> details) {
+        // Only NetworkOrchestrator extensions can be registered with physical networks
+        if (!Extension.Type.NetworkOrchestrator.equals(extension.getType())) {
+            throw new InvalidParameterValueException(String.format(
+                    "Only extensions of type %s can be registered with a physical network. "
+                    + "Extension '%s' is of type %s.",
+                    Extension.Type.NetworkOrchestrator.name(),
+                    extension.getName(), extension.getType().name()));
+        }
+
+        // Block registering the exact same extension twice on the same physical network
+        final ExtensionResourceMap.ResourceType resourceType = ExtensionResourceMap.ResourceType.PhysicalNetwork;
+        ExtensionResourceMapVO existing = extensionResourceMapDao.findResourceByExtensionIdAndResourceIdAndType(
+                extension.getId(), physicalNetwork.getId(), resourceType);
+        if (existing != null) {
+            throw new CloudRuntimeException(String.format(
+                    "Extension '%s' is already registered with physical network %s",
+                    extension.getName(), physicalNetwork));
+        }
+
+        // Resolve which services this extension provides from its network.services detail
+        Set<Service> services = resolveExtensionServices(extension);
+
+        return Transaction.execute((TransactionCallbackWithException<ExtensionResourceMap, CloudRuntimeException>) status -> {
+            // 1. Persist the extension<->physical-network mapping
+            ExtensionResourceMapVO extensionMap = new ExtensionResourceMapVO(extension.getId(),
+                    physicalNetwork.getId(), resourceType);
+            ExtensionResourceMapVO savedExtensionMap = extensionResourceMapDao.persist(extensionMap);
+
+            // 2. Persist device credentials / details
+            List<ExtensionResourceMapDetailsVO> detailsVOList = new ArrayList<>();
+            if (MapUtils.isNotEmpty(details)) {
+                for (Map.Entry<String, String> entry : details.entrySet()) {
+                    boolean display = !SENSITIVE_DETAIL_KEYS.contains(entry.getKey().toLowerCase());
+                    detailsVOList.add(new ExtensionResourceMapDetailsVO(savedExtensionMap.getId(),
+                            entry.getKey(), entry.getValue(), display));
+                }
+                extensionResourceMapDetailsDao.saveDetails(detailsVOList);
+            }
+
+            // 3. Auto-create the NetworkServiceProvider entry for this extension so that
+            //    the services are visible in the UI and in listSupportedNetworkServices.
+            //    The NSP name equals the extension name; state is Enabled by default.
+            PhysicalNetworkServiceProviderVO existingNsp =
+                    physicalNetworkServiceProviderDao.findByServiceProvider(
+                            physicalNetwork.getId(), extension.getName());
+            if (existingNsp == null) {
+                PhysicalNetworkServiceProviderVO nsp =
+                        new PhysicalNetworkServiceProviderVO(physicalNetwork.getId(), extension.getName());
+                applyServicesToNsp(nsp, services);
+                nsp.setState(PhysicalNetworkServiceProvider.State.Enabled);
+                physicalNetworkServiceProviderDao.persist(nsp);
+                logger.info("Auto-created NetworkServiceProvider '{}' (Enabled) for physical network {} "
+                        + "with services {}", extension, physicalNetwork, services);
+            }
+
+            return savedExtensionMap;
+        });
+    }
+
+    /**
+     * Resolves the set of network service names declared in the extension's
+     * {@code network.services} detail. Falls back to an empty set if not present
+     */
+    private Set<Service> resolveExtensionServices(Extension extension) {
+        Map<String, String> extDetails = extensionDetailsDao.listDetailsKeyPairs(extension.getId());
+        Set<Service> parsed = parseNetworkServicesFromDetailKeys(extDetails);
+        if (!parsed.isEmpty()) {
+            return parsed;
+        }
+        // Falls back to an empty set if not present
+        return new HashSet<>();
+    }
+
+    /**
+     * Resolves the set of service names from the extension detail map.
+     * From {@code network.services} comma-separated key.
+     */
+    private Set<Service> parseNetworkServicesFromDetailKeys(Map<String, String> extDetails) {
+        if (extDetails == null) {
+            return Collections.emptySet();
+        }
+        // New format: "network.services" = "SourceNat,StaticNat,..."
+        if (extDetails.containsKey(ExtensionHelper.NETWORK_SERVICES_DETAIL_KEY)) {
+            String value = extDetails.get(ExtensionHelper.NETWORK_SERVICES_DETAIL_KEY);
+            if (StringUtils.isNotBlank(value)) {
+                Set<Service> services = new HashSet<>();
+                for (String s : value.split(",")) {
+                    Service service = Network.Service.getService(s.trim());
+                    if (service != null) {
+                        services.add(service);
+                    }
+                }
+                if (!services.isEmpty()) {
+                    return services;
+                }
+            }
+        }
+
+        return Collections.emptySet();
+    }
+
+    /**
+     * Builds a full {@code Map<Service, Map<Capability, String>>} from the
+     * extension detail map.  From the split keys
+     * {@code network.services} + {@code network.service.capabilities}.
+     */
+    private Map<Service, Map<Capability, String>> buildCapabilitiesFromDetailKeys(
+            Map<String, String> extDetails) {
+        if (extDetails == null) {
+            return new HashMap<>();
+        }
+        // New split format
+        if (extDetails.containsKey(ExtensionHelper.NETWORK_SERVICES_DETAIL_KEY)) {
+            Set<Service> serviceNames = parseNetworkServicesFromDetailKeys(extDetails);
+            if (!serviceNames.isEmpty()) {
+                JsonObject capsObj = null;
+                if (extDetails.containsKey(ExtensionHelper.NETWORK_SERVICE_CAPABILITIES_DETAIL_KEY)) {
+                    try {
+                        capsObj = JsonParser.parseString(
+                                extDetails.get(ExtensionHelper.NETWORK_SERVICE_CAPABILITIES_DETAIL_KEY))
+                                .getAsJsonObject();
+                    } catch (Exception e) {
+                        logger.warn("Failed to parse network.service.capabilities JSON: {}", e.getMessage());
+                    }
+                }
+                Map<Service, Map<Capability, String>> result = new HashMap<>();
+                for (Service service : serviceNames) {
+                    Map<Capability, String> capMap = new HashMap<>();
+                    if (capsObj != null && capsObj.has(service.getName())) {
+                        JsonObject svcCaps = capsObj.getAsJsonObject(service.getName());
+                        for (Map.Entry<String, JsonElement> entry : svcCaps.entrySet()) {
+                            Capability cap = Capability.getCapability(entry.getKey());
+                            if (cap != null) {
+                                capMap.put(cap, entry.getValue().getAsString());
+                            }
+                        }
+                    }
+                    result.put(service, capMap);
+                }
+                return result;
+            }
+        }
+
+        return new HashMap<>();
+    }
+
+    /**
+     * Sets the boolean service-provided flags on a {@link PhysicalNetworkServiceProviderVO}
+     * based on a set of service names.
+     */
+    private void applyServicesToNsp(PhysicalNetworkServiceProviderVO nsp, Set<Service> services) {
+        nsp.setSourcenatServiceProvided(services.contains(Service.SourceNat));
+        nsp.setStaticnatServiceProvided(services.contains(Service.StaticNat));
+        nsp.setPortForwardingServiceProvided(services.contains(Service.PortForwarding));
+        nsp.setFirewallServiceProvided(services.contains(Service.Firewall));
+        nsp.setGatewayServiceProvided(services.contains(Service.Gateway));
+        nsp.setDnsServiceProvided(services.contains(Service.Dns));
+        nsp.setDhcpServiceProvided(services.contains(Service.Dhcp));
+        nsp.setUserdataServiceProvided(services.contains(Service.UserData));
+        nsp.setLbServiceProvided(services.contains(Service.Lb));
+        nsp.setVpnServiceProvided(services.contains(Service.Vpn));
+        nsp.setSecuritygroupServiceProvided(services.contains(Service.SecurityGroup));
+        nsp.setNetworkAclServiceProvided(services.contains(Service.NetworkACL));
+        nsp.setCustomActionServiceProvided(services.contains(Service.CustomAction));
+    }
+
+    /**
+     * Propagates a change in the set of network services declared by a NetworkOrchestrator
+     * extension to every physical network the extension is registered with. A service that is
+     * still referenced by a network or VPC offering (i.e. the extension is configured as the
+     * provider for that service) cannot be removed. Otherwise, every physical network's provider
+     * is updated to add newly declared services and drop services that are no longer declared.
+     */
+    protected void updateNetworkExtensionServicesOnPhysicalNetworks(ExtensionVO extension,
+              Set<Service> oldServices, Set<Service> newServices) {
+        Set<Service> removedServices = new HashSet<>(oldServices);
+        removedServices.removeAll(newServices);
+        Set<Service> addedServices = new HashSet<>(newServices);
+        addedServices.removeAll(oldServices);
+        if (removedServices.isEmpty() && addedServices.isEmpty()) {
+            return;
+        }
+        for (Service removedService : removedServices) {
+            boolean usedByNetworkOffering = CollectionUtils.isNotEmpty(
+                    networkOfferingServiceMapDao.listOfferingIdsByServiceAndProvider(removedService, extension.getName()));
+            boolean usedByVpcOffering = CollectionUtils.isNotEmpty(
+                    vpcOfferingServiceMapDao.listOfferingIdsByServiceAndProvider(removedService, extension.getName()));
+            if (usedByNetworkOffering || usedByVpcOffering) {
+                throw new CloudRuntimeException(String.format(
+                        "Cannot remove service %s from extension '%s' as it is used by a network/VPC offering",
+                        removedService.getName(), extension.getName()));
+            }
+        }
+        List<Long> physicalNetworkIds = extensionResourceMapDao.listResourceIdsByExtensionIdAndType(
+                extension.getId(), ExtensionResourceMap.ResourceType.PhysicalNetwork);
+        for (Long physicalNetworkId : physicalNetworkIds) {
+            PhysicalNetworkServiceProviderVO nsp = physicalNetworkServiceProviderDao.findByServiceProvider(
+                    physicalNetworkId, extension.getName());
+            if (nsp == null) {
+                continue;
+            }
+            List<Service> enabledServices = new ArrayList<>(nsp.getEnabledServices());
+            enabledServices.removeAll(removedServices);
+            for (Service addedService : addedServices) {
+                if (!enabledServices.contains(addedService)) {
+                    enabledServices.add(addedService);
+                }
+            }
+            nsp.setEnabledServices(enabledServices);
+            physicalNetworkServiceProviderDao.update(nsp.getId(), nsp);
+            logger.info("Updated NetworkServiceProvider '{}' on physical network {} with services {}",
+                    extension, physicalNetworkId, enabledServices);
+        }
+    }
+
+    /** Keys that are always stored with display=false (sensitive). */
+    private static final Set<String> SENSITIVE_DETAIL_KEYS =
+            Set.of("password", "sshkey");
+
     @Override
     @ActionEvent(eventType = EventTypes.EVENT_EXTENSION_RESOURCE_UNREGISTER, eventDescription = "unregistering extension resource")
     public Extension unregisterExtensionWithResource(UnregisterExtensionCmd cmd) {
@@ -942,10 +1350,15 @@ public Extension unregisterExtensionWithResource(UnregisterExtensionCmd cmd) {
         final String resourceType = cmd.getResourceType();
         if (!EnumUtils.isValidEnum(ExtensionResourceMap.ResourceType.class, resourceType)) {
             throw new InvalidParameterValueException(
-                    String.format("Currently only [%s] can be used to unregister an extension of type Orchestrator",
+                    String.format("Currently only [%s] can be used to unregister an extension",
                             EnumSet.allOf(ExtensionResourceMap.ResourceType.class)));
         }
-        unregisterExtensionWithCluster(resourceId, extensionId);
+        ExtensionResourceMap.ResourceType resType = EnumUtils.getEnum(ExtensionResourceMap.ResourceType.class, resourceType);
+        if (ExtensionResourceMap.ResourceType.PhysicalNetwork.equals(resType)) {
+            unregisterExtensionWithPhysicalNetwork(resourceId, extensionId);
+        } else {
+            unregisterExtensionWithCluster(resourceId, extensionId);
+        }
         return extensionDao.findById(extensionId);
     }
 
@@ -965,6 +1378,45 @@ public void unregisterExtensionWithCluster(Cluster cluster, Long extensionId) {
         }
     }
 
+    protected void unregisterExtensionWithPhysicalNetwork(String resourceId, Long extensionId) {
+        PhysicalNetworkVO physicalNetwork = physicalNetworkDao.findByUuid(resourceId);
+        if (physicalNetwork == null) {
+            throw new InvalidParameterValueException("Invalid physical network ID specified");
+        }
+        // Find the specific map entry for this extension+physical-network combination
+        ExtensionResourceMapVO existing = extensionResourceMapDao.findResourceByExtensionIdAndResourceIdAndType(
+                extensionId, physicalNetwork.getId(), ExtensionResourceMap.ResourceType.PhysicalNetwork);
+        if (existing == null) {
+            return;
+        }
+
+        ExtensionVO ext = extensionDao.findById(existing.getExtensionId());
+        if (ext != null) {
+            List<NetworkVO> networksUsingProvider = networkDao.listByPhysicalNetworkAndProvider(
+                    physicalNetwork.getId(), ext.getName());
+            if (CollectionUtils.isNotEmpty(networksUsingProvider)) {
+                throw new CloudRuntimeException(String.format(
+                        "Cannot unregister extension '%s' from physical network %s. "
+                                + "Provider is used by %d existing network service(s)",
+                        ext.getName(), physicalNetwork, networksUsingProvider.size()));
+            }
+        }
+
+        extensionResourceMapDao.remove(existing.getId());
+        extensionResourceMapDetailsDao.removeDetails(existing.getId());
+
+        // Also remove the auto-created NSP for this extension
+        if (ext != null) {
+            PhysicalNetworkServiceProviderVO nsp =
+                    physicalNetworkServiceProviderDao.findByServiceProvider(physicalNetwork.getId(), ext.getName());
+            if (nsp != null) {
+                physicalNetworkServiceProviderDao.remove(nsp.getId());
+                logger.info("Removed NetworkServiceProvider '{}' from physical network {} "
+                        + "on extension unregister", ext, physicalNetwork);
+            }
+        }
+    }
+
     @Override
     public ExtensionResponse createExtensionResponse(Extension extension,
                  EnumSet<ApiConstants.ExtensionDetails> viewDetails) {
@@ -988,6 +1440,12 @@ public ExtensionResponse createExtensionResponse(Extension extension,
                     Cluster cluster = clusterDao.findById(extensionResourceMapVO.getResourceId());
                     extensionResourceResponse.setId(cluster.getUuid());
                     extensionResourceResponse.setName(cluster.getName());
+                } else if (ExtensionResourceMap.ResourceType.PhysicalNetwork.equals(extensionResourceMapVO.getResourceType())) {
+                    PhysicalNetworkVO pn = physicalNetworkDao.findById(extensionResourceMapVO.getResourceId());
+                    if (pn != null) {
+                        extensionResourceResponse.setId(pn.getUuid());
+                        extensionResourceResponse.setName(pn.getName());
+                    }
                 }
                 Map<String, String> details = extensionResourceMapDetailsDao.listDetailsKeyPairs(
                         extensionResourceMapVO.getId(), true);
@@ -1143,7 +1601,7 @@ public List<ExtensionCustomActionResponse> listCustomActions(ListCustomActionCmd
         }
 
         if (extensionId == null && resourceType != null && StringUtils.isNotBlank(resourceId)) {
-            Extension extension = getExtensionFromResource(resourceType, resourceId);
+            Extension extension = getExtensionWithCustomActionFromResource(resourceType, resourceId);
             if (extension == null) {
                 logger.error("No extension found for the specified resource [type: {}, id: {}]", resourceTypeStr, resourceId);
                 throw new InvalidParameterValueException("Internal error listing custom actions with specified resource");
@@ -1335,7 +1793,7 @@ protected void updatedCustomActionDetails(long id, Boolean cleanupDetails, Map<S
 
     @Override
     public CustomActionResultResponse runCustomAction(RunCustomActionCmd cmd) {
-        final Long id =  cmd.getCustomActionId();
+        final Long id = cmd.getCustomActionId();
         final String resourceTypeStr = cmd.getResourceType();
         final String resourceUuid = cmd.getResourceId();
         Map<String, String> cmdParameters = cmd.getParameters();
@@ -1360,8 +1818,6 @@ public CustomActionResultResponse runCustomAction(RunCustomActionCmd cmd) {
             logger.error("Failed to run {} as it is not enabled", customActionVO);
             throw new InvalidParameterValueException(error);
         }
-        final String actionName = customActionVO.getName();
-        RunCustomActionCommand runCustomActionCommand = new RunCustomActionCommand(actionName);
         final long extensionId = customActionVO.getExtensionId();
         final ExtensionVO extensionVO = extensionDao.findById(extensionId);
         if (extensionVO == null) {
@@ -1392,39 +1848,47 @@ public CustomActionResultResponse runCustomAction(RunCustomActionCmd cmd) {
             logger.error("Specified resource does not exist for running {}", customActionVO);
             throw new CloudRuntimeException(error);
         }
-        Long clusterId = null;
-        Long hostId = null;
-        if (entity instanceof Cluster) {
-            clusterId = ((Cluster)entity).getId();
-            List<HostVO> hosts = hostDao.listByClusterAndHypervisorType(clusterId, Hypervisor.HypervisorType.External);
-            if (CollectionUtils.isEmpty(hosts)) {
-                logger.error("No hosts found for {} for running {}", entity, customActionVO);
-                throw new CloudRuntimeException(error);
-            }
-            hostId = hosts.get(0).getId();
-        } else if (entity instanceof Host) {
-            Host host = (Host)entity;
-            if (!Hypervisor.HypervisorType.External.equals(host.getHypervisorType())) {
-                logger.error("Invalid {} specified as host resource for running {}", entity, customActionVO);
-                throw new InvalidParameterValueException(error);
-            }
-            hostId = host.getId();
-            clusterId = host.getClusterId();
-        } else if (entity instanceof VirtualMachine) {
-            VirtualMachine virtualMachine = (VirtualMachine)entity;
+        if (entity instanceof VirtualMachine) {
+            VirtualMachine virtualMachine = (VirtualMachine) entity;
             accountService.checkAccess(caller, null, true, virtualMachine);
-            if (!Hypervisor.HypervisorType.External.equals(virtualMachine.getHypervisorType())) {
-                logger.error("Invalid {} specified as VM resource for running {}", entity, customActionVO);
-                throw new InvalidParameterValueException(error);
-            }
-            VirtualMachineProfile vmProfile = new VirtualMachineProfileImpl(virtualMachine);
-            VirtualMachineTO virtualMachineTO = virtualMachineManager.toVmTO(vmProfile);
-            runCustomActionCommand.setVmTO(virtualMachineTO);
-            Pair<Long, Long> clusterAndHostId = virtualMachineManager.findClusterAndHostIdForVm(virtualMachine, false);
-            clusterId = clusterAndHostId.first();
-            hostId = clusterAndHostId.second();
+            return runVirtualMachineCustomAction(virtualMachine, customActionVO, extensionVO,
+                    actionResourceType, cmdParameters);
+        } else if (entity instanceof Network) {
+            // Network custom action: dispatched directly to NetworkCustomActionProvider (no agent)
+            Network network = (Network) entity;
+            accountService.checkAccess(caller, null, true, network);
+            return runNetworkCustomAction(network, customActionVO, extensionVO, actionResourceType, cmdParameters);
+        } else if (entity instanceof Vpc) {
+            // VPC custom action: dispatched directly to NetworkCustomActionProvider (no agent)
+            Vpc vpc = (Vpc) entity;
+            accountService.checkAccess(caller, null, true, vpc);
+            return runVpcCustomAction(vpc, customActionVO, extensionVO, actionResourceType, cmdParameters);
+        }
+        throw new CloudRuntimeException(String.format("Custom action for resource type %s is not supported",
+                actionResourceType.name()));
+    }
+
+    private CustomActionResultResponse runVirtualMachineCustomAction(VirtualMachine virtualMachine,
+            ExtensionCustomActionVO customActionVO, ExtensionVO extensionVO,
+            ExtensionCustomAction.ResourceType actionResourceType,
+            Map<String, String> cmdParameters) {
+
+        String error = "Internal error running action on virtual machine";
+
+        if (!Hypervisor.HypervisorType.External.equals(virtualMachine.getHypervisorType())) {
+            logger.error("Invalid {} specified as VM resource for running {}", virtualMachine, customActionVO);
+            throw new InvalidParameterValueException(error);
         }
 
+        final String actionName = customActionVO.getName();
+        RunCustomActionCommand runCustomActionCommand = new RunCustomActionCommand(actionName);
+        VirtualMachineProfile vmProfile = new VirtualMachineProfileImpl(virtualMachine);
+        VirtualMachineTO virtualMachineTO = virtualMachineManager.toVmTO(vmProfile);
+        runCustomActionCommand.setVmTO(virtualMachineTO);
+        Pair<Long, Long> clusterAndHostId = virtualMachineManager.findClusterAndHostIdForVm(virtualMachine, false);
+
+        Long clusterId = clusterAndHostId.first();
+        Long hostId = clusterAndHostId.second();
         if (clusterId == null || hostId == null) {
             logger.error(
                     "Unable to find cluster or host with the specified resource - cluster ID: {}, host ID: {}",
@@ -1458,7 +1922,7 @@ public CustomActionResultResponse runCustomAction(RunCustomActionCmd cmd) {
         Map<String, String> result = new HashMap<>();
         response.setSuccess(false);
         result.put(ApiConstants.MESSAGE, getActionMessage(false, customActionVO, extensionVO,
-                actionResourceType, entity));
+                actionResourceType, virtualMachine));
         Map<String, Map<String, String>> externalDetails =
                 getExternalAccessDetails(allDetails.first(), hostId, extensionResource);
         Map<String, String> vmExternalDetails = null;
@@ -1473,7 +1937,7 @@ public CustomActionResultResponse runCustomAction(RunCustomActionCmd cmd) {
         runCustomActionCommand.setWait(customActionVO.getTimeout());
         try {
             logger.info("Running custom action: {} with {} parameters", actionName,
-                    (parameters != null ? parameters.keySet().size() : 0));
+                    (parameters != null ? parameters.size() : 0));
             Answer answer = agentMgr.send(hostId, runCustomActionCommand);
             if (!(answer instanceof RunCustomActionAnswer)) {
                 logger.error("Unexpected answer [{}] received for {}", answer.getClass().getSimpleName(),
@@ -1483,7 +1947,7 @@ public CustomActionResultResponse runCustomAction(RunCustomActionCmd cmd) {
                 RunCustomActionAnswer customActionAnswer = (RunCustomActionAnswer) answer;
                 response.setSuccess(answer.getResult());
                 result.put(ApiConstants.MESSAGE, getActionMessage(answer.getResult(), customActionVO, extensionVO,
-                        actionResourceType, entity));
+                        actionResourceType, virtualMachine));
                 result.put(ApiConstants.DETAILS, customActionAnswer.getDetails());
             }
         } catch (AgentUnavailableException e) {
@@ -1499,6 +1963,183 @@ public CustomActionResultResponse runCustomAction(RunCustomActionCmd cmd) {
         return response;
     }
 
+    /**
+     * Executes a custom action for a Network resource by delegating to an
+     * available {@link NetworkCustomActionProvider} (e.g. NetworkExtensionElement).
+     * This path does NOT go through the agent framework.
+     */
+    protected CustomActionResultResponse runNetworkCustomAction(Network network,
+            ExtensionCustomActionVO customActionVO, ExtensionVO extensionVO,
+            ExtensionCustomAction.ResourceType actionResourceType,
+            Map<String, String> cmdParameters) {
+
+        final String actionName = customActionVO.getName();
+        CustomActionResultResponse response = new CustomActionResultResponse();
+        response.setId(customActionVO.getUuid());
+        response.setName(actionName);
+        response.setObjectName("customactionresult");
+        Map<String, String> result = new HashMap<>();
+        response.setSuccess(false);
+        result.put(ApiConstants.MESSAGE, getActionMessage(false, customActionVO, extensionVO, actionResourceType, network));
+
+        // Resolve action parameters
+        List<ExtensionCustomAction.Parameter> actionParameters = null;
+        Pair<Map<String, String>, Map<String, String>> allDetails =
+                extensionCustomActionDetailsDao.listDetailsKeyPairsWithVisibility(customActionVO.getId());
+        if (allDetails.second().containsKey(ApiConstants.PARAMETERS)) {
+            actionParameters = ExtensionCustomAction.Parameter.toListFromJson(
+                    allDetails.second().get(ApiConstants.PARAMETERS));
+        }
+        Map<String, Object> parameters = null;
+        if (CollectionUtils.isNotEmpty(actionParameters)) {
+            parameters = ExtensionCustomAction.Parameter.validateParameterValues(actionParameters, cmdParameters);
+        }
+
+        // Find the provider name for this network
+        String providerName = networkServiceMapDao.getProviderForServiceInNetwork(network.getId(), Service.CustomAction);
+        if (StringUtils.isBlank(providerName)) {
+            logger.error("No network service provider found for network {}", network);
+            result.put(ApiConstants.DETAILS, "No network service provider found for this network");
+            response.setResult(result);
+            return response;
+        }
+
+        // Check if provider name matches the extension name
+        if (!providerName.equals(extensionVO.getName())) {
+            logger.error("Provider name '{}' for network {} does not match extension name '{}'",
+                    providerName, network, extensionVO);
+            result.put(ApiConstants.DETAILS, "Network service provider '" + providerName +
+                    "' does not match extension '" + extensionVO.getName() + "'");
+            response.setResult(result);
+            return response;
+        }
+
+        // Get the network element implementing that provider
+        NetworkElement element = networkModel.getElementImplementingProvider(providerName);
+        if (element == null) {
+            logger.error("No NetworkElement found implementing provider '{}' for network {}", providerName, network);
+            result.put(ApiConstants.DETAILS, "No network element found for provider: " + providerName);
+            response.setResult(result);
+            return response;
+        }
+
+        // The element must implement NetworkCustomActionProvider
+        if (!(element instanceof NetworkCustomActionProvider)) {
+            logger.error("Network element '{}' for provider '{}' does not support custom actions",
+                    element.getClass().getSimpleName(), providerName);
+            result.put(ApiConstants.DETAILS, "Provider '" + providerName + "' does not support custom actions");
+            response.setResult(result);
+            return response;
+        }
+
+        NetworkCustomActionProvider provider = (NetworkCustomActionProvider) element;
+        try {
+            if (!provider.canHandleCustomAction(network)) {
+                throw new CloudRuntimeException("Provider '" + providerName + "' cannot handle custom action for this network");
+            }
+            logger.info("Running network custom action '{}' on network {} via {} (provider: {})",
+                    actionName, network, element.getClass().getSimpleName(), providerName);
+            String output = provider.runCustomAction(network, actionName, parameters);
+            boolean success = output != null;
+            response.setSuccess(success);
+            result.put(ApiConstants.MESSAGE, getActionMessage(success, customActionVO, extensionVO, actionResourceType, network));
+            result.put(ApiConstants.DETAILS, success ? output : "Action failed — check management server logs for details");
+        } catch (Exception e) {
+            logger.error("Network custom action '{}' threw exception: {}", actionName, e.getMessage(), e);
+            result.put(ApiConstants.DETAILS, "Action failed: " + e.getMessage());
+        }
+        response.setResult(result);
+        return response;
+    }
+
+    /**
+     * Executes a custom action for a VPC resource by finding the VPC's
+     * extension provider and dispatching directly to it (no tier network lookup).
+     */
+    protected CustomActionResultResponse runVpcCustomAction(Vpc vpc,
+            ExtensionCustomActionVO customActionVO, ExtensionVO extensionVO,
+            ExtensionCustomAction.ResourceType actionResourceType,
+            Map<String, String> cmdParameters) {
+
+        final String actionName = customActionVO.getName();
+        CustomActionResultResponse response = new CustomActionResultResponse();
+        response.setId(customActionVO.getUuid());
+        response.setName(actionName);
+        response.setObjectName("customactionresult");
+        Map<String, String> result = new HashMap<>();
+        response.setSuccess(false);
+        result.put(ApiConstants.MESSAGE, getActionMessage(false, customActionVO, extensionVO, actionResourceType, vpc));
+
+        // Resolve action parameters
+        List<ExtensionCustomAction.Parameter> actionParameters = null;
+        Pair<Map<String, String>, Map<String, String>> allDetails =
+                extensionCustomActionDetailsDao.listDetailsKeyPairsWithVisibility(customActionVO.getId());
+        if (allDetails.second().containsKey(ApiConstants.PARAMETERS)) {
+            actionParameters = ExtensionCustomAction.Parameter.toListFromJson(
+                    allDetails.second().get(ApiConstants.PARAMETERS));
+        }
+        Map<String, Object> parameters = null;
+        if (CollectionUtils.isNotEmpty(actionParameters)) {
+            parameters = ExtensionCustomAction.Parameter.validateParameterValues(actionParameters, cmdParameters);
+        }
+
+        // Find the provider name for this VPC
+        String providerName = vpcServiceMapDao.getProviderForServiceInVpc(vpc.getId(), Service.CustomAction);
+        if (StringUtils.isBlank(providerName)) {
+            logger.error("No VPC service provider found for VPC {}", vpc.getId());
+            result.put(ApiConstants.DETAILS, "No VPC service provider found for this VPC");
+            response.setResult(result);
+            return response;
+        }
+
+        // Check if provider name matches the extension name
+        if (!providerName.equals(extensionVO.getName())) {
+            logger.error("Provider name '{}' for vpc {} does not match extension name '{}'",
+                    providerName, vpc.getId(), extensionVO.getName());
+            result.put(ApiConstants.DETAILS, "Network service provider '" + providerName +
+                    "' does not match extension '" + extensionVO.getName() + "'");
+            response.setResult(result);
+            return response;
+        }
+
+        // Get the network element implementing that provider
+        NetworkElement element = networkModel.getElementImplementingProvider(providerName);
+        if (element == null) {
+            logger.error("No NetworkElement found implementing provider '{}' for VPC {}", providerName, vpc);
+            result.put(ApiConstants.DETAILS, "No network element found for provider: " + providerName);
+            response.setResult(result);
+            return response;
+        }
+
+        // The element must implement NetworkCustomActionProvider
+        if (!(element instanceof NetworkCustomActionProvider)) {
+            logger.error("Network element '{}' for provider '{}' does not support VPC custom actions",
+                    element.getClass().getSimpleName(), providerName);
+            result.put(ApiConstants.DETAILS, "Provider '" + providerName + "' does not support custom actions");
+            response.setResult(result);
+            return response;
+        }
+
+        NetworkCustomActionProvider provider = (NetworkCustomActionProvider) element;
+        try {
+            if (!provider.canHandleVpcCustomAction(vpc)) {
+                throw new CloudRuntimeException("Provider '" + providerName + "' cannot handle custom action for this VPC");
+            }
+            logger.info("Running VPC custom action '{}' on VPC {} via {} (provider: {})",
+                    actionName, vpc.getId(), element.getClass().getSimpleName(), providerName);
+            String output = provider.runCustomAction(vpc, actionName, parameters);
+            boolean success = output != null;
+            response.setSuccess(success);
+            result.put(ApiConstants.MESSAGE, getActionMessage(success, customActionVO, extensionVO, actionResourceType, vpc));
+            result.put(ApiConstants.DETAILS, success ? output : "Action failed — check management server logs for details");
+        } catch (Exception e) {
+            logger.error("VPC custom action '{}' threw exception: {}", actionName, e.getMessage(), e);
+            result.put(ApiConstants.DETAILS, "Action failed: " + e.getMessage());
+        }
+        response.setResult(result);
+        return response;
+    }
+
     @Override
     public ExtensionCustomActionResponse createCustomActionResponse(ExtensionCustomAction customAction) {
         ExtensionCustomActionResponse response = new ExtensionCustomActionResponse(customAction.getUuid(),
@@ -1608,11 +2249,8 @@ public void updateExtensionResourceMapDetails(long extensionResourceMapId, Map<S
         if (MapUtils.isEmpty(details)) {
             return;
         }
-        List<ExtensionResourceMapDetailsVO> detailsList = new ArrayList<>();
-        for (Map.Entry<String, String> entry : details.entrySet()) {
-            detailsList.add(new ExtensionResourceMapDetailsVO(extensionResourceMapId, entry.getKey(),
-                    entry.getValue()));
-        }
+        List<ExtensionResourceMapDetailsVO> detailsList =
+                buildExtensionResourceDetailsArray(extensionResourceMapId, details);
         extensionResourceMapDetailsDao.saveDetails(detailsList);
     }
 
@@ -1650,6 +2288,11 @@ public Extension getExtension(long id) {
         return extensionDao.findById(id);
     }
 
+    @Override
+    public Extension getExtensionByNameAndType(String name, Extension.Type type) {
+        return extensionDao.findByNameAndType(name, type);
+    }
+
     @Override
     public Extension getExtensionForCluster(long clusterId) {
         Long extensionId = getExtensionIdForCluster(clusterId);
@@ -1714,6 +2357,7 @@ public List<Class<?>> getCommands() {
         cmds.add(UpdateExtensionCmd.class);
         cmds.add(RegisterExtensionCmd.class);
         cmds.add(UnregisterExtensionCmd.class);
+        cmds.add(UpdateRegisteredExtensionCmd.class);
         return cmds;
     }
 
@@ -1765,4 +2409,95 @@ protected void runInContext() {
             }
         }
     }
+
+    @Override
+    public String getExtensionScriptPath(Extension extension) {
+        if (extension == null) {
+            return null;
+        }
+        return externalProvisioner.getExtensionPath(extension.getRelativePath());
+    }
+
+    @Override
+    public Extension getExtensionForPhysicalNetworkAndProvider(long physicalNetworkId, String providerName) {
+        if (StringUtils.isBlank(providerName)) {
+            return null;
+        }
+        ExtensionVO ext = extensionDao.findByName(providerName);
+        if (ext == null) {
+            return null;
+        }
+
+        ExtensionResourceMapVO map = extensionResourceMapDao.findResourceByExtensionIdAndResourceIdAndType(
+                ext.getId(), physicalNetworkId, ExtensionResourceMap.ResourceType.PhysicalNetwork);
+        if (map != null) {
+            return ext;
+        }
+        return null;
+    }
+
+    @Override
+    public Map<String, String> getAllResourceMapDetailsForExtensionOnPhysicalNetwork(long physicalNetworkId, long extensionId) {
+        ExtensionResourceMapVO map = extensionResourceMapDao.findResourceByExtensionIdAndResourceIdAndType(
+                extensionId, physicalNetworkId, ExtensionResourceMap.ResourceType.PhysicalNetwork);
+        if (map == null) {
+            return new HashMap<>();
+        }
+
+        Map<String, String> details = extensionResourceMapDetailsDao.listDetailsKeyPairs(map.getId());
+        return details != null ? details : new HashMap<>();
+    }
+
+    @Override
+    public boolean isNetworkExtensionProvider(String providerName) {
+        if (StringUtils.isBlank(providerName)) {
+            return false;
+        }
+        return extensionDao.findByNameAndType(providerName, Extension.Type.NetworkOrchestrator) != null;
+    }
+
+    @Override
+    public boolean usesNetworkExtensionIsolation(String providerName) {
+        Extension extension = extensionDao.findByName(providerName);
+        if (extension == null) {
+            return false;
+        }
+        Map<String, String> extDetails = extensionDetailsDao.listDetailsKeyPairs(extension.getId());
+        if (MapUtils.isEmpty(extDetails)) {
+            return false;
+        }
+        return NETWORK_EXTENSION_ISOLATION_METHOD.equalsIgnoreCase(extDetails.get(NETWORK_ISOLATION_METHOD_DETAIL_KEY));
+    }
+
+    @Override
+    public List<Extension> listExtensionsByType(Extension.Type type) {
+        if (type == null) {
+            return new ArrayList<>();
+        }
+        List<ExtensionVO> extensions = extensionDao.listByType(type);
+        if (CollectionUtils.isEmpty(extensions)) {
+            return new ArrayList<>();
+        }
+        return new ArrayList<>(extensions);
+    }
+
+    @Override
+    public Map<Service, Map<Capability, String>> getNetworkCapabilitiesForProvider(Long physicalNetworkId,
+            String providerName) {
+        if (StringUtils.isBlank(providerName)) {
+            return new HashMap<>();
+        }
+        Extension extension = null;
+        if (physicalNetworkId != null) {
+            extension = getExtensionForPhysicalNetworkAndProvider(physicalNetworkId, providerName);
+        } else {
+            // Search across all physical networks
+            extension = extensionDao.findByNameAndType(providerName, Extension.Type.NetworkOrchestrator);
+        }
+        if (extension == null) {
+            return new HashMap<>();
+        }
+        Map<String, String> extDetails = extensionDetailsDao.listDetailsKeyPairs(extension.getId());
+        return buildCapabilitiesFromDetailKeys(extDetails);
+    }
 }
diff --git a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/network/NetworkExtensionElement.java b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/network/NetworkExtensionElement.java
new file mode 100644
index 000000000000..e98848c01f7d
--- /dev/null
+++ b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/network/NetworkExtensionElement.java
@@ -0,0 +1,2618 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.framework.extensions.network;
+
+import java.io.File;
+import java.net.URI;
+import java.nio.file.Files;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import javax.inject.Inject;
+import javax.naming.ConfigurationException;
+
+import com.cloud.agent.api.to.LoadBalancerTO;
+import com.cloud.dc.DataCenter;
+import com.cloud.dc.Vlan;
+import com.cloud.dc.VlanVO;
+import com.cloud.dc.dao.DataCenterDao;
+import com.cloud.dc.dao.VlanDao;
+import com.cloud.deploy.DeployDestination;
+import com.cloud.exception.ConcurrentOperationException;
+import com.cloud.exception.InsufficientCapacityException;
+import com.cloud.exception.ResourceUnavailableException;
+import com.cloud.host.dao.HostDao;
+import com.cloud.network.IpAddressManager;
+import com.cloud.network.IpAddress;
+import com.cloud.network.Network;
+import com.cloud.network.Network.Capability;
+import com.cloud.network.Network.Provider;
+import com.cloud.network.Network.Service;
+import com.cloud.network.NetworkModel;
+import com.cloud.network.Networks;
+import com.cloud.network.dao.NetworkDetailVO;
+import com.cloud.network.dao.NetworkDao;
+import com.cloud.network.dao.NetworkVO;
+import com.cloud.network.dao.PhysicalNetworkDao;
+import com.cloud.network.dao.PhysicalNetworkVO;
+import com.cloud.network.PhysicalNetworkServiceProvider;
+import com.cloud.network.PublicIpAddress;
+import com.cloud.network.addr.PublicIp;
+import com.cloud.network.dao.FirewallRulesDao;
+import com.cloud.network.dao.IPAddressDao;
+import com.cloud.network.dao.IPAddressVO;
+import com.cloud.network.dao.NetworkDetailsDao;
+import com.cloud.network.dao.NetworkServiceMapDao;
+import com.cloud.network.vpc.dao.VpcDao;
+import com.cloud.network.element.AggregatedCommandExecutor;
+import com.cloud.network.element.DhcpServiceProvider;
+import com.cloud.network.element.DnsServiceProvider;
+import com.cloud.network.element.FirewallServiceProvider;
+import com.cloud.network.element.IpDeployer;
+import com.cloud.network.element.LoadBalancingServiceProvider;
+import com.cloud.network.element.NetworkACLServiceProvider;
+import com.cloud.network.element.NetworkElement;
+import com.cloud.network.element.PortForwardingServiceProvider;
+import com.cloud.network.element.SourceNatServiceProvider;
+import com.cloud.network.element.StaticNatServiceProvider;
+import com.cloud.network.element.UserDataServiceProvider;
+import com.cloud.network.element.VpcProvider;
+import com.cloud.network.vpc.NetworkACLItem;
+import com.cloud.network.vpc.PrivateGateway;
+import com.cloud.network.vpc.StaticRouteProfile;
+import com.cloud.network.vpc.Vpc;
+import com.cloud.network.lb.LoadBalancingRule;
+import com.cloud.network.rules.FirewallRule;
+import com.cloud.network.rules.FirewallRuleVO;
+import com.cloud.network.rules.PortForwardingRule;
+import com.cloud.network.rules.StaticNat;
+import com.cloud.offerings.NetworkOfferingVO;
+import com.cloud.offerings.dao.NetworkOfferingDao;
+import com.cloud.service.ServiceOfferingVO;
+import com.cloud.service.dao.ServiceOfferingDao;
+import com.cloud.storage.dao.GuestOSCategoryDao;
+import com.cloud.storage.dao.GuestOSDao;
+import com.cloud.user.AccountService;
+import com.cloud.uservm.UserVm;
+import com.cloud.offering.NetworkOffering;
+import com.cloud.user.Account;
+import com.cloud.utils.Pair;
+import com.cloud.utils.component.AdapterBase;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.utils.net.NetUtils;
+import com.cloud.vm.Nic;
+import com.cloud.vm.NicProfile;
+import com.cloud.vm.NicVO;
+import com.cloud.vm.ReservationContext;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.VirtualMachineManager;
+import com.cloud.vm.VirtualMachineProfile;
+import com.cloud.vm.VMInstanceDetailVO;
+import com.cloud.vm.VmDetailConstants;
+import com.cloud.vm.dao.NicDao;
+import com.cloud.vm.dao.UserVmDao;
+import com.cloud.vm.dao.VMInstanceDetailsDao;
+import com.google.gson.Gson;
+import com.google.gson.JsonArray;
+import com.google.gson.JsonElement;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.engine.orchestration.service.NetworkOrchestrationService;
+import org.apache.cloudstack.extension.Extension;
+import org.apache.cloudstack.extension.ExtensionHelper;
+import org.apache.cloudstack.extension.NetworkCustomActionProvider;
+import org.apache.cloudstack.framework.extensions.dao.ExtensionDetailsDao;
+import org.apache.cloudstack.framework.extensions.vo.ExtensionDetailsVO;
+import org.apache.cloudstack.resourcedetail.dao.VpcDetailsDao;
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.collections.MapUtils;
+import org.apache.commons.lang3.EnumUtils;
+import org.apache.commons.lang3.StringUtils;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import java.util.stream.Collectors;
+
+
+public class NetworkExtensionElement extends AdapterBase implements
+        NetworkElement, SourceNatServiceProvider, StaticNatServiceProvider,
+        PortForwardingServiceProvider, IpDeployer, NetworkCustomActionProvider,
+        DhcpServiceProvider, DnsServiceProvider, FirewallServiceProvider,
+        UserDataServiceProvider, LoadBalancingServiceProvider,
+        VpcProvider, NetworkACLServiceProvider, AggregatedCommandExecutor {
+
+    private static final Map<Service, Map<Capability, String>> DEFAULT_CAPABILITIES = new HashMap<>();
+
+
+    /**
+     * When non-null, restricts all operations to the extension whose name
+     * matches this provider name.
+     */
+    private String providerName;
+
+    @Inject
+    private NetworkModel networkModel;
+    @Inject
+    private NetworkServiceMapDao ntwkSrvcDao;
+    @Inject
+    private ExtensionHelper extensionHelper;
+    @Inject
+    private NetworkDetailsDao networkDetailsDao;
+    @Inject
+    private IpAddressManager ipAddressManager;
+    @Inject
+    private NetworkOrchestrationService networkManager;
+    @Inject
+    private AccountService accountService;
+    @Inject
+    private PhysicalNetworkDao physicalNetworkDao;
+    @Inject
+    private ExtensionDetailsDao extensionDetailsDao;
+    @Inject
+    private NetworkDao networkDao;
+    @Inject
+    private DataCenterDao dataCenterDao;
+    @Inject
+    private VlanDao vlanDao;
+    @Inject
+    private GuestOSCategoryDao guestOSCategoryDao;
+    @Inject
+    private GuestOSDao guestOSDao;
+    @Inject
+    private HostDao hostDao;
+    @Inject
+    private VMInstanceDetailsDao vmInstanceDetailsDao;
+    @Inject
+    private UserVmDao userVmDao;
+    @Inject
+    private NicDao nicDao;
+    @Inject
+    private NetworkOfferingDao networkOfferingDao;
+    @Inject
+    private ServiceOfferingDao serviceOfferingDao;
+    @Inject
+    private FirewallRulesDao firewallRulesDao;
+    @Inject
+    private IPAddressDao ipAddressDao;
+    @Inject
+    private VpcDao vpcDao;
+    @Inject
+    private VpcDetailsDao vpcDetailsDao;
+
+    // ---- Script argument names ----
+
+    public static final String ARG_PHYSICAL_NETWORK_EXTENSION_DETAILS = "physical-network-extension-details";
+    public static final String ARG_NETWORK_EXTENSION_DETAILS = "network-extension-details";
+    public static final String ARG_PAYLOAD = "payload";
+    public static final String ARG_ACTION_PARAMS = "action-params";
+
+    public static final int DEFAULT_SCRIPT_TIMEOUT_SECONDS = 60;
+
+    public static final int EXIT_CODE_SUCCESS = 0;
+    public static final int EXIT_CODE_FAILURE = -1;
+
+    // ---- Script command names ----
+
+    public static final String CMD_IMPLEMENT_NETWORK = "implement-network";
+    public static final String CMD_SHUTDOWN_NETWORK = "shutdown-network";
+    public static final String CMD_DESTROY_NETWORK = "destroy-network";
+    public static final String CMD_ENSURE_NETWORK_DEVICE = "ensure-network-device";
+    public static final String CMD_ASSIGN_IP = "assign-ip";
+    public static final String CMD_RELEASE_IP = "release-ip";
+    public static final String CMD_ADD_STATIC_NAT = "add-static-nat";
+    public static final String CMD_DELETE_STATIC_NAT = "delete-static-nat";
+    public static final String CMD_ADD_PORT_FORWARD = "add-port-forward";
+    public static final String CMD_DELETE_PORT_FORWARD = "delete-port-forward";
+    public static final String CMD_ADD_DHCP_ENTRY = "add-dhcp-entry";
+    public static final String CMD_CONFIG_DHCP_SUBNET = "config-dhcp-subnet";
+    public static final String CMD_REMOVE_DHCP_SUBNET = "remove-dhcp-subnet";
+    public static final String CMD_REMOVE_DHCP_ENTRY = "remove-dhcp-entry";
+    public static final String CMD_ADD_DNS_ENTRY = "add-dns-entry";
+    public static final String CMD_REMOVE_DNS_ENTRY = "remove-dns-entry";
+    public static final String CMD_CONFIG_DNS_SUBNET = "config-dns-subnet";
+    public static final String CMD_REMOVE_DNS_SUBNET = "remove-dns-subnet";
+    public static final String CMD_SAVE_VM_DATA = "save-vm-data";
+    public static final String CMD_SAVE_PASSWORD = "save-password";
+    public static final String CMD_SAVE_USERDATA = "save-userdata";
+    public static final String CMD_SAVE_SSHKEY = "save-sshkey";
+    public static final String CMD_SAVE_HYPERVISOR_HOSTNAME = "save-hypervisor-hostname";
+    public static final String CMD_APPLY_LB_RULES = "apply-lb-rules";
+    public static final String CMD_APPLY_FW_RULES = "apply-fw-rules";
+    public static final String CMD_RESTORE_NETWORK = "restore-network";
+    public static final String CMD_IMPLEMENT_VPC = "implement-vpc";
+    public static final String CMD_SHUTDOWN_VPC = "shutdown-vpc";
+    public static final String CMD_UPDATE_VPC_SOURCE_NAT_IP = "update-vpc-source-nat-ip";
+    public static final String CMD_APPLY_NETWORK_ACL = "apply-network-acl";
+    public static final String CMD_CUSTOM_ACTION = "custom-action";
+    public static final String CMD_PREPARE_NIC = "prepare-nic";
+    public static final String CMD_RELEASE_NIC = "release-nic";
+
+    // ---- Network detail key ----
+
+    /**
+     * Key used to persist the per-network JSON blob in {@code network_details}.
+     * The blob is produced by the network-extension.sh's {@code ensure-network-device}
+     * command and may contain any fields the script needs (e.g. selected host,
+     * namespace name, VRF ID, …).
+     */
+    public static final String NETWORK_DETAIL_EXTENSION_DETAILS = "extension.details";
+
+    /**
+     * Extension detail key that controls whether {@link #ensureExtensionIp} allocates
+     * a placeholder NIC/IP.
+     *
+     * <p>Applies to any network whose DHCP/DNS/UserData service is provided by this
+     * extension <em>without</em> SourceNat or Gateway — i.e. shared networks and
+     * isolated networks that omit SourceNat.  Set the value to {@code "false"} on the
+     * Extension object (via {@code createExtension} or {@code updateExtension}) when
+     * the extension handles its own data-plane addressing and does not need CloudStack
+     * to reserve a real IP from the subnet pool (e.g. OVN, which programs port
+     * bindings in-fabric).  Omitting the detail or setting any value other than
+     * {@code "false"} preserves the original behaviour (placeholder IP is allocated).</p>
+     */
+    public static final String NETWORK_ALLOCATE_EXTENSION_IP = "network.allocate.extension.ip";
+
+    public String getProviderName() {
+        return providerName;
+    }
+
+    /**
+     * Returns a new {@link NetworkExtensionElement} scoped to {@code providerName},
+     * sharing all injected dependencies with this instance.
+     */
+    public NetworkExtensionElement withProviderName(String providerName) {
+        NetworkExtensionElement copy = new NetworkExtensionElement();
+        copy.networkModel                   = this.networkModel;
+        copy.ntwkSrvcDao                    = this.ntwkSrvcDao;
+        copy.extensionHelper                = this.extensionHelper;
+        copy.networkDetailsDao              = this.networkDetailsDao;
+        copy.ipAddressManager               = this.ipAddressManager;
+        copy.physicalNetworkDao             = this.physicalNetworkDao;
+        copy.extensionDetailsDao            = this.extensionDetailsDao;
+        copy.networkDao                     = this.networkDao;
+        copy.dataCenterDao                  = this.dataCenterDao;
+        copy.vlanDao                        = this.vlanDao;
+        copy.guestOSCategoryDao             = this.guestOSCategoryDao;
+        copy.guestOSDao                     = this.guestOSDao;
+        copy.hostDao                        = this.hostDao;
+        copy.vmInstanceDetailsDao           = this.vmInstanceDetailsDao;
+        copy.userVmDao                      = this.userVmDao;
+        copy.nicDao                         = this.nicDao;
+        copy.networkManager                 = this.networkManager;
+        copy.networkOfferingDao             = this.networkOfferingDao;
+        copy.serviceOfferingDao             = this.serviceOfferingDao;
+        copy.accountService                 = this.accountService;
+        copy.firewallRulesDao               = this.firewallRulesDao;
+        copy.ipAddressDao                   = this.ipAddressDao;
+        copy.vpcDao                         = this.vpcDao;
+        copy.vpcDetailsDao                  = this.vpcDetailsDao;
+        copy.providerName                   = providerName;
+
+        logger.debug("NetworkExtensionElement initialised with provider name '{}'", providerName);
+        return copy;
+    }
+
+    // ---- Capabilities ----
+
+    @Override
+    public Map<Service, Map<Capability, String>> getCapabilities() {
+        try {
+            // If this element is scoped to a provider name, prefer capabilities stored
+            // in the extension's "network.service.capabilities" detail.  The ExtensionHelper
+            // exposes a helper that loads the Service→Capability map from the DB.
+            if (StringUtils.isNotBlank(providerName)) {
+                Map<Service, Map<Capability, String>> caps = extensionHelper.getNetworkCapabilitiesForProvider(null, providerName);
+                if (MapUtils.isNotEmpty(caps)) {
+                    return caps;
+                }
+            }
+        } catch (Exception e) {
+            logger.warn("Failed to load network service capabilities from extension details for provider '{}': {}", providerName, e.getMessage());
+        }
+
+        return DEFAULT_CAPABILITIES;
+    }
+
+    @Override
+    public Provider getProvider() {
+        if (providerName != null) {
+            return Provider.createTransientProvider(providerName);
+        }
+        return Provider.NetworkExtension;
+    }
+
+    // ---- Extension / provider resolution ----
+
+    protected Extension resolveExtension(Network network) {
+        Long physicalNetworkId = network.getPhysicalNetworkId();
+        if (physicalNetworkId == null) {
+            logger.warn("Network {} has no physical network — cannot resolve extension", network);
+            return null;
+        }
+        Extension ext = extensionHelper.getExtensionForPhysicalNetworkAndProvider(physicalNetworkId, providerName);
+        if (ext != null) {
+            return ext;
+        }
+        logger.warn("No extension found for scoped provider '{}' on physical network {}", providerName, physicalNetworkId);
+        return null;
+    }
+
+    protected boolean canHandle(Network network, Service service) {
+        Long physicalNetworkId = network.getPhysicalNetworkId();
+        if (physicalNetworkId == null) {
+            return false;
+        }
+        boolean hasExt = extensionHelper.getExtensionForPhysicalNetworkAndProvider(physicalNetworkId, providerName) != null;
+        if (!hasExt) {
+            return false;
+        }
+        if (service == null) {
+            return true;
+        }
+        List<String> sp = ntwkSrvcDao.getProvidersForServiceInNetwork(network.getId(), service);
+        return sp != null && sp.stream()
+                .anyMatch(p -> extensionHelper.getExtensionForPhysicalNetworkAndProvider(physicalNetworkId, p) != null);
+    }
+
+    @Override
+    public boolean configure(String name, Map<String, Object> params) throws ConfigurationException {
+        super.configure(name, params);
+        return true;
+    }
+
+    // ---- NetworkElement lifecycle ----
+
+    @Override
+    public boolean implement(Network network, NetworkOffering offering, DeployDestination dest,
+            ReservationContext context) throws ConcurrentOperationException,
+            ResourceUnavailableException, InsufficientCapacityException {
+        if (!canHandle(network, null)) {
+            return false;
+        }
+        logger.info("Implementing network extension for network {} (VLAN {})", network, network.getBroadcastUri());
+
+        // Step 1: Ensure a network device is selected and its details stored.
+        ensureExtensionDetails(network);
+
+        // Step 2: Create the network on the device.
+        JsonObject implementPayload = new JsonObject();
+        addNetworkToPayload(implementPayload, network);
+        addExtensionIpToPayload(implementPayload, network);
+
+        Pair<Integer, String> result = executeScriptAndReturnOutput(network, CMD_IMPLEMENT_NETWORK, implementPayload);
+
+        if (result.first() != EXIT_CODE_SUCCESS) {
+            return false;
+        }
+
+        // Update the network properties from the output
+        applyNetworkUpdateFromScriptOutput(network, result.second());
+
+        // Step 3: Configure source NAT for both VPC and non-VPC networks for
+        // compatibility (other network-element providers may also implement VPC tiers).
+        // When this is a VPC tier, the script's assign-ip does nothing for source-nat
+        // because VPC source NAT is managed at the VPC level by implementVpc().
+        if (canHandle(network, Service.SourceNat)) {
+            try {
+                if (network.getVpcId() == null) {
+                    // Isolated network: apply the network's own source NAT IP.
+                    Account owner = accountService.getAccount(network.getAccountId());
+                    PublicIpAddress existingIp = networkModel.getSourceNatIpAddressForGuestNetwork(owner, network);
+                    if (existingIp != null) {
+                        applyIps(network, List.of(existingIp), Set.of(Service.SourceNat));
+                    }
+                } else {
+                    // VPC tier: apply the VPC-level source NAT IP (script is a no-op for SNAT).
+                    final PublicIpAddress vpcSourceNatIp = getVpcSourceNatIp(network.getVpcId());
+                    if (vpcSourceNatIp != null) {
+                        applyIps(network, List.of(vpcSourceNatIp), Set.of(Service.SourceNat));
+                    }
+                }
+            } catch (Exception e) {
+                logger.warn("Failed to configure source NAT IP for network {}: {}", network, e.getMessage());
+            }
+        }
+
+        return true;
+    }
+
+    @Override
+    public boolean prepare(Network network, NicProfile nic, VirtualMachineProfile vm,
+            DeployDestination dest, ReservationContext context)
+            throws ConcurrentOperationException, ResourceUnavailableException, InsufficientCapacityException {
+
+        if (!canHandle(network, null)) {
+            return false;
+        }
+
+        if (!networkModel.isProviderEnabledInPhysicalNetwork(networkModel.getPhysicalNetworkId(network), getProvider().getName())) {
+            return false;
+        }
+
+        // Sync nic with network
+        applyNicUpdateFromNetwork(network, nic.getId());
+
+        // Build payload for prepare-nic script command
+        try {
+            JsonObject payload = new JsonObject();
+            addNetworkToPayload(payload, network);
+            addNicToPayload(payload, nic);
+            if (vm != null) {
+                payload.addProperty("hostname", safeStr(vm.getHostName()));
+            }
+            addExtensionIpToPayload(payload, network);
+
+            logger.debug("Preparing NIC via extension script: network={} nicMac={} nicIp={}", network, nic.getMacAddress(), nic.getIPv4Address());
+
+            return executeScript(network, CMD_PREPARE_NIC, payload);
+        } catch (Exception e) {
+            logger.warn("prepare: failed to prepare NIC for network {}: {}", network, e.getMessage());
+            return false;
+        }
+    }
+
+    private void applyNicUpdateFromNetwork(Network network, Long nicId) {
+        if (nicId == null) {
+            return;
+        }
+        NicVO nicVo = nicDao.findById(nicId);
+        if (nicVo == null) {
+            return;
+        }
+        if (network.getBroadcastUri() != null) {
+            nicVo.setBroadcastUri(network.getBroadcastUri());
+            nicVo.setIsolationUri(network.getBroadcastUri());
+            nicDao.update(nicId, nicVo);
+        }
+    }
+
+    @Override
+    public boolean release(Network network, NicProfile nic, VirtualMachineProfile vm,
+            ReservationContext context) throws ConcurrentOperationException, ResourceUnavailableException {
+        if (!canHandle(network, null)) {
+            return true;
+        }
+
+        try {
+            JsonObject payload = new JsonObject();
+            addNetworkToPayload(payload, network);
+            addNicToPayload(payload, nic);
+            addExtensionIpToPayload(payload, network);
+
+            logger.debug("Releasing NIC via extension script: network={} nicMac={} nicIp={}", network, nic != null ? nic.getMacAddress() : null, nic != null ? nic.getIPv4Address() : null);
+
+            return executeScript(network, CMD_RELEASE_NIC, payload);
+        } catch (Exception e) {
+            logger.warn("release: failed to release NIC for network {}: {}", network, e.getMessage());
+            return false;
+        }
+    }
+
+    @Override
+    public boolean shutdown(Network network, ReservationContext context, boolean cleanup)
+            throws ConcurrentOperationException, ResourceUnavailableException {
+        logger.info("Shutting down network extension for network {}", network);
+        JsonObject payload = new JsonObject();
+        addNetworkToPayload(payload, network);
+        boolean result = executeScript(network, CMD_SHUTDOWN_NETWORK, payload);
+        if (result) {
+            // Remove stored per-network extension details (e.g. namespace). For VPC-backed networks
+            // the namespace is named cs-vpc-<vpcId>, stored in the extension details. Removing the
+            // stored details ensures the namespace is deleted/forgotten on shutdown.
+            try {
+                networkDetailsDao.removeDetail(network.getId(), NETWORK_DETAIL_EXTENSION_DETAILS);
+            } catch (Exception e) {
+                logger.warn("Failed to remove network extension details for network {}: {}", network, e.getMessage());
+            }
+        }
+        return result;
+    }
+
+    @Override
+    public boolean destroy(Network network, ReservationContext context)
+            throws ConcurrentOperationException, ResourceUnavailableException {
+        logger.info("Destroying network extension for network {}", network);
+        JsonObject payload = new JsonObject();
+        addNetworkToPayload(payload, network);
+        // For both isolated and VPC tier networks, use destroy-network.
+        // For VPC tiers, the script preserves the shared namespace;
+        // the VPC namespace is removed only when shutdownVpc() calls shutdown-vpc.
+        boolean result = executeScript(network, CMD_DESTROY_NETWORK, payload);
+        if (result) {
+            cleanupPlaceholderNicIp(network, context);
+            networkDetailsDao.removeDetail(network.getId(), NETWORK_DETAIL_EXTENSION_DETAILS);
+        }
+        return result;
+    }
+
+    /**
+     * Releases placeholder NIC IPs allocated for DHCP/DNS/UserData extension traffic,
+     * then removes the placeholder NIC record(s) for this network.
+     */
+    protected void cleanupPlaceholderNicIp(Network network, ReservationContext context) {
+        List<NicVO> placeholderNics = nicDao.listPlaceholderNicsByNetworkIdAndVmType(
+                network.getId(), VirtualMachine.Type.DomainRouter);
+        if (CollectionUtils.isEmpty(placeholderNics)) {
+            return;
+        }
+
+        long userId = accountService.getSystemUser().getId();
+        Account caller = accountService.getSystemAccount();
+        if (context != null && context.getAccount() != null) {
+            caller = context.getAccount();
+        }
+
+        for (NicVO placeholderNic : placeholderNics) {
+            try {
+                String ip = placeholderNic.getIPv4Address();
+                if (StringUtils.isNotBlank(ip)) {
+                    logger.debug("Cleaning up PlaceHolder IP {} on network {}", ip, network);
+                    IPAddressVO ipAddress = ipAddressDao.findByIpAndSourceNetworkId(network.getId(), ip);
+                    if (ipAddress != null) {
+                        if (Network.GuestType.Shared.equals(network.getGuestType())) {
+                            ipAddressManager.disassociatePublicIpAddress(ipAddress, userId, caller);
+                        } else {
+                            ipAddressManager.markIpAsUnavailable(ipAddress.getId());
+                            ipAddressDao.unassignIpAddress(ipAddress.getId());
+                        }
+                    }
+                }
+            } catch (Exception e) {
+                logger.warn("Failed to release placeholder IP for network {} and nic {}: {}",
+                        network, placeholderNic, e.getMessage());
+            }
+
+            try {
+                nicDao.remove(placeholderNic.getId());
+            } catch (Exception e) {
+                logger.warn("Failed to remove placeholder nic {} for network {}: {}",
+                        placeholderNic, network, e.getMessage());
+            }
+        }
+    }
+
+    @Override
+    public boolean isReady(PhysicalNetworkServiceProvider provider) {
+        return true;
+    }
+
+    @Override
+    public boolean shutdownProviderInstances(PhysicalNetworkServiceProvider provider, ReservationContext context)
+            throws ConcurrentOperationException, ResourceUnavailableException {
+        return true;
+    }
+
+    @Override
+    public boolean canEnableIndividualServices() {
+        return true;
+    }
+
+    @Override
+    public boolean verifyServicesCombination(Set<Service> services) {
+        return true;
+    }
+
+    // ---- ensure-network-device ----
+
+    /**
+     * Calls the network-extension.sh script with {@code ensure-network-device} before
+     * the first network operation.  The script verifies the previously selected
+     * device is reachable (using the {@code hosts} list in the physical-network
+     * extension details) and performs failover if needed.  The returned JSON is
+     * persisted in {@code network_details} and forwarded to all subsequent calls
+     * via {@value #ARG_NETWORK_EXTENSION_DETAILS}.
+     *
+     * <p>For VPC tier networks the extension details are inherited from the VPC-level
+     * details (stored in {@code vpc_details}) so all tiers in the same VPC share
+     * the same host/namespace binding.  The script's {@code ensure-network-device}
+     * is only called at the VPC level (see {@link #ensureExtensionDetails(Vpc)}).</p>
+     */
+    protected void ensureExtensionDetails(Network network) {
+        if (network.getVpcId() != null) {
+            Vpc vpc = vpcDao.findById(network.getVpcId());
+            ensureExtensionDetails(vpc);
+            return;
+        }
+
+        // Isolated network: run ensure-network-device to select / validate the host.
+        Map<String, String> stored = networkDetailsDao.listDetailsKeyPairs(network.getId());
+        String currentDetails = stored != null
+                ? stored.getOrDefault(NETWORK_DETAIL_EXTENSION_DETAILS, "{}") : "{}";
+
+        logger.info("Ensuring network device for network {} (current={})", network, currentDetails);
+
+        Extension extension = resolveExtension(network);
+        File scriptFile = resolveScriptFile(network, extension);
+
+        JsonObject argsPayload = new JsonObject();
+        addNetworkToPayload(argsPayload, network);
+        argsPayload.addProperty("current_details", currentDetails);
+        JsonObject payload = buildNetworkScriptPayload(network, argsPayload, extension);
+
+        try {
+            Pair<Integer, String> result = executeScriptWithFilePayload(scriptFile,
+                    CMD_ENSURE_NETWORK_DEVICE, payload, "Network extension");
+            String output = result.second() != null ? result.second() : "";
+
+            if (result.first() != EXIT_CODE_SUCCESS) {
+                logger.warn("ensure-network-device exited {} for network {} — keeping current details",
+                        -1, network);
+                if ("{}".equals(currentDetails)) {
+                    networkDetailsDao.addDetail(network.getId(), NETWORK_DETAIL_EXTENSION_DETAILS, "{}", false);
+                }
+                return;
+            }
+            if (output.isEmpty()) {
+                output = "{}".equals(currentDetails) ? "{}" : currentDetails;
+            }
+            if (!output.equals(currentDetails)) {
+                logger.info("Network device updated for network {}: {}", network, output);
+                networkDetailsDao.addDetail(network.getId(), NETWORK_DETAIL_EXTENSION_DETAILS, output, false);
+            } else {
+                logger.debug("Network device unchanged for network {}: {}", network, output);
+            }
+        } catch (Exception e) {
+            logger.warn("Failed ensure-network-device for network {}: {}", network, e.getMessage());
+            if ("{}".equals(currentDetails)) {
+                networkDetailsDao.addDetail(network.getId(), NETWORK_DETAIL_EXTENSION_DETAILS, "{}", false);
+            }
+        }
+    }
+
+    /*
+    * If the network supports DHCP/DNS/UserData but not SourceNat/Gateway,
+    * an additional IP is needed on the external network to host these services.
+    * This method ensures that IP is allocated and configured on the external network and returns its address.
+     */
+    protected String ensureExtensionIp(Network network) {
+        if (networkModel.isAnyServiceSupportedInNetwork(network.getId(), this.getProvider(),
+                Service.SourceNat, Service.Gateway)) {
+            // Gateway or Source NAT will be configured on the external network
+            return network.getGateway();
+        }
+
+        if (networkModel.isAnyServiceSupportedInNetwork(network.getId(), this.getProvider(),
+                Service.Dhcp, Service.Dns, Service.UserData)) {
+                // Some extensions (e.g. OVN) handle shared-network addressing in the
+                // data plane and do not need a CloudStack-allocated placeholder IP.
+            Extension ext = extensionHelper.getExtensionByNameAndType(providerName, Extension.Type.NetworkOrchestrator);
+            if (ext != null) {
+                ExtensionDetailsVO allocateDetail =
+                        extensionDetailsDao.findDetail(ext.getId(), NETWORK_ALLOCATE_EXTENSION_IP);
+                if (allocateDetail != null && "false".equalsIgnoreCase(allocateDetail.getValue())) {
+                    logger.debug("Skipping placeholder IP for network {} — {} detail is false",
+                            network.getId(), NETWORK_ALLOCATE_EXTENSION_IP);
+                    return null;
+                }
+                try {
+                    // An extra IP will be allocated and configured on the external network
+                    Nic placeholderNic = networkModel.getPlaceholderNicForRouter(network, null);
+                    if (placeholderNic == null) {
+                        NetworkDetailVO routerIpDetail = networkDetailsDao.findDetail(network.getId(), ApiConstants.ROUTER_IP);
+                        String routerIp = routerIpDetail != null ? routerIpDetail.getValue() : null;
+                        Account account = accountService.getAccount(network.getAccountId());
+                        String extensionIp = Network.GuestType.Shared.equals(network.getGuestType()) ?
+                                ipAddressManager.assignPublicIpAddress(network.getDataCenterId(), null, account, Vlan.VlanType.DirectAttached, network.getId(), routerIp, false, false).getAddress().toString() :
+                                ipAddressManager.acquireGuestIpAddress(network, routerIp);
+                        logger.debug("Saving placeholder nic with ip4 address {} for the network", extensionIp, network);
+                        networkManager.savePlaceholderNic(network, extensionIp, null, VirtualMachine.Type.DomainRouter);
+                        return extensionIp;
+                    }
+                    return placeholderNic.getIPv4Address();
+                } catch (Exception e) {
+                    logger.warn("Failed to acquire extension IP for network {}: {}", network, e.getMessage());
+                }
+            }
+        }
+        return null;
+    }
+
+    // ---- IpDeployer ----
+
+    @Override
+    public boolean applyIps(Network network, List<? extends PublicIpAddress> ipAddress, Set<Service> services)
+            throws ResourceUnavailableException {
+        if (CollectionUtils.isEmpty(ipAddress)) {
+            return true;
+        }
+        logger.info("Applying {} IPs for network {}", ipAddress.size(), network);
+
+        for (PublicIpAddress ip : ipAddress) {
+            boolean isSourceNat = ip.isSourceNat();
+            boolean isRevoke = ip.getState() == IpAddress.State.Releasing;
+            String action = isRevoke ? CMD_RELEASE_IP : CMD_ASSIGN_IP;
+
+            JsonObject payload = new JsonObject();
+            addNetworkToPayload(payload, network);
+            addPublicIpToPayload(payload, ip.getId(), isSourceNat);
+
+             boolean result = executeScript(network, action, payload);
+             if (!result) {
+                 throw new ResourceUnavailableException(
+                         "Failed to " + action + " for IP " + ip.getAddress().addr(),
+                         Network.class, network.getId());
+             }
+         }
+         return true;
+     }
+
+    // ---- StaticNatServiceProvider ----
+
+    @Override
+    public boolean applyStaticNats(Network config, List<? extends StaticNat> rules)
+            throws ResourceUnavailableException {
+        if (CollectionUtils.isEmpty(rules)) {
+            return true;
+        }
+        if (!canHandle(config, Service.StaticNat)) {
+            return false;
+        }
+        logger.info("Applying {} static NAT rules for network {}", rules.size(), config);
+        for (StaticNat rule : rules) {
+            String action = rule.isForRevoke() ? CMD_DELETE_STATIC_NAT : CMD_ADD_STATIC_NAT;
+            JsonObject payload = new JsonObject();
+            addNetworkToPayload(payload, config);
+            addPublicIpToPayload(payload, rule.getSourceIpAddressId(), false);
+            payload.addProperty("private_ip", safeStr(rule.getDestIpAddress()));
+            boolean result = executeScript(config, action, payload);
+            if (!result) {
+                throw new ResourceUnavailableException("Failed to " + action + " for static NAT rule",
+                        Network.class, config.getId());
+            }
+        }
+        return true;
+    }
+
+    // ---- PortForwardingServiceProvider ----
+
+    @Override
+    public boolean applyPFRules(Network network, List<PortForwardingRule> rules)
+            throws ResourceUnavailableException {
+        if (CollectionUtils.isEmpty(rules)) {
+            return true;
+        }
+        if (!canHandle(network, Service.PortForwarding)) {
+            return false;
+        }
+        logger.info("Applying {} port forwarding rules for network {}", rules.size(), network);
+        for (PortForwardingRule rule : rules) {
+            boolean isRevoke = rule.getState() == FirewallRule.State.Revoke;
+            String action = isRevoke ? CMD_DELETE_PORT_FORWARD : CMD_ADD_PORT_FORWARD;
+            String publicPort  = PortForwardingServiceProvider.getPublicPortRange(rule);
+            String privatePort = PortForwardingServiceProvider.getPrivatePFPortRange(rule);
+            JsonObject payload = new JsonObject();
+            addNetworkToPayload(payload, network);
+            addPublicIpToPayload(payload, rule.getSourceIpAddressId(), false);
+            payload.addProperty("public_port", safeStr(publicPort));
+            payload.addProperty("private_ip", safeStr(rule.getDestinationIpAddress() != null
+                    ? rule.getDestinationIpAddress().addr() : null));
+            payload.addProperty("private_port", safeStr(privatePort));
+            payload.addProperty("protocol", safeStr(rule.getProtocol()));
+            boolean result = executeScript(network, action, payload);
+            if (!result) {
+                throw new ResourceUnavailableException("Failed to " + action + " for port forwarding rule",
+                        Network.class, network.getId());
+            }
+        }
+        return true;
+    }
+
+    // ---- Script execution ----
+
+    protected boolean executeScript(Network network, String command, JsonObject argsPayload) {
+        return executeScriptAndReturnOutput(network, command, argsPayload).first() == 0;
+    }
+
+    protected Pair<Integer, String> executeScriptAndReturnOutput(Network network, String command, JsonObject argsPayload) {
+        ensureExtensionDetails(network);
+        Extension extension = resolveExtension(network);
+        JsonObject payload = buildNetworkScriptPayload(network, argsPayload, extension);
+        return executeScriptWithFilePayload(network, command, payload);
+    }
+
+    private JsonObject parseJsonOutput(String outputStr) {
+        if (StringUtils.isBlank(outputStr)) {
+            return null;
+        }
+        try {
+            JsonElement parsed = JsonParser.parseString(outputStr);
+            if (!parsed.isJsonObject()) {
+                logger.debug("Ignoring non-object script output: {}", outputStr);
+                return null;
+            }
+            return parsed.getAsJsonObject();
+        } catch (Exception e) {
+            logger.debug("Ignoring non-JSON script output: {}", outputStr);
+            return null;
+        }
+    }
+
+    private String getJsonString(JsonObject jsonObject, String keyPath) {
+        if (jsonObject == null || StringUtils.isBlank(keyPath)) {
+            return null;
+        }
+        JsonElement value = jsonObject.has(keyPath) ? jsonObject.get(keyPath) : null;
+        if (value == null) {
+            JsonElement current = jsonObject;
+            String[] parts = keyPath.split("\\.");
+            for (String part : parts) {
+                if (current == null || !current.isJsonObject()) {
+                    current = null;
+                    break;
+                }
+                JsonObject currentObj = current.getAsJsonObject();
+                if (!currentObj.has(part)) {
+                    current = null;
+                    break;
+                }
+                current = currentObj.get(part);
+            }
+            value = current;
+        }
+        if (value == null || value.isJsonNull()) {
+            return null;
+        }
+        return value.getAsString();
+    }
+
+    private void applyNetworkUpdateFromScriptOutput(Network network, String outputStr) {
+        JsonObject outputJson = parseJsonOutput(outputStr);
+        String networkBroadcastUri = getJsonString(outputJson, "network.broadcast_uri");
+        String networkBroadcastDomainType = getJsonString(outputJson, "network.broadcast_domain_type");
+
+        if (ExtensionHelper.NETWORK_EXTENSION_GURU_NAME.equals(network.getGuruName()) &&
+                (networkBroadcastUri == null || networkBroadcastDomainType == null)) {
+            throw new CloudRuntimeException(String.format(
+                    "Script output is missing required network properties 'network.broadcast_uri' and 'network.broadcast_domain_type'" +
+                            " for network %s: %s", network, outputStr));
+        }
+
+        try {
+            NetworkVO networkVo = networkDao.findById(network.getId());
+            if (networkVo == null) {
+                return;
+            }
+
+            boolean changed = false;
+            if (networkBroadcastDomainType != null) {
+                Networks.BroadcastDomainType domainType = EnumUtils.getEnumIgnoreCase(Networks.BroadcastDomainType.class, networkBroadcastDomainType);
+                if (domainType != null) {
+                    networkVo.setBroadcastDomainType(domainType);
+                    changed = true;
+                } else {
+                    logger.warn("Ignoring unknown broadcast domain type '{}' for network {}",
+                            networkBroadcastDomainType, network);
+                }
+            }
+
+            if (networkBroadcastUri != null) {
+                networkVo.setBroadcastUri(URI.create(networkBroadcastUri));
+                changed = true;
+            }
+
+            if (changed) {
+                networkDao.update(networkVo.getId(), networkVo);
+                for (NicVO nicVO : nicDao.listByNetworkId(networkVo.getId())) {
+                    applyNicUpdateFromNetwork(networkVo, nicVO.getId());
+                }
+            }
+        } catch (Exception e) {
+            logger.warn("Failed to update network {} from script output: {}", network, e.getMessage());
+        }
+    }
+
+    protected Pair<Integer, String> executeScriptWithFilePayload(Network network, String command, JsonObject payload) {
+        Extension extension = resolveExtension(network);
+        File scriptFile = resolveScriptFile(network, extension);
+        return executeScriptWithFilePayload(scriptFile, command, payload, "Network extension");
+    }
+
+    private Pair<Integer, String> executeScriptWithFilePayload(File scriptFile, String command,
+            JsonObject payload, String logPrefix) {
+        File payloadFile = null;
+        try {
+            payloadFile = File.createTempFile("cs-extnet-" + command + "-", ".payload");
+            String payloadJson = payload != null ? new Gson().toJson(payload) : "{}";
+            logger.debug("Writing payload to payload file {}", payloadFile);
+            Files.writeString(payloadFile.toPath(), payloadJson, StandardCharsets.UTF_8);
+
+            List<String> cmdLine = new ArrayList<>();
+            cmdLine.add(scriptFile.getAbsolutePath());
+            cmdLine.add(command);
+            cmdLine.add(payloadFile.getAbsolutePath());
+            cmdLine.add(String.valueOf(DEFAULT_SCRIPT_TIMEOUT_SECONDS));
+
+            logger.debug("Executing {} script: {}", logPrefix, String.join(" ", cmdLine));
+
+            ProcessBuilder processBuilder = new ProcessBuilder(cmdLine);
+            processBuilder.redirectErrorStream(true);
+            Process process = processBuilder.start();
+            byte[] output = process.getInputStream().readAllBytes();
+            int exitCode = process.waitFor();
+
+            String outputStr = new String(output).trim();
+            if (!outputStr.isEmpty()) {
+                logger.debug("Script output: {}", outputStr);
+            }
+
+            if (exitCode != EXIT_CODE_SUCCESS) {
+                logger.error("{} script {} failed with exit code {}: {}", logPrefix, command, exitCode, outputStr);
+                return new Pair<>(exitCode, outputStr);
+            }
+
+            JsonObject outputJson = parseJsonOutput(outputStr);
+            String status = outputJson != null ? getJsonString(outputJson, "status") : null;
+            if (StringUtils.isNotBlank(status) && !"success".equalsIgnoreCase(status)) {
+                logger.error("{} script {} returned non-success status '{}': {}", logPrefix, command, status, outputStr);
+                return new Pair<>(EXIT_CODE_FAILURE, outputStr);
+            }
+
+            return new Pair<>(EXIT_CODE_SUCCESS, outputStr);
+        } catch (Exception e) {
+            throw new CloudRuntimeException(
+                    String.format("Failed preparing payload file for command %s", command), e);
+        } finally {
+            if (payloadFile != null && payloadFile.exists() && !payloadFile.delete()) {
+                payloadFile.deleteOnExit();
+            }
+        }
+    }
+
+    private JsonObject buildNetworkScriptPayload(Network network, JsonObject argsPayload, Extension extension) {
+        JsonObject payload = new JsonObject();
+        payload.add(ARG_PHYSICAL_NETWORK_EXTENSION_DETAILS,
+                buildPhysicalNetworkExtensionDetailsPayload(network.getPhysicalNetworkId(), extension));
+        payload.add(ARG_NETWORK_EXTENSION_DETAILS, buildNetworkExtensionDetailsPayload(network));
+        payload.add(ARG_PAYLOAD, argsPayload != null ? argsPayload : new JsonObject());
+        return payload;
+    }
+
+    /**
+     * Adds all standard network-level fields to the payload.
+     * Always-present: network_id, vlan, zone_id.
+     * Conditional (only when non-blank): gateway, cidr, vpc_id, and the two
+     * IPv6 network fields (network_ip6_gateway, network_ip6_cidr).
+     */
+    private void addNetworkToPayload(JsonObject payload, Network network) {
+        if (payload == null || network == null) {
+            return;
+        }
+        payload.addProperty("network_id", String.valueOf(network.getId()));
+        payload.addProperty("vlan", safeStr(getVlanId(network)));
+        payload.addProperty("zone_id", String.valueOf(network.getDataCenterId()));
+        if (network.getGuestType() != null) {
+            payload.addProperty("guest_type", network.getGuestType().toString().toLowerCase());
+        }
+        if (network.getState() != null) {
+            payload.addProperty("network_state", network.getState().toString().toLowerCase());
+        }
+        if (StringUtils.isNotBlank(network.getGateway())) {
+            payload.addProperty("gateway", safeStr(network.getGateway()));
+        }
+        if (StringUtils.isNotBlank(network.getCidr())) {
+            payload.addProperty("cidr", safeStr(network.getCidr()));
+        }
+        if (network.getVpcId() != null) {
+            payload.addProperty("vpc_id", String.valueOf(network.getVpcId()));
+        }
+        if (StringUtils.isNotBlank(network.getIp6Gateway())) {
+            payload.addProperty("network_ip6_gateway", safeStr(network.getIp6Gateway()));
+        }
+        if (StringUtils.isNotBlank(network.getIp6Cidr())) {
+            payload.addProperty("network_ip6_cidr", safeStr(network.getIp6Cidr()));
+        }
+    }
+
+    /**
+     * Adds all standard VPC-level fields to the payload.
+     * Always-present: vpc_id, zone_id.
+     * Conditional (only when non-null / non-blank): vpc_state, vpc_cidr.
+     */
+    private void addVpcToPayload(JsonObject payload, Vpc vpc) {
+        if (payload == null || vpc == null) {
+            return;
+        }
+        payload.addProperty("vpc_id", String.valueOf(vpc.getId()));
+        payload.addProperty("zone_id", String.valueOf(vpc.getZoneId()));
+        if (vpc.getState() != null) {
+            payload.addProperty("vpc_state", vpc.getState().toString().toLowerCase());
+        }
+        if (StringUtils.isNotBlank(vpc.getCidr())) {
+            payload.addProperty("vpc_cidr", safeStr(vpc.getCidr()));
+        }
+    }
+
+    /**
+     * Adds all available NIC fields to the payload.
+     * Fields are added only when non-blank / non-null so the JSON stays clean.
+     * Covers: nic_id, nic_uuid, mac, ip, gateway (IPv4), netmask, default_nic,
+     * device_id, and the three IPv6 NIC fields.
+     */
+    private void addNicToPayload(JsonObject payload, NicProfile nic) {
+        if (payload == null || nic == null) {
+            return;
+        }
+        payload.addProperty("nic_id", String.valueOf(nic.getId()));
+        if (StringUtils.isNotBlank(nic.getUuid())) {
+            payload.addProperty("nic_uuid", nic.getUuid());
+        }
+        payload.addProperty("mac", safeStr(nic.getMacAddress()));
+        payload.addProperty("ip", safeStr(nic.getIPv4Address()));
+        if (StringUtils.isNotBlank(nic.getIPv4Gateway())) {
+            payload.addProperty("gateway", safeStr(nic.getIPv4Gateway()));
+        }
+        if (StringUtils.isNotBlank(nic.getIPv4Netmask())) {
+            payload.addProperty("netmask", safeStr(nic.getIPv4Netmask()));
+        }
+        payload.addProperty("default_nic", String.valueOf(nic.isDefaultNic()));
+        if (nic.getDeviceId() != null) {
+            payload.addProperty("device_id", String.valueOf(nic.getDeviceId()));
+        }
+        if (StringUtils.isNotBlank(nic.getIPv6Address())) {
+            payload.addProperty("ip6_address", safeStr(nic.getIPv6Address()));
+        }
+        if (StringUtils.isNotBlank(nic.getIPv6Gateway())) {
+            payload.addProperty("ip6_gateway", safeStr(nic.getIPv6Gateway()));
+        }
+        if (StringUtils.isNotBlank(nic.getIPv6Cidr())) {
+            payload.addProperty("ip6_cidr", safeStr(nic.getIPv6Cidr()));
+        }
+    }
+
+    /**
+     * Adds the network DNS fields to the payload: {@code dns} (comma-separated
+     * resolver list) and {@code domain} (network domain suffix).
+     */
+    private void addNetworkDnsToPayload(JsonObject payload, Network network) {
+        if (payload == null || network == null) {
+            return;
+        }
+        payload.addProperty("dns", safeStr(getNetworkDns(network)));
+        payload.addProperty("domain", safeStr(network.getNetworkDomain()));
+    }
+
+    /**
+     * Resolves the extension IP for {@code network} via {@link #ensureExtensionIp}
+     * and adds it to the payload as {@code extension_ip}.
+     */
+    private void addExtensionIpToPayload(JsonObject payload, Network network) {
+        if (payload == null || network == null) {
+            return;
+        }
+        String extensionIp = ensureExtensionIp(network);
+        if (StringUtils.isNotBlank(extensionIp)) {
+            payload.addProperty("extension_ip", extensionIp);
+        }
+    }
+
+    // ---- Detail helpers ----
+
+    /**
+     * Returns all {@code extension_resource_map_details} for the given extension
+     * on the physical network as a plain map, enriched with physical-network
+     * metadata (name, kvmnetworklabel, vmwarenetworklabel, xennetworklabel,
+     * public_kvmnetworklabel) so the wrapper script can derive bridge names and
+     * interface names without extra lookups.
+     */
+    private Map<String, String> buildPhysicalNetworkDetailsMap(Long physicalNetworkId, Extension extension) {
+        Map<String, String> details = new HashMap<>();
+        if (physicalNetworkId == null || extension == null) {
+            return details;
+        }
+        // Start with registered extension_resource_map_details
+        Map<String, String> mapDetails = extensionHelper.getAllResourceMapDetailsForExtensionOnPhysicalNetwork(
+                physicalNetworkId, extension.getId());
+        if (mapDetails != null) {
+            details.putAll(mapDetails);
+        }
+
+        // Enrich with physical-network record fields
+        PhysicalNetworkVO pn = physicalNetworkDao.findById(physicalNetworkId);
+        if (pn != null && pn.getName() != null) {
+            details.put("physicalnetworkname", pn.getName());
+        }
+
+        return details;
+    }
+
+    /**
+     * Builds the physical-network extension details as a {@link JsonObject}.
+     * Includes all {@code extension_resource_map_details} for the extension on the
+     * physical network, enriched with physical-network metadata fields.
+     */
+    private JsonObject buildPhysicalNetworkExtensionDetailsPayload(Long physicalNetworkId, Extension extension) {
+        Map<String, String> map = buildPhysicalNetworkDetailsMap(physicalNetworkId, extension);
+        JsonObject obj = new JsonObject();
+        for (Map.Entry<String, String> entry : map.entrySet()) {
+            if (entry.getValue() != null) {
+                obj.addProperty(entry.getKey(), entry.getValue());
+            }
+        }
+        return obj;
+    }
+
+    /**
+     * Returns the per-network extension-details JSON blob (the value stored under
+     * {@code NETWORK_DETAIL_EXTENSION_DETAILS} in {@code network_details} or
+     * {@code vpc_details}) as a {@link JsonObject}.
+     * Returns an empty object when no blob has been stored yet.
+     */
+    private JsonObject buildNetworkExtensionDetailsPayload(Network network) {
+        String json;
+        if (network.getVpcId() != null) {
+            Map<String, String> vpcDetails = vpcDetailsDao.listDetailsKeyPairs(network.getVpcId());
+            json = vpcDetails != null ? vpcDetails.getOrDefault(NETWORK_DETAIL_EXTENSION_DETAILS, "{}") : "{}";
+        } else {
+            Map<String, String> networkDetails = networkDetailsDao.listDetailsKeyPairs(network.getId());
+            json = networkDetails != null ? networkDetails.getOrDefault(NETWORK_DETAIL_EXTENSION_DETAILS, "{}") : "{}";
+        }
+        return parseJsonObjectOrEmpty(json);
+    }
+
+    /**
+     * Returns the VPC-level extension-details JSON blob (stored under
+     * {@code NETWORK_DETAIL_EXTENSION_DETAILS} in {@code vpc_details}) as a
+     * {@link JsonObject}.  Returns an empty object when no blob has been stored.
+     */
+    private JsonObject buildVpcExtensionDetailsPayload(long vpcId) {
+        Map<String, String> vpcDetails = vpcDetailsDao.listDetailsKeyPairs(vpcId);
+        String json = vpcDetails != null ? vpcDetails.getOrDefault(NETWORK_DETAIL_EXTENSION_DETAILS, "{}") : "{}";
+        return parseJsonObjectOrEmpty(json);
+    }
+
+    /**
+     * Builds the custom-action parameters as a {@link JsonObject}.
+     * Returns an empty object for {@code null} or empty parameter maps.
+     */
+    private JsonObject buildActionParamsPayload(Map<String, Object> parameters) {
+        JsonObject obj = new JsonObject();
+        if (MapUtils.isEmpty(parameters)) {
+            return obj;
+        }
+        for (Map.Entry<String, Object> entry : parameters.entrySet()) {
+            obj.addProperty(entry.getKey(),
+                    entry.getValue() != null ? entry.getValue().toString() : "");
+        }
+        return obj;
+    }
+
+    /**
+     * Parses a JSON string into a {@link JsonObject}.
+     * Returns an empty {@link JsonObject} when the input is {@code null}, blank,
+     * or not a valid JSON object.
+     */
+    private JsonObject parseJsonObjectOrEmpty(String json) {
+        if (StringUtils.isBlank(json)) {
+            return new JsonObject();
+        }
+        try {
+            JsonElement element = JsonParser.parseString(json);
+            return element.isJsonObject() ? element.getAsJsonObject() : new JsonObject();
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to parse JSON: " + json, e);
+        }
+    }
+
+    // ---- Custom action ----
+
+    @Override
+    public boolean canHandleCustomAction(Network network) {
+        return canHandle(network, Service.CustomAction);
+    }
+
+    /**
+     * Runs a custom action on the external network device.
+     * The custom action payload is written to a temporary file and passed to the
+     * extension script via {@link #executeScriptWithFilePayload(File, String, JsonObject, String)}.
+     */
+    @Override
+    public String runCustomAction(Network network, String actionName, Map<String, Object> parameters) {
+        Extension extension = resolveExtension(network);
+        File scriptFile = resolveScriptFile(network, extension);
+
+        JsonObject payload = buildCustomActionPayload(network, extension, actionName, parameters);
+
+        logger.info("Running custom action '{}' on network {} (extension: {}, params: {} key(s))",
+                actionName, network, extension != null ? extension.getName() : "unknown",
+                parameters != null ? parameters.size() : 0);
+
+        try {
+            Pair<Integer, String> result = executeScriptWithFilePayload(scriptFile, CMD_CUSTOM_ACTION, payload,
+                    "Network extension");
+            String outputStr = result.second() != null ? result.second().trim() : "";
+
+            if (result.first() != EXIT_CODE_SUCCESS) {
+                logger.error("Custom action '{}' on network {} failed: {}", actionName, network, outputStr);
+                return null;
+            }
+            logger.info("Custom action '{}' on network {} completed successfully", actionName, network);
+            return outputStr.isEmpty() ? "OK" : outputStr;
+        } catch (Exception e) {
+            logger.error("Failed to execute custom action '{}' on network {}: {}", actionName, network, e.getMessage());
+            throw new CloudRuntimeException(String.format("Failed to execute custom action %s on network %s", actionName, network.getUuid()), e);
+        }
+    }
+
+    @Override
+    public boolean canHandleVpcCustomAction(Vpc vpc) {
+        return resolveExtensionForVpc(vpc) != null;
+    }
+
+    /**
+     * Runs a custom action on the external network device for a VPC.
+     * The custom action payload is written to a temporary file and passed to the
+     * extension script via {@link #executeScriptWithFilePayload(File, String, JsonObject, String)}.
+     */
+    @Override
+    public String runCustomAction(Vpc vpc, String actionName, Map<String, Object> parameters) {
+        Pair<Long, Extension> physNetAndExt = resolveExtensionForVpc(vpc);
+        if (physNetAndExt == null) {
+            throw new CloudRuntimeException("No extension found for VPC " + vpc.getUuid());
+        }
+        Long physicalNetworkId = physNetAndExt.first();
+        Extension extension = physNetAndExt.second();
+        File scriptFile = resolveScriptFileForVpc(physicalNetworkId, extension);
+
+        JsonObject payload = buildCustomActionPayload(vpc, physicalNetworkId, extension, actionName, parameters);
+
+        logger.info("Running custom action '{}' on VPC {} (extension: {}, params: {} key(s))",
+                actionName, vpc, extension != null ? extension.getName() : "unknown",
+                parameters != null ? parameters.size() : 0);
+
+        try {
+            Pair<Integer, String> result = executeScriptWithFilePayload(scriptFile, CMD_CUSTOM_ACTION, payload,
+                    "VPC extension");
+            String outputStr = result.second() != null ? result.second().trim() : "";
+
+            if (result.first() != EXIT_CODE_SUCCESS) {
+                logger.error("VPC custom action '{}' on VPC {} failed: {}", actionName, vpc, outputStr);
+                return null;
+            }
+            logger.info("VPC custom action '{}' on VPC {} completed successfully", actionName, vpc);
+            return outputStr.isEmpty() ? "OK" : outputStr;
+        } catch (Exception e) {
+            logger.error("Failed to execute VPC custom action '{}' on VPC {}: {}", actionName, vpc, e.getMessage());
+            throw new CloudRuntimeException(String.format("Failed to execute VPC custom action %s on VPC %s ", actionName, vpc.getUuid()), e);
+        }
+    }
+
+    private JsonObject buildCustomActionPayload(Network network, Extension extension, String actionName,
+            Map<String, Object> parameters) {
+        JsonObject payload = new JsonObject();
+        addNetworkToPayload(payload, network);
+        payload.addProperty("action", actionName);
+        payload.add(ARG_ACTION_PARAMS, buildActionParamsPayload(parameters));
+        payload.add(ARG_PHYSICAL_NETWORK_EXTENSION_DETAILS,
+                buildPhysicalNetworkExtensionDetailsPayload(network.getPhysicalNetworkId(), extension));
+        payload.add(ARG_NETWORK_EXTENSION_DETAILS,
+                buildNetworkExtensionDetailsPayload(network));
+        return payload;
+    }
+
+    private JsonObject buildCustomActionPayload(Vpc vpc, Long physicalNetworkId, Extension extension,
+            String actionName, Map<String, Object> parameters) {
+        JsonObject payload = new JsonObject();
+        addVpcToPayload(payload, vpc);
+        payload.addProperty("action", actionName);
+        payload.add(ARG_ACTION_PARAMS, buildActionParamsPayload(parameters));
+        payload.add(ARG_PHYSICAL_NETWORK_EXTENSION_DETAILS,
+                buildPhysicalNetworkExtensionDetailsPayload(physicalNetworkId, extension));
+        payload.add(ARG_NETWORK_EXTENSION_DETAILS,
+                buildVpcExtensionDetailsPayload(vpc.getId()));
+        return payload;
+    }
+
+    // ---- Script file resolution ----
+
+    /**
+     * Resolves the executable script file from the given extension.
+     *
+     * <p>Lookup order (first match wins):</p>
+     * <ol>
+     *   <li>{@code <extensionPath>/<extensionName>.sh} — preferred convention,
+     *       e.g. for an extension named {@code network-extension} the script is
+     *       {@code network-extension.sh}.</li>
+     *   <li>{@code <extensionPath>} itself, if it is a file and is executable.</li>
+     * </ol>
+     */
+    protected File resolveScriptFile(Network network, Extension extension) {
+        Long physicalNetworkId = network.getPhysicalNetworkId();
+        if (physicalNetworkId == null) {
+            throw new CloudRuntimeException("Network " + network.getUuid() + " has no physical network");
+        }
+        if (extension == null) {
+            throw new CloudRuntimeException(
+                    "No NetworkOrchestrator extension found for network " + network.getUuid()
+                    + " on physical network " + physicalNetworkId);
+        }
+        if (!Extension.Type.NetworkOrchestrator.equals(extension.getType())) {
+            throw new CloudRuntimeException("Extension " + extension.getName() + " is not of type NetworkOrchestrator");
+        }
+        if (!Extension.State.Enabled.equals(extension.getState())) {
+            throw new CloudRuntimeException("Extension " + extension.getName() + " is not enabled");
+        }
+        if (!extension.isPathReady()) {
+            throw new CloudRuntimeException("Extension " + extension.getName() + " path is not ready");
+        }
+
+        String extensionPath = extensionHelper.getExtensionScriptPath(extension);
+        if (extensionPath == null) {
+            throw new CloudRuntimeException("Could not resolve path for extension " + extension.getName());
+        }
+
+        File extensionFile = new File(extensionPath);
+        if (extensionFile.isFile() && extensionFile.canExecute()) {
+            return extensionFile;
+        }
+
+        throw new CloudRuntimeException(
+                "No executable script found in extension path " + extensionPath + " inside the extension directory.");
+    }
+
+    // ---- Helpers ----
+
+    private String getVlanId(Network network) {
+        return network.getBroadcastUri() != null
+                ? Networks.BroadcastDomainType.getValue(network.getBroadcastUri()) : null;
+    }
+
+    private String getIpAddress(Long ipAddressId) {
+        if (ipAddressId == null) {
+            return "";
+        }
+        IpAddress ip = networkModel.getIp(ipAddressId);
+        return ip != null ? ip.getAddress().addr() : "";
+    }
+
+    /**
+     * Adds all standard public-IP fields to the payload.
+     * Makes exactly two DB calls: one for the {@link IpAddress} and one for
+     * its {@link VlanVO}. All five fields are then derived from those two
+     * objects in memory — no further DB calls are made.
+     * Fields: {@code public_ip}, {@code public_vlan}, {@code public_gateway},
+     * {@code public_cidr}, {@code source_nat}.
+     */
+    private void addPublicIpToPayload(JsonObject payload, Long ipAddressId, boolean sourceNat) {
+        if (payload == null || ipAddressId == null) {
+            return;
+        }
+        IpAddress ip = networkModel.getIp(ipAddressId);
+        if (ip == null || ip.getAddress() == null) {
+            return;
+        }
+        VlanVO vlan = vlanDao.findById(ip.getVlanId());
+        payload.addProperty("public_ip", safeStr(ip.getAddress().addr()));
+        payload.addProperty("public_vlan", vlan != null ? safeStr(vlan.getVlanTag()) : "");
+        payload.addProperty("public_gateway", vlan != null ? safeStr(vlan.getVlanGateway()) : "");
+        payload.addProperty("public_cidr", vlan != null
+                ? StringUtils.defaultString(NetUtils.ipAndNetMaskToCidr(ip.getAddress().addr(), vlan.getVlanNetmask())) : "");
+        payload.addProperty("source_nat", String.valueOf(sourceNat));
+    }
+
+    private String safeStr(String value) {
+        return value != null ? value : "";
+    }
+
+    // ---- DhcpServiceProvider ----
+
+    private String getNetworkDns(final Network network) {
+        final DataCenter dc = dataCenterDao.findById(network.getDataCenterId());
+        Pair<String, String> dnsList = networkModel.getNetworkIp4Dns(network, dc);
+        return dnsList.first() + (dnsList.second() != null ? "," + dnsList.second() : "");
+    }
+
+    @Override
+    public boolean addDhcpEntry(Network network, NicProfile nic, VirtualMachineProfile vm,
+            DeployDestination dest, ReservationContext context)
+            throws ConcurrentOperationException, InsufficientCapacityException, ResourceUnavailableException {
+        if (!canHandle(network, Service.Dhcp)) {
+            return false;
+        }
+        logger.debug("addDhcpEntry: network={} mac={} ip={} ipv6={}", network,
+                nic.getMacAddress(), nic.getIPv4Address(), nic.getIPv6Address());
+        JsonObject payload = new JsonObject();
+        addNetworkToPayload(payload, network);
+        addNicToPayload(payload, nic);
+        payload.addProperty("hostname", safeStr(vm.getHostName()));
+        addNetworkDnsToPayload(payload, network);
+        addExtensionIpToPayload(payload, network);
+        return executeScript(network, CMD_ADD_DHCP_ENTRY, payload);
+    }
+
+    @Override
+    public boolean configDhcpSupportForSubnet(Network network, NicProfile nic, VirtualMachineProfile vm,
+            DeployDestination dest, ReservationContext context)
+            throws ConcurrentOperationException, InsufficientCapacityException, ResourceUnavailableException {
+        if (!canHandle(network, Service.Dhcp)) {
+            return false;
+        }
+        logger.debug("configDhcpSupportForSubnet: network={}", network);
+        JsonObject payload = new JsonObject();
+        addNetworkToPayload(payload, network);
+        addNetworkDnsToPayload(payload, network);
+        addExtensionIpToPayload(payload, network);
+        addNicToPayload(payload, nic);
+        return executeScript(network, CMD_CONFIG_DHCP_SUBNET, payload);
+    }
+
+    @Override
+    public boolean removeDhcpSupportForSubnet(Network network) throws ResourceUnavailableException {
+        if (!canHandle(network, Service.Dhcp)) {
+            return false;
+        }
+        logger.debug("removeDhcpSupportForSubnet: network={}", network);
+        JsonObject payload = new JsonObject();
+        addNetworkToPayload(payload, network);
+        addExtensionIpToPayload(payload, network);
+        return executeScript(network, CMD_REMOVE_DHCP_SUBNET, payload);
+    }
+
+    @Override
+    public boolean setExtraDhcpOptions(Network network, long nicId, Map<Integer, String> dhcpOptions) {
+        return false;
+    }
+
+    @Override
+    public boolean removeDhcpEntry(Network network, NicProfile nic, VirtualMachineProfile vmProfile)
+            throws ResourceUnavailableException {
+        if (!canHandle(network, Service.Dhcp)) {
+            return false;
+        }
+        logger.debug("removeDhcpEntry: network={} mac={} ip={} ipv6={}", network,
+                nic.getMacAddress(), nic.getIPv4Address(), nic.getIPv6Address());
+        JsonObject payload = new JsonObject();
+        addNetworkToPayload(payload, network);
+        addNicToPayload(payload, nic);
+        addExtensionIpToPayload(payload, network);
+        return executeScript(network, CMD_REMOVE_DHCP_ENTRY, payload);
+    }
+
+    // ---- DnsServiceProvider ----
+
+    @Override
+    public boolean addDnsEntry(Network network, NicProfile nic, VirtualMachineProfile vm,
+            DeployDestination dest, ReservationContext context)
+            throws ConcurrentOperationException, InsufficientCapacityException, ResourceUnavailableException {
+        if (!canHandle(network, Service.Dns)) {
+            return false;
+        }
+        String hostname = vm.getHostName();
+        logger.debug("addDnsEntry: network={} hostname={} ip={} ipv6={}", network,
+                hostname, nic.getIPv4Address(), nic.getIPv6Address());
+        JsonObject payload = new JsonObject();
+        addNetworkToPayload(payload, network);
+        addNetworkDnsToPayload(payload, network);
+        addNicToPayload(payload, nic);
+        payload.addProperty("hostname", safeStr(hostname));
+        addExtensionIpToPayload(payload, network);
+        return executeScript(network, CMD_ADD_DNS_ENTRY, payload);
+    }
+
+    @Override
+    public boolean removeDnsEntry(Network network, NicProfile nic, VirtualMachineProfile vmProfile) throws ResourceUnavailableException {
+        if (!canHandle(network, Service.Dns)) {
+            return false;
+        }
+        logger.debug("removeDnsEntry: network={} mac={} ip={} ipv6={}", network,
+                nic.getMacAddress(), nic.getIPv4Address(), nic.getIPv6Address());
+        JsonObject payload = new JsonObject();
+        addNetworkToPayload(payload, network);
+        addNetworkDnsToPayload(payload, network);
+        addNicToPayload(payload, nic);
+        addExtensionIpToPayload(payload, network);
+        return executeScript(network, CMD_REMOVE_DNS_ENTRY, payload);
+    }
+
+    @Override
+    public boolean configDnsSupportForSubnet(Network network, NicProfile nic, VirtualMachineProfile vm,
+            DeployDestination dest, ReservationContext context)
+            throws ConcurrentOperationException, InsufficientCapacityException, ResourceUnavailableException {
+        if (!canHandle(network, Service.Dns)) {
+            return false;
+        }
+        logger.debug("configDnsSupportForSubnet: network={}", network);
+        JsonObject payload = new JsonObject();
+        addNetworkToPayload(payload, network);
+        addNetworkDnsToPayload(payload, network);
+        addExtensionIpToPayload(payload, network);
+        addNicToPayload(payload, nic);
+        return executeScript(network, CMD_CONFIG_DNS_SUBNET, payload);
+    }
+
+    @Override
+    public boolean removeDnsSupportForSubnet(Network network) throws ResourceUnavailableException {
+        if (!canHandle(network, Service.Dns)) {
+            return false;
+        }
+        logger.debug("removeDnsSupportForSubnet: network={}", network);
+        JsonObject payload = new JsonObject();
+        addNetworkToPayload(payload, network);
+        addNetworkDnsToPayload(payload, network);
+        addExtensionIpToPayload(payload, network);
+        return executeScript(network, CMD_REMOVE_DNS_SUBNET, payload);
+    }
+
+    // ---- UserDataServiceProvider ----
+
+    @Override
+    public boolean addPasswordAndUserdata(Network network, NicProfile nic, VirtualMachineProfile profile,
+            DeployDestination dest, ReservationContext context)
+            throws ConcurrentOperationException, InsufficientCapacityException, ResourceUnavailableException {
+        if (!canHandle(network, Service.UserData)) {
+            return false;
+        }
+
+        VirtualMachine vm = profile.getVirtualMachine();
+
+        // SSH public key from VM instance details
+        String sshPublicKey = null;
+        try {
+            VMInstanceDetailVO sshKeyDetail = vmInstanceDetailsDao.findDetail(profile.getId(), VmDetailConstants.SSH_PUBLIC_KEY);
+            if (sshKeyDetail != null) {
+                sshPublicKey = sshKeyDetail.getValue();
+            }
+        } catch (Exception e) {
+            logger.debug("Could not fetch SSH public key for VM {}: {}", profile, e.getMessage());
+        }
+
+        // Service offering display name
+        String serviceOfferingName = "";
+        try {
+            serviceOfferingName = profile.getServiceOffering().getDisplayText();
+        } catch (Exception e) {
+            logger.debug("Could not fetch service offering for VM {}: {}", profile, e.getMessage());
+        }
+
+        // Is Windows guest?
+        boolean isWindows = false;
+        try {
+            isWindows = guestOSCategoryDao
+                    .findById(guestOSDao.findById(vm.getGuestOSId()).getCategoryId())
+                    .getName().equalsIgnoreCase("Windows");
+        } catch (Exception e) {
+            logger.debug("Could not determine OS type for VM {}: {}", profile, e.getMessage());
+        }
+
+        // Hypervisor hostname – prefer dest host, fall back to current host
+        String destHostname = null;
+        try {
+            if (dest != null && dest.getHost() != null) {
+                destHostname = VirtualMachineManager.getHypervisorHostname(dest.getHost().getName());
+            } else if (vm.getHostId() != null) {
+                destHostname = VirtualMachineManager.getHypervisorHostname(
+                        hostDao.findById(vm.getHostId()).getName());
+            }
+        } catch (Exception e) {
+            logger.debug("Could not resolve hypervisor hostname for VM {}: {}", profile, e.getMessage());
+        }
+
+        // Password from the VM profile parameter (set by UserVmManager before deployment)
+        String password = (String) profile.getParameter(VirtualMachineProfile.Param.VmPassword);
+
+        // Use this NIC's IP — the metadata server in each namespace identifies requesters
+        // by REMOTE_ADDR, which will be the VM's IP on THIS network (not necessarily the
+        // default NIC IP), so we always key metadata by the NIC's IP on this network.
+        String nicIpAddress = nic.getIPv4Address();
+
+        logger.debug("addPasswordAndUserdata: network={} ip={} ipv6={} hasPassword={} hasSshKey={}",
+                network.getId(), nicIpAddress, nic.getIPv6Address(),
+                StringUtils.isNotEmpty(password),
+                StringUtils.isNotEmpty(sshPublicKey));
+
+        final UserVmVO userVm = userVmDao.findById(vm.getId());
+        if (userVm == null) {
+            throw new CloudRuntimeException("Could not find UserVmVO for VM " + vm.getUuid());
+        }
+
+        // Generate the full metadata set (userdata, meta-data/*, password) in one go
+        List<String[]> vmData = networkModel.generateVmData(
+                userVm.getUserData(),
+                userVm.getUserDataDetails(),
+                serviceOfferingName,
+                vm.getDataCenterId(),
+                profile.getInstanceName(),
+                profile.getHostName(),
+                profile.getId(),
+                profile.getUuid(),
+                nicIpAddress,
+                sshPublicKey,
+                password,
+                isWindows,
+                destHostname);
+
+        if (CollectionUtils.isEmpty(vmData)) {
+            logger.debug("addPasswordAndUserdata: no VM data generated for network={} ip={} ipv6={}", network, nicIpAddress, nic.getIPv6Address());
+            return true;
+        }
+
+        JsonArray vmDataArray = new JsonArray();
+        for (String[] entry : vmData) {
+            String dir     = entry[NetworkModel.CONFIGDATA_DIR];
+            String file    = entry[NetworkModel.CONFIGDATA_FILE];
+            String content = entry.length > NetworkModel.CONFIGDATA_CONTENT
+                    ? entry[NetworkModel.CONFIGDATA_CONTENT] : null;
+            if (content == null) content = "";
+
+            String contentStr;
+            if (NetworkModel.USERDATA_DIR.equals(dir) && NetworkModel.USERDATA_FILE.equals(file)) {
+                try {
+                    contentStr = new String(Base64.getDecoder().decode(content), StandardCharsets.UTF_8);
+                } catch (Exception e) {
+                    contentStr = content;
+                }
+            } else {
+                contentStr = content;
+            }
+
+            JsonObject entryObj = new JsonObject();
+            entryObj.addProperty("dir", dir);
+            entryObj.addProperty("file", file);
+            entryObj.addProperty("content", contentStr);
+            vmDataArray.add(entryObj);
+        }
+
+        JsonObject payload = new JsonObject();
+        addNetworkToPayload(payload, network);
+        addNicToPayload(payload, nic);
+        payload.addProperty("ip", safeStr(nicIpAddress));
+        addExtensionIpToPayload(payload, network);
+        payload.add("vm_data", vmDataArray);
+
+        return executeScript(network, CMD_SAVE_VM_DATA, payload);
+    }
+
+    @Override
+    public boolean savePassword(Network network, NicProfile nic, VirtualMachineProfile vm)
+            throws ResourceUnavailableException {
+        if (!canHandle(network, Service.UserData)) {
+            return false;
+        }
+        String password = (String) vm.getParameter(VirtualMachineProfile.Param.VmPassword);
+        if (StringUtils.isEmpty(password)) {
+            return true;
+        }
+        logger.debug("savePassword: network={} ip={} ipv6={}", network, nic.getIPv4Address(), nic.getIPv6Address());
+        JsonObject payload = new JsonObject();
+        addNetworkToPayload(payload, network);
+        addNicToPayload(payload, nic);
+        payload.addProperty("password", password);
+        addExtensionIpToPayload(payload, network);
+        return executeScript(network, CMD_SAVE_PASSWORD, payload);
+    }
+
+    @Override
+    public boolean saveUserData(Network network, NicProfile nic, VirtualMachineProfile vm)
+            throws ResourceUnavailableException {
+        if (!canHandle(network, Service.UserData)) {
+            return false;
+        }
+        String userData = null;
+        if (vm.getVirtualMachine() instanceof UserVm) {
+            userData = ((UserVm) vm.getVirtualMachine()).getUserData();
+        }
+        if (StringUtils.isEmpty(userData)) {
+            return true;
+        }
+        logger.debug("saveUserData: network={} ip={} ipv6={}", network, nic.getIPv4Address(), nic.getIPv6Address());
+        String userDataDecoded;
+        try {
+            userDataDecoded = new String(Base64.getDecoder().decode(userData), StandardCharsets.UTF_8);
+        } catch (Exception e) {
+            userDataDecoded = userData;
+        }
+        JsonObject payload = new JsonObject();
+        addNetworkToPayload(payload, network);
+        addNicToPayload(payload, nic);
+        payload.addProperty("userdata", userDataDecoded);
+        addExtensionIpToPayload(payload, network);
+        return executeScript(network, CMD_SAVE_USERDATA, payload);
+    }
+
+    @Override
+    public boolean saveSSHKey(Network network, NicProfile nic, VirtualMachineProfile vm,
+            String sshPublicKey) throws ResourceUnavailableException {
+        if (!canHandle(network, Service.UserData)) {
+            return false;
+        }
+        if (StringUtils.isEmpty(sshPublicKey)) {
+            return true;
+        }
+        logger.debug("saveSSHKey: network={} ip={} ipv6={}", network, nic.getIPv4Address(), nic.getIPv6Address());
+        JsonObject payload = new JsonObject();
+        addNetworkToPayload(payload, network);
+        addNicToPayload(payload, nic);
+        payload.addProperty("sshkey", sshPublicKey);
+        addExtensionIpToPayload(payload, network);
+        return executeScript(network, CMD_SAVE_SSHKEY, payload);
+    }
+
+    @Override
+    public boolean saveHypervisorHostname(NicProfile nic, Network network, VirtualMachineProfile vm,
+            DeployDestination dest) throws ResourceUnavailableException {
+        if (!canHandle(network, Service.UserData)) {
+            return false;
+        }
+        String hostname = dest != null && dest.getHost() != null ? dest.getHost().getName() : null;
+        if (StringUtils.isBlank(hostname)) {
+            return true;
+        }
+        logger.debug("saveHypervisorHostname: network={} ip={} ipv6={} host={}", network,
+                nic.getIPv4Address(), nic.getIPv6Address(), hostname);
+        JsonObject payload = new JsonObject();
+        addNetworkToPayload(payload, network);
+        addNicToPayload(payload, nic);
+        payload.addProperty("hypervisor_hostname", hostname);
+        addExtensionIpToPayload(payload, network);
+        return executeScript(network, CMD_SAVE_HYPERVISOR_HOSTNAME, payload);
+    }
+
+    // ---- LoadBalancingServiceProvider ----
+
+    @Override
+    public boolean applyLBRules(Network network, List<LoadBalancingRule> rules)
+            throws ResourceUnavailableException {
+        if (CollectionUtils.isEmpty(rules)) {
+            return true;
+        }
+        if (!canHandle(network, Service.Lb)) {
+            return false;
+        }
+        logger.info("Applying {} LB rules for network {}", rules.size(), network);
+
+        JsonArray lbRulesArray = new JsonArray();
+        for (LoadBalancingRule rule : rules) {
+            boolean revoke = rule.getState() == FirewallRule.State.Revoke;
+            JsonObject ruleObj = new JsonObject();
+            ruleObj.addProperty("id", rule.getId());
+            ruleObj.addProperty("name", rule.getName());
+            ruleObj.addProperty("publicIp", rule.getSourceIp() != null ? rule.getSourceIp().addr() : "");
+            ruleObj.addProperty("publicPort", rule.getSourcePortStart());
+            ruleObj.addProperty("privatePort", rule.getDefaultPortStart());
+            ruleObj.addProperty("protocol", safeStr(rule.getProtocol()));
+            ruleObj.addProperty("algorithm", safeStr(rule.getAlgorithm()));
+            ruleObj.addProperty("revoke", revoke);
+            JsonArray backendsArray = buildLBRuleBackendArray(rule);
+            ruleObj.add("backends", backendsArray);
+            lbRulesArray.add(ruleObj);
+        }
+
+        JsonObject payload = new JsonObject();
+        addNetworkToPayload(payload, network);
+        payload.add("lb_rules", lbRulesArray);
+        boolean result = executeScript(network, CMD_APPLY_LB_RULES, payload);
+        if (!result) {
+            throw new ResourceUnavailableException("Failed to apply LB rules for network " + network.getUuid(),
+                    Network.class, network.getId());
+        }
+        return true;
+    }
+
+    private static JsonArray buildLBRuleBackendArray(LoadBalancingRule rule) {
+        JsonArray backendsArray = new JsonArray();
+        if (rule.getDestinations() != null) {
+            for (LoadBalancingRule.LbDestination dest : rule.getDestinations()) {
+                JsonObject destObj = new JsonObject();
+                destObj.addProperty("ip", dest.getIpAddress());
+                destObj.addProperty("port", dest.getDestinationPortStart());
+                destObj.addProperty("revoked", dest.isRevoked());
+                backendsArray.add(destObj);
+            }
+        }
+        return backendsArray;
+    }
+
+    @Override
+    public boolean validateLBRule(Network network, LoadBalancingRule rule) {
+        // Delegate validation to the external script; accept by default
+        return true;
+    }
+
+    @Override
+    public List<LoadBalancerTO> updateHealthChecks(Network network,
+                                                   List<LoadBalancingRule> lbrules) {
+        // Health-check state updates are not implemented via this path
+        return new ArrayList<>();
+    }
+
+    @Override
+    public boolean handlesOnlyRulesInTransitionState() {
+        return false;
+    }
+
+    @Override
+    public IpDeployer getIpDeployer(Network network) {
+        // This element itself implements IpDeployer; return this instance.
+        return this;
+    }
+
+    @Override
+    public boolean rollingRestartSupported() {
+        return false;
+    }
+
+    /**
+     * Applies all active firewall rules for a network to the external network device.
+     *
+     * <p>Three categories of rules are handled:</p>
+     * <ol>
+     *   <li><b>Egress rules</b> ({@link FirewallRule.TrafficType#Egress}) — control outbound
+     *       traffic from guest VMs.  The network offering's {@code egressDefaultPolicy} flag
+     *       is consulted:
+     *       <ul>
+     *         <li>{@code true}  (ALLOW by default) — each egress rule becomes a DROP rule;
+     *             a catch-all ACCEPT is appended at the end.</li>
+     *         <li>{@code false} (DENY by default) — each egress rule becomes an ACCEPT rule;
+     *             a catch-all DROP is appended at the end.</li>
+     *       </ul>
+     *   </li>
+     *   <li><b>Ingress rules</b> ({@link FirewallRule.TrafficType#Ingress}) on public IPs
+     *       (static NAT, port-forwarding, LB, …) — control inbound access to a specific
+     *       public IP.  The wrapper script uses {@code conntrack --ctorigdst} to match the
+     *       original pre-DNAT destination, so no private-IP lookup is required and all
+     *       DNAT-based services (static-NAT, port-forwarding, LB) are handled uniformly.</li>
+     *   <li><b>Default egress policy</b> — always conveyed via the JSON payload so the
+     *       script can enforce it even when the explicit rule list is empty.</li>
+     * </ol>
+     *
+     * <p><b>Full-state rebuild semantics:</b>
+     * {@code applyFWRules} is called with a <em>narrow</em> scope — the firewall manager
+     * passes only the rules for one public IP ({@code applyIngressFirewallRules}) or only
+     * the egress rules ({@code applyEgressFirewallRules}) per call.  The script, however,
+     * rebuilds the entire firewall chain from scratch each time it runs.  To avoid wiping
+     * the rules for other IPs on every call, this method ignores the {@code rules} parameter
+     * and instead queries the database for <em>all</em> active (non-revoked, non-System)
+     * {@link FirewallRule.Purpose#Firewall} rules for the network.</p>
+     *
+     * <p>Script command: {@code apply-fw-rules}</p>
+     */
+    @Override
+    public boolean applyFWRules(Network network, List<? extends FirewallRule> rules)
+            throws ResourceUnavailableException {
+        if (!canHandle(network, Service.Firewall)) {
+            return false;
+        }
+
+        // Determine default egress policy from the network offering.
+        // true  = ALLOW (default permissive; explicit rules are deny-rules)
+        // false = DENY  (default restrictive; explicit rules are allow-rules)
+        NetworkOfferingVO offering = networkOfferingDao.findById(network.getNetworkOfferingId());
+        boolean defaultEgressAllow = offering == null || offering.isEgressDefaultPolicy();
+
+        // Load ALL active (non-revoked) firewall rules for this network from the DB.
+        // applyFWRules is called in a narrow scope (only one public IP's ingress rules, or
+        // only egress rules per call), but the script does a full rebuild of the firewall
+        // chain.  Querying the DB ensures every call produces a complete, correct chain.
+        List<FirewallRuleVO> allRules = firewallRulesDao.listByNetworkAndPurposeAndNotRevoked(
+                network.getId(), FirewallRule.Purpose.Firewall);
+        // Skip System-type rules — the default egress policy is already conveyed by
+        // "default_egress_allow".  System rules are transient (not stored in DB), but
+        // guard here anyway in case of future changes.
+        allRules = allRules.stream()
+                .filter(r -> !FirewallRule.FirewallRuleType.System.equals(r.getType()))
+                .collect(Collectors.toList());
+
+        for (FirewallRuleVO r : allRules) {
+            firewallRulesDao.loadSourceCidrs(r);
+            firewallRulesDao.loadDestinationCidrs(r);
+        }
+
+        logger.info("applyFWRules: network={} activeRules={} defaultEgressAllow={}",
+                network, allRules.size(), defaultEgressAllow);
+
+        JsonObject fwRules = new JsonObject();
+        fwRules.addProperty("default_egress_allow", defaultEgressAllow);
+        fwRules.addProperty("cidr", safeStr(network.getCidr()));
+        JsonArray rulesArray = new JsonArray();
+        for (FirewallRuleVO rule : allRules) {
+            boolean isEgress = FirewallRule.TrafficType.Egress.equals(rule.getTrafficType());
+            JsonObject ruleObj = new JsonObject();
+            ruleObj.addProperty("id", rule.getId());
+            ruleObj.addProperty("type", isEgress ? "egress" : "ingress");
+            ruleObj.addProperty("protocol", safeStr(rule.getProtocol()));
+            if (rule.getSourcePortStart() != null) ruleObj.addProperty("portStart", rule.getSourcePortStart());
+            if (rule.getSourcePortEnd() != null) ruleObj.addProperty("portEnd", rule.getSourcePortEnd());
+            if (rule.getIcmpType() != null) ruleObj.addProperty("icmpType", rule.getIcmpType());
+            if (rule.getIcmpCode() != null) ruleObj.addProperty("icmpCode", rule.getIcmpCode());
+            // For ingress rules include the public IP the rule is associated with.
+            if (!isEgress) ruleObj.addProperty("publicIp", getIpAddress(rule.getSourceIpAddressId()));
+            // sourceCidrs: for ingress = allowed external source IPs;
+            //              for egress  = allowed VM source IP ranges
+            JsonArray sourceCidrsArray = new JsonArray();
+            List<String> sourceCidrs = rule.getSourceCidrList();
+            if (CollectionUtils.isNotEmpty(sourceCidrs)) {
+                for (String cidr : sourceCidrs) sourceCidrsArray.add(cidr);
+            }
+            ruleObj.add("sourceCidrs", sourceCidrsArray);
+            // destCidrs: optional destination CIDR filter (meaningful for egress rules)
+            JsonArray destCidrsArray = new JsonArray();
+            List<String> destCidrs = rule.getDestinationCidrList();
+            if (CollectionUtils.isNotEmpty(destCidrs)) {
+                for (String cidr : destCidrs) destCidrsArray.add(cidr);
+            }
+            ruleObj.add("destCidrs", destCidrsArray);
+            rulesArray.add(ruleObj);
+        }
+        fwRules.add("rules", rulesArray);
+
+        JsonObject payload = new JsonObject();
+        addNetworkToPayload(payload, network);
+        payload.add("fw_rules", fwRules);
+
+        boolean result = executeScript(network, CMD_APPLY_FW_RULES, payload);
+        if (!result) {
+            throw new ResourceUnavailableException(
+                    "Failed to apply firewall rules for network " + network,
+                    Network.class, network.getId());
+        }
+        return true;
+    }
+
+    // ---- AggregatedCommandExecutor ----
+
+    /**
+     * Called at the start of a network-restart cycle (before rules are re-programmed).
+     * We have nothing to "start" here — the batch restore is driven by
+     * {@link #completeAggregatedExecution}.
+     */
+    @Override
+    public boolean prepareAggregatedExecution(Network network, DeployDestination dest)
+            throws ResourceUnavailableException {
+        if (!canHandle(network, null)) {
+            return true;
+        }
+        logger.debug("prepareAggregatedExecution: network={} dest={}", network, dest);
+        return true;
+    }
+
+    /**
+     * Called after all firewall/NAT/LB rules have been re-applied during a network restart.
+     *
+     * <p>Queries all active User-VM NICs on this network from the database, builds a single
+     * batch JSON payload containing DHCP/DNS/metadata entries for every VM, and sends it to
+     * the wrapper script as a single {@code restore-network} call.  This avoids N script
+     * invocations (one per VM) and instead performs the full restore in one shot.</p>
+     */
+    @Override
+    public boolean completeAggregatedExecution(Network network, DeployDestination dest)
+            throws ResourceUnavailableException {
+        if (!canHandle(network, null)) {
+            return true;
+        }
+
+        logger.debug("completeAggregatedExecution: restoring all VM network data for network={} dest={}", network, dest);
+
+        boolean dhcpEnabled     = networkModel.areServicesSupportedInNetwork(network.getId(), Service.Dhcp)
+                && networkModel.isProviderSupportServiceInNetwork(network.getId(), Service.Dhcp, getProvider());
+        boolean dnsEnabled      = networkModel.areServicesSupportedInNetwork(network.getId(), Service.Dns)
+                && networkModel.isProviderSupportServiceInNetwork(network.getId(), Service.Dns, getProvider());
+        boolean userdataEnabled = networkModel.areServicesSupportedInNetwork(network.getId(), Service.UserData)
+                && networkModel.isProviderSupportServiceInNetwork(network.getId(), Service.UserData, getProvider());
+
+        if (!dhcpEnabled && !dnsEnabled && !userdataEnabled) {
+            logger.debug("completeAggregatedExecution: no DHCP/DNS/UserData service for network={}, skipping", network);
+            return true;
+        }
+
+        // Query all active User-VM NICs on this network
+        List<NicVO> nics = nicDao.listByNetworkIdAndType(network.getId(), VirtualMachine.Type.User);
+        if (CollectionUtils.isEmpty(nics)) {
+            logger.debug("completeAggregatedExecution: no user VM NICs on network={}, skipping", network);
+            return true;
+        }
+
+        logger.info("completeAggregatedExecution: building batch restore for {} VMs on network={}",
+                nics.size(), network);
+
+        JsonObject restoreData = buildRestoreNetworkData(network, nics, dhcpEnabled, dnsEnabled, userdataEnabled);
+
+        JsonObject payload = new JsonObject();
+        addNetworkToPayload(payload, network);
+        addExtensionIpToPayload(payload, network);
+        addNetworkDnsToPayload(payload, network);
+        payload.add("restore_data", restoreData);
+
+        return executeScript(network, CMD_RESTORE_NETWORK, payload);
+    }
+
+    /**
+     * Called in the {@code finally} block of the network-restart cycle to clean up any
+     * temporary state created by {@link #prepareAggregatedExecution}.
+     * Nothing to clean up here.
+     */
+    @Override
+    public boolean cleanupAggregatedExecution(Network network, DeployDestination dest)
+            throws ResourceUnavailableException {
+        return true;
+    }
+
+    /**
+     * Builds the base64-encoded JSON payload for {@code restore-network}.
+     *
+     * <p>The JSON structure is:</p>
+     * <pre>
+     * {
+     *   "dhcp_enabled": true,
+     *   "dns_enabled":  true,
+     *   "userdata_enabled": true,
+     *   "vms": [
+     *     {
+     *       "ip":          "10.0.0.10",
+     *       "mac":         "02:00:00:00:00:01",
+     *       "hostname":    "vm-1",
+     *       "default_nic": true,
+     *       "vm_data": [
+     *         { "dir": "userdata", "file": "user-data", "content": "<plain text>" },
+     *         { "dir": "meta-data", "file": "instance-id", "content": "<plain text>" },
+     *         ...
+     *       ]
+     *     },
+     *     ...
+     *   ]
+     * }
+     * </pre>
+     *
+     * <p>Each {@code vm_data} entry has its {@code content} as a plain UTF-8 string,
+     * matching the encoding used by the per-VM {@code save-vm-data} command.</p>
+     */
+    private JsonObject buildRestoreNetworkData(Network network, List<NicVO> nics,
+            boolean dhcpEnabled, boolean dnsEnabled, boolean userdataEnabled) {
+
+        Map<Long, String> offeringNameCache = new HashMap<>();
+
+        JsonObject root = new JsonObject();
+        root.addProperty("dhcp_enabled", dhcpEnabled);
+        root.addProperty("dns_enabled", dnsEnabled);
+        root.addProperty("userdata_enabled", userdataEnabled);
+        JsonArray vmsArray = new JsonArray();
+
+        for (NicVO nic : nics) {
+            if (nic.getState() != Nic.State.Reserved && nic.getState() != Nic.State.Allocated) {
+                continue;
+            }
+            if (nic.getIPv4Address() == null || nic.getMacAddress() == null) {
+                continue;
+            }
+
+            long instanceId = nic.getInstanceId();
+
+            UserVmVO userVm = userVmDao.findById(instanceId);
+            if (userVm == null) {
+                continue;
+            }
+
+            // Per-VM data array (only if UserData service is enabled)
+            List<String[]> vmData = null;
+            if (userdataEnabled) {
+                try {
+                    // Service offering display text
+                    String offeringName = offeringNameCache.computeIfAbsent(userVm.getServiceOfferingId(), id -> {
+                        try {
+                            ServiceOfferingVO so = serviceOfferingDao.findById(id);
+                            return so != null ? so.getDisplayText() : "";
+                        } catch (Exception e) {
+                            return "";
+                        }
+                    });
+
+                    // SSH public key
+                    String sshPublicKey = null;
+                    try {
+                        VMInstanceDetailVO sshKeyDetail = vmInstanceDetailsDao.findDetail(instanceId, VmDetailConstants.SSH_PUBLIC_KEY);
+                        if (sshKeyDetail != null) {
+                            sshPublicKey = sshKeyDetail.getValue();
+                        }
+                    } catch (Exception e) {
+                        logger.debug("Could not fetch SSH key for VM {}: {}", userVm, e.getMessage());
+                    }
+
+                    // Is Windows?
+                    boolean isWindows = false;
+                    try {
+                        isWindows = guestOSCategoryDao
+                                .findByIdIncludingRemoved(guestOSDao.findByIdIncludingRemoved(userVm.getGuestOSId()).getCategoryId())
+                                .getName().equalsIgnoreCase("Windows");
+                    } catch (Exception ignored) { }
+
+                    // Hypervisor hostname from current host
+                    String destHostname = null;
+                    try {
+                        if (userVm.getHostId() != null) {
+                            destHostname = VirtualMachineManager.getHypervisorHostname(
+                                    hostDao.findById(userVm.getHostId()).getName());
+                        }
+                    } catch (Exception ignored) { }
+
+                    vmData = networkModel.generateVmData(
+                            userVm.getUserData(),
+                            userVm.getUserDataDetails(),
+                            offeringName,
+                            userVm.getDataCenterId(),
+                            userVm.getInstanceName(),
+                            userVm.getHostName(),
+                            userVm.getId(),
+                            userVm.getUuid(),
+                            nic.getIPv4Address(),
+                            sshPublicKey,
+                            null,   // password — not re-issued on restore
+                            isWindows,
+                            destHostname);
+                } catch (Exception e) {
+                    logger.warn("Could not generate vmData for VM {} on network {}: {}", userVm, network, e.getMessage());
+                }
+            }
+
+            JsonObject vmObj = new JsonObject();
+            addNetworkDnsToPayload(vmObj, network);
+            vmObj.addProperty("ip", nic.getIPv4Address());
+            vmObj.addProperty("ip6_address", safeStr(nic.getIPv6Address()));
+            vmObj.addProperty("mac", nic.getMacAddress());
+            vmObj.addProperty("nic_uuid", safeStr(nic.getUuid()));
+            vmObj.addProperty("hostname", safeStr(userVm.getHostName()));
+            vmObj.addProperty("device_id", String.valueOf(nic.getDeviceId()));
+            vmObj.addProperty("default_nic", nic.isDefaultNic());
+
+            JsonArray vmDataArray = new JsonArray();
+            if (CollectionUtils.isNotEmpty(vmData)) {
+                for (String[] entry : vmData) {
+                    String dir     = entry[NetworkModel.CONFIGDATA_DIR];
+                    String file    = entry[NetworkModel.CONFIGDATA_FILE];
+                    String content = entry.length > NetworkModel.CONFIGDATA_CONTENT
+                            ? entry[NetworkModel.CONFIGDATA_CONTENT] : null;
+                    if (content == null) content = "";
+
+                    String contentStr;
+                    if (NetworkModel.USERDATA_DIR.equals(dir) && NetworkModel.USERDATA_FILE.equals(file)) {
+                        try {
+                            contentStr = new String(Base64.getDecoder().decode(content), StandardCharsets.UTF_8);
+                        } catch (Exception e) {
+                            contentStr = content;
+                        }
+                    } else {
+                        contentStr = content;
+                    }
+
+                    JsonObject entryObj = new JsonObject();
+                    entryObj.addProperty("dir", dir);
+                    entryObj.addProperty("file", file);
+                    entryObj.addProperty("content", contentStr);
+                    vmDataArray.add(entryObj);
+                }
+            }
+            vmObj.add("vm_data", vmDataArray);
+            vmsArray.add(vmObj);
+        }
+
+        root.add("vms", vmsArray);
+        return root;
+    }
+
+    // ---- VpcProvider ----
+
+    /**
+     * Finds the extension + physical-network pair for the given VPC by scanning the
+     * physical networks in the VPC's zone for a registered NetworkOrchestrator extension.
+     * Returns {@code null} when no suitable extension is found.
+     */
+    protected Pair<Long, Extension> resolveExtensionForVpc(Vpc vpc) {
+        List<PhysicalNetworkVO> physNetworks;
+        List<NetworkVO> networks = networkDao.listByVpc(vpc.getId());
+        if (CollectionUtils.isNotEmpty(networks)) {
+            physNetworks = new ArrayList<>();
+            for (NetworkVO network : networks) {
+                PhysicalNetworkVO pn = physicalNetworkDao.findById(network.getPhysicalNetworkId());
+                if (pn != null && !physNetworks.contains(pn)) {
+                    physNetworks.add(pn);
+                }
+            }
+        } else {
+            physNetworks = physicalNetworkDao.listByZoneAndTrafficType(vpc.getZoneId(), Networks.TrafficType.Guest);
+            if (CollectionUtils.isEmpty(physNetworks)) {
+                return null;
+            }
+        }
+        for (PhysicalNetworkVO pn : physNetworks) {
+            Extension ext = extensionHelper.getExtensionForPhysicalNetworkAndProvider(pn.getId(), providerName);
+            if (ext != null) {
+                return new Pair<>(pn.getId(), ext);
+            }
+        }
+        return null;
+    }
+
+    /**
+     * Resolves the script file for a VPC-level operation (no network object required).
+     */
+    protected File resolveScriptFileForVpc(Long physicalNetworkId, Extension extension) {
+        if (physicalNetworkId == null) {
+            throw new CloudRuntimeException("No physical network ID for VPC extension");
+        }
+        if (extension == null) {
+            throw new CloudRuntimeException("No extension found for physical network " + physicalNetworkId);
+        }
+        if (!Extension.Type.NetworkOrchestrator.equals(extension.getType())) {
+            throw new CloudRuntimeException("Extension " + extension.getName() + " is not of type NetworkOrchestrator");
+        }
+        if (!Extension.State.Enabled.equals(extension.getState())) {
+            throw new CloudRuntimeException("Extension " + extension.getName() + " is not enabled");
+        }
+        if (!extension.isPathReady()) {
+            throw new CloudRuntimeException("Extension " + extension.getName() + " path is not ready");
+        }
+        String extensionPath = extensionHelper.getExtensionScriptPath(extension);
+        if (extensionPath == null) {
+            throw new CloudRuntimeException("Could not resolve path for extension " + extension.getName());
+        }
+        File extensionFile = new File(extensionPath);
+        if (extensionFile.isFile() && extensionFile.canExecute()) {
+            return extensionFile;
+        }
+        throw new CloudRuntimeException(
+                "No executable script found in extension path " + extensionPath
+                + ". Expected '" + extension.getName() + ".sh'.");
+    }
+
+    /**
+     * Calls {@code ensure-network-device} with VPC-level args (no {@code --network-id}).
+     * The returned JSON is persisted in {@code vpc_details} under key
+     * {@value #NETWORK_DETAIL_EXTENSION_DETAILS}.  VPC tier networks then inherit
+     * these details via {@link #ensureExtensionDetails(Network)}.
+     */
+    protected void ensureExtensionDetails(Vpc vpc) {
+        Map<String, String> stored = vpcDetailsDao.listDetailsKeyPairs(vpc.getId());
+        String currentDetails = stored != null
+                ? stored.getOrDefault(NETWORK_DETAIL_EXTENSION_DETAILS, "{}") : "{}";
+
+        logger.info("Ensuring extension device for VPC {} (current={})", vpc, currentDetails);
+
+        Pair<Long, Extension> physNetAndExt = resolveExtensionForVpc(vpc);
+        if (physNetAndExt == null) {
+            logger.warn("ensureExtensionDetails(vpc): no extension found for VPC {} zone {}",
+                    vpc, vpc.getZoneId());
+            return;
+        }
+        JsonObject argsPayload = new JsonObject();
+        addVpcToPayload(argsPayload, vpc);
+        argsPayload.addProperty("current_details", currentDetails);
+
+        try {
+            Pair<Integer, String> result = executeVpcScriptAndReturnOutput(vpc, CMD_ENSURE_NETWORK_DEVICE, argsPayload);
+            String output = result.second() != null ? result.second() : "";
+
+            if (result.first() != EXIT_CODE_SUCCESS) {
+                logger.warn("ensure-network-device exited {} for VPC {} — keeping current details",
+                        -1, vpc);
+                if ("{}".equals(currentDetails)) {
+                    vpcDetailsDao.addDetail(vpc.getId(), NETWORK_DETAIL_EXTENSION_DETAILS, "{}", false);
+                }
+                return;
+            }
+            if (output.isEmpty()) {
+                output = "{}".equals(currentDetails) ? "{}" : currentDetails;
+            }
+            if (!output.equals(currentDetails)) {
+                logger.info("VPC extension device updated for VPC {}: {}", vpc, output);
+                vpcDetailsDao.addDetail(vpc.getId(), NETWORK_DETAIL_EXTENSION_DETAILS, output, false);
+            } else {
+                logger.debug("VPC extension device unchanged for VPC {}: {}", vpc, output);
+            }
+        } catch (Exception e) {
+            logger.warn("Failed ensure-network-device for VPC {}: {}", vpc, e.getMessage());
+            if ("{}".equals(currentDetails)) {
+                vpcDetailsDao.addDetail(vpc.getId(), NETWORK_DETAIL_EXTENSION_DETAILS, "{}", false);
+            }
+        }
+    }
+
+    /**
+     * Executes the extension script for a VPC-level command (no tier network required).
+     * Uses VPC-level details from {@code vpc_details}.
+     */
+    protected boolean executeVpcScript(Vpc vpc, String command, JsonObject argsPayload) {
+        return executeVpcScriptAndReturnOutput(vpc, command, argsPayload).first() == EXIT_CODE_SUCCESS;
+    }
+
+    protected Pair<Integer, String> executeVpcScriptAndReturnOutput(Vpc vpc, String command, JsonObject argsPayload) {
+        Pair<Long, Extension> physNetAndExt = resolveExtensionForVpc(vpc);
+        if (physNetAndExt == null) {
+            logger.warn("executeVpcScript: no extension found for VPC {} zone {}", vpc, vpc.getZoneId());
+            return new Pair<>(EXIT_CODE_FAILURE, "No extension found for VPC " + vpc.getUuid());
+        }
+        Long physicalNetworkId = physNetAndExt.first();
+        Extension extension = physNetAndExt.second();
+        File scriptFile = resolveScriptFileForVpc(physicalNetworkId, extension);
+        try {
+            JsonObject payload = buildVpcScriptPayload(vpc, argsPayload, physicalNetworkId, extension);
+            return executeScriptWithFilePayload(scriptFile, command, payload, "VPC extension");
+        } catch (Exception e) {
+            logger.error("Failed to execute VPC extension script {}: {}", command, e.getMessage(), e);
+            throw new CloudRuntimeException("Failed to execute VPC extension script: " + command, e);
+        }
+    }
+
+    private JsonObject buildVpcScriptPayload(Vpc vpc, JsonObject argsPayload, Long physicalNetworkId, Extension extension) {
+        JsonObject payload = new JsonObject();
+        payload.add(ARG_PHYSICAL_NETWORK_EXTENSION_DETAILS,
+                buildPhysicalNetworkExtensionDetailsPayload(physicalNetworkId, extension));
+        payload.add(ARG_NETWORK_EXTENSION_DETAILS, buildVpcExtensionDetailsPayload(vpc.getId()));
+        payload.add(ARG_PAYLOAD, argsPayload != null ? argsPayload : new JsonObject());
+        return payload;
+    }
+
+    protected PublicIpAddress getVpcSourceNatIp(long vpcId) {
+        final List<IPAddressVO> ips = ipAddressDao.listByAssociatedVpc(vpcId, true);
+        if (CollectionUtils.isEmpty(ips)) {
+            return null;
+        }
+        IPAddressVO selected = null;
+        for (final IPAddressVO ip : ips) {
+            if (ip.getState() != IpAddress.State.Releasing) {
+                selected = ip;
+                break;
+            }
+        }
+        if (selected == null) {
+            selected = ips.get(0);
+        }
+
+        final VlanVO vlan = vlanDao.findById(selected.getVlanId());
+        if (vlan == null) {
+            logger.warn("No VLAN found for VPC source NAT IP {} (vpc={})", selected.getAddress(), vpcId);
+            return null;
+        }
+        return PublicIp.createFromAddrAndVlan(selected, vlan);
+    }
+
+    /**
+     * Implements the VPC by:
+     * <ol>
+     *   <li>Calling {@link #ensureExtensionDetails(Vpc)} to select a host and
+     *       save the VPC-level details (does not use any anchor tier network).</li>
+     *   <li>Calling the script's {@code implement-vpc} command to create the VPC
+     *       namespace and VPC-level networking state.</li>
+     *   <li>Applying VPC source NAT if a source-NAT IP already exists (the script's
+     *       {@code assign-ip} sets up the public veth + SNAT rule for the VPC CIDR).</li>
+     * </ol>
+     */
+    @Override
+    public boolean implementVpc(Vpc vpc, DeployDestination dest, ReservationContext context)
+            throws ConcurrentOperationException, ResourceUnavailableException, InsufficientCapacityException {
+
+        // Step 1: Ensure a VPC extension device is selected and details saved at VPC level.
+        ensureExtensionDetails(vpc);
+
+        // Step 2: Create the VPC namespace (no anchor tier network needed).
+        JsonObject implPayload = new JsonObject();
+        addVpcToPayload(implPayload, vpc);
+
+        // Include source NAT IP if already allocated, so the script can set up the
+        // VPC-level SNAT rule for the entire VPC CIDR.
+        final PublicIpAddress sourceNatIp = getVpcSourceNatIp(vpc.getId());
+        if (sourceNatIp != null) {
+            addPublicIpToPayload(implPayload, sourceNatIp.getId(), true);
+        }
+
+        return executeVpcScript(vpc, CMD_IMPLEMENT_VPC, implPayload);
+    }
+
+    /**
+     * Shuts down the VPC by:
+     * <ol>
+     *   <li>Calling {@code destroy-network} for each extension-backed VPC tier (removes
+     *       tier resources but preserves the shared VPC namespace).</li>
+     *   <li>Calling {@code shutdown-vpc} to remove the VPC namespace and state after
+     *       all tiers have been cleaned up.</li>
+     * </ol>
+     */
+    @Override
+    public boolean shutdownVpc(Vpc vpc, ReservationContext context)
+            throws ConcurrentOperationException, ResourceUnavailableException {
+        final List<? extends Network> networks = networkModel.listNetworksByVpc(vpc.getId());
+
+        boolean result = true;
+        if (networks != null) {
+            for (final Network network : networks) {
+                if (!canHandle(network, null)) {
+                    continue;
+                }
+
+                final JsonObject payload = new JsonObject();
+                addNetworkToPayload(payload, network);
+
+                final boolean tierResult = executeScript(network, CMD_DESTROY_NETWORK, payload);
+                result = result && tierResult;
+            }
+        }
+
+        // Remove the VPC namespace and VPC-level details regardless of tier result.
+        JsonObject vpcPayload = new JsonObject();
+        addVpcToPayload(vpcPayload, vpc);
+        boolean vpcResult = executeVpcScript(vpc, CMD_SHUTDOWN_VPC, vpcPayload);
+        if (vpcResult) {
+            try {
+                vpcDetailsDao.removeDetail(vpc.getId(), NETWORK_DETAIL_EXTENSION_DETAILS);
+            } catch (Exception e) {
+                logger.warn("Failed to remove VPC extension details for VPC {}: {}", vpc, e.getMessage());
+            }
+        }
+        result = result && vpcResult;
+
+        return result;
+    }
+
+    @Override
+    public boolean createPrivateGateway(PrivateGateway gateway)
+            throws ConcurrentOperationException, ResourceUnavailableException {
+        throw new UnsupportedOperationException("Private gateways are not supported by the network extension element.");
+    }
+
+    /** Private gateways are not supported by the network extension element. */
+    @Override
+    public boolean deletePrivateGateway(PrivateGateway gateway)
+            throws ConcurrentOperationException, ResourceUnavailableException {
+        throw new UnsupportedOperationException("Private gateways are not supported by the network extension element.");
+    }
+
+    /** Static routes are not supported by the network extension element. */
+    @Override
+    public boolean applyStaticRoutes(Vpc vpc, List<StaticRouteProfile> routes)
+            throws ResourceUnavailableException {
+        throw new UnsupportedOperationException("Static routes are not supported by the network extension element.");
+    }
+
+    /** ACL items on private gateways are not supported by the network extension element. */
+    @Override
+    public boolean applyACLItemsToPrivateGw(PrivateGateway gateway, List<? extends NetworkACLItem> rules)
+            throws ResourceUnavailableException {
+        throw new UnsupportedOperationException("ACL items on private gateways are not supported by the network extension element.");
+    }
+
+    @Override
+    public boolean updateVpcSourceNatIp(Vpc vpc, IpAddress address) {
+        if (vpc == null || address == null || address.getAddress() == null) {
+            logger.warn("updateVpcSourceNatIp: invalid input (vpc={}, address={})", vpc, address);
+            return false;
+        }
+
+        final JsonObject payload = new JsonObject();
+        addVpcToPayload(payload, vpc);
+        addPublicIpToPayload(payload, address.getId(), true);
+
+        final boolean result = executeVpcScript(vpc, CMD_UPDATE_VPC_SOURCE_NAT_IP, payload);
+        if (!result) {
+            logger.warn("updateVpcSourceNatIp: failed to update source NAT IP for VPC {} to {}",
+                    vpc, address.getAddress().addr());
+        }
+        return result;
+    }
+
+    /**
+     * Applies VPC network ACL rules for a VPC tier network via the script's
+     * {@code apply-network-acl} command.  Rules are serialised as a JSON array
+     * and passed via a temporary payload file.
+     *
+     * <p>Script command: {@code apply-network-acl}</p>
+     */
+    @Override
+    public boolean applyNetworkACLs(Network config, List<? extends NetworkACLItem> rules)
+            throws ResourceUnavailableException {
+        if (!canHandle(config, Service.NetworkACL)) {
+            return true;
+        }
+
+        // Rebuild the ACL chain from all non-revoked rules.
+        List<? extends NetworkACLItem> activeRules = rules == null ? List.of() :
+                rules.stream()
+                     .filter(r -> r.getState() != NetworkACLItem.State.Revoke)
+                     .collect(Collectors.toList());
+
+        logger.info("applyNetworkACLs: network={} activeRules={}", config, activeRules.size());
+
+        JsonArray aclRules = buildAclRulesArray(activeRules);
+
+        JsonObject payload = new JsonObject();
+        addNetworkToPayload(payload, config);
+        payload.add("acl_rules", aclRules);
+
+        boolean result = executeScript(config, CMD_APPLY_NETWORK_ACL, payload);
+        if (!result) {
+            throw new ResourceUnavailableException(
+                    "Failed to apply network ACL rules for network " + config.getUuid(),
+                    Network.class, config.getId());
+        }
+        return true;
+    }
+
+    /**
+     * Re-applies ACL rules for all extension-backed networks in a VPC after a rule reorder.
+     * Calls {@code apply-network-acl} for each affected network with the full ACL item list.
+     */
+    @Override
+    public boolean reorderAclRules(Vpc vpc, List<? extends Network> networks,
+            List<? extends NetworkACLItem> networkACLItems) {
+        if (CollectionUtils.isEmpty(networks)) {
+            return true;
+        }
+
+        List<? extends NetworkACLItem> activeRules = networkACLItems == null ? List.of() :
+                networkACLItems.stream()
+                               .filter(r -> r.getState() != NetworkACLItem.State.Revoke)
+                               .collect(Collectors.toList());
+
+        boolean result = true;
+        for (Network network : networks) {
+            if (!canHandle(network, Service.NetworkACL)) {
+                continue;
+            }
+            try {
+                JsonArray aclRules = buildAclRulesArray(activeRules);
+
+                JsonObject payload = new JsonObject();
+                addNetworkToPayload(payload, network);
+                payload.add("acl_rules", aclRules);
+
+                boolean r = executeScript(network, CMD_APPLY_NETWORK_ACL, payload);
+                result = result && r;
+            } catch (Exception e) {
+                logger.warn("reorderAclRules: failed for network {}: {}", network, e.getMessage());
+                result = false;
+            }
+        }
+        return result;
+    }
+
+    /**
+     * Serialises a list of {@link NetworkACLItem}s to a {@link JsonArray}
+     * suitable for passing to the {@code apply-network-acl} script command.
+     * Rules are sorted by their number (priority order).
+     */
+    private JsonArray buildAclRulesArray(List<? extends NetworkACLItem> rules) {
+        JsonArray array = new JsonArray();
+        List<? extends NetworkACLItem> sorted = rules.stream()
+                .sorted(java.util.Comparator.comparingInt(NetworkACLItem::getNumber))
+                .collect(Collectors.toList());
+        for (NetworkACLItem rule : sorted) {
+            JsonObject ruleObj = buildAclRuleObject(rule);
+            JsonArray sourceCidrsArray = new JsonArray();
+            List<String> sourceCidrs = rule.getSourceCidrList();
+            if (CollectionUtils.isNotEmpty(sourceCidrs)) {
+                for (String cidr : sourceCidrs) sourceCidrsArray.add(cidr);
+            }
+            ruleObj.add("sourceCidrs", sourceCidrsArray);
+            array.add(ruleObj);
+        }
+        return array;
+    }
+
+    private JsonObject buildAclRuleObject(NetworkACLItem rule) {
+        JsonObject ruleObj = new JsonObject();
+        ruleObj.addProperty("number", rule.getNumber());
+        ruleObj.addProperty("action", rule.getAction().name().toLowerCase());
+        ruleObj.addProperty("trafficType", rule.getTrafficType().name().toLowerCase());
+        ruleObj.addProperty("protocol", safeStr(rule.getProtocol()));
+        if (rule.getSourcePortStart() != null) ruleObj.addProperty("portStart", rule.getSourcePortStart());
+        if (rule.getSourcePortEnd() != null) ruleObj.addProperty("portEnd", rule.getSourcePortEnd());
+        if (rule.getIcmpType() != null) ruleObj.addProperty("icmpType", rule.getIcmpType());
+        if (rule.getIcmpCode() != null) ruleObj.addProperty("icmpCode", rule.getIcmpCode());
+        return ruleObj;
+    }
+}
diff --git a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/network/README.md b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/network/README.md
new file mode 100644
index 000000000000..9101a591587e
--- /dev/null
+++ b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/network/README.md
@@ -0,0 +1,1493 @@
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements.  See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership.  The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License.  You may obtain a copy of the License at
+
+   http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing,
+ software distributed under the License is distributed on an
+ "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ KIND, either express or implied.  See the License for the
+ specific language governing permissions and limitations
+ under the License.
+ -->
+
+# Network Extension Script Protocol
+
+This document describes the complete interface between Apache CloudStack's
+`NetworkExtensionElement` and the external script (Bash, Python, or any
+executable) that implements network services for a custom device.
+
+Any executable that handles the commands listed below can be registered as a
+**NetworkOrchestrator extension** and used as the provider for one or more
+CloudStack network services (DHCP, DNS, UserData, SourceNat, StaticNat,
+PortForwarding, Firewall, Lb, NetworkACL, Gateway).
+
+The reference implementation is the `network-namespace` extension at
+`extensions/network-namespace/`, which uses Linux network namespaces on KVM
+hosts.  Use it as a working example.
+
+---
+
+## Table of Contents
+
+1. [Architecture Overview](#architecture-overview)
+2. [Script Placement Convention](#script-placement-convention)
+3. [CloudStack Setup Steps](#cloudstack-setup-steps)
+4. [Always-present payload fields](#always-present-payload-fields)
+5. [Shared payload fields](#shared-payload-fields)
+6. [Command Reference](#command-reference)
+   - [ensure-network-device](#ensure-network-device)
+   - [implement-network](#implement-network)
+   - [shutdown-network](#shutdown-network)
+   - [destroy-network](#destroy-network)
+   - [implement-vpc](#implement-vpc)
+   - [shutdown-vpc](#shutdown-vpc)
+   - [update-vpc-source-nat-ip](#update-vpc-source-nat-ip)
+   - [assign-ip / release-ip](#assign-ip--release-ip)
+   - [add-static-nat / delete-static-nat](#add-static-nat--delete-static-nat)
+   - [add-port-forward / delete-port-forward](#add-port-forward--delete-port-forward)
+   - [apply-fw-rules](#apply-fw-rules)
+   - [apply-network-acl](#apply-network-acl)
+   - [prepare-nic / release-nic](#prepare-nic--release-nic)
+   - [add-dhcp-entry / remove-dhcp-entry](#add-dhcp-entry--remove-dhcp-entry)
+   - [config-dhcp-subnet / remove-dhcp-subnet](#config-dhcp-subnet--remove-dhcp-subnet)
+   - [set-dhcp-options](#set-dhcp-options)
+   - [add-dns-entry](#add-dns-entry)
+   - [config-dns-subnet / remove-dns-subnet](#config-dns-subnet--remove-dns-subnet)
+   - [save-vm-data](#save-vm-data)
+   - [save-password](#save-password)
+   - [save-userdata](#save-userdata)
+   - [save-sshkey](#save-sshkey)
+   - [save-hypervisor-hostname](#save-hypervisor-hostname)
+   - [apply-lb-rules](#apply-lb-rules)
+   - [restore-network](#restore-network)
+   - [custom-action](#custom-action)
+7. [Service-to-Command Mapping](#service-to-command-mapping)
+8. [Capabilities Configuration](#capabilities-configuration)
+9. [VPC Networks](#vpc-networks)
+10. [Extension IP](#extension-ip)
+11. [Exit Codes](#exit-codes)
+12. [Minimal Script Skeleton](#minimal-script-skeleton)
+
+---
+
+## Architecture Overview
+
+```
+CloudStack Management Server
+        │
+        │  exec  <extension-path>/<ext-name>.sh  <command>  <payload-file>  <timeout-seconds>
+        │        payload-file contains JSON for the command invocation
+        ▼
+   Your Script (Bash / Python / Go / …)
+        │
+        │  configures / queries your device:
+        │    • KVM host over SSH
+        │    • SDN controller REST API
+        │    • Hardware appliance CLI
+        │    • Cloud provider API
+        ▼
+   External Network Device
+```
+
+CloudStack calls the script synchronously (blocking process execution) on the
+**management server** for every network event.  The script is responsible for
+translating those events into configuration changes on the actual device.
+
+The script must:
+
+- **Exit 0** on success.
+- **Exit non-zero** on failure (CloudStack will log the error and may retry).
+- For `ensure-network-device` only, **print a single-line JSON object** to
+  stdout (see [ensure-network-device](#ensure-network-device)).
+
+All other commands must produce no output on stdout (any output is logged at
+DEBUG level and ignored).
+
+---
+
+## Script Placement Convention
+
+CloudStack resolves the executable in this order (first match wins):
+
+1. **`<extensionPath>/<extensionName>.sh`** — preferred convention.
+   Example: extension named `my-sdn` → script at
+   `.../my-sdn/my-sdn.sh`.
+2. **`<extensionPath>` itself**, if it is a regular file and is executable.
+
+The `<extensionPath>` is the `path` field returned by `listExtensions` after
+the extension is created.  CloudStack sets it to:
+
+```
+/usr/share/cloudstack-management/extensions/<extensionName>/
+```
+
+> **Tip:** Your script does not have to live on the management server — it can
+> be a thin proxy that SSHes into a remote appliance.  The
+> `network-namespace.sh` entry-point is exactly that: it SSHes into the target
+> KVM host and calls the wrapper script there.
+
+---
+
+## CloudStack Setup Steps
+
+### Step 1 – Create the Extension
+
+```bash
+cmk createExtension \
+    name=my-sdn \
+    type=NetworkOrchestrator \
+    details[0].network.services="SourceNat,StaticNat,PortForwarding,Firewall,Lb,Dhcp,Dns,UserData,CustomAction" \
+    details[1].network.service.capabilities="$(cat my-sdn-capabilities.json)" \
+    details[2].network.isolation.method="NetworkExtension"
+```
+
+`network.service.capabilities` is a JSON object — see
+[Capabilities Configuration](#capabilities-configuration).
+
+### Step 2 – Deploy the Script
+
+Copy your executable to the path reported by `listExtensions`:
+
+```bash
+SCRIPT_PATH=$(cmk listExtensions name=my-sdn | jq -r '.[0].path')
+# e.g. /usr/share/cloudstack-management/extensions/my-sdn/
+mkdir -p "${SCRIPT_PATH}"
+cp my-sdn.sh "${SCRIPT_PATH}/my-sdn.sh"
+chmod 755    "${SCRIPT_PATH}/my-sdn.sh"
+```
+
+If you have multiple management servers, deploy the script to **every** one.
+
+### Step 3 – Register the Extension to a Physical Network
+
+```bash
+PHYS_ID=$(cmk listPhysicalNetworks | jq -r '.[0].id')
+EXT_ID=$(cmk listExtensions name=my-sdn | jq -r '.[0].id')
+
+cmk registerExtension \
+    id=${EXT_ID} \
+    resourcetype=PhysicalNetwork \
+    resourceid=${PHYS_ID} \
+    details[0].hosts="192.168.1.10,192.168.1.11" \
+    details[1].username="root" \
+    details[2].password="s3cr3t"
+```
+
+To update the registration details later, use `updateRegisteredExtension`:
+
+```bash
+cmk updateRegisteredExtension \
+    extensionid=${EXT_ID} \
+    resourcetype=PhysicalNetwork \
+    resourceid=${PHYS_ID} \
+    details[0].hosts="192.168.1.10,192.168.1.11" \
+    details[1].username="root" \
+    details[2].password="s3cr3t"
+```
+
+Any key/value pairs you pass here are stored with the physical-network
+registration as extension metadata. The `custom-action` path embeds them
+directly into the payload file under `physical-network-extension-details`.
+The schema is entirely yours — CloudStack treats it as opaque.
+
+> **`network.isolation.method=NetworkExtension`** must be set as an Extension
+> detail (via `createExtension` or `updateExtension`).
+> This is required whenever your `implement-network` handler outputs JSON that
+> updates the network's broadcast domain type.
+> Without it the script output is accepted but silently ignored — the network
+> record in the CloudStack database is not updated.
+
+### Step 4 – Enable the Network Service Provider
+
+```bash
+NSP_ID=$(cmk listNetworkServiceProviders physicalnetworkid=${PHYS_ID} \
+         name=my-sdn | jq -r '.[0].id')
+cmk updateNetworkServiceProvider id=${NSP_ID} state=Enabled
+```
+
+### Step 5 – Create a Network Offering
+
+```bash
+cmk createNetworkOffering \
+    name="My-SDN-Offering" \
+    displaytext="My SDN network offering" \
+    guestiptype=Isolated \
+    traffictype=GUEST \
+    supportedservices="Dhcp,Dns,UserData,SourceNat,StaticNat,PortForwarding,Firewall,Lb" \
+    serviceProviderList[0].service=Dhcp           serviceProviderList[0].provider=my-sdn \
+    serviceProviderList[1].service=Dns            serviceProviderList[1].provider=my-sdn \
+    serviceProviderList[2].service=UserData       serviceProviderList[2].provider=my-sdn \
+    serviceProviderList[3].service=SourceNat      serviceProviderList[3].provider=my-sdn \
+    serviceProviderList[4].service=StaticNat      serviceProviderList[4].provider=my-sdn \
+    serviceProviderList[5].service=PortForwarding serviceProviderList[5].provider=my-sdn \
+    serviceProviderList[6].service=Firewall       serviceProviderList[6].provider=my-sdn \
+    serviceProviderList[7].service=Lb             serviceProviderList[7].provider=my-sdn \
+    serviceCapabilityList[0].service=SourceNat \
+    serviceCapabilityList[0].capabilitytype=SupportedSourceNatTypes \
+    serviceCapabilityList[0].capabilityvalue=peraccount
+cmk updateNetworkOffering id=<offering-id> state=Enabled
+```
+
+---
+
+## Always-present payload fields
+
+For all standard network / VPC commands, CloudStack now executes the script as:
+
+```text
+<extension-path>/<extension-name>.sh <command> <payload-file> <timeout-seconds>
+```
+
+`payload-file` contains a JSON object with this envelope:
+
+```json
+{
+  "physical-network-extension-details": {},
+  "network-extension-details": {},
+  "payload": {}
+}
+```
+
+| Field | Value |
+|---|---|
+| `physical-network-extension-details` | Physical-network extension metadata registered on the physical network, enriched with `physicalnetworkname`. |
+| `network-extension-details` | Additional network or VPC details stored in CloudStack and forwarded as a JSON object. |
+| `payload` | Command-specific JSON object for the command being executed. |
+
+`timeout-seconds` is currently `60`.
+
+> **Important:** `custom-action` is still the exception in shape. It uses its
+> own top-level payload structure and does **not** wrap command-specific fields
+> under a nested `payload` object. Use top-level `action-params` for
+> command-specific parameters.
+
+---
+
+## Shared payload fields
+
+The following names appear repeatedly inside the nested `payload` object.
+
+### Network-level fields (added by `addNetworkToPayload`)
+
+| Field | Description |
+|---|---|
+| `network_id` | CloudStack numeric network ID. |
+| `vlan` | Guest VLAN tag (for example `100`). Extracted from the broadcast URI. May be empty for flat networks. |
+| `zone_id` | CloudStack zone ID. |
+| `guest_type` | Guest network type: `"isolated"`, `"shared"`, or `"l2"`. Scripts should use this to skip NAT/firewall operations that are not applicable to Shared or L2 networks. |
+| `network_state` | Guest network state: `"allocated"`, `"setup"`, `"implementing"`, `"implemented"`, `"shutdown"` or `"destroy"`. |
+| `gateway` | Guest network gateway (for example `10.0.0.1`). Omitted when blank. |
+| `cidr` | Guest network CIDR (for example `10.0.0.0/24`). Omitted when blank. |
+| `vpc_id` | CloudStack numeric VPC ID. Present for VPC tier networks and VPC-scoped commands. |
+| `network_ip6_gateway` | Guest network IPv6 gateway, when the network has IPv6 configured. |
+| `network_ip6_cidr` | Guest network IPv6 CIDR, when the network has IPv6 configured. |
+
+### NIC-level fields (added by `addNicToPayload`)
+
+| Field | Description |
+|---|---|
+| `nic_id` | CloudStack numeric NIC ID. |
+| `nic_uuid` | NIC UUID — matches `external_ids:iface-id` written by the KVM agent for OVN port binding. |
+| `mac` | VM NIC MAC address. |
+| `ip` | VM NIC IPv4 address. |
+| `gateway` | VM NIC IPv4 gateway (NIC-level; equals the network gateway for normal guest networks). |
+| `netmask` | VM NIC IPv4 netmask (for example `255.255.255.0`). |
+| `default_nic` | Stringified boolean — `"false"` for secondary NICs. |
+| `device_id` | NIC device index in the VM (slot number). |
+| `ip6_address` | VM NIC IPv6 address, when the NIC has IPv6 configured. |
+| `ip6_gateway` | VM NIC IPv6 gateway, when available. |
+| `ip6_cidr` | VM NIC IPv6 CIDR, when available. |
+
+### Public-IP fields (added by `addPublicIpToPayload`)
+
+| Field | Description |
+|---|---|
+| `public_ip` | A public IP address. |
+| `public_vlan` | VLAN tag of the public IP segment. |
+| `public_gateway` | Gateway of the public IP segment. |
+| `public_cidr` | CIDR of the public IP (for example `203.0.113.0/24`). |
+| `source_nat` | Stringified boolean (`"true"` / `"false"`) indicating whether the public IP is the source-NAT IP. |
+| `private_ip` | A VM's private guest-network IP address (NAT target). |
+
+### DNS / extension-IP fields
+
+| Field | Description |
+|---|---|
+| `extension_ip` | The IP the extension device uses on the guest side. Equals the gateway when SourceNat/Gateway is provided; otherwise it is a dedicated IP from the guest subnet. |
+| `dns` | Comma-separated DNS server list. |
+| `domain` | Network domain suffix. |
+
+---
+
+## Command Reference
+
+### `ensure-network-device`
+
+**Called:** Before every network operation, automatically by
+`NetworkExtensionElement`.
+
+**Purpose:** Select (or re-validate) the device/host that will handle this
+network.  Perform failover to another host if the current one is unreachable.
+The returned JSON is stored in `network_details` under key `extension.details` and
+passed back to later `ensure-network-device` calls as `payload.current_details`.
+
+**Payload file shape:**
+
+```json
+{
+  "physical-network-extension-details": {},
+  "network-extension-details": {},
+  "payload": {
+    "network_id": "42",
+    "vlan": "100",
+    "zone_id": "1",
+    "vpc_id": "7",
+    "current_details": "{}"
+  }
+}
+```
+
+**Payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. Omitted for VPC-level calls. |
+| `vlan` | Guest VLAN. Present only for network-level calls. |
+| `zone_id` | CloudStack zone ID. |
+| `vpc_id` | VPC ID for VPC-level calls, and also present for VPC tier networks. |
+| `current_details` | Previously stored `extension.details` JSON string (`{}` on first call). |
+
+**Stdout:** A single-line JSON object.  CloudStack stores this verbatim.
+You can put any fields your script needs (host selection, device ID, segment
+ID, namespace name, etc.).
+
+```json
+{"host":"192.168.1.10","device_id":"vrf-42","namespace":"cs-net-42"}
+```
+
+**Exit 0:** JSON written to stdout is persisted.
+**Exit non-zero:** Existing details are kept unchanged; a warning is logged.
+
+---
+
+### `implement-network`
+
+**Called:** When a network is implemented (first VM deployed, or network
+restart).
+
+**Purpose:** Create / bring up the network segment on the device: create the
+virtual segment (VRF, namespace, VLAN, …), attach the guest interface, and
+configure the gateway.
+
+**Payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `vlan` | Guest VLAN tag. |
+| `gateway` | Guest network gateway. |
+| `cidr` | Guest network CIDR. |
+| `extension_ip` | Device IP on the guest network. |
+| `vpc_id` | Present for VPC tier networks. |
+
+> **IPv6 note:** For network-scoped commands that already include `gateway`/`cidr`,
+> CloudStack now also includes `network_ip6_gateway` and `network_ip6_cidr`
+> when the guest network has IPv6 configured.
+
+**Stdout (required when `network.isolation.method=NetworkExtension`):**
+
+When the Extension detail `network.isolation.method=NetworkExtension` is set,
+CloudStack selects `NetworkExtensionGuestNetworkGuru` and applies the JSON object
+printed to stdout back to the network record.  The following two fields **must**
+be present in the output so that CloudStack stores the correct broadcast type and
+URI — without them the KVM agent (`OvsVifDriver`) will not set
+`external_ids:iface-id` on the OVS tap port and OVN port-binding will fail:
+
+| Output key | Required value | Description |
+|---|---|---|
+| `network.broadcast_domain_type` | `"Lswitch"` (OVN) or appropriate type | Sets `BroadcastDomainType` on the network record. |
+| `network.broadcast_uri` | e.g. `"ovn://cs-net-<networkId>"` | Sets the broadcast URI used by the hypervisor agent. |
+
+Example stdout:
+
+```json
+{"network.broadcast_domain_type": "Lswitch", "network.broadcast_uri": "ovn://cs-net-42"}
+```
+
+> **Note:** These fields are only consumed when the Extension detail
+> `network.isolation.method=NetworkExtension` is set.  Without it, the script
+> output is accepted but the network record is **not** updated (the update is
+> silently skipped).
+
+---
+
+### `shutdown-network`
+
+**Called:** When a network is shut down (e.g., all VMs removed, before
+deletion).
+
+**Purpose:** Tear down the network segment; release resources.  The
+per-network `extension.details` blob is removed from CloudStack after a successful
+return.
+
+**Payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `vlan` | Guest VLAN tag. |
+| `vpc_id` | Present for VPC tier networks. |
+
+---
+
+### `destroy-network`
+
+**Called:** When a network is permanently deleted.
+
+**Purpose:** Same as `shutdown-network`, but called at hard-delete time.  The
+placeholder NIC IP (if any) and the `extension.details` blob are cleaned up
+automatically by CloudStack after a successful return.
+
+**Payload fields (`payload` object):** Identical to `shutdown-network`.
+
+---
+
+### `implement-vpc`
+
+**Called:** When a VPC is implemented (before any tier is set up).
+
+**Purpose:** Create the VPC-level networking state on the device (e.g., a
+shared namespace or VRF that all tiers will attach to).  If a source-NAT IP
+is already allocated for the VPC, its details are also included so the script
+can set up the VPC-level SNAT rule at this stage.
+
+**Payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `vpc_id` | VPC ID. |
+| `vpc_cidr` | VPC supernet CIDR. |
+| `public_ip` | Source-NAT IP, when already allocated. |
+| `public_vlan` | VLAN of the source-NAT IP, when present. |
+| `public_gateway` | Gateway of the source-NAT IP segment, when present. |
+| `public_cidr` | CIDR of the source-NAT IP, when present. |
+| `source_nat` | `"true"` when the public IP fields are present. |
+
+---
+
+### `shutdown-vpc`
+
+**Called:** During `shutdownVpc` after all tier networks have been destroyed.
+
+**Purpose:** Remove the VPC-level namespace / VRF and all associated state.
+The `extension.details` blob is removed from CloudStack after a successful return.
+
+**Payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `vpc_id` | VPC ID. |
+
+---
+
+### `update-vpc-source-nat-ip`
+
+**Called:** When the VPC source-NAT IP changes
+(`updateVpcSourceNatIp` API).
+
+**Purpose:** Update the VPC-level SNAT rule to point to the new public IP.
+
+**Payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `vpc_id` | VPC ID. |
+| `vpc_cidr` | VPC supernet CIDR. |
+| `public_ip` | New source-NAT IP. |
+| `public_vlan` | VLAN of the new source-NAT IP. |
+| `public_gateway` | Gateway of the new source-NAT IP segment. |
+| `public_cidr` | CIDR of the new source-NAT IP. |
+| `source_nat` | Always `"true"`. |
+
+---
+
+### `assign-ip` / `release-ip`
+
+**Called:** When a public IP is associated with or disassociated from a
+network (source NAT, static NAT, PF, LB allocation).
+
+**Purpose:**
+- `assign-ip` — attach the public IP to the device; add the necessary routing
+  entry so the device can receive traffic for this IP.
+- `release-ip` — detach the public IP; remove routing.
+
+**Payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `vlan` | Guest VLAN. |
+| `public_ip` | The public IP being assigned or released. |
+| `source_nat` | `"true"` if this is the source NAT IP. |
+| `gateway` | Guest network gateway. |
+| `cidr` | Guest network CIDR. |
+| `public_gateway` | Gateway of the public IP segment. |
+| `public_cidr` | CIDR of the public IP. |
+| `public_vlan` | Public VLAN tag. |
+| `vpc_id` | Present for VPC tier networks. |
+
+---
+
+### `add-static-nat` / `delete-static-nat`
+
+**Called:** When a static NAT rule is created or deleted
+(`enableStaticNat` / `disableStaticNat` API).
+
+**Purpose:** Configure a 1:1 bidirectional NAT mapping between a public IP
+and a VM private IP.
+
+**Payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `vlan` | Guest VLAN tag. |
+| `public_ip` | Public IP. |
+| `public_cidr` | Public IP CIDR. |
+| `public_vlan` | Public VLAN tag. |
+| `private_ip` | VM private IP (DNAT destination). |
+| `vpc_id` | Present for VPC tier networks. |
+
+---
+
+### `add-port-forward` / `delete-port-forward`
+
+**Called:** When a port forwarding rule is created or deleted
+(`createPortForwardingRule` / `deletePortForwardingRule` API).
+
+**Purpose:** Configure a DNAT rule from `public-ip:public-port` to
+`private-ip:private-port`.
+
+**Payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `vlan` | Guest VLAN tag. |
+| `public_ip` | Public IP. |
+| `public_cidr` | Public IP CIDR. |
+| `public_vlan` | Public VLAN tag. |
+| `public_port` | Port range on the public IP, for example `22` or `8080-8090`. |
+| `private_ip` | VM private IP. |
+| `private_port` | Destination port range on the VM. |
+| `protocol` | Protocol such as `tcp` or `udp`. |
+| `vpc_id` | Present for VPC tier networks. |
+
+---
+
+### `apply-fw-rules`
+
+**Called:** When any firewall rule is created, deleted, or updated for the
+network (`createFirewallRule`, `deleteFirewallRule`, `updateEgressFirewallRule`
+APIs, and during network restart).
+
+**Purpose:** Rebuild the entire firewall policy for the network from scratch.
+CloudStack calls this with a *narrow* scope (one IP's ingress rules or egress
+rules per call), but the `fw_rules` payload field always contains **all** active
+rules for the network, so a full rebuild is always safe.
+
+**Payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `vlan` | Guest VLAN tag. |
+| `gateway` | Guest network gateway. |
+| `cidr` | Guest network CIDR. |
+| `fw_rules` | JSON object containing the firewall payload shown below. |
+| `vpc_id` | Present for VPC tier networks. |
+
+**`fw_rules` JSON:**
+
+```json
+{
+  "default_egress_allow": true,
+  "cidr": "10.0.0.0/24",
+  "rules": [
+    {
+      "id": 1,
+      "type": "ingress",
+      "protocol": "tcp",
+      "portStart": 22,
+      "portEnd": 22,
+      "publicIp": "203.0.113.5",
+      "sourceCidrs": ["0.0.0.0/0"],
+      "destCidrs": []
+    },
+    {
+      "id": 2,
+      "type": "egress",
+      "protocol": "icmp",
+      "icmpType": -1,
+      "icmpCode": -1,
+      "sourceCidrs": [],
+      "destCidrs": []
+    }
+  ]
+}
+```
+
+| Field | Description |
+|---|---|
+| `default_egress_allow` | `true` = permissive egress by default (explicit rules are deny rules); `false` = restrictive (explicit rules are allow rules). |
+| `cidr` | Guest network CIDR. |
+| `rules[].type` | `"ingress"` or `"egress"`. |
+| `rules[].protocol` | `"tcp"`, `"udp"`, `"icmp"`, `"all"`. |
+| `rules[].portStart` / `portEnd` | TCP/UDP port range (absent for ICMP/all). |
+| `rules[].icmpType` / `icmpCode` | ICMP type/code (`-1` = any; absent for TCP/UDP). |
+| `rules[].publicIp` | For ingress: the public IP the rule applies to. |
+| `rules[].sourceCidrs` | Allowed source IP ranges (ingress: external; egress: VM). |
+| `rules[].destCidrs` | Allowed destination IP ranges (egress only). |
+
+---
+
+### `apply-network-acl`
+
+**Called:** When a VPC network ACL is applied to a tier network
+(`createNetworkACLList`, `replaceNetworkACLList`, `updateNetworkACLItem`,
+`moveNetworkAclItem` APIs, and during network restart).
+
+**Purpose:** Rebuild the entire ACL policy for the VPC tier from scratch.
+Rules are applied in ascending `number` order.
+
+**Payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `vlan` | Guest VLAN tag. |
+| `gateway` | Guest network gateway. |
+| `cidr` | Guest network CIDR. |
+| `acl_rules` | JSON array of ACL rules shown below. |
+| `vpc_id` | VPC ID. Always present for VPC tiers. |
+
+**`acl_rules` JSON:**
+
+```json
+[
+  {
+    "number":      10,
+    "action":      "allow",
+    "trafficType": "ingress",
+    "protocol":    "tcp",
+    "portStart":   22,
+    "portEnd":     22,
+    "sourceCidrs": ["0.0.0.0/0"]
+  },
+  {
+    "number":      20,
+    "action":      "deny",
+    "trafficType": "egress",
+    "protocol":    "all",
+    "sourceCidrs": []
+  }
+]
+```
+
+| Field | Description |
+|---|---|
+| `number` | Rule priority (lower number = higher priority). |
+| `action` | `"allow"` or `"deny"`. |
+| `trafficType` | `"ingress"` or `"egress"`. |
+| `protocol` | `"tcp"`, `"udp"`, `"icmp"`, `"all"`. |
+| `portStart` / `portEnd` | TCP/UDP port range (absent for ICMP/all). |
+| `icmpType` / `icmpCode` | ICMP type/code (absent for TCP/UDP). |
+| `sourceCidrs` | Source CIDR filter list. |
+
+---
+
+### `prepare-nic` / `release-nic`
+
+**Called:** On every NIC attach (`prepare`) and detach (`release`) regardless
+of which services the extension provides.
+
+**Purpose:**
+- `prepare-nic` — set up per-NIC state before the VM boots: create the port
+  binding on the device (OVN `Logical_Switch_Port`, dnsmasq entry, …).
+- `release-nic` — tear down per-NIC state after the VM is destroyed: remove the
+  port binding and associated metadata.
+
+These commands fire for **all** NICs on extension-managed networks, not just
+those belonging to DHCP/DNS-enabled offerings.
+
+**`prepare-nic` payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `vlan` | Guest VLAN tag. |
+| `mac` | VM NIC MAC address. |
+| `ip` | VM NIC IPv4 address. |
+| `nic_ip6_address` | NIC IPv6 address, when configured. |
+| `nic_ip6_gateway` | NIC IPv6 gateway, when available. |
+| `nic_ip6_cidr` | NIC IPv6 CIDR, when available. |
+| `nic_uuid` | NIC UUID — matches `external_ids:iface-id` written by the KVM agent for OVN port binding. |
+| `default_nic` | Stringified boolean — `"false"` for secondary NICs. |
+| `hostname` | VM hostname. |
+| `gateway` | Guest network gateway. |
+| `cidr` | Guest network CIDR. |
+| `extension_ip` | Extension IP. |
+| `vpc_id` | Present for VPC tier networks. |
+
+**`release-nic` payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `vlan` | Guest VLAN tag. |
+| `mac` | VM NIC MAC address. |
+| `ip` | VM NIC IPv4 address. |
+| `nic_ip6_address` | NIC IPv6 address, when configured. |
+| `nic_ip6_gateway` | NIC IPv6 gateway, when available. |
+| `nic_ip6_cidr` | NIC IPv6 CIDR, when available. |
+| `nic_uuid` | NIC UUID. |
+| `extension_ip` | Extension IP. |
+| `vpc_id` | Present for VPC tier networks. |
+
+---
+
+### `add-dhcp-entry` / `remove-dhcp-entry`
+
+**Called:** When a VM NIC is reserved (`add`) or released (`remove`) on a
+network whose DHCP service is provided by this extension.
+
+**Purpose:** Add or remove a static DHCP lease for the VM.
+
+> **IPv6 note:** For NIC-scoped commands (`add/remove-dhcp-entry`,
+> `add-dns-entry`, `save-vm-data`, `save-password`, `save-userdata`,
+> `save-sshkey`, `save-hypervisor-hostname`), CloudStack includes
+> `nic_ip6_address`, `nic_ip6_gateway`, and `nic_ip6_cidr` when the NIC
+> has IPv6 information.
+
+**`add-dhcp-entry` payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `mac` | VM NIC MAC address, for example `02:00:00:00:00:01`. |
+| `ip` | VM assigned IP. |
+| `hostname` | VM hostname. |
+| `gateway` | Guest network gateway. |
+| `cidr` | Guest network CIDR. |
+| `dns` | Comma-separated DNS server list. |
+| `default_nic` | Stringified boolean indicating whether this NIC is the default NIC. |
+| `domain` | Network domain suffix. |
+| `extension_ip` | Extension IP. |
+| `nic_uuid` | NIC UUID, when available. |
+| `vpc_id` | Present for VPC tier networks. |
+
+**`remove-dhcp-entry` payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `mac` | VM NIC MAC address. |
+| `ip` | VM assigned IP. |
+| `extension_ip` | Extension IP. |
+| `nic_uuid` | NIC UUID, when available. |
+| `vpc_id` | Present for VPC tier networks. |
+
+---
+
+### `config-dhcp-subnet` / `remove-dhcp-subnet`
+
+**Called:** When a shared-network subnet is configured or removed.
+
+**Purpose:** Configure the DHCP scope (pool, gateway, DNS) for a subnet
+without tying it to a specific VM.
+
+**`config-dhcp-subnet` payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `gateway` | Guest network gateway. |
+| `cidr` | Guest network CIDR. |
+| `dns` | Comma-separated DNS server list. |
+| `vlan` | Guest VLAN tag. |
+| `domain` | Network domain suffix. |
+| `extension_ip` | Extension IP. |
+| `nic_uuid` | NIC UUID, when available. |
+| `vpc_id` | Present for VPC tier networks. |
+
+**`remove-dhcp-subnet` payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `extension_ip` | Extension IP. |
+| `vpc_id` | Present for VPC tier networks. |
+
+---
+
+### `set-dhcp-options`
+
+**Called:** When extra DHCP options are set on a NIC
+(`updateNicExtraDhcpOption` API).
+
+**Payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `nic_id` | CloudStack NIC ID. |
+| `options` | Compact JSON string such as `{"15":"example.com","119":"search.example.com"}`. |
+| `extension_ip` | Extension IP. |
+| `vpc_id` | Present for VPC tier networks. |
+
+---
+
+### `add-dns-entry`
+
+**Called:** When a VM NIC is reserved on a network whose DNS service is
+provided by this extension.
+
+**Payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `ip` | VM IP. |
+| `hostname` | VM hostname. |
+| `extension_ip` | Extension IP. |
+| `nic_uuid` | NIC UUID, when available. |
+| `vpc_id` | Present for VPC tier networks. |
+
+---
+
+### `config-dns-subnet` / `remove-dns-subnet`
+
+**Called:** When a DNS scope is configured or removed for a subnet.
+
+**`config-dns-subnet` payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `gateway` | Guest network gateway. |
+| `cidr` | Guest network CIDR. |
+| `dns` | Comma-separated DNS server list. |
+| `vlan` | Guest VLAN tag. |
+| `domain` | Network domain suffix. |
+| `extension_ip` | Extension IP. |
+| `nic_uuid` | NIC UUID, when available. |
+| `vpc_id` | Present for VPC tier networks. |
+
+**`remove-dns-subnet` payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `extension_ip` | Extension IP. |
+| `vpc_id` | Present for VPC tier networks. |
+
+---
+
+### `save-vm-data`
+
+**Called:** When a VM is deployed or updated with user data, SSH keys, or
+password on a network whose UserData service is provided by this extension.
+
+**Purpose:** Store the complete cloud-init metadata set (user-data,
+meta-data/*, password) for the VM so the metadata HTTP server can serve it.
+
+**Payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `ip` | VM IP. |
+| `gateway` | Gateway of the VM NIC on this network. |
+| `extension_ip` | Extension IP. |
+| `vm_data` | JSON array shown below. |
+| `nic_uuid` | NIC UUID, when available. |
+| `vpc_id` | Present for VPC tier networks. |
+
+**`vm_data` JSON:**
+
+```json
+[
+  {"dir":"userdata",   "file":"user-data",       "content":"<plain text>"},
+  {"dir":"meta-data",  "file":"instance-id",      "content":"<plain text>"},
+  {"dir":"meta-data",  "file":"local-hostname",   "content":"<plain text>"},
+  {"dir":"meta-data",  "file":"public-keys/0/openssh-key", "content":"<plain text>"},
+  {"dir":"password",   "file":"vm_password",      "content":"<plain text>"}
+]
+```
+
+Each `content` field is a plain UTF-8 string.  Write it directly to disk.
+
+Your metadata HTTP server should serve each entry at:
+`http://<extension-ip>/latest/<dir>/<file>`
+
+---
+
+### `save-password`
+
+**Called:** When a password reset is requested for a VM
+(`resetPasswordForVirtualMachine` API).
+
+**Payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `ip` | VM IP. |
+| `gateway` | Gateway of the VM NIC. |
+| `password` | Plain-text new password. |
+| `extension_ip` | Extension IP. |
+| `nic_uuid` | NIC UUID, when available. |
+| `vpc_id` | Present for VPC tier networks. |
+
+---
+
+### `save-userdata`
+
+**Called:** When a VM's user data is updated
+(`updateVirtualMachine` with `userdata`).
+
+**Payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `ip` | VM IP. |
+| `gateway` | Gateway of the VM NIC. |
+| `userdata` | User-data as plain text. |
+| `extension_ip` | Extension IP. |
+| `nic_uuid` | NIC UUID, when available. |
+| `vpc_id` | Present for VPC tier networks. |
+
+---
+
+### `save-sshkey`
+
+**Called:** When an SSH public key is reset for a VM
+(`resetSSHKeyForVirtualMachine` API).
+
+**Payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `ip` | VM IP. |
+| `gateway` | Gateway of the VM NIC. |
+| `sshkey` | SSH public key (plain text). |
+| `extension_ip` | Extension IP. |
+| `nic_uuid` | NIC UUID, when available. |
+| `vpc_id` | Present for VPC tier networks. |
+
+---
+
+### `save-hypervisor-hostname`
+
+**Called:** When a VM is deployed and UserData service is active.
+
+**Purpose:** Store the hypervisor hostname in the metadata so VMs can identify
+which host they run on (cloud-init `availability-zone` / host detection).
+
+**Payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `ip` | VM IP. |
+| `gateway` | Gateway of the VM NIC. |
+| `hypervisor_hostname` | Hypervisor node hostname. |
+| `extension_ip` | Extension IP. |
+| `nic_uuid` | NIC UUID, when available. |
+| `vpc_id` | Present for VPC tier networks. |
+
+---
+
+### `apply-lb-rules`
+
+**Called:** When a load balancer rule is created, deleted, or its members
+change (`createLoadBalancerRule`, `deleteLoadBalancerRule`,
+`assignToLoadBalancerRule`, `removeFromLoadBalancerRule` APIs).
+
+**Purpose:** Configure the load balancer on the device: create/update/delete
+virtual server → backend pool mappings.
+
+**Payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `vlan` | Guest VLAN tag. |
+| `lb_rules` | JSON array of LB rules shown below. |
+| `vpc_id` | Present for VPC tier networks. |
+
+**Decoded `lb_rules` JSON:**
+
+```json
+[
+  {
+    "id":          1,
+    "name":        "lb-web",
+    "publicIp":    "203.0.113.5",
+    "publicPort":  80,
+    "privatePort": 8080,
+    "protocol":    "tcp",
+    "algorithm":   "roundrobin",
+    "revoke":      false,
+    "backends": [
+      {"ip": "10.0.0.10", "port": 8080, "revoked": false},
+      {"ip": "10.0.0.11", "port": 8080, "revoked": true}
+    ]
+  }
+]
+```
+
+| Field | Description |
+|---|---|
+| `revoke` | `true` → delete this rule; `false` → create/update. |
+| `backends[].revoked` | `true` → this backend has been removed from the rule. |
+| `algorithm` | `roundrobin`, `leastconn`, or `source`. |
+| `protocol` | `tcp`, `udp`, or `tcp-proxy`. |
+
+---
+
+### `restore-network`
+
+**Called:** During a `restartNetwork(cleanup=true)` or `restartVPC(cleanup=true)`
+operation, after all rules (firewall/NAT/LB) have been re-applied.
+
+**Purpose:** Batch-restore all DHCP leases, DNS entries, and metadata for
+every VM currently on the network in a single call (instead of N per-VM
+calls).
+
+**Payload fields (`payload` object):**
+
+| Field | Description |
+|---|---|
+| `network_id` | Network ID. |
+| `gateway` | Guest network gateway. |
+| `cidr` | Guest network CIDR. |
+| `vlan` | Guest VLAN tag. |
+| `extension_ip` | Extension IP. |
+| `dns` | Comma-separated DNS server list. |
+| `domain` | Network domain suffix. |
+| `restore_data` | JSON restore payload shown below. |
+| `vpc_id` | Present for VPC tier networks. |
+
+**`restore_data` JSON:**
+
+```json
+{
+  "dhcp_enabled":     true,
+  "dns_enabled":      true,
+  "userdata_enabled": true,
+  "vms": [
+    {
+      "ip":          "10.0.0.10",
+      "mac":         "02:00:00:00:00:01",
+      "hostname":    "vm-1",
+      "default_nic": true,
+      "vm_data": [
+        {"dir": "userdata",  "file": "user-data",    "content": "<plain text>"},
+        {"dir": "meta-data", "file": "instance-id",  "content": "<plain text>"},
+        {"dir": "meta-data", "file": "local-hostname","content": "<plain text>"}
+      ]
+    }
+  ]
+}
+```
+
+Each `vm_data[].content` is a plain UTF-8 string (same encoding as in `save-vm-data`).
+
+---
+
+### `custom-action`
+
+**Called:** Via the `runNetworkCustomAction` API.
+
+**Purpose:** Allows operators to trigger ad-hoc operations on the device
+without defining new CloudStack API calls.
+
+CloudStack writes the full custom-action request to a temporary JSON payload
+file and passes that file directly to the script. Unlike the other commands,
+`custom-action` does **not** use the nested `{ "payload": ... }` envelope;
+command-specific inputs are provided in top-level `action-params`.
+
+It still includes the same top-level extension detail objects used elsewhere,
+including `physical-network-extension-details` and `network-extension-details`.
+
+**Top-level payload keys (network-level):**
+
+| Key | Description |
+|---|---|
+| `network_id` | The CloudStack network ID. |
+| `vpc_id` | Present when the network belongs to a VPC. |
+| `action` | The action name passed by the operator. |
+| `action-params` | JSON object with arbitrary key/value parameters. |
+| `physical-network-extension-details` | Physical-network extension details JSON. |
+| `network-extension-details` | Stored `extension.details` JSON for the network. |
+
+**Top-level payload keys (VPC-level):**
+
+| Key | Description |
+|---|---|
+| `vpc_id` | The CloudStack VPC ID. |
+| `action` | The action name passed by the operator. |
+| `action-params` | JSON object with arbitrary key/value parameters. |
+| `physical-network-extension-details` | Physical-network extension details JSON. |
+| `network-extension-details` | Stored `extension.details` JSON for the VPC. |
+
+Hook scripts should parse the payload file directly.
+
+**Stdout:** Returned verbatim to the API caller.
+
+---
+
+## Service-to-Command Mapping
+
+| CloudStack Network Service | Commands triggered |
+|---|---|
+| **SourceNat / Gateway** | `assign-ip`, `release-ip` |
+| **StaticNat** | `add-static-nat`, `delete-static-nat` |
+| **PortForwarding** | `add-port-forward`, `delete-port-forward` |
+| **Firewall** | `apply-fw-rules` |
+| **Lb** | `apply-lb-rules` |
+| **NetworkACL** | `apply-network-acl` |
+| **Dhcp** | `add-dhcp-entry`, `remove-dhcp-entry`, `config-dhcp-subnet`, `remove-dhcp-subnet`, `set-dhcp-options` |
+| **Dns** | `add-dns-entry`, `config-dns-subnet`, `remove-dns-subnet` |
+| **UserData** | `save-vm-data`, `save-password`, `save-userdata`, `save-sshkey`, `save-hypervisor-hostname` |
+| *(NIC lifecycle — all)* | `prepare-nic`, `release-nic` |
+| *(network lifecycle — all)* | `ensure-network-device`, `implement-network`, `shutdown-network`, `destroy-network`, `restore-network` |
+| *(VPC lifecycle)* | `ensure-network-device`, `implement-vpc`, `shutdown-vpc`, `update-vpc-source-nat-ip` |
+| *(operator)* | `custom-action` |
+
+Your script only needs to implement the commands for the services it declares
+in `network.services`.  All other commands can safely be no-ops (exit 0).
+
+---
+
+## Capabilities Configuration
+
+When creating the extension, set `network.service.capabilities` to a JSON
+object keyed by service name.  The values are capability name → value string
+maps.
+
+```json
+{
+  "SourceNat": {
+    "SupportedSourceNatTypes": "peraccount",
+    "RedundantRouter":         "false"
+  },
+  "StaticNat": {
+    "Supported": "true"
+  },
+  "PortForwarding": {
+    "SupportedProtocols": "tcp,udp"
+  },
+  "Firewall": {
+    "TrafficStatistics":       "per public ip",
+    "SupportedProtocols":      "tcp,udp,icmp",
+    "SupportedEgressProtocols":"tcp,udp,icmp,all",
+    "SupportedTrafficDirection":"ingress,egress",
+    "MultipleIps":             "true"
+  },
+  "Lb": {
+    "SupportedLBAlgorithms":       "roundrobin,leastconn,source",
+    "SupportedLBIsolation":        "dedicated",
+    "SupportedProtocols":          "tcp,udp,tcp-proxy",
+    "SupportedStickinessMethods":  "lbcookie,appsession",
+    "LbSchemes":                   "Public",
+    "SslTermination":              "false",
+    "VmAutoScaling":               "false"
+  },
+  "Dhcp": {
+    "DhcpAccrossMultipleSubnets": "true"
+  },
+  "Dns": {
+    "AllowDnsSuffixModification": "true",
+    "ExternalDns":                "true"
+  },
+  "Gateway": {
+    "RedundantRouter": "false"
+  },
+  "NetworkACL": {
+    "SupportedProtocols": "tcp,udp,icmp"
+  },
+  "UserData": {
+    "Supported": "true"
+  }
+}
+```
+
+Only declare services and capabilities your implementation actually supports.
+
+---
+
+## VPC Networks
+
+For networks that belong to a VPC, `vpc_id` is added to the nested command
+payload. Use it to share state across all tiers of the same VPC (e.g., a
+single VRF or namespace per VPC instead of per tier).
+
+In `ensure-network-device`, use `vpc_id` (when present) as the hash key for
+host selection so all tiers of a VPC always land on the same device.
+
+VPC lifecycle commands (`implement-vpc`, `shutdown-vpc`,
+`update-vpc-source-nat-ip`) are invoked at the VPC level with no
+`network_id` — only `vpc_id`. Tier-level commands such as
+`implement-network` and `destroy-network` still receive both
+`network_id` and `vpc_id`.
+
+To use this extension as a VPC provider:
+
+1. Create the NetworkOffering with `useVpc=on`.
+2. Create a VpcOffering with the extension as provider.
+
+---
+
+## Extension IP
+
+`extension_ip` is the IP the device presents on the guest network side:
+
+- **With SourceNat or Gateway service:** equals `gateway` (the device is the
+  gateway; no separate IP needed).
+- **Without SourceNat/Gateway** (Dhcp/Dns/UserData only, e.g. a shared network
+  helper): CloudStack allocates a dedicated IP from the guest subnet and passes
+  it.  The device must listen on this IP for DHCP, DNS, and metadata (port 80)
+  requests.
+
+### Opting out of the placeholder IP
+
+Some extensions (e.g. OVN) manage their own data-plane addressing and do not
+need CloudStack to reserve a real IP for networks that provide DHCP/DNS/UserData
+without SourceNat or Gateway.  This covers **both** shared networks and isolated
+networks that omit SourceNat.  Set the Extension detail
+**`network.allocate.extension.ip=false`** when creating or updating the Extension
+to suppress the allocation:
+
+```bash
+cmk createExtension \
+    name=my-sdn \
+    ... \
+    details[N].network.allocate.extension.ip=false
+```
+
+When this detail is `false`, `ensureExtensionIp` returns `null` for any network
+backed by this extension that reaches the placeholder-IP branch — i.e. networks
+with DHCP/DNS/UserData but without SourceNat/Gateway.  `extension_ip` will not
+be set in command payloads, and no IP is consumed from the subnet pool.
+
+Omitting the detail (or setting any value other than `false`) preserves the
+original behaviour — a placeholder NIC is allocated and `extension_ip` is
+included in every command payload.
+
+---
+
+## Exit Codes
+
+| Exit code | Meaning |
+|---|---|
+| `0` | Success. |
+| Any non-zero | Failure. CloudStack logs the exit code and script output, and treats the operation as failed. |
+
+For SSH-proxy scripts you may use sub-codes for diagnostics (they are logged
+but not interpreted differently by CloudStack):
+
+| Suggested code | Suggested meaning |
+|---|---|
+| `1` | Usage / configuration error. |
+| `2` | SSH connection / authentication failure. |
+| `3` | Remote script returned non-zero. |
+
+---
+
+## Minimal Script Skeleton
+
+The following Bash skeleton handles all commands and can be used as a starting
+point.  Replace each `TODO` block with your device's API calls.
+
+```bash
+#!/bin/bash
+# my-sdn.sh — CloudStack NetworkOrchestrator extension entry-point
+set -euo pipefail
+
+COMMAND="${1:-}"
+PAYLOAD_FILE="${2:-}"
+TIMEOUT_SECONDS="${3:-60}"
+
+if [[ -z "${COMMAND}" || -z "${PAYLOAD_FILE}" ]]; then
+    echo "Usage: $0 <command> <payload-file> <timeout-seconds>" >&2
+    exit 1
+fi
+
+root_field() {
+    python3 - "$PAYLOAD_FILE" "$1" <<'PY'
+import json, sys
+with open(sys.argv[1], encoding='utf-8') as fh:
+    data = json.load(fh)
+value = data.get(sys.argv[2], "")
+if isinstance(value, (dict, list)):
+    print(json.dumps(value, separators=(",", ":")))
+elif value is None:
+    print("")
+else:
+    print(value)
+PY
+}
+
+payload_field() {
+    python3 - "$PAYLOAD_FILE" "$1" <<'PY'
+import json, sys
+with open(sys.argv[1], encoding='utf-8') as fh:
+    data = json.load(fh)
+value = data.get('payload', {}).get(sys.argv[2], "")
+if isinstance(value, (dict, list)):
+    print(json.dumps(value, separators=(",", ":")))
+elif value is None:
+    print("")
+else:
+    print(value)
+PY
+}
+
+case "${COMMAND}" in
+
+    ensure-network-device)
+        # TODO: check that the device is reachable; select/validate host
+        # Print per-network JSON to stdout (stored by CloudStack)
+        printf '{"device":"%s"}\n' "$(payload_field network_id)"
+        ;;
+
+    implement-network)
+        # TODO: create virtual segment (VRF / VLAN / namespace / …)
+        # TODO: configure gateway IP $(payload_field extension_ip) on $(payload_field cidr)
+        ;;
+
+    shutdown-network|destroy-network)
+        # TODO: tear down the virtual segment
+        ;;
+
+    implement-vpc)
+        # TODO: create VPC-level namespace / VRF for vpc=$(payload_field vpc_id)
+        # Optional source-NAT IP: $(payload_field public_ip)
+        ;;
+
+    shutdown-vpc)
+        # TODO: remove VPC namespace / VRF for vpc=$(payload_field vpc_id)
+        ;;
+
+    update-vpc-source-nat-ip)
+        # TODO: update VPC SNAT rule to use new public IP $(payload_field public_ip)
+        ;;
+
+    assign-ip)
+        # TODO: attach public IP $(payload_field public_ip) to the device
+        ;;
+
+    release-ip)
+        # TODO: remove public IP $(payload_field public_ip) from the device
+        ;;
+
+    add-static-nat)
+        # TODO: DNAT $(payload_field public_ip) → $(payload_field private_ip)
+        ;;
+
+    delete-static-nat)
+        # TODO: remove DNAT for $(payload_field public_ip)
+        ;;
+
+    add-port-forward)
+        # TODO: DNAT $(payload_field public_ip):$(payload_field public_port) → $(payload_field private_ip):$(payload_field private_port)
+        ;;
+
+    delete-port-forward)
+        # TODO: remove the port-forwarding DNAT rule
+        ;;
+
+    apply-fw-rules)
+        FW_JSON=$(payload_field fw_rules)
+        # TODO: parse $FW_JSON and apply to device
+        ;;
+
+    apply-network-acl)
+        ACL_JSON=$(payload_field acl_rules)
+        # TODO: parse $ACL_JSON and apply to VPC tier
+        ;;
+
+    prepare-nic)
+        # TODO: create port binding mac=$(payload_field mac) ip=$(payload_field ip) nic_uuid=$(payload_field nic_uuid)
+        ;;
+
+    release-nic)
+        # TODO: remove port binding mac=$(payload_field mac) ip=$(payload_field ip)
+        ;;
+
+    add-dhcp-entry)
+        # TODO: add static lease mac=$(payload_field mac) ip=$(payload_field ip)
+        ;;
+
+    remove-dhcp-entry)
+        # TODO: remove static lease for mac=$(payload_field mac)
+        ;;
+
+    config-dhcp-subnet|remove-dhcp-subnet) ;;
+
+    set-dhcp-options) ;;
+
+    add-dns-entry)
+        # TODO: add A record hostname=$(payload_field hostname) ip=$(payload_field ip)
+        ;;
+
+    config-dns-subnet|remove-dns-subnet) ;;
+
+    save-vm-data)
+        VM_DATA_JSON=$(payload_field vm_data)
+        # TODO: iterate entries and write to metadata store
+        ;;
+
+    save-password|save-userdata|save-sshkey|save-hypervisor-hostname) ;;
+
+    apply-lb-rules)
+        LB_JSON=$(payload_field lb_rules)
+        # TODO: parse $LB_JSON and configure load balancer
+        ;;
+
+    restore-network)
+        RESTORE_JSON=$(payload_field restore_data)
+        # TODO: iterate vms and restore leases / DNS / metadata
+        ;;
+
+    custom-action)
+        ACTION_NAME=$(root_field action)
+        ACTION_PARAMS=$(root_field action-params)
+        # TODO: handle $ACTION_NAME with params $ACTION_PARAMS
+        echo "custom action ${ACTION_NAME} not implemented"
+        exit 1
+        ;;
+
+    *)
+        echo "Unknown command: ${COMMAND}" >&2
+        exit 1
+        ;;
+esac
+
+exit 0
+```
+
+For a full production implementation see https://github.com/apache/cloudstack-extensions/tree/network-namespace/Network-Namespace:
+- `network-namespace.sh` — management-server entry-point (SSH proxy).
+- `network-namespace-wrapper.sh` — KVM-host wrapper that implements all commands using Linux network namespaces.
diff --git a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/vo/ExtensionDetailsVO.java b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/vo/ExtensionDetailsVO.java
index 535a0f703958..546f33b2a1d4 100644
--- a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/vo/ExtensionDetailsVO.java
+++ b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/vo/ExtensionDetailsVO.java
@@ -40,7 +40,7 @@ public class ExtensionDetailsVO implements ResourceDetail {
     @Column(name = "name", nullable = false, length = 255)
     private String name;
 
-    @Column(name = "value", nullable = false, length = 255)
+    @Column(name = "value", nullable = false, length = 4096)
     private String value;
 
     @Column(name = "display")
diff --git a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/vo/ExtensionResourceMapDetailsVO.java b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/vo/ExtensionResourceMapDetailsVO.java
index 5cb6f7b85114..c2b23f1eee04 100644
--- a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/vo/ExtensionResourceMapDetailsVO.java
+++ b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/vo/ExtensionResourceMapDetailsVO.java
@@ -40,7 +40,7 @@ public class ExtensionResourceMapDetailsVO implements ResourceDetail {
     @Column(name = "name", nullable = false, length = 255)
     private String name;
 
-    @Column(name = "value", nullable = false, length = 255)
+    @Column(name = "value", nullable = false, length = 4096)
     private String value;
 
     @Column(name = "display")
diff --git a/framework/extensions/src/main/resources/META-INF/cloudstack/core/spring-framework-extensions-core-context.xml b/framework/extensions/src/main/resources/META-INF/cloudstack/core/spring-framework-extensions-core-context.xml
index 9d44d8ff7f3d..ee5e98630140 100644
--- a/framework/extensions/src/main/resources/META-INF/cloudstack/core/spring-framework-extensions-core-context.xml
+++ b/framework/extensions/src/main/resources/META-INF/cloudstack/core/spring-framework-extensions-core-context.xml
@@ -33,4 +33,7 @@
     <bean id="ExtensionsManager" class="org.apache.cloudstack.framework.extensions.manager.ExtensionsManagerImpl" />
     <bean id="ExtensionCustomActionDaoImpl" class="org.apache.cloudstack.framework.extensions.dao.ExtensionCustomActionDaoImpl" />
     <bean id="ExtensionCustomActionDetailsDaoImpl" class="org.apache.cloudstack.framework.extensions.dao.ExtensionCustomActionDetailsDaoImpl" />
+    <bean id="networkExtension" class="org.apache.cloudstack.framework.extensions.network.NetworkExtensionElement">
+        <property name="name" value="NetworkExtension" />
+    </bean>
 </beans>
diff --git a/framework/extensions/src/test/java/org/apache/cloudstack/framework/extensions/api/ListExtensionsCmdTest.java b/framework/extensions/src/test/java/org/apache/cloudstack/framework/extensions/api/ListExtensionsCmdTest.java
index 1ca601293a37..9ae051af00f4 100644
--- a/framework/extensions/src/test/java/org/apache/cloudstack/framework/extensions/api/ListExtensionsCmdTest.java
+++ b/framework/extensions/src/test/java/org/apache/cloudstack/framework/extensions/api/ListExtensionsCmdTest.java
@@ -18,6 +18,7 @@
 package org.apache.cloudstack.framework.extensions.api;
 
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 
 import java.util.Arrays;
@@ -89,4 +90,21 @@ public void testGetDetailsWithInvalidValueThrowsException() {
         setPrivateField("details", detailsList);
         cmd.getDetails();
     }
+
+    // -----------------------------------------------------------------------
+    // Tests for type getter
+    // -----------------------------------------------------------------------
+
+    @Test
+    public void testGetTypeReturnsValueWhenSet() {
+        setPrivateField("type", "NetworkOrchestrator");
+        assertEquals("NetworkOrchestrator", cmd.getType());
+    }
+
+    @Test
+    public void testGetTypeReturnsNullWhenUnset() {
+        setPrivateField("type", null);
+        assertNull(cmd.getType());
+    }
+
 }
diff --git a/framework/extensions/src/test/java/org/apache/cloudstack/framework/extensions/api/UpdateRegisteredExtensionCmdTest.java b/framework/extensions/src/test/java/org/apache/cloudstack/framework/extensions/api/UpdateRegisteredExtensionCmdTest.java
new file mode 100644
index 000000000000..023820237f47
--- /dev/null
+++ b/framework/extensions/src/test/java/org/apache/cloudstack/framework/extensions/api/UpdateRegisteredExtensionCmdTest.java
@@ -0,0 +1,160 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.framework.extensions.api;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.EnumSet;
+import java.util.Map;
+
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.ExtensionResponse;
+import org.apache.cloudstack.extension.Extension;
+import org.apache.cloudstack.framework.extensions.manager.ExtensionsManager;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mockito;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import com.cloud.user.Account;
+
+public class UpdateRegisteredExtensionCmdTest {
+
+    private UpdateRegisteredExtensionCmd cmd;
+    private ExtensionsManager extensionsManager;
+
+    @Before
+    public void setUp() {
+        cmd = Mockito.spy(new UpdateRegisteredExtensionCmd());
+        extensionsManager = mock(ExtensionsManager.class);
+        ReflectionTestUtils.setField(cmd, "extensionsManager", extensionsManager);
+    }
+
+    @Test
+    public void extensionIdReturnsNullWhenUnset() {
+        ReflectionTestUtils.setField(cmd, "extensionId", null);
+        assertNull(cmd.getExtensionId());
+    }
+
+    @Test
+    public void extensionIdReturnsValueWhenSet() {
+        Long extensionId = 42L;
+        ReflectionTestUtils.setField(cmd, "extensionId", extensionId);
+        assertEquals(extensionId, cmd.getExtensionId());
+    }
+
+    @Test
+    public void cleanupDetailsReturnsNullWhenUnset() {
+        ReflectionTestUtils.setField(cmd, "cleanupDetails", null);
+        assertNull(cmd.isCleanupDetails());
+    }
+
+    @Test
+    public void cleanupDetailsReturnsTrueWhenSet() {
+        ReflectionTestUtils.setField(cmd, "cleanupDetails", true);
+        assertTrue(cmd.isCleanupDetails());
+    }
+
+    @Test
+    public void cleanupDetailsReturnsFalseWhenSetToFalse() {
+        ReflectionTestUtils.setField(cmd, "cleanupDetails", false);
+        assertFalse(cmd.isCleanupDetails());
+    }
+
+    @Test
+    public void getEntityOwnerIdReturnsSystemAccountId() {
+        assertEquals(Account.ACCOUNT_ID_SYSTEM, cmd.getEntityOwnerId());
+    }
+
+    @Test
+    public void getApiResourceTypeReturnsExtension() {
+        assertEquals(ApiCommandResourceType.Extension, cmd.getApiResourceType());
+    }
+
+    @Test
+    public void getApiResourceIdReturnsExtensionId() {
+        Long extensionId = 99L;
+        ReflectionTestUtils.setField(cmd, "extensionId", extensionId);
+        assertEquals(extensionId, cmd.getApiResourceId());
+    }
+
+    @Test
+    public void resourceIdReturnsValueWhenSet() {
+        String resourceId = "resource-123";
+        ReflectionTestUtils.setField(cmd, "resourceId", resourceId);
+        assertEquals(resourceId, cmd.getResourceId());
+    }
+
+    @Test
+    public void resourceTypeReturnsValueWhenSet() {
+        String resourceType = "PhysicalNetwork";
+        ReflectionTestUtils.setField(cmd, "resourceType", resourceType);
+        assertEquals(resourceType, cmd.getResourceType());
+    }
+
+    @Test
+    public void detailsReturnsEmptyMapWhenUnset() {
+        ReflectionTestUtils.setField(cmd, "details", null);
+        Map<String, String> details = cmd.getDetails();
+        assertNotNull(details);
+        assertTrue(details.isEmpty());
+    }
+
+    @Test
+    public void executeSetsExtensionResponseWhenManagerSucceeds() {
+        Extension extension = mock(Extension.class);
+        ExtensionResponse response = mock(ExtensionResponse.class);
+        when(extensionsManager.updateRegisteredExtensionWithResource(cmd)).thenReturn(extension);
+        when(extensionsManager.createExtensionResponse(extension, EnumSet.of(ApiConstants.ExtensionDetails.all)))
+                .thenReturn(response);
+
+        doNothing().when(cmd).setResponseObject(any());
+
+        cmd.execute();
+
+        verify(extensionsManager).updateRegisteredExtensionWithResource(cmd);
+        verify(extensionsManager).createExtensionResponse(extension, EnumSet.of(ApiConstants.ExtensionDetails.all));
+        verify(cmd).setResponseObject(response);
+    }
+
+    @Test
+    public void executeThrowsServerApiExceptionWhenManagerFails() {
+        when(extensionsManager.updateRegisteredExtensionWithResource(cmd))
+                .thenThrow(new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to update registered extension"));
+
+        try {
+            cmd.execute();
+            fail("Expected ServerApiException");
+        } catch (ServerApiException e) {
+            assertEquals("Failed to update registered extension", e.getDescription());
+        }
+    }
+}
diff --git a/framework/extensions/src/test/java/org/apache/cloudstack/framework/extensions/dao/ExtensionResourceMapDaoImplTest.java b/framework/extensions/src/test/java/org/apache/cloudstack/framework/extensions/dao/ExtensionResourceMapDaoImplTest.java
index 76a0175e7576..f4d5099b78b0 100644
--- a/framework/extensions/src/test/java/org/apache/cloudstack/framework/extensions/dao/ExtensionResourceMapDaoImplTest.java
+++ b/framework/extensions/src/test/java/org/apache/cloudstack/framework/extensions/dao/ExtensionResourceMapDaoImplTest.java
@@ -83,4 +83,52 @@ public void listResourceIdsByExtensionIdAndTypeReturnsCorrectIds() {
         when(dao.listResourceIdsByExtensionIdAndType(1L, ExtensionResourceMap.ResourceType.Cluster)).thenReturn(expectedIds);
         assertEquals(expectedIds, dao.listResourceIdsByExtensionIdAndType(1L, ExtensionResourceMap.ResourceType.Cluster));
     }
+
+    // -----------------------------------------------------------------------
+    // Tests for new methods: findResourceByExtensionIdAndResourceIdAndType, listResourceIdsByType
+    // -----------------------------------------------------------------------
+
+    @Test
+    public void findResourceByExtensionIdAndResourceIdAndTypeReturnsNullWhenNoMatch() {
+        when(dao.findResourceByExtensionIdAndResourceIdAndType(999L, 77L, ExtensionResourceMap.ResourceType.PhysicalNetwork)).thenReturn(null);
+        assertNull(dao.findResourceByExtensionIdAndResourceIdAndType(999L, 77L, ExtensionResourceMap.ResourceType.PhysicalNetwork));
+    }
+
+    @Test
+    public void findResourceByExtensionIdAndResourceIdAndTypeReturnsMatchingEntry() {
+        ExtensionResourceMapVO map1 = new ExtensionResourceMapVO();
+        map1.setExtensionId(42L);
+        map1.setResourceId(7L);
+        map1.setResourceType(ExtensionResourceMap.ResourceType.PhysicalNetwork);
+        ExtensionResourceMapVO expected = map1;
+        when(dao.findResourceByExtensionIdAndResourceIdAndType(42L, 7L, ExtensionResourceMap.ResourceType.PhysicalNetwork)).thenReturn(expected);
+        ExtensionResourceMapVO result = dao.findResourceByExtensionIdAndResourceIdAndType(42L, 7L, ExtensionResourceMap.ResourceType.PhysicalNetwork);
+        assertEquals(expected, result);
+    }
+
+    @Test
+    public void findResourceByExtensionIdAndResourceIdAndTypeDifferentiatesResourceTypes() {
+        ExtensionResourceMapVO clusterMap = new ExtensionResourceMapVO();
+        clusterMap.setResourceType(ExtensionResourceMap.ResourceType.Cluster);
+        when(dao.findResourceByExtensionIdAndResourceIdAndType(10L, 55L, ExtensionResourceMap.ResourceType.Cluster)).thenReturn(clusterMap);
+        when(dao.findResourceByExtensionIdAndResourceIdAndType(10L, 55L, ExtensionResourceMap.ResourceType.PhysicalNetwork)).thenReturn(null);
+
+        assertEquals(clusterMap, dao.findResourceByExtensionIdAndResourceIdAndType(10L, 55L, ExtensionResourceMap.ResourceType.Cluster));
+        assertNull(dao.findResourceByExtensionIdAndResourceIdAndType(10L, 55L, ExtensionResourceMap.ResourceType.PhysicalNetwork));
+    }
+
+    @Test
+    public void listResourceIdsByTypeReturnsEmptyListWhenNoMatch() {
+        when(dao.listResourceIdsByType(ExtensionResourceMap.ResourceType.PhysicalNetwork)).thenReturn(List.of());
+        assertTrue(dao.listResourceIdsByType(ExtensionResourceMap.ResourceType.PhysicalNetwork).isEmpty());
+    }
+
+    @Test
+    public void listResourceIdsByTypeReturnsMatchingIds() {
+        List<Long> expectedIds = List.of(5L, 10L, 15L);
+        when(dao.listResourceIdsByType(ExtensionResourceMap.ResourceType.PhysicalNetwork)).thenReturn(expectedIds);
+        List<Long> result = dao.listResourceIdsByType(ExtensionResourceMap.ResourceType.PhysicalNetwork);
+        assertEquals(3, result.size());
+        assertEquals(expectedIds, result);
+    }
 }
diff --git a/framework/extensions/src/test/java/org/apache/cloudstack/framework/extensions/manager/ExtensionsManagerImplTest.java b/framework/extensions/src/test/java/org/apache/cloudstack/framework/extensions/manager/ExtensionsManagerImplTest.java
index ff3fce06b006..fa8c97742697 100644
--- a/framework/extensions/src/test/java/org/apache/cloudstack/framework/extensions/manager/ExtensionsManagerImplTest.java
+++ b/framework/extensions/src/test/java/org/apache/cloudstack/framework/extensions/manager/ExtensionsManagerImplTest.java
@@ -37,8 +37,10 @@
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.mockStatic;
 import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
+import static org.mockito.Mockito.withSettings;
 
 import java.io.File;
 import java.security.InvalidParameterException;
@@ -62,6 +64,7 @@
 import org.apache.cloudstack.extension.CustomActionResultResponse;
 import org.apache.cloudstack.extension.Extension;
 import org.apache.cloudstack.extension.ExtensionCustomAction;
+import org.apache.cloudstack.extension.ExtensionHelper;
 import org.apache.cloudstack.extension.ExtensionResourceMap;
 import org.apache.cloudstack.framework.extensions.api.AddCustomActionCmd;
 import org.apache.cloudstack.framework.extensions.api.CreateExtensionCmd;
@@ -74,6 +77,7 @@
 import org.apache.cloudstack.framework.extensions.api.UnregisterExtensionCmd;
 import org.apache.cloudstack.framework.extensions.api.UpdateCustomActionCmd;
 import org.apache.cloudstack.framework.extensions.api.UpdateExtensionCmd;
+import org.apache.cloudstack.framework.extensions.api.UpdateRegisteredExtensionCmd;
 import org.apache.cloudstack.framework.extensions.command.CleanupExtensionFilesCommand;
 import org.apache.cloudstack.framework.extensions.command.ExtensionServerActionBaseCommand;
 import org.apache.cloudstack.framework.extensions.command.GetExtensionPathChecksumCommand;
@@ -87,6 +91,7 @@
 import org.apache.cloudstack.framework.extensions.vo.ExtensionCustomActionDetailsVO;
 import org.apache.cloudstack.framework.extensions.vo.ExtensionCustomActionVO;
 import org.apache.cloudstack.framework.extensions.vo.ExtensionDetailsVO;
+import org.apache.cloudstack.framework.extensions.vo.ExtensionResourceMapDetailsVO;
 import org.apache.cloudstack.framework.extensions.vo.ExtensionResourceMapVO;
 import org.apache.cloudstack.framework.extensions.vo.ExtensionVO;
 import org.apache.cloudstack.utils.identity.ManagementServerNode;
@@ -94,6 +99,7 @@
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.MockedStatic;
@@ -122,6 +128,21 @@
 import com.cloud.host.dao.HostDetailsDao;
 import com.cloud.hypervisor.ExternalProvisioner;
 import com.cloud.hypervisor.Hypervisor;
+import com.cloud.network.Network;
+import com.cloud.network.NetworkModel;
+import com.cloud.network.dao.NetworkDao;
+import com.cloud.network.dao.NetworkServiceMapDao;
+import com.cloud.network.dao.NetworkVO;
+import com.cloud.network.dao.PhysicalNetworkDao;
+import com.cloud.network.dao.PhysicalNetworkServiceProviderDao;
+import com.cloud.network.dao.PhysicalNetworkServiceProviderVO;
+import com.cloud.network.dao.PhysicalNetworkVO;
+import com.cloud.network.element.NetworkElement;
+import com.cloud.network.vpc.Vpc;
+import com.cloud.network.vpc.dao.VpcOfferingServiceMapDao;
+import com.cloud.network.vpc.dao.VpcServiceMapDao;
+import com.cloud.offerings.dao.NetworkOfferingServiceMapDao;
+import org.apache.cloudstack.extension.NetworkCustomActionProvider;
 import com.cloud.org.Cluster;
 import com.cloud.serializer.GsonHelper;
 import com.cloud.storage.dao.VMTemplateDao;
@@ -136,7 +157,6 @@
 import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.VirtualMachineManager;
 import com.cloud.vm.VmDetailConstants;
-import com.cloud.vm.dao.VMInstanceDao;
 
 @RunWith(MockitoJUnitRunner.class)
 public class ExtensionsManagerImplTest {
@@ -168,8 +188,6 @@ public class ExtensionsManagerImplTest {
     @Mock
     private ExtensionCustomActionDetailsDao extensionCustomActionDetailsDao;
     @Mock
-    private VMInstanceDao vmInstanceDao;
-    @Mock
     private VirtualMachineManager virtualMachineManager;
     @Mock
     private EntityManager entityManager;
@@ -185,6 +203,25 @@ public class ExtensionsManagerImplTest {
     private RoleService roleService;
     @Mock
     private AccountService accountService;
+    @Mock
+    private PhysicalNetworkDao physicalNetworkDao;
+    @Mock
+    private NetworkDao networkDao;
+    @Mock
+    private NetworkServiceMapDao networkServiceMapDao;
+    @Mock
+    private VpcServiceMapDao vpcServiceMapDao;
+    @Mock
+    private NetworkModel networkModel;
+
+    @Mock
+    private PhysicalNetworkServiceProviderDao physicalNetworkServiceProviderDao;
+
+    @Mock
+    private NetworkOfferingServiceMapDao networkOfferingServiceMapDao;
+
+    @Mock
+    private VpcOfferingServiceMapDao vpcOfferingServiceMapDao;
 
     @Before
     public void setUp() {
@@ -287,17 +324,9 @@ public void unregisterExtensionWithClusterThrowsIfClusterNotFound() {
     @Test
     public void getExtensionFromResourceReturnsNullIfEntityNotFound() {
         when(entityManager.findByUuid(any(), anyString())).thenReturn(null);
-        assertNull(extensionsManager.getExtensionFromResource(ExtensionCustomAction.ResourceType.VirtualMachine, "uuid"));
+        assertNull(extensionsManager.getExtensionWithCustomActionFromResource(ExtensionCustomAction.ResourceType.VirtualMachine, "uuid"));
     }
 
-    @Test
-    public void getActionMessageReturnsDefaultOnBlank() {
-        ExtensionCustomAction action = mock(ExtensionCustomAction.class);
-        Extension ext = mock(Extension.class);
-        when(action.getSuccessMessage()).thenReturn(null);
-        String msg = extensionsManager.getActionMessage(true, action, ext, ExtensionCustomAction.ResourceType.VirtualMachine, null);
-        assertTrue(msg.contains("Successfully completed"));
-    }
 
     @Test
     public void getActionMessageReturnsDefaultMessageForSuccessWithoutCustomMessage() {
@@ -343,14 +372,6 @@ public void getActionMessageReturnsCustomFailureMessage() {
         assertEquals("Custom failure message", result);
     }
 
-    @Test
-    public void getActionMessageHandlesNullActionMessage() {
-        ExtensionCustomAction action = mock(ExtensionCustomAction.class);
-        when(action.getSuccessMessage()).thenReturn(null);
-        Extension extension = mock(Extension.class);
-        String result = extensionsManager.getActionMessage(true, action, extension, ExtensionCustomAction.ResourceType.VirtualMachine, null);
-        assertTrue(result.contains("Successfully completed"));
-    }
 
     @Test
     public void getFilteredExternalDetailsReturnsFilteredMap() {
@@ -381,26 +402,6 @@ public void sendExtensionPathNotReadyAlertDoesNotCallsAlertManager() {
                 anyLong(), anyLong(), anyString(), anyString());
     }
 
-    @Test
-    public void updateExtensionPathReadyUpdatesWhenStateDiffers() {
-        Extension ext = mock(Extension.class);
-        when(ext.getId()).thenReturn(1L);
-        when(ext.isPathReady()).thenReturn(false);
-        ExtensionVO vo = mock(ExtensionVO.class);
-        when(extensionDao.createForUpdate(1L)).thenReturn(vo);
-        when(extensionDao.update(1L, vo)).thenReturn(true);
-        extensionsManager.updateExtensionPathReady(ext, true);
-        verify(extensionDao).update(1L, vo);
-    }
-
-    @Test
-    public void disableExtensionUpdatesState() {
-        ExtensionVO vo = mock(ExtensionVO.class);
-        when(extensionDao.createForUpdate(1L)).thenReturn(vo);
-        when(extensionDao.update(1L, vo)).thenReturn(true);
-        extensionsManager.disableExtension(1L);
-        verify(extensionDao).update(1L, vo);
-    }
 
     @Test
     public void getExtensionFromResourceReturnsExtensionForValidResource() {
@@ -413,7 +414,7 @@ public void getExtensionFromResourceReturnsExtensionForValidResource() {
         ExtensionVO extension = mock(ExtensionVO.class);
         when(extensionDao.findById(100L)).thenReturn(extension);
 
-        Extension result = extensionsManager.getExtensionFromResource(ExtensionCustomAction.ResourceType.VirtualMachine, "vm-uuid");
+        Extension result = extensionsManager.getExtensionWithCustomActionFromResource(ExtensionCustomAction.ResourceType.VirtualMachine, "vm-uuid");
 
         assertEquals(extension, result);
     }
@@ -422,7 +423,7 @@ public void getExtensionFromResourceReturnsExtensionForValidResource() {
     public void getExtensionFromResourceReturnsNullForInvalidResourceUuid() {
         when(entityManager.findByUuid(eq(VirtualMachine.class), eq("invalid-uuid"))).thenReturn(null);
 
-        Extension result = extensionsManager.getExtensionFromResource(ExtensionCustomAction.ResourceType.VirtualMachine, "invalid-uuid");
+        Extension result = extensionsManager.getExtensionWithCustomActionFromResource(ExtensionCustomAction.ResourceType.VirtualMachine, "invalid-uuid");
 
         assertNull(result);
     }
@@ -433,7 +434,7 @@ public void getExtensionFromResourceReturnsNullForMissingClusterMapping() {
         when(entityManager.findByUuid(eq(VirtualMachine.class), eq("vm-uuid"))).thenReturn(vm);
         when(virtualMachineManager.findClusterAndHostIdForVm(vm, false)).thenReturn(new Pair<>(null, null));
 
-        Extension result = extensionsManager.getExtensionFromResource(ExtensionCustomAction.ResourceType.VirtualMachine, "vm-uuid");
+        Extension result = extensionsManager.getExtensionWithCustomActionFromResource(ExtensionCustomAction.ResourceType.VirtualMachine, "vm-uuid");
 
         assertNull(result);
     }
@@ -445,7 +446,7 @@ public void getExtensionFromResourceReturnsNullForMissingExtensionMapping() {
         when(virtualMachineManager.findClusterAndHostIdForVm(vm, false)).thenReturn(new Pair<>(1L, 1L));
         when(extensionResourceMapDao.findByResourceIdAndType(1L, ExtensionResourceMap.ResourceType.Cluster)).thenReturn(null);
 
-        Extension result = extensionsManager.getExtensionFromResource(ExtensionCustomAction.ResourceType.VirtualMachine, "vm-uuid");
+        Extension result = extensionsManager.getExtensionWithCustomActionFromResource(ExtensionCustomAction.ResourceType.VirtualMachine, "vm-uuid");
 
         assertNull(result);
     }
@@ -558,41 +559,26 @@ public void getExtensionsPathReturnsProvisionerPath() {
         assertEquals("/tmp/extensions", extensionsManager.getExtensionsPath());
     }
 
-    @Test
-    public void getExtensionIdForClusterReturnsNullIfNoMap() {
-        when(extensionResourceMapDao.findByResourceIdAndType(anyLong(), any())).thenReturn(null);
-        assertNull(extensionsManager.getExtensionIdForCluster(1L));
-    }
 
     @Test
-    public void getExtensionIdForClusterReturnsIdIfMapExists() {
-        ExtensionResourceMapVO map = mock(ExtensionResourceMapVO.class);
-        when(map.getExtensionId()).thenReturn(5L);
-        when(extensionResourceMapDao.findByResourceIdAndType(anyLong(), any())).thenReturn(map);
-        assertEquals(Long.valueOf(5L), extensionsManager.getExtensionIdForCluster(1L));
-    }
-
-    @Test
-    public void getExtensionReturnsExtension() {
-        ExtensionVO ext = mock(ExtensionVO.class);
-        when(extensionDao.findById(1L)).thenReturn(ext);
-        assertEquals(ext, extensionsManager.getExtension(1L));
-    }
-
-    @Test
-    public void getExtensionForClusterReturnsNullIfNoId() {
-        when(extensionResourceMapDao.findByResourceIdAndType(anyLong(), any())).thenReturn(null);
-        assertNull(extensionsManager.getExtensionForCluster(1L));
+    public void checkExtensionPathSyncUpdatesReadyWhenStateDiffers() {
+        Extension ext = mock(Extension.class);
+        when(ext.getName()).thenReturn("ext");
+        when(ext.getRelativePath()).thenReturn("entry.sh");
+        when(ext.isPathReady()).thenReturn(false);
+        extensionsManager.checkExtensionPathState(ext, Collections.emptyList());
+        verify(extensionsManager).updateExtensionPathReady(ext, false);
     }
 
     @Test
-    public void getExtensionForClusterReturnsExtensionIfIdExists() {
-        ExtensionResourceMapVO map = mock(ExtensionResourceMapVO.class);
-        when(map.getExtensionId()).thenReturn(5L);
-        when(extensionResourceMapDao.findByResourceIdAndType(anyLong(), any())).thenReturn(map);
-        ExtensionVO ext = mock(ExtensionVO.class);
-        when(extensionDao.findById(5L)).thenReturn(ext);
-        assertEquals(ext, extensionsManager.getExtensionForCluster(1L));
+    public void checkExtensionPathSyncUpdatesReadyWhenStateUnchanged() {
+        Extension ext = mock(Extension.class);
+        when(ext.getName()).thenReturn("ext");
+        when(ext.getRelativePath()).thenReturn("entry.sh");
+        when(ext.isPathReady()).thenReturn(true);
+        when(externalProvisioner.getChecksumForExtensionPath("ext", "entry.sh")).thenReturn("checksum123");
+        extensionsManager.checkExtensionPathState(ext, Collections.emptyList());
+        verify(extensionsManager, times(1)).updateExtensionPathReady(any(), anyBoolean());
     }
 
     @Test
@@ -950,6 +936,105 @@ public void testUpdateExtension_InvalidState() {
         extensionsManager.updateExtension(cmd);
     }
 
+    @Test(expected = CloudRuntimeException.class)
+    public void testUpdateExtension_RemovingUsedNetworkServiceThrows() {
+        UpdateExtensionCmd cmd = mock(UpdateExtensionCmd.class);
+        when(cmd.getId()).thenReturn(6L);
+        when(cmd.isOrchestratorRequiresPrepareVm()).thenReturn(null);
+        when(cmd.getState()).thenReturn(null);
+        Map<String, String> newDetails = new HashMap<>();
+        newDetails.put(ExtensionHelper.NETWORK_SERVICES_DETAIL_KEY, "SourceNat");
+        when(cmd.getDetails()).thenReturn(newDetails);
+        when(cmd.isCleanupDetails()).thenReturn(false);
+
+        ExtensionVO ext = mock(ExtensionVO.class);
+        when(ext.getId()).thenReturn(6L);
+        when(ext.getName()).thenReturn("MyExt");
+        when(ext.getType()).thenReturn(Extension.Type.NetworkOrchestrator);
+        when(extensionDao.findById(6L)).thenReturn(ext);
+
+        Map<String, String> oldDetailsMap = new HashMap<>();
+        oldDetailsMap.put(ExtensionHelper.NETWORK_SERVICES_DETAIL_KEY, "SourceNat,StaticNat");
+        Map<String, String> updatedDetailsMap = new HashMap<>();
+        updatedDetailsMap.put(ExtensionHelper.NETWORK_SERVICES_DETAIL_KEY, "SourceNat");
+        when(extensionDetailsDao.listDetailsKeyPairs(6L)).thenReturn(oldDetailsMap).thenReturn(updatedDetailsMap);
+
+        when(networkOfferingServiceMapDao.listOfferingIdsByServiceAndProvider(Network.Service.StaticNat, "MyExt"))
+                .thenReturn(Collections.singletonList(1L));
+
+        extensionsManager.updateExtension(cmd);
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testUpdateExtension_RemovingServiceUsedByVpcOfferingThrows() {
+        UpdateExtensionCmd cmd = mock(UpdateExtensionCmd.class);
+        when(cmd.getId()).thenReturn(8L);
+        when(cmd.isOrchestratorRequiresPrepareVm()).thenReturn(null);
+        when(cmd.getState()).thenReturn(null);
+        Map<String, String> newDetails = new HashMap<>();
+        newDetails.put(ExtensionHelper.NETWORK_SERVICES_DETAIL_KEY, "SourceNat");
+        when(cmd.getDetails()).thenReturn(newDetails);
+        when(cmd.isCleanupDetails()).thenReturn(false);
+
+        ExtensionVO ext = mock(ExtensionVO.class);
+        when(ext.getId()).thenReturn(8L);
+        when(ext.getName()).thenReturn("MyExt");
+        when(ext.getType()).thenReturn(Extension.Type.NetworkOrchestrator);
+        when(extensionDao.findById(8L)).thenReturn(ext);
+
+        Map<String, String> oldDetailsMap = new HashMap<>();
+        oldDetailsMap.put(ExtensionHelper.NETWORK_SERVICES_DETAIL_KEY, "SourceNat,StaticNat");
+        Map<String, String> updatedDetailsMap = new HashMap<>();
+        updatedDetailsMap.put(ExtensionHelper.NETWORK_SERVICES_DETAIL_KEY, "SourceNat");
+        when(extensionDetailsDao.listDetailsKeyPairs(8L)).thenReturn(oldDetailsMap).thenReturn(updatedDetailsMap);
+
+        when(networkOfferingServiceMapDao.listOfferingIdsByServiceAndProvider(Network.Service.StaticNat, "MyExt"))
+                .thenReturn(Collections.emptyList());
+        when(vpcOfferingServiceMapDao.listOfferingIdsByServiceAndProvider(Network.Service.StaticNat, "MyExt"))
+                .thenReturn(Collections.singletonList(1L));
+
+        extensionsManager.updateExtension(cmd);
+    }
+
+    @Test
+    public void testUpdateExtension_UpdatesPhysicalNetworkServicesWhenNotInUse() {
+        UpdateExtensionCmd cmd = mock(UpdateExtensionCmd.class);
+        when(cmd.getId()).thenReturn(7L);
+        when(cmd.isOrchestratorRequiresPrepareVm()).thenReturn(null);
+        when(cmd.getState()).thenReturn(null);
+        Map<String, String> newDetails = new HashMap<>();
+        newDetails.put(ExtensionHelper.NETWORK_SERVICES_DETAIL_KEY, "SourceNat,StaticNat");
+        when(cmd.getDetails()).thenReturn(newDetails);
+        when(cmd.isCleanupDetails()).thenReturn(false);
+
+        ExtensionVO ext = mock(ExtensionVO.class);
+        when(ext.getId()).thenReturn(7L);
+        when(ext.getName()).thenReturn("MyExt");
+        when(ext.getType()).thenReturn(Extension.Type.NetworkOrchestrator);
+        when(extensionDao.findById(7L)).thenReturn(ext);
+
+        Map<String, String> oldDetailsMap = new HashMap<>();
+        oldDetailsMap.put(ExtensionHelper.NETWORK_SERVICES_DETAIL_KEY, "SourceNat");
+        Map<String, String> updatedDetailsMap = new HashMap<>();
+        updatedDetailsMap.put(ExtensionHelper.NETWORK_SERVICES_DETAIL_KEY, "SourceNat,StaticNat");
+        when(extensionDetailsDao.listDetailsKeyPairs(7L)).thenReturn(oldDetailsMap).thenReturn(updatedDetailsMap);
+
+        when(extensionResourceMapDao.listResourceIdsByExtensionIdAndType(7L, ExtensionResourceMap.ResourceType.PhysicalNetwork))
+                .thenReturn(Collections.singletonList(100L));
+        PhysicalNetworkServiceProviderVO nsp = mock(PhysicalNetworkServiceProviderVO.class);
+        when(nsp.getId()).thenReturn(500L);
+        when(nsp.getEnabledServices()).thenReturn(new ArrayList<>(Collections.singletonList(Network.Service.SourceNat)));
+        when(physicalNetworkServiceProviderDao.findByServiceProvider(100L, "MyExt")).thenReturn(nsp);
+
+        extensionsManager.updateExtension(cmd);
+
+        ArgumentCaptor<List<Network.Service>> captor = ArgumentCaptor.forClass(List.class);
+        verify(nsp).setEnabledServices(captor.capture());
+        assertTrue(captor.getValue().contains(Network.Service.SourceNat));
+        assertTrue(captor.getValue().contains(Network.Service.StaticNat));
+        verify(physicalNetworkServiceProviderDao).update(500L, nsp);
+    }
+
     @Test
     public void updateExtensionsDetails_SavesDetails_WhenDetailsProvided() {
         long extensionId = 10L;
@@ -1024,13 +1109,6 @@ public void testDeleteExtension_Success() {
         verify(extensionDao).remove(1L);
     }
 
-    @Test
-    public void testRegisterExtensionWithResource_InvalidResourceType() {
-        RegisterExtensionCmd cmd = mock(RegisterExtensionCmd.class);
-        when(cmd.getResourceType()).thenReturn("InvalidType");
-
-        assertThrows(InvalidParameterValueException.class, () -> extensionsManager.registerExtensionWithResource(cmd));
-    }
 
     @Test
     public void registerExtensionWithResourceRegistersSuccessfullyForValidResourceType() {
@@ -1063,8 +1141,6 @@ public void registerExtensionWithResourceThrowsForMissingExtension() {
         RegisterExtensionCmd cmd = mock(RegisterExtensionCmd.class);
         when(cmd.getResourceType()).thenReturn(ExtensionResourceMap.ResourceType.Cluster.name());
         when(cmd.getResourceId()).thenReturn(UUID.randomUUID().toString());
-        ClusterVO clusterVO = mock(ClusterVO.class);
-        when(clusterDao.findByUuid(anyString())).thenReturn(clusterVO);
         extensionsManager.registerExtensionWithResource(cmd);
     }
 
@@ -1139,6 +1215,154 @@ public void unregisterExtensionWithClusterHandlesMissingMappingGracefully() {
         verify(extensionResourceMapDao, never()).remove(anyLong());
     }
 
+    @Test
+    public void unregisterExtensionWithResourceThrowsWhenProviderUsedByExistingNetworks() {
+        UnregisterExtensionCmd cmd = mock(UnregisterExtensionCmd.class);
+        when(cmd.getResourceType()).thenReturn(ExtensionResourceMap.ResourceType.PhysicalNetwork.name());
+        when(cmd.getResourceId()).thenReturn("physnet-uuid");
+        when(cmd.getExtensionId()).thenReturn(1L);
+
+        PhysicalNetworkVO physicalNetwork = mock(PhysicalNetworkVO.class);
+        when(physicalNetwork.getId()).thenReturn(42L);
+        when(physicalNetworkDao.findByUuid("physnet-uuid")).thenReturn(physicalNetwork);
+
+        ExtensionResourceMapVO existing = mock(ExtensionResourceMapVO.class);
+        when(existing.getExtensionId()).thenReturn(1L);
+        when(extensionResourceMapDao.findResourceByExtensionIdAndResourceIdAndType(1L, 42L,
+                ExtensionResourceMap.ResourceType.PhysicalNetwork)).thenReturn(existing);
+
+        ExtensionVO extension = mock(ExtensionVO.class);
+        when(extension.getName()).thenReturn("extnet-provider");
+        when(extensionDao.findById(1L)).thenReturn(extension);
+
+        NetworkVO network = mock(NetworkVO.class);
+        when(networkDao.listByPhysicalNetworkAndProvider(42L, "extnet-provider")).thenReturn(List.of(network));
+
+        assertThrows(CloudRuntimeException.class, () -> extensionsManager.unregisterExtensionWithResource(cmd));
+        verify(extensionResourceMapDao, never()).remove(anyLong());
+    }
+
+    @Test
+    public void updateRegisteredExtensionWithResourceUpdatesDetailsForExistingMapping() {
+        UpdateRegisteredExtensionCmd cmd = mock(UpdateRegisteredExtensionCmd.class);
+        when(cmd.getResourceType()).thenReturn(ExtensionResourceMap.ResourceType.PhysicalNetwork.name());
+        when(cmd.getResourceId()).thenReturn("physnet-uuid");
+        when(cmd.getExtensionId()).thenReturn(1L);
+        when(cmd.getDetails()).thenReturn(Map.of("username", "root", "hosts", "10.10.10.10"));
+        when(cmd.isCleanupDetails()).thenReturn(false);
+
+        ExtensionVO extension = mock(ExtensionVO.class);
+        when(extensionDao.findById(1L)).thenReturn(extension);
+
+        PhysicalNetworkVO physicalNetwork = mock(PhysicalNetworkVO.class);
+        when(physicalNetwork.getId()).thenReturn(42L);
+        when(physicalNetworkDao.findByUuid("physnet-uuid")).thenReturn(physicalNetwork);
+
+        ExtensionResourceMapVO existing = mock(ExtensionResourceMapVO.class);
+        when(existing.getId()).thenReturn(100L);
+        when(extensionResourceMapDao.findResourceByExtensionIdAndResourceIdAndType(1L, 42L,
+                ExtensionResourceMap.ResourceType.PhysicalNetwork)).thenReturn(existing);
+
+        Extension result = extensionsManager.updateRegisteredExtensionWithResource(cmd);
+
+        assertEquals(extension, result);
+        verify(extensionResourceMapDetailsDao, never()).removeDetails(anyLong());
+        verify(extensionResourceMapDetailsDao).saveDetails(any());
+    }
+
+    @Test
+    public void updateRegisteredExtensionWithResourceCleanupDetailsFirstThenSaveRequested() {
+        UpdateRegisteredExtensionCmd cmd = mock(UpdateRegisteredExtensionCmd.class);
+        when(cmd.getResourceType()).thenReturn(ExtensionResourceMap.ResourceType.PhysicalNetwork.name());
+        when(cmd.getResourceId()).thenReturn("physnet-uuid");
+        when(cmd.getExtensionId()).thenReturn(1L);
+        when(cmd.getDetails()).thenReturn(Map.of("username", "root", "password", "secret"));
+        when(cmd.isCleanupDetails()).thenReturn(true);
+
+        ExtensionVO extension = mock(ExtensionVO.class);
+        when(extensionDao.findById(1L)).thenReturn(extension);
+
+        PhysicalNetworkVO physicalNetwork = mock(PhysicalNetworkVO.class);
+        when(physicalNetwork.getId()).thenReturn(42L);
+        when(physicalNetworkDao.findByUuid("physnet-uuid")).thenReturn(physicalNetwork);
+
+        ExtensionResourceMapVO existing = mock(ExtensionResourceMapVO.class);
+        when(existing.getId()).thenReturn(100L);
+        when(extensionResourceMapDao.findResourceByExtensionIdAndResourceIdAndType(1L, 42L,
+                ExtensionResourceMap.ResourceType.PhysicalNetwork)).thenReturn(existing);
+
+        extensionsManager.updateRegisteredExtensionWithResource(cmd);
+
+        verify(extensionResourceMapDetailsDao).removeDetails(100L);
+        verify(extensionResourceMapDetailsDao, never()).saveDetails(any());
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    public void updateRegisteredExtensionWithResourceStoresSensitiveDetailsWithDisplayFalse() {
+        UpdateRegisteredExtensionCmd cmd = mock(UpdateRegisteredExtensionCmd.class);
+        when(cmd.getResourceType()).thenReturn(ExtensionResourceMap.ResourceType.PhysicalNetwork.name());
+        when(cmd.getResourceId()).thenReturn("physnet-uuid");
+        when(cmd.getExtensionId()).thenReturn(1L);
+        when(cmd.getDetails()).thenReturn(Map.of("username", "root", "password", "newSecret"));
+        when(cmd.isCleanupDetails()).thenReturn(false);
+
+        ExtensionVO extension = mock(ExtensionVO.class);
+        when(extensionDao.findById(1L)).thenReturn(extension);
+
+        PhysicalNetworkVO physicalNetwork = mock(PhysicalNetworkVO.class);
+        when(physicalNetwork.getId()).thenReturn(42L);
+        when(physicalNetworkDao.findByUuid("physnet-uuid")).thenReturn(physicalNetwork);
+
+        ExtensionResourceMapVO existing = mock(ExtensionResourceMapVO.class);
+        when(existing.getId()).thenReturn(100L);
+        when(extensionResourceMapDao.findResourceByExtensionIdAndResourceIdAndType(1L, 42L,
+                ExtensionResourceMap.ResourceType.PhysicalNetwork)).thenReturn(existing);
+        extensionsManager.updateRegisteredExtensionWithResource(cmd);
+
+        ArgumentCaptor<List<ExtensionResourceMapDetailsVO>> captor = ArgumentCaptor.forClass(List.class);
+        verify(extensionResourceMapDetailsDao).saveDetails(captor.capture());
+        verify(extensionResourceMapDetailsDao, never()).removeDetails(anyLong());
+        List<ExtensionResourceMapDetailsVO> savedDetails = captor.getValue();
+
+        ExtensionResourceMapDetailsVO passwordDetail = savedDetails.stream()
+                .filter(detail -> "password".equals(detail.getName()))
+                .findFirst()
+                .orElse(null);
+        assertNotNull(passwordDetail);
+        assertFalse(passwordDetail.isDisplay());
+        assertEquals("newSecret", passwordDetail.getValue());
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    public void registerExtensionWithClusterStoresSensitiveDetailsWithDisplayFalse() {
+        Cluster cluster = mock(Cluster.class);
+        when(cluster.getId()).thenReturn(12L);
+        when(cluster.getHypervisorType()).thenReturn(Hypervisor.HypervisorType.External);
+
+        Extension extension = mock(Extension.class);
+        when(extension.getId()).thenReturn(5L);
+
+        ExtensionResourceMapVO persistedMap = mock(ExtensionResourceMapVO.class);
+        when(persistedMap.getId()).thenReturn(120L);
+        when(extensionResourceMapDao.persist(any())).thenReturn(persistedMap);
+
+        extensionsManager.registerExtensionWithCluster(cluster, extension,
+                Map.of("username", "admin", "password", "s3cr3t"));
+
+        ArgumentCaptor<List<ExtensionResourceMapDetailsVO>> captor = ArgumentCaptor.forClass(List.class);
+        verify(extensionResourceMapDetailsDao).saveDetails(captor.capture());
+        List<ExtensionResourceMapDetailsVO> savedDetails = captor.getValue();
+
+        ExtensionResourceMapDetailsVO passwordDetail = savedDetails.stream()
+                .filter(detail -> "password".equals(detail.getName()))
+                .findFirst()
+                .orElse(null);
+        assertNotNull(passwordDetail);
+        assertFalse(passwordDetail.isDisplay());
+    }
+
     @Test
     public void testCreateExtensionResponse_BasicFields() {
         Extension extension = mock(Extension.class);
@@ -1708,6 +1932,238 @@ public void runCustomAction_CheckAccessThrowsException() throws Exception {
         }
     }
 
+    @Test
+    public void runNetworkCustomAction_NoProviderFound_ReturnsFailureResponse() {
+        Network network = mock(Network.class);
+        when(network.getId()).thenReturn(11L);
+
+        ExtensionCustomActionVO actionVO = mock(ExtensionCustomActionVO.class);
+        when(actionVO.getId()).thenReturn(10L);
+        when(actionVO.getUuid()).thenReturn("action-uuid");
+        when(actionVO.getName()).thenReturn("dump-config");
+        when(extensionCustomActionDetailsDao.listDetailsKeyPairsWithVisibility(10L))
+                .thenReturn(new Pair<>(new HashMap<>(), new HashMap<>()));
+
+        ExtensionVO extensionVO = mock(ExtensionVO.class);
+
+        CustomActionResultResponse response = extensionsManager.runNetworkCustomAction(
+                network, actionVO, extensionVO, ExtensionCustomAction.ResourceType.Network, Collections.emptyMap());
+
+        assertFalse(response.getSuccess());
+        assertEquals("No network service provider found for this network", response.getResult().get(ApiConstants.DETAILS));
+    }
+
+    @Test
+    public void runNetworkCustomAction_ProviderElementMissing_ReturnsFailureResponse() {
+        Network network = mock(Network.class);
+        when(network.getId()).thenReturn(12L);
+        when(networkServiceMapDao.getProviderForServiceInNetwork(12L, Network.Service.CustomAction)).thenReturn("ExtProvider");
+        when(networkModel.getElementImplementingProvider("ExtProvider")).thenReturn(null);
+
+        ExtensionCustomActionVO actionVO = mock(ExtensionCustomActionVO.class);
+        when(actionVO.getId()).thenReturn(11L);
+        when(actionVO.getUuid()).thenReturn("action-uuid");
+        when(actionVO.getName()).thenReturn("dump-config");
+        when(extensionCustomActionDetailsDao.listDetailsKeyPairsWithVisibility(11L))
+                .thenReturn(new Pair<>(new HashMap<>(), new HashMap<>()));
+
+        ExtensionVO extensionVO = mock(ExtensionVO.class);
+        when(extensionVO.getName()).thenReturn("ExtProvider");
+
+        CustomActionResultResponse response = extensionsManager.runNetworkCustomAction(
+                network, actionVO, extensionVO, ExtensionCustomAction.ResourceType.Network, Collections.emptyMap());
+
+        assertFalse(response.getSuccess());
+        assertEquals("No network element found for provider: ExtProvider", response.getResult().get(ApiConstants.DETAILS));
+    }
+
+    @Test
+    public void runNetworkCustomAction_ProviderCannotHandle_ReturnsFailureResponse() {
+        Network network = mock(Network.class);
+        when(network.getId()).thenReturn(13L);
+        when(networkServiceMapDao.getProviderForServiceInNetwork(13L, Network.Service.CustomAction)).thenReturn("ExtProvider");
+
+        NetworkElement element = mock(NetworkElement.class, withSettings().extraInterfaces(NetworkCustomActionProvider.class));
+        NetworkCustomActionProvider provider = (NetworkCustomActionProvider) element;
+        when(networkModel.getElementImplementingProvider("ExtProvider")).thenReturn(element);
+        when(provider.canHandleCustomAction(network)).thenReturn(false);
+
+        ExtensionCustomActionVO actionVO = mock(ExtensionCustomActionVO.class);
+        when(actionVO.getId()).thenReturn(12L);
+        when(actionVO.getUuid()).thenReturn("action-uuid");
+        when(actionVO.getName()).thenReturn("dump-config");
+        when(extensionCustomActionDetailsDao.listDetailsKeyPairsWithVisibility(12L))
+                .thenReturn(new Pair<>(new HashMap<>(), new HashMap<>()));
+
+        ExtensionVO extensionVO = mock(ExtensionVO.class);
+        when(extensionVO.getName()).thenReturn("ExtProvider");
+
+        CustomActionResultResponse response = extensionsManager.runNetworkCustomAction(
+                network, actionVO, extensionVO, ExtensionCustomAction.ResourceType.Network, Collections.emptyMap());
+
+        assertFalse(response.getSuccess());
+        assertTrue(response.getResult().get(ApiConstants.DETAILS).contains("cannot handle custom action"));
+    }
+
+    @Test
+    public void runNetworkCustomAction_ProviderDoesNotImplementCustomAction_ReturnsFailureResponse() {
+        Network network = mock(Network.class);
+        when(network.getId()).thenReturn(131L);
+        when(networkServiceMapDao.getProviderForServiceInNetwork(131L, Network.Service.CustomAction)).thenReturn("ExtProvider");
+
+        NetworkElement element = mock(NetworkElement.class);
+        when(networkModel.getElementImplementingProvider("ExtProvider")).thenReturn(element);
+
+        ExtensionCustomActionVO actionVO = mock(ExtensionCustomActionVO.class);
+        when(actionVO.getId()).thenReturn(121L);
+        when(actionVO.getUuid()).thenReturn("action-uuid");
+        when(actionVO.getName()).thenReturn("dump-config");
+        when(extensionCustomActionDetailsDao.listDetailsKeyPairsWithVisibility(121L))
+                .thenReturn(new Pair<>(new HashMap<>(), new HashMap<>()));
+
+        ExtensionVO extensionVO = mock(ExtensionVO.class);
+        when(extensionVO.getName()).thenReturn("ExtProvider");
+
+        CustomActionResultResponse response = extensionsManager.runNetworkCustomAction(
+                network, actionVO, extensionVO, ExtensionCustomAction.ResourceType.Network, Collections.emptyMap());
+
+        assertFalse(response.getSuccess());
+        assertTrue(response.getResult().get(ApiConstants.DETAILS).contains("does not support custom actions"));
+    }
+
+    @Test
+    public void runNetworkCustomAction_SuccessfulExecution_ReturnsSuccessResponse() {
+        Network network = mock(Network.class);
+        when(network.getId()).thenReturn(14L);
+        when(networkServiceMapDao.getProviderForServiceInNetwork(14L, Network.Service.CustomAction)).thenReturn("ExtProvider");
+
+        NetworkElement element = mock(NetworkElement.class, withSettings().extraInterfaces(NetworkCustomActionProvider.class));
+        NetworkCustomActionProvider provider = (NetworkCustomActionProvider) element;
+        when(networkModel.getElementImplementingProvider("ExtProvider")).thenReturn(element);
+        when(provider.canHandleCustomAction(network)).thenReturn(true);
+        when(provider.runCustomAction(eq(network), eq("dump-config"), any())).thenReturn("dump-output");
+
+        ExtensionCustomActionVO actionVO = mock(ExtensionCustomActionVO.class);
+        when(actionVO.getId()).thenReturn(13L);
+        when(actionVO.getUuid()).thenReturn("action-uuid");
+        when(actionVO.getName()).thenReturn("dump-config");
+        when(extensionCustomActionDetailsDao.listDetailsKeyPairsWithVisibility(13L))
+                .thenReturn(new Pair<>(new HashMap<>(), new HashMap<>()));
+
+        ExtensionVO extensionVO = mock(ExtensionVO.class);
+        when(extensionVO.getName()).thenReturn("ExtProvider");
+
+        CustomActionResultResponse response = extensionsManager.runNetworkCustomAction(
+                network, actionVO, extensionVO, ExtensionCustomAction.ResourceType.Network, Collections.emptyMap());
+
+        assertTrue(response.getSuccess());
+        assertEquals("dump-output", response.getResult().get(ApiConstants.DETAILS));
+    }
+
+    @Test
+    public void runVpcCustomAction_ProviderNotCustomActionProvider_ReturnsFailureResponse() {
+        Vpc vpc = mock(Vpc.class);
+        when(vpc.getId()).thenReturn(21L);
+        when(vpcServiceMapDao.getProviderForServiceInVpc(21L, Network.Service.CustomAction)).thenReturn("VpcProvider");
+
+        NetworkElement element = mock(NetworkElement.class);
+        when(networkModel.getElementImplementingProvider("VpcProvider")).thenReturn(element);
+
+        ExtensionCustomActionVO actionVO = mock(ExtensionCustomActionVO.class);
+        when(actionVO.getId()).thenReturn(20L);
+        when(actionVO.getUuid()).thenReturn("action-uuid");
+        when(actionVO.getName()).thenReturn("dump-config");
+        when(extensionCustomActionDetailsDao.listDetailsKeyPairsWithVisibility(20L))
+                .thenReturn(new Pair<>(new HashMap<>(), new HashMap<>()));
+
+        ExtensionVO extensionVO = mock(ExtensionVO.class);
+        when(extensionVO.getName()).thenReturn("VpcProvider");
+
+        CustomActionResultResponse response = extensionsManager.runVpcCustomAction(
+                vpc, actionVO, extensionVO, ExtensionCustomAction.ResourceType.Vpc, Collections.emptyMap());
+
+        assertFalse(response.getSuccess());
+        assertTrue(response.getResult().get(ApiConstants.DETAILS).contains("does not support custom actions"));
+    }
+
+    @Test
+    public void runVpcCustomAction_NoProviderFound_ReturnsFailureResponse() {
+        Vpc vpc = mock(Vpc.class);
+        when(vpc.getId()).thenReturn(211L);
+
+        ExtensionCustomActionVO actionVO = mock(ExtensionCustomActionVO.class);
+        when(actionVO.getId()).thenReturn(201L);
+        when(actionVO.getUuid()).thenReturn("action-uuid");
+        when(actionVO.getName()).thenReturn("dump-config");
+        when(extensionCustomActionDetailsDao.listDetailsKeyPairsWithVisibility(201L))
+                .thenReturn(new Pair<>(new HashMap<>(), new HashMap<>()));
+
+        ExtensionVO extensionVO = mock(ExtensionVO.class);
+
+        CustomActionResultResponse response = extensionsManager.runVpcCustomAction(
+                vpc, actionVO, extensionVO, ExtensionCustomAction.ResourceType.Vpc, Collections.emptyMap());
+
+        assertFalse(response.getSuccess());
+        assertEquals("No VPC service provider found for this VPC", response.getResult().get(ApiConstants.DETAILS));
+    }
+
+    @Test
+    public void runVpcCustomAction_ProviderCannotHandleVpc_ReturnsFailureResponse() {
+        Vpc vpc = mock(Vpc.class);
+        when(vpc.getId()).thenReturn(212L);
+        when(vpcServiceMapDao.getProviderForServiceInVpc(212L, Network.Service.CustomAction)).thenReturn("VpcProvider");
+
+        NetworkElement element = mock(NetworkElement.class, withSettings().extraInterfaces(NetworkCustomActionProvider.class));
+        NetworkCustomActionProvider provider = (NetworkCustomActionProvider) element;
+        when(networkModel.getElementImplementingProvider("VpcProvider")).thenReturn(element);
+        when(provider.canHandleVpcCustomAction(vpc)).thenReturn(false);
+
+        ExtensionCustomActionVO actionVO = mock(ExtensionCustomActionVO.class);
+        when(actionVO.getId()).thenReturn(202L);
+        when(actionVO.getUuid()).thenReturn("action-uuid");
+        when(actionVO.getName()).thenReturn("dump-config");
+        when(extensionCustomActionDetailsDao.listDetailsKeyPairsWithVisibility(202L))
+                .thenReturn(new Pair<>(new HashMap<>(), new HashMap<>()));
+
+        ExtensionVO extensionVO = mock(ExtensionVO.class);
+        when(extensionVO.getName()).thenReturn("VpcProvider");
+
+        CustomActionResultResponse response = extensionsManager.runVpcCustomAction(
+                vpc, actionVO, extensionVO, ExtensionCustomAction.ResourceType.Vpc, Collections.emptyMap());
+
+        assertFalse(response.getSuccess());
+        assertTrue(response.getResult().get(ApiConstants.DETAILS).contains("cannot handle custom action"));
+    }
+
+    @Test
+    public void runVpcCustomAction_SuccessfulExecution_ReturnsSuccessResponse() {
+        Vpc vpc = mock(Vpc.class);
+        when(vpc.getId()).thenReturn(22L);
+        when(vpcServiceMapDao.getProviderForServiceInVpc(22L, Network.Service.CustomAction)).thenReturn("VpcProvider");
+
+        NetworkElement element = mock(NetworkElement.class, withSettings().extraInterfaces(NetworkCustomActionProvider.class));
+        NetworkCustomActionProvider provider = (NetworkCustomActionProvider) element;
+        when(networkModel.getElementImplementingProvider("VpcProvider")).thenReturn(element);
+        when(provider.canHandleVpcCustomAction(vpc)).thenReturn(true);
+        when(provider.runCustomAction(eq(vpc), eq("dump-config"), any())).thenReturn("vpc-dump-output");
+
+        ExtensionCustomActionVO actionVO = mock(ExtensionCustomActionVO.class);
+        when(actionVO.getId()).thenReturn(21L);
+        when(actionVO.getUuid()).thenReturn("action-uuid");
+        when(actionVO.getName()).thenReturn("dump-config");
+        when(extensionCustomActionDetailsDao.listDetailsKeyPairsWithVisibility(21L))
+                .thenReturn(new Pair<>(new HashMap<>(), new HashMap<>()));
+
+        ExtensionVO extensionVO = mock(ExtensionVO.class);
+        when(extensionVO.getName()).thenReturn("VpcProvider");
+
+        CustomActionResultResponse response = extensionsManager.runVpcCustomAction(
+                vpc, actionVO, extensionVO, ExtensionCustomAction.ResourceType.Vpc, Collections.emptyMap());
+
+        assertTrue(response.getSuccess());
+        assertEquals("vpc-dump-output", response.getResult().get(ApiConstants.DETAILS));
+    }
+
     @Test
     public void createCustomActionResponse_SetsBasicFields() {
         ExtensionCustomAction action = mock(ExtensionCustomAction.class);
@@ -2218,4 +2674,392 @@ public void addInbuiltExtensionReservedResourceDetailsAddedDetails() {
         assertEquals(reservedResourceDetails.size(), entry.getValue().size());
         assertTrue(reservedResourceDetails.containsAll(entry.getValue()));
     }
+
+    // -----------------------------------------------------------------------
+    // Tests for network custom action behavior
+    // -----------------------------------------------------------------------
+
+
+    // Helper: a mock object that is both a NetworkElement and a NetworkCustomActionProvider
+    interface MockNetworkElement extends NetworkElement, NetworkCustomActionProvider {}
+
+    @Test
+    public void runNetworkCustomActionSucceeds() {
+        Network network = mock(Network.class);
+        when(network.getId()).thenReturn(5L);
+
+        ExtensionCustomActionVO actionVO = mock(ExtensionCustomActionVO.class);
+        when(actionVO.getUuid()).thenReturn("action-uuid");
+        when(actionVO.getName()).thenReturn("reboot-device");
+        when(actionVO.getId()).thenReturn(1L);
+
+        ExtensionVO extensionVO = mock(ExtensionVO.class);
+        when(extensionVO.getName()).thenReturn("my-extnet");
+
+        Pair<Map<String, String>, Map<String, String>> details = new Pair<>(new HashMap<>(), new HashMap<>());
+        when(extensionCustomActionDetailsDao.listDetailsKeyPairsWithVisibility(1L)).thenReturn(details);
+
+        // networkServiceMapDao returns provider name for SourceNat
+        when(networkServiceMapDao.getProviderForServiceInNetwork(eq(5L), any())).thenReturn("my-extnet");
+
+        // element implements both NetworkElement and NetworkCustomActionProvider
+        MockNetworkElement element = mock(MockNetworkElement.class);
+        when(element.canHandleCustomAction(eq(network))).thenReturn(true);
+        when(element.runCustomAction(eq(network), eq("reboot-device"), any())).thenReturn("OK: bridge bounced");
+        when(networkModel.getElementImplementingProvider("my-extnet")).thenReturn(element);
+
+        CustomActionResultResponse resp = extensionsManager.runNetworkCustomAction(
+                network, actionVO, extensionVO,
+                ExtensionCustomAction.ResourceType.Network, new HashMap<>());
+
+        assertTrue(resp.isSuccess());
+        assertEquals("OK: bridge bounced", resp.getResult().get(ApiConstants.DETAILS));
+    }
+
+    @Test
+    public void runNetworkCustomActionFailsWhenNoProvider() {
+        Network network = mock(Network.class);
+        when(network.getId()).thenReturn(5L);
+
+        ExtensionCustomActionVO actionVO = mock(ExtensionCustomActionVO.class);
+        when(actionVO.getUuid()).thenReturn("action-uuid");
+        when(actionVO.getName()).thenReturn("dump-config");
+        when(actionVO.getId()).thenReturn(2L);
+
+        ExtensionVO extensionVO = mock(ExtensionVO.class);
+
+        Pair<Map<String, String>, Map<String, String>> details = new Pair<>(new HashMap<>(), new HashMap<>());
+        when(extensionCustomActionDetailsDao.listDetailsKeyPairsWithVisibility(2L)).thenReturn(details);
+
+        // No provider found for any service
+        when(networkServiceMapDao.getProviderForServiceInNetwork(eq(5L), any())).thenReturn(null);
+
+        CustomActionResultResponse resp = extensionsManager.runNetworkCustomAction(
+                network, actionVO, extensionVO,
+                ExtensionCustomAction.ResourceType.Network, new HashMap<>());
+
+        assertFalse(resp.isSuccess());
+        assertTrue(resp.getResult().get(ApiConstants.DETAILS).contains("No network service provider"));
+    }
+
+    // -----------------------------------------------------------------------
+    // Tests for getExtensionFromResource with Network resource type
+    // -----------------------------------------------------------------------
+
+    @Test
+    public void getExtensionFromResourceReturnsExtensionForNetworkWithProviderMatch() {
+        Network network = mock(Network.class);
+        when(network.getId()).thenReturn(10L);
+        when(network.getPhysicalNetworkId()).thenReturn(5L);
+        when(entityManager.findByUuid(eq(Network.class), eq("net-uuid"))).thenReturn(network);
+
+        String providerName ="my-ext-provider";
+        when(networkServiceMapDao.getProviderForServiceInNetwork(10L, Network.Service.CustomAction)).thenReturn(providerName);
+
+        ExtensionVO ext = mock(ExtensionVO.class);
+        doReturn(ext).when(extensionsManager).getExtensionForPhysicalNetworkAndProvider(5L, "my-ext-provider");
+
+        Extension result = extensionsManager.getExtensionWithCustomActionFromResource(ExtensionCustomAction.ResourceType.Network, "net-uuid");
+        assertEquals(ext, result);
+    }
+
+    @Test
+    public void getExtensionFromResourceFallsBackToFirstMappingForNetwork() {
+        Network network = mock(Network.class);
+        when(network.getId()).thenReturn(10L);
+        when(network.getPhysicalNetworkId()).thenReturn(5L);
+        when(entityManager.findByUuid(eq(Network.class), eq("net-uuid"))).thenReturn(network);
+
+        when(networkServiceMapDao.getProviderForServiceInNetwork(10L, Network.Service.CustomAction)).thenReturn(null);
+
+        Extension result = extensionsManager.getExtensionWithCustomActionFromResource(ExtensionCustomAction.ResourceType.Network, "net-uuid");
+        assertNull(result);
+    }
+
+    @Test
+    public void getExtensionFromResourceReturnsNullForNetworkWithNullPhysicalNetworkId() {
+        Network network = mock(Network.class);
+        when(network.getPhysicalNetworkId()).thenReturn(null);
+        when(entityManager.findByUuid(eq(Network.class), eq("net-uuid"))).thenReturn(network);
+
+        Extension result = extensionsManager.getExtensionWithCustomActionFromResource(ExtensionCustomAction.ResourceType.Network, "net-uuid");
+        assertNull(result);
+    }
+
+    // -----------------------------------------------------------------------
+    // Tests for getExtensionFromResource with Vpc resource type
+    // -----------------------------------------------------------------------
+
+    @Test
+    public void getExtensionFromResourceReturnsExtensionForVpcWithProviderMatch() {
+        Vpc vpc = mock(Vpc.class);
+        when(vpc.getId()).thenReturn(20L);
+        when(entityManager.findByUuid(eq(Vpc.class), eq("vpc-uuid"))).thenReturn(vpc);
+
+        when(vpcServiceMapDao.getProviderForServiceInVpc(20L, Network.Service.CustomAction)).thenReturn("my-vpc-provider");
+
+        ExtensionVO ext = mock(ExtensionVO.class);
+        when(extensionDao.findByNameAndType("my-vpc-provider", Extension.Type.NetworkOrchestrator)).thenReturn(ext);
+
+        Extension result = extensionsManager.getExtensionWithCustomActionFromResource(ExtensionCustomAction.ResourceType.Vpc, "vpc-uuid");
+
+        assertEquals(ext, result);
+    }
+
+    @Test
+    public void getExtensionFromResourceReturnsNullForVpcWithoutProvider() {
+        Vpc vpc = mock(Vpc.class);
+        when(vpc.getId()).thenReturn(20L);
+        when(entityManager.findByUuid(eq(Vpc.class), eq("vpc-uuid"))).thenReturn(vpc);
+
+        when(vpcServiceMapDao.getProviderForServiceInVpc(20L, Network.Service.CustomAction)).thenReturn(null);
+
+        Extension result = extensionsManager.getExtensionWithCustomActionFromResource(ExtensionCustomAction.ResourceType.Vpc, "vpc-uuid");
+
+        assertNull(result);
+        verify(extensionDao, never()).findByName(anyString());
+    }
+
+    @Test
+    public void getExtensionFromResourceReturnsNullForVpcWhenProviderExtensionNotFound() {
+        Vpc vpc = mock(Vpc.class);
+        when(vpc.getId()).thenReturn(20L);
+        when(entityManager.findByUuid(eq(Vpc.class), eq("vpc-uuid"))).thenReturn(vpc);
+
+        when(vpcServiceMapDao.getProviderForServiceInVpc(20L, Network.Service.CustomAction)).thenReturn("missing-provider");
+        when(extensionDao.findByNameAndType("missing-provider", Extension.Type.NetworkOrchestrator)).thenReturn(null);
+
+        Extension result = extensionsManager.getExtensionWithCustomActionFromResource(ExtensionCustomAction.ResourceType.Vpc, "vpc-uuid");
+
+        assertNull(result);
+    }
+
+
+    // -----------------------------------------------------------------------
+    // Tests for registerExtensionWithPhysicalNetwork
+    // -----------------------------------------------------------------------
+
+    @Test
+    public void registerExtensionWithPhysicalNetworkSucceeds() {
+        RegisterExtensionCmd cmd = mock(RegisterExtensionCmd.class);
+        when(cmd.getResourceType()).thenReturn(ExtensionResourceMap.ResourceType.PhysicalNetwork.name());
+        when(cmd.getResourceId()).thenReturn("pnet-uuid");
+        when(cmd.getExtensionId()).thenReturn(1L);
+        when(cmd.getDetails()).thenReturn(null);
+
+        ExtensionVO extension = mock(ExtensionVO.class);
+        when(extension.getType()).thenReturn(Extension.Type.NetworkOrchestrator);
+        when(extension.getName()).thenReturn("my-ext");
+        when(extension.getId()).thenReturn(1L);
+        when(extensionDao.findById(1L)).thenReturn(extension);
+
+        PhysicalNetworkVO physNet = mock(PhysicalNetworkVO.class);
+        when(physNet.getId()).thenReturn(42L);
+        when(physicalNetworkDao.findByUuid("pnet-uuid")).thenReturn(physNet);
+
+        when(extensionResourceMapDao.findResourceByExtensionIdAndResourceIdAndType(1L, 42L,
+                ExtensionResourceMap.ResourceType.PhysicalNetwork)).thenReturn(null);
+        when(extensionDetailsDao.listDetailsKeyPairs(1L)).thenReturn(Collections.emptyMap());
+
+        ExtensionResourceMapVO savedMap = mock(ExtensionResourceMapVO.class);
+        when(savedMap.getExtensionId()).thenReturn(1L);
+        when(extensionResourceMapDao.persist(any())).thenReturn(savedMap);
+
+        when(physicalNetworkServiceProviderDao.findByServiceProvider(42L, "my-ext")).thenReturn(null);
+
+        Extension result = extensionsManager.registerExtensionWithResource(cmd);
+        assertEquals(extension, result);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void registerExtensionWithPhysicalNetworkFailsForNonNetworkOrchestratorType() {
+        RegisterExtensionCmd cmd = mock(RegisterExtensionCmd.class);
+        when(cmd.getResourceType()).thenReturn(ExtensionResourceMap.ResourceType.PhysicalNetwork.name());
+        when(cmd.getResourceId()).thenReturn("pnet-uuid");
+        when(cmd.getExtensionId()).thenReturn(1L);
+
+        ExtensionVO extension = mock(ExtensionVO.class);
+        when(extension.getType()).thenReturn(Extension.Type.Orchestrator);
+        when(extension.getName()).thenReturn("orch-ext");
+        when(extensionDao.findById(1L)).thenReturn(extension);
+
+        PhysicalNetworkVO physNet = mock(PhysicalNetworkVO.class);
+        when(physicalNetworkDao.findByUuid("pnet-uuid")).thenReturn(physNet);
+
+        extensionsManager.registerExtensionWithResource(cmd);
+    }
+
+
+    // -----------------------------------------------------------------------
+    // Tests for getExtensionForPhysicalNetworkAndProvider
+    // -----------------------------------------------------------------------
+
+    @Test
+    public void getExtensionForPhysicalNetworkAndProviderReturnsMatchingExtension() {
+        ExtensionVO ext = mock(ExtensionVO.class);
+        when(ext.getId()).thenReturn(10L);
+        when(extensionDao.findByName("myext")).thenReturn(ext);
+        when(extensionResourceMapDao.findResourceByExtensionIdAndResourceIdAndType(10L, 5L,
+                ExtensionResourceMap.ResourceType.PhysicalNetwork)).thenReturn(mock(ExtensionResourceMapVO.class));
+
+        Extension result = extensionsManager.getExtensionForPhysicalNetworkAndProvider(5L, "myext");
+        assertEquals(ext, result);
+    }
+
+    @Test
+    public void getExtensionForPhysicalNetworkAndProviderReturnsNullWhenNameDoesNotMatch() {
+        ExtensionVO ext = mock(ExtensionVO.class);
+        when(ext.getId()).thenReturn(10L);
+        when(extensionDao.findByName("myext")).thenReturn(ext);
+        when(extensionResourceMapDao.findResourceByExtensionIdAndResourceIdAndType(10L, 5L,
+                ExtensionResourceMap.ResourceType.PhysicalNetwork)).thenReturn(null);
+
+        Extension result = extensionsManager.getExtensionForPhysicalNetworkAndProvider(5L, "myext");
+        assertNull(result);
+    }
+
+    @Test
+    public void getExtensionForPhysicalNetworkAndProviderReturnsNullForNullProviderName() {
+        Extension result = extensionsManager.getExtensionForPhysicalNetworkAndProvider(5L, null);
+        assertNull(result);
+    }
+
+    // -----------------------------------------------------------------------
+    // Tests for getAllResourceMapDetailsForExtensionOnPhysicalNetwork
+    // -----------------------------------------------------------------------
+
+    @Test
+    public void getAllResourceMapDetailsForExtensionOnPhysicalNetworkReturnsDetails() {
+        ExtensionResourceMapVO mapVO = mock(ExtensionResourceMapVO.class);
+        when(mapVO.getId()).thenReturn(100L);
+        when(extensionResourceMapDao.findResourceByExtensionIdAndResourceIdAndType(10L, 5L,
+                ExtensionResourceMap.ResourceType.PhysicalNetwork)).thenReturn(mapVO);
+        when(extensionResourceMapDetailsDao.listDetailsKeyPairs(100L))
+                .thenReturn(Map.of("host", "192.168.1.1"));
+
+        Map<String, String> result = extensionsManager.getAllResourceMapDetailsForExtensionOnPhysicalNetwork(5L, 10L);
+        assertEquals("192.168.1.1", result.get("host"));
+    }
+
+    @Test
+    public void getAllResourceMapDetailsForExtensionOnPhysicalNetworkReturnsEmptyWhenNoMapping() {
+        when(extensionResourceMapDao.findResourceByExtensionIdAndResourceIdAndType(10L, 5L,
+                ExtensionResourceMap.ResourceType.PhysicalNetwork)).thenReturn(null);
+
+        Map<String, String> result = extensionsManager.getAllResourceMapDetailsForExtensionOnPhysicalNetwork(5L, 10L);
+        assertTrue(result.isEmpty());
+    }
+
+    // -----------------------------------------------------------------------
+    // Tests for isNetworkExtensionProvider
+    // -----------------------------------------------------------------------
+
+    @Test
+    public void isNetworkExtensionProviderReturnsTrueWhenProviderMatchesExtension() {
+        when(extensionDao.findByNameAndType("my-ext", Extension.Type.NetworkOrchestrator)).thenReturn(mock(ExtensionVO.class));
+
+        assertTrue(extensionsManager.isNetworkExtensionProvider("my-ext"));
+    }
+
+    @Test
+    public void isNetworkExtensionProviderReturnsFalseWhenNoMatch() {
+        when(extensionDao.findByNameAndType("unknown", Extension.Type.NetworkOrchestrator)).thenReturn(null);
+        assertFalse(extensionsManager.isNetworkExtensionProvider("unknown"));
+    }
+
+    @Test
+    public void isNetworkExtensionProviderReturnsFalseForNullProvider() {
+        assertFalse(extensionsManager.isNetworkExtensionProvider(null));
+    }
+
+    // -----------------------------------------------------------------------
+    // Tests for listExtensionsByType
+    // -----------------------------------------------------------------------
+
+    @Test
+    public void listExtensionsByTypeReturnsExtensionsForType() {
+        ExtensionVO ext = mock(ExtensionVO.class);
+        when(extensionDao.listByType(Extension.Type.NetworkOrchestrator)).thenReturn(List.of(ext));
+
+        List<Extension> result = extensionsManager.listExtensionsByType(Extension.Type.NetworkOrchestrator);
+        assertEquals(1, result.size());
+        assertEquals(ext, result.get(0));
+    }
+
+    @Test
+    public void listExtensionsByTypeReturnsEmptyForNullType() {
+        List<Extension> result = extensionsManager.listExtensionsByType(null);
+        assertTrue(result.isEmpty());
+    }
+
+    @Test
+    public void listExtensionsByTypeReturnsEmptyWhenNoExtensions() {
+        when(extensionDao.listByType(Extension.Type.NetworkOrchestrator)).thenReturn(Collections.emptyList());
+        List<Extension> result = extensionsManager.listExtensionsByType(Extension.Type.NetworkOrchestrator);
+        assertTrue(result.isEmpty());
+    }
+
+    // -----------------------------------------------------------------------
+    // Tests for getNetworkCapabilitiesForProvider
+    // -----------------------------------------------------------------------
+
+    @Test
+    public void getNetworkCapabilitiesForProviderReturnsCapabilitiesFromExtensionDetails() {
+        long physNetId = 10L;
+        String providerName = "my-ext";
+
+        ExtensionVO ext = mock(ExtensionVO.class);
+        when(ext.getId()).thenReturn(5L);
+        doReturn(ext).when(extensionsManager).getExtensionForPhysicalNetworkAndProvider(physNetId, providerName);
+
+        when(extensionDetailsDao.listDetailsKeyPairs(5L)).thenReturn(Map.of(
+                ExtensionHelper.NETWORK_SERVICES_DETAIL_KEY,
+                "SourceNat,StaticNat"));
+
+        Map<Network.Service, Map<Network.Capability, String>> result =
+                extensionsManager.getNetworkCapabilitiesForProvider(physNetId, providerName);
+        assertNotNull(result);
+        assertTrue(result.containsKey(Network.Service.SourceNat));
+    }
+
+    @Test
+    public void getNetworkCapabilitiesForProviderReturnsEmptyMapForNullProvider() {
+        Map<Network.Service, Map<Network.Capability, String>> result =
+                extensionsManager.getNetworkCapabilitiesForProvider(10L, null);
+        assertTrue(result.isEmpty());
+    }
+
+    @Test
+    public void runNetworkCustomActionFailsWhenProviderReturnsNull() {
+        Network network = mock(Network.class);
+        when(network.getId()).thenReturn(5L);
+
+        ExtensionCustomActionVO actionVO = mock(ExtensionCustomActionVO.class);
+        when(actionVO.getUuid()).thenReturn("action-uuid");
+        when(actionVO.getName()).thenReturn("unknown-action");
+        when(actionVO.getId()).thenReturn(3L);
+
+        ExtensionVO extensionVO = mock(ExtensionVO.class);
+        when(extensionVO.getName()).thenReturn("my-extnet");
+
+        Pair<Map<String, String>, Map<String, String>> details = new Pair<>(new HashMap<>(), new HashMap<>());
+        when(extensionCustomActionDetailsDao.listDetailsKeyPairsWithVisibility(3L)).thenReturn(details);
+
+        // networkServiceMapDao returns provider name
+        when(networkServiceMapDao.getProviderForServiceInNetwork(eq(5L), any())).thenReturn("my-extnet");
+
+        // element implements both NetworkElement and NetworkCustomActionProvider but action returns null
+        MockNetworkElement element = mock(MockNetworkElement.class);
+        when(element.canHandleCustomAction(eq(network))).thenReturn(true);
+        when(element.runCustomAction(eq(network), eq("unknown-action"), any())).thenReturn(null);
+        when(networkModel.getElementImplementingProvider("my-extnet")).thenReturn(element);
+
+        CustomActionResultResponse resp = extensionsManager.runNetworkCustomAction(
+                network, actionVO, extensionVO,
+                ExtensionCustomAction.ResourceType.Network, new HashMap<>());
+
+        assertFalse(resp.isSuccess());
+        assertTrue(resp.getResult().get(ApiConstants.DETAILS).contains("Action failed"));
+    }
+
 }
diff --git a/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/impl/AsyncJobManagerImpl.java b/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/impl/AsyncJobManagerImpl.java
index 9d71c6d07b49..be0953581dd7 100644
--- a/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/impl/AsyncJobManagerImpl.java
+++ b/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/impl/AsyncJobManagerImpl.java
@@ -31,6 +31,8 @@
 import java.util.concurrent.RejectedExecutionException;
 import java.util.concurrent.ScheduledExecutorService;
 import java.util.concurrent.TimeUnit;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 import javax.inject.Inject;
 import javax.naming.ConfigurationException;
@@ -116,6 +118,8 @@
 import org.apache.logging.log4j.ThreadContext;
 
 public class AsyncJobManagerImpl extends ManagerBase implements AsyncJobManager, ClusterManagerListener, Configurable {
+    private static final Pattern PASSWORD_FIELD_PATTERN = Pattern.compile("\\\"password\\\":\\\"([^\\\"]*)\\\"+");
+
     // Advanced
     public static final ConfigKey<Long> JobExpireMinutes = new ConfigKey<Long>("Advanced", Long.class, "job.expire.minutes", "1440",
         "Time (in minutes) for async-jobs to be kept in system", true, ConfigKey.Scope.Global);
@@ -555,22 +559,26 @@ public AsyncJob queryJob(final long jobId, final boolean updatePollTime) {
     }
 
     public String obfuscatePassword(String result, boolean hidePassword) {
-        if (hidePassword) {
-            String pattern = "\"password\":";
-            if (result != null) {
-                if (result.contains(pattern)) {
-                    String[] resp = result.split(pattern);
-                    String psswd = resp[1].toString().split(",")[0];
-                    if (psswd.endsWith("}")) {
-                        psswd = psswd.substring(0, psswd.length() - 1);
-                        result = resp[0] + pattern + psswd.replace(psswd.substring(2, psswd.length() - 1), "*****") + "}," + resp[1].split(",", 2)[1];
-                    } else {
-                        result = resp[0] + pattern + psswd.replace(psswd.substring(2, psswd.length() - 1), "*****") + "," + resp[1].split(",", 2)[1];
-                    }
-                }
-            }
+        if (!hidePassword || StringUtils.isBlank(result)) {
+            return result;
+        }
+
+        Matcher matcher = PASSWORD_FIELD_PATTERN.matcher(result);
+        StringBuilder obfuscatedResult = new StringBuilder();
+        while (matcher.find()) {
+            String password = matcher.group(1);
+            String replacement = "\"password\":\"" + obfuscatePasswordValue(password) + "\"";
+            matcher.appendReplacement(obfuscatedResult, Matcher.quoteReplacement(replacement));
+        }
+        matcher.appendTail(obfuscatedResult);
+        return obfuscatedResult.toString();
+    }
+
+    private String obfuscatePasswordValue(String password) {
+        if (StringUtils.isEmpty(password)) {
+            return password;
         }
-        return result;
+        return password.charAt(0) + "*****";
     }
 
     private void scheduleExecution(final AsyncJobVO job) {
diff --git a/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/impl/VmWorkJobVO.java b/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/impl/VmWorkJobVO.java
index 41eaac598bf3..050fe4e5215c 100644
--- a/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/impl/VmWorkJobVO.java
+++ b/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/impl/VmWorkJobVO.java
@@ -69,6 +69,14 @@ public VmWorkJobVO(String related) {
         setRelated(related);
     }
 
+    public VmWorkJobVO(String related, long userId, long accountId, String cmd, Long instanceId, VirtualMachine.Type vmType, Step step) {
+        super(null, userId, accountId, cmd, null, instanceId, null, null);
+        setRelated(related);
+        this.vmType = vmType;
+        this.step = step;
+        this.vmInstanceId = instanceId;
+    }
+
     public Step getStep() {
         return step;
     }
diff --git a/framework/jobs/src/test/java/org/apache/cloudstack/framework/jobs/AsyncJobManagerTest.java b/framework/jobs/src/test/java/org/apache/cloudstack/framework/jobs/AsyncJobManagerTest.java
index 7130873e4eed..f3cd37188456 100644
--- a/framework/jobs/src/test/java/org/apache/cloudstack/framework/jobs/AsyncJobManagerTest.java
+++ b/framework/jobs/src/test/java/org/apache/cloudstack/framework/jobs/AsyncJobManagerTest.java
@@ -17,12 +17,15 @@
 package org.apache.cloudstack.framework.jobs;
 
 import org.apache.cloudstack.framework.jobs.impl.AsyncJobManagerImpl;
+import org.apache.commons.lang3.StringUtils;
 import org.junit.Assert;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.mockito.Spy;
 import org.mockito.junit.MockitoJUnitRunner;
 
+import com.cloud.utils.HumanReadableJson;
+
 @RunWith (MockitoJUnitRunner.class)
 public class AsyncJobManagerTest {
 
@@ -37,6 +40,12 @@ public class AsyncJobManagerTest {
     String inputNoBraces = "\"password\":\"password\"\",\"action\":\"OFF\"";
     String expectedNoBraces = "\"password\":\"p*****\",\"action\":\"OFF\"";
 
+    String realUserVmResponseWithPasswordInput = "{\"id\":\"f75b0990-5801-4b78-bcb0-58a503afa49c\",\"name\":\"pw-vm\"," +
+            "\"displayname\":\"pw-vm\",\"account\":\"admin\",\"password\":\"67wSK5\",\"instancename\":\"i-2-17-VM\"," +
+            "\"details\":{\"password\":\"3WTVryPJZJwMZGcJJ+OOYf84+uixk/1FraomPG9N6/Uvng\\u003d\\u003d\"," +
+            "\"Message.ReservedCapacityFreed.Flag\":\"true\",\"rootDiskController\":\"osdefault\"}," +
+            "\"arch\":\"x86_64\",\"jobid\":\"c13865d3-61ec-4269-979a-3d799181d5fe\",\"jobstatus\":0}";
+
     @Test
     public void obfuscatePasswordTest() {
         String result = asyncJobManager.obfuscatePassword(input, true);
@@ -79,4 +88,15 @@ public void obfuscatePasswordTestHidePasswordNoPassword() {
         Assert.assertEquals(noPassword, result);
     }
 
+    @Test
+    public void obfuscatePasswordTestHidePasswordRealInput() {
+        String result = asyncJobManager.obfuscatePassword(realUserVmResponseWithPasswordInput, true);
+
+        Assert.assertNotNull(result);
+        Assert.assertFalse(result.contains("\"password\":\"3WTVryPJZJwMZGcJJ+OOYf84+uixk\""));
+        String jsonObject = HumanReadableJson.getHumanReadableBytesJson(result);
+        Assert.assertTrue(StringUtils.isNotEmpty(jsonObject));
+        Assert.assertTrue(jsonObject.contains("\"password\":\"3*****\""));
+    }
+
 }
diff --git a/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaCreditsDao.java b/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaCreditsDao.java
index da36bc0b98c5..faf5ce363393 100644
--- a/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaCreditsDao.java
+++ b/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaCreditsDao.java
@@ -25,7 +25,7 @@
 
 public interface QuotaCreditsDao extends GenericDao<QuotaCreditsVO, Long> {
 
-    List<QuotaCreditsVO> findCredits(Long accountId, Long domainId, Date startDate, Date endDate, boolean recursive);
+    List<QuotaCreditsVO> findCredits(Long accountId, List<Long> domainIds, Date startDate, Date endDate);
 
     QuotaCreditsVO saveCredits(QuotaCreditsVO credits);
 
diff --git a/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaCreditsDaoImpl.java b/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaCreditsDaoImpl.java
index ce51177d0aec..ceb901ca30fd 100644
--- a/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaCreditsDaoImpl.java
+++ b/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaCreditsDaoImpl.java
@@ -21,7 +21,6 @@
 
 import javax.inject.Inject;
 
-import com.cloud.domain.dao.DomainDao;
 import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.SearchBuilder;
 import org.apache.cloudstack.quota.vo.QuotaBalanceVO;
@@ -39,8 +38,6 @@
 @Component
 public class QuotaCreditsDaoImpl extends GenericDaoBase<QuotaCreditsVO, Long> implements QuotaCreditsDao {
 
-    @Inject
-    DomainDao domainDao;
     @Inject
     QuotaBalanceDao quotaBalanceDao;
 
@@ -50,19 +47,18 @@ public QuotaCreditsDaoImpl() {
         quotaCreditsVoSearch = createSearchBuilder();
         quotaCreditsVoSearch.and("updatedOn", quotaCreditsVoSearch.entity().getUpdatedOn(), SearchCriteria.Op.BETWEEN);
         quotaCreditsVoSearch.and("accountId", quotaCreditsVoSearch.entity().getAccountId(), SearchCriteria.Op.EQ);
-        quotaCreditsVoSearch.and("domainId", quotaCreditsVoSearch.entity().getDomainId(), SearchCriteria.Op.IN);
+        quotaCreditsVoSearch.and("domainIds", quotaCreditsVoSearch.entity().getDomainId(), SearchCriteria.Op.IN);
         quotaCreditsVoSearch.done();
     }
 
     @Override
-    public List<QuotaCreditsVO> findCredits(Long accountId, Long domainId, Date startDate, Date endDate, boolean recursive) {
+    public List<QuotaCreditsVO> findCredits(Long accountId, List<Long> domainIds, Date startDate, Date endDate) {
         SearchCriteria<QuotaCreditsVO> sc = quotaCreditsVoSearch.create();
         Filter filter = new Filter(QuotaCreditsVO.class, "updatedOn", true, 0L, Long.MAX_VALUE);
 
         sc.setParametersIfNotNull("accountId", accountId);
-        if (domainId != null) {
-            List<Long> domainIds = recursive ? domainDao.getDomainAndChildrenIds(domainId) : List.of(domainId);
-            sc.setParameters("domainId", domainIds.toArray());
+        if (domainIds != null) {
+            sc.setParameters("domainIds", domainIds.toArray());
         }
 
         if (ObjectUtils.allNotNull(startDate, endDate)) {
diff --git a/packaging/systemd/cloudstack-management.default b/packaging/systemd/cloudstack-management.default
index a41338beda68..dbb7fa7d4bc5 100644
--- a/packaging/systemd/cloudstack-management.default
+++ b/packaging/systemd/cloudstack-management.default
@@ -15,7 +15,7 @@
 # specific language governing permissions and limitations
 # under the License.
 
-JAVA_OPTS="-Djava.security.properties=/etc/cloudstack/management/java.security.ciphers -Djava.awt.headless=true -Xmx2G -XX:+UseParallelGC -XX:MaxGCPauseMillis=500 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/cloudstack/management/ -XX:ErrorFile=/var/log/cloudstack/management/cloudstack-management.err --add-opens=java.base/java.lang=ALL-UNNAMED --add-exports=java.base/sun.security.x509=ALL-UNNAMED"
+JAVA_OPTS="-Djava.security.properties=/etc/cloudstack/management/java.security.ciphers -Djava.awt.headless=true -Xmx2G -XX:+UseParallelGC -XX:MaxGCPauseMillis=500 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/cloudstack/management/ -XX:ErrorFile=/var/log/cloudstack/management/cloudstack-management.err --add-opens=java.base/java.lang=ALL-UNNAMED --add-exports=java.base/sun.security.x509=ALL-UNNAMED -Djava.io.tmpdir=/var/tmp"
 
 CLASSPATH="/usr/share/cloudstack-management/lib/*:/etc/cloudstack/management:/usr/share/cloudstack-common:/usr/share/cloudstack-management/setup:/usr/share/cloudstack-management:/usr/share/cloudstack-mysql-ha/lib/*"
 
diff --git a/plugins/backup/dummy/src/main/java/org/apache/cloudstack/backup/DummyBackupProvider.java b/plugins/backup/dummy/src/main/java/org/apache/cloudstack/backup/DummyBackupProvider.java
index b228a9f8ce05..00bb353788f9 100644
--- a/plugins/backup/dummy/src/main/java/org/apache/cloudstack/backup/DummyBackupProvider.java
+++ b/plugins/backup/dummy/src/main/java/org/apache/cloudstack/backup/DummyBackupProvider.java
@@ -90,13 +90,14 @@ public boolean assignVMToBackupOffering(VirtualMachine vm, BackupOffering backup
     }
 
     @Override
-    public boolean restoreVMFromBackup(VirtualMachine vm, Backup backup) {
+    public boolean restoreVMFromBackup(VirtualMachine vm, Backup backup, boolean quickRestore, Long hostId) {
         logger.debug("Restoring vm {} from backup {} on the Dummy Backup Provider", vm, backup);
         return true;
     }
 
     @Override
-    public Pair<Boolean, String> restoreBackedUpVolume(Backup backup, Backup.VolumeInfo backupVolumeInfo, String hostIp, String dataStoreUuid, Pair<String, VirtualMachine.State> vmNameAndState) {
+    public Pair<Boolean, String> restoreBackedUpVolume(Backup backup, Backup.VolumeInfo backupVolumeInfo, String hostIp, String dataStoreUuid,
+            Pair<String, VirtualMachine.State> vmNameAndState, VirtualMachine vm, boolean quickRestore) {
         final VolumeVO volume = volumeDao.findByUuid(backupVolumeInfo.getUuid());
         final StoragePoolHostVO dataStore = storagePoolHostDao.findByUuid(dataStoreUuid);
         final DiskOffering diskOffering = diskOfferingDao.findByUuid(backupVolumeInfo.getDiskOfferingId());
@@ -153,7 +154,7 @@ public boolean willDeleteBackupsOnOfferingRemoval() {
     }
 
     @Override
-    public Pair<Boolean, Backup> takeBackup(VirtualMachine vm, Boolean quiesceVM) {
+    public Pair<Boolean, Backup> takeBackup(VirtualMachine vm, Boolean quiesceVM, boolean isolated) {
         logger.debug("Starting backup for VM {} on Dummy provider", vm);
 
         BackupVO backup = new BackupVO();
@@ -204,7 +205,7 @@ public void syncBackupStorageStats(Long zoneId) {
     }
 
     @Override
-    public Pair<Boolean, String> restoreBackupToVM(VirtualMachine vm, Backup backup, String hostIp, String dataStoreUuid) {
+    public Pair<Boolean, String> restoreBackupToVM(VirtualMachine vm, Backup backup, String hostIp, String dataStoreUuid, boolean quickrestore) {
         return new Pair<>(true, null);
     }
 }
diff --git a/plugins/backup/kboss/pom.xml b/plugins/backup/kboss/pom.xml
new file mode 100644
index 000000000000..eb8cbd03efa1
--- /dev/null
+++ b/plugins/backup/kboss/pom.xml
@@ -0,0 +1,50 @@
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one
+  or more contributor license agreements. See the NOTICE file
+  distributed with this work for additional information
+  regarding copyright ownership. The ASF licenses this file
+  to you under the Apache License, Version 2.0 (the
+  "License"); you may not use this file except in compliance
+  with the License. You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing,
+  software distributed under the License is distributed on an
+  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+
+  KIND, either express or implied. See the License for the
+  specific language governing permissions and limitations
+  under the License.
+-->
+<project xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://maven.apache.org/POM/4.0.0"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <artifactId>cloud-plugin-backup-kvm-backup-on-secondary-storage</artifactId>
+    <name>Apache CloudStack Plugin - KVM Backup On Secondary Storage</name>
+    <parent>
+        <artifactId>cloudstack-plugins</artifactId>
+        <groupId>org.apache.cloudstack</groupId>
+        <version>4.23.0.0-SNAPSHOT</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <dependencies>
+        <dependency>
+            <groupId>org.apache.cloudstack</groupId>
+            <artifactId>cloud-plugin-hypervisor-kvm</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.cloudstack</groupId>
+            <artifactId>cloud-engine-components-api</artifactId>
+            <version>${project.version}</version>
+            <scope>compile</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.cloudstack</groupId>
+            <artifactId>cloud-engine-orchestration</artifactId>
+            <version>${project.version}</version>
+            <scope>compile</scope>
+        </dependency>
+    </dependencies>
+</project>
diff --git a/plugins/backup/kboss/src/main/java/org/apache/cloudstack/backup/KbossBackupProvider.java b/plugins/backup/kboss/src/main/java/org/apache/cloudstack/backup/KbossBackupProvider.java
new file mode 100644
index 000000000000..596dc62b7206
--- /dev/null
+++ b/plugins/backup/kboss/src/main/java/org/apache/cloudstack/backup/KbossBackupProvider.java
@@ -0,0 +1,2921 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.backup;
+
+import static org.apache.cloudstack.backup.dao.BackupDetailsDao.BACKUP_HASH;
+import static org.apache.cloudstack.backup.dao.BackupDetailsDao.CURRENT;
+import static org.apache.cloudstack.backup.dao.BackupDetailsDao.END_OF_CHAIN;
+import static org.apache.cloudstack.backup.dao.BackupDetailsDao.IMAGE_STORE_ID;
+import static org.apache.cloudstack.backup.dao.BackupDetailsDao.ISOLATED;
+import static org.apache.cloudstack.backup.dao.BackupDetailsDao.PARENT_ID;
+import static org.apache.cloudstack.backup.dao.BackupDetailsDao.SCREENSHOT_PATH;
+
+import java.io.File;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.LinkedHashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.Set;
+import java.util.UUID;
+import java.util.concurrent.ExecutionException;
+import java.util.stream.Collectors;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.alert.AlertService;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.command.user.vm.DestroyVMCmd;
+import org.apache.cloudstack.backup.dao.BackupDao;
+import org.apache.cloudstack.backup.dao.BackupDetailsDao;
+import org.apache.cloudstack.backup.dao.BackupOfferingDao;
+import org.apache.cloudstack.backup.dao.BackupOfferingDetailsDao;
+import org.apache.cloudstack.backup.dao.InternalBackupDataStoreDao;
+import org.apache.cloudstack.backup.dao.InternalBackupJoinDao;
+import org.apache.cloudstack.backup.dao.InternalBackupServiceJobDao;
+import org.apache.cloudstack.backup.dao.InternalBackupStoragePoolDao;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.engine.orchestration.service.VolumeOrchestrationService;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreManager;
+import org.apache.cloudstack.engine.subsystem.api.storage.EndPoint;
+import org.apache.cloudstack.engine.subsystem.api.storage.EndPointSelector;
+import org.apache.cloudstack.engine.subsystem.api.storage.VolumeDataFactory;
+import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.config.Configurable;
+import org.apache.cloudstack.framework.jobs.AsyncJob;
+import org.apache.cloudstack.framework.jobs.AsyncJobExecutionContext;
+import org.apache.cloudstack.framework.jobs.AsyncJobManager;
+import org.apache.cloudstack.framework.jobs.Outcome;
+import org.apache.cloudstack.framework.jobs.impl.AsyncJobVO;
+import org.apache.cloudstack.framework.jobs.impl.OutcomeImpl;
+import org.apache.cloudstack.framework.jobs.impl.VmWorkJobVO;
+import org.apache.cloudstack.jobs.JobInfo;
+import org.apache.cloudstack.secstorage.heuristics.HeuristicType;
+import org.apache.cloudstack.storage.command.BackupDeleteAnswer;
+import org.apache.cloudstack.storage.command.DeleteCommand;
+import org.apache.cloudstack.storage.datastore.db.ImageStoreDao;
+import org.apache.cloudstack.storage.datastore.db.ImageStoreVO;
+import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreVO;
+import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.apache.cloudstack.storage.heuristics.HeuristicRuleHelper;
+import org.apache.cloudstack.storage.to.BackupDeltaTO;
+import org.apache.cloudstack.storage.to.DeltaMergeTreeTO;
+import org.apache.cloudstack.storage.to.KbossTO;
+import org.apache.cloudstack.storage.to.VolumeObjectTO;
+import org.apache.cloudstack.storage.vmsnapshot.VMSnapshotHelper;
+import org.apache.cloudstack.storage.volume.VolumeObject;
+import org.apache.commons.collections4.CollectionUtils;
+import org.apache.commons.lang3.BooleanUtils;
+import org.apache.commons.lang3.ObjectUtils;
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.agent.AgentManager;
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.Command;
+import com.cloud.agent.api.storage.MergeDiskOnlyVmSnapshotCommand;
+import com.cloud.agent.api.to.DataStoreTO;
+import com.cloud.agent.api.to.DataTO;
+import com.cloud.agent.api.to.VirtualMachineTO;
+import com.cloud.agent.manager.Commands;
+import com.cloud.alert.AlertManager;
+import com.cloud.exception.AgentUnavailableException;
+import com.cloud.exception.InsufficientCapacityException;
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.exception.OperationTimedoutException;
+import com.cloud.exception.ResourceAllocationException;
+import com.cloud.exception.ResourceUnavailableException;
+import com.cloud.host.HostVO;
+import com.cloud.host.Status;
+import com.cloud.host.dao.HostDao;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.hypervisor.HypervisorGuru;
+import com.cloud.hypervisor.HypervisorGuruManager;
+import com.cloud.resource.ResourceState;
+import com.cloud.storage.DataStoreRole;
+import com.cloud.storage.DiskOfferingVO;
+import com.cloud.storage.Storage;
+import com.cloud.storage.Volume;
+import com.cloud.storage.VolumeApiService;
+import com.cloud.storage.VolumeApiServiceImpl;
+import com.cloud.storage.VolumeVO;
+import com.cloud.storage.dao.DiskOfferingDao;
+import com.cloud.storage.dao.VolumeDao;
+import com.cloud.uservm.UserVm;
+import com.cloud.utils.DateUtil;
+import com.cloud.utils.Pair;
+import com.cloud.utils.Predicate;
+import com.cloud.utils.component.AdapterBase;
+import com.cloud.utils.db.EntityManager;
+import com.cloud.utils.db.Transaction;
+import com.cloud.utils.db.TransactionCallback;
+import com.cloud.utils.db.TransactionLegacy;
+import com.cloud.utils.exception.BackupException;
+import com.cloud.utils.exception.BackupProviderException;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.utils.fsm.NoTransitionException;
+import com.cloud.vm.NicVO;
+import com.cloud.vm.UserVmManager;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VMInstanceDetailVO;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.VirtualMachineManager;
+import com.cloud.vm.VirtualMachineManagerImpl;
+import com.cloud.vm.VirtualMachineProfileImpl;
+import com.cloud.vm.VmDetailConstants;
+import com.cloud.vm.VmWork;
+import com.cloud.vm.VmWorkConstants;
+import com.cloud.vm.VmWorkDeleteBackup;
+import com.cloud.vm.VmWorkRestoreBackup;
+import com.cloud.vm.VmWorkRestoreVolumeBackupAndAttach;
+import com.cloud.vm.VmWorkSerializer;
+import com.cloud.vm.VmWorkTakeBackup;
+import com.cloud.vm.dao.NicDao;
+import com.cloud.vm.dao.UserVmDao;
+import com.cloud.vm.dao.VMInstanceDetailsDao;
+import com.cloud.vm.snapshot.VMSnapshot;
+import com.cloud.vm.snapshot.VMSnapshotDetailsVO;
+import com.cloud.vm.snapshot.VMSnapshotVO;
+import com.cloud.vm.snapshot.dao.VMSnapshotDao;
+import com.cloud.vm.snapshot.dao.VMSnapshotDetailsDao;
+
+public class KbossBackupProvider extends AdapterBase implements InternalBackupProvider, Configurable {
+    protected ConfigKey<Integer> backupChainSize = new ConfigKey<>("Advanced", Integer.class, "backup.chain.size", "8", "Determines the max size of a backup chain." +
+            " Currently only used by the KBOSS provider. If cloud admins set it to 1 , all the backups will be full backups. With values lower than 1, the backup chain will be " +
+            "unlimited, unless it is stopped by another process. Please note that unlimited backup chains have a higher chance of getting corrupted, as new backups will be" +
+            " dependant on all of the older ones.", true, ConfigKey.Scope.Zone);
+
+    protected ConfigKey<Integer> backupTimeout = new ConfigKey<>("Advanced", Integer.class, "kboss.timeout", "43200", "Timeout, in seconds, to execute KBOSS commands. After the " +
+            "command times out, the Management Server will still wait for another kboss.timeout seconds to receive a response from the Agent.", true, ConfigKey.Scope.Zone);
+
+    @Inject
+    private AsyncJobManager jobManager;
+    @Inject
+    private EntityManager entityManager;
+
+    @Inject
+    private VirtualMachineManager virtualMachineManager;
+
+    @Inject
+    private UserVmDao userVmDao;
+
+    @Inject
+    private VMInstanceDetailsDao vmInstanceDetailsDao;
+
+    @Inject
+    private VMSnapshotHelper vmSnapshotHelper;
+
+    @Inject
+    private SnapshotDataStoreDao snapshotDataStoreDao;
+
+    @Inject
+    private VMSnapshotDao vmSnapshotDao;
+
+    @Inject
+    private VMSnapshotDetailsDao vmSnapshotDetailsDao;
+
+    @Inject
+    private BackupDao backupDao;
+
+    @Inject
+    private InternalBackupJoinDao internalBackupJoinDao;
+
+    @Inject
+    private BackupDetailsDao backupDetailDao;
+
+    @Inject
+    private InternalBackupStoragePoolDao internalBackupStoragePoolDao;
+
+    @Inject
+    private InternalBackupDataStoreDao internalBackupDataStoreDao;
+
+    @Inject
+    private BackupOfferingDao backupOfferingDao;
+
+    @Inject
+    private BackupOfferingDetailsDao backupOfferingDetailsDao;
+
+    @Inject
+    private HeuristicRuleHelper heuristicRuleHelper;
+
+    @Inject
+    private DataStoreManager dataStoreManager;
+
+    @Inject
+    private AgentManager agentManager;
+
+    @Inject
+    private EndPointSelector endPointSelector;
+
+    @Inject
+    private VolumeDao volumeDao;
+
+    @Inject
+    private ImageStoreDao imageStoreDao;
+
+    @Inject
+    private VolumeApiService volumeApiService;
+
+    @Inject
+    private PrimaryDataStoreDao storagePoolDao;
+
+    @Inject
+    private HostDao hostDao;
+
+    @Inject
+    private UserVmManager userVmManager;
+
+    @Inject
+    private VolumeOrchestrationService volumeOrchestrationService;
+
+    @Inject
+    private VolumeDataFactory volumeDataFactory;
+    @Inject
+    private InternalBackupServiceJobDao internalBackupServiceJobDao;
+
+    @Inject
+    private BackupManager backupManager;
+
+    @Inject
+    private DiskOfferingDao diskOfferingDao;
+
+    @Inject
+    private HypervisorGuruManager hypervisorGuruManager;
+
+    @Inject
+    private NicDao nicDao;
+
+    @Inject
+    private AlertManager alertManager;
+
+    protected final List<Backup.Status> validChildStatesToRemoveBackup = List.of(Backup.Status.Expunged, Backup.Status.Error, Backup.Status.Failed);
+
+    private final List<Storage.StoragePoolType> supportedStoragePoolTypes = List.of(Storage.StoragePoolType.Filesystem, Storage.StoragePoolType.NetworkFilesystem,
+            Storage.StoragePoolType.SharedMountPoint);
+
+    private final List<Backup.Status> allowedBackupStatesToRemove = List.of(Backup.Status.BackedUp, Backup.Status.Failed, Backup.Status.Error);
+
+    private final List<Backup.Status> allowedBackupStatesToCompress = List.of(Backup.Status.BackedUp, Backup.Status.Restoring);
+
+    private final List<Backup.Status> allowedBackupStatesToValidate = List.of(Backup.Status.BackedUp, Backup.Status.Restoring);
+
+    private final List<VirtualMachine.State> allowedVmStates = Arrays.asList(VirtualMachine.State.Running, VirtualMachine.State.Stopped);
+
+    @Override
+    public String getName() {
+        return "kboss";
+    }
+
+    @Override
+    public String getDescription() {
+        return "KVM Backup on Secondary Storage";
+    }
+
+    @Override
+    public List<BackupOffering> listBackupOfferings(Long zoneId) {
+        return List.of();
+    }
+
+    @Override
+    public boolean isValidProviderOffering(Long zoneId, String uuid) {
+        return true;
+    }
+
+    @Override
+    public boolean assignVMToBackupOffering(VirtualMachine vm, BackupOffering backupOffering) {
+        logger.debug("Assigning VM [{}] to KBOSS backup offering with name:[{}], uuid: [{}].", vm.getUuid(), backupOffering.getName(), backupOffering.getUuid());
+        if (!Hypervisor.HypervisorType.KVM.equals(vm.getHypervisorType())) {
+            logger.error("KVM Backup on Secondary Storage provider is only supported for KVM.");
+            return false;
+        }
+
+        for (VMSnapshotVO vmSnapshotVO : vmSnapshotDao.findByVmAndByType(vm.getId(), VMSnapshot.Type.Disk)) {
+            List<VMSnapshotDetailsVO> vmSnapshotDetails = vmSnapshotDetailsDao.listDetails(vmSnapshotVO.getId());
+            if (!vmSnapshotDetails.stream().allMatch(vmSnapshotDetailsVO -> vmSnapshotDetailsVO.getName().equals(VolumeApiServiceImpl.KVM_FILE_BASED_STORAGE_SNAPSHOT))) {
+                logger.error("KBOSS is only supported with disk-only VM snapshots using [{}] strategy. Found a disk-only VM snapshot using another strategy for the VM.",
+                        VolumeApiServiceImpl.KVM_FILE_BASED_STORAGE_SNAPSHOT);
+                logger.debug("Found VM snapshot details [{}].", () -> vmSnapshotDetails.stream().map(VMSnapshotDetailsVO::getName).collect(Collectors.toList()));
+                return false;
+            }
+        }
+
+        return CollectionUtils.isEmpty(vmSnapshotDao.findByVmAndByType(vm.getId(), VMSnapshot.Type.DiskAndMemory));
+    }
+
+    @Override
+    public boolean removeVMFromBackupOffering(VirtualMachine vm) {
+        logger.info("Removing VM [{}] from KBOSS backup offering.", vm.getUuid());
+
+        validateVmState(vm, "remove backup offering", VirtualMachine.State.Expunging, VirtualMachine.State.Destroyed);
+        if (endBackupChain(vm)) {
+            return true;
+        }
+        UserVmVO vmVO = userVmDao.findById(vm.getId());
+        logger.error("Failed to merge deltas for VM [{}] during backup offering removal process. Changing its state to [{}].", vm, VirtualMachine.State.BackupError);
+        vmInstanceDetailsDao.addDetail(vm.getId(), VmDetailConstants.LAST_KNOWN_STATE, vmVO.getState().name(), false);
+        vmVO.setState(VirtualMachine.State.BackupError);
+        userVmDao.update(vmVO.getId(), vmVO);
+
+        return false;
+    }
+
+    @Override
+    public boolean willDeleteBackupsOnOfferingRemoval() {
+        return false;
+    }
+
+    @Override
+    public Pair<Boolean, Backup> takeBackup(VirtualMachine vm, Boolean quiesceVm, boolean isolated) {
+        logger.debug("Queueing backup on VM [{}].", vm.getUuid());
+        Outcome<?> outcome = createBackupThroughJobQueue(vm, ObjectUtils.defaultIfNull(quiesceVm, false), isolated);
+
+        try {
+            outcome.get();
+        } catch (InterruptedException | ExecutionException e) {
+            throw new CloudRuntimeException(String.format("Unable to retrieve result from job takeBackup due to [%s]. VM [%s].", e.getMessage(), vm.getUuid()), e);
+        }
+
+        Object jobResult = jobManager.unmarshallResultObject(outcome.getJob());
+
+        if (jobResult instanceof BackupProviderException) {
+            throw (BackupProviderException) jobResult;
+        } else if (jobResult instanceof Throwable) {
+            throw new CloudRuntimeException(String.format("Exception while taking KBOSS backup for VM [%s]. Check the logs for more information.", vm.getUuid()));
+        }
+
+        Pair<Boolean, Long> result = (Pair<Boolean, Long>)jobResult;
+        Pair<Boolean, Backup> returnValue = new Pair<>(result.first(), null);
+        if (result.first()) {
+            returnValue.second(backupDao.findById(result.second()));
+        }
+        return returnValue;
+    }
+
+    @Override
+    public Pair<Boolean, Long> orchestrateTakeBackup(Backup backup, boolean quiesceVm, boolean isolated) {
+        BackupVO backupVO = (BackupVO) backup;
+        long vmId = backup.getVmId();
+        VirtualMachine userVm = virtualMachineManager.findById(vmId);
+        Long hostId = vmSnapshotHelper.pickRunningHost(vmId);
+        HostVO hostVO = hostDao.findById(hostId);
+
+        if (hostVO.getStatus() != Status.Up || hostVO.getResourceState() != ResourceState.Enabled) {
+            backupVO.setStatus(Backup.Status.Failed);
+            backupDao.update(backupVO.getId(), backupVO);
+
+            logger.error("No available host found to create backup [{}] of VM [{}]. Setting the backup as Failed.", backupVO.getUuid(), userVm.getUuid());
+            return new Pair<>(Boolean.FALSE,  backup.getId());
+        }
+
+        List<VolumeObjectTO> volumeTOs;
+        try {
+            validateVmState(userVm, "take backup");
+            volumeTOs = vmSnapshotHelper.getVolumeTOList(userVm.getId());
+            validateStorages(volumeTOs, userVm.getUuid());
+        } catch (Exception e) {
+            backupVO.setStatus(Backup.Status.Failed);
+            backupDao.update(backupVO.getId(), backupVO);
+            throw e;
+        }
+
+        logger.info("Starting VM backup process for VM [{}].", userVm.getUuid());
+
+        BackupOfferingVO backupOfferingVO = backupOfferingDao.findByIdIncludingRemoved(backup.getBackupOfferingId());
+
+        backupVO.setDate(new Date());
+        List<InternalBackupJoinVO> backupChain = getBackupJoinParents(backupVO, true);
+        InternalBackupJoinVO parentBackup = null;
+        if (isolated) {
+            setBackupAsIsolated(backupVO);
+        } else {
+            parentBackup = getParentAndSetEndOfChain(backupVO, backupChain, backupOfferingVO);
+        }
+        InternalBackupJoinVO newBackupJoin = internalBackupJoinDao.findById(backup.getId());
+        boolean fullBackup = parentBackup == null;
+        List<InternalBackupStoragePoolVO> parentBackupDeltasOnPrimary = new ArrayList<>();
+        List<InternalBackupDataStoreVO> parentBackupDeltasOnSecondary = new ArrayList<>();
+        List<String> chainImageStoreUrls = null;
+        List<KbossTO> kbossTOs = new ArrayList<>();
+        HashMap<String, InternalBackupStoragePoolVO> volumeUuidToDeltaPrimaryRef = new HashMap<>();
+        HashMap<String, InternalBackupDataStoreVO> volumeUuidToDeltaSecondaryRef = new HashMap<>();
+
+        if (!fullBackup) {
+            parentBackupDeltasOnPrimary = internalBackupStoragePoolDao.listByBackupId(parentBackup.getId());
+            parentBackupDeltasOnSecondary = internalBackupDataStoreDao.listByBackupId(parentBackup.getId());
+
+            chainImageStoreUrls = getChainImageStoreUrls(backupChain);
+        }
+
+        boolean runningVm = userVm.getState() == VirtualMachine.State.Running;
+        transitVmState(userVm, VirtualMachine.Event.BackupRequested, hostId);
+        updateBackupStatusToBackingUp(volumeTOs, backupVO);
+
+        DataStore imageStore = getImageStoreForBackup(userVm.getDataCenterId(), backupVO);
+        createBasicBackupDetails(imageStore.getId(), fullBackup ? 0L : parentBackup.getId(), backupVO);
+
+        List<VMSnapshotVO> succeedingVmSnapshotList = getSucceedingVmSnapshotList(parentBackup);
+        VMSnapshotVO succeedingVmSnapshot = succeedingVmSnapshotList.isEmpty() ? null : succeedingVmSnapshotList.get(0);
+
+        Map<Long, List<SnapshotDataStoreVO>> volumeIdToSnapshotDataStoreList = mapVolumesToVmSnapshotReferences(volumeTOs, succeedingVmSnapshotList);
+        for (VolumeObjectTO volumeObjectTO : volumeTOs) {
+            KbossTO kbossTO = new KbossTO(volumeObjectTO, volumeIdToSnapshotDataStoreList.getOrDefault(volumeObjectTO.getId(), new ArrayList<>()));
+            kbossTOs.add(kbossTO);
+            createDeltaReferences(fullBackup, !succeedingVmSnapshotList.isEmpty(), runningVm, backup, parentBackupDeltasOnSecondary,
+                    parentBackupDeltasOnPrimary, volumeUuidToDeltaPrimaryRef, volumeUuidToDeltaSecondaryRef, succeedingVmSnapshot, kbossTO);
+        }
+
+        TakeKbossBackupCommand command = new TakeKbossBackupCommand(quiesceVm, runningVm, newBackupJoin.getEndOfChain(), userVm.getInstanceName(), imageStore.getUri(),
+                chainImageStoreUrls, kbossTOs, isolated);
+
+        Answer answer = sendBackupCommand(hostId, command);
+
+        if (answer == null || !answer.getResult()) {
+            processBackupFailure(answer, userVm, hostId, runningVm, backupVO);
+            return new Pair<>(Boolean.FALSE, null);
+        }
+
+        processBackupSuccess(runningVm, volumeTOs, volumeUuidToDeltaPrimaryRef, volumeUuidToDeltaSecondaryRef, (TakeKbossBackupAnswer)answer, parentBackupDeltasOnPrimary,
+                succeedingVmSnapshotList, backupVO, fullBackup, userVm, hostId, newBackupJoin.getEndOfChain(), isolated);
+
+        if (!isolated) {
+            updateCurrentBackup(newBackupJoin);
+        }
+
+        if (offeringSupportsCompression(newBackupJoin)) {
+            compressBackupAsync(newBackupJoin, backup.getZoneId(), userVm.getAccountId());
+        } else {
+            validateBackupAsyncIfHasOfferingSupport(newBackupJoin, backup.getZoneId(), userVm.getAccountId());
+        }
+        return new Pair<>(Boolean.TRUE, backupVO.getId());
+    }
+
+    @Override
+    public boolean deleteBackup(Backup backup, boolean forced) {
+        logger.debug("Queueing backup [{}] deletion.", backup.getUuid());
+        Outcome<Boolean> outcome = deleteBackupThroughJobQueue(backup, forced);
+
+        try {
+            outcome.get();
+        } catch (InterruptedException | ExecutionException e) {
+            throw new CloudRuntimeException(String.format("Unable to retrieve result from job deleteBackup due to [%s]. Backup [%s].", e.getMessage(), backup.getUuid()), e);
+        }
+
+        Object jobResult = jobManager.unmarshallResultObject(outcome.getJob());
+
+        if (jobResult instanceof Throwable) {
+            if (jobResult instanceof BackupProviderException) {
+                throw (BackupProviderException) jobResult;
+            }
+            throw new CloudRuntimeException(String.format("Exception while deleting KBOSS backup [%s]. Check the logs for more information.", backup.getUuid()));
+        }
+
+        return BooleanUtils.isTrue((Boolean) jobResult);
+    }
+
+    @Override
+    public Boolean orchestrateDeleteBackup(Backup backup, boolean forced) {
+        BackupVO backupVO = (BackupVO) backup;
+
+        VirtualMachine virtualMachine = virtualMachineManager.findById(backup.getVmId());
+
+        if (virtualMachine != null) {
+            validateVmState(virtualMachine, "delete backup", VirtualMachine.State.Destroyed);
+        }
+
+        logger.info("Starting delete process for backup [{}].", backupVO);
+
+        if (!validateBackupStateForRemoval(backupVO.getId())) {
+            return false;
+        }
+
+        checkErrorBackup(backupVO, virtualMachine);
+        if (deleteFailedBackup(backupVO)) {
+            return true;
+        }
+
+        InternalBackupJoinVO childBackup = internalBackupJoinDao.findByParentId(backup.getId());
+
+        if (childBackup != null && !validChildStatesToRemoveBackup.contains(childBackup.getStatus())) {
+            logger.debug("Backup [{}] has children that are not in one of the following states [{}]; will mark it as removed on the database but the files will not be deleted " +
+                    "from secondary storage until the children are also expunged.", backup.getUuid(), validChildStatesToRemoveBackup);
+            backupVO.setStatus(Backup.Status.Removed);
+            backupDao.update(backupVO.getId(), backupVO);
+            return true;
+        }
+
+        InternalBackupJoinVO backupJoinVO = internalBackupJoinDao.findById(backup.getId());
+        if (backupJoinVO.getCurrent()) {
+            if (!mergeCurrentBackupDeltas(backupJoinVO)) {
+                return false;
+            }
+            InternalBackupJoinVO parent = internalBackupJoinDao.findById(backupJoinVO.getParentId());
+            if (parent != null && parent.getStatus() == Backup.Status.BackedUp) {
+                backupDetailDao.persist(new BackupDetailVO(parent.getId(), END_OF_CHAIN, Boolean.TRUE.toString(), false));
+            }
+        }
+
+        Commands deleteCommands = new Commands(Command.OnError.Continue);
+
+        DataStore dataStore = addBackupDeltasToDeleteCommand(backup.getId(), deleteCommands);
+        Pair<List<InternalBackupJoinVO>, InternalBackupJoinVO> backupParentsToBeRemovedAndLastAliveBackup = getParentsToBeExpungedWithBackupAndAddThemToListOfDeleteCommands(backupVO,
+                deleteCommands);
+
+        EndPoint endPoint = endPointSelector.select(dataStore);
+        if (endPoint == null) {
+            logger.error("Unable to find SSVM to delete backup [{}]. Check if SSVM is up for the zone.", backup);
+            throw new CloudRuntimeException(String.format("Unable to delete backup [%s]. Please check the logs.", backup.getUuid()));
+        }
+        Answer[] deleteAnswers;
+        try {
+            deleteAnswers = sendBackupCommands(endPoint.getId(), deleteCommands);
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            throw new CloudRuntimeException(e);
+        }
+
+        List<Long> removedBackupIds = backupParentsToBeRemovedAndLastAliveBackup.first().stream().map(InternalBackupJoinVO::getId).collect(Collectors.toList());
+        removedBackupIds.add(backup.getId());
+
+        boolean isFailedSetEmpty = processRemoveBackupFailures(forced, deleteAnswers, removedBackupIds, backupJoinVO);
+
+        processRemovedBackups(removedBackupIds);
+
+        if (backupParentsToBeRemovedAndLastAliveBackup.second() != null) {
+            backupDetailDao.persist(new BackupDetailVO(backupParentsToBeRemovedAndLastAliveBackup.second().getId(), END_OF_CHAIN, Boolean.TRUE.toString(), false));
+        }
+
+        return isFailedSetEmpty;
+    }
+
+    @Override
+    public boolean restoreVMFromBackup(VirtualMachine vm, Backup backup, boolean quickRestore, Long hostId) {
+        logger.debug("Queueing backup [{}] restore for VM [{}].", backup.getUuid(), vm.getUuid());
+        validateQuickRestore(backup, quickRestore);
+
+        Outcome<Boolean> outcome = restoreVMFromBackupThroughJobQueue(vm, backup, quickRestore, hostId);
+
+        try {
+            outcome.get();
+        } catch (InterruptedException | ExecutionException e) {
+            throw new CloudRuntimeException(String.format("Unable to retrieve result from job restoreVMFromBackup due to [%s]. Backup [%s].", e.getMessage(), backup.getUuid()), e);
+        } finally {
+            BackupVO backupVO = backupDao.findById(backup.getId());
+            backupVO.setStatus(Backup.Status.BackedUp);
+            backupDao.update(backupVO.getId(), backupVO);
+        }
+
+        Object jobResult = jobManager.unmarshallResultObject(outcome.getJob());
+
+        handleRestoreException(backup, vm, jobResult);
+
+        return BooleanUtils.isTrue((Boolean) jobResult);
+    }
+
+    @Override
+    public Boolean orchestrateRestoreVMFromBackup(Backup backup, VirtualMachine vm, boolean quickRestore, Long hostId, boolean sameVmAsBackup) {
+        logger.info("Starting restore backup process for VM [{}] and backup [{}].", vm.getUuid(), backup);
+        validateNoVmSnapshots(vm);
+        validateQuickRestore(backup, quickRestore);
+        long backupId = backup.getId();
+        Pair<Boolean, BackupVO> isValidStateAndBackupVo = validateCompressionStateForRestoreAndGetBackup(backupId);
+
+        if (!isValidStateAndBackupVo.first()) {
+            return false;
+        }
+
+        InternalBackupJoinVO backupJoinVO = internalBackupJoinDao.findById(backupId);
+        InternalBackupJoinVO currentBackup = sameVmAsBackup ? internalBackupJoinDao.findCurrent(vm.getId()) : null;
+        List<InternalBackupStoragePoolVO> deltasOnPrimary = new ArrayList<>();
+        if (currentBackup != null) {
+            deltasOnPrimary = internalBackupStoragePoolDao.listByBackupId(currentBackup.getId());
+        }
+        List<InternalBackupDataStoreVO> deltasOnSecondary = internalBackupDataStoreDao.listByBackupId(backupId);
+        List<VolumeObjectTO> volumeTOs = vmSnapshotHelper.getVolumeTOList(vm.getId());
+
+        Set<BackupDeltaTO> deltasToRemove = new HashSet<>();
+
+        List<InternalBackupDataStoreVO> backupsWithoutVolumes = sameVmAsBackup ? getBackupsWithoutVolumes(deltasOnSecondary, volumeTOs) : List.of();
+
+        HostVO host;
+        try {
+            host = getHostToRestore(vm, quickRestore, hostId);
+        } catch (AgentUnavailableException e) {
+            throw new CloudRuntimeException(e);
+        }
+
+        BackupVO backupVO = isValidStateAndBackupVo.second();
+        List<Backup.VolumeInfo> volumeInfos = backupVO.getBackedUpVolumes();
+        if (sameVmAsBackup) {
+            createAndAttachVolumes(volumeInfos, backupsWithoutVolumes, vm, host);
+            // Get new volume references
+            volumeTOs = vmSnapshotHelper.getVolumeTOList(vm.getId());
+        }
+
+        Set<Pair<BackupDeltaTO, VolumeObjectTO>> backupAndVolumePairs = generateBackupAndVolumePairsToRestore(deltasOnSecondary, volumeTOs, backupJoinVO, sameVmAsBackup);
+
+        List<DeltaMergeTreeTO> deltasToBeMerged = List.of();
+        if (sameVmAsBackup) {
+            List<VolumeObjectTO> volumesNotPartOfTheBackup = getVolumesThatAreNotPartOfTheBackup(volumeTOs, deltasOnSecondary);
+            deltasToBeMerged = populateDeltasToRemoveAndToMergeAndUpdateVolumePaths(deltasOnPrimary, deltasToRemove, volumeTOs, volumesNotPartOfTheBackup,
+                    vm.getUuid());
+        }
+        Set<String> secondaryStorageUrls = getParentSecondaryStorageUrls(backupVO);
+
+        Commands commands = new Commands(Command.OnError.Stop);
+        commands.addCommand(new RestoreKbossBackupCommand(deltasToRemove, backupAndVolumePairs, secondaryStorageUrls, quickRestore));
+        commands.addCommand(new MergeDiskOnlyVmSnapshotCommand(deltasToBeMerged, vm.getState().equals(VirtualMachine.State.Running), vm.getInstanceName()));
+
+        Answer[] answers;
+
+        try {
+            answers = sendBackupCommands(host.getId(), commands);
+        } catch (OperationTimedoutException | AgentUnavailableException e) {
+            throw new CloudRuntimeException(e);
+        }
+
+        if (answers == null) {
+            logger.error("Failed to restore backup [{}] due to no answer from host.", backup);
+            return false;
+        }
+
+        if (!processRestoreAnswers(vm, answers, quickRestore)) {
+            return false;
+        }
+
+        updateVolumePathsAndSizeIfNeeded(vm, volumeTOs, volumeInfos, deltasToBeMerged, sameVmAsBackup);
+
+        if (currentBackup != null) {
+            internalBackupStoragePoolDao.expungeByBackupId(currentBackup.getId());
+            setEndOfChainAndRemoveCurrentForBackup(currentBackup);
+        }
+
+        if (quickRestore) {
+            List<VolumeInfo> volumesToConsolidate = getVolumesToConsolidate(vm, deltasOnSecondary, volumeTOs, host.getId(), sameVmAsBackup);
+            return finalizeQuickRestore(vm, volumesToConsolidate, host.getId());
+        }
+
+        return true;
+    }
+
+    @Override
+    public Pair<Boolean, String> restoreBackedUpVolume(Backup backup, Backup.VolumeInfo backupVolumeInfo, String hostIp, String dataStoreUuid,
+            Pair<String, VirtualMachine.State> vmNameAndState, VirtualMachine vm, boolean quickRestore) {
+        logger.debug("Queueing backup [{}] volume [{}] restore for VM [{}].", backup.getUuid(), backupVolumeInfo, vm.getUuid());
+        validateQuickRestore(backup, quickRestore);
+        Outcome<Boolean> outcome = restoreBackedUpVolumeThroughJobQueue(vm, backup, backupVolumeInfo, hostIp, quickRestore);
+
+        try {
+            outcome.get();
+        } catch (InterruptedException | ExecutionException e) {
+            throw new CloudRuntimeException(String.format("Unable to retrieve result from job restoreBackedUpVolume due to [%s]. Backup [%s].", e.getMessage(), backup.getUuid()), e);
+        } finally {
+            BackupVO backupVO = backupDao.findById(backup.getId());
+            backupVO.setStatus(Backup.Status.BackedUp);
+            backupDao.update(backupVO.getId(), backupVO);
+        }
+
+        Object jobResult = jobManager.unmarshallResultObject(outcome.getJob());
+
+        handleRestoreException(backup, vm, jobResult);
+
+        if (!(jobResult instanceof Pair)) {
+            throw new CloudRuntimeException(String.format("Unexpected answer from restoreBackupVolume job. Got [%s].", jobResult));
+        }
+        return (Pair<Boolean, String>) jobResult;
+    }
+
+    @Override
+    public Pair<Boolean, String> orchestrateRestoreBackedUpVolume(Backup backup, VirtualMachine vm, Backup.VolumeInfo backupVolumeInfo, String hostIp, boolean quickRestore) {
+        BackupVO backupVO = (BackupVO) backup;
+        Pair<Boolean, BackupVO> isValidStateAndBackupVo = validateCompressionStateForRestoreAndGetBackup(backup.getId());
+
+        if (!isValidStateAndBackupVo.first()) {
+            return new Pair<>(false, null);
+        }
+
+        VolumeVO backedUpVolume = volumeDao.findByUuidIncludingRemoved(backupVolumeInfo.getUuid());
+        HostVO hostVo = hostDao.findByIp(hostIp);
+        VolumeInfo volumeInfo = duplicateAndCreateVolume(vm, hostVo, backupVolumeInfo);
+
+        VolumeObjectTO volumeObjectTO = (VolumeObjectTO) volumeInfo.getTO();
+        InternalBackupDataStoreVO deltaOnSecondary = internalBackupDataStoreDao.findByBackupIdAndVolumeId(backup.getId(), backedUpVolume.getId());
+        InternalBackupJoinVO internalBackupJoinVO = internalBackupJoinDao.findById(backup.getId());
+        Pair<BackupDeltaTO, VolumeObjectTO> backupAndVolumePair = generateBackupAndVolumePairForSingleNewVolume(deltaOnSecondary, volumeObjectTO, internalBackupJoinVO);
+        Set<String> secondaryStorageUrls = getParentSecondaryStorageUrls(backupVO);
+
+        RestoreKbossBackupCommand cmd = new RestoreKbossBackupCommand(Set.of(), Set.of(backupAndVolumePair), secondaryStorageUrls, quickRestore);
+
+        Answer answer = sendBackupCommand(hostVo.getId(), cmd);
+
+        if (!processRestoreAnswers(vm, new Answer[] {answer}, quickRestore)) {
+            throw new CloudRuntimeException("Bad answer from agent");
+        }
+
+        VolumeVO newVolume = (VolumeVO)volumeInfo.getVolume();
+        volumeDao.update(newVolume.getId(), newVolume);
+
+        Volume attachedVolume = volumeApiService.attachVolumeToVM(vm.getId(), newVolume.getId(), null, false, false);
+
+        if (quickRestore) {
+            ArrayList<VolumeInfo> volumeToConsolidate = new ArrayList<>();
+            volumeToConsolidate.add(volumeDataFactory.getVolume(attachedVolume.getId()));
+            return new Pair<>(finalizeQuickRestore(vm, volumeToConsolidate, hostVo.getId()), attachedVolume.getUuid());
+        }
+
+        return new Pair<>(true, attachedVolume.getUuid());
+    }
+
+    @Override
+    public boolean startBackupCompression(long backupId, long hostId) {
+        Pair<Boolean, BackupVO> validCompressAndBackupVO = validateBackupStateForStartCompressionAndUpdateCompressionStatus(backupId);
+
+        if (!validCompressAndBackupVO.first()) {
+            return false;
+        }
+
+        InternalBackupJoinVO backup = internalBackupJoinDao.findById(backupId);
+        InternalBackupJoinVO parentBackup = internalBackupJoinDao.findById(backup.getParentId());
+
+        List<InternalBackupDataStoreVO> backupDeltas = internalBackupDataStoreDao.listByBackupId(backupId);
+        List<InternalBackupDataStoreVO> parentBackupDeltas = parentBackup != null ? internalBackupDataStoreDao.listByBackupId(backup.getParentId()) : List.of();
+
+        DataStoreTO imageStoreTo = dataStoreManager.getDataStore(backup.getImageStoreId(), DataStoreRole.Image).getTO();
+        DataStoreTO parentStoreTo = parentBackup != null ? dataStoreManager.getDataStore(parentBackup.getImageStoreId(), DataStoreRole.Image).getTO() : null;
+
+        List<DeltaMergeTreeTO> deltasToCompressAndParents = new ArrayList<>();
+        for (InternalBackupDataStoreVO delta : backupDeltas) {
+            BackupDeltaTO backupDeltaTO = new BackupDeltaTO(imageStoreTo, Hypervisor.HypervisorType.KVM, delta.getBackupPath());
+            InternalBackupDataStoreVO parentDataStore = parentBackupDeltas.stream().filter(parent -> parent.getVolumeId() == delta.getVolumeId()).findFirst().orElse(null);
+            BackupDeltaTO parentDeltaTO = parentDataStore != null ? new BackupDeltaTO(parentStoreTo, Hypervisor.HypervisorType.KVM, parentDataStore.getBackupPath()) : null;
+            deltasToCompressAndParents.add(new DeltaMergeTreeTO(null, parentDeltaTO, backupDeltaTO, null));
+        }
+
+        HostVO hostVO = hostDao.findById(hostId);
+        BackupVO backupVO = validCompressAndBackupVO.second();
+
+        long minFreeStorage = Math.round(backupVO.getSize() * backupCompressionMinimumFreeStorage.valueIn(hostVO.getDataCenterId()));
+
+        BackupOfferingVO backupOfferingVO = backupOfferingDao.findByIdIncludingRemoved(backupVO.getBackupOfferingId());
+        BackupOfferingDetailsVO detail = backupOfferingDetailsDao.findDetail(backupOfferingVO.getId(), ApiConstants.COMPRESSION_LIBRARY);
+        List<InternalBackupJoinVO> backupChain = getBackupJoinParents(backupVO, true);
+        List<String> chainImageStoreUrls = getChainImageStoreUrls(backupChain);
+        CompressBackupCommand cmd = new CompressBackupCommand(deltasToCompressAndParents, chainImageStoreUrls, minFreeStorage, detail == null ? null :
+                Backup.CompressionLibrary.valueOf(detail.getValue()), backupCompressionCoroutines.valueIn(hostVO.getClusterId()),
+                backupCompressionRateLimit.valueIn(hostVO.getClusterId()));
+        cmd.setWait(backupCompressionTimeout.valueIn(hostVO.getClusterId()));
+        Answer answer = agentManager.easySend(hostId, cmd);
+
+        if (answer == null || !answer.getResult()) {
+            logger.error("Failed to compress backup [{}] due to {}.", backup.getUuid(), answer == null ? "no answer" : answer.getDetails());
+            backupVO.setCompressionStatus(Backup.CompressionStatus.CompressionError);
+            backupDao.update(backupId, backupVO);
+            return false;
+        }
+
+        logger.info("Successfully completed the first step of the backup compression process for backup [{}]. Will launch a new compression job to finalize the compression.",
+                backup.getUuid());
+
+        internalBackupServiceJobDao.persist(new InternalBackupServiceJobVO(backupVO.getId(), backupVO.getZoneId(), backupVO.getVmId(), backupVO.getAccountId(),
+                InternalBackupServiceJobType.FinalizeCompression));
+
+        return true;
+    }
+
+    @Override
+    public boolean finalizeBackupCompression(long backupId, long hostId) {
+        Pair<Boolean, BackupVO> shouldContinueProcessAndBackupVo = validateBackupStateForFinalizeCompression(backupId);
+        if (!shouldContinueProcessAndBackupVo.first()) {
+            return false;
+        }
+        BackupVO backupVO = shouldContinueProcessAndBackupVo.second();
+
+        List<BackupDeltaTO> deltaTOs = getBackupDeltaTOList(backupId);
+
+        FinalizeBackupCompressionCommand cmd = new FinalizeBackupCompressionCommand(backupVO.getStatus() != Backup.Status.BackedUp, deltaTOs);
+        HostVO hostVO = hostDao.findById(hostId);
+        cmd.setWait(backupCompressionTimeout.valueIn(hostVO.getClusterId()));
+        Answer answer = agentManager.easySend(hostId, cmd);
+
+        if (answer == null || !answer.getResult()) {
+            logger.error("Failed to finish compression of backup [{}] due to {}.", backupVO.getUuid(), answer == null ? "no answer" : answer.getDetails());
+            backupVO.setCompressionStatus(Backup.CompressionStatus.CompressionError);
+            backupDao.update(backupId, backupVO);
+            return false;
+        }
+
+        if (cmd.isCleanup()) {
+            logger.info("Successfully cleaned up backup compression of backup [{}].", backupVO);
+            return true;
+        }
+
+        backupVO.setCompressionStatus(Backup.CompressionStatus.Compressed);
+        backupVO.setUncompressedSize(backupVO.getSize());
+        backupVO.setSize(Long.parseLong(answer.getDetails()));
+        backupDao.update(backupVO.getId(), backupVO);
+
+        logger.info("Finalized compression for backup [{}], old size was [{}], compressed size is [{}].", backupVO.getUuid(), backupVO.getUncompressedSize(), backupVO.getSize());
+
+        validateBackupAsyncIfHasOfferingSupport(internalBackupJoinDao.findById(backupId), backupVO.getZoneId(), backupVO.getAccountId());
+        return true;
+    }
+
+    @Override
+    public boolean validateBackup(long backupId, long hostId) {
+        if (!validateBackupStateForValidation(backupId)) {
+            return false;
+        }
+        BackupVO backupVO = backupDao.findById(backupId);
+        backupVO.setValidationStatus(Backup.ValidationStatus.Validating);
+        backupDao.update(backupId, backupVO);
+        BackupDetailVO hashDetail = backupDetailDao.findDetail(backupId, BACKUP_HASH);
+        if (hashDetail != null) {
+            return validateWithHash(backupId, backupVO, hashDetail);
+        } else {
+            return validateWithValidationVm(backupId, hostId, backupVO);
+        }
+    }
+
+    @Override
+    public Pair<Boolean, String> restoreBackupToVM(VirtualMachine vm, Backup backup, String hostIp, String dataStoreUuid, boolean quickRestore) {
+        Pair<Boolean, Backup.Status> shouldRestoreAndOldStatus = validateBackupStateForRestoreBackupToVM(backup.getId());
+        if (!shouldRestoreAndOldStatus.first()) {
+            return new Pair<>(false, "Backup is not in the right state.");
+        }
+
+        boolean result = false;
+        try {
+            result = orchestrateRestoreVMFromBackup(backup, vm, quickRestore, null, false);
+        } catch (Exception exception) {
+            handleRestoreException(backup, vm, exception);
+        } finally {
+            Transaction.execute(TransactionLegacy.CLOUD_DB, (TransactionCallback<Boolean>) transactionStatus -> {
+                BackupVO backupVO = backupDao.findById(backup.getId());
+                backupVO.setStatus(shouldRestoreAndOldStatus.second());
+                backupDao.update(backupVO.getId(), backupVO);
+                return true;
+            });
+        }
+
+        return new Pair<>(result, null);
+    }
+
+    @Override
+    public boolean finishBackupChain(VirtualMachine virtualMachine) {
+        UserVmVO userVmVO = userVmDao.findById(virtualMachine.getId());
+        if (allowedVmStates.contains(userVmVO.getState())) {
+            return endBackupChain(userVmVO);
+        }
+        if (userVmVO.getState() != VirtualMachine.State.BackupError) {
+            logger.error("VM [{}] is not in the right state to finish backup chain. It can only be in states [Running, Stopped and BackupError].", userVmVO.getUuid());
+
+            return false;
+        }
+        return normalizeBackupErrorAndFinishChain(userVmVO);
+    }
+
+    @Override
+    public void syncBackupMetrics(Long zoneId) {
+    }
+
+    @Override
+    public Backup createNewBackupEntryForRestorePoint(Backup.RestorePoint rp, VirtualMachine vm) {
+        return null;
+    }
+
+    @Override
+    public Pair<Long, Long> getBackupStorageStats(Long zoneId) {
+        return new Pair<>(0L, 0L);
+    }
+
+    @Override
+    public void syncBackupStorageStats(Long zoneId) {
+    }
+
+    @Override
+    public boolean supportsInstanceFromBackup() {
+        return true;
+    }
+
+    @Override
+    public boolean supportsMemoryVmSnapshot() {
+        return false;
+    }
+
+    @Override
+    public void prepareVolumeForDetach(Volume volume, VirtualMachine virtualMachine) {
+        logger.info("Preparing volume [{}] for detach.", volume.getUuid());
+        mergeCurrentDeltaIntoVolume(volume, virtualMachine, "detach", virtualMachine.getState().equals(VirtualMachine.State.Running));
+    }
+
+    @Override
+    public void prepareVolumeForMigration(Volume volume, VirtualMachine vm) {
+        if (VirtualMachine.State.Migrating.equals(vm.getState())) {
+            logger.info("Preparing volume [{}] for live migration.", volume.getUuid());
+            mergeCurrentDeltaIntoVolume(volume, vm, "live migration", true);
+        }
+    }
+
+    @Override
+    public void updateVolumeId(VirtualMachine virtualMachine, long oldVolumeId, long newVolumeId) {
+        internalBackupDataStoreDao.updateVolumeId(oldVolumeId, newVolumeId);
+    }
+
+    @Override
+    public void prepareVmForSnapshotRevert(VMSnapshot vmSnapshot, VirtualMachine virtualMachine) {
+        InternalBackupJoinVO currentBackup = internalBackupJoinDao.findCurrent(virtualMachine.getId());
+
+        if (currentBackup == null) {
+            logger.debug("There is no current backup delta, the VM [{}] is already prepared for VM snapshot revert.", virtualMachine.getUuid());
+            return;
+        }
+        if (currentBackup.getDate().before(vmSnapshot.getCreated())) {
+            logger.debug("The current backup delta was taken before [{}] the VM snapshot being reverted [{}], no need to prepare the VM.", currentBackup.getDate(),
+                    vmSnapshot.getCreated());
+
+            return;
+        }
+
+        logger.debug("Preparing VM [{}] for VM snapshot reversion.", virtualMachine.getUuid());
+
+        List<VolumeObjectTO> volumeObjectTOs = vmSnapshotHelper.getVolumeTOList(virtualMachine.getId());
+        VMSnapshotVO vmSnapshotSucceedingCurrentBackup = getSucceedingVmSnapshot(currentBackup);
+
+        List<DeltaMergeTreeTO> deltaMergeTreeTOList = new ArrayList<>();
+        Commands commands = new Commands(Command.OnError.Stop);
+        List<InternalBackupStoragePoolVO> deletedDeltas = new ArrayList<>();
+
+        createDeleteCommandsAndMergeTrees(volumeObjectTOs, commands, deletedDeltas, vmSnapshotSucceedingCurrentBackup, deltaMergeTreeTOList);
+
+        if (!deltaMergeTreeTOList.isEmpty()) {
+            commands.addCommand(new MergeDiskOnlyVmSnapshotCommand(deltaMergeTreeTOList, false, virtualMachine.getInstanceName()));
+        }
+
+        Long hostId = vmSnapshotHelper.pickRunningHost(virtualMachine.getId());
+
+        Answer[] answers;
+        try {
+            answers = sendBackupCommands(hostId, commands);
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            throw new CloudRuntimeException(e);
+        }
+
+        if (answers == null || Arrays.stream(answers).anyMatch(answer -> !answer.getResult())) {
+            logger.error("Error while trying to prepare VM [{}] for VM snapshot reversion. Got [{}] as answers from host.", virtualMachine.getUuid(),
+                    answers != null ? Arrays.stream(answers).filter(answer -> !answer.getResult()).map(Answer::getDetails) : null);
+            throw new CloudRuntimeException(String.format("Unable to prepare VM [%s] for VM snapshot reversion.", virtualMachine.getUuid()));
+        }
+
+        List<SnapshotDataStoreVO> snapRefsSucceedingCurrentBackup = new ArrayList<>();
+        if (vmSnapshotSucceedingCurrentBackup != null) {
+            snapRefsSucceedingCurrentBackup = vmSnapshotHelper.getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(vmSnapshotSucceedingCurrentBackup.getId());
+        }
+
+        updateReferencesAfterPrepareForSnapshotRevert(deltaMergeTreeTOList, snapRefsSucceedingCurrentBackup, deletedDeltas, currentBackup);
+    }
+
+    /**
+     * Get the secondary storage URLs of the backups that are backing files of this VM. This is only useful for Validation VMs currently, which are created with backing files on
+     * the secondary storage.
+     * */
+    @Override
+    public Set<String> getSecondaryStorageUrls(UserVm userVm) {
+        VMInstanceDetailVO detailVO = vmInstanceDetailsDao.findDetail(userVm.getId(), ApiConstants.BACKUP_ID);
+        if (detailVO == null) {
+            return Set.of();
+        }
+        BackupVO backupVO = backupDao.findByUuid(detailVO.getValue());
+        Set<String> secondaryStorageUrls = getParentSecondaryStorageUrls(backupVO);
+        InternalBackupJoinVO internalBackupJoinVO = internalBackupJoinDao.findById(backupVO.getId());
+        secondaryStorageUrls.add(imageStoreDao.findById(internalBackupJoinVO.getImageStoreId()).getUrl());
+        return secondaryStorageUrls;
+    }
+
+    @Override
+    public Boolean crossZoneInstanceCreationEnabled(BackupOffering backupOffering) {
+        return false;
+    }
+
+    @Override
+    public List<Backup.RestorePoint> listRestorePoints(VirtualMachine vm) {
+        return null;
+    }
+
+    @Override
+    public String getConfigComponentName() {
+        return BackupService.class.getSimpleName();
+    }
+
+    @Override
+    public ConfigKey<?>[] getConfigKeys() {
+        return new ConfigKey[] {backupChainSize, backupTimeout, backupCompressionTimeout, backupCompressionMinimumFreeStorage, backupCompressionRateLimit,
+                backupCompressionCoroutines};
+    }
+
+    protected Outcome<?> createBackupThroughJobQueue(VirtualMachine vm, boolean quiesceVm, boolean isolated) {
+        final CallContext context = CallContext.current();
+        long userId = context.getCallingUser().getId();
+        long accountId = context.getCallingAccount().getAccountId();
+        long vmId = vm.getId();
+
+        BackupVO backup = new BackupVO(String.format("%s-%s", vm.getHostName(), DateUtil.getDateInSystemTimeZone()), vmId, vm.getBackupOfferingId(), accountId,
+                vm.getDomainId(), vm.getDataCenterId(), 0, Backup.Status.Queued, null,
+                Backup.CompressionStatus.Uncompressed, Backup.ValidationStatus.NotValidated);
+
+        VmWorkJobVO workJob = new VmWorkJobVO(AsyncJobExecutionContext.getOriginJobId(), userId, accountId, VmWorkTakeBackup.class.getName(), vmId, VirtualMachine.Type.Instance,
+                VmWorkJobVO.Step.Starting);
+        VmWorkTakeBackup workInfo = new VmWorkTakeBackup(userId, accountId, vmId, backupDao.persist(backup).getId(), VM_WORK_JOB_HANDLER, quiesceVm, isolated);
+
+        workJob.setDispatcher(VmWorkConstants.VM_WORK_JOB_DISPATCHER);
+        workJob.setCmdInfo(VmWorkSerializer.serialize(workInfo));
+
+        jobManager.submitAsyncJob(workJob, VmWorkConstants.VM_WORK_QUEUE, vmId);
+        AsyncJobExecutionContext.getCurrentExecutionContext().joinJob(workJob.getId());
+
+        return new OutcomeImpl<>(Pair.class, workJob, VirtualMachineManagerImpl.VmJobCheckInterval.value(), new Predicate() {
+            @Override
+            public boolean checkCondition() {
+                AsyncJobVO jobVo = entityManager.findById(AsyncJobVO.class, workJob.getId());
+                return jobVo == null || jobVo.getStatus() != JobInfo.Status.IN_PROGRESS;
+            }
+        }, AsyncJob.Topics.JOB_STATE);
+    }
+
+    protected Outcome<Boolean> deleteBackupThroughJobQueue(Backup backup, boolean forced) {
+        final CallContext context = CallContext.current();
+        long userId = context.getCallingUser().getId();
+        long accountId = context.getCallingAccount().getAccountId();
+        VirtualMachine userVm = userVmDao.findByIdIncludingRemoved(backup.getVmId());
+        long vmId = userVm.getId();
+
+        VmWorkJobVO workJob = new VmWorkJobVO(AsyncJobExecutionContext.getOriginJobId(), userId, accountId, VmWorkDeleteBackup.class.getName(), vmId, VirtualMachine.Type.Instance,
+                VmWorkJobVO.Step.Starting);
+        VmWorkDeleteBackup workInfo = new VmWorkDeleteBackup(userId, accountId, vmId, VM_WORK_JOB_HANDLER, backup.getId(), forced);
+
+        return submitWorkJob(workJob, workInfo, vmId);
+    }
+
+    protected Outcome<Boolean> restoreVMFromBackupThroughJobQueue(VirtualMachine vm, Backup backup, boolean quickRestore, Long hostId) {
+        final CallContext context = CallContext.current();
+        long userId = context.getCallingUser().getId();
+        long accountId = context.getCallingAccount().getAccountId();
+        long vmId = vm.getId();
+
+        VmWorkJobVO workJob = new VmWorkJobVO(AsyncJobExecutionContext.getOriginJobId(), userId, accountId, VmWorkRestoreBackup.class.getName(), vmId, VirtualMachine.Type.Instance,
+                VmWorkJobVO.Step.Starting);
+        VmWorkRestoreBackup workInfo = new VmWorkRestoreBackup(userId, accountId, vmId, VM_WORK_JOB_HANDLER, backup.getId(), quickRestore, hostId);
+
+        return submitWorkJob(workJob, workInfo, vmId);
+    }
+
+    protected Outcome<Boolean> restoreBackedUpVolumeThroughJobQueue(VirtualMachine vm, Backup backup, Backup.VolumeInfo backupVolumeInfo, String hostIp, boolean quickRestore) {
+        final CallContext context = CallContext.current();
+        long userId = context.getCallingUser().getId();
+        long accountId = context.getCallingAccount().getAccountId();
+        long vmId = vm.getId();
+
+        VmWorkJobVO workJob = new VmWorkJobVO(AsyncJobExecutionContext.getOriginJobId(), userId, accountId, VmWorkRestoreVolumeBackupAndAttach.class.getName(), vmId,
+                VirtualMachine.Type.Instance, VmWorkJobVO.Step.Starting);
+        VmWorkRestoreVolumeBackupAndAttach workInfo = new VmWorkRestoreVolumeBackupAndAttach(userId, accountId, vmId, VM_WORK_JOB_HANDLER, backup.getId(),
+                backupVolumeInfo, hostIp, quickRestore);
+
+        return submitWorkJob(workJob, workInfo, vmId);
+    }
+
+    protected OutcomeImpl<Boolean> submitWorkJob(VmWorkJobVO workJob, VmWork workInfo, long vmId) {
+        workJob.setDispatcher(VmWorkConstants.VM_WORK_JOB_DISPATCHER);
+        workJob.setCmdInfo(VmWorkSerializer.serialize(workInfo));
+
+        jobManager.submitAsyncJob(workJob, VmWorkConstants.VM_WORK_QUEUE, vmId);
+        AsyncJobExecutionContext.getCurrentExecutionContext().joinJob(workJob.getId());
+
+        return new OutcomeImpl<>(Boolean.class, workJob, VirtualMachineManagerImpl.VmJobCheckInterval.value(), new Predicate() {
+            @Override
+            public boolean checkCondition() {
+                AsyncJobVO jobVo = entityManager.findById(AsyncJobVO.class, workJob.getId());
+                return jobVo == null || jobVo.getStatus() != JobInfo.Status.IN_PROGRESS;
+            }
+        }, AsyncJob.Topics.JOB_STATE);
+    }
+
+    protected void validateBackupAsyncIfHasOfferingSupport(InternalBackupJoinVO backupJoinVO, long zoneId, long accountId) {
+        if (!offeringSupportsValidation(backupJoinVO)) {
+            return;
+        }
+
+        logger.info("Queuing backup validation job for backup [{}].", backupJoinVO.getUuid());
+        internalBackupServiceJobDao.persist(new InternalBackupServiceJobVO(backupJoinVO.getId(), zoneId, backupJoinVO.getVmId(), accountId, InternalBackupServiceJobType.BackupValidation));
+    }
+
+    protected void compressBackupAsync(InternalBackupJoinVO backupJoinVO, long zoneId, long accountId) {
+        logger.info("Queuing backup compression job for backup [{}].", backupJoinVO.getUuid());
+        internalBackupServiceJobDao.persist(new InternalBackupServiceJobVO(backupJoinVO.getId(), zoneId, backupJoinVO.getVmId(), accountId, InternalBackupServiceJobType.StartCompression));
+    }
+
+    protected boolean finalizeQuickRestore(VirtualMachine vm, List<VolumeInfo> volumesToConsolidate, long hostId) {
+        logger.info("Finalizing quick restore for VM [{}].", vm.getUuid());
+
+        UserVmVO userVmVO = userVmDao.findById(vm.getId());
+        if (userVmVO.getState() == VirtualMachine.State.Stopped) {
+            try {
+                logger.info("Starting VM [{}] as part of the quick restore process.", vm.getName());
+                userVmManager.startVirtualMachine(userVmVO.getId(), hostId, new HashMap<>(), null, true);
+            } catch (Exception e) {
+                logger.error("Caught [{}] while trying to quick restore VM [{}]. Throwing BackupException.", e, vm);
+                throw new BackupException(String.format("Exception while trying to start VM [%s] as part of the quick restore process.", userVmVO.getUuid()), e, false);
+            }
+        }
+
+        return consolidateVolumes(vm, hostId, volumesToConsolidate);
+    }
+
+    protected boolean validateWithHash(long backupId, BackupVO backupVO, BackupDetailVO hashDetail) {
+        List<BackupDeltaTO> backupDeltaTOList = getBackupDeltaTOList(backupId);
+        TakeBackupHashCommand hashCommand = new TakeBackupHashCommand(backupDeltaTOList, backupVO.getUuid());
+        List<HostVO> hosts = hostDao.listAllHostsUpByZoneAndHypervisor(backupVO.getZoneId(), Hypervisor.HypervisorType.KVM);
+        String message;
+        if (CollectionUtils.isEmpty(hosts)) {
+            message = String.format("No Up and Enabled host found in zone [%s]. Cannot validate backup [%s]. Will try again later.", backupVO.getZoneId(), backupVO.getUuid());
+            logger.error(message);
+            setBackupUnableToValidateAndSendAlert(backupVO, message);
+            return false;
+        }
+        Collections.shuffle(hosts);
+        Answer answer = sendBackupCommand(hosts.get(0).getId(), hashCommand);
+        if (!answer.getResult()) {
+            message = String.format("Unable to get hash of backup [%s] due to [%s]. Will try again later.", backupVO.getUuid(), answer.getDetails());
+            logger.warn(message);
+            setBackupUnableToValidateAndSendAlert(backupVO, message);
+            return false;
+        }
+
+        if (!hashDetail.getValue().equals(answer.getDetails())) {
+            message = String.format("Current xxHash128 of backup [%s] is different from previous validated hash. This backup has changed and might be corrupt." +
+                    "The old hash is [%s]; the new hash is [%s].", backupVO.getUuid(), hashDetail.getValue(), answer.getDetails());
+            logger.error(message);
+            setBackupAsInvalidAndSendAlert(backupVO, message);
+            return false;
+        }
+
+        logger.info("xxHash128 of backup [{}] is the same as when it was validated. This backup is still valid.", backupVO.getUuid());
+        backupVO.setValidationStatus(Backup.ValidationStatus.Valid);
+        backupDao.update(backupId, backupVO);
+        return true;
+    }
+
+    protected boolean validateWithValidationVm(long backupId, long hostId, BackupVO backupVO) {
+        boolean startedVm = false;
+        UserVmVO validationVm = null;
+        List<VolumeVO> volumeVOs = List.of();
+        try {
+            validationVm = allocateValidationVm(backupId, backupVO);
+            if (validationVm == null) {
+                return false;
+            }
+
+            HostVO hostVo = hostDao.findById(hostId);
+            List<VolumeObjectTO> volumeToList = new ArrayList<>();
+            volumeVOs = volumeDao.findByInstance(validationVm.getId());
+            createValidationVolumesOnPrimaryStorage(volumeVOs, validationVm, backupVO, hostVo, volumeToList);
+
+            List<InternalBackupDataStoreVO> backupDeltas = internalBackupDataStoreDao.listByBackupId(backupId);
+            InternalBackupJoinVO backupJoinVO = internalBackupJoinDao.findById(backupId);
+            Set<Pair<BackupDeltaTO, VolumeObjectTO>> backupDeltaAndVolumePairs = generateBackupAndVolumePairsToRestore(backupDeltas, volumeToList, backupJoinVO, false);
+            if (!prepareForValidation(hostId, backupDeltaAndVolumePairs, backupVO, validationVm)) {
+                return false;
+            }
+
+            userVmManager.startVirtualMachine(validationVm, null);
+            startedVm = true;
+            //refresh info
+            validationVm = userVmDao.findById(validationVm.getId());
+            hostVo = hostDao.findById(validationVm.getHostId());
+
+            HypervisorGuru hvGuru = hypervisorGuruManager.getGuru(validationVm.getHypervisorType());
+            VirtualMachineProfileImpl profile = new VirtualMachineProfileImpl(validationVm);
+            VirtualMachineTO vmTO = hvGuru.implement(profile);
+
+            if (!validateBackup(backupId, vmTO, backupDeltaAndVolumePairs, backupVO, validationVm, hostVo)) {
+                endBackupChainIfConfigured(backupVO);
+                return false;
+            }
+            calculateAndSaveHash(backupDeltaAndVolumePairs, backupVO, hostVo.getId());
+            return true;
+        } catch (Exception ex) {
+            logger.error("Encountered an exception during the validation process of backup [{}]. Will cleanup now.", backupVO.getUuid(), ex);
+            setBackupUnableToValidateAndSendAlert(backupVO, "Failed to validate due to unexpected exception: " + ex.getMessage());
+            return false;
+        } finally {
+            cleanupValidation(startedVm, validationVm, backupVO, volumeVOs);
+        }
+    }
+
+    /**
+     * If backupValidationEndChainOnFail is true for the account, and the backup being validated is part of the current chain, we end the current chain.
+     * */
+    protected void endBackupChainIfConfigured(BackupVO backupVO) {
+        if (!getValidationEndChainOnFail(backupVO)) {
+            return;
+        }
+        VirtualMachine vm = userVmDao.findByIdIncludingRemoved(backupVO.getVmId());
+        validateVmState(vm, "end backup chain", VirtualMachine.State.Expunging, VirtualMachine.State.Destroyed);
+        List<InternalBackupJoinVO> backupChildren = getBackupJoinChildren(backupVO);
+
+        // Get updated record
+        InternalBackupJoinVO backupJoinVO = internalBackupJoinDao.findById(backupVO.getId());
+        if (backupJoinVO.getCurrent() || (!backupChildren.isEmpty() && backupChildren.get(backupChildren.size() - 1).getCurrent())) {
+            logger.info("As [{}] is true, we are ending the backup chain for VM [{}]. The next backup will be a full backup.",
+                    BackupValidationServiceJobController.backupValidationEndChainOnFail.toString());
+            endBackupChain(vm);
+        }
+    }
+
+    /**
+     * This method was created to facilitate testing
+     * */
+    protected Boolean getValidationEndChainOnFail(BackupVO backupVO) {
+        return BackupValidationServiceJobController.backupValidationEndChainOnFail.valueIn(backupVO.getAccountId());
+    }
+
+    protected boolean normalizeBackupErrorAndFinishChain(UserVmVO userVmVO) {
+        VMInstanceDetailVO detail = vmInstanceDetailsDao.findDetail(userVmVO.getId(), VmDetailConstants.LAST_KNOWN_STATE);
+        boolean runningVM = detail == null || VirtualMachine.State.valueOf(detail.getValue()) == VirtualMachine.State.Running;
+
+        BackupVO backupVO = backupDao.findLatestByStatusAndVmId(Backup.Status.Error, userVmVO.getId());
+        InternalBackupJoinVO internalBackupJoinVO = internalBackupJoinDao.findById(backupVO.getId());
+        ImageStoreVO imageStoreVO = imageStoreDao.findById(internalBackupJoinVO.getImageStoreId());
+
+        List<KbossTO> kbossTOS = new ArrayList<>();
+        List<InternalBackupStoragePoolVO> deltasOnPrimary = internalBackupStoragePoolDao.listByBackupId(internalBackupJoinVO.getId());
+        InternalBackupJoinVO parent = internalBackupJoinDao.findById(internalBackupJoinVO.getParentId());
+
+        // There is a possibility that the cleanup step of the backup creation was executed, and thus we would have to merge with the old parent's parent
+        List<InternalBackupStoragePoolVO> parentDeltasOnPrimary = new ArrayList<>();
+        if (parent != null) {
+            parentDeltasOnPrimary = internalBackupStoragePoolDao.listByBackupId(parent.getId());
+        }
+
+        List<InternalBackupDataStoreVO> deltasOnSecondary = internalBackupDataStoreDao.listByBackupId(internalBackupJoinVO.getId());
+        configureKbossTosForCleanup(userVmVO, deltasOnPrimary, deltasOnSecondary, runningVM, parentDeltasOnPrimary, kbossTOS);
+        CleanupKbossBackupErrorCommand command = new CleanupKbossBackupErrorCommand(runningVM, userVmVO.getInstanceName(), imageStoreVO.getUrl(), kbossTOS);
+
+        long hostId = userVmVO.getHostId() != null ? userVmVO.getHostId() : vmSnapshotHelper.pickRunningHost(userVmVO.getId());
+        Answer answer = sendBackupCommand(hostId, command);
+        if (answer == null || !answer.getResult()) {
+            logger.error("Unable to finish backup chain for VM [{}]. The host [{}] logs will have more information on why this happened.", userVmVO.getUuid(), hostId);
+            return false;
+        }
+
+        boolean chainAlreadyEnded = processCleanupBackupErrorAnswer(userVmVO, answer);
+
+        if (!chainAlreadyEnded) {
+            return endBackupChain(userVmVO);
+        }
+        InternalBackupJoinVO current = internalBackupJoinDao.findCurrent(userVmVO.getId());
+        internalBackupStoragePoolDao.expungeByBackupId(current.getId());
+        setEndOfChainAndRemoveCurrentForBackup(current);
+
+        return true;
+    }
+
+    protected boolean processCleanupBackupErrorAnswer(UserVmVO userVmVO, Answer answer) {
+        boolean runningVM;
+        CleanupKbossBackupErrorAnswer cleanAnswer = (CleanupKbossBackupErrorAnswer) answer;
+        logger.info("Successfully finished chain for VM [{}] and normalizing the BackupError state. Cleaning up metadata.", userVmVO.getUuid());
+
+        boolean chainAlreadyEnded = false;
+        for (VolumeObjectTO volumeObjectTO : cleanAnswer.getVolumeObjectTos()) {
+            VolumeVO volumeVO = volumeDao.findById(volumeObjectTO.getId());
+            if (!volumeObjectTO.getPath().equals(volumeVO.getPath())) {
+                volumeVO.setPath(volumeObjectTO.getPath());
+                volumeDao.update(volumeVO.getId(), volumeVO);
+                chainAlreadyEnded = true;
+            }
+        }
+
+        runningVM = cleanAnswer.isVmRunning();
+        userVmVO.setState(runningVM ? VirtualMachine.State.Running : VirtualMachine.State.Stopped);
+        userVmDao.update(userVmVO.getId(), userVmVO);
+        vmInstanceDetailsDao.removeDetail(userVmVO.getId(), VmDetailConstants.LAST_KNOWN_STATE);
+        return chainAlreadyEnded;
+    }
+
+    protected void calculateAndSaveHash(Set<Pair<BackupDeltaTO, VolumeObjectTO>> backupDeltaAndVolumePairs, BackupVO backupVO, long hostId) {
+        TakeBackupHashCommand cmd = new TakeBackupHashCommand(backupDeltaAndVolumePairs.stream().map(Pair::first).collect(Collectors.toList()), backupVO.getUuid());
+        Answer answer = sendBackupCommand(hostId, cmd);
+
+        if (answer.getResult() && answer.getDetails() != null) {
+            logger.debug("Got xxHash128 [{}] of backup [{}].", answer.getDetails(), backupVO.getUuid());
+            backupDetailDao.addDetail(backupVO.getId(), BackupDetailsDao.BACKUP_HASH, answer.getDetails(), false);
+            return;
+        }
+        logger.warn("Unable to get hash of backup [{}] due to [{}].", backupVO.getUuid(), answer.getDetails());
+    }
+
+
+    /**
+     * Return a list of BackupDeltaTO of the given backup.
+     * */
+    protected List<BackupDeltaTO> getBackupDeltaTOList(long backupId) {
+        InternalBackupJoinVO backupJoinVO = internalBackupJoinDao.findById(backupId);
+        DataStoreTO imageStoreTo = dataStoreManager.getDataStore(backupJoinVO.getImageStoreId(), DataStoreRole.Image).getTO();
+        List<InternalBackupDataStoreVO> deltas = internalBackupDataStoreDao.listByBackupId(backupId);
+
+        return deltas.stream()
+                .map(delta -> new BackupDeltaTO(imageStoreTo, Hypervisor.HypervisorType.KVM, delta.getBackupPath()))
+                .collect(Collectors.toList());
+    }
+
+    protected void cleanupValidation(boolean startedVm, UserVmVO validationVm, BackupVO backupVO, List<VolumeVO> volumeVOs) {
+        if (validationVm == null) {
+            return;
+        }
+        if (startedVm) {
+            userVmManager.stopVirtualMachine(validationVm.getId(), true);
+        }
+        DestroyVMCmd destroyVMCmd = new DestroyVMCmd(validationVm.getId(), true);
+        StringBuilder errorMessage = new StringBuilder("Cleanup failed due to:");
+        boolean sendMail = false;
+        try {
+            userVmManager.destroyVm(destroyVMCmd, false);
+        } catch (Exception e) {
+            errorMessage.append("\nGot an unexpected exception while trying to destroy validation VM.");
+            sendMail = true;
+            logger.error("Got an error while trying to cleanup validation of backup [{}].", backupVO.getUuid(), e);
+        }
+        for (VolumeVO volume : volumeVOs) {
+            if (volume.getVolumeType() == Volume.Type.ROOT) {
+                continue;
+            }
+            Volume vol = volumeApiService.destroyVolume(volume.getId(), CallContext.current().getCallingAccount(), true, true, null);
+            if (vol == null) {
+                sendMail = true;
+                errorMessage.append(String.format("\nWe were unable to destroy volume [%s].", volume.getUuid()));
+            }
+        }
+
+        if (startedVm) {
+            CleanupKbossValidationCommand cleanupKbossValidationCommand = new CleanupKbossValidationCommand(validationVm.getName(), getSecondaryStorageUrls(validationVm));
+            Answer answer = agentManager.easySend(validationVm.getHostId(), cleanupKbossValidationCommand);
+            if (answer == null || !answer.getResult()) {
+                logger.error("Failed to cleanup post validation of backup [{}]. Got answer [{}]", backupVO.getUuid(), answer == null ? null : answer.getDetails());
+                HostVO host = hostDao.findById(validationVm.getHostId());
+                sendMail = true;
+                errorMessage.append(String.format("\nFailed to cleanup secondary storage mount at host [%s].", host != null ? host.getUuid() : "null"));
+            }
+        }
+
+        if (sendMail) {
+            sendCleanupFailedEmail(backupVO, errorMessage.toString());
+        }
+    }
+
+    protected boolean validateBackup(long backupId, VirtualMachineTO vmTO, Set<Pair<BackupDeltaTO, VolumeObjectTO>> backupDeltaAndVolumePairs, BackupVO backupVO, UserVmVO validationVm,
+            HostVO hostVo) {
+        Answer answer;
+        ValidateKbossVmCommand validateKbossVmCommand = new ValidateKbossVmCommand(vmTO, backupDeltaAndVolumePairs.stream().findFirst().get().first());
+        configureValidationSteps(validateKbossVmCommand, backupVO);
+        answer = agentManager.easySend(validationVm.getHostId(), validateKbossVmCommand);
+
+        boolean result = processValidationAnswer(answer, backupVO, validationVm, hostVo, validateKbossVmCommand);
+        if (result) {
+            backupVO.setValidationStatus(Backup.ValidationStatus.Valid);
+            backupDao.update(backupId, backupVO);
+        }
+        return result;
+    }
+
+    protected boolean prepareForValidation(long hostId, Set<Pair<BackupDeltaTO, VolumeObjectTO>> backupDeltaAndVolumePairs, BackupVO backupVO, UserVmVO validationVm) {
+        PrepareValidationCommand prepareCommand = new PrepareValidationCommand(new ArrayList<>(backupDeltaAndVolumePairs), getParentSecondaryStorageUrls(backupVO));
+
+        Answer answer = agentManager.easySend(hostId, prepareCommand);
+
+        if (answer == null || !answer.getResult()) {
+            String msg = String.format("Failed to prepare dummy VM [%s] for validation of %s. %s", validationVm.getName(), backupVO.getUuid(), answer != null ?
+                    "Details: "+ answer.getDetails(): "");
+            logger.error(msg);
+            setBackupUnableToValidateAndSendAlert(backupVO, msg);
+            return false;
+        }
+        return true;
+    }
+
+    protected void createValidationVolumesOnPrimaryStorage(List<VolumeVO> volumeVOs, UserVmVO validationVm, BackupVO backupVO, HostVO hostVo, List<VolumeObjectTO> volumeToList) throws NoTransitionException {
+        for (VolumeVO volume : volumeVOs) {
+            logger.debug("Creating validation volume [{}] for validation VM [{}].", volume.getUuid(), validationVm.getUuid());
+            VolumeInfo volumeInfo = volumeDataFactory.getVolume(volume.getId());
+            volumeInfo = volumeOrchestrationService.createVolumeOnPrimaryStorage(validationVm, volumeInfo, Hypervisor.HypervisorType.KVM, null, hostVo.getClusterId(),
+                    hostVo.getPodId());
+            validateCorrectStorageType(backupVO, volume, volumeInfo);
+            volumeToList.add((VolumeObjectTO)volumeInfo.getTO());
+        }
+    }
+
+    protected UserVmVO allocateValidationVm(long backupId, BackupVO backupVO) {
+        UserVmVO validationVm;
+        try {
+            validationVm = (UserVmVO) userVmManager.allocateVMForValidation(backupId, Hypervisor.HypervisorType.KVM);
+            NicVO nic = nicDao.findDefaultNicForVM(validationVm.getId());
+            virtualMachineManager.updateVmNic(validationVm, nic, false);
+            validationVm.setDataCenterId(backupVO.getZoneId());
+        } catch (InsufficientCapacityException | ResourceAllocationException | ResourceUnavailableException e) {
+            String msg = String.format("Unable to allocate dummy VM to validate %s due to %s.", backupVO.getUuid(), e.getMessage());
+            logger.error(msg, e);
+            setBackupUnableToValidateAndSendAlert(backupVO, msg);
+            return null;
+        }
+        return validationVm;
+    }
+
+    protected List<VolumeInfo> getVolumesToConsolidate(VirtualMachine vm, List<InternalBackupDataStoreVO> deltasOnSecondary, List<VolumeObjectTO> volumeObjectTOS, long hostId,
+            boolean sameVmAsBackup) {
+        List<VolumeInfo> volumesToConsolidate = new ArrayList<>();
+
+        transitVmState(vm, VirtualMachine.Event.RestoringSuccess, hostId);
+        for (VolumeObjectTO volume : volumeObjectTOS) {
+            VolumeInfo volumeInfo = volumeDataFactory.getVolume(volume.getVolumeId());
+            transitVolumeState(volumeInfo.getVolume(), Volume.Event.RestoreSucceeded);
+
+            if (!sameVmAsBackup || deltasOnSecondary.stream().anyMatch(delta -> delta.getVolumeId() == volume.getVolumeId())) {
+                volumesToConsolidate.add(volumeInfo);
+            }
+        }
+        return volumesToConsolidate;
+    }
+
+    protected boolean consolidateVolumes(VirtualMachine vm, long hostId, List<VolumeInfo> volumesToConsolidate) {
+        for (VolumeInfo volumeInfo : volumesToConsolidate) {
+            transitVolumeState(volumeInfo.getVolume(), Volume.Event.ConsolidationRequested);
+        }
+
+        VMInstanceDetailVO uuids = vmInstanceDetailsDao.findDetail(vm.getId(), VmDetailConstants.LINKED_VOLUMES_SECONDARY_STORAGE_UUIDS);
+        List<String> secondaryStorageUuids = uuids != null ? List.of(uuids.getValue().split(",")) : List.of();
+        ConsolidateVolumesCommand cmd = new ConsolidateVolumesCommand(volumesToConsolidate, secondaryStorageUuids, vm.getInstanceName());
+        Answer answer = sendBackupCommand(hostId, cmd);
+
+        String logError = String.format("Failed to consolidate volumes [%s] of VM [%s]. Answer details: [%s].",
+                volumesToConsolidate, vm.getName(), answer != null ? answer.getDetails() : "null");
+        if (!(answer instanceof ConsolidateVolumesAnswer)) {
+            logger.error(logError);
+            throw new BackupException(logError, false);
+        }
+        ConsolidateVolumesAnswer cAnswer = (ConsolidateVolumesAnswer)answer;
+        processConsolidateAnswer(cAnswer, volumesToConsolidate, vm);
+
+        logger.info("Volume consolidation answer: [{}].", cAnswer.getResult());
+        return cAnswer.getResult();
+    }
+
+    /**
+     * Validates the Backup status:<br/>
+     * - If it is Error and The VM is in BackupError, will throw an exception;<br/>
+     * - If it is in Error but the VM is not in BackupError, will set the backup as Failed so that it may be removed with {@code deleteFailedBackup(BackupVO backupVO)};<br/>
+     * - If it is not in Error, does nothing.
+     * */
+    protected void checkErrorBackup(BackupVO backupVO, VirtualMachine virtualMachine) {
+        if (backupVO.getStatus() != Backup.Status.Error) {
+            return;
+        }
+        if (virtualMachine != null && virtualMachine.getState() == VirtualMachine.State.BackupError) {
+            logger.error("Unable to delete backup [{}] as it is in Error state and the associated VM [{}] is in BackupError state. You must read the backup creation logs," +
+                    " normalize the VM's volumes in the hypervisor/storage and update the VM state in the database before trying to delete the backup. Try again when the VM is not " +
+                    "in this state.", backupVO, virtualMachine.getUuid());
+            throw new InvalidParameterValueException(String.format("Unable to delete backup [%s]. Please check the logs.", backupVO.getUuid()));
+        }
+        logger.debug("Assuming VM and storage are normalized and setting backup [{}] as failed so its metadata is deleted.");
+        backupVO.setStatus(Backup.Status.Failed);
+    }
+
+    /**
+     * Deletes a Failed backup metadata and sets the backup as Expunged.
+     * */
+    protected boolean deleteFailedBackup(BackupVO backupVO) {
+        if (backupVO.getStatus() != Backup.Status.Failed) {
+            return false;
+        }
+        long backupId = backupVO.getId();
+
+        backupVO.setStatus(Backup.Status.Expunged);
+        backupDao.update(backupId, backupVO);
+        internalBackupStoragePoolDao.expungeByBackupId(backupId);
+        internalBackupDataStoreDao.expungeByBackupId(backupId);
+        backupDetailDao.removeDetails(backupId);
+        return true;
+    }
+
+    /**
+     * Merges the current delta on primary storage, if any, into the given volume. If the backup has no more deltas on primary storage, will set the backup as end_of_chain.
+     * */
+    protected void mergeCurrentDeltaIntoVolume(Volume volume, VirtualMachine virtualMachine, String operation, boolean isVmRunning) {
+        InternalBackupStoragePoolVO delta = internalBackupStoragePoolDao.findOneByVolumeId(volume.getId());
+        if (delta == null) {
+            logger.debug("Volume [{}] has no deltas to merge, doing nothing.", volume.getUuid());
+            return;
+        }
+        InternalBackupJoinVO internalBackupJoinVO = internalBackupJoinDao.findById(delta.getBackupId());
+        VMSnapshotVO succeedingVmSnapshotVO = getSucceedingVmSnapshot(internalBackupJoinVO);
+
+        DataStore store = dataStoreManager.getDataStore(volume.getPoolId(), DataStoreRole.Primary);
+        VolumeObject volumeObject = VolumeObject.getVolumeObject(store, (VolumeVO)volume);
+
+        DeltaMergeTreeTO deltaMergeTreeTO = createDeltaMergeTree(succeedingVmSnapshotVO == null, isVmRunning, delta, (VolumeObjectTO)volumeObject.getTO(), succeedingVmSnapshotVO);
+        MergeDiskOnlyVmSnapshotCommand cmd = new MergeDiskOnlyVmSnapshotCommand(List.of(deltaMergeTreeTO), isVmRunning, virtualMachine.getInstanceName());
+
+        Answer answer = sendBackupCommand(vmSnapshotHelper.pickRunningHost(virtualMachine.getId()), cmd);
+
+        if (answer == null || !answer.getResult()) {
+            logger.error("Error while trying to prepare volume [{}] for {}. Got [{}] as answer from host.", volume.getUuid(), operation, answer != null ? answer.getDetails() : null);
+            throw new CloudRuntimeException(String.format("Unable to prepare volume [%s] for [%s].", volume.getUuid(), operation));
+        }
+
+        if (succeedingVmSnapshotVO == null) {
+            VolumeVO volumeVO = volumeDao.findById(volumeObject.getId());
+            volumeVO.setPath(deltaMergeTreeTO.getParent().getPath());
+            volumeDao.update(volumeVO.getId(), volumeVO);
+        }
+
+        expungeOldDeltasAndUpdateVmSnapshotIfNeeded(List.of(delta), succeedingVmSnapshotVO);
+
+        List<InternalBackupStoragePoolVO> backupDeltas = internalBackupStoragePoolDao.listByBackupId(delta.getBackupId());
+        if (backupDeltas.isEmpty()) {
+            logger.debug("Backup [{}] has no more deltas on primary storage due to prepare volume [{}] for {} operation. Will set it as end of chain and not current.",
+                    internalBackupJoinVO.getUuid(), volume.getUuid(), operation);
+            setEndOfChainAndRemoveCurrentForBackup(internalBackupJoinVO);
+        }
+    }
+
+    /**
+     * Creates the necessary delta references on both primary and secondary storage. Also maps the volume to the parent delta backup and create the delta merge tree.
+     * */
+    protected void createDeltaReferences(boolean fullBackup, boolean hasVmSnapshotSucceedingLastBackup, boolean runningVm, Backup backup,
+            List<InternalBackupDataStoreVO> parentBackupDeltasOnSecondary, List<InternalBackupStoragePoolVO> parentBackupDeltasOnPrimary,
+            HashMap<String, InternalBackupStoragePoolVO> volumeUuidToDeltaPrimaryRef, HashMap<String, InternalBackupDataStoreVO> volumeUuidToDeltaSecondaryRef,
+            VMSnapshotVO succeedingVmSnapshot, KbossTO kbossTO) {
+        VolumeObjectTO volumeObjectTO = kbossTO.getVolumeObjectTO();
+        logger.debug("Creating delta references for backup [{}] of volume [{}].", backup.getUuid(), volumeObjectTO.getUuid());
+
+        String filename = UUID.randomUUID().toString();
+        String relativePathOnSecondary = String.format("%s%s%s%s%s%s%s", "backups", File.separator, volumeObjectTO.getAccountId(), File.separator, volumeObjectTO.getId(),
+                File.separator, filename);
+        kbossTO.setDeltaPathOnPrimary(filename);
+        kbossTO.setDeltaPathOnSecondary(relativePathOnSecondary);
+
+        InternalBackupDataStoreVO deltaSecondaryRef = new InternalBackupDataStoreVO(backup.getId(), volumeObjectTO.getVolumeId(), volumeObjectTO.getDeviceId(), relativePathOnSecondary);
+        if (!fullBackup) {
+            InternalBackupStoragePoolVO parentDeltaOnPrimary = createDeltaMergeTreeForVolume(false, runningVm, parentBackupDeltasOnPrimary, succeedingVmSnapshot, kbossTO);
+            findAndSetParentBackupPath(parentBackupDeltasOnSecondary, parentDeltaOnPrimary, kbossTO);
+        }
+
+        InternalBackupDataStoreVO referenceOnSecondary = internalBackupDataStoreDao.persist(deltaSecondaryRef);
+        logger.trace("Created reference [{}] for backup [{}] of volume [{}].", referenceOnSecondary, backup, volumeObjectTO);
+        volumeUuidToDeltaSecondaryRef.put(volumeObjectTO.getUuid(), referenceOnSecondary);
+
+        InternalBackupStoragePoolVO deltaPrimaryRef = new InternalBackupStoragePoolVO(backup.getId(), volumeObjectTO.getPoolId(), volumeObjectTO.getVolumeId(), filename,
+                volumeObjectTO.getPath());
+
+        if (kbossTO.getDeltaMergeTreeTO() != null && !hasVmSnapshotSucceedingLastBackup) {
+            deltaPrimaryRef.setBackupDeltaParentPath(kbossTO.getDeltaMergeTreeTO().getParent().getPath());
+        } else if (hasVmSnapshotSucceedingLastBackup) {
+            deltaPrimaryRef.setBackupDeltaParentPath(volumeObjectTO.getPath());
+        }
+
+        InternalBackupStoragePoolVO referenceOnPrimary = internalBackupStoragePoolDao.persist(deltaPrimaryRef);
+        logger.trace("Created reference [{}] for backup [{}] of volume [{}].", referenceOnPrimary, backup, volumeObjectTO);
+        volumeUuidToDeltaPrimaryRef.put(volumeObjectTO.getUuid(), referenceOnPrimary);
+    }
+
+    protected HostVO getHostToRestore(VirtualMachine vm, boolean quickRestore, Long hostId) throws AgentUnavailableException {
+        HostVO host;
+        if (quickRestore) {
+            if (hostId == null) {
+                hostId = vm.getLastHostId();
+            }
+            if (hostId == null) {
+                logger.error("Cannot quick restore if the VM has no last host and no hostId was informed. You may try to start it in an available host and stop it before quick" +
+                        " restoring. Otherwise, use the normal restore.");
+                throw new AgentUnavailableException(String.format("No host found to quick restore VM [%s]. Please check the logs.", vm.getUuid()), -1);
+            }
+            host = hostDao.findByIdIncludingRemoved(hostId);
+            if (host.getStatus() != Status.Up || host.isInMaintenanceStates() || host.getResourceState() != ResourceState.Enabled) {
+                logger.error("Cannot quick restore if the VM's last host is in maintenance, not Up, or disabled. You may try to start it in an available host and stop it before quick" +
+                        " restoring. Otherwise, use the normal restore.");
+                throw new AgentUnavailableException(String.format("No host found to quick restore VM [%s]. Please check the logs.", vm.getUuid()), -1);
+            }
+        } else {
+            hostId = vmSnapshotHelper.pickRunningHost(vm.getId());
+            host = hostDao.findByIdIncludingRemoved(hostId);
+        }
+        return host;
+    }
+
+    /**
+     * Returns ordered list of disk-only VM snapshots taken after the last backup. The list is ordered from oldest to newest.
+     * */
+    protected List<VMSnapshotVO> getSucceedingVmSnapshotList(InternalBackupJoinVO backup) {
+        List<VMSnapshotVO> vmSnapshotVOs = new ArrayList<>();
+        if (backup == null) {
+            return vmSnapshotVOs;
+        }
+
+        VMSnapshotVO currentSnapshotVO = vmSnapshotDao.findCurrentSnapshotByVmId(backup.getVmId());
+        if (currentSnapshotVO == null || currentSnapshotVO.getCreated().before(backup.getDate())) {
+            return vmSnapshotVOs;
+        }
+        vmSnapshotVOs.add(0, currentSnapshotVO);
+
+        while (currentSnapshotVO.getParent() != null && currentSnapshotVO.getParent() != 0) {
+            VMSnapshotVO parentSnap = vmSnapshotDao.findById(currentSnapshotVO.getParent());
+            if (parentSnap.getCreated().before(backup.getDate())){
+                break;
+            }
+            currentSnapshotVO = parentSnap;
+            vmSnapshotVOs.add(0, currentSnapshotVO);
+        }
+
+        logger.debug("Found the following VM snapshots that succeed the backup [{}]: [{}].", backup.getUuid(), vmSnapshotVOs);
+
+        return vmSnapshotVOs;
+    }
+
+    /**
+     * Returns the disk-only VM snapshot taken after the last backup, if any.
+     * */
+    protected VMSnapshotVO getSucceedingVmSnapshot(InternalBackupJoinVO backup) {
+        List<VMSnapshotVO> snaps = getSucceedingVmSnapshotList(backup);
+        if (snaps.isEmpty()) {
+            return null;
+        }
+        return snaps.get(0);
+    }
+
+    /**
+     * Given a VM snapshot, returns a map of volume id to list of snapshot references of the children of the VM snapshot.
+     * */
+    protected Map<Long, List<SnapshotDataStoreVO>> gatherSnapshotReferencesOfChildrenSnapshot(List<VolumeObjectTO> volumeObjectTOs, VMSnapshot vmSnapshotVO) {
+        Map<Long, List<SnapshotDataStoreVO>> volumeToSnapshotRefs = new HashMap<>();
+        if (vmSnapshotVO == null) {
+            return volumeToSnapshotRefs;
+        }
+
+        List<VMSnapshotVO> snapshotChildren = vmSnapshotDao.listByParent(vmSnapshotVO.getId());
+        if (CollectionUtils.isEmpty(snapshotChildren)) {
+            return volumeToSnapshotRefs;
+        }
+
+        List<SnapshotDataStoreVO> snapshotDataStoreVOS = new ArrayList<>();
+        snapshotChildren.stream()
+                .map(snapshotVo -> vmSnapshotHelper.getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(snapshotVo.getId()))
+                .forEach(snapshotDataStoreVOS::addAll);
+        mapVolumesToSnapshotReferences(volumeObjectTOs, snapshotDataStoreVOS, volumeToSnapshotRefs);
+        if (logger.isDebugEnabled()) {
+            StringBuilder log = new StringBuilder(String.format("Found the following snapshot references that succeed the VM snapshot [%s].", vmSnapshotVO.getUuid()));
+            for (VolumeObjectTO volumeObjectTO : volumeObjectTOs) {
+                log.append(String.format(" Volume [%s]; Snapshot references [%s].", volumeObjectTO.getUuid(), volumeToSnapshotRefs.get(volumeObjectTO.getId())));
+            }
+            logger.debug(log.toString());
+        }
+
+        return volumeToSnapshotRefs;
+    }
+
+    /**
+     * Given a list of volumes and VM snapshots, maps the volumes to the snapshot references of the VM snapshots.
+     * */
+    protected Map<Long, List<SnapshotDataStoreVO>> mapVolumesToVmSnapshotReferences(List<VolumeObjectTO> volumeObjectTOs, List<VMSnapshotVO> vmSnapshotVOList) {
+        Map<Long, List<SnapshotDataStoreVO>> volumeToSnapshotRefs = new HashMap<>();
+        if (vmSnapshotVOList.isEmpty()) {
+            logger.trace("No VM snapshot to map to any volume, returning.");
+            return volumeToSnapshotRefs;
+        }
+
+        ArrayList<SnapshotDataStoreVO> allRefs = new ArrayList<>();
+        for (VMSnapshotVO vmSnapshotVO : vmSnapshotVOList) {
+            allRefs.addAll(vmSnapshotHelper.getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(vmSnapshotVO.getId()));
+        }
+        mapVolumesToSnapshotReferences(volumeObjectTOs, allRefs, volumeToSnapshotRefs);
+        logger.trace("Given volume objects [{}] and VM snapshots [{}], created the following map [{}].", volumeObjectTOs, vmSnapshotVOList, volumeToSnapshotRefs);
+        return volumeToSnapshotRefs;
+    }
+
+    protected void mapVolumesToSnapshotReferences(List<VolumeObjectTO> volumeObjectTOs, List<SnapshotDataStoreVO> snapshotDataStoreVOS, Map<Long, List<SnapshotDataStoreVO>> volumeToSnapshotRefs) {
+        for (VolumeObjectTO volumeObjectTO : volumeObjectTOs) {
+            List<SnapshotDataStoreVO> associatedSnapshots = snapshotDataStoreVOS.stream()
+                    .filter(snapRef -> Objects.equals(snapRef.getVolumeId(), volumeObjectTO.getVolumeId()))
+                    .collect(Collectors.toList());
+            volumeToSnapshotRefs.put(volumeObjectTO.getId(), associatedSnapshots);
+        }
+    }
+
+    /**
+     * Updates the necessary references on the database. Also calculates the backup's physical size.
+     * */
+    protected long updateDeltaReferencesAndCalculateBackupPhysicalSize(VolumeObjectTO volumeObjectTO, HashMap<String, InternalBackupStoragePoolVO> volumeUuidToDeltaPrimaryRef,
+            HashMap<String, InternalBackupDataStoreVO> volumeUuidToDeltaSecondaryRef, TakeKbossBackupAnswer answer, long physicalBackupSize, boolean endChain, boolean isolated,
+            BackupVO backupVO) {
+        String volumeUuid = volumeObjectTO.getUuid();
+        InternalBackupStoragePoolVO deltaPrimaryRef = volumeUuidToDeltaPrimaryRef.get(volumeUuid);
+        if (endChain || isolated) {
+            logger.trace("Since backup [{}] is [{}]. We will delete the delta reference on primary at [{}] as it does not exist anymore.", backupVO.getUuid(), endChain ?
+                    "end of chain" : "isolated", deltaPrimaryRef.getBackupDeltaPath());
+            internalBackupStoragePoolDao.expunge(deltaPrimaryRef.getId());
+        }
+
+        InternalBackupDataStoreVO deltaSecondaryRef = volumeUuidToDeltaSecondaryRef.get(volumeUuid);
+
+        String newVolumePath = answer.getMapVolumeUuidToNewVolumePath().get(volumeUuid);
+
+        VolumeVO volumeVO = volumeDao.findById(volumeObjectTO.getId());
+        volumeVO.setPath(newVolumePath);
+        logger.trace("Updating volume [{}] path to [{}].", volumeVO.getUuid(), newVolumePath);
+        volumeDao.update(volumeVO.getId(), volumeVO);
+
+        Pair<String, Long> deltaPathOnSecondaryAndSize = answer.getMapVolumeUuidToDeltaPathOnSecondaryAndSize().get(volumeUuid);
+        logger.trace("Updating delta reference on secondary [{}] path to [{}].", deltaSecondaryRef, deltaPathOnSecondaryAndSize.first());
+        deltaSecondaryRef.setBackupPath(deltaPathOnSecondaryAndSize.first());
+        internalBackupDataStoreDao.update(deltaSecondaryRef.getId(), deltaSecondaryRef);
+
+        physicalBackupSize += deltaPathOnSecondaryAndSize.second();
+        return physicalBackupSize;
+    }
+
+    /**
+     * Expunge the old backup deltas and if there were disk-only VM snapshot deltas after the last backup, update their paths.
+     * */
+    protected void expungeOldDeltasAndUpdateVmSnapshotIfNeeded(List<InternalBackupStoragePoolVO> oldDeltasOnPrimary, VMSnapshot vmSnapshot) {
+        List<SnapshotDataStoreVO> snapshotRefs = vmSnapshot == null ? List.of() : vmSnapshotHelper.getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(vmSnapshot.getId());
+        for (InternalBackupStoragePoolVO oldBackupDelta : oldDeltasOnPrimary) {
+            logger.trace("Expunging old backup delta [{}].", oldBackupDelta);
+            internalBackupStoragePoolDao.expunge(oldBackupDelta.getId());
+            SnapshotDataStoreVO snapshotDataStoreVO = snapshotRefs.stream().filter(ref -> ref.getVolumeId() == oldBackupDelta.getVolumeId()).findFirst().orElse(null);
+            if (snapshotDataStoreVO == null) {
+                continue;
+            }
+            snapshotDataStoreVO.setInstallPath(oldBackupDelta.getBackupDeltaParentPath());
+            logger.debug("Updating snapshot delta [{}] path to [{}].", snapshotDataStoreVO.getId(), oldBackupDelta.getBackupDeltaParentPath());
+            snapshotDataStoreDao.update(snapshotDataStoreVO.getId(), snapshotDataStoreVO);
+        }
+    }
+
+    /**
+     * Create a {@link DeltaMergeTreeTO} for the volume if it has a delta on primary and add it to the list.
+     *
+     * @return the delta on primary of the volume. Null if no delta.
+     * */
+    protected InternalBackupStoragePoolVO createDeltaMergeTreeForVolume(boolean childIsVolume, boolean runningVm, List<InternalBackupStoragePoolVO> deltasOnPrimary, VMSnapshotVO succeedingVmSnapshot,
+            KbossTO kbossTO) {
+        VolumeObjectTO volumeObjectTO = kbossTO.getVolumeObjectTO();
+
+        InternalBackupStoragePoolVO deltaOnPrimary = deltasOnPrimary.stream()
+                .filter(delta -> delta.getVolumeId() == volumeObjectTO.getVolumeId())
+                .findFirst()
+                .orElse(null);
+        if (deltaOnPrimary == null) {
+            logger.debug("Volume [{}] has no delta on primary storage.", volumeObjectTO);
+            return null;
+        }
+
+        logger.debug("Volume [{}] has a backup delta on primary storage [{}].", volumeObjectTO.getUuid(), deltaOnPrimary);
+
+        kbossTO.setDeltaMergeTreeTO(createDeltaMergeTree(childIsVolume, runningVm, deltaOnPrimary, volumeObjectTO, succeedingVmSnapshot));
+        return deltaOnPrimary;
+    }
+
+    protected DeltaMergeTreeTO createDeltaMergeTree(boolean childIsVolume, boolean runningVm, InternalBackupStoragePoolVO deltaOnPrimary,
+            VolumeObjectTO volumeObjectTO, VMSnapshotVO succeedingVmSnapshot) {
+        DataStore store = dataStoreManager.getDataStore(deltaOnPrimary.getStoragePoolId(), DataStoreRole.Primary);
+        DataTO deltaChild;
+        if (childIsVolume) {
+            deltaChild = volumeObjectTO;
+        } else {
+            deltaChild = new BackupDeltaTO(store.getTO(), Hypervisor.HypervisorType.KVM, deltaOnPrimary.getBackupDeltaPath());
+        }
+
+        BackupDeltaTO deltaParent = new BackupDeltaTO(store.getTO(), Hypervisor.HypervisorType.KVM, deltaOnPrimary.getBackupDeltaParentPath());
+
+        List<String> succeedingDeltaPaths = new ArrayList<>();
+        if (succeedingVmSnapshot != null) {
+            succeedingDeltaPaths = gatherSnapshotReferencesOfChildrenSnapshot(List.of(volumeObjectTO), succeedingVmSnapshot).getOrDefault(volumeObjectTO.getVolumeId(), List.of())
+                    .stream().map(SnapshotDataStoreVO::getInstallPath).collect(Collectors.toList());
+
+            if (!childIsVolume && !runningVm && succeedingDeltaPaths.isEmpty()) {
+                succeedingDeltaPaths = List.of(volumeObjectTO.getPath());
+                logger.debug("Since the last backup delta of volume [{}] is succeeded by a snapshot and the delta created by this snapshot is also the volume, it will have to be" +
+                        " rebased. Setting it as the grand-child.", volumeObjectTO.getUuid());
+            }
+        }
+
+        List<DataTO> deltaGrandchildren = succeedingDeltaPaths.stream()
+                .map(deltaPath -> new BackupDeltaTO(store.getTO(), Hypervisor.HypervisorType.KVM, deltaPath))
+                .collect(Collectors.toList());
+
+        DeltaMergeTreeTO deltaMergeTreeTO = new DeltaMergeTreeTO(volumeObjectTO, deltaParent, deltaChild, deltaGrandchildren);
+
+        logger.debug("Mapped the following delta merge tree for volume [{}]: [{}].", volumeObjectTO.getUuid(), deltaMergeTreeTO);
+        return deltaMergeTreeTO;
+    }
+
+    /**
+     * Sets on the {@code kbossTO} the backupParentOnSecondary path based on the list of InternalBackupDataStoreVO.
+     *
+     * @param parentBackupDeltasOnSecondary
+     *         List of deltas on secondary;
+     * @param parentDeltaOnPrimary
+     * @param kbossTO
+     *         KbossTO to be configured;
+     */
+    protected void findAndSetParentBackupPath(List<InternalBackupDataStoreVO> parentBackupDeltasOnSecondary, InternalBackupStoragePoolVO parentDeltaOnPrimary, KbossTO kbossTO) {
+        VolumeObjectTO volumeObjectTO = kbossTO.getVolumeObjectTO();
+        if (parentDeltaOnPrimary == null) {
+            logger.debug("Volume [{}] has no parent on primary, thus its backup cannot be incremental.", volumeObjectTO);
+            return;
+        }
+
+        InternalBackupDataStoreVO parentOnSecondary = parentBackupDeltasOnSecondary.stream()
+                .filter(backupDataStoreVo -> volumeObjectTO.getVolumeId() == backupDataStoreVo.getVolumeId())
+                .findFirst()
+                .orElse(null);
+
+        if (parentOnSecondary == null) {
+            return;
+        }
+
+        logger.debug("Volume [{}] already has a backup [{}].", volumeObjectTO.getUuid(), parentOnSecondary.getBackupId());
+
+        kbossTO.setPathBackupParentOnSecondary(parentOnSecondary.getBackupPath());
+    }
+
+    /**
+     * Verify if the data center has heuristic rules for allocating backups; if there is then returns the {@link DataStore} returned by the JS script.
+     * Otherwise, returns a {@link DataStore} with free capacity.
+     */
+    protected DataStore getImageStoreForBackup(Long dataCenterId, BackupVO backupVO) {
+        DataStore imageStore = heuristicRuleHelper.getImageStoreIfThereIsHeuristicRule(dataCenterId, HeuristicType.BACKUP, backupVO);
+
+        if (imageStore == null) {
+            imageStore = dataStoreManager.getImageStoreWithFreeCapacity(dataCenterId);
+        }
+
+        if (imageStore == null) {
+            backupVO.setStatus(Backup.Status.Failed);
+            backupDao.update(backupVO.getId(), backupVO);
+            throw new CloudRuntimeException(String.format("Unable to find secondary storage for backup [%s].", backupVO));
+        }
+
+        logger.debug("Backup [{}] will use secondary storage [{}].", backupVO.getUuid(), imageStore.getUuid());
+        return imageStore;
+    }
+
+    protected void setBackupAsIsolated(BackupVO backup) {
+        logger.debug("Setting backup [{}] as isolated.", backup.getUuid());
+        backupDetailDao.persist(new BackupDetailVO(backup.getId(), ISOLATED, Boolean.TRUE.toString(), true));
+    }
+
+    /**
+     * Gets the parent for newBackup. Will set the newBackup as the end of chain if needed.<br/>
+     * - If no backups are found, returns null. <br/>
+     * - If the last backup was the end of the chain, returns null. <br/>
+     *
+     * @param newBackup the new backup being created.
+     * @param backupChain newBackup's ancestors.
+     * */
+    protected InternalBackupJoinVO getParentAndSetEndOfChain(BackupVO newBackup, List<InternalBackupJoinVO> backupChain, BackupOfferingVO offering) {
+        int chainSize = getChainSizeForBackup(offering, newBackup.getZoneId());
+        if (CollectionUtils.isEmpty(backupChain)) {
+            setEndOfChainTrueIfRemainingChainSizeIsOneOrLess(chainSize, chainSize, newBackup.getId(), newBackup.getUuid());
+            return null;
+        }
+
+        int remainingChainSize = chainSize - backupChain.size();
+        setEndOfChainTrueIfRemainingChainSizeIsOneOrLess(remainingChainSize, chainSize, newBackup.getId(), newBackup.getUuid());
+
+        InternalBackupJoinVO parent = backupChain.get(0);
+        return parent.getStatus().equals(Backup.Status.BackedUp) ? parent : null;
+    }
+
+    /**
+     * For every restore point, maps a volume to it.
+     * @throws CloudRuntimeException If cannot map restore point to any volume.
+     * */
+    protected Set<Pair<BackupDeltaTO, VolumeObjectTO>> generateBackupAndVolumePairsToRestore(List<InternalBackupDataStoreVO> backupDeltas, List<VolumeObjectTO> volumeTOs,
+            InternalBackupJoinVO backupJoinVO, boolean sameVmAsBackup) {
+        Set<Pair<BackupDeltaTO, VolumeObjectTO>> backupAndVolumePairs = new HashSet<>();
+        DataStore dataStore = dataStoreManager.getDataStore(backupJoinVO.getImageStoreId(), DataStoreRole.Image);
+        for (InternalBackupDataStoreVO backupDataStoreVO : backupDeltas) {
+            VolumeObjectTO volumeObjectTO = volumeTOs.stream()
+                    .filter(volumeTO -> sameVmAsBackup ? volumeTO.getVolumeId() == backupDataStoreVO.getVolumeId() : volumeTO.getDeviceId() == backupDataStoreVO.getDeviceId())
+                    .findFirst()
+                    .orElse(null);
+
+            if (volumeObjectTO == null) {
+                logger.error("All backups should have a corresponding volume at this point, however, backup delta [{}] does not.", backupDataStoreVO.getId());
+                throw new CloudRuntimeException("Error while restoring backup. Please check the logs.");
+            }
+
+            backupAndVolumePairs.add(new Pair<>(new BackupDeltaTO(dataStore.getTO(), Hypervisor.HypervisorType.KVM, backupDataStoreVO.getBackupPath()), volumeObjectTO));
+        }
+        logger.debug("Generated the following list of pairs of backup deltas and volumes: [{}].", backupAndVolumePairs);
+        return backupAndVolumePairs;
+    }
+
+    protected Pair<BackupDeltaTO, VolumeObjectTO> generateBackupAndVolumePairForSingleNewVolume(InternalBackupDataStoreVO backupDeltaVo, VolumeObjectTO volumeTO,
+            InternalBackupJoinVO backupJoinVO) {
+        DataStore dataStore = dataStoreManager.getDataStore(backupJoinVO.getImageStoreId(), DataStoreRole.Image);
+        Pair<BackupDeltaTO, VolumeObjectTO> backupAndVolumePair = new Pair<>(new BackupDeltaTO(dataStore.getTO(), Hypervisor.HypervisorType.KVM, backupDeltaVo.getBackupPath()), volumeTO);
+
+        logger.debug("Paired volume [{}] with backup delta [{}].", volumeTO, backupAndVolumePair.first());
+        return backupAndVolumePair;
+    }
+
+    /**
+     * For every volume, maps deltas that should be deleted, if there are any. If a volume has a delta but is not part of backup being restored, it will be mapped to be merged.
+     *
+     * @return List of deltas to be merged.
+     * */
+    protected List<DeltaMergeTreeTO> populateDeltasToRemoveAndToMergeAndUpdateVolumePaths(List<InternalBackupStoragePoolVO> deltasOnPrimary, Set<BackupDeltaTO> deltasToRemove, List<VolumeObjectTO> volumeTOs,
+            List<VolumeObjectTO> volumesNotPartOfTheBackupBeingRestored, String vmUuid) {
+        List<DeltaMergeTreeTO> deltasToBeMerged = new ArrayList<>();
+        for (InternalBackupStoragePoolVO deltaOnPrimary : deltasOnPrimary) {
+            Optional<VolumeObjectTO> optional = volumeTOs.stream().filter(volumeTO -> volumeTO.getVolumeId() == deltaOnPrimary.getVolumeId()).findFirst();
+            if (optional.isEmpty()) {
+                logger.error("Failed to find volume that matches delta [{}] with path [{}]. Please check for inconsistencies on the database or if there are leftover" +
+                        " deltas on storage.", deltaOnPrimary.getId(), deltaOnPrimary.getBackupDeltaPath());
+                throw new CloudRuntimeException(String.format("Failed to restore VM [%s]. Please check the logs.", vmUuid));
+            }
+            VolumeObjectTO volumeObjectTO = optional.get();
+
+            if (volumesNotPartOfTheBackupBeingRestored.contains(volumeObjectTO)) {
+                deltasToBeMerged.add(createDeltaMergeTree(true, false, deltaOnPrimary, volumeObjectTO, null));
+                continue;
+            }
+
+            DataStore dataStore = dataStoreManager.getDataStore(deltaOnPrimary.getStoragePoolId(), DataStoreRole.Primary);
+            BackupDeltaTO backupDeltaTO = new BackupDeltaTO(dataStore.getTO(), Hypervisor.HypervisorType.KVM, deltaOnPrimary.getBackupDeltaPath());
+            logger.debug("Mapped the following backup delta on primary to be removed since the volume [{}] is not part of the backup being restored [{}].",
+                    volumeObjectTO.getUuid(), backupDeltaTO);
+            deltasToRemove.add(backupDeltaTO);
+            volumeObjectTO.setPath(deltaOnPrimary.getBackupDeltaParentPath());
+        }
+        if (!deltasToBeMerged.isEmpty()) {
+            logger.debug("The following deltaMergeTrees [{}] were created to merge volumes [{}] that have no backups.", deltasToBeMerged, volumesNotPartOfTheBackupBeingRestored);
+        }
+        return deltasToBeMerged;
+    }
+
+    protected void updateVolumePathsAndSizeIfNeeded(VirtualMachine vm, List<VolumeObjectTO> volumeTOs, List<Backup.VolumeInfo> volumeInfos,
+            List<DeltaMergeTreeTO> deltaMergeTreeTOList, boolean sameVmAsBackup) {
+        List<VolumeVO> volumeVOs = volumeDao.findByInstance(vm.getId());
+
+        for (VolumeVO volumeVO : volumeVOs) {
+            VolumeObjectTO volumeTO = volumeTOs.stream().filter(volumeObjectTO -> volumeObjectTO.getVolumeId() == volumeVO.getId()).findFirst().get();
+
+            String log = "Volume [%s] path was updated as part of the backup restore process. New path: [%s].";
+            DeltaMergeTreeTO deltaMergeTreeTO = deltaMergeTreeTOList.stream().filter(delta -> delta.getChild().getId() == volumeTO.getId()).findFirst().orElse(null);
+            if (!volumeVO.getPath().equals(volumeTO.getPath())) {
+                volumeVO.setPath(volumeTO.getPath());
+                logger.debug(() -> String.format(log, volumeVO.getUuid(), volumeVO.getPath()));
+            } else if (deltaMergeTreeTO != null) {
+                volumeVO.setPath(deltaMergeTreeTO.getParent().getPath());
+                logger.debug(() -> String.format(log, volumeVO.getUuid(), volumeVO.getPath()));
+            }
+
+            Backup.VolumeInfo volumeInfo = volumeInfos.stream()
+                    .filter(info -> sameVmAsBackup ? volumeVO.getUuid().equals(info.getUuid()) : volumeVO.getDeviceId().equals(info.getDeviceId()))
+                    .findFirst().orElse(null);
+            if (volumeInfo != null && !Objects.equals(volumeInfo.getSize(), volumeVO.getSize())) {
+                logger.debug("Volume [{}] size was restored as part of the backup restore process. Old size is [{}] new size is [{}].", volumeVO.getUuid(),
+                        volumeVO.getSize(), volumeInfo.getSize());
+                volumeVO.setSize(volumeInfo.getSize());
+            }
+
+            volumeDao.update(volumeVO.getId(), volumeVO);
+        }
+    }
+
+    protected void createAndAttachVolumes(List<Backup.VolumeInfo> volumeInfos, List<InternalBackupDataStoreVO> backupDeltas, VirtualMachine vm, HostVO host) {
+        logger.info("Found the following backup deltas that have no volume correspondence [{}]. Will create new volumes and attach them to VM [{}].", backupDeltas.stream()
+                .map(InternalBackupDataStoreVO::getId).collect(Collectors.toList()), vm.getUuid());
+        for (InternalBackupDataStoreVO delta : backupDeltas) {
+            VolumeVO volumeVO = volumeDao.findByIdIncludingRemoved(delta.getVolumeId());
+            Backup.VolumeInfo backupVolumeInfo = volumeInfos.stream().filter(info -> volumeVO.getUuid().equals(info.getUuid())).findFirst().orElseThrow();
+            VolumeInfo volumeInfo = duplicateAndCreateVolume(vm, host, backupVolumeInfo);
+            Volume volume = volumeApiService.attachVolumeToVM(vm.getId(), volumeInfo.getId(), null, false, true);
+            transitVolumeState(volume, Volume.Event.RestoreRequested);
+            delta.setVolumeId(volume.getId());
+        }
+    }
+
+    protected VolumeInfo duplicateAndCreateVolume(VirtualMachine vm, HostVO hostVo, Backup.VolumeInfo backupVolumeInfo) {
+        VolumeVO newVolume = duplicateVolume(backupVolumeInfo);
+        VolumeInfo volumeInfo = volumeDataFactory.getVolume(newVolume.getId());
+
+        try {
+            volumeInfo = volumeOrchestrationService.createVolumeOnPrimaryStorage(vm, volumeInfo, Hypervisor.HypervisorType.KVM, null, hostVo.getClusterId(), hostVo.getPodId());
+            validateCorrectStorageType(null, newVolume, volumeInfo);
+        } catch (NoTransitionException ex) {
+            logger.error("Exception while creating volume to restore.", ex);
+            throw new CloudRuntimeException(ex);
+        }
+
+        return volumeInfo;
+    }
+
+    protected VolumeVO duplicateVolume(Backup.VolumeInfo backupVolumeInfo) {
+        VolumeVO volumeVO = volumeDao.findByUuidIncludingRemoved(backupVolumeInfo.getUuid());
+        VolumeVO duplicateVO = new VolumeVO(volumeVO);
+        DiskOfferingVO diskOfferingVO = diskOfferingDao.findByUuidIncludingRemoved(backupVolumeInfo.getDiskOfferingId());
+        duplicateVO.setDiskOfferingId(diskOfferingVO.getId());
+        duplicateVO.setSize(backupVolumeInfo.getSize());
+        duplicateVO.setMinIops(backupVolumeInfo.getMinIops());
+        duplicateVO.setMaxIops(backupVolumeInfo.getMaxIops());
+        duplicateVO.setAttached(null);
+        duplicateVO.setVolumeType(Volume.Type.DATADISK);
+        duplicateVO.setInstanceId(null);
+        duplicateVO.setPoolId(null);
+        duplicateVO.setPath(null);
+        return volumeDao.persist(duplicateVO);
+    }
+
+    protected List<InternalBackupDataStoreVO> getBackupsWithoutVolumes(List<InternalBackupDataStoreVO> backups, List<VolumeObjectTO> volumes) {
+        List<InternalBackupDataStoreVO> deltasOnSecondaryWithNoVolumes = new ArrayList<>();
+        for (InternalBackupDataStoreVO backup : backups) {
+            VolumeObjectTO volumeObjectTO = volumes.stream().filter(volumeTO -> volumeTO.getVolumeId() == backup.getVolumeId())
+                    .findFirst()
+                    .orElse(null);
+
+            if (volumeObjectTO == null) {
+                deltasOnSecondaryWithNoVolumes.add(backup);
+            }
+        }
+        return deltasOnSecondaryWithNoVolumes;
+    }
+
+    protected List<VolumeObjectTO> getVolumesThatAreNotPartOfTheBackup(List<VolumeObjectTO> volumeObjectTOS, List<InternalBackupDataStoreVO> deltasOnSecondary) {
+        List<VolumeObjectTO> volumesWithNoBackups = new ArrayList<>();
+        for (VolumeObjectTO volume : volumeObjectTOS) {
+            if (deltasOnSecondary.stream().noneMatch(delta -> delta.getVolumeId() == volume.getVolumeId())) {
+                volumesWithNoBackups.add(volume);
+            }
+        }
+        logger.debug("Found the following volumes that are not part of the backup being restored [{}].", volumesWithNoBackups);
+        return volumesWithNoBackups;
+    }
+
+    protected void processBackupSuccess(boolean runningVm, List<VolumeObjectTO> volumeTOs, HashMap<String, InternalBackupStoragePoolVO> volumeUuidToDeltaPrimaryRef,
+            HashMap<String, InternalBackupDataStoreVO> volumeUuidToDeltaSecondaryRef, TakeKbossBackupAnswer answer, List<InternalBackupStoragePoolVO> parentBackupDeltasOnPrimary,
+            List<VMSnapshotVO> succeedingVmSnapshots, BackupVO backupVO, boolean fullBackup, VirtualMachine userVm, Long hostId, boolean endChain, boolean isolated) {
+        long physicalBackupSize = 0;
+        logger.debug("Processing backup [{}] success.", backupVO.getUuid());
+        for (VolumeObjectTO volumeObjectTO : volumeTOs) {
+            physicalBackupSize = updateDeltaReferencesAndCalculateBackupPhysicalSize(volumeObjectTO, volumeUuidToDeltaPrimaryRef, volumeUuidToDeltaSecondaryRef, answer,
+                    physicalBackupSize, endChain, isolated, backupVO);
+        }
+
+        expungeOldDeltasAndUpdateVmSnapshotIfNeeded(parentBackupDeltasOnPrimary, succeedingVmSnapshots.isEmpty() ? null : succeedingVmSnapshots.get(0));
+
+        backupVO.setSize(physicalBackupSize);
+        backupVO.setStatus(Backup.Status.BackedUp);
+        backupVO.setBackedUpVolumes(backupManager.createVolumeInfoFromVolumes(new ArrayList<>(volumeDao.findByInstance(userVm.getId()))));
+        backupDao.loadDetails(backupVO);
+        backupVO.getDetails().putAll(backupManager.getBackupDetailsFromVM(userVm));
+        backupVO.setType(fullBackup ? "FULL" : "INCREMENTAL");
+        backupDao.update(backupVO.getId(), backupVO);
+
+        transitVmState(userVm, runningVm ? VirtualMachine.Event.BackupSucceededRunning : VirtualMachine.Event.BackupSucceededStopped, hostId);
+    }
+
+    protected void processBackupFailure(Answer answer, VirtualMachine vm, long hostId, boolean runningVm, BackupVO backupVO) {
+        if (answer instanceof TakeKbossBackupAnswer && ((TakeKbossBackupAnswer) answer).isVmConsistent()) {
+            logger.info("Backup [{}] of VM [{}] failed. However, the VM is still consistent, so we will roll back its state.", backupVO.getUuid(), vm.getUuid());
+            backupVO.setStatus(Backup.Status.Failed);
+
+            transitVmState(vm, runningVm ? VirtualMachine.Event.OperationFailedToRunning : VirtualMachine.Event.OperationFailedToStopped, hostId);
+        } else {
+            logger.info("Backup [{}] of VM [{}] ended in error. We are not sure if the VM is consistent; thus, we will set it as BackupError.", backupVO.getUuid(), vm.getUuid());
+            transitVmState(vm, VirtualMachine.Event.OperationFailedToError, hostId);
+            vmInstanceDetailsDao.addDetail(vm.getId(), VmDetailConstants.LAST_KNOWN_STATE, runningVm ? VirtualMachine.State.Running.name() : VirtualMachine.State.Stopped.name(), false);
+            backupVO.setStatus(Backup.Status.Error);
+        }
+
+        backupDao.update(backupVO.getId(), backupVO);
+    }
+
+    protected void processRemovedBackups(List<Long> removedBackupIds) {
+        for (Long removedBackupId : removedBackupIds) {
+            BackupVO removedBackupVO = backupDao.findByIdIncludingRemoved(removedBackupId);
+            removedBackupVO.setStatus(Backup.Status.Expunged);
+            backupDao.update(removedBackupId, removedBackupVO);
+            internalBackupDataStoreDao.expungeByBackupId(removedBackupId);
+            backupDetailDao.removeDetailsExcept(removedBackupId, END_OF_CHAIN);
+        }
+    }
+
+    /**
+     * For every backup, except for the one which the command was issued, will set them as Expunged regardless and hope operators will look
+     * at the logs. For the current one, if forced=false, will set it as error, otherwise, will set it as Expunged as well.
+     * */
+    protected boolean processRemoveBackupFailures(boolean forced, Answer[] deleteAnswers, List<Long> removedBackupIds, InternalBackupJoinVO backupJoinVO) {
+        List<Answer> failures = Arrays.stream(deleteAnswers).filter(answer -> !answer.getResult()).collect(Collectors.toList());
+        Set<Long> failedToRemoveBackupIdSet = new HashSet<>();
+        if (CollectionUtils.isNotEmpty(failures)) {
+            StringBuilder failureStringBuilder = new StringBuilder("Encountered the following failures during backup removal, all will be marked as Expunged and need to be" +
+                    " manually deleted from storage. ");
+            for (Answer answer : failures) {
+                failedToRemoveBackupIdSet.add(((BackupDeleteAnswer)answer).getBackupId());
+                failureStringBuilder.append(answer.getDetails());
+            }
+            logger.error(failureStringBuilder.toString());
+        }
+
+        removedBackupIds.removeAll(failedToRemoveBackupIdSet);
+
+        boolean result = failedToRemoveBackupIdSet.isEmpty();
+        if (!forced && failedToRemoveBackupIdSet.remove(backupJoinVO.getId())) {
+            BackupVO failedVO = backupDao.findByIdIncludingRemoved(backupJoinVO.getId());
+            logger.info("Since backup delete command was not forced, will not set the main backup [{}] as Expunged, will set it as error instead.", failedVO.getUuid());
+            failedVO.setStatus(Backup.Status.Error);
+            backupDao.update(failedVO.getId(), failedVO);
+        }
+
+        for (Long failedToRemove : failedToRemoveBackupIdSet) {
+            BackupVO failedVO = backupDao.findByIdIncludingRemoved(failedToRemove);
+            failedVO.setStatus(Backup.Status.Expunged);
+            logger.error("Setting backup [{}] as expunged, even though there was an error when deleting it from storage. Please look at the logs and check if it was deleted from" +
+                    " storage.", failedVO.getUuid());
+            backupDao.update(failedToRemove, failedVO);
+        }
+
+        return result;
+    }
+
+    protected void processConsolidateAnswer(ConsolidateVolumesAnswer cAnswer, List<VolumeInfo> volumesToConsolidate, VirtualMachine vm) {
+        for (VolumeObjectTO volumeObjectTO : cAnswer.getSuccessfullyConsolidatedVolumes()) {
+            VolumeInfo volumeInfo = volumesToConsolidate.stream().filter(vol -> vol.getId() == volumeObjectTO.getVolumeId()).findFirst().orElseThrow();
+            transitVolumeState(volumeInfo.getVolume(), Volume.Event.OperationSucceeded);
+            volumesToConsolidate.remove(volumeInfo);
+        }
+        volumesToConsolidate.forEach(volumeInfo -> transitVolumeState(volumeInfo, Volume.Event.OperationFailed));
+        if (cAnswer.getResult()) {
+            vmInstanceDetailsDao.removeDetail(vm.getId(), VmDetailConstants.LINKED_VOLUMES_SECONDARY_STORAGE_UUIDS);
+        } else {
+            throw new BackupException(String.format("Failed to consolidate all volumes necessary of VM [%s]. Missing volumes are [%s].", vm.getUuid(), volumesToConsolidate), false);
+        }
+    }
+
+    protected boolean processRestoreAnswers(VirtualMachine vm, Answer[] answers, boolean quickRestore) {
+        boolean cmdSucceeded = true;
+        for (Answer answer : answers) {
+            if (answer == null || !answer.getResult()) {
+                cmdSucceeded = false;
+                logger.error("Failed to restore backup due to: [{}].", answer == null ? "null answer" : answer.getDetails());
+            }
+            if (answer instanceof RestoreKbossBackupAnswer && quickRestore) {
+                RestoreKbossBackupAnswer restoreAnswer = (RestoreKbossBackupAnswer) answer;
+                vmInstanceDetailsDao.addDetail(vm.getId(), VmDetailConstants.LINKED_VOLUMES_SECONDARY_STORAGE_UUIDS, StringUtils.join(restoreAnswer.getSecondaryStorageUuids(), ","), false);
+            }
+        }
+        return cmdSucceeded;
+    }
+
+    protected boolean processValidationAnswer(Answer answer, BackupVO backupVO, UserVmVO validationVm, HostVO hostVo, ValidateKbossVmCommand validateKbossVmCommand) {
+        if (answer == null) {
+            String msg = String.format("Backup [%s] was validated using dummy VM [%s]. The backup was deemed invalid due to: Null answer from host [%s]", backupVO.getUuid(),
+                    validationVm.getName(), hostVo.getName());
+            logger.error(msg);
+            setBackupAsInvalidAndSendAlert(backupVO, msg);
+            return false;
+        }
+        if (!answer.getResult()) {
+            String msg = String.format("Backup [%s] was validated using dummy VM [%s]. The backup was deemed invalid due to: %s", backupVO.getUuid(),
+                    validationVm.getName(), answer.getDetails());
+            logger.error(msg);
+            setBackupAsInvalidAndSendAlert(backupVO, msg);
+            return false;
+        }
+        if (!(answer instanceof ValidateKbossVmAnswer)) {
+            return false;
+        }
+        ValidateKbossVmAnswer validateKbossVmAnswer = (ValidateKbossVmAnswer)answer;
+        boolean result = true;
+        String msg = String.format("Backup [%s] was validated using dummy VM [%s]. The backup was deemed invalid due to: ", backupVO.getUuid(), validationVm.getName());
+        if (validateKbossVmCommand.isWaitForBoot() && !validateKbossVmAnswer.isBootValidated()) {
+            result = false;
+            msg += "\n - The VM did not boot within the expected time.";
+        }
+        if (validateKbossVmCommand.isExecuteScript() && validateKbossVmAnswer.getScriptResult() != null) {
+            result = false;
+            msg += "\n - The script did not output the expected output. Captured output: " + validateKbossVmAnswer.getScriptResult();
+        }
+        if (validateKbossVmCommand.isTakeScreenshot() && validateKbossVmAnswer.getScreenshotPath() == null) {
+            result = false;
+            msg += "\n - We were unable to take a screenshot of the VM.";
+        } else if (validateKbossVmCommand.isTakeScreenshot()) {
+            logger.debug("Saving validation screenshot path [{}] to the backup details of backup [{}].", validateKbossVmAnswer.getScreenshotPath(), backupVO.getUuid());
+            backupDetailDao.addDetail(backupVO.getId(), SCREENSHOT_PATH, validateKbossVmAnswer.getScreenshotPath(), false);
+        }
+        if (!result) {
+            setBackupAsInvalidAndSendAlert(backupVO, msg);
+        }
+
+        return result;
+    }
+
+    protected void handleBackupExceptionInRestore(VirtualMachine vm, BackupException jobResult) {
+        if (!jobResult.isVmConsistent()) {
+            UserVmVO vmVO = userVmDao.findById(vm.getId());
+            vmVO.setState(VirtualMachine.State.RestoreError);
+            userVmDao.update(vmVO.getId(), vmVO);
+            for (VolumeVO vol : volumeDao.findByInstance(vmVO.getId())) {
+                vol.setState(Volume.State.RestoreError);
+                volumeDao.update(vol.getId(), vol);
+            }
+        }
+    }
+
+    protected void handleRestoreException(Backup backup, VirtualMachine vm, Object jobResult) {
+        if (!(jobResult instanceof Throwable)) {
+            return;
+        }
+        if (jobResult instanceof BackupException) {
+            handleBackupExceptionInRestore(vm, (BackupException)jobResult);
+        } else if (jobResult instanceof BackupProviderException) {
+            throw (BackupProviderException) jobResult;
+        }
+        throw new CloudRuntimeException(String.format("Exception while restoring KVM internal incremental backup [%s]. Check the logs for more information.", backup.getUuid()),
+            ((Throwable)jobResult).getCause());
+    }
+
+    protected boolean endBackupChain(VirtualMachine vm) {
+        InternalBackupJoinVO current = internalBackupJoinDao.findCurrent(vm.getId());
+        if (current == null) {
+            logger.debug("There is no current active chain, no need to do anything.");
+            return true;
+        }
+
+        if (mergeCurrentBackupDeltas(current)) {
+            setEndOfChainAndRemoveCurrentForBackup(current);
+            return true;
+        }
+        return false;
+    }
+
+    /**
+     * Merges the backup deltas related to the passed {@code InternalBackupJoinVO}.
+     *
+     * @return true if the merge was successful and false otherwise.
+     * */
+    protected boolean mergeCurrentBackupDeltas(InternalBackupJoinVO backupJoinVO) {
+        VirtualMachine userVm = userVmDao.findById(backupJoinVO.getVmId());
+        VMSnapshotVO succeedingVmSnapshot = getSucceedingVmSnapshot(backupJoinVO);
+        MergeDiskOnlyVmSnapshotCommand cmd = buildMergeDiskOnlyVmSnapshotCommandForCurrentBackup(backupJoinVO, userVm, succeedingVmSnapshot);
+        Long hostId = vmSnapshotHelper.pickRunningHost(backupJoinVO.getVmId());
+
+        Answer answer = sendBackupCommand(hostId, cmd);
+        if (answer == null || !answer.getResult()) {
+            logger.error("Failed to remove backup [{}]. Tried to merge the current deltas to cleanup the VM but failed due to [{}].",
+                    backupJoinVO.getUuid(), answer != null ? answer.getDetails() : "no answer");
+            return false;
+        }
+
+        expungeOldDeltasAndUpdateVmSnapshotIfNeeded(internalBackupStoragePoolDao.listByBackupId(backupJoinVO.getId()), succeedingVmSnapshot);
+
+        if (succeedingVmSnapshot != null) {
+            return true;
+        }
+
+        for (DeltaMergeTreeTO deltaMergeTreeTO : cmd.getDeltaMergeTreeToList()) {
+            VolumeVO volumeVO = volumeDao.findById(deltaMergeTreeTO.getVolumeObjectTO().getVolumeId());
+            volumeVO.setPath(deltaMergeTreeTO.getParent().getPath());
+            logger.debug("Updating volume [{}] path to [{}] as part of the backup delete cleanup process.", volumeVO.getUuid(), volumeVO.getPath());
+            volumeDao.update(volumeVO.getId(), volumeVO);
+        }
+
+        return true;
+    }
+
+    protected void createDeleteCommandsAndMergeTrees(List<VolumeObjectTO> volumeObjectTOs, Commands commands, List<InternalBackupStoragePoolVO> deletedDeltas,
+            VMSnapshotVO vmSnapshotSucceedingCurrentBackup, List<DeltaMergeTreeTO> deltaMergeTreeTOList) {
+        for (VolumeObjectTO volumeObjectTO : volumeObjectTOs) {
+            InternalBackupStoragePoolVO delta = internalBackupStoragePoolDao.findOneByVolumeId(volumeObjectTO.getVolumeId());
+            if (delta == null) {
+                continue;
+            }
+            if (delta.getBackupDeltaPath().equals(volumeObjectTO.getPath())) {
+                commands.addCommand(new DeleteCommand(new BackupDeltaTO(volumeObjectTO.getDataStore(), Hypervisor.HypervisorType.KVM, delta.getBackupDeltaParentPath())));
+                deletedDeltas.add(delta);
+                logger.debug("Volume [{}] has a backup delta that will be deleted as part of the preparation to revert a VM snapshot.", volumeObjectTO.getUuid());
+            } else {
+                deltaMergeTreeTOList.add(createDeltaMergeTree(false, false, delta, volumeObjectTO, vmSnapshotSucceedingCurrentBackup));
+            }
+        }
+    }
+
+    /***
+     * Gets the list of parents that should be expunged. Will also create delete commands for them and add them to the list deleteCommands object.
+     *
+     * @param backupVO backup being expunged
+     * @param deleteCommands Commands object that will be appended with the delete commands for the parent backups.
+     * @return A pair which contains the list of backups that will be expunged, and the reference to the last backup of the chain that is still alive, if it exists.
+     */
+    protected Pair<List<InternalBackupJoinVO>, InternalBackupJoinVO> getParentsToBeExpungedWithBackupAndAddThemToListOfDeleteCommands(BackupVO backupVO, Commands deleteCommands) {
+        logger.debug("Searching for removed parents of [{}] that should be expunged.", backupVO);
+        List<InternalBackupJoinVO> backupParents = getBackupJoinParents(backupVO, true);
+        List<InternalBackupJoinVO> backupParentsToBeExpunged = null;
+        InternalBackupJoinVO lastAliveBackup = null;
+        for (int i = 0; i < backupParents.size(); i++) {
+            InternalBackupJoinVO backupParent = backupParents.get(i);
+            if (Backup.Status.Removed.equals(backupParent.getStatus())) {
+                addBackupDeltasToDeleteCommand(backupParent.getId(), deleteCommands);
+            } else {
+                backupParentsToBeExpunged = backupParents.subList(0, i);
+                lastAliveBackup = backupParents.get(i);
+                break;
+            }
+        }
+        if (backupParentsToBeExpunged == null) {
+            backupParentsToBeExpunged = backupParents;
+        }
+        logger.debug("Found [{}] removed parents of [{}] that should be expunged: [{}].", backupParentsToBeExpunged.size(), backupVO, backupParentsToBeExpunged);
+        return new Pair<>(backupParentsToBeExpunged, lastAliveBackup);
+    }
+
+    protected MergeDiskOnlyVmSnapshotCommand buildMergeDiskOnlyVmSnapshotCommandForCurrentBackup(InternalBackupJoinVO backupJoinVO, VirtualMachine userVm, VMSnapshotVO vmSnapshot) {
+        List<DeltaMergeTreeTO> deltaMergeTreeTOs = new ArrayList<>();
+
+        List<VolumeObjectTO> volumeTOs = vmSnapshotHelper.getVolumeTOList(backupJoinVO.getVmId());
+        Map<Long, List<SnapshotDataStoreVO>> volumeIdToSnapshotDataStoreList = gatherSnapshotReferencesOfChildrenSnapshot(volumeTOs, vmSnapshot);
+        List<InternalBackupStoragePoolVO> deltasOnPrimary = internalBackupStoragePoolDao.listByBackupId(backupJoinVO.getId());
+
+        for (VolumeObjectTO volumeObjectTO : volumeTOs) {
+            KbossTO kbossTO = new KbossTO(volumeObjectTO, volumeIdToSnapshotDataStoreList.getOrDefault(volumeObjectTO.getId(), new ArrayList<>()));
+            createDeltaMergeTreeForVolume(vmSnapshot == null, userVm.getState() == VirtualMachine.State.Running, deltasOnPrimary, vmSnapshot, kbossTO);
+            if (kbossTO.getDeltaMergeTreeTO() != null) {
+                deltaMergeTreeTOs.add(kbossTO.getDeltaMergeTreeTO());
+            } else {
+                logger.debug("Volume [{}] does not have any deltas to merge as part of the backup delete process.", volumeObjectTO.getUuid());
+            }
+        }
+
+        return new MergeDiskOnlyVmSnapshotCommand(deltaMergeTreeTOs, userVm.getState().equals(VirtualMachine.State.Running), userVm.getInstanceName());
+    }
+
+    protected DataStore addBackupDeltasToDeleteCommand(long backupId, Commands deleteCommands) {
+        InternalBackupJoinVO internalBackupJoinVO = internalBackupJoinDao.findById(backupId);
+        List<InternalBackupDataStoreVO> internalBackupDataStoreVOS = internalBackupDataStoreDao.listByBackupId(backupId);
+        DataStore dataStore = dataStoreManager.getDataStore(internalBackupJoinVO.getImageStoreId(), DataStoreRole.Image);
+        DataStoreTO dataStoreTO = dataStore.getTO();
+        BackupDetailVO screenshotPath = backupDetailDao.findDetail(backupId, SCREENSHOT_PATH);
+        for (InternalBackupDataStoreVO internalBackupDataStoreVO : internalBackupDataStoreVOS) {
+            BackupDeltaTO backupDeltaTO = new BackupDeltaTO(dataStoreTO, Hypervisor.HypervisorType.KVM, internalBackupDataStoreVO.getBackupPath());
+            backupDeltaTO.setId(backupId);
+            if (screenshotPath != null) {
+                backupDeltaTO.setScreenshotPath(screenshotPath.getValue());
+                screenshotPath = null;
+            }
+            DeleteCommand deleteCommand = new DeleteCommand(backupDeltaTO);
+            deleteCommands.addCommand(deleteCommand);
+        }
+        return dataStore;
+    }
+
+    protected Set<String> getParentSecondaryStorageUrls(BackupVO backupVO) {
+        List<InternalBackupJoinVO> parentBackups = getBackupJoinParents(backupVO, true);
+        Set<Long> secondaryStorageIds = parentBackups.stream().map(InternalBackupJoinVO::getImageStoreId).collect(Collectors.toSet());
+        return secondaryStorageIds.stream().map(id -> imageStoreDao.findById(id).getUrl()).collect(Collectors.toSet());
+    }
+
+    protected List<String> getChainImageStoreUrls(List<InternalBackupJoinVO> backupChain) {
+        List<String> chainImageStoreUrls;
+        LinkedHashSet<Long> imageStoreIdSet = backupChain.stream().map(InternalBackupJoinVO::getImageStoreId).collect(Collectors.toCollection(LinkedHashSet::new));
+        chainImageStoreUrls = imageStoreIdSet.stream().map(id -> imageStoreDao.findById(id).getUrl()).collect(Collectors.toList());
+        return chainImageStoreUrls;
+    }
+
+    /**
+     * Gets the list of backup parents of a given BackupVO.
+     * @param backupVO the backup in question.
+     * @param includeRemoved whether to include removed (but not expunged) parents or not.
+     * @return list of parents, or an empty list if no parents found.
+     * */
+    protected List<InternalBackupJoinVO> getBackupJoinParents(BackupVO backupVO, boolean includeRemoved) {
+        List<InternalBackupJoinVO> ancestorBackups;
+
+        if (includeRemoved) {
+            ancestorBackups = internalBackupJoinDao.listIncludingRemovedByVmIdAndBeforeDateOrderByCreatedDesc(backupVO.getVmId(), backupVO.getDate());
+        } else {
+            ancestorBackups = internalBackupJoinDao.listByBackedUpAndVmIdAndDateBeforeOrAfterOrderBy(backupVO.getVmId(), backupVO.getDate(), true, false);
+        }
+
+        for (int i = 0; i < ancestorBackups.size(); i++) {
+            if (ancestorBackups.get(i).getEndOfChain()) {
+                return ancestorBackups.subList(0, i);
+            }
+        }
+
+        logger.debug("Found the following backup chain ancestors of backup [{}]: [{}].", backupVO, ancestorBackups);
+        return ancestorBackups;
+    }
+
+    protected int getChainSizeForBackup(BackupOfferingVO offering, long zoneId) {
+        BackupOfferingDetailsVO detailsVO = backupOfferingDetailsDao.findDetail(offering.getId(), ApiConstants.BACKUP_CHAIN_SIZE);
+        if (detailsVO != null) {
+            return Integer.parseInt(detailsVO.getValue());
+        }
+        return backupChainSize.valueIn(zoneId);
+    }
+
+    /**
+     * Gets the list of backup children of a given backupVO. In ascending created order.
+     *
+     * @return list of children, or and empty list if no children found.
+     * */
+    protected List<InternalBackupJoinVO> getBackupJoinChildren(BackupVO backupVO) {
+        List<InternalBackupJoinVO> children = internalBackupJoinDao.listByBackedUpAndVmIdAndDateBeforeOrAfterOrderBy(backupVO.getVmId(), backupVO.getDate(), false, true);
+
+        long parentId = backupVO.getId();
+        for (int i = 0; i < children.size(); i++) {
+            if (children.get(i).getParentId() != parentId) {
+                return children.subList(0, i);
+            }
+            parentId = children.get(i).getId();
+        }
+
+        return children;
+    }
+
+    /**
+     * Creates a detail for the given BackupVO if the remaining chain size is one or less and the value of backupChainSize is greater than 0.
+     * */
+    protected void setEndOfChainTrueIfRemainingChainSizeIsOneOrLess(int remainingChainSize, int chainSize, long backupId, String backupUuid) {
+        if (remainingChainSize <= 1 && chainSize > 0) {
+            logger.debug("Setting backup [{}] as end of chain.", backupUuid);
+            backupDetailDao.persist(new BackupDetailVO(backupId, END_OF_CHAIN, Boolean.TRUE.toString(), true));
+        }
+    }
+
+    protected void setBackupVirtualSize(List<VolumeObjectTO> volumeTOs, BackupVO backupVO) {
+        long virtualSize = 0;
+        for (VolumeObjectTO volumeObjectTO : volumeTOs) {
+            virtualSize += volumeObjectTO.getSize();
+        }
+
+        backupVO.setProtectedSize(virtualSize);
+    }
+
+    protected void updateBackupStatusToBackingUp(List<VolumeObjectTO> volumeTOs, BackupVO backupVO) {
+        setBackupVirtualSize(volumeTOs, backupVO);
+        backupVO.setStatus(Backup.Status.BackingUp);
+        backupDao.update(backupVO.getId(), backupVO);
+    }
+
+    /**
+     * Retrieves the current backup and removes the CURRENT detail. If the informed backup is not the end of chain, sets it as the new CURRENT
+     * */
+    protected void updateCurrentBackup(InternalBackupJoinVO backup) {
+        InternalBackupJoinVO current = internalBackupJoinDao.findCurrent(backup.getVmId());
+
+        if (current != null) {
+            backupDetailDao.removeDetail(current.getId(), CURRENT);
+        }
+
+        if (!backup.getEndOfChain()) {
+            backupDetailDao.persist(new BackupDetailVO(backup.getId(), CURRENT, Boolean.TRUE.toString(), true));
+        }
+    }
+
+    /**
+     * Given a backup, removes the CURRENT detail, and if the snapshot is not set as END_OF_CHAIN, sets it as END_OF_CHAIN.
+     * */
+    protected void setEndOfChainAndRemoveCurrentForBackup(InternalBackupJoinVO currentBackup) {
+        backupDetailDao.removeDetail(currentBackup.getId(), CURRENT);
+        if (!currentBackup.getEndOfChain()) {
+            backupDetailDao.persist(new BackupDetailVO(currentBackup.getId(), END_OF_CHAIN, Boolean.TRUE.toString(), true));
+        }
+    }
+
+    protected void setBackupUnableToValidateAndSendAlert(BackupVO backupVO, String msg) {
+        backupVO.setValidationStatus(Backup.ValidationStatus.UnableToValidate);
+        backupDao.update(backupVO.getId(), backupVO);
+        alertManager.sendAlert(AlertService.AlertType.ALERT_TYPE_BACKUP_VALIDATION_UNABLE_TO_VALIDATE, backupVO.getZoneId(), null, String.format("Unable to validate backup [%s]",
+                backupVO.getName()), msg);
+    }
+
+    protected void sendCleanupFailedEmail(BackupVO backupVO, String msg) {
+        alertManager.sendAlert(AlertService.AlertType.ALERT_TYPE_BACKUP_VALIDATION_CLEANUP_FAILED, backupVO.getZoneId(), null, String.format("Cleanup of validation of backup " +
+                        "[%s] failed",
+                backupVO.getName()), msg);
+    }
+
+    protected void setBackupAsInvalidAndSendAlert(BackupVO backupVO, String msg) {
+        backupVO.setValidationStatus(Backup.ValidationStatus.NotValid);
+        backupDao.update(backupVO.getId(), backupVO);
+        alertManager.sendAlert(AlertService.AlertType.ALERT_TYPE_BACKUP_VALIDATION_FAILED, backupVO.getZoneId(), null, String.format("Backup [%s] is not valid",
+                backupVO.getName()), msg);
+    }
+
+    protected void configureKbossTosForCleanup(UserVmVO userVmVO, List<InternalBackupStoragePoolVO> deltasOnPrimary, List<InternalBackupDataStoreVO> deltasOnSecondary, boolean runningVM,
+            List<InternalBackupStoragePoolVO> parentDeltasOnPrimary, List<KbossTO> kbossTOS) {
+        for (VolumeObjectTO volumeObjectTO : vmSnapshotHelper.getVolumeTOList(userVmVO.getId())) {
+            InternalBackupStoragePoolVO deltaOnPrimary = deltasOnPrimary.stream()
+                    .filter(delta -> delta.getVolumeId() == volumeObjectTO.getVolumeId()).findFirst().orElseThrow();
+            volumeObjectTO.setPath(deltaOnPrimary.getBackupDeltaPath());
+
+            InternalBackupDataStoreVO deltaOnSecondary =
+                    deltasOnSecondary.stream().filter(delta -> delta.getVolumeId() == volumeObjectTO.getVolumeId()).findFirst().orElseThrow();
+            KbossTO kbossTO = new KbossTO(volumeObjectTO, deltaOnPrimary.getBackupDeltaParentPath(), deltaOnSecondary.getBackupPath());
+
+            parentDeltasOnPrimary.stream()
+                    .filter(delta -> delta.getVolumeId() == volumeObjectTO.getVolumeId()).findFirst()
+                    .ifPresent(parentDelta -> kbossTO.setParentDeltaPathOnPrimary(parentDelta.getBackupDeltaParentPath()));
+            kbossTOS.add(kbossTO);
+        }
+    }
+
+    protected void configureValidationSteps(ValidateKbossVmCommand cmd, BackupVO backup) {
+        BackupOfferingVO offeringVO = backupOfferingDao.findByIdIncludingRemoved(backup.getBackupOfferingId());
+        BackupOfferingDetailsVO detailsVO = backupOfferingDetailsDao.findDetail(offeringVO.getId(), ApiConstants.VALIDATION_STEPS);
+        String validationSteps = detailsVO.getValue();
+        for (String step : validationSteps.split(",")) {
+            Backup.ValidationSteps enumStep = Backup.ValidationSteps.valueOf(step);
+            switch (enumStep) {
+                case screenshot:
+                    cmd.setTakeScreenshot(true);
+                    VMInstanceDetailVO screenshotWait = vmInstanceDetailsDao.findDetail(backup.getVmId(), VmDetailConstants.VALIDATION_SCREENSHOT_WAIT);
+                    cmd.setScreenshotWait(screenshotWait != null ? Integer.valueOf(screenshotWait.getValue()) :
+                            BackupValidationServiceJobController.backupValidationScreenshotDefaultWait.valueIn(backup.getAccountId()));
+                    break;
+                case wait_for_boot:
+                    cmd.setWaitForBoot(true);
+                    VMInstanceDetailVO bootTimeout = vmInstanceDetailsDao.findDetail(backup.getVmId(), VmDetailConstants.VALIDATION_BOOT_TIMEOUT);
+                    cmd.setBootTimeout(bootTimeout != null ? Integer.valueOf(bootTimeout.getValue()) :
+                            BackupValidationServiceJobController.backupValidationBootDefaultTimeout.valueIn(backup.getAccountId()));
+                    break;
+                case execute_command:
+                    configureValidationScript(cmd, backup);
+                    break;
+            }
+        }
+    }
+
+    protected void configureValidationScript(ValidateKbossVmCommand cmd, BackupVO backupVO) {
+        long vmId = backupVO.getVmId();
+        VMInstanceDetailVO script = vmInstanceDetailsDao.findDetail(vmId, VmDetailConstants.VALIDATION_COMMAND);
+        if (script == null) {
+            logger.warn("Execute command step was configured but no script given. Ignoring this step for backup [{}].", backupVO.getUuid());
+            return;
+        }
+        cmd.setExecuteScript(true);
+        cmd.setScriptToExecute(script.getValue());
+        VMInstanceDetailVO scriptArguments = vmInstanceDetailsDao.findDetail(vmId, VmDetailConstants.VALIDATION_COMMAND_ARGUMENTS);
+        cmd.setScriptArguments(scriptArguments != null ? scriptArguments.getValue() : null);
+        VMInstanceDetailVO scriptExpectedResult = vmInstanceDetailsDao.findDetail(vmId, VmDetailConstants.VALIDATION_COMMAND_EXPECTED_RESULT);
+        cmd.setExpectedResult(scriptExpectedResult != null ? scriptExpectedResult.getValue() : "0");
+        VMInstanceDetailVO scriptTimeout = vmInstanceDetailsDao.findDetail(vmId, VmDetailConstants.VALIDATION_COMMAND_TIMEOUT);
+        cmd.setScriptTimeout(scriptTimeout != null ? Integer.valueOf(scriptTimeout.getValue()) :
+                BackupValidationServiceJobController.backupValidationScriptDefaultTimeout.valueIn(backupVO.getAccountId()));
+    }
+
+    protected void createBasicBackupDetails(Long imageStoreId, Long parentId, BackupVO backupVO) {
+        backupDetailDao.persist(new BackupDetailVO(backupVO.getId(), IMAGE_STORE_ID, imageStoreId.toString(), false));
+        backupDetailDao.persist(new BackupDetailVO(backupVO.getId(), PARENT_ID, parentId.toString(), false));
+    }
+
+    protected void updateReferencesAfterPrepareForSnapshotRevert(List<DeltaMergeTreeTO> deltaMergeTreeTOList, List<SnapshotDataStoreVO> snapRefsSucceedingCurrentBackup,
+            List<InternalBackupStoragePoolVO> deletedDeltas, InternalBackupJoinVO backupVO) {
+        for (DeltaMergeTreeTO deltaMergeTreeTO : deltaMergeTreeTOList) {
+            SnapshotDataStoreVO snapshotRef = snapRefsSucceedingCurrentBackup.stream()
+                    .filter(ref -> Objects.equals(ref.getVolumeId(), deltaMergeTreeTO.getVolumeObjectTO().getVolumeId()))
+                    .findFirst()
+                    .orElse(null);
+            if (snapshotRef != null) {
+                snapshotRef.setInstallPath(deltaMergeTreeTO.getParent().getPath());
+                logger.debug("Updating snapshot reference [{}] path to [{}] as part of the preparation to restore a VM snapshot.", snapshotRef.getId(), snapshotRef.getInstallPath());
+                snapshotDataStoreDao.update(snapshotRef.getId(), snapshotRef);
+            }
+            internalBackupStoragePoolDao.expungeByVolumeId(deltaMergeTreeTO.getVolumeObjectTO().getVolumeId());
+        }
+
+        for (InternalBackupStoragePoolVO delta : deletedDeltas) {
+            internalBackupStoragePoolDao.expungeByVolumeId(delta.getVolumeId());
+        }
+
+        setEndOfChainAndRemoveCurrentForBackup(backupVO);
+    }
+
+    protected Answer sendBackupCommand(long hostId, Command cmd) {
+        cmd.setWait(backupTimeout.value());
+        return agentManager.easySend(hostId, cmd);
+    }
+
+    protected Answer[] sendBackupCommands(Long hostId, Commands cmds) throws OperationTimedoutException, AgentUnavailableException {
+        for (Command cmd : cmds) {
+            cmd.setWait(backupTimeout.value());
+        }
+        return agentManager.send(hostId, cmds);
+    }
+
+    protected void validateCorrectStorageType(BackupVO backupVO, VolumeVO volume, VolumeInfo volumeInfo) {
+        StoragePoolVO storagePoolVO = storagePoolDao.findById(volumeInfo.getDataStore().getId());
+        if (!supportedStoragePoolTypes.contains(storagePoolVO.getPoolType())) {
+            logger.error("Error while trying to create volume [{}]. It was created in a storage that is not supported. Make sure that the disk offerings of VMs with backup " +
+                    "offerings can only be allocated to file-based storages ({}).", backupVO, volume, supportedStoragePoolTypes);
+            throw new CloudRuntimeException(String.format("Unable to create volume [%s] due to a failure to allocate the volume. Please check the logs.", backupVO.getUuid()));
+        }
+    }
+
+    protected void validateQuickRestore(Backup backup, boolean quickRestore) {
+        BackupOfferingVO backupOfferingVO = backupOfferingDao.findByIdIncludingRemoved(backup.getBackupOfferingId());
+        BackupOfferingDetailsVO detail = backupOfferingDetailsDao.findDetail(backupOfferingVO.getId(), ApiConstants.ALLOW_QUICK_RESTORE);
+        if (quickRestore && (detail == null || !Boolean.parseBoolean(detail.getValue()))) {
+            throw new BackupProviderException(String.format("Unable to quick restore backup [%s] using offering [%s] as the offering does not support quick restoration.",
+                    backup.getUuid(), backupOfferingVO.getUuid()));
+        }
+    }
+
+    protected boolean offeringSupportsValidation(InternalBackupJoinVO backup) {
+        BackupOfferingVO backupOfferingVO = backupOfferingDao.findByIdIncludingRemoved(backup.getBackupOfferingId());
+        BackupOfferingDetailsVO detail = backupOfferingDetailsDao.findDetail(backupOfferingVO.getId(), ApiConstants.VALIDATE);
+        if (detail == null || !Boolean.parseBoolean(detail.getValue())) {
+            logger.debug("Backup [{}] will not be validated as offering [{}] does not support it.", backup, backupOfferingVO.getUuid());
+            return false;
+        }
+        return true;
+    }
+
+    protected boolean offeringSupportsCompression(InternalBackupJoinVO backup) {
+        BackupOfferingVO backupOfferingVO = backupOfferingDao.findByIdIncludingRemoved(backup.getBackupOfferingId());
+        BackupOfferingDetailsVO detail = backupOfferingDetailsDao.findDetail(backupOfferingVO.getId(), ApiConstants.COMPRESS);
+        if (detail == null || !Boolean.parseBoolean(detail.getValue())) {
+            logger.debug("Backup [{}] will not be compressed as offering [{}] does not support it.", backup, backupOfferingVO.getUuid());
+            return false;
+        }
+        return true;
+    }
+
+    protected void validateVmState(VirtualMachine vm, String operation, VirtualMachine.State... additionalStates) {
+        List<VirtualMachine.State> allowedStates = new ArrayList<>(this.allowedVmStates);
+        allowedStates.addAll(Arrays.asList(additionalStates));
+        if (!allowedStates.contains(vm.getState())) {
+            throw new BackupProviderException(String.format("VM [%s] is not in the right state to %s. It must be in one of these states: %s", vm.getUuid(), operation,
+                    allowedStates));
+        }
+    }
+
+    protected Pair<Boolean, BackupVO> validateCompressionStateForRestoreAndGetBackup(long backupId) {
+        return Transaction.execute(TransactionLegacy.CLOUD_DB, (TransactionCallback<Pair<Boolean, BackupVO>>) result -> {
+            BackupVO backupVO = null;
+            try {
+                backupVO = lockBackup(backupId);
+                if (backupVO == null) {
+                    logger.warn("Unable to get lock on backup [{}]. Cannot restore it.", backupId);
+                    return new Pair<>(false, null);
+                }
+
+                if (backupVO.getCompressionStatus() == Backup.CompressionStatus.FinalizingCompression) {
+                    logger.error("We cannot restore backups that are finalizing the compression process. Please wait for the process to end and try again later.",
+                            allowedBackupStatesToCompress, backupVO.getStatus());
+                    return new Pair<>(false, null);
+                }
+                backupVO.setStatus(Backup.Status.Restoring);
+                backupDao.update(backupId, backupVO);
+                return new Pair<>(true, backupVO);
+            } finally {
+                if (backupVO != null) {
+                    releaseBackup(backupId);
+                }
+            }
+        });
+    }
+
+    /**
+     * Validates that the backup is in a valid state. This is synchronized with the backup compression check. We get a new backup reference to make sure the compression has not
+     * changed the backup compression state.
+     * */
+    protected boolean validateBackupStateForRemoval(long backupId) {
+        return Transaction.execute(TransactionLegacy.CLOUD_DB, (TransactionCallback<Boolean>) result -> {
+            BackupVO backupVO = null;
+            try {
+                backupVO = lockBackup(backupId);
+                if (backupVO == null) {
+                    logger.warn("Unable to acquire lock for backup [{}]. Cannot remove it.", backupId);
+                    return false;
+                }
+
+                if (!allowedBackupStatesToRemove.contains(backupVO.getStatus())) {
+                    logger.error("Backup [{}] is not in a state allowed to be removed. Current state is [{}]; allowed states are [{}]", backupVO, backupVO.getStatus(),
+                            allowedBackupStatesToRemove);
+                    return false;
+                }
+
+                if (Backup.CompressionStatus.Compressing.equals(backupVO.getCompressionStatus())) {
+                    logger.error("Backup [{}] is being compressed, we cannot delete it. Please wait for the compress process to end and try again later.", backupVO.getUuid());
+                    return false;
+                }
+
+                if (Backup.ValidationStatus.Validating.equals(backupVO.getValidationStatus())) {
+                    logger.error("Backup [{}] is being validated, we cannot delete it. Please wait for the validation process to end and try again later.", backupVO.getUuid());
+                    return false;
+                }
+                return true;
+            } finally {
+                if (backupVO != null) {
+                    releaseBackup(backupId);
+                }
+            }
+        });
+    }
+
+    /**
+     * Validates that the backup is in a valid state to start the compression. This is synchronized with the backup removal check. We get a new backup reference to make sure the
+     * delete process has not changed the backup state.
+     * */
+    protected Pair<Boolean, BackupVO> validateBackupStateForStartCompressionAndUpdateCompressionStatus(long backupId) {
+        return Transaction.execute(TransactionLegacy.CLOUD_DB, (TransactionCallback<Pair<Boolean, BackupVO>>) result -> {
+            BackupVO backupVO = null;
+            try {
+                backupVO = lockBackup(backupId);
+                if (backupVO == null) {
+                    logger.warn("Unable to get lock on backup [{}]. Will abort the start of the compression process. We might try again later.", backupId);
+                    return new Pair<>(false, null);
+                }
+
+                if (!allowedBackupStatesToCompress.contains(backupVO.getStatus())) {
+                    logger.error("We can only compress backups that are on states [{}]. Current backup state is [{}].", allowedBackupStatesToCompress, backupVO.getStatus());
+                    return new Pair<>(false, null);
+                }
+
+                logger.info("Compressing backup [{}].", backupVO.getUuid());
+                backupVO.setCompressionStatus(Backup.CompressionStatus.Compressing);
+                backupDao.update(backupVO.getId(), backupVO);
+                return new Pair<>(true, backupVO);
+            } finally {
+                if (backupVO != null) {
+                    releaseBackup(backupId);
+                }
+            }
+        });
+    }
+
+    /**
+     * Validates that the backup is in a valid state to finalize the compression. This is synchronized with the backup restore check. We get a new backup reference to make sure
+     * the restore process has not changed the backup state.
+     * */
+    protected Pair<Boolean, BackupVO> validateBackupStateForFinalizeCompression(long backupId) {
+        return Transaction.execute(TransactionLegacy.CLOUD_DB, (TransactionCallback<Pair<Boolean, BackupVO>>) result -> {
+            BackupVO backupVO = null;
+            try {
+                backupVO = lockBackup(backupId);
+                if (backupVO == null) {
+                    logger.warn("Unable to get lock on backup [{}]. Will abort the finalize compression process. We might try again later.", backupId);
+                    return new Pair<>(false, null);
+                }
+
+                List<InternalBackupJoinVO> children = getBackupJoinChildren(backupVO);
+                if (Backup.Status.Restoring == backupVO.getStatus() || children.stream().anyMatch(backup -> backup.getStatus() == Backup.Status.Restoring)) {
+                    logger.warn(
+                            "Backup [{}] not in right state to finish compression. We can only finish compression process if backup is in [{}] state and no children are being " + "restored. Will try again later",
+                            backupVO, Backup.Status.BackedUp);
+                    return new Pair<>(false, null);
+                }
+
+                if (Backup.Status.BackedUp == backupVO.getStatus()) {
+                    logger.info("Backup [{}] is in the right state to finish compression. Will start the process.", backupVO.getUuid());
+                    backupVO.setCompressionStatus(Backup.CompressionStatus.FinalizingCompression);
+                    backupDao.update(backupId, backupVO);
+                } else {
+                    logger.warn("Backup [{}] is in [{}] state. Aborting compression and cleaning up compressed data. We can only finish compression process if backup is in [{}] "
+                                    + "state.", backupVO.getUuid(), backupVO.getStatus(), Backup.Status.BackedUp);
+                    backupVO.setCompressionStatus(Backup.CompressionStatus.CompressionError);
+                    backupDao.update(backupId, backupVO);
+                }
+                return new Pair<>(true, backupVO);
+            } finally {
+                if (backupVO != null) {
+                    releaseBackup(backupId);
+                }
+            }
+        });
+    }
+
+    protected Pair<Boolean, Backup.Status> validateBackupStateForRestoreBackupToVM(long backupId) {
+        return Transaction.execute(TransactionLegacy.CLOUD_DB, (TransactionCallback<Pair<Boolean, Backup.Status>>) result -> {
+            BackupVO backupVO = null;
+            try {
+                backupVO = lockBackup(backupId);
+                if (backupVO == null) {
+                    logger.warn("Unable to get lock on backup [{}]. Cannot create VM from this backup right now.", backupId);
+                    return new Pair<>(false, null);
+                }
+
+                if (Backup.Status.BackedUp == backupVO.getStatus() || Backup.Status.Restoring == backupVO.getStatus()) {
+                    logger.debug("Backup [{}] is in the right state to create VM from it. Will start the process.", backupVO.getUuid());
+                    Backup.Status oldStatus = backupVO.getStatus();
+                    backupVO.setStatus(Backup.Status.Restoring);
+                    backupDao.update(backupId, backupVO);
+                    return new Pair<>(true, oldStatus);
+                } else {
+                    logger.warn("Backup [{}] is in [{}] state. Aborting VM creation from backup. We can only create VM from backup if backup is in [{}] state.",
+                            backupVO.getUuid(), backupVO.getStatus(), List.of(Backup.Status.BackedUp, Backup.Status.Restoring));
+                    return new Pair<>(false, null);
+                }
+            } finally {
+                if (backupVO != null) {
+                    releaseBackup(backupId);
+                }
+            }
+        });
+    }
+
+    /**
+     * Validates that the backup is in a valid state to validate. This is synchronized with the backup removal check. We get a new backup reference to make sure the removal process
+     * has not changed the backup state.
+     * */
+    protected boolean validateBackupStateForValidation(long backupId) {
+        return Transaction.execute(TransactionLegacy.CLOUD_DB, (TransactionCallback<Boolean>) result -> {
+            BackupVO backupVO = null;
+            try {
+                backupVO = lockBackup(backupId);
+                if (backupVO == null) {
+                    logger.warn("Unable to acquire lock for backup [{}]. Cannot validate it. It might have been removed.", backupId);
+                    return false;
+                }
+
+                if (!allowedBackupStatesToValidate.contains(backupVO.getStatus())) {
+                    logger.error("Backup [{}] is not in a state allowed to be validated. Current state is [{}]; allowed states are [{}]", backupVO, backupVO.getStatus(),
+                            allowedBackupStatesToValidate);
+                    return false;
+                }
+                return true;
+            } finally {
+                if (backupVO != null) {
+                    releaseBackup(backupId);
+                }
+            }
+        });
+    }
+
+    protected void validateStorages(List<VolumeObjectTO> volumeTOs, String vmUuid) {
+        for (VolumeObjectTO volumeObjectTO : volumeTOs) {
+            StoragePoolVO storagePoolVO = storagePoolDao.findById(volumeObjectTO.getPoolId());
+            if (!supportedStoragePoolTypes.contains(storagePoolVO.getPoolType())) {
+                logger.error("Only able to take backups of VMs with volumes in the following storage types [{}]. Throwing an exception.", supportedStoragePoolTypes);
+                throw new BackupProviderException(String.format("Unable to take backup of VM [%s], please check the logs.", vmUuid));
+            }
+        }
+    }
+
+    protected void validateNoVmSnapshots(VirtualMachine vm) {
+        List<VMSnapshotVO> vmSnapshotVOs = vmSnapshotDao.findByVm(vm.getId());
+        if (!vmSnapshotVOs.isEmpty()) {
+            throw new BackupProviderException(String.format("Restoring VM [%s] would remove the current VM snapshots it has. Please remove the VM snapshots [%s] before" +
+                    " restoring the backup.", vm.getUuid(), vmSnapshotVOs.stream().map(VMSnapshotVO::getUuid).collect(Collectors.toList())));
+        }
+    }
+
+    protected BackupVO lockBackup(long backupId) {
+        return backupDao.acquireInLockTable(backupId, 300);
+    }
+
+    protected void releaseBackup(long backupId) {
+        backupDao.releaseFromLockTable(backupId);
+    }
+
+    protected void transitVmState(VirtualMachine vm, VirtualMachine.Event event, long hostId) {
+        try {
+            virtualMachineManager.stateTransitTo(vm, event, hostId);
+        } catch (NoTransitionException e) {
+            String msg = String.format("Failed to change VM [%s] state with event [%s].", vm.getUuid(), event.toString());
+            logger.error(msg, e);
+            throw new CloudRuntimeException(msg, e);
+        }
+    }
+
+    protected void transitVolumeState(Volume volume, Volume.Event event) {
+        try {
+            volumeApiService.stateTransitTo(volume, event);
+        } catch (NoTransitionException e) {
+            throw new CloudRuntimeException(e);
+        }
+    }
+}
diff --git a/plugins/backup/kboss/src/main/resources/META-INF/cloudstack/kboss/module.properties b/plugins/backup/kboss/src/main/resources/META-INF/cloudstack/kboss/module.properties
new file mode 100644
index 000000000000..33c86662ed69
--- /dev/null
+++ b/plugins/backup/kboss/src/main/resources/META-INF/cloudstack/kboss/module.properties
@@ -0,0 +1,18 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+name=kboss
+parent=backup
diff --git a/plugins/backup/kboss/src/main/resources/META-INF/cloudstack/kboss/spring-backup-kboss-context.xml b/plugins/backup/kboss/src/main/resources/META-INF/cloudstack/kboss/spring-backup-kboss-context.xml
new file mode 100644
index 000000000000..da6600e6a7d2
--- /dev/null
+++ b/plugins/backup/kboss/src/main/resources/META-INF/cloudstack/kboss/spring-backup-kboss-context.xml
@@ -0,0 +1,26 @@
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one
+  or more contributor license agreements. See the NOTICE file
+  distributed with this work for additional information
+  regarding copyright ownership. The ASF licenses this file
+  to you under the Apache License, Version 2.0 (the
+  "License"); you may not use this file except in compliance
+  with the License. You may obtain a copy of the License at
+  http://www.apache.org/licenses/LICENSE-2.0
+  Unless required by applicable law or agreed to in writing,
+  software distributed under the License is distributed on an
+  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  KIND, either express or implied. See the License for the
+  specific language governing permissions and limitations
+  under the License.
+-->
+<beans xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="http://www.springframework.org/schema/beans"
+       xsi:schemaLocation="http://www.springframework.org/schema/beans
+                      http://www.springframework.org/schema/beans/spring-beans-3.0.xsd"
+>
+
+    <bean id="kbossBackupProvider" class="org.apache.cloudstack.backup.KbossBackupProvider">
+        <property name="name" value="kboss"/>
+    </bean>
+</beans>
diff --git a/plugins/backup/kboss/src/test/java/org/apache/cloudstack/backup/KbossBackupProviderTest.java b/plugins/backup/kboss/src/test/java/org/apache/cloudstack/backup/KbossBackupProviderTest.java
new file mode 100644
index 000000000000..d16e0bd948fc
--- /dev/null
+++ b/plugins/backup/kboss/src/test/java/org/apache/cloudstack/backup/KbossBackupProviderTest.java
@@ -0,0 +1,3115 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.backup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyBoolean;
+import static org.mockito.ArgumentMatchers.anyList;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.ArgumentMatchers.anyMap;
+import static org.mockito.ArgumentMatchers.contains;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.command.user.vm.DestroyVMCmd;
+import org.apache.cloudstack.backup.dao.BackupDao;
+import org.apache.cloudstack.backup.dao.BackupDetailsDao;
+import org.apache.cloudstack.backup.dao.BackupOfferingDao;
+import org.apache.cloudstack.backup.dao.BackupOfferingDetailsDao;
+import org.apache.cloudstack.backup.dao.InternalBackupDataStoreDao;
+import org.apache.cloudstack.backup.dao.InternalBackupJoinDao;
+import org.apache.cloudstack.backup.dao.InternalBackupServiceJobDao;
+import org.apache.cloudstack.backup.dao.InternalBackupStoragePoolDao;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreManager;
+import org.apache.cloudstack.engine.subsystem.api.storage.EndPoint;
+import org.apache.cloudstack.engine.subsystem.api.storage.EndPointSelector;
+import org.apache.cloudstack.engine.subsystem.api.storage.VolumeDataFactory;
+import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.secstorage.heuristics.HeuristicType;
+import org.apache.cloudstack.storage.command.BackupDeleteAnswer;
+import org.apache.cloudstack.storage.datastore.db.ImageStoreDao;
+import org.apache.cloudstack.storage.datastore.db.ImageStoreVO;
+import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.SnapshotDataStoreVO;
+import org.apache.cloudstack.storage.heuristics.HeuristicRuleHelper;
+import org.apache.cloudstack.storage.to.BackupDeltaTO;
+import org.apache.cloudstack.storage.to.DeltaMergeTreeTO;
+import org.apache.cloudstack.storage.to.KbossTO;
+import org.apache.cloudstack.storage.to.VolumeObjectTO;
+import org.apache.cloudstack.storage.vmsnapshot.VMSnapshotHelper;
+import org.apache.cloudstack.storage.volume.VolumeObject;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.AgentManager;
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.Command;
+import com.cloud.agent.api.to.VirtualMachineTO;
+import com.cloud.agent.manager.Commands;
+import com.cloud.exception.AgentUnavailableException;
+import com.cloud.exception.InsufficientCapacityException;
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.exception.OperationTimedoutException;
+import com.cloud.exception.ResourceAllocationException;
+import com.cloud.exception.ResourceUnavailableException;
+import com.cloud.host.HostVO;
+import com.cloud.host.Status;
+import com.cloud.host.dao.HostDao;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.hypervisor.HypervisorGuru;
+import com.cloud.hypervisor.HypervisorGuruManager;
+import com.cloud.resource.ResourceState;
+import com.cloud.storage.DataStoreRole;
+import com.cloud.storage.Volume;
+import com.cloud.storage.VolumeApiService;
+import com.cloud.storage.VolumeApiServiceImpl;
+import com.cloud.storage.VolumeVO;
+import com.cloud.storage.dao.VolumeDao;
+import com.cloud.utils.DateUtil;
+import com.cloud.utils.Pair;
+import com.cloud.utils.exception.BackupException;
+import com.cloud.utils.exception.BackupProviderException;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.utils.fsm.NoTransitionException;
+import com.cloud.vm.UserVmManager;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VMInstanceDetailVO;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.VirtualMachineManager;
+import com.cloud.vm.VmDetailConstants;
+import com.cloud.vm.dao.UserVmDao;
+import com.cloud.vm.dao.VMInstanceDetailsDao;
+import com.cloud.vm.snapshot.VMSnapshot;
+import com.cloud.vm.snapshot.VMSnapshotDetailsVO;
+import com.cloud.vm.snapshot.VMSnapshotVO;
+import com.cloud.vm.snapshot.dao.VMSnapshotDao;
+import com.cloud.vm.snapshot.dao.VMSnapshotDetailsDao;
+
+@RunWith(MockitoJUnitRunner.class)
+public class KbossBackupProviderTest {
+
+    @Mock
+    private VirtualMachine virtualMachineMock;
+
+    @Mock
+    private BackupOfferingVO backupOfferingMock;
+
+    @Mock
+    private VolumeDao volumeDaoMock;
+
+    @Mock
+    private VolumeVO volumeVoMock;
+
+    @Mock
+    private SnapshotDataStoreDao snapshotDataStoreDaoMock;
+
+    @Mock
+    private SnapshotDataStoreVO snapshotDataStoreVoMock;
+
+    @Mock
+    private VMSnapshotDao vmSnapshotDaoMock;
+
+    @Mock
+    private VMSnapshotVO vmSnapshotVoMock;
+
+    @Mock
+    private VMSnapshotDetailsDao vmSnapshotDetailsDaoMock;
+
+    @Mock
+    private VMSnapshotDetailsVO vmSnapshotDetailsVoMock;
+
+    @Mock
+    private InternalBackupJoinDao internalBackupJoinDaoMock;
+
+    @Mock
+    private InternalBackupJoinVO internalBackupJoinVoMock;
+
+    @Mock
+    private InternalBackupDataStoreDao internalBackupDataStoreDaoMock;
+
+    @Mock
+    private InternalBackupDataStoreVO internalBackupDataStoreVoMock;
+
+    @Mock
+    private InternalBackupStoragePoolDao internalBackupStoragePoolDaoMock;
+
+    @Mock
+    private BackupVO backupVoMock;
+
+    @Mock
+    private BackupDetailsDao backupDetailDaoMock;
+
+    @Mock
+    private BackupDetailVO backupDetailVoMock;
+
+    @Mock
+    private ConfigKey<Integer> backupChainSize;
+
+    @Mock
+    private DataStoreManager dataStoreManagerMock;
+
+    @Mock
+    private DataStore dataStoreMock;
+
+    @Mock
+    private HeuristicRuleHelper heuristicRuleHelperMock;
+
+    @Mock
+    private VMSnapshotHelper vmSnapshotHelperMock;
+
+    @Mock
+    private BackupDao backupDaoMock;
+
+    @Mock
+    private VolumeObjectTO volumeObjectToMock;
+
+    @Mock
+    private VirtualMachineManager virtualMachineManagerMock;
+
+    @Mock
+    private HostDao hostDaoMock;
+
+    @Mock
+    private HostVO hostVOMock;
+
+    @Mock
+    private UserVmDao userVmDaoMock;
+
+    @Mock
+    private VMInstanceDetailsDao vmInstanceDetailsDaoMock;
+
+    @Mock
+    private VMInstanceDetailVO vmInstanceDetailVoMock;
+
+    @Mock
+    private UserVmVO userVmVOMock;
+
+    @Mock
+    private BackupOfferingDao backupOfferingDaoMock;
+
+    @Mock
+    private AgentManager agentManagerMock;
+
+    @Mock
+    private TakeKbossBackupAnswer takeKbossBackupAnswerMock;
+
+    @Mock
+    private EndPointSelector endPointSelectorMock;
+
+    @Mock
+    private EndPoint endPointMock;
+
+    @Mock
+    private Backup.VolumeInfo backupVolumeInfoMock;
+
+    @Mock
+    private VolumeInfo volumeInfoMock;
+
+    @Mock
+    private VolumeApiService volumeApiServiceMock;
+
+    @Mock
+    private VolumeDataFactory volumeDataFactoryMock;
+
+    @Mock
+    private BackupOfferingDetailsDao backupOfferingDetailsDaoMock;
+
+    @Mock
+    private BackupOfferingDetailsVO backupOfferingDetailsVoMock;
+
+    @Mock
+    private Answer answerMock;
+
+    @Mock
+    private InternalBackupServiceJobDao internalBackupServiceJobDaoMock;
+
+    @Mock
+    private UserVmManager userVmManagerMock;
+
+    @Mock
+    private HypervisorGuruManager hypervisorGuruManagerMock;
+    @Mock
+    private HypervisorGuru hypervisorGuruMock;
+    @Mock
+    private VirtualMachineTO virtualMachineToMock;
+    @Mock
+    private ImageStoreDao imageStoreDaoMock;
+
+    @Mock
+    private VolumeObject volumeObjectMock;
+
+    @Mock
+    private InternalBackupStoragePoolVO internalBackupStoragePoolVoMock;
+
+    @Mock
+    private BackupDeltaTO backupDeltaToMock;
+
+    @Mock
+    private DeltaMergeTreeTO deltaMergeTreeToMock;
+
+    @Spy
+    @InjectMocks
+    private KbossBackupProvider kbossBackupProviderSpy;
+
+    private long vmId = 319832;
+    private long volumeId = 41;
+
+    Long backupId = 312L;
+
+    @Before
+    public void setup() {
+        doReturn(vmId).when(virtualMachineMock).getId();
+        doReturn(vmId).when(backupVoMock).getVmId();
+        doReturn(vmId).when(internalBackupJoinVoMock).getVmId();
+        doReturn(vmId).when(userVmVOMock).getId();
+        doReturn(backupId).when(backupVoMock).getId();
+    }
+
+
+    @Test
+    public void assignVMToBackupOfferingTestNotKvm() {
+        doReturn(Hypervisor.HypervisorType.Any).when(virtualMachineMock).getHypervisorType();
+        boolean result = kbossBackupProviderSpy.assignVMToBackupOffering(virtualMachineMock, backupOfferingMock);
+        assertFalse(result);
+    }
+
+    @Test
+    public void assignVMToBackupOfferingTestKvmWithUnsupportedDiskOnlyVmSnapshot() {
+        doReturn(Hypervisor.HypervisorType.KVM).when(virtualMachineMock).getHypervisorType();
+        doReturn(List.of(vmSnapshotVoMock)).when(vmSnapshotDaoMock).findByVmAndByType(vmId, VMSnapshot.Type.Disk);
+        long vmSnapId = 921;
+        doReturn(vmSnapId).when(vmSnapshotVoMock).getId();
+        doReturn(List.of(vmSnapshotDetailsVoMock)).when(vmSnapshotDetailsDaoMock).listDetails(vmSnapId);
+        doReturn("Anything").when(vmSnapshotDetailsVoMock).getName();
+
+        boolean result = kbossBackupProviderSpy.assignVMToBackupOffering(virtualMachineMock, backupOfferingMock);
+        assertFalse(result);
+    }
+
+    @Test
+    public void assignVMToBackupOfferingTestKvmWithSupportedDiskOnlyVmSnapshotAndDiskAndMemoryVmSnapshot() {
+        doReturn(Hypervisor.HypervisorType.KVM).when(virtualMachineMock).getHypervisorType();
+        doReturn(List.of(vmSnapshotVoMock)).when(vmSnapshotDaoMock).findByVmAndByType(vmId, VMSnapshot.Type.Disk);
+        long vmSnapId = 921;
+        doReturn(vmSnapId).when(vmSnapshotVoMock).getId();
+        doReturn(List.of(vmSnapshotDetailsVoMock)).when(vmSnapshotDetailsDaoMock).listDetails(vmSnapId);
+        doReturn(VolumeApiServiceImpl.KVM_FILE_BASED_STORAGE_SNAPSHOT).when(vmSnapshotDetailsVoMock).getName();
+        doReturn(List.of(vmSnapshotVoMock)).when(vmSnapshotDaoMock).findByVmAndByType(vmId, VMSnapshot.Type.DiskAndMemory);
+
+        boolean result = kbossBackupProviderSpy.assignVMToBackupOffering(virtualMachineMock, backupOfferingMock);
+        assertFalse(result);
+    }
+
+
+    @Test
+    public void assignVMToBackupOfferingTestKvmWithSupportedDiskOnlyVmSnapshotAndNoDiskAndMemoryVmSnapshot() {
+        doReturn(Hypervisor.HypervisorType.KVM).when(virtualMachineMock).getHypervisorType();
+        doReturn(List.of(vmSnapshotVoMock)).when(vmSnapshotDaoMock).findByVmAndByType(vmId, VMSnapshot.Type.Disk);
+        long vmSnapId = 921;
+        doReturn(vmSnapId).when(vmSnapshotVoMock).getId();
+        doReturn(List.of(vmSnapshotDetailsVoMock)).when(vmSnapshotDetailsDaoMock).listDetails(vmSnapId);
+        doReturn(VolumeApiServiceImpl.KVM_FILE_BASED_STORAGE_SNAPSHOT).when(vmSnapshotDetailsVoMock).getName();
+
+        boolean result = kbossBackupProviderSpy.assignVMToBackupOffering(virtualMachineMock, backupOfferingMock);
+        assertTrue(result);
+    }
+
+    @Test
+    public void removeVMFromBackupOfferingTestNoActiveChain() {
+        doReturn(VirtualMachine.State.Running).when(virtualMachineMock).getState();
+
+        boolean result = kbossBackupProviderSpy.removeVMFromBackupOffering(virtualMachineMock);
+
+        verify(kbossBackupProviderSpy, Mockito.never()).mergeCurrentBackupDeltas(any());
+        assertTrue(result);
+    }
+
+    @Test
+    public void removeVMFromBackupOfferingTestWithActiveChain() {
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findCurrent(vmId);
+        doReturn(true).when(kbossBackupProviderSpy).mergeCurrentBackupDeltas(any());
+        doReturn(VirtualMachine.State.Stopped).when(virtualMachineMock).getState();
+
+        boolean result = kbossBackupProviderSpy.removeVMFromBackupOffering(virtualMachineMock);
+
+        verify(kbossBackupProviderSpy, Mockito.times(1)).mergeCurrentBackupDeltas(any());
+        assertTrue(result);
+    }
+
+    @Test
+    public void removeVMFromBackupOfferingTestFailedToEndChain() {
+        doReturn(VirtualMachine.State.Stopped).when(userVmVOMock).getState();
+        doReturn(false).when(kbossBackupProviderSpy).endBackupChain(any());
+        doReturn(userVmVOMock).when(userVmDaoMock).findById(any());
+        doNothing().when(vmInstanceDetailsDaoMock).addDetail(Mockito.anyLong(), any(), any(), Mockito.anyBoolean());
+
+        boolean result = kbossBackupProviderSpy.removeVMFromBackupOffering(userVmVOMock);
+
+        verify(vmInstanceDetailsDaoMock, Mockito.times(1)).addDetail(Mockito.anyLong(), any(), any(), Mockito.anyBoolean());
+        verify(userVmDaoMock, Mockito.times(1)).update(Mockito.anyLong(), any());
+        assertFalse(result);
+    }
+
+    @Test
+    public void getBackupJoinParentsTestIncludeRemovedEmptyList() {
+        Date date = DateUtil.now();
+        doReturn(date).when(backupVoMock).getDate();
+        doReturn(new ArrayList<>()).when(internalBackupJoinDaoMock).listIncludingRemovedByVmIdAndBeforeDateOrderByCreatedDesc(vmId, date);
+
+        List<InternalBackupJoinVO> result = kbossBackupProviderSpy.getBackupJoinParents(backupVoMock, true);
+
+        assertTrue(result.isEmpty());
+    }
+
+    @Test
+    public void getBackupJoinParentsTestIncludeRemovedAncestorIsEndOfChain() {
+        Date date = DateUtil.now();
+        doReturn(date).when(backupVoMock).getDate();
+        doReturn(true).when(internalBackupJoinVoMock).getEndOfChain();
+        doReturn(List.of(internalBackupJoinVoMock)).when(internalBackupJoinDaoMock).listIncludingRemovedByVmIdAndBeforeDateOrderByCreatedDesc(vmId, date);
+
+        List<InternalBackupJoinVO> result = kbossBackupProviderSpy.getBackupJoinParents(backupVoMock, true);
+
+        assertTrue(result.isEmpty());
+    }
+
+    @Test
+    public void getBackupJoinParentsTestIncludeRemovedAncestorMultipleAncestors() {
+        Date date = DateUtil.now();
+        doReturn(date).when(backupVoMock).getDate();
+        InternalBackupJoinVO internalBackupJoinVoMock1 = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(false).when(internalBackupJoinVoMock1).getEndOfChain();
+        InternalBackupJoinVO internalBackupJoinVoMock2 = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(false).when(internalBackupJoinVoMock2).getEndOfChain();
+        doReturn(true).when(internalBackupJoinVoMock).getEndOfChain();
+        doReturn(List.of(internalBackupJoinVoMock1, internalBackupJoinVoMock2, internalBackupJoinVoMock)).when(internalBackupJoinDaoMock).listIncludingRemovedByVmIdAndBeforeDateOrderByCreatedDesc(vmId, date);
+
+        List<InternalBackupJoinVO> result = kbossBackupProviderSpy.getBackupJoinParents(backupVoMock, true);
+
+        assertEquals(List.of(internalBackupJoinVoMock1, internalBackupJoinVoMock2), result);
+    }
+
+    @Test
+    public void getBackupJoinParentsTestIncludeRemovedAncestorMultipleAncestorsNoEndOfChain() {
+        Date date = DateUtil.now();
+        doReturn(date).when(backupVoMock).getDate();
+        InternalBackupJoinVO internalBackupJoinVoMock1 = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(false).when(internalBackupJoinVoMock1).getEndOfChain();
+        InternalBackupJoinVO internalBackupJoinVoMock2 = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(false).when(internalBackupJoinVoMock2).getEndOfChain();
+        doReturn(false).when(internalBackupJoinVoMock).getEndOfChain();
+        doReturn(List.of(internalBackupJoinVoMock1, internalBackupJoinVoMock2, internalBackupJoinVoMock)).when(internalBackupJoinDaoMock).listIncludingRemovedByVmIdAndBeforeDateOrderByCreatedDesc(vmId, date);
+
+        List<InternalBackupJoinVO> result = kbossBackupProviderSpy.getBackupJoinParents(backupVoMock, true);
+
+        assertEquals(List.of(internalBackupJoinVoMock1, internalBackupJoinVoMock2, internalBackupJoinVoMock), result);
+    }
+
+    @Test
+    public void getBackupJoinParentsTestNoRemovedAncestorMultipleAncestorsNoEndOfChain() {
+        Date date = DateUtil.now();
+        doReturn(date).when(backupVoMock).getDate();
+        InternalBackupJoinVO internalBackupJoinVoMock1 = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(false).when(internalBackupJoinVoMock1).getEndOfChain();
+        InternalBackupJoinVO internalBackupJoinVoMock2 = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(false).when(internalBackupJoinVoMock2).getEndOfChain();
+        doReturn(false).when(internalBackupJoinVoMock).getEndOfChain();
+        doReturn(List.of(internalBackupJoinVoMock1, internalBackupJoinVoMock2, internalBackupJoinVoMock)).when(internalBackupJoinDaoMock).listByBackedUpAndVmIdAndDateBeforeOrAfterOrderBy(vmId, date, true,
+                false);
+
+        List<InternalBackupJoinVO> result = kbossBackupProviderSpy.getBackupJoinParents(backupVoMock, false);
+
+        assertEquals(List.of(internalBackupJoinVoMock1, internalBackupJoinVoMock2, internalBackupJoinVoMock), result);
+    }
+
+    @Test
+    public void setEndOfChainTrueIfRemainingChainSizeIsOneTestChainSizeLowerThanOneAndConfigIsZero() {
+        int chainSize = 0;
+        kbossBackupProviderSpy.setEndOfChainTrueIfRemainingChainSizeIsOneOrLess(-1, chainSize, 1, "uuid");
+
+        verify(backupDetailDaoMock, Mockito.never()).persist(any());
+    }
+
+    @Test
+    public void setEndOfChainTrueIfRemainingChainSizeIsOneTestChainSizeLowerThanOneAndConfigBiggerThanZero() {
+        int chainSize = 1;
+        kbossBackupProviderSpy.setEndOfChainTrueIfRemainingChainSizeIsOneOrLess(-1, chainSize, 1, "uuid");
+
+        verify(backupDetailDaoMock, Mockito.times(1)).persist(any());
+    }
+
+    @Test
+    public void setEndOfChainTrueIfRemainingChainSizeIsOneTestChainSizeBiggerThanOne() {
+        kbossBackupProviderSpy.setEndOfChainTrueIfRemainingChainSizeIsOneOrLess(2, 0, 1, "uuid");
+
+        verify(backupDetailDaoMock, Mockito.never()).persist(any());
+    }
+
+    @Test
+    public void setEndOfChainTrueIfRemainingChainSizeIsOneTestChainSizeIsOne() {
+        int chainSize = 2;
+        kbossBackupProviderSpy.setEndOfChainTrueIfRemainingChainSizeIsOneOrLess(1, chainSize, 1, "uuid");
+
+        verify(backupDetailDaoMock, Mockito.times(1)).persist(any());
+    }
+
+    @Test
+    public void getParentAndSetEndOfChainTestBackupChainIsEmpty() {
+        int chainSize = 2;
+        doReturn(chainSize).when(kbossBackupProviderSpy).getChainSizeForBackup(any(), Mockito.anyLong());
+        doNothing().when(kbossBackupProviderSpy).setEndOfChainTrueIfRemainingChainSizeIsOneOrLess(Mockito.anyInt(), Mockito.anyInt(), Mockito.anyLong(), any());
+
+        InternalBackupJoinVO result = kbossBackupProviderSpy.getParentAndSetEndOfChain(backupVoMock, List.of(), null);
+
+        assertNull(result);
+        verify(kbossBackupProviderSpy, Mockito.times(1)).setEndOfChainTrueIfRemainingChainSizeIsOneOrLess(Mockito.anyInt(), Mockito.anyInt(), Mockito.anyLong(),
+                any());
+    }
+
+    @Test
+    public void getParentAndSetEndOfChainTestBackupChainIsBiggerThanChainSize() {
+        int chainSize = 2;
+        doReturn(chainSize).when(kbossBackupProviderSpy).getChainSizeForBackup(any(), Mockito.anyLong());
+        doNothing().when(kbossBackupProviderSpy).setEndOfChainTrueIfRemainingChainSizeIsOneOrLess(Mockito.anyInt(), Mockito.anyInt(), Mockito.anyLong(), any());
+
+        InternalBackupJoinVO internalBackupJoinVoMock1 = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(Backup.Status.BackedUp).when(internalBackupJoinVoMock1).getStatus();
+        InternalBackupJoinVO internalBackupJoinVoMock2 = Mockito.mock(InternalBackupJoinVO.class);
+        InternalBackupJoinVO result = kbossBackupProviderSpy.getParentAndSetEndOfChain(backupVoMock, List.of(internalBackupJoinVoMock1, internalBackupJoinVoMock2), null);
+
+        assertEquals(internalBackupJoinVoMock1, result);
+        verify(kbossBackupProviderSpy, Mockito.times(1)).setEndOfChainTrueIfRemainingChainSizeIsOneOrLess(Mockito.anyInt(), Mockito.anyInt(), Mockito.anyLong(), any());
+    }
+
+    @Test
+    public void getParentAndSetEndOfChainTestBackupChainIsSmallerThanChainSize() {
+        int chainSize = 3;
+        doReturn(chainSize).when(kbossBackupProviderSpy).getChainSizeForBackup(any(), Mockito.anyLong());
+        doNothing().when(kbossBackupProviderSpy).setEndOfChainTrueIfRemainingChainSizeIsOneOrLess(Mockito.anyInt(), Mockito.anyInt(), Mockito.anyLong(), any());
+
+        InternalBackupJoinVO internalBackupJoinVoMock1 = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(Backup.Status.BackedUp).when(internalBackupJoinVoMock1).getStatus();
+        InternalBackupJoinVO internalBackupJoinVoMock2 = Mockito.mock(InternalBackupJoinVO.class);
+        InternalBackupJoinVO result = kbossBackupProviderSpy.getParentAndSetEndOfChain(backupVoMock, List.of(internalBackupJoinVoMock1, internalBackupJoinVoMock2), null);
+
+        assertEquals(internalBackupJoinVoMock1, result);
+        verify(kbossBackupProviderSpy, Mockito.times(1)).setEndOfChainTrueIfRemainingChainSizeIsOneOrLess(Mockito.anyInt(), Mockito.anyInt(), Mockito.anyLong(), any());
+    }
+
+    @Test
+    public void getParentAndSetEndOfChainTestBackupChainIsNotEmptyParentIsRemoved() {
+        int chainSize = 2;
+        doReturn(chainSize).when(kbossBackupProviderSpy).getChainSizeForBackup(any(), Mockito.anyLong());
+        doNothing().when(kbossBackupProviderSpy).setEndOfChainTrueIfRemainingChainSizeIsOneOrLess(Mockito.anyInt(), Mockito.anyInt(), Mockito.anyLong(), any());
+
+        InternalBackupJoinVO internalBackupJoinVoMock1 = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(Backup.Status.Removed).when(internalBackupJoinVoMock1).getStatus();
+        InternalBackupJoinVO result = kbossBackupProviderSpy.getParentAndSetEndOfChain(backupVoMock, List.of(internalBackupJoinVoMock1), null);
+
+        assertNull(result);
+        verify(kbossBackupProviderSpy, Mockito.times(1)).setEndOfChainTrueIfRemainingChainSizeIsOneOrLess(Mockito.anyInt(), Mockito.anyInt(), Mockito.anyLong(), any());
+    }
+
+    @Test
+    public void getImageStoreForBackupTestNoHeuristic() {
+        long zoneId = 2;
+        doReturn(null).when(heuristicRuleHelperMock).getImageStoreIfThereIsHeuristicRule(zoneId, HeuristicType.BACKUP, backupVoMock);
+        doReturn(dataStoreMock).when(dataStoreManagerMock).getImageStoreWithFreeCapacity(zoneId);
+
+        DataStore result = kbossBackupProviderSpy.getImageStoreForBackup(zoneId, backupVoMock);
+
+        assertEquals(dataStoreMock, result);
+    }
+
+    @Test
+    public void getImageStoreForBackupTestWithHeuristic() {
+        long zoneId = 2;
+        doReturn(dataStoreMock).when(heuristicRuleHelperMock).getImageStoreIfThereIsHeuristicRule(zoneId, HeuristicType.BACKUP, backupVoMock);
+
+        DataStore result = kbossBackupProviderSpy.getImageStoreForBackup(zoneId, backupVoMock);
+
+        assertEquals(dataStoreMock, result);
+        verify(dataStoreManagerMock, Mockito.never()).getImageStoreWithFreeCapacity(Mockito.anyLong());
+    }
+
+    @Test (expected = CloudRuntimeException.class)
+    public void getImageStoreForBackupTestNoStorageFound() {
+        kbossBackupProviderSpy.getImageStoreForBackup(0L, backupVoMock);
+    }
+
+    @Test
+    public void getSucceedingVmSnapshotListTestBackupIsNull() {
+        List<VMSnapshotVO> result = kbossBackupProviderSpy.getSucceedingVmSnapshotList(null);
+
+        assertTrue(result.isEmpty());
+    }
+
+    @Test
+    public void getSucceedingVmSnapshotListTestNoCurrentSnapshotVo() {
+        doReturn(null).when(vmSnapshotDaoMock).findCurrentSnapshotByVmId(vmId);
+
+        List<VMSnapshotVO> result = kbossBackupProviderSpy.getSucceedingVmSnapshotList(internalBackupJoinVoMock);
+
+        assertTrue(result.isEmpty());
+    }
+
+    @Test
+    public void getSucceedingVmSnapshotListTestCurrentCreatedBeforeBackup() {
+        doReturn(vmSnapshotVoMock).when(vmSnapshotDaoMock).findCurrentSnapshotByVmId(vmId);
+        Date before = DateUtil.now();
+        before.setTime(before.getTime()-10000);
+        Date now = DateUtil.now();
+        doReturn(before).when(vmSnapshotVoMock).getCreated();
+        doReturn(now).when(internalBackupJoinVoMock).getDate();
+
+        List<VMSnapshotVO> result = kbossBackupProviderSpy.getSucceedingVmSnapshotList(internalBackupJoinVoMock);
+
+        assertTrue(result.isEmpty());
+    }
+
+    @Test
+    public void getSucceedingVmSnapshotListTestCurrentVmSnapshotHasNoParent() {
+        doReturn(vmSnapshotVoMock).when(vmSnapshotDaoMock).findCurrentSnapshotByVmId(vmId);
+        Date before = DateUtil.now();
+        before.setTime(before.getTime()-10000);
+        Date now = DateUtil.now();
+        doReturn(now).when(vmSnapshotVoMock).getCreated();
+        doReturn(before).when(internalBackupJoinVoMock).getDate();
+
+        List<VMSnapshotVO> result = kbossBackupProviderSpy.getSucceedingVmSnapshotList(internalBackupJoinVoMock);
+
+        assertEquals(1, result.size());
+        assertEquals(vmSnapshotVoMock, result.get(0));
+    }
+
+    @Test
+    public void getSucceedingVmSnapshotListTestCurrentVmSnapshotHasParentsCreatedAfter() {
+        doReturn(vmSnapshotVoMock).when(vmSnapshotDaoMock).findCurrentSnapshotByVmId(vmId);
+        Date before = DateUtil.now();
+        before.setTime(before.getTime()-10000);
+        Date now = DateUtil.now();
+        doReturn(now).when(vmSnapshotVoMock).getCreated();
+        doReturn(before).when(internalBackupJoinVoMock).getDate();
+        long snapParentId = 909;
+        doReturn(snapParentId).when(vmSnapshotVoMock).getParent();
+        VMSnapshotVO vmSnapshotVoMock1 = Mockito.mock(VMSnapshotVO.class);
+        doReturn(now).when(vmSnapshotVoMock1).getCreated();
+        doReturn(vmSnapshotVoMock1).when(vmSnapshotDaoMock).findById(snapParentId);
+
+        List<VMSnapshotVO> result = kbossBackupProviderSpy.getSucceedingVmSnapshotList(internalBackupJoinVoMock);
+
+        assertEquals(List.of(vmSnapshotVoMock1, vmSnapshotVoMock), result);
+    }
+
+
+    @Test
+    public void getSucceedingVmSnapshotListTestCurrentVmSnapshotHasParentsCreatedBefore() {
+        doReturn(vmSnapshotVoMock).when(vmSnapshotDaoMock).findCurrentSnapshotByVmId(vmId);
+        Date before = DateUtil.now();
+        before.setTime(before.getTime() - 10000);
+        Date now = DateUtil.now();
+        doReturn(now).when(vmSnapshotVoMock).getCreated();
+        doReturn(before).when(internalBackupJoinVoMock).getDate();
+        long snapParentId = 909;
+        doReturn(snapParentId).when(vmSnapshotVoMock).getParent();
+        VMSnapshotVO vmSnapshotVoMock1 = Mockito.mock(VMSnapshotVO.class);
+        Date evenBefore = new Date(before.getTime() - 10000);
+        doReturn(evenBefore).when(vmSnapshotVoMock1).getCreated();
+        doReturn(vmSnapshotVoMock1).when(vmSnapshotDaoMock).findById(snapParentId);
+
+        List<VMSnapshotVO> result = kbossBackupProviderSpy.getSucceedingVmSnapshotList(internalBackupJoinVoMock);
+
+        assertEquals(List.of(vmSnapshotVoMock), result);
+    }
+
+    @Test
+    public void mapVolumesToVmSnapshotReferencesTestVmSnapshotVOListIsEmpty() {
+        kbossBackupProviderSpy.mapVolumesToVmSnapshotReferences(List.of(), List.of());
+
+        verify(vmSnapshotHelperMock, Mockito.never()).getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(1);
+    }
+
+    @Test
+    public void mapVolumesToVmSnapshotReferencesTestVmSnapshotVOListHasTwoElements() {
+        VMSnapshotVO vmSnapshotVoMock1 = Mockito.mock(VMSnapshotVO.class);
+        doReturn(1L).when(vmSnapshotVoMock).getId();
+        doReturn(2L).when(vmSnapshotVoMock1).getId();
+        doNothing().when(kbossBackupProviderSpy).mapVolumesToSnapshotReferences(Mockito.anyList(), Mockito.anyList(), anyMap());
+
+        kbossBackupProviderSpy.mapVolumesToVmSnapshotReferences(List.of(), List.of(vmSnapshotVoMock, vmSnapshotVoMock1));
+
+        verify(vmSnapshotHelperMock, times(1)).getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(1);
+        verify(vmSnapshotHelperMock, times(1)).getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(2);
+        verify(kbossBackupProviderSpy, times(1)).mapVolumesToSnapshotReferences(Mockito.anyList(), Mockito.anyList(), anyMap());
+    }
+
+    @Test
+    public void createDeltaReferencesTestFullBackupEndOfChain() {
+        doReturn(internalBackupDataStoreVoMock).when(internalBackupDataStoreDaoMock).persist(any());
+
+        kbossBackupProviderSpy.createDeltaReferences(true,
+                true, true, backupVoMock, List.of(), List.of(), new HashMap<>(), new HashMap<>(), null, new KbossTO(volumeObjectToMock, List.of()));
+
+        verify(internalBackupDataStoreDaoMock, Mockito.times(1)).persist(any());
+    }
+
+    @Test
+    public void createDeltaReferencesTestIsolatedBackup() {
+        doReturn(internalBackupDataStoreVoMock).when(internalBackupDataStoreDaoMock).persist(any());
+
+        kbossBackupProviderSpy.createDeltaReferences(true,
+                true, true, backupVoMock, List.of(), List.of(), new HashMap<>(), new HashMap<>(), null, new KbossTO(volumeObjectToMock, List.of()));
+
+        verify(internalBackupDataStoreDaoMock, Mockito.times(1)).persist(any());
+        verify(kbossBackupProviderSpy, Mockito.times(0)).findAndSetParentBackupPath(any(), any(), any());
+        verify(kbossBackupProviderSpy, Mockito.times(0)).findAndSetParentBackupPath(any(), any(), any());
+        verify(internalBackupStoragePoolDaoMock, Mockito.times(1)).persist(any());
+    }
+
+    @Test
+    public void createDeltaReferencesTestNotFullBackupEndOfChain() {
+        doReturn(internalBackupDataStoreVoMock).when(internalBackupDataStoreDaoMock).persist(any());
+        KbossTO kbossTO = new KbossTO(volumeObjectToMock, List.of());
+        doReturn(null).when(kbossBackupProviderSpy).createDeltaMergeTreeForVolume(false, true, List.of(), null, kbossTO);
+        doNothing().when(kbossBackupProviderSpy).findAndSetParentBackupPath(List.of(), null, kbossTO);
+
+        kbossBackupProviderSpy.createDeltaReferences(false, true, true, backupVoMock, List.of(), List.of(), new HashMap<>(), new HashMap<>(), null, kbossTO);
+
+        verify(internalBackupDataStoreDaoMock, Mockito.times(1)).persist(any());
+        verify(kbossBackupProviderSpy, Mockito.times(1)).findAndSetParentBackupPath(List.of(), null, kbossTO);
+    }
+
+    @Test
+    public void createDeltaReferencesTestFullBackupNotEndOfChainDoesNotHaveVmSnapshotSucceedingLastBackup() {
+        doReturn(internalBackupDataStoreVoMock).when(internalBackupDataStoreDaoMock).persist(any());
+
+        kbossBackupProviderSpy.createDeltaReferences(true,
+                false, true, backupVoMock, List.of(), List.of(), new HashMap<>(), new HashMap<>(), null, new KbossTO(volumeObjectToMock, List.of()));
+
+        verify(internalBackupDataStoreDaoMock, Mockito.times(1)).persist(any());
+    }
+
+    @Test
+    public void orchestrateTakeBackupTestHostIsDownReturnFalse() {
+        Mockito.when(virtualMachineManagerMock.findById(Mockito.anyLong())).thenReturn(virtualMachineMock);
+        Mockito.when(vmSnapshotHelperMock.pickRunningHost(Mockito.anyLong())).thenReturn(1L);
+        Mockito.when(hostDaoMock.findById(Mockito.anyLong())).thenReturn(hostVOMock);
+        Mockito.when(hostVOMock.getStatus()).thenReturn(Status.Down);
+
+        Pair<Boolean, Long> result = kbossBackupProviderSpy.orchestrateTakeBackup(backupVoMock, false, false);
+        assertFalse(result.first());
+    }
+
+    @Test
+    public void orchestrateTakeBackupTestHostIsDisconnectedReturnFalse() {
+        Mockito.when(virtualMachineManagerMock.findById(Mockito.anyLong())).thenReturn(virtualMachineMock);
+        Mockito.when(vmSnapshotHelperMock.pickRunningHost(Mockito.anyLong())).thenReturn(1L);
+        Mockito.when(hostDaoMock.findById(Mockito.anyLong())).thenReturn(hostVOMock);
+        Mockito.when(hostVOMock.getStatus()).thenReturn(Status.Disconnected);
+
+        Pair<Boolean, Long> result = kbossBackupProviderSpy.orchestrateTakeBackup(backupVoMock, false, false);
+        assertFalse(result.first());
+    }
+
+    @Test (expected = BackupProviderException.class)
+    public void orchestrateTakeBackupTestInitialValidationThrowException() {
+        Mockito.when(virtualMachineManagerMock.findById(Mockito.anyLong())).thenReturn(virtualMachineMock);
+        Mockito.when(vmSnapshotHelperMock.pickRunningHost(Mockito.anyLong())).thenReturn(1L);
+        Mockito.when(hostDaoMock.findById(Mockito.anyLong())).thenReturn(hostVOMock);
+        Mockito.when(hostVOMock.getStatus()).thenReturn(Status.Up);
+        Mockito.when(hostVOMock.getResourceState()).thenReturn(ResourceState.Enabled);
+        doNothing().when(kbossBackupProviderSpy).validateVmState(any(), any());
+        Mockito.doThrow(new BackupProviderException("tst")).when(kbossBackupProviderSpy).validateStorages(any(), any());
+
+        kbossBackupProviderSpy.orchestrateTakeBackup(backupVoMock, false, false);
+        assertEquals(Backup.Status.Failed, backupVoMock.getStatus());
+        Mockito.verify(backupDaoMock, Mockito.times(1)).update(Mockito.anyLong(), any());
+    }
+
+    @Test
+    public void orchestrateTakeBackupTestIsolatedBackupFailed() {
+        Mockito.when(virtualMachineManagerMock.findById(Mockito.anyLong())).thenReturn(virtualMachineMock);
+        Mockito.when(vmSnapshotHelperMock.pickRunningHost(Mockito.anyLong())).thenReturn(1L);
+        Mockito.when(hostDaoMock.findById(Mockito.anyLong())).thenReturn(hostVOMock);
+        Mockito.when(hostVOMock.getStatus()).thenReturn(Status.Up);
+        Mockito.when(hostVOMock.getResourceState()).thenReturn(ResourceState.Enabled);
+        doNothing().when(kbossBackupProviderSpy).validateVmState(any(), any());
+
+        VolumeObjectTO vol1 = Mockito.mock(VolumeObjectTO.class);
+        VolumeObjectTO vol2 = Mockito.mock(VolumeObjectTO.class);
+        doReturn(List.of(vol1, vol2)).when(vmSnapshotHelperMock).getVolumeTOList(Mockito.anyLong());
+
+        doNothing().when(kbossBackupProviderSpy).validateStorages(any(), any());
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(any());
+        doReturn(dataStoreMock).when(kbossBackupProviderSpy).getImageStoreForBackup(any(), any());
+
+        Pair<Boolean, Long> result = kbossBackupProviderSpy.orchestrateTakeBackup(backupVoMock, false, true);
+        assertFalse(result.first());
+        assertNull(result.second());
+        verify(kbossBackupProviderSpy, Mockito.times(1)).setBackupAsIsolated(backupVoMock);
+        verify(kbossBackupProviderSpy, Mockito.times(2)).createDeltaReferences(Mockito.anyBoolean(), Mockito.anyBoolean(), Mockito.anyBoolean(), any(), any(), any(), any(), any(), any(), any());
+        verify(kbossBackupProviderSpy, Mockito.times(1)).processBackupFailure(any(), any(), Mockito.anyLong(), Mockito.anyBoolean(), any());
+    }
+
+    @Test
+    public void orchestrateTakeBackupTestIsolatedBackupSuccessWithCompression() {
+        Mockito.when(virtualMachineManagerMock.findById(Mockito.anyLong())).thenReturn(virtualMachineMock);
+        Mockito.when(vmSnapshotHelperMock.pickRunningHost(Mockito.anyLong())).thenReturn(1L);
+        Mockito.when(hostDaoMock.findById(Mockito.anyLong())).thenReturn(hostVOMock);
+        Mockito.when(hostVOMock.getStatus()).thenReturn(Status.Up);
+        Mockito.when(hostVOMock.getResourceState()).thenReturn(ResourceState.Enabled);
+        doNothing().when(kbossBackupProviderSpy).validateVmState(any(), any());
+
+        VolumeObjectTO vol1 = Mockito.mock(VolumeObjectTO.class);
+        VolumeObjectTO vol2 = Mockito.mock(VolumeObjectTO.class);
+        doReturn(List.of(vol1, vol2)).when(vmSnapshotHelperMock).getVolumeTOList(Mockito.anyLong());
+
+        doNothing().when(kbossBackupProviderSpy).validateStorages(any(), any());
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(any());
+        doReturn(dataStoreMock).when(kbossBackupProviderSpy).getImageStoreForBackup(any(), any());
+        doReturn(takeKbossBackupAnswerMock).when(kbossBackupProviderSpy).sendBackupCommand(anyLong(), any());
+        doReturn(true).when(takeKbossBackupAnswerMock).getResult();
+        doNothing().when(kbossBackupProviderSpy).processBackupSuccess(anyBoolean(), any(), any(), any(), any(), any(), any(), any(), anyBoolean(), any(),
+                anyLong(), anyBoolean(), anyBoolean());
+        doReturn(true).when(kbossBackupProviderSpy).offeringSupportsCompression(internalBackupJoinVoMock);
+        doNothing().when(kbossBackupProviderSpy).compressBackupAsync(internalBackupJoinVoMock, 0, 0);
+
+        Pair<Boolean, Long> result = kbossBackupProviderSpy.orchestrateTakeBackup(backupVoMock, false, true);
+        assertTrue(result.first());
+        assertEquals(backupId, result.second());
+        verify(kbossBackupProviderSpy, Mockito.times(1)).setBackupAsIsolated(backupVoMock);
+        verify(kbossBackupProviderSpy, Mockito.times(2)).createDeltaReferences(Mockito.anyBoolean(), Mockito.anyBoolean(), Mockito.anyBoolean(), any(), any(), any(), any(), any(), any(), any());
+        verify(kbossBackupProviderSpy, Mockito.times(1)).processBackupSuccess(anyBoolean(), any(), any(), any(), any(), any(), any(), any(), anyBoolean(), any(),
+                anyLong(), anyBoolean(), anyBoolean());
+        verify(kbossBackupProviderSpy, Mockito.times(1)).compressBackupAsync(internalBackupJoinVoMock, 0, 0);
+    }
+
+    @Test
+    public void orchestrateTakeBackupTestBackupSuccessWithValidation() {
+        Mockito.when(virtualMachineManagerMock.findById(Mockito.anyLong())).thenReturn(virtualMachineMock);
+        Mockito.when(vmSnapshotHelperMock.pickRunningHost(Mockito.anyLong())).thenReturn(1L);
+        Mockito.when(hostDaoMock.findById(Mockito.anyLong())).thenReturn(hostVOMock);
+        Mockito.when(hostVOMock.getStatus()).thenReturn(Status.Up);
+        Mockito.when(hostVOMock.getResourceState()).thenReturn(ResourceState.Enabled);
+        doNothing().when(kbossBackupProviderSpy).validateVmState(any(), any());
+
+        VolumeObjectTO vol1 = Mockito.mock(VolumeObjectTO.class);
+        VolumeObjectTO vol2 = Mockito.mock(VolumeObjectTO.class);
+        doReturn(List.of(vol1, vol2)).when(vmSnapshotHelperMock).getVolumeTOList(Mockito.anyLong());
+
+        doNothing().when(kbossBackupProviderSpy).validateStorages(any(), any());
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(any());
+        InternalBackupJoinVO parentMock = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(parentMock).when(kbossBackupProviderSpy).getParentAndSetEndOfChain(any(), any(), any());
+        doReturn(dataStoreMock).when(kbossBackupProviderSpy).getImageStoreForBackup(any(), any());
+        doReturn(takeKbossBackupAnswerMock).when(kbossBackupProviderSpy).sendBackupCommand(anyLong(), any());
+        doReturn(true).when(takeKbossBackupAnswerMock).getResult();
+        doNothing().when(kbossBackupProviderSpy).processBackupSuccess(anyBoolean(), any(), any(), any(), any(), any(), any(), any(), anyBoolean(), any(),
+                anyLong(), anyBoolean(), anyBoolean());
+        doReturn(false).when(kbossBackupProviderSpy).offeringSupportsCompression(internalBackupJoinVoMock);
+        doNothing().when(kbossBackupProviderSpy).validateBackupAsyncIfHasOfferingSupport(any(), anyLong(), anyLong());
+
+        Pair<Boolean, Long> result = kbossBackupProviderSpy.orchestrateTakeBackup(backupVoMock, false, false);
+        assertTrue(result.first());
+        assertEquals(backupId, result.second());
+        verify(internalBackupStoragePoolDaoMock).listByBackupId(0);
+        verify(internalBackupDataStoreDaoMock).listByBackupId(0);
+        verify(kbossBackupProviderSpy, Mockito.times(2)).createDeltaReferences(Mockito.anyBoolean(), Mockito.anyBoolean(), Mockito.anyBoolean(), any(), any(), any(), any(), any(), any(), any());
+        verify(kbossBackupProviderSpy, Mockito.times(1)).processBackupSuccess(anyBoolean(), any(), any(), any(), any(), any(), any(), any(), anyBoolean(), any(),
+                anyLong(), anyBoolean(), anyBoolean());
+        verify(kbossBackupProviderSpy, Mockito.times(1)).validateBackupAsyncIfHasOfferingSupport(internalBackupJoinVoMock, 0, 0);
+    }
+
+    @Test
+    public void orchestrateDeleteBackupTestBackupStateIsNotOk() {
+        doReturn(virtualMachineMock).when(virtualMachineManagerMock).findById(vmId);
+        doNothing().when(kbossBackupProviderSpy).validateVmState(any(), any(), any());
+
+        Boolean result = kbossBackupProviderSpy.orchestrateDeleteBackup(backupVoMock, false);
+
+        assertFalse(result);
+        verify(kbossBackupProviderSpy).validateVmState(any(), any(), any());
+    }
+
+    @Test
+    public void orchestrateDeleteBackupTestDeleteFailedBackup() throws OperationTimedoutException, AgentUnavailableException {
+        doReturn(virtualMachineMock).when(virtualMachineManagerMock).findById(vmId);
+        doNothing().when(kbossBackupProviderSpy).validateVmState(any(), any(), any());
+        doReturn(true).when(kbossBackupProviderSpy).validateBackupStateForRemoval(backupId);
+        doReturn(true).when(kbossBackupProviderSpy).deleteFailedBackup(backupVoMock);
+
+        Boolean result = kbossBackupProviderSpy.orchestrateDeleteBackup(backupVoMock, false);
+
+        assertTrue(result);
+        verify(kbossBackupProviderSpy).validateVmState(any(), any(), any());
+        verify(kbossBackupProviderSpy).deleteFailedBackup(backupVoMock);
+        verify(kbossBackupProviderSpy, never()).sendBackupCommands(anyLong(), any());
+    }
+
+    @Test
+    public void orchestrateDeleteBackupTestDeleteBackupWithLiveChildren() throws OperationTimedoutException, AgentUnavailableException {
+        doReturn(virtualMachineMock).when(virtualMachineManagerMock).findById(vmId);
+        doNothing().when(kbossBackupProviderSpy).validateVmState(any(), any(), any());
+        doReturn(true).when(kbossBackupProviderSpy).validateBackupStateForRemoval(backupId);
+        doReturn(false).when(kbossBackupProviderSpy).deleteFailedBackup(backupVoMock);
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findByParentId(anyLong());
+        doReturn(Backup.Status.BackedUp).when(internalBackupJoinVoMock).getStatus();
+
+        Boolean result = kbossBackupProviderSpy.orchestrateDeleteBackup(backupVoMock, false);
+
+        assertTrue(result);
+        verify(kbossBackupProviderSpy).validateVmState(any(), any(), any());
+        verify(backupVoMock).setStatus(Backup.Status.Removed);
+        verify(backupDaoMock).update(backupId, backupVoMock);
+        verify(kbossBackupProviderSpy, never()).sendBackupCommands(anyLong(), any());
+    }
+
+    @Test
+    public void orchestrateDeleteBackupTestDeleteCurrentBackupWithNoChildrenFailedToMerge() throws OperationTimedoutException, AgentUnavailableException {
+        doReturn(virtualMachineMock).when(virtualMachineManagerMock).findById(vmId);
+        doNothing().when(kbossBackupProviderSpy).validateVmState(any(), any(), any());
+        doReturn(true).when(kbossBackupProviderSpy).validateBackupStateForRemoval(backupId);
+        doReturn(false).when(kbossBackupProviderSpy).deleteFailedBackup(backupVoMock);
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(backupId);
+        doReturn(true).when(internalBackupJoinVoMock).getCurrent();
+        doReturn(false).when(kbossBackupProviderSpy).mergeCurrentBackupDeltas(internalBackupJoinVoMock);
+
+        Boolean result = kbossBackupProviderSpy.orchestrateDeleteBackup(backupVoMock, false);
+
+        assertFalse(result);
+        verify(kbossBackupProviderSpy).validateVmState(any(), any(), any());
+        verify(kbossBackupProviderSpy, never()).sendBackupCommands(anyLong(), any());
+        verify(kbossBackupProviderSpy).mergeCurrentBackupDeltas(any());
+    }
+
+    @Test (expected = CloudRuntimeException.class)
+    public void orchestrateDeleteBackupTestDeleteCurrentBackupWithNoChildrenWithParentNoEndPoint() throws OperationTimedoutException, AgentUnavailableException {
+        long parentBackupId = 12;
+        doReturn(parentBackupId).when(internalBackupJoinVoMock).getParentId();
+        doReturn(virtualMachineMock).when(virtualMachineManagerMock).findById(vmId);
+        doNothing().when(kbossBackupProviderSpy).validateVmState(any(), any(), any());
+        doReturn(true).when(kbossBackupProviderSpy).validateBackupStateForRemoval(backupId);
+        doReturn(false).when(kbossBackupProviderSpy).deleteFailedBackup(backupVoMock);
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(backupId);
+        doReturn(true).when(internalBackupJoinVoMock).getCurrent();
+        doReturn(true).when(kbossBackupProviderSpy).mergeCurrentBackupDeltas(internalBackupJoinVoMock);
+        InternalBackupJoinVO parentVo = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(parentVo).when(internalBackupJoinDaoMock).findById(parentBackupId);
+        doReturn(Backup.Status.BackedUp).when(parentVo).getStatus();
+        doReturn(null).when(kbossBackupProviderSpy).addBackupDeltasToDeleteCommand(anyLong(), any());
+        doReturn(null).when(kbossBackupProviderSpy).getParentsToBeExpungedWithBackupAndAddThemToListOfDeleteCommands(any(), any());
+        doReturn(null).when(endPointSelectorMock).select((DataStore)null);
+
+        Boolean result = kbossBackupProviderSpy.orchestrateDeleteBackup(backupVoMock, false);
+
+        assertFalse(result);
+        verify(kbossBackupProviderSpy).validateVmState(any(), any(), any());
+        verify(backupDetailDaoMock).persist(any());
+        verify(kbossBackupProviderSpy, never()).sendBackupCommands(anyLong(), any());
+    }
+
+    @Test (expected = CloudRuntimeException.class)
+    public void orchestrateDeleteBackupTestDeleteCurrentBackupWithNoChildrenWithParentTimedoutException() throws OperationTimedoutException, AgentUnavailableException {
+        long parentBackupId = 12;
+        doReturn(parentBackupId).when(internalBackupJoinVoMock).getParentId();
+        doReturn(virtualMachineMock).when(virtualMachineManagerMock).findById(vmId);
+        doNothing().when(kbossBackupProviderSpy).validateVmState(any(), any(), any());
+        doReturn(true).when(kbossBackupProviderSpy).validateBackupStateForRemoval(backupId);
+        doReturn(false).when(kbossBackupProviderSpy).deleteFailedBackup(backupVoMock);
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(backupId);
+        doReturn(true).when(internalBackupJoinVoMock).getCurrent();
+        doReturn(true).when(kbossBackupProviderSpy).mergeCurrentBackupDeltas(internalBackupJoinVoMock);
+        InternalBackupJoinVO parentVo = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(parentVo).when(internalBackupJoinDaoMock).findById(parentBackupId);
+        doReturn(Backup.Status.BackedUp).when(parentVo).getStatus();
+        doReturn(null).when(kbossBackupProviderSpy).addBackupDeltasToDeleteCommand(anyLong(), any());
+        doReturn(null).when(kbossBackupProviderSpy).getParentsToBeExpungedWithBackupAndAddThemToListOfDeleteCommands(any(), any());
+        doReturn(endPointMock).when(endPointSelectorMock).select((DataStore)null);
+        doThrow(OperationTimedoutException.class).when(kbossBackupProviderSpy).sendBackupCommands(anyLong(), any());
+
+        Boolean result = kbossBackupProviderSpy.orchestrateDeleteBackup(backupVoMock, false);
+
+        assertFalse(result);
+        verify(kbossBackupProviderSpy).validateVmState(any(), any(), any());
+        verify(backupDetailDaoMock).persist(any());
+        verify(kbossBackupProviderSpy, Mockito.times(1)).sendBackupCommands(anyLong(), any());
+    }
+
+    @Test
+    public void orchestrateDeleteBackupTestDeleteCurrentBackupWithNoChildrenWithParentFailedSetNotEmpty() throws OperationTimedoutException, AgentUnavailableException {
+        long parentBackupId = 12;
+        doReturn(parentBackupId).when(internalBackupJoinVoMock).getParentId();
+        doReturn(virtualMachineMock).when(virtualMachineManagerMock).findById(vmId);
+        doNothing().when(kbossBackupProviderSpy).validateVmState(any(), any(), any());
+        doReturn(true).when(kbossBackupProviderSpy).validateBackupStateForRemoval(backupId);
+        doReturn(false).when(kbossBackupProviderSpy).deleteFailedBackup(backupVoMock);
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(backupId);
+        doReturn(true).when(internalBackupJoinVoMock).getCurrent();
+        doReturn(true).when(kbossBackupProviderSpy).mergeCurrentBackupDeltas(internalBackupJoinVoMock);
+        InternalBackupJoinVO parentVo = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(parentVo).when(internalBackupJoinDaoMock).findById(parentBackupId);
+        doReturn(Backup.Status.BackedUp).when(parentVo).getStatus();
+        doReturn(null).when(kbossBackupProviderSpy).addBackupDeltasToDeleteCommand(anyLong(), any());
+        doReturn(new Pair<>(List.of(), parentVo)).when(kbossBackupProviderSpy).getParentsToBeExpungedWithBackupAndAddThemToListOfDeleteCommands(any(), any());
+        doReturn(endPointMock).when(endPointSelectorMock).select((DataStore)null);
+        doReturn(null).when(kbossBackupProviderSpy).sendBackupCommands(anyLong(), any());
+        doReturn(false).when(kbossBackupProviderSpy).processRemoveBackupFailures(anyBoolean(), any(), any(), any());
+        doNothing().when(kbossBackupProviderSpy).processRemovedBackups(any());
+
+
+        Boolean result = kbossBackupProviderSpy.orchestrateDeleteBackup(backupVoMock, false);
+
+        assertFalse(result);
+        verify(kbossBackupProviderSpy).validateVmState(any(), any(), any());
+        verify(backupDetailDaoMock, Mockito.times(2)).persist(any());
+        verify(kbossBackupProviderSpy, Mockito.times(1)).sendBackupCommands(anyLong(), any());
+    }
+
+    @Test
+    public void orchestrateDeleteBackupTestDeleteCurrentBackupWithNoChildrenWithParentFailedSetEmpty() throws OperationTimedoutException, AgentUnavailableException {
+        long parentBackupId = 12;
+        doReturn(parentBackupId).when(internalBackupJoinVoMock).getParentId();
+        doReturn(virtualMachineMock).when(virtualMachineManagerMock).findById(vmId);
+        doNothing().when(kbossBackupProviderSpy).validateVmState(any(), any(), any());
+        doReturn(true).when(kbossBackupProviderSpy).validateBackupStateForRemoval(backupId);
+        doReturn(false).when(kbossBackupProviderSpy).deleteFailedBackup(backupVoMock);
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(backupId);
+        doReturn(true).when(internalBackupJoinVoMock).getCurrent();
+        doReturn(true).when(kbossBackupProviderSpy).mergeCurrentBackupDeltas(internalBackupJoinVoMock);
+        InternalBackupJoinVO parentVo = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(parentVo).when(internalBackupJoinDaoMock).findById(parentBackupId);
+        doReturn(Backup.Status.BackedUp).when(parentVo).getStatus();
+        doReturn(null).when(kbossBackupProviderSpy).addBackupDeltasToDeleteCommand(anyLong(), any());
+        doReturn(new Pair<>(List.of(), parentVo)).when(kbossBackupProviderSpy).getParentsToBeExpungedWithBackupAndAddThemToListOfDeleteCommands(any(), any());
+        doReturn(endPointMock).when(endPointSelectorMock).select((DataStore)null);
+        doReturn(null).when(kbossBackupProviderSpy).sendBackupCommands(anyLong(), any());
+        doReturn(true).when(kbossBackupProviderSpy).processRemoveBackupFailures(anyBoolean(), any(), any(), any());
+        doNothing().when(kbossBackupProviderSpy).processRemovedBackups(any());
+
+
+        Boolean result = kbossBackupProviderSpy.orchestrateDeleteBackup(backupVoMock, false);
+
+        assertTrue(result);
+        verify(kbossBackupProviderSpy).validateVmState(any(), any(), any());
+        verify(backupDetailDaoMock, Mockito.times(2)).persist(any());
+        verify(kbossBackupProviderSpy, Mockito.times(1)).sendBackupCommands(anyLong(), any());
+    }
+
+    @Test
+    public void orchestrateRestoreVMFromBackupTestInvalidState() {
+        doNothing().when(kbossBackupProviderSpy).validateNoVmSnapshots(virtualMachineMock);
+        doNothing().when(kbossBackupProviderSpy).validateQuickRestore(backupVoMock, false);
+        doReturn(new Pair<>(false, backupVoMock)).when(kbossBackupProviderSpy).validateCompressionStateForRestoreAndGetBackup(backupId);
+
+        boolean result = kbossBackupProviderSpy.orchestrateRestoreVMFromBackup(backupVoMock, virtualMachineMock, false, null, false);
+
+        assertFalse(result);
+    }
+
+    @Test (expected = CloudRuntimeException.class)
+    public void orchestrateRestoreVMFromBackupTestCurrentBackupNoHostToRestore() throws AgentUnavailableException { // fixxxxxxx
+        doNothing().when(kbossBackupProviderSpy).validateNoVmSnapshots(virtualMachineMock);
+        doNothing().when(kbossBackupProviderSpy).validateQuickRestore(backupVoMock, false);
+        doReturn(new Pair<>(true, backupVoMock)).when(kbossBackupProviderSpy).validateCompressionStateForRestoreAndGetBackup(backupId);
+        long currentBackupId = 39;
+        doThrow(AgentUnavailableException.class).when(kbossBackupProviderSpy).getHostToRestore(virtualMachineMock, false, null);
+
+        kbossBackupProviderSpy.orchestrateRestoreVMFromBackup(backupVoMock, virtualMachineMock, false, null, false);
+
+        verify(internalBackupStoragePoolDaoMock).listByBackupId(currentBackupId);
+    }
+
+    @Test (expected = CloudRuntimeException.class)
+    public void orchestrateRestoreVMFromBackupTestSameVmCurrentBackupTimeOut() throws AgentUnavailableException, OperationTimedoutException {
+        doNothing().when(kbossBackupProviderSpy).validateNoVmSnapshots(virtualMachineMock);
+        doNothing().when(kbossBackupProviderSpy).validateQuickRestore(backupVoMock, false);
+        doReturn(new Pair<>(true, backupVoMock)).when(kbossBackupProviderSpy).validateCompressionStateForRestoreAndGetBackup(backupId);
+        long currentBackupId = 39;
+        InternalBackupJoinVO currentBackup = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(currentBackupId).when(currentBackup).getId();
+        doReturn(currentBackup).when(internalBackupJoinDaoMock).findCurrent(vmId);
+        doReturn(hostVOMock).when(kbossBackupProviderSpy).getHostToRestore(virtualMachineMock, false, null);
+        doNothing().when(kbossBackupProviderSpy).createAndAttachVolumes(any(), any(), any(), any());
+        doReturn(Set.of()).when(kbossBackupProviderSpy).generateBackupAndVolumePairsToRestore(any(), any(), any(), anyBoolean());
+        doReturn(List.of()).when(kbossBackupProviderSpy).getVolumesThatAreNotPartOfTheBackup(any(), any());
+        doReturn(List.of()).when(kbossBackupProviderSpy).populateDeltasToRemoveAndToMergeAndUpdateVolumePaths(any(), any(), any(), any(), any());
+        doReturn(VirtualMachine.State.Stopped).when(virtualMachineMock).getState();
+        doThrow(OperationTimedoutException.class).when(kbossBackupProviderSpy).sendBackupCommands(anyLong(), any());
+
+        boolean result = kbossBackupProviderSpy.orchestrateRestoreVMFromBackup(backupVoMock, virtualMachineMock, false, null, true);
+
+        verify(internalBackupStoragePoolDaoMock).listByBackupId(currentBackupId);
+        verify(kbossBackupProviderSpy).createAndAttachVolumes(any(), any(), any(), any());
+        verify(kbossBackupProviderSpy).populateDeltasToRemoveAndToMergeAndUpdateVolumePaths(any(), any(), any(), any(), any());
+    }
+
+    @Test
+    public void orchestrateRestoreVMFromBackupTestSameVmCurrentBackupNullAnswers() throws AgentUnavailableException, OperationTimedoutException {
+        doNothing().when(kbossBackupProviderSpy).validateNoVmSnapshots(virtualMachineMock);
+        doNothing().when(kbossBackupProviderSpy).validateQuickRestore(backupVoMock, false);
+        doReturn(new Pair<>(true, backupVoMock)).when(kbossBackupProviderSpy).validateCompressionStateForRestoreAndGetBackup(backupId);
+        long currentBackupId = 39;
+        InternalBackupJoinVO currentBackup = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(currentBackupId).when(currentBackup).getId();
+        doReturn(currentBackup).when(internalBackupJoinDaoMock).findCurrent(vmId);
+        doReturn(hostVOMock).when(kbossBackupProviderSpy).getHostToRestore(virtualMachineMock, false, null);
+        doNothing().when(kbossBackupProviderSpy).createAndAttachVolumes(any(), any(), any(), any());
+        doReturn(Set.of()).when(kbossBackupProviderSpy).generateBackupAndVolumePairsToRestore(any(), any(), any(), anyBoolean());
+        doReturn(List.of()).when(kbossBackupProviderSpy).getVolumesThatAreNotPartOfTheBackup(any(), any());
+        doReturn(List.of()).when(kbossBackupProviderSpy).populateDeltasToRemoveAndToMergeAndUpdateVolumePaths(any(), any(), any(), any(), any());
+        doReturn(VirtualMachine.State.Stopped).when(virtualMachineMock).getState();
+        doReturn(null).when(kbossBackupProviderSpy).sendBackupCommands(anyLong(), any());
+
+        boolean result = kbossBackupProviderSpy.orchestrateRestoreVMFromBackup(backupVoMock, virtualMachineMock, false, null, true);
+
+        verify(internalBackupStoragePoolDaoMock).listByBackupId(currentBackupId);
+        verify(kbossBackupProviderSpy).createAndAttachVolumes(any(), any(), any(), any());
+        verify(kbossBackupProviderSpy).populateDeltasToRemoveAndToMergeAndUpdateVolumePaths(any(), any(), any(), any(), any());
+        assertFalse(result);
+    }
+
+    @Test
+    public void orchestrateRestoreVMFromBackupTestSameVmCurrentBackupAnswerFalse() throws AgentUnavailableException, OperationTimedoutException {
+        doNothing().when(kbossBackupProviderSpy).validateNoVmSnapshots(virtualMachineMock);
+        doNothing().when(kbossBackupProviderSpy).validateQuickRestore(backupVoMock, false);
+        doReturn(new Pair<>(true, backupVoMock)).when(kbossBackupProviderSpy).validateCompressionStateForRestoreAndGetBackup(backupId);
+        long currentBackupId = 39;
+        InternalBackupJoinVO currentBackup = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(currentBackupId).when(currentBackup).getId();
+        doReturn(currentBackup).when(internalBackupJoinDaoMock).findCurrent(vmId);
+        doReturn(hostVOMock).when(kbossBackupProviderSpy).getHostToRestore(virtualMachineMock, false, null);
+        doNothing().when(kbossBackupProviderSpy).createAndAttachVolumes(any(), any(), any(), any());
+        doReturn(Set.of()).when(kbossBackupProviderSpy).generateBackupAndVolumePairsToRestore(any(), any(), any(), anyBoolean());
+        doReturn(List.of()).when(kbossBackupProviderSpy).getVolumesThatAreNotPartOfTheBackup(any(), any());
+        doReturn(List.of()).when(kbossBackupProviderSpy).populateDeltasToRemoveAndToMergeAndUpdateVolumePaths(any(), any(), any(), any(), any());
+        doReturn(VirtualMachine.State.Stopped).when(virtualMachineMock).getState();
+        doReturn(new Answer[]{Mockito.mock(Answer.class)}).when(kbossBackupProviderSpy).sendBackupCommands(anyLong(), any());
+        doReturn(false).when(kbossBackupProviderSpy).processRestoreAnswers(any(), any(), anyBoolean());
+
+        boolean result = kbossBackupProviderSpy.orchestrateRestoreVMFromBackup(backupVoMock, virtualMachineMock, false, null, true);
+
+        verify(internalBackupStoragePoolDaoMock).listByBackupId(currentBackupId);
+        verify(kbossBackupProviderSpy).createAndAttachVolumes(any(), any(), any(), any());
+        verify(kbossBackupProviderSpy).populateDeltasToRemoveAndToMergeAndUpdateVolumePaths(any(), any(), any(), any(), any());
+        assertFalse(result);
+    }
+
+    @Test
+    public void orchestrateRestoreVMFromBackupTestSameVmQuickRestoreCurrentBackupAnswerTrue() throws AgentUnavailableException, OperationTimedoutException {
+        doNothing().when(kbossBackupProviderSpy).validateNoVmSnapshots(virtualMachineMock);
+        doNothing().when(kbossBackupProviderSpy).validateQuickRestore(backupVoMock, true);
+        doReturn(new Pair<>(true, backupVoMock)).when(kbossBackupProviderSpy).validateCompressionStateForRestoreAndGetBackup(backupId);
+        long currentBackupId = 39;
+        InternalBackupJoinVO currentBackup = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(currentBackupId).when(currentBackup).getId();
+        doReturn(currentBackup).when(internalBackupJoinDaoMock).findCurrent(vmId);
+        doReturn(hostVOMock).when(kbossBackupProviderSpy).getHostToRestore(virtualMachineMock, true, null);
+        doNothing().when(kbossBackupProviderSpy).createAndAttachVolumes(any(), any(), any(), any());
+        doReturn(Set.of()).when(kbossBackupProviderSpy).generateBackupAndVolumePairsToRestore(any(), any(), any(), anyBoolean());
+        doReturn(List.of()).when(kbossBackupProviderSpy).getVolumesThatAreNotPartOfTheBackup(any(), any());
+        doReturn(List.of()).when(kbossBackupProviderSpy).populateDeltasToRemoveAndToMergeAndUpdateVolumePaths(any(), any(), any(), any(), any());
+        doReturn(VirtualMachine.State.Stopped).when(virtualMachineMock).getState();
+        doReturn(new Answer[]{Mockito.mock(Answer.class)}).when(kbossBackupProviderSpy).sendBackupCommands(anyLong(), any());
+        doReturn(true).when(kbossBackupProviderSpy).processRestoreAnswers(any(), any(), anyBoolean());
+        doNothing().when(kbossBackupProviderSpy).setEndOfChainAndRemoveCurrentForBackup(currentBackup);
+        doReturn(List.of()).when(kbossBackupProviderSpy).getVolumesToConsolidate(any(), any(), any(), anyLong(), anyBoolean());
+        doReturn(true).when(kbossBackupProviderSpy).finalizeQuickRestore(any(), anyList(), anyLong());
+
+        boolean result = kbossBackupProviderSpy.orchestrateRestoreVMFromBackup(backupVoMock, virtualMachineMock, true, null, true);
+
+        verify(internalBackupStoragePoolDaoMock).listByBackupId(currentBackupId);
+        verify(kbossBackupProviderSpy).createAndAttachVolumes(any(), any(), any(), any());
+        verify(kbossBackupProviderSpy).populateDeltasToRemoveAndToMergeAndUpdateVolumePaths(any(), any(), any(), any(), any());
+        verify(kbossBackupProviderSpy).updateVolumePathsAndSizeIfNeeded(any(), any(), anyList(), anyList(), anyBoolean());
+        verify(internalBackupStoragePoolDaoMock).expungeByBackupId(currentBackupId);
+        verify(kbossBackupProviderSpy).setEndOfChainAndRemoveCurrentForBackup(currentBackup);
+        verify(kbossBackupProviderSpy).finalizeQuickRestore(any(), anyList(), anyLong());
+        assertTrue(result);
+    }
+
+    @Test
+    public void orchestrateRestoreBackedUpVolumeTestInvalidState() {
+        doReturn(new Pair<>(false, null)).when(kbossBackupProviderSpy).validateCompressionStateForRestoreAndGetBackup(backupId);
+
+        Pair<Boolean, String> result = kbossBackupProviderSpy.orchestrateRestoreBackedUpVolume(backupVoMock, virtualMachineMock, null, null, false);
+
+        assertFalse(result.first());
+        verify(kbossBackupProviderSpy, Mockito.never()).sendBackupCommand(anyLong(), any());
+    }
+
+    @Test (expected = CloudRuntimeException.class)
+    public void orchestrateRestoreBackedUpVolumeTestAnswerFalse() {
+        doReturn(new Pair<>(true, null)).when(kbossBackupProviderSpy).validateCompressionStateForRestoreAndGetBackup(backupId);
+        doReturn(volumeVoMock).when(volumeDaoMock).findByUuidIncludingRemoved(any());
+        doReturn(hostVOMock).when(hostDaoMock).findByIp(any());
+        doReturn(volumeInfoMock).when(kbossBackupProviderSpy).duplicateAndCreateVolume(virtualMachineMock, hostVOMock, backupVolumeInfoMock);
+        doReturn(volumeObjectToMock).when(volumeInfoMock).getTO();
+        doReturn(new Pair<BackupDeltaTO, VolumeObjectTO>(null, null)).when(kbossBackupProviderSpy).generateBackupAndVolumePairForSingleNewVolume(any(), any(), any());
+        doReturn(Set.of()).when(kbossBackupProviderSpy).getParentSecondaryStorageUrls(backupVoMock);
+        doReturn(false).when(kbossBackupProviderSpy).processRestoreAnswers(any(), any(), anyBoolean());
+
+        Pair<Boolean, String> result = kbossBackupProviderSpy.orchestrateRestoreBackedUpVolume(backupVoMock, virtualMachineMock, backupVolumeInfoMock, null, false);
+
+        verify(kbossBackupProviderSpy, Mockito.times(1)).sendBackupCommand(anyLong(), any());
+    }
+
+    @Test
+    public void orchestrateRestoreBackedUpVolumeTestQuickRestoreAnswerTrue() {
+        doReturn(new Pair<>(true, null)).when(kbossBackupProviderSpy).validateCompressionStateForRestoreAndGetBackup(backupId);
+        doReturn(volumeVoMock).when(volumeDaoMock).findByUuidIncludingRemoved(any());
+        doReturn(hostVOMock).when(hostDaoMock).findByIp(any());
+        doReturn(volumeInfoMock).when(kbossBackupProviderSpy).duplicateAndCreateVolume(virtualMachineMock, hostVOMock, backupVolumeInfoMock);
+        doReturn(volumeObjectToMock).when(volumeInfoMock).getTO();
+        doReturn(new Pair<BackupDeltaTO, VolumeObjectTO>(null, null)).when(kbossBackupProviderSpy).generateBackupAndVolumePairForSingleNewVolume(any(), any(), any());
+        doReturn(Set.of()).when(kbossBackupProviderSpy).getParentSecondaryStorageUrls(backupVoMock);
+        doReturn(true).when(kbossBackupProviderSpy).processRestoreAnswers(any(), any(), anyBoolean());
+        doReturn(volumeVoMock).when(volumeInfoMock).getVolume();
+        doReturn(volumeVoMock).when(volumeApiServiceMock).attachVolumeToVM(anyLong(), anyLong(), any(), anyBoolean(), anyBoolean());
+        doReturn(true).when(kbossBackupProviderSpy).finalizeQuickRestore(any(), anyList(), anyLong());
+
+        Pair<Boolean, String> result = kbossBackupProviderSpy.orchestrateRestoreBackedUpVolume(backupVoMock, virtualMachineMock, backupVolumeInfoMock, null, true);
+
+        assertTrue(result.first());
+
+        verify(kbossBackupProviderSpy, Mockito.times(1)).sendBackupCommand(anyLong(), any());
+        verify(volumeApiServiceMock).attachVolumeToVM(anyLong(), anyLong(), any(), anyBoolean(), anyBoolean());
+        verify(kbossBackupProviderSpy).finalizeQuickRestore(any(), anyList(), anyLong());
+    }
+
+    @Test
+    public void startBackupCompressionTestInvalidState() {
+        doReturn(new Pair<>(false, null)).when(kbossBackupProviderSpy).validateBackupStateForStartCompressionAndUpdateCompressionStatus(backupId);
+
+        boolean result = kbossBackupProviderSpy.startBackupCompression(backupId, 0);
+
+        assertFalse(result);
+    }
+
+    @Test
+    public void startBackupCompressionTestNullAnswer() {
+        doReturn(new Pair<>(true, backupVoMock)).when(kbossBackupProviderSpy).validateBackupStateForStartCompressionAndUpdateCompressionStatus(backupId);
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(backupId);
+        long parentId = 1332;
+        doReturn(parentId).when(internalBackupJoinVoMock).getParentId();
+        InternalBackupJoinVO parentVo = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(parentVo).when(internalBackupJoinDaoMock).findById(parentId);
+        doReturn(List.of(internalBackupDataStoreVoMock)).when(internalBackupDataStoreDaoMock).listByBackupId(backupId);
+        InternalBackupDataStoreVO parentDelta = mock(InternalBackupDataStoreVO.class);
+        doReturn(List.of(parentDelta)).when(internalBackupDataStoreDaoMock).listByBackupId(parentId);
+        doReturn(dataStoreMock).when(dataStoreManagerMock).getDataStore(anyLong(), any());
+        doReturn(hostVOMock).when(hostDaoMock).findById(anyLong());
+        doReturn(backupOfferingMock).when(backupOfferingDaoMock).findByIdIncludingRemoved(anyLong());
+        doReturn(backupOfferingDetailsVoMock).when(backupOfferingDetailsDaoMock).findDetail(anyLong(), any());
+        doReturn("zstd").when(backupOfferingDetailsVoMock).getValue();
+        doReturn(List.of(parentVo)).when(kbossBackupProviderSpy).getBackupJoinParents(backupVoMock, true);
+        doReturn(null).when(kbossBackupProviderSpy).getChainImageStoreUrls(any());
+        doReturn(null).when(agentManagerMock).easySend(anyLong(), any());
+
+        boolean result = kbossBackupProviderSpy.startBackupCompression(backupId, 0);
+
+        assertFalse(result);
+        verify(backupVoMock).setCompressionStatus(Backup.CompressionStatus.CompressionError);
+        verify(backupDaoMock).update(backupId, backupVoMock);
+    }
+
+    @Test
+    public void startBackupCompressionTestSuccess() {
+        doReturn(new Pair<>(true, backupVoMock)).when(kbossBackupProviderSpy).validateBackupStateForStartCompressionAndUpdateCompressionStatus(backupId);
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(backupId);
+        long parentId = 1332;
+        doReturn(parentId).when(internalBackupJoinVoMock).getParentId();
+        InternalBackupJoinVO parentVo = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(parentVo).when(internalBackupJoinDaoMock).findById(parentId);
+        doReturn(List.of(internalBackupDataStoreVoMock)).when(internalBackupDataStoreDaoMock).listByBackupId(backupId);
+        InternalBackupDataStoreVO parentDelta = mock(InternalBackupDataStoreVO.class);
+        doReturn(List.of(parentDelta)).when(internalBackupDataStoreDaoMock).listByBackupId(parentId);
+        doReturn(dataStoreMock).when(dataStoreManagerMock).getDataStore(anyLong(), any());
+        doReturn(hostVOMock).when(hostDaoMock).findById(anyLong());
+        doReturn(backupOfferingMock).when(backupOfferingDaoMock).findByIdIncludingRemoved(anyLong());
+        doReturn(backupOfferingDetailsVoMock).when(backupOfferingDetailsDaoMock).findDetail(anyLong(), any());
+        doReturn("zstd").when(backupOfferingDetailsVoMock).getValue();
+        doReturn(List.of(parentVo)).when(kbossBackupProviderSpy).getBackupJoinParents(backupVoMock, true);
+        doReturn(null).when(kbossBackupProviderSpy).getChainImageStoreUrls(any());
+        doReturn(answerMock).when(agentManagerMock).easySend(anyLong(), any());
+        doReturn(true).when(answerMock).getResult();
+
+        boolean result = kbossBackupProviderSpy.startBackupCompression(backupId, 0);
+
+        assertTrue(result);
+        verify(internalBackupServiceJobDaoMock).persist(any());
+    }
+
+    @Test
+    public void finalizeBackupCompressionTestInvalidState() {
+        doReturn(new Pair<>(false, null)).when(kbossBackupProviderSpy).validateBackupStateForFinalizeCompression(backupId);
+
+        boolean result = kbossBackupProviderSpy.finalizeBackupCompression(backupId, 0);
+
+        assertFalse(result);
+    }
+
+    @Test
+    public void finalizeBackupCompressionTestNullAnswer() {
+        doReturn(new Pair<>(true, backupVoMock)).when(kbossBackupProviderSpy).validateBackupStateForFinalizeCompression(backupId);
+        doReturn(List.of()).when(kbossBackupProviderSpy).getBackupDeltaTOList(backupId);
+        doReturn(hostVOMock).when(hostDaoMock).findById(0L);
+        doReturn(null).when(agentManagerMock).easySend(anyLong(), any());
+
+        boolean result = kbossBackupProviderSpy.finalizeBackupCompression(backupId, 0);
+
+        assertFalse(result);
+        verify(backupVoMock).setCompressionStatus(Backup.CompressionStatus.CompressionError);
+        verify(backupDaoMock).update(backupId, backupVoMock);
+    }
+
+    @Test
+    public void finalizeBackupCompressionTestCleanup() {
+        doReturn(new Pair<>(true, backupVoMock)).when(kbossBackupProviderSpy).validateBackupStateForFinalizeCompression(backupId);
+        doReturn(Backup.Status.Removed).when(backupVoMock).getStatus();
+        doReturn(List.of()).when(kbossBackupProviderSpy).getBackupDeltaTOList(backupId);
+        doReturn(hostVOMock).when(hostDaoMock).findById(0L);
+        doReturn(answerMock).when(agentManagerMock).easySend(anyLong(), any());
+        doReturn(true).when(answerMock).getResult();
+
+        boolean result = kbossBackupProviderSpy.finalizeBackupCompression(backupId, 0);
+
+        assertTrue(result);
+        verify(backupVoMock, Mockito.never()).setCompressionStatus(Backup.CompressionStatus.Compressed);
+        verify(backupDaoMock, Mockito.never()).update(backupId, backupVoMock);
+    }
+
+    @Test
+    public void finalizeBackupCompressionTestSuccess() {
+        doReturn(new Pair<>(true, backupVoMock)).when(kbossBackupProviderSpy).validateBackupStateForFinalizeCompression(backupId);
+        doReturn(Backup.Status.BackedUp).when(backupVoMock).getStatus();
+        doReturn(List.of()).when(kbossBackupProviderSpy).getBackupDeltaTOList(backupId);
+        doReturn(hostVOMock).when(hostDaoMock).findById(0L);
+        doReturn(answerMock).when(agentManagerMock).easySend(anyLong(), any());
+        doReturn(true).when(answerMock).getResult();
+        doReturn("1").when(answerMock).getDetails();
+        doNothing().when(kbossBackupProviderSpy).validateBackupAsyncIfHasOfferingSupport(any(), anyLong(), anyLong());
+
+        boolean result = kbossBackupProviderSpy.finalizeBackupCompression(backupId, 0);
+
+        assertTrue(result);
+        verify(backupVoMock).setCompressionStatus(Backup.CompressionStatus.Compressed);
+        verify(backupDaoMock).update(backupId, backupVoMock);
+    }
+
+    @Test
+    public void validateBackupTestInvalidState() {
+        doReturn(false).when(kbossBackupProviderSpy).validateBackupStateForValidation(backupId);
+
+        boolean result = kbossBackupProviderSpy.validateBackup(backupId, 0);
+
+        assertFalse(result);
+    }
+
+    @Test
+    public void validateBackupTestValidateWithHash() {
+        doReturn(true).when(kbossBackupProviderSpy).validateBackupStateForValidation(backupId);
+        doReturn(backupVoMock).when(backupDaoMock).findById(backupId);
+        doReturn(backupDetailVoMock).when(backupDetailDaoMock).findDetail(backupId, BackupDetailsDao.BACKUP_HASH);
+        doReturn(true).when(kbossBackupProviderSpy).validateWithHash(backupId, backupVoMock, backupDetailVoMock);
+
+        boolean result = kbossBackupProviderSpy.validateBackup(backupId, 0);
+
+        assertTrue(result);
+        verify(kbossBackupProviderSpy).validateWithHash(backupId, backupVoMock, backupDetailVoMock);
+    }
+
+    @Test
+    public void validateBackupTestValidateWithValidationVm() {
+        doReturn(true).when(kbossBackupProviderSpy).validateBackupStateForValidation(backupId);
+        doReturn(backupVoMock).when(backupDaoMock).findById(backupId);
+        doReturn(null).when(backupDetailDaoMock).findDetail(backupId, BackupDetailsDao.BACKUP_HASH);
+        doReturn(true).when(kbossBackupProviderSpy).validateWithValidationVm(backupId, 0, backupVoMock);
+
+        boolean result = kbossBackupProviderSpy.validateBackup(backupId, 0);
+
+        assertTrue(result);
+        verify(kbossBackupProviderSpy).validateWithValidationVm(backupId, 0, backupVoMock);
+    }
+
+    @Test
+    public void finishBackupChainTestInvalidState() {
+        doReturn(userVmVOMock).when(userVmDaoMock).findById(vmId);
+        doReturn(VirtualMachine.State.Migrating).when(userVmVOMock).getState();
+
+        boolean result = kbossBackupProviderSpy.finishBackupChain(virtualMachineMock);
+
+        assertFalse(result);
+    }
+
+    @Test
+    public void finishBackupChainTestRunningVm() {
+        doReturn(userVmVOMock).when(userVmDaoMock).findById(vmId);
+        doReturn(VirtualMachine.State.Running).when(userVmVOMock).getState();
+        doReturn(true).when(kbossBackupProviderSpy).endBackupChain(userVmVOMock);
+
+        boolean result = kbossBackupProviderSpy.finishBackupChain(virtualMachineMock);
+
+        assertTrue(result);
+        verify(kbossBackupProviderSpy).endBackupChain(userVmVOMock);
+    }
+
+    @Test
+    public void finishBackupChainTestBackupError() {
+        doReturn(userVmVOMock).when(userVmDaoMock).findById(vmId);
+        doReturn(VirtualMachine.State.BackupError).when(userVmVOMock).getState();
+        doReturn(true).when(kbossBackupProviderSpy).normalizeBackupErrorAndFinishChain(userVmVOMock);
+
+        boolean result = kbossBackupProviderSpy.finishBackupChain(virtualMachineMock);
+
+        assertTrue(result);
+        verify(kbossBackupProviderSpy).normalizeBackupErrorAndFinishChain(userVmVOMock);
+    }
+
+    @Test
+    public void prepareVmForSnapshotRevertTestNoCurrentBackup() {
+        doReturn(null).when(internalBackupJoinDaoMock).findCurrent(vmId);
+
+        kbossBackupProviderSpy.prepareVmForSnapshotRevert(vmSnapshotVoMock, virtualMachineMock);
+
+        verify(kbossBackupProviderSpy, never()).getSucceedingVmSnapshot(any());
+    }
+
+    @Test
+    public void prepareVmForSnapshotRevertTestCurrentBackupBeforeVmSnapshot() {
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findCurrent(vmId);
+        doReturn(Date.from(Instant.EPOCH)).when(internalBackupJoinVoMock).getDate();
+        doReturn(Date.from(Instant.now())).when(vmSnapshotVoMock).getCreated();
+
+        kbossBackupProviderSpy.prepareVmForSnapshotRevert(vmSnapshotVoMock, virtualMachineMock);
+
+        verify(kbossBackupProviderSpy, never()).getSucceedingVmSnapshot(any());
+    }
+
+    @Test (expected = CloudRuntimeException.class)
+    public void prepareVmForSnapshotRevertTestCurrentBackupAfterVmSnapshotTimeout() throws OperationTimedoutException, AgentUnavailableException {
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findCurrent(vmId);
+        doReturn(Date.from(Instant.now())).when(internalBackupJoinVoMock).getDate();
+        doReturn(Date.from(Instant.EPOCH)).when(vmSnapshotVoMock).getCreated();
+        doReturn(List.of()).when(vmSnapshotHelperMock).getVolumeTOList(vmId);
+        doReturn(vmSnapshotVoMock).when(kbossBackupProviderSpy).getSucceedingVmSnapshot(internalBackupJoinVoMock);
+        doNothing().when(kbossBackupProviderSpy).createDeleteCommandsAndMergeTrees(any(), any(), any(), any(), anyList());
+        doThrow(OperationTimedoutException.class).when(kbossBackupProviderSpy).sendBackupCommands(any(), any());
+
+        kbossBackupProviderSpy.prepareVmForSnapshotRevert(vmSnapshotVoMock, virtualMachineMock);
+
+        verify(kbossBackupProviderSpy, never()).updateReferencesAfterPrepareForSnapshotRevert(any(), any(), any(), any());
+    }
+
+    @Test (expected = CloudRuntimeException.class)
+    public void prepareVmForSnapshotRevertTestCurrentBackupAfterVmSnapshotNullAnswer() throws OperationTimedoutException, AgentUnavailableException {
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findCurrent(vmId);
+        doReturn(Date.from(Instant.now())).when(internalBackupJoinVoMock).getDate();
+        doReturn(Date.from(Instant.EPOCH)).when(vmSnapshotVoMock).getCreated();
+        doReturn(List.of()).when(vmSnapshotHelperMock).getVolumeTOList(vmId);
+        doReturn(vmSnapshotVoMock).when(kbossBackupProviderSpy).getSucceedingVmSnapshot(internalBackupJoinVoMock);
+        doNothing().when(kbossBackupProviderSpy).createDeleteCommandsAndMergeTrees(any(), any(), any(), any(), anyList());
+        doReturn(null).when(kbossBackupProviderSpy).sendBackupCommands(any(), any());
+
+        kbossBackupProviderSpy.prepareVmForSnapshotRevert(vmSnapshotVoMock, virtualMachineMock);
+
+        verify(kbossBackupProviderSpy, never()).updateReferencesAfterPrepareForSnapshotRevert(any(), any(), any(), any());
+    }
+
+    @Test
+    public void prepareVmForSnapshotRevertTestCurrentBackupAfterVmSnapshotSuccess() throws OperationTimedoutException, AgentUnavailableException {
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findCurrent(vmId);
+        doReturn(Date.from(Instant.now())).when(internalBackupJoinVoMock).getDate();
+        doReturn(Date.from(Instant.EPOCH)).when(vmSnapshotVoMock).getCreated();
+        doReturn(List.of()).when(vmSnapshotHelperMock).getVolumeTOList(vmId);
+        doReturn(vmSnapshotVoMock).when(kbossBackupProviderSpy).getSucceedingVmSnapshot(internalBackupJoinVoMock);
+        doNothing().when(kbossBackupProviderSpy).createDeleteCommandsAndMergeTrees(any(), any(), any(), any(), anyList());
+        doReturn(new Answer[]{}).when(kbossBackupProviderSpy).sendBackupCommands(any(), any());
+        doNothing().when(kbossBackupProviderSpy).updateReferencesAfterPrepareForSnapshotRevert(any(), any(), any(), any());
+
+        kbossBackupProviderSpy.prepareVmForSnapshotRevert(vmSnapshotVoMock, virtualMachineMock);
+
+        verify(kbossBackupProviderSpy).updateReferencesAfterPrepareForSnapshotRevert(any(), any(), any(), any());
+    }
+
+    @Test (expected = BackupException.class)
+    public void finalizeQuickRestoreTestStoppedVmStartException() throws ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
+        doReturn(userVmVOMock).when(userVmDaoMock).findById(vmId);
+        doReturn(VirtualMachine.State.Stopped).when(userVmVOMock).getState();
+        doThrow(CloudRuntimeException.class).when(userVmManagerMock).startVirtualMachine(anyLong(), any(), any(), any(), anyBoolean());
+
+        kbossBackupProviderSpy.finalizeQuickRestore(virtualMachineMock, List.of(), 0);
+    }
+
+    @Test
+    public void finalizeQuickRestoreTestStoppedVmStartSuccess() {
+        doReturn(userVmVOMock).when(userVmDaoMock).findById(vmId);
+        doReturn(true).when(kbossBackupProviderSpy).consolidateVolumes(any(), anyLong(), anyList());
+
+        boolean result = kbossBackupProviderSpy.finalizeQuickRestore(virtualMachineMock, List.of(), 0);
+
+        assertTrue(result);
+        verify(kbossBackupProviderSpy).consolidateVolumes(any(), anyLong(), anyList());
+    }
+
+    @Test
+    public void validateWithHashTestNoHosts() {
+        doReturn(List.of()).when(kbossBackupProviderSpy).getBackupDeltaTOList(backupId);
+        doReturn(null).when(hostDaoMock).listAllHostsUpByZoneAndHypervisor(anyLong(), any());
+        doNothing().when(kbossBackupProviderSpy).setBackupUnableToValidateAndSendAlert(any(), any());
+
+        boolean result = kbossBackupProviderSpy.validateWithHash(backupId, backupVoMock, null);
+
+        assertFalse(result);
+        verify(kbossBackupProviderSpy).setBackupUnableToValidateAndSendAlert(any(), any());
+    }
+
+    @Test
+    public void validateWithHashTestAnswerResultFalse() {
+        doReturn(List.of()).when(kbossBackupProviderSpy).getBackupDeltaTOList(backupId);
+        doReturn(List.of(hostVOMock)).when(hostDaoMock).listAllHostsUpByZoneAndHypervisor(anyLong(), any());
+        doReturn(answerMock).when(kbossBackupProviderSpy).sendBackupCommand(anyLong(), any());
+        doReturn(false).when(answerMock).getResult();
+        doNothing().when(kbossBackupProviderSpy).setBackupUnableToValidateAndSendAlert(any(), any());
+
+        boolean result = kbossBackupProviderSpy.validateWithHash(backupId, backupVoMock, null);
+
+        assertFalse(result);
+        verify(kbossBackupProviderSpy).sendBackupCommand(anyLong(), any());
+        verify(kbossBackupProviderSpy).setBackupUnableToValidateAndSendAlert(any(), any());
+    }
+
+    @Test
+    public void validateWithHashTestDifferentHash() {
+        doReturn(List.of()).when(kbossBackupProviderSpy).getBackupDeltaTOList(backupId);
+        doReturn(List.of(hostVOMock)).when(hostDaoMock).listAllHostsUpByZoneAndHypervisor(anyLong(), any());
+        doReturn(answerMock).when(kbossBackupProviderSpy).sendBackupCommand(anyLong(), any());
+        doReturn(true).when(answerMock).getResult();
+        doReturn("wrongHash").when(answerMock).getDetails();
+        doReturn("correctHash").when(backupDetailVoMock).getValue();
+        doNothing().when(kbossBackupProviderSpy).setBackupAsInvalidAndSendAlert(any(), any());
+
+        boolean result = kbossBackupProviderSpy.validateWithHash(backupId, backupVoMock, backupDetailVoMock);
+
+        assertFalse(result);
+        verify(kbossBackupProviderSpy).sendBackupCommand(anyLong(), any());
+        verify(kbossBackupProviderSpy).setBackupAsInvalidAndSendAlert(any(), any());
+        verify(backupDaoMock, Mockito.never()).update(anyLong(), any());
+    }
+
+    @Test
+    public void validateWithHashTestSameHash() {
+        doReturn(List.of()).when(kbossBackupProviderSpy).getBackupDeltaTOList(backupId);
+        doReturn(List.of(hostVOMock)).when(hostDaoMock).listAllHostsUpByZoneAndHypervisor(anyLong(), any());
+        doReturn(answerMock).when(kbossBackupProviderSpy).sendBackupCommand(anyLong(), any());
+        doReturn(true).when(answerMock).getResult();
+        doReturn("correctHash").when(answerMock).getDetails();
+        doReturn("correctHash").when(backupDetailVoMock).getValue();
+
+        boolean result = kbossBackupProviderSpy.validateWithHash(backupId, backupVoMock, backupDetailVoMock);
+
+        assertTrue(result);
+        verify(kbossBackupProviderSpy).sendBackupCommand(anyLong(), any());
+        verify(kbossBackupProviderSpy, never()).setBackupAsInvalidAndSendAlert(any(), any());
+        verify(kbossBackupProviderSpy, never()).setBackupUnableToValidateAndSendAlert(any(), any());
+        verify(backupDaoMock).update(anyLong(), any());
+    }
+
+
+    @Test
+    public void validateWithValidationVmTestValidationVmIsNull() {
+        doReturn(null).when(kbossBackupProviderSpy).allocateValidationVm(anyLong(), any());
+
+        boolean result = kbossBackupProviderSpy.validateWithValidationVm(backupId, 2L, backupVoMock);
+
+        assertFalse(result);
+        verify(kbossBackupProviderSpy).cleanupValidation(anyBoolean(), any(), any(), any());
+    }
+
+    @Test
+    public void validateWithValidationVmTestPrepareForValidationFails() throws NoTransitionException {
+        doReturn(userVmVOMock).when(kbossBackupProviderSpy).allocateValidationVm(anyLong(), any());
+        doReturn(hostVOMock).when(hostDaoMock).findById(anyLong());
+        doReturn(List.of()).when(volumeDaoMock).findByInstance(anyLong());
+        doNothing().when(kbossBackupProviderSpy).createValidationVolumesOnPrimaryStorage(any(), any(), any(), any(), any());
+        doReturn(List.of()).when(internalBackupDataStoreDaoMock).listByBackupId(anyLong());
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(anyLong());
+        doReturn(Set.of()).when(kbossBackupProviderSpy).generateBackupAndVolumePairsToRestore(any(), any(), any(), eq(false));
+        doReturn(false).when(kbossBackupProviderSpy).prepareForValidation(anyLong(), any(), any(), any());
+
+        boolean result = kbossBackupProviderSpy.validateWithValidationVm(backupId, 2L, backupVoMock);
+
+        assertFalse(result);
+        verify(kbossBackupProviderSpy).cleanupValidation(eq(false), eq(userVmVOMock), eq(backupVoMock), any());
+    }
+
+    @Test
+    public void validateWithValidationVmTestValidateBackupFails() throws NoTransitionException {
+        doReturn(userVmVOMock).when(kbossBackupProviderSpy).allocateValidationVm(anyLong(), any());
+        doReturn(2L).when(userVmVOMock).getHostId();
+        doReturn(Hypervisor.HypervisorType.KVM).when(userVmVOMock).getHypervisorType();
+        doReturn(hostVOMock).when(hostDaoMock).findById(anyLong());
+        doReturn(userVmVOMock).when(userVmDaoMock).findById(anyLong());
+        doReturn(List.of()).when(volumeDaoMock).findByInstance(anyLong());
+        doNothing().when(kbossBackupProviderSpy).createValidationVolumesOnPrimaryStorage(any(), any(), any(), any(), any());
+        doReturn(List.of()).when(internalBackupDataStoreDaoMock).listByBackupId(anyLong());
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(anyLong());
+        doReturn(Set.of()).when(kbossBackupProviderSpy).generateBackupAndVolumePairsToRestore(any(), any(), any(), eq(false));
+        doReturn(true).when(kbossBackupProviderSpy).prepareForValidation(anyLong(), any(), any(), any());
+        doReturn(hypervisorGuruMock).when(hypervisorGuruManagerMock).getGuru(any());
+        doReturn(virtualMachineToMock).when(hypervisorGuruMock).implement(any());
+        doReturn(false).when(kbossBackupProviderSpy).validateBackup(anyLong(), any(), any(), any(), any(), any());
+        doNothing().when(kbossBackupProviderSpy).sendCleanupFailedEmail(any(), any());
+        doNothing().when(kbossBackupProviderSpy).validateVmState(any(), any(), any(), any());
+
+        boolean result = kbossBackupProviderSpy.validateWithValidationVm(backupId, 2L, backupVoMock);
+
+        assertFalse(result);
+        verify(kbossBackupProviderSpy).endBackupChainIfConfigured(backupVoMock);
+        verify(kbossBackupProviderSpy).cleanupValidation(eq(true), eq(userVmVOMock), eq(backupVoMock), any());
+    }
+
+    @Test
+    public void validateWithValidationVmTestSuccessfulValidation() throws NoTransitionException {
+        doReturn(userVmVOMock).when(kbossBackupProviderSpy).allocateValidationVm(anyLong(), any());
+        doReturn(2L).when(userVmVOMock).getHostId();
+        doReturn(Hypervisor.HypervisorType.KVM).when(userVmVOMock).getHypervisorType();
+        doReturn(hostVOMock).when(hostDaoMock).findById(anyLong());
+        doReturn(2L).when(hostVOMock).getId();
+        doReturn(userVmVOMock).when(userVmDaoMock).findById(anyLong());
+        doReturn(List.of()).when(volumeDaoMock).findByInstance(anyLong());
+        doNothing().when(kbossBackupProviderSpy).createValidationVolumesOnPrimaryStorage(any(), any(), any(), any(), any());
+        doReturn(List.of()).when(internalBackupDataStoreDaoMock).listByBackupId(anyLong());
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(anyLong());
+        doReturn(Set.of()).when(kbossBackupProviderSpy).generateBackupAndVolumePairsToRestore(any(), any(), any(), eq(false));
+        doReturn(true).when(kbossBackupProviderSpy).prepareForValidation(anyLong(), any(), any(), any());
+        doReturn(hypervisorGuruMock).when(hypervisorGuruManagerMock).getGuru(any());
+        doReturn(virtualMachineToMock).when(hypervisorGuruMock).implement(any());
+        doReturn(true).when(kbossBackupProviderSpy).validateBackup(anyLong(), any(), any(), any(), any(), any());
+        doNothing().when(kbossBackupProviderSpy).calculateAndSaveHash(any(), any(), anyLong());
+        doNothing().when(kbossBackupProviderSpy).sendCleanupFailedEmail(any(), any());
+
+        boolean result = kbossBackupProviderSpy.validateWithValidationVm(backupId, 2L, backupVoMock);
+
+        assertTrue(result);
+        verify(kbossBackupProviderSpy).calculateAndSaveHash(any(), eq(backupVoMock), anyLong());
+        verify(kbossBackupProviderSpy).cleanupValidation(eq(true), eq(userVmVOMock), eq(backupVoMock), any());
+    }
+
+    @Test
+    public void validateWithValidationVmTestExceptionHandling() throws NoTransitionException {
+        doReturn(userVmVOMock).when(kbossBackupProviderSpy).allocateValidationVm(anyLong(), any());
+        doReturn(hostVOMock).when(hostDaoMock).findById(anyLong());
+        doReturn(List.of()).when(volumeDaoMock).findByInstance(anyLong());
+        doThrow(new RuntimeException("boom")).when(kbossBackupProviderSpy).createValidationVolumesOnPrimaryStorage(any(), any(), any(), any(), any());
+        doNothing().when(kbossBackupProviderSpy).setBackupUnableToValidateAndSendAlert(any(), any());
+
+        boolean result = kbossBackupProviderSpy.validateWithValidationVm(backupId, 2L, backupVoMock);
+
+        assertFalse(result);
+        verify(kbossBackupProviderSpy).setBackupUnableToValidateAndSendAlert(eq(backupVoMock), contains("boom"));
+        verify(kbossBackupProviderSpy).cleanupValidation(eq(false), eq(userVmVOMock), eq(backupVoMock), any());
+    }
+
+
+    @Test
+    public void setBackupAsIsolatedTestPersistIsolatedDetail() {
+        kbossBackupProviderSpy.setBackupAsIsolated(backupVoMock);
+        verify(backupDetailDaoMock, Mockito.times(1)).persist(any());
+    }
+
+    @Test
+    public void endBackupChainIfConfiguredTestFeatureDisabled() {
+        doReturn(false).when(kbossBackupProviderSpy).getValidationEndChainOnFail(backupVoMock);
+
+        kbossBackupProviderSpy.endBackupChainIfConfigured(backupVoMock);
+
+        verify(kbossBackupProviderSpy, never()).endBackupChain(any());
+    }
+
+    @Test
+    public void endBackupChainIfConfiguredTestNotCurrentAndNoCurrentChildren() {
+        doReturn(true).when(kbossBackupProviderSpy).getValidationEndChainOnFail(backupVoMock);
+        doReturn(false).when(internalBackupJoinVoMock).getCurrent();
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(anyLong());
+        InternalBackupJoinVO child = mock(InternalBackupJoinVO.class);
+        doReturn(false).when(child).getCurrent();
+        doReturn(List.of(child)).when(kbossBackupProviderSpy).getBackupJoinChildren(any());
+        doNothing().when(kbossBackupProviderSpy).validateVmState(any(), any(), any(), any());
+
+        kbossBackupProviderSpy.endBackupChainIfConfigured(backupVoMock);
+
+        verify(kbossBackupProviderSpy, never()).endBackupChain(any());
+    }
+
+    @Test
+    public void endBackupChainIfConfiguredTestBackupIsCurrent() {
+        doReturn(true).when(kbossBackupProviderSpy).getValidationEndChainOnFail(backupVoMock);
+        doReturn(true).when(internalBackupJoinVoMock).getCurrent();
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(anyLong());
+        doReturn(List.of()).when(kbossBackupProviderSpy).getBackupJoinChildren(any());
+        doReturn(userVmVOMock).when(userVmDaoMock).findByIdIncludingRemoved(anyLong());
+        doReturn(true).when(kbossBackupProviderSpy).endBackupChain(any());
+        doNothing().when(kbossBackupProviderSpy).validateVmState(any(), any(), any(), any());
+
+        kbossBackupProviderSpy.endBackupChainIfConfigured(backupVoMock);
+
+        verify(kbossBackupProviderSpy, times(1)).endBackupChain(userVmVOMock);
+    }
+
+    @Test
+    public void endBackupChainIfConfiguredTestLastChildIsCurrent() {
+        doReturn(true).when(kbossBackupProviderSpy).getValidationEndChainOnFail(backupVoMock);
+        doReturn(false).when(internalBackupJoinVoMock).getCurrent();
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(anyLong());
+        InternalBackupJoinVO child = mock(InternalBackupJoinVO.class);
+        doReturn(true).when(child).getCurrent();
+        doReturn(List.of(child)).when(kbossBackupProviderSpy).getBackupJoinChildren(any());
+        doReturn(userVmVOMock).when(userVmDaoMock).findByIdIncludingRemoved(anyLong());
+        doReturn(true).when(kbossBackupProviderSpy).endBackupChain(any());
+        doNothing().when(kbossBackupProviderSpy).validateVmState(any(), any(), any(), any());
+
+        kbossBackupProviderSpy.endBackupChainIfConfigured(backupVoMock);
+
+        verify(kbossBackupProviderSpy, times(1)).endBackupChain(userVmVOMock);
+    }
+
+
+    @Test
+    public void normalizeBackupErrorAndFinishChainTestAnswerNull() {
+        doReturn(null).when(vmInstanceDetailsDaoMock).findDetail(anyLong(), any());
+        doReturn(backupVoMock).when(backupDaoMock).findLatestByStatusAndVmId(any(), anyLong());
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(backupId);
+        doReturn(mock(ImageStoreVO.class)).when(imageStoreDaoMock).findById(anyLong());
+        doReturn(List.of()).when(internalBackupStoragePoolDaoMock).listByBackupId(anyLong());
+        long parentId = 9382;
+        doReturn(parentId).when(internalBackupJoinVoMock).getParentId();
+        doReturn(null).when(internalBackupJoinDaoMock).findById(parentId);
+        doReturn(List.of()).when(internalBackupDataStoreDaoMock).listByBackupId(anyLong());
+        doNothing().when(kbossBackupProviderSpy).configureKbossTosForCleanup(any(), any(), any(), anyBoolean(), any(), any());
+        doReturn(null).when(kbossBackupProviderSpy).sendBackupCommand(anyLong(), any());
+
+        boolean result = kbossBackupProviderSpy.normalizeBackupErrorAndFinishChain(userVmVOMock);
+
+        assertFalse(result);
+    }
+
+    @Test
+    public void normalizeBackupErrorAndFinishChainTestAnswerFailed() {
+        doReturn(null).when(vmInstanceDetailsDaoMock).findDetail(anyLong(), any());
+        doReturn(backupVoMock).when(backupDaoMock).findLatestByStatusAndVmId(any(), anyLong());
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(backupId);
+        doReturn(mock(ImageStoreVO.class)).when(imageStoreDaoMock).findById(anyLong());
+        doReturn(List.of()).when(internalBackupStoragePoolDaoMock).listByBackupId(anyLong());
+        long parentId = 9382;
+        doReturn(parentId).when(internalBackupJoinVoMock).getParentId();
+        doReturn(null).when(internalBackupJoinDaoMock).findById(parentId);
+        doReturn(List.of()).when(internalBackupDataStoreDaoMock).listByBackupId(anyLong());
+        doNothing().when(kbossBackupProviderSpy).configureKbossTosForCleanup(any(), any(), any(), anyBoolean(), any(), any());
+        doReturn(answerMock).when(kbossBackupProviderSpy).sendBackupCommand(anyLong(), any());
+        doReturn(false).when(answerMock).getResult();
+
+        boolean result = kbossBackupProviderSpy.normalizeBackupErrorAndFinishChain(userVmVOMock);
+
+        assertFalse(result);
+    }
+
+    @Test
+    public void normalizeBackupErrorAndFinishChainTestSuccessCallsEndChain() {
+        doReturn(null).when(vmInstanceDetailsDaoMock).findDetail(anyLong(), any());
+        doReturn(backupVoMock).when(backupDaoMock).findLatestByStatusAndVmId(any(), anyLong());
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(anyLong());
+        doReturn(mock(ImageStoreVO.class)).when(imageStoreDaoMock).findById(anyLong());
+        doReturn(List.of()).when(internalBackupStoragePoolDaoMock).listByBackupId(anyLong());
+        long parentId = 9382;
+        doReturn(parentId).when(internalBackupJoinVoMock).getParentId();
+        doReturn(null).when(internalBackupJoinDaoMock).findById(parentId);
+        doReturn(List.of()).when(internalBackupDataStoreDaoMock).listByBackupId(anyLong());
+        doNothing().when(kbossBackupProviderSpy).configureKbossTosForCleanup(any(), any(), any(), anyBoolean(), any(), any());
+        doReturn(answerMock).when(kbossBackupProviderSpy).sendBackupCommand(anyLong(), any());
+        doReturn(true).when(answerMock).getResult();
+        doReturn(false).when(kbossBackupProviderSpy).processCleanupBackupErrorAnswer(any(), any());
+        doReturn(true).when(kbossBackupProviderSpy).endBackupChain(any());
+
+        boolean result = kbossBackupProviderSpy.normalizeBackupErrorAndFinishChain(userVmVOMock);
+
+        assertTrue(result);
+        verify(kbossBackupProviderSpy).endBackupChain(userVmVOMock);
+    }
+
+
+    @Test
+    public void normalizeBackupErrorAndFinishChainTestChainAlreadyEnded() {
+        doReturn(null).when(vmInstanceDetailsDaoMock).findDetail(anyLong(), any());
+        doReturn(backupVoMock).when(backupDaoMock).findLatestByStatusAndVmId(any(), anyLong());
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(anyLong());
+        doReturn(mock(ImageStoreVO.class)).when(imageStoreDaoMock).findById(anyLong());
+        doReturn(List.of()).when(internalBackupStoragePoolDaoMock).listByBackupId(anyLong());
+        long parentId = 9382;
+        doReturn(parentId).when(internalBackupJoinVoMock).getParentId();
+        doReturn(null).when(internalBackupJoinDaoMock).findById(parentId);
+        doReturn(List.of()).when(internalBackupDataStoreDaoMock).listByBackupId(anyLong());
+        doNothing().when(kbossBackupProviderSpy).configureKbossTosForCleanup(any(), any(), any(), anyBoolean(), any(), any());
+        doReturn(answerMock).when(kbossBackupProviderSpy).sendBackupCommand(anyLong(), any());
+        doReturn(true).when(answerMock).getResult();
+        doReturn(true).when(kbossBackupProviderSpy).processCleanupBackupErrorAnswer(any(), any());
+        InternalBackupJoinVO current = mock(InternalBackupJoinVO.class);
+        doReturn(current).when(internalBackupJoinDaoMock).findCurrent(anyLong());
+        doNothing().when(internalBackupStoragePoolDaoMock).expungeByBackupId(anyLong());
+        doNothing().when(kbossBackupProviderSpy).setEndOfChainAndRemoveCurrentForBackup(any());
+
+        boolean result = kbossBackupProviderSpy.normalizeBackupErrorAndFinishChain(userVmVOMock);
+
+        assertTrue(result);
+        verify(internalBackupStoragePoolDaoMock).expungeByBackupId(anyLong());
+        verify(kbossBackupProviderSpy).setEndOfChainAndRemoveCurrentForBackup(any());
+    }
+
+    @Test
+    public void cleanupValidationTestStartedVmFalseAndValidationNotPreparedAndFailedToDestroyVolume() throws ResourceUnavailableException {
+        VolumeVO dataVolume = Mockito.mock(VolumeVO.class);
+        doReturn(Volume.Type.DATADISK).when(dataVolume).getVolumeType();
+        doReturn(52L).when(dataVolume).getId();
+        doNothing().when(kbossBackupProviderSpy).sendCleanupFailedEmail(any(), any());
+
+        try (MockedStatic<CallContext> callContextMocked = Mockito.mockStatic(CallContext.class)) {
+            CallContext callContextMock = Mockito.mock(CallContext.class);
+            callContextMocked.when(CallContext::current).thenReturn(callContextMock);
+
+            kbossBackupProviderSpy.cleanupValidation(false, userVmVOMock, backupVoMock, List.of(dataVolume));
+
+            verify(userVmManagerMock, Mockito.never()).stopVirtualMachine(anyLong(), anyBoolean());
+            verify(userVmManagerMock, Mockito.times(1)).destroyVm(any(DestroyVMCmd.class), Mockito.eq(false));
+            verify(volumeApiServiceMock, Mockito.times(1)).destroyVolume(Mockito.eq(52L), any(), Mockito.eq(true), Mockito.eq(true), Mockito.isNull());
+            verify(agentManagerMock, Mockito.never()).easySend(anyLong(), any());
+        }
+    }
+
+    @Test
+    public void cleanupValidationTestDestroyVmThrowsAndCleanupMailIsSent() throws ResourceUnavailableException {
+        VolumeVO dataVolume = Mockito.mock(VolumeVO.class);
+        doReturn(Volume.Type.DATADISK).when(dataVolume).getVolumeType();
+        doReturn(88L).when(userVmVOMock).getHostId();
+        doReturn(Set.of("secondary-storage-1")).when(kbossBackupProviderSpy).getSecondaryStorageUrls(userVmVOMock);
+        doThrow(new RuntimeException("boom")).when(userVmManagerMock).destroyVm(any(DestroyVMCmd.class), Mockito.eq(false));
+        doReturn(answerMock).when(agentManagerMock).easySend(anyLong(), any());
+        doReturn(true).when(answerMock).getResult();
+        doNothing().when(kbossBackupProviderSpy).sendCleanupFailedEmail(any(), any());
+
+        try (MockedStatic<CallContext> callContextMocked = Mockito.mockStatic(CallContext.class)) {
+            CallContext callContextMock = Mockito.mock(CallContext.class);
+            callContextMocked.when(CallContext::current).thenReturn(callContextMock);
+
+            kbossBackupProviderSpy.cleanupValidation(true, userVmVOMock, backupVoMock, List.of(dataVolume));
+
+            verify(userVmManagerMock, Mockito.times(1)).destroyVm(any(DestroyVMCmd.class), Mockito.eq(false));
+            verify(kbossBackupProviderSpy, Mockito.times(1)).sendCleanupFailedEmail(eq(backupVoMock), contains("Got an unexpected exception while trying to destroy validation VM."));
+            verify(agentManagerMock, Mockito.times(1)).easySend(Mockito.eq(88L), any(CleanupKbossValidationCommand.class));
+        }
+    }
+
+    @Test
+    public void cleanupValidationTestCleanupCommandFails() {
+        VolumeVO dataVolume = Mockito.mock(VolumeVO.class);
+        doReturn(Volume.Type.DATADISK).when(dataVolume).getVolumeType();
+        doReturn(88L).when(userVmVOMock).getHostId();
+        doReturn(Set.of("secondary-storage-1")).when(kbossBackupProviderSpy).getSecondaryStorageUrls(userVmVOMock);
+        doReturn(null).when(agentManagerMock).easySend(anyLong(), any());
+        doReturn(hostVOMock).when(hostDaoMock).findById(88L);
+        doNothing().when(kbossBackupProviderSpy).sendCleanupFailedEmail(any(), any());
+
+        try (MockedStatic<CallContext> callContextMocked = Mockito.mockStatic(CallContext.class)) {
+            CallContext callContextMock = Mockito.mock(CallContext.class);
+            callContextMocked.when(CallContext::current).thenReturn(callContextMock);
+
+            kbossBackupProviderSpy.cleanupValidation(true, userVmVOMock, backupVoMock, List.of(dataVolume));
+
+            verify(agentManagerMock, Mockito.times(1)).easySend(Mockito.eq(88L), any(CleanupKbossValidationCommand.class));
+            verify(hostDaoMock, Mockito.times(1)).findById(88L);
+            verify(kbossBackupProviderSpy, times(1)).sendCleanupFailedEmail(any(), any());
+        }
+    }
+
+    @Test
+    public void cleanupValidationTestNoEmailSentAndAllStepsExecuted() throws ResourceUnavailableException {
+        VolumeVO rootVolume = Mockito.mock(VolumeVO.class);
+        doReturn(Volume.Type.ROOT).when(rootVolume).getVolumeType();
+
+        VolumeVO dataVolume = Mockito.mock(VolumeVO.class);
+        doReturn(Volume.Type.DATADISK).when(dataVolume).getVolumeType();
+        doReturn(52L).when(dataVolume).getId();
+
+        doReturn(77L).when(userVmVOMock).getId();
+        doReturn(88L).when(userVmVOMock).getHostId();
+        doReturn(Set.of("secondary-storage-1")).when(kbossBackupProviderSpy).getSecondaryStorageUrls(userVmVOMock);
+        doReturn(answerMock).when(agentManagerMock).easySend(anyLong(), any());
+        doReturn(true).when(answerMock).getResult();
+        doReturn(volumeVoMock).when(volumeApiServiceMock).destroyVolume(Mockito.eq(52L), any(), Mockito.eq(true), Mockito.eq(true), Mockito.isNull());
+
+        try (MockedStatic<CallContext> callContextMocked = Mockito.mockStatic(CallContext.class)) {
+            CallContext callContextMock = Mockito.mock(CallContext.class);
+            callContextMocked.when(CallContext::current).thenReturn(callContextMock);
+
+            kbossBackupProviderSpy.cleanupValidation(true, userVmVOMock, backupVoMock, List.of(rootVolume, dataVolume));
+
+            verify(userVmManagerMock, Mockito.times(1)).stopVirtualMachine(77L, true);
+            verify(userVmManagerMock, Mockito.times(1)).destroyVm(any(DestroyVMCmd.class), Mockito.eq(false));
+            verify(volumeApiServiceMock, Mockito.times(1)).destroyVolume(Mockito.eq(52L), any(), Mockito.eq(true), Mockito.eq(true), Mockito.isNull());
+            verify(agentManagerMock, Mockito.times(1)).easySend(Mockito.eq(88L), any(CleanupKbossValidationCommand.class));
+            verify(kbossBackupProviderSpy, Mockito.never()).sendCleanupFailedEmail(any(), any());
+            verify(hostDaoMock, Mockito.never()).findById(anyLong());
+        }
+    }
+
+    @Test
+    public void getVolumesToConsolidateTestSameVmAsBackupFalse() {
+        VolumeObjectTO volumeObjectTO1 = Mockito.mock(VolumeObjectTO.class);
+        doReturn(11L).when(volumeObjectTO1).getVolumeId();
+        VolumeInfo volumeInfo1 = Mockito.mock(VolumeInfo.class);
+        doReturn(volumeVoMock).when(volumeInfo1).getVolume();
+        doReturn(volumeInfo1).when(volumeDataFactoryMock).getVolume(11L);
+
+        VolumeObjectTO volumeObjectTO2 = Mockito.mock(VolumeObjectTO.class);
+        doReturn(22L).when(volumeObjectTO2).getVolumeId();
+        VolumeInfo volumeInfo2 = Mockito.mock(VolumeInfo.class);
+        doReturn(Mockito.mock(VolumeVO.class)).when(volumeInfo2).getVolume();
+        doReturn(volumeInfo2).when(volumeDataFactoryMock).getVolume(22L);
+
+        doNothing().when(kbossBackupProviderSpy).transitVmState(any(), any(), anyLong());
+        doNothing().when(kbossBackupProviderSpy).transitVolumeState(any(), any());
+
+        List<VolumeInfo> result = kbossBackupProviderSpy.getVolumesToConsolidate(virtualMachineMock, List.of(), List.of(volumeObjectTO1, volumeObjectTO2), 99L, false);
+
+        assertEquals(List.of(volumeInfo1, volumeInfo2), result);
+        verify(kbossBackupProviderSpy, times(1)).transitVmState(virtualMachineMock, VirtualMachine.Event.RestoringSuccess, 99L);
+        verify(volumeDataFactoryMock, times(1)).getVolume(11L);
+        verify(volumeDataFactoryMock, times(1)).getVolume(22L);
+        verify(kbossBackupProviderSpy, times(2)).transitVolumeState(any(), eq(Volume.Event.RestoreSucceeded));
+    }
+
+    @Test
+    public void getVolumesToConsolidateTestSameVmAsBackupTrueFiltersBySecondaryDeltas() {
+        VolumeObjectTO volumeObjectTO1 = Mockito.mock(VolumeObjectTO.class);
+        doReturn(11L).when(volumeObjectTO1).getVolumeId();
+        VolumeInfo volumeInfo1 = Mockito.mock(VolumeInfo.class);
+        doReturn(volumeVoMock).when(volumeInfo1).getVolume();
+        doReturn(volumeInfo1).when(volumeDataFactoryMock).getVolume(11L);
+
+        VolumeObjectTO volumeObjectTO2 = Mockito.mock(VolumeObjectTO.class);
+        doReturn(22L).when(volumeObjectTO2).getVolumeId();
+        VolumeInfo volumeInfo2 = Mockito.mock(VolumeInfo.class);
+        doReturn(Mockito.mock(VolumeVO.class)).when(volumeInfo2).getVolume();
+        doReturn(volumeInfo2).when(volumeDataFactoryMock).getVolume(22L);
+
+        InternalBackupDataStoreVO delta = Mockito.mock(InternalBackupDataStoreVO.class);
+        doReturn(33L).when(delta).getVolumeId();
+
+        doNothing().when(kbossBackupProviderSpy).transitVmState(any(), any(), anyLong());
+        doNothing().when(kbossBackupProviderSpy).transitVolumeState(any(), any());
+
+        List<VolumeInfo> result = kbossBackupProviderSpy.getVolumesToConsolidate(virtualMachineMock, List.of(delta), List.of(volumeObjectTO1, volumeObjectTO2), 99L, true);
+
+        assertEquals(List.of(), result);
+        verify(kbossBackupProviderSpy, times(1)).transitVmState(virtualMachineMock, VirtualMachine.Event.RestoringSuccess, 99L);
+        verify(volumeDataFactoryMock, times(1)).getVolume(11L);
+        verify(volumeDataFactoryMock, times(1)).getVolume(22L);
+        verify(kbossBackupProviderSpy, times(2)).transitVolumeState(any(), eq(Volume.Event.RestoreSucceeded));
+    }
+
+    @Test
+    public void checkErrorBackupTestNonErrorStatusDoesNothing() {
+        doReturn(Backup.Status.BackedUp).when(backupVoMock).getStatus();
+
+        kbossBackupProviderSpy.checkErrorBackup(backupVoMock, virtualMachineMock);
+
+        verify(backupVoMock, never()).setStatus(Backup.Status.Failed);
+    }
+
+    @Test
+    public void checkErrorBackupTestErrorStatusAndVmIsNullSetsBackupFailed() {
+        doReturn(Backup.Status.Error).when(backupVoMock).getStatus();
+
+        kbossBackupProviderSpy.checkErrorBackup(backupVoMock, null);
+
+        verify(backupVoMock).setStatus(Backup.Status.Failed);
+    }
+
+    @Test
+    public void checkErrorBackupTestErrorStatusAndVmNotBackupErrorSetsBackupFailed() {
+        doReturn(Backup.Status.Error).when(backupVoMock).getStatus();
+        doReturn(VirtualMachine.State.Running).when(virtualMachineMock).getState();
+
+        kbossBackupProviderSpy.checkErrorBackup(backupVoMock, virtualMachineMock);
+
+        verify(backupVoMock).setStatus(Backup.Status.Failed);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void checkErrorBackupTestErrorStatusAndVmInBackupErrorThrows() {
+        doReturn(Backup.Status.Error).when(backupVoMock).getStatus();
+        doReturn(VirtualMachine.State.BackupError).when(virtualMachineMock).getState();
+
+        kbossBackupProviderSpy.checkErrorBackup(backupVoMock, virtualMachineMock);
+
+        verify(backupVoMock, never()).setStatus(Backup.Status.Failed);
+    }
+
+    @Test
+    public void deleteFailedBackupTestFailedBackupIsExpungedAndCleanedUp() {
+        long backupId = 123L;
+        doReturn(backupId).when(backupVoMock).getId();
+        doReturn(Backup.Status.Failed).when(backupVoMock).getStatus();
+
+        boolean result = kbossBackupProviderSpy.deleteFailedBackup(backupVoMock);
+
+        assertTrue(result);
+        verify(backupVoMock).setStatus(Backup.Status.Expunged);
+        verify(backupDaoMock).update(backupId, backupVoMock);
+        verify(internalBackupStoragePoolDaoMock).expungeByBackupId(backupId);
+        verify(internalBackupDataStoreDaoMock).expungeByBackupId(backupId);
+        verify(backupDetailDaoMock).removeDetails(backupId);
+    }
+
+    @Test
+    public void deleteFailedBackupTestNonFailedBackupDoesNothing() {
+        doReturn(Backup.Status.BackedUp).when(backupVoMock).getStatus();
+
+        boolean result = kbossBackupProviderSpy.deleteFailedBackup(backupVoMock);
+
+        assertFalse(result);
+        verify(backupVoMock, never()).setStatus(Backup.Status.Expunged);
+        verify(backupDaoMock, never()).update(anyLong(), any());
+        verify(internalBackupStoragePoolDaoMock, never()).expungeByBackupId(anyLong());
+        verify(internalBackupDataStoreDaoMock, never()).expungeByBackupId(anyLong());
+        verify(backupDetailDaoMock, never()).removeDetails(anyLong());
+    }
+
+    @Test
+    public void mergeCurrentDeltaIntoVolumeTestNoDeltaDoesNothing() {
+        doReturn(volumeId).when(volumeVoMock).getId();
+        doReturn(null).when(internalBackupStoragePoolDaoMock).findOneByVolumeId(volumeId);
+
+        kbossBackupProviderSpy.mergeCurrentDeltaIntoVolume(volumeVoMock, virtualMachineMock, "detach", true);
+
+        verify(internalBackupStoragePoolDaoMock, times(1)).findOneByVolumeId(volumeId);
+        verify(internalBackupJoinDaoMock, never()).findById(anyLong());
+    }
+
+    @Test (expected = CloudRuntimeException.class)
+    public void mergeCurrentDeltaIntoVolumeTestNullAnswer() {
+        doReturn(volumeId).when(volumeVoMock).getId();
+        doReturn(internalBackupStoragePoolVoMock).when(internalBackupStoragePoolDaoMock).findOneByVolumeId(volumeId);
+        doReturn(backupId).when(internalBackupStoragePoolVoMock).getBackupId();
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(backupId);
+        doReturn(null).when(kbossBackupProviderSpy).getSucceedingVmSnapshot(internalBackupJoinVoMock);
+        doReturn(deltaMergeTreeToMock).when(kbossBackupProviderSpy).createDeltaMergeTree(anyBoolean(), anyBoolean(), any(), any(), any());
+        doReturn(null).when(kbossBackupProviderSpy).sendBackupCommand(anyLong(), any());
+        try (MockedStatic<VolumeObject> volumeObjectMockedStatic = Mockito.mockStatic(VolumeObject.class)) {
+            when(VolumeObject.getVolumeObject(any(), any())).thenReturn(volumeObjectMock);
+
+            kbossBackupProviderSpy.mergeCurrentDeltaIntoVolume(volumeVoMock, virtualMachineMock, "detach", true);
+
+            verify(kbossBackupProviderSpy).sendBackupCommand(anyLong(), any());
+            verify(kbossBackupProviderSpy, never()).expungeOldDeltasAndUpdateVmSnapshotIfNeeded(anyList(), any());
+        }
+    }
+
+    @Test
+    public void mergeCurrentDeltaIntoVolumeTestNoSucceedingSnapshot() {
+        doReturn(volumeId).when(volumeVoMock).getId();
+        doReturn(internalBackupStoragePoolVoMock).when(internalBackupStoragePoolDaoMock).findOneByVolumeId(volumeId);
+        doReturn(backupId).when(internalBackupStoragePoolVoMock).getBackupId();
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(backupId);
+        doReturn(null).when(kbossBackupProviderSpy).getSucceedingVmSnapshot(internalBackupJoinVoMock);
+        doReturn(deltaMergeTreeToMock).when(kbossBackupProviderSpy).createDeltaMergeTree(anyBoolean(), anyBoolean(), any(), any(), any());
+        doReturn(answerMock).when(kbossBackupProviderSpy).sendBackupCommand(anyLong(), any());
+        doReturn(true).when(answerMock).getResult();
+        doReturn(volumeVoMock).when(volumeDaoMock).findById(anyLong());
+        doReturn(backupDeltaToMock).when(deltaMergeTreeToMock).getParent();
+        doNothing().when(kbossBackupProviderSpy).expungeOldDeltasAndUpdateVmSnapshotIfNeeded(anyList(), any());
+        doReturn(List.of()).when(internalBackupStoragePoolDaoMock).listByBackupId(backupId);
+        doNothing().when(kbossBackupProviderSpy).setEndOfChainAndRemoveCurrentForBackup(any());
+
+        try (MockedStatic<VolumeObject> volumeObjectMockedStatic = Mockito.mockStatic(VolumeObject.class)) {
+            when(VolumeObject.getVolumeObject(any(), any())).thenReturn(volumeObjectMock);
+
+            kbossBackupProviderSpy.mergeCurrentDeltaIntoVolume(volumeVoMock, virtualMachineMock, "detach", true);
+
+            verify(kbossBackupProviderSpy).sendBackupCommand(anyLong(), any());
+            verify(volumeDaoMock).update(volumeId, volumeVoMock);
+            verify(kbossBackupProviderSpy).expungeOldDeltasAndUpdateVmSnapshotIfNeeded(anyList(), any());
+            verify(kbossBackupProviderSpy).setEndOfChainAndRemoveCurrentForBackup(any());
+        }
+    }
+
+    @Test
+    public void mergeCurrentDeltaIntoVolumeTestWithSucceedingSnapshotWithMoreDeltas() {
+        doReturn(volumeId).when(volumeVoMock).getId();
+        doReturn(internalBackupStoragePoolVoMock).when(internalBackupStoragePoolDaoMock).findOneByVolumeId(volumeId);
+        doReturn(backupId).when(internalBackupStoragePoolVoMock).getBackupId();
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(backupId);
+        doReturn(vmSnapshotVoMock).when(kbossBackupProviderSpy).getSucceedingVmSnapshot(internalBackupJoinVoMock);
+        doReturn(deltaMergeTreeToMock).when(kbossBackupProviderSpy).createDeltaMergeTree(anyBoolean(), anyBoolean(), any(), any(), any());
+        doReturn(answerMock).when(kbossBackupProviderSpy).sendBackupCommand(anyLong(), any());
+        doReturn(true).when(answerMock).getResult();
+        doNothing().when(kbossBackupProviderSpy).expungeOldDeltasAndUpdateVmSnapshotIfNeeded(anyList(), any());
+        doReturn(List.of(internalBackupStoragePoolVoMock)).when(internalBackupStoragePoolDaoMock).listByBackupId(backupId);
+
+        try (MockedStatic<VolumeObject> volumeObjectMockedStatic = Mockito.mockStatic(VolumeObject.class)) {
+            when(VolumeObject.getVolumeObject(any(), any())).thenReturn(volumeObjectMock);
+
+            kbossBackupProviderSpy.mergeCurrentDeltaIntoVolume(volumeVoMock, virtualMachineMock, "detach", true);
+
+            verify(kbossBackupProviderSpy).sendBackupCommand(anyLong(), any());
+            verify(volumeDaoMock, never()).update(volumeId, volumeVoMock);
+            verify(kbossBackupProviderSpy).expungeOldDeltasAndUpdateVmSnapshotIfNeeded(anyList(), any());
+            verify(kbossBackupProviderSpy, never()).setEndOfChainAndRemoveCurrentForBackup(any());
+        }
+    }
+
+    @Test
+    public void getHostToRestoreTestNonQuickRestoreUsesRunningHost() throws AgentUnavailableException {
+        doReturn(vmId).when(virtualMachineMock).getId();
+        doReturn(77L).when(vmSnapshotHelperMock).pickRunningHost(vmId);
+        doReturn(hostVOMock).when(hostDaoMock).findByIdIncludingRemoved(77L);
+
+        HostVO result = kbossBackupProviderSpy.getHostToRestore(virtualMachineMock, false, null);
+
+        assertEquals(hostVOMock, result);
+        verify(vmSnapshotHelperMock, times(1)).pickRunningHost(vmId);
+        verify(hostDaoMock, times(1)).findByIdIncludingRemoved(77L);
+    }
+
+    @Test
+    public void getHostToRestoreTestQuickRestoreUsesProvidedHostId() throws AgentUnavailableException {
+        doReturn(Status.Up).when(hostVOMock).getStatus();
+        doReturn(false).when(hostVOMock).isInMaintenanceStates();
+        doReturn(ResourceState.Enabled).when(hostVOMock).getResourceState();
+        doReturn(hostVOMock).when(hostDaoMock).findByIdIncludingRemoved(55L);
+
+        HostVO result = kbossBackupProviderSpy.getHostToRestore(virtualMachineMock, true, 55L);
+
+        assertEquals(hostVOMock, result);
+        verify(vmSnapshotHelperMock, never()).pickRunningHost(anyLong());
+        verify(hostDaoMock, times(1)).findByIdIncludingRemoved(55L);
+    }
+
+    @Test
+    public void getHostToRestoreTestQuickRestoreUsesVmLastHostIdWhenHostIdIsNull() throws AgentUnavailableException {
+        doReturn(99L).when(virtualMachineMock).getLastHostId();
+        doReturn(Status.Up).when(hostVOMock).getStatus();
+        doReturn(false).when(hostVOMock).isInMaintenanceStates();
+        doReturn(ResourceState.Enabled).when(hostVOMock).getResourceState();
+        doReturn(hostVOMock).when(hostDaoMock).findByIdIncludingRemoved(99L);
+
+        HostVO result = kbossBackupProviderSpy.getHostToRestore(virtualMachineMock, true, null);
+
+        assertEquals(hostVOMock, result);
+        verify(hostDaoMock, times(1)).findByIdIncludingRemoved(99L);
+    }
+
+    @Test(expected = AgentUnavailableException.class)
+    public void getHostToRestoreTestQuickRestoreWithNoHostIdAndNoLastHostThrows() throws AgentUnavailableException {
+        doReturn(null).when(virtualMachineMock).getLastHostId();
+
+        kbossBackupProviderSpy.getHostToRestore(virtualMachineMock, true, null);
+    }
+
+    @Test(expected = AgentUnavailableException.class)
+    public void getHostToRestoreTestQuickRestoreWithHostDownThrows() throws AgentUnavailableException {
+        doReturn(Status.Down).when(hostVOMock).getStatus();
+        doReturn(hostVOMock).when(hostDaoMock).findByIdIncludingRemoved(55L);
+
+        kbossBackupProviderSpy.getHostToRestore(virtualMachineMock, true, 55L);
+    }
+
+    @Test(expected = AgentUnavailableException.class)
+    public void getHostToRestoreTestQuickRestoreWithHostInMaintenanceThrows() throws AgentUnavailableException {
+        doReturn(Status.Up).when(hostVOMock).getStatus();
+        doReturn(true).when(hostVOMock).isInMaintenanceStates();
+        doReturn(hostVOMock).when(hostDaoMock).findByIdIncludingRemoved(55L);
+
+        kbossBackupProviderSpy.getHostToRestore(virtualMachineMock, true, 55L);
+    }
+
+    @Test(expected = AgentUnavailableException.class)
+    public void getHostToRestoreTestQuickRestoreWithHostDisabledThrows() throws AgentUnavailableException {
+        doReturn(Status.Up).when(hostVOMock).getStatus();
+        doReturn(false).when(hostVOMock).isInMaintenanceStates();
+        doReturn(ResourceState.Disabled).when(hostVOMock).getResourceState();
+        doReturn(hostVOMock).when(hostDaoMock).findByIdIncludingRemoved(55L);
+
+        kbossBackupProviderSpy.getHostToRestore(virtualMachineMock, true, 55L);
+    }
+
+    @Test
+    public void gatherSnapshotReferencesOfChildrenSnapshotTestVmSnapshotIsNull() {
+        List<VolumeObjectTO> volumeObjectTOs = List.of(volumeObjectToMock);
+
+        Map<Long, List<SnapshotDataStoreVO>> result = kbossBackupProviderSpy.gatherSnapshotReferencesOfChildrenSnapshot(volumeObjectTOs, null);
+
+        assertTrue(result.isEmpty());
+        verify(vmSnapshotDaoMock, never()).listByParent(anyLong());
+        verify(vmSnapshotHelperMock, never()).getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(anyLong());
+        verify(kbossBackupProviderSpy, never()).mapVolumesToSnapshotReferences(anyList(), anyList(), anyMap());
+    }
+
+    @Test
+    public void gatherSnapshotReferencesOfChildrenSnapshotTestChildrenListIsEmpty() {
+        doReturn(100L).when(vmSnapshotVoMock).getId();
+        doReturn(List.of()).when(vmSnapshotDaoMock).listByParent(100L);
+
+        List<VolumeObjectTO> volumeObjectTOs = List.of(volumeObjectToMock);
+
+        Map<Long, List<SnapshotDataStoreVO>> result = kbossBackupProviderSpy.gatherSnapshotReferencesOfChildrenSnapshot(volumeObjectTOs, vmSnapshotVoMock);
+
+        assertTrue(result.isEmpty());
+        verify(vmSnapshotDaoMock, times(1)).listByParent(100L);
+        verify(vmSnapshotHelperMock, never()).getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(anyLong());
+        verify(kbossBackupProviderSpy, never()).mapVolumesToSnapshotReferences(anyList(), anyList(), anyMap());
+    }
+
+    @Test
+    public void gatherSnapshotReferencesOfChildrenSnapshotTestSingleChildWithSingleSnapshotReference() {
+        VMSnapshotVO childSnapshot = Mockito.mock(VMSnapshotVO.class);
+        SnapshotDataStoreVO snapshotDataStoreVO = Mockito.mock(SnapshotDataStoreVO.class);
+
+        doReturn(100L).when(vmSnapshotVoMock).getId();
+        doReturn(List.of(childSnapshot)).when(vmSnapshotDaoMock).listByParent(100L);
+        doReturn(200L).when(childSnapshot).getId();
+        doReturn(List.of(snapshotDataStoreVO)).when(vmSnapshotHelperMock).getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(200L);
+        doNothing().when(kbossBackupProviderSpy).mapVolumesToSnapshotReferences(anyList(), anyList(), anyMap());
+
+        List<VolumeObjectTO> volumeObjectTOs = List.of(volumeObjectToMock);
+
+        Map<Long, List<SnapshotDataStoreVO>> result =
+                kbossBackupProviderSpy.gatherSnapshotReferencesOfChildrenSnapshot(volumeObjectTOs, vmSnapshotVoMock);
+
+        assertTrue(result.isEmpty());
+        verify(vmSnapshotDaoMock, times(1)).listByParent(100L);
+        verify(vmSnapshotHelperMock, times(1)).getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(200L);
+        verify(kbossBackupProviderSpy, times(1)).mapVolumesToSnapshotReferences(eq(volumeObjectTOs), anyList(), anyMap());
+    }
+
+    @Test
+    public void gatherSnapshotReferencesOfChildrenSnapshotTestMultipleChildrenAggregatesSnapshotReferences() {
+        VMSnapshotVO childSnapshot1 = Mockito.mock(VMSnapshotVO.class);
+        VMSnapshotVO childSnapshot2 = Mockito.mock(VMSnapshotVO.class);
+        SnapshotDataStoreVO snapshotDataStoreVO1 = Mockito.mock(SnapshotDataStoreVO.class);
+        SnapshotDataStoreVO snapshotDataStoreVO2 = Mockito.mock(SnapshotDataStoreVO.class);
+
+        doReturn(100L).when(vmSnapshotVoMock).getId();
+        doReturn(List.of(childSnapshot1, childSnapshot2)).when(vmSnapshotDaoMock).listByParent(100L);
+        doReturn(201L).when(childSnapshot1).getId();
+        doReturn(202L).when(childSnapshot2).getId();
+        doReturn(List.of(snapshotDataStoreVO1)).when(vmSnapshotHelperMock)
+                .getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(201L);
+        doReturn(List.of(snapshotDataStoreVO2)).when(vmSnapshotHelperMock)
+                .getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(202L);
+        doNothing().when(kbossBackupProviderSpy).mapVolumesToSnapshotReferences(anyList(), anyList(), anyMap());
+
+        List<VolumeObjectTO> volumeObjectTOs = List.of(volumeObjectToMock);
+
+        Map<Long, List<SnapshotDataStoreVO>> result =
+                kbossBackupProviderSpy.gatherSnapshotReferencesOfChildrenSnapshot(volumeObjectTOs, vmSnapshotVoMock);
+
+        assertTrue(result.isEmpty());
+        verify(vmSnapshotHelperMock, times(1)).getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(201L);
+        verify(vmSnapshotHelperMock, times(1)).getVolumeSnapshotsAssociatedWithKvmDiskOnlyVmSnapshot(202L);
+        verify(kbossBackupProviderSpy, times(1)).mapVolumesToSnapshotReferences(eq(volumeObjectTOs), anyList(), anyMap());
+    }
+
+    @Test
+    public void createDeltaMergeTreeTestChildIsVolumeWithoutSucceedingSnapshot() {
+        doReturn(dataStoreMock).when(dataStoreManagerMock).getDataStore(anyLong(), eq(DataStoreRole.Primary));
+        doReturn("parent-path").when(internalBackupStoragePoolVoMock).getBackupDeltaParentPath();
+
+        DeltaMergeTreeTO result = kbossBackupProviderSpy.createDeltaMergeTree(true, true, internalBackupStoragePoolVoMock,
+                volumeObjectToMock, null);
+
+        assertEquals(volumeObjectToMock, result.getVolumeObjectTO());
+        assertTrue(result.getGrandChildren().isEmpty());
+        assertEquals(volumeObjectToMock, result.getChild());
+        assertEquals("parent-path", result.getParent().getPath());
+    }
+
+    @Test
+    public void createDeltaMergeTreeTestChildIsDeltaWithoutSucceedingSnapshot() {
+        doReturn(dataStoreMock).when(dataStoreManagerMock).getDataStore(anyLong(), eq(DataStoreRole.Primary));
+        doReturn("parent-path").when(internalBackupStoragePoolVoMock).getBackupDeltaParentPath();
+        doReturn("child-path").when(internalBackupStoragePoolVoMock).getBackupDeltaPath();
+
+        DeltaMergeTreeTO result = kbossBackupProviderSpy.createDeltaMergeTree(false, true, internalBackupStoragePoolVoMock,
+                volumeObjectToMock, null);
+
+        assertEquals(volumeObjectToMock, result.getVolumeObjectTO());
+        assertEquals("parent-path", result.getParent().getPath());
+        assertEquals("child-path", result.getChild().getPath());
+        assertTrue(result.getGrandChildren().isEmpty());
+    }
+
+    @Test
+    public void createDeltaMergeTreeTestChildIsDeltaWithSucceedingSnapshotReferences() {
+        SnapshotDataStoreVO snapshotRefMock = Mockito.mock(SnapshotDataStoreVO.class);
+
+        doReturn(dataStoreMock).when(dataStoreManagerMock).getDataStore(anyLong(), eq(DataStoreRole.Primary));
+        doReturn("parent-path").when(internalBackupStoragePoolVoMock).getBackupDeltaParentPath();
+        doReturn("child-path").when(internalBackupStoragePoolVoMock).getBackupDeltaPath();
+        doReturn(volumeId).when(volumeObjectToMock).getVolumeId();
+        doReturn("snapshot-grandchild").when(snapshotRefMock).getInstallPath();
+
+        doReturn(Map.of(volumeId, List.of(snapshotRefMock))).when(kbossBackupProviderSpy).gatherSnapshotReferencesOfChildrenSnapshot(List.of(volumeObjectToMock), vmSnapshotVoMock);
+
+        DeltaMergeTreeTO result = kbossBackupProviderSpy.createDeltaMergeTree(false, true, internalBackupStoragePoolVoMock,
+                volumeObjectToMock, vmSnapshotVoMock);
+
+        assertEquals("child-path", result.getChild().getPath());
+        assertEquals(1, result.getGrandChildren().size());
+        assertEquals("snapshot-grandchild", result.getGrandChildren().get(0).getPath());
+    }
+
+    @Test
+    public void createDeltaMergeTreeTestChildIsDeltaWithSucceedingSnapshotButNoReferencesRebasesToVolumePath() {
+        doReturn(dataStoreMock).when(dataStoreManagerMock).getDataStore(anyLong(), eq(DataStoreRole.Primary));
+        doReturn("parent-path").when(internalBackupStoragePoolVoMock).getBackupDeltaParentPath();
+        doReturn("child-path").when(internalBackupStoragePoolVoMock).getBackupDeltaPath();
+        doReturn("/volume/path").when(volumeObjectToMock).getPath();
+
+        doReturn(Map.of()).when(kbossBackupProviderSpy)
+                .gatherSnapshotReferencesOfChildrenSnapshot(List.of(volumeObjectToMock), vmSnapshotVoMock);
+
+        DeltaMergeTreeTO result = kbossBackupProviderSpy.createDeltaMergeTree(false, false, internalBackupStoragePoolVoMock,
+                volumeObjectToMock, vmSnapshotVoMock);
+
+        assertEquals(1, result.getGrandChildren().size());
+        assertEquals("/volume/path", result.getGrandChildren().get(0).getPath());
+    }
+
+    @Test
+    public void generateBackupAndVolumePairsToRestoreTestSameVmAsBackupMatchesByVolumeId() {
+        doReturn(77L).when(internalBackupJoinVoMock).getImageStoreId();
+        doReturn(dataStoreMock).when(dataStoreManagerMock).getDataStore(77L, DataStoreRole.Image);
+        doReturn(10L).when(internalBackupDataStoreVoMock).getVolumeId();
+        doReturn("delta-path").when(internalBackupDataStoreVoMock).getBackupPath();
+        doReturn(10L).when(volumeObjectToMock).getVolumeId();
+
+        Set<Pair<BackupDeltaTO, VolumeObjectTO>> result = kbossBackupProviderSpy.generateBackupAndVolumePairsToRestore(List.of(internalBackupDataStoreVoMock),
+                List.of(volumeObjectToMock), internalBackupJoinVoMock, true);
+
+        assertEquals(1, result.size());
+        Pair<BackupDeltaTO, VolumeObjectTO> pair = result.iterator().next();
+        assertEquals(volumeObjectToMock, pair.second());
+        assertEquals("delta-path", pair.first().getPath());
+    }
+
+    @Test
+    public void generateBackupAndVolumePairsToRestoreTestDifferentVmMatchesByDeviceId() {
+        doReturn(77L).when(internalBackupJoinVoMock).getImageStoreId();
+        doReturn(dataStoreMock).when(dataStoreManagerMock).getDataStore(77L, DataStoreRole.Image);
+        doReturn(5L).when(internalBackupDataStoreVoMock).getDeviceId();
+        doReturn("delta-path").when(internalBackupDataStoreVoMock).getBackupPath();
+        doReturn(5L).when(volumeObjectToMock).getDeviceId();
+
+        Set<Pair<BackupDeltaTO, VolumeObjectTO>> result = kbossBackupProviderSpy.generateBackupAndVolumePairsToRestore(List.of(internalBackupDataStoreVoMock),
+                List.of(volumeObjectToMock), internalBackupJoinVoMock, false);
+
+        assertEquals(1, result.size());
+        Pair<BackupDeltaTO, VolumeObjectTO> pair = result.iterator().next();
+        assertEquals(volumeObjectToMock, pair.second());
+        assertEquals("delta-path", pair.first().getPath());
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void generateBackupAndVolumePairsToRestoreTestThrowsWhenNoMatchingVolumeExists() {
+        doReturn(77L).when(internalBackupJoinVoMock).getImageStoreId();
+        doReturn(dataStoreMock).when(dataStoreManagerMock).getDataStore(77L, DataStoreRole.Image);
+        doReturn(10L).when(internalBackupDataStoreVoMock).getVolumeId();
+        doReturn(123L).when(internalBackupDataStoreVoMock).getId();
+
+        kbossBackupProviderSpy.generateBackupAndVolumePairsToRestore(List.of(internalBackupDataStoreVoMock), List.of(volumeObjectToMock), internalBackupJoinVoMock, true);
+    }
+
+    @Test
+    public void populateDeltasToRemoveAndToMergeAndUpdateVolumePathsTestVolumeIsPartOfBackupAddsDeltaToRemoveAndUpdatesPath() {
+        doReturn(dataStoreMock).when(dataStoreManagerMock).getDataStore(11L, DataStoreRole.Primary);
+        doReturn(10L).when(internalBackupStoragePoolVoMock).getVolumeId();
+        doReturn(11L).when(internalBackupStoragePoolVoMock).getStoragePoolId();
+        doReturn("delta-path").when(internalBackupStoragePoolVoMock).getBackupDeltaPath();
+        doReturn("parent-path").when(internalBackupStoragePoolVoMock).getBackupDeltaParentPath();
+        doReturn(10L).when(volumeObjectToMock).getVolumeId();
+
+        Set<BackupDeltaTO> deltasToRemove = new java.util.HashSet<>();
+
+        List<DeltaMergeTreeTO> result = kbossBackupProviderSpy.populateDeltasToRemoveAndToMergeAndUpdateVolumePaths(List.of(internalBackupStoragePoolVoMock), deltasToRemove,
+                List.of(volumeObjectToMock), List.of(), "vm-uuid");
+
+        assertTrue(result.isEmpty());
+        assertEquals(1, deltasToRemove.size());
+        verify(volumeObjectToMock, times(1)).setPath("parent-path");
+        verify(dataStoreManagerMock, times(1)).getDataStore(11L, DataStoreRole.Primary);
+    }
+
+    @Test
+    public void populateDeltasToRemoveAndToMergeAndUpdateVolumePathsTestVolumeIsPartOfBackupCreatesMergeTree() {
+        doReturn(volumeId).when(internalBackupStoragePoolVoMock).getVolumeId();
+        doReturn(volumeId).when(volumeObjectToMock).getVolumeId();
+
+        Set<BackupDeltaTO> deltasToRemove = new java.util.HashSet<>();
+
+        doReturn(deltaMergeTreeToMock).when(kbossBackupProviderSpy).createDeltaMergeTree(true, false, internalBackupStoragePoolVoMock, volumeObjectToMock, null);
+
+        List<DeltaMergeTreeTO> result = kbossBackupProviderSpy.populateDeltasToRemoveAndToMergeAndUpdateVolumePaths(List.of(internalBackupStoragePoolVoMock), deltasToRemove,
+                List.of(volumeObjectToMock), List.of(volumeObjectToMock), "vm-uuid");
+
+        assertEquals(List.of(deltaMergeTreeToMock), result);
+        assertTrue(deltasToRemove.isEmpty());
+        verify(kbossBackupProviderSpy, times(1)).createDeltaMergeTree(true, false, internalBackupStoragePoolVoMock, volumeObjectToMock, null);
+        verify(dataStoreManagerMock, never()).getDataStore(anyLong(), eq(DataStoreRole.Primary));
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void populateDeltasToRemoveAndToMergeAndUpdateVolumePathsTestThrowsWhenNoMatchingVolumeExists() {
+        kbossBackupProviderSpy.populateDeltasToRemoveAndToMergeAndUpdateVolumePaths(List.of(internalBackupStoragePoolVoMock), Set.of(), List.of(), List.of(), "vm-uuid");
+    }
+
+    @Test
+    public void updateVolumePathsAndSizeIfNeededTestUpdatesPathAndSizeWhenVolumePathChanged() {
+        doReturn(List.of(volumeVoMock)).when(volumeDaoMock).findByInstance(vmId);
+        doReturn(volumeId).when(volumeVoMock).getId();
+        doReturn("old-path").when(volumeVoMock).getPath();
+        doReturn(5L).when(volumeVoMock).getDeviceId();
+        doReturn(100L).when(volumeVoMock).getSize();
+        doReturn(volumeId).when(volumeObjectToMock).getVolumeId();
+        doReturn("new-path").when(volumeObjectToMock).getPath();
+        doReturn(150L).when(backupVolumeInfoMock).getSize();
+        doReturn(5L).when(backupVolumeInfoMock).getDeviceId();
+
+        kbossBackupProviderSpy.updateVolumePathsAndSizeIfNeeded(virtualMachineMock, List.of(volumeObjectToMock), List.of(backupVolumeInfoMock), List.of(), false);
+
+        verify(volumeVoMock).setPath("new-path");
+        verify(volumeVoMock).setSize(150L);
+        verify(volumeDaoMock).update(volumeId, volumeVoMock);
+    }
+
+    @Test
+    public void updateVolumePathsAndSizeIfNeededTestUsesMergeTreeParentPathWhenVolumePathDidNotChange() {
+        doReturn(List.of(volumeVoMock)).when(volumeDaoMock).findByInstance(vmId);
+        doReturn(volumeId).when(volumeVoMock).getId();
+        doReturn("same-path").when(volumeVoMock).getPath();
+        doReturn(5L).when(volumeVoMock).getDeviceId();
+        doReturn(100L).when(volumeVoMock).getSize();
+        doReturn("same-path").when(volumeObjectToMock).getPath();
+        doReturn(volumeId).when(volumeObjectToMock).getId();
+        doReturn(volumeId).when(volumeObjectToMock).getVolumeId();
+        doReturn(150L).when(backupVolumeInfoMock).getSize();
+        doReturn(5L).when(backupVolumeInfoMock).getDeviceId();
+        doReturn(volumeObjectToMock).when(deltaMergeTreeToMock).getChild();
+        doReturn(backupDeltaToMock).when(deltaMergeTreeToMock).getParent();
+        doReturn("parent-path").when(backupDeltaToMock).getPath();
+
+        kbossBackupProviderSpy.updateVolumePathsAndSizeIfNeeded(virtualMachineMock, List.of(volumeObjectToMock), List.of(backupVolumeInfoMock), List.of(deltaMergeTreeToMock),
+                false);
+
+        verify(volumeVoMock).setPath("parent-path");
+        verify(volumeVoMock).setSize(150L);
+        verify(volumeDaoMock).update(volumeId, volumeVoMock);
+    }
+
+    @Test
+    public void updateVolumePathsAndSizeIfNeededTestLeavesSizeUntouchedWhenRestoreSizeMatchesCurrentSize() {
+        doReturn(List.of(volumeVoMock)).when(volumeDaoMock).findByInstance(vmId);
+        doReturn(vmId).when(virtualMachineMock).getId();
+        doReturn(volumeId).when(volumeVoMock).getId();
+        doReturn("same-path").when(volumeVoMock).getPath();
+        doReturn(5L).when(volumeVoMock).getDeviceId();
+        doReturn(100L).when(volumeVoMock).getSize();
+        doReturn(volumeId).when(volumeObjectToMock).getVolumeId();
+        doReturn("same-path").when(volumeObjectToMock).getPath();
+        doReturn(100L).when(backupVolumeInfoMock).getSize();
+        doReturn(5L).when(backupVolumeInfoMock).getDeviceId();
+
+        kbossBackupProviderSpy.updateVolumePathsAndSizeIfNeeded(virtualMachineMock, List.of(volumeObjectToMock), List.of(backupVolumeInfoMock), List.of(), false);
+
+        verify(volumeVoMock, never()).setSize(anyLong());
+        verify(volumeDaoMock).update(volumeId, volumeVoMock);
+    }
+
+    @Test
+    public void updateVolumePathsAndSizeIfNeededTestMatchesByUuidWhenSameVmAsBackup() {
+        doReturn(List.of(volumeVoMock)).when(volumeDaoMock).findByInstance(vmId);
+        doReturn(vmId).when(virtualMachineMock).getId();
+        doReturn(volumeId).when(volumeVoMock).getId();
+        doReturn("same-path").when(volumeVoMock).getPath();
+        doReturn("vm-uuid").when(volumeVoMock).getUuid();
+        doReturn(100L).when(volumeVoMock).getSize();
+        doReturn(volumeId).when(volumeObjectToMock).getVolumeId();
+        doReturn("same-path").when(volumeObjectToMock).getPath();
+        doReturn("vm-uuid").when(backupVolumeInfoMock).getUuid();
+        doReturn(120L).when(backupVolumeInfoMock).getSize();
+
+        kbossBackupProviderSpy.updateVolumePathsAndSizeIfNeeded(virtualMachineMock, List.of(volumeObjectToMock), List.of(backupVolumeInfoMock), List.of(), true);
+
+        verify(volumeVoMock).setSize(120L);
+        verify(volumeDaoMock).update(volumeId, volumeVoMock);
+    }
+
+
+    @Test
+    public void processRemoveBackupFailuresTestNoFailuresReturnsTrueAndRemovesNothing() {
+        doReturn(backupId).when(internalBackupJoinVoMock).getId();
+
+        Answer[] deleteAnswers = new Answer[] {answerMock};
+        doReturn(true).when(answerMock).getResult();
+
+        List<Long> removedBackupIds = new ArrayList<>(List.of(backupId, 200L));
+
+        boolean result = kbossBackupProviderSpy.processRemoveBackupFailures(false, deleteAnswers, removedBackupIds, internalBackupJoinVoMock);
+
+        assertTrue(result);
+        assertEquals(List.of(backupId, 200L), removedBackupIds);
+        verify(backupDaoMock, never()).findByIdIncludingRemoved(anyLong());
+        verify(backupDaoMock, never()).update(anyLong(), any());
+    }
+
+    @Test
+    public void processRemoveBackupFailuresTestFailureOnCurrentBackupNotForcedSetsError() {
+        doReturn(backupId).when(internalBackupJoinVoMock).getId();
+
+        BackupDeleteAnswer failedCurrentBackupAnswer = Mockito.mock(BackupDeleteAnswer.class);
+        doReturn(false).when(failedCurrentBackupAnswer).getResult();
+        doReturn(backupId).when(failedCurrentBackupAnswer).getBackupId();
+        doReturn("delete failed").when(failedCurrentBackupAnswer).getDetails();
+
+        doReturn(backupId).when(backupVoMock).getId();
+        doReturn(backupVoMock).when(backupDaoMock).findByIdIncludingRemoved(backupId);
+
+        List<Long> removedBackupIds = new ArrayList<>(List.of(backupId, 200L));
+
+        boolean result = kbossBackupProviderSpy.processRemoveBackupFailures(false, new Answer[]{failedCurrentBackupAnswer}, removedBackupIds, internalBackupJoinVoMock);
+
+        assertFalse(result);
+        assertEquals(List.of(200L), removedBackupIds);
+        verify(backupVoMock).setStatus(Backup.Status.Error);
+        verify(backupDaoMock).update(backupId, backupVoMock);
+        verify(backupDaoMock, never()).findByIdIncludingRemoved(200L);
+    }
+
+    @Test
+    public void processRemoveBackupFailuresTestFailureOnCurrentBackupForcedSetBackupAsExpunged() {
+        BackupDeleteAnswer failedCurrentBackupAnswer = Mockito.mock(BackupDeleteAnswer.class);
+        doReturn(false).when(failedCurrentBackupAnswer).getResult();
+        doReturn(backupId).when(failedCurrentBackupAnswer).getBackupId();
+        doReturn("delete failed").when(failedCurrentBackupAnswer).getDetails();
+        doReturn(backupVoMock).when(backupDaoMock).findByIdIncludingRemoved(backupId);
+
+        List<Long> removedBackupIds = new ArrayList<>(List.of(backupId, 200L));
+
+        boolean result = kbossBackupProviderSpy.processRemoveBackupFailures(true, new Answer[]{failedCurrentBackupAnswer}, removedBackupIds, internalBackupJoinVoMock);
+
+        assertFalse(result);
+        assertEquals(List.of(200L), removedBackupIds);
+        verify(backupVoMock).setStatus(Backup.Status.Expunged);
+        verify(backupDaoMock).update(backupId, backupVoMock);
+        verify(backupDaoMock, never()).findByIdIncludingRemoved(200L);
+    }
+
+    @Test
+    public void processRemoveBackupFailuresTestFailureOnOtherBackupMarksItExpunged() {
+        doReturn(backupId).when(internalBackupJoinVoMock).getId();
+
+        BackupDeleteAnswer failedOtherBackupAnswer = Mockito.mock(BackupDeleteAnswer.class);
+        doReturn(false).when(failedOtherBackupAnswer).getResult();
+        doReturn(200L).when(failedOtherBackupAnswer).getBackupId();
+        doReturn("delete failed").when(failedOtherBackupAnswer).getDetails();
+
+        BackupVO failedBackup = Mockito.mock(BackupVO.class);
+        doReturn(failedBackup).when(backupDaoMock).findByIdIncludingRemoved(200L);
+
+        List<Long> removedBackupIds = new ArrayList<>(List.of(backupId, 200L));
+
+        boolean result = kbossBackupProviderSpy.processRemoveBackupFailures(false, new Answer[]{failedOtherBackupAnswer}, removedBackupIds, internalBackupJoinVoMock);
+
+        assertFalse(result);
+        assertEquals(List.of(backupId), removedBackupIds);
+        verify(failedBackup).setStatus(Backup.Status.Expunged);
+        verify(backupDaoMock).update(200L, failedBackup);
+        verify(backupDaoMock, never()).findByIdIncludingRemoved(backupId);
+    }
+
+    @Test
+    public void processValidationAnswerTestNullAnswer() {
+        doNothing().when(kbossBackupProviderSpy).setBackupAsInvalidAndSendAlert(eq(backupVoMock), any());
+
+        boolean result = kbossBackupProviderSpy.processValidationAnswer(null, backupVoMock, userVmVOMock, hostVOMock, null);
+
+        assertFalse(result);
+        verify(kbossBackupProviderSpy).setBackupAsInvalidAndSendAlert(eq(backupVoMock), contains("Null answer from host"));
+    }
+
+    @Test
+    public void processValidationAnswerTestFalseAnswer() {
+        doNothing().when(kbossBackupProviderSpy).setBackupAsInvalidAndSendAlert(eq(backupVoMock), any());
+
+        doReturn(false).when(answerMock).getResult();
+        doReturn("fail-reason").when(answerMock).getDetails();
+        boolean result = kbossBackupProviderSpy.processValidationAnswer(answerMock, backupVoMock, userVmVOMock, hostVOMock, null);
+
+        assertFalse(result);
+        verify(kbossBackupProviderSpy).setBackupAsInvalidAndSendAlert(eq(backupVoMock), contains("fail-reason"));
+    }
+
+    @Test
+    public void processValidationAnswerTestBootNotValidated() {
+        doNothing().when(kbossBackupProviderSpy).setBackupAsInvalidAndSendAlert(eq(backupVoMock), any());
+
+        ValidateKbossVmAnswer answer = Mockito.mock(ValidateKbossVmAnswer.class);
+        doReturn(true).when(answer).getResult();
+        doReturn(false).when(answer).isBootValidated();
+
+        ValidateKbossVmCommand cmd = Mockito.mock(ValidateKbossVmCommand.class);
+        doReturn(true).when(cmd).isWaitForBoot();
+
+        boolean result = kbossBackupProviderSpy.processValidationAnswer(answer, backupVoMock, userVmVOMock, hostVOMock, cmd);
+
+        assertFalse(result);
+        verify(kbossBackupProviderSpy).setBackupAsInvalidAndSendAlert(eq(backupVoMock), contains("The VM did not boot within the expected time"));
+    }
+
+    @Test
+    public void processValidationAnswerTestBootNotValidatedScriptResultFalse() {
+        doNothing().when(kbossBackupProviderSpy).setBackupAsInvalidAndSendAlert(eq(backupVoMock), any());
+
+        ValidateKbossVmAnswer answer = Mockito.mock(ValidateKbossVmAnswer.class);
+        doReturn(true).when(answer).getResult();
+        doReturn(false).when(answer).isBootValidated();
+        doReturn("false").when(answer).getScriptResult();
+
+        ValidateKbossVmCommand cmd = Mockito.mock(ValidateKbossVmCommand.class);
+        doReturn(true).when(cmd).isWaitForBoot();
+        doReturn(true).when(cmd).isExecuteScript();
+
+        boolean result = kbossBackupProviderSpy.processValidationAnswer(answer, backupVoMock, userVmVOMock, hostVOMock, cmd);
+
+        assertFalse(result);
+        verify(kbossBackupProviderSpy).setBackupAsInvalidAndSendAlert(eq(backupVoMock), contains("The VM did not boot within the expected time"));
+        verify(kbossBackupProviderSpy).setBackupAsInvalidAndSendAlert(eq(backupVoMock), contains("The script did not output the expected output."));
+    }
+
+    @Test
+    public void processValidationAnswerTestBootNotValidatedScriptResultFalseScreenshotPathNull() {
+        doNothing().when(kbossBackupProviderSpy).setBackupAsInvalidAndSendAlert(eq(backupVoMock), any());
+
+        ValidateKbossVmAnswer answer = Mockito.mock(ValidateKbossVmAnswer.class);
+        doReturn(true).when(answer).getResult();
+        doReturn(false).when(answer).isBootValidated();
+        doReturn("false").when(answer).getScriptResult();
+        doReturn(null).when(answer).getScreenshotPath();
+
+        ValidateKbossVmCommand cmd = Mockito.mock(ValidateKbossVmCommand.class);
+        doReturn(true).when(cmd).isWaitForBoot();
+        doReturn(true).when(cmd).isExecuteScript();
+        doReturn(true).when(cmd).isTakeScreenshot();
+
+        boolean result = kbossBackupProviderSpy.processValidationAnswer(answer, backupVoMock, userVmVOMock, hostVOMock, cmd);
+
+        assertFalse(result);
+        verify(kbossBackupProviderSpy).setBackupAsInvalidAndSendAlert(eq(backupVoMock), contains("The VM did not boot within the expected time"));
+        verify(kbossBackupProviderSpy).setBackupAsInvalidAndSendAlert(eq(backupVoMock), contains("The script did not output the expected output."));
+        verify(kbossBackupProviderSpy).setBackupAsInvalidAndSendAlert(eq(backupVoMock), contains("We were unable to take a screenshot of the VM."));
+    }
+
+    @Test
+    public void processValidationAnswerTestBootValidatedScriptResultTrueScreenshotPathNotNull() {
+        ValidateKbossVmAnswer answer = Mockito.mock(ValidateKbossVmAnswer.class);
+        doReturn(true).when(answer).getResult();
+        doReturn(true).when(answer).isBootValidated();
+        doReturn(null).when(answer).getScriptResult();
+        doReturn("snap-path").when(answer).getScreenshotPath();
+
+        ValidateKbossVmCommand cmd = Mockito.mock(ValidateKbossVmCommand.class);
+        doReturn(true).when(cmd).isWaitForBoot();
+        doReturn(true).when(cmd).isExecuteScript();
+        doReturn(true).when(cmd).isTakeScreenshot();
+
+        boolean result = kbossBackupProviderSpy.processValidationAnswer(answer, backupVoMock, userVmVOMock, hostVOMock, cmd);
+
+        assertTrue(result);
+        verify(kbossBackupProviderSpy, never()).setBackupAsInvalidAndSendAlert(any(), any());
+        verify(backupDetailDaoMock).addDetail(eq(backupId), eq(BackupDetailsDao.SCREENSHOT_PATH), eq("snap-path"), eq(false));
+    }
+
+    @Test
+    public void getParentsToBeExpungedWithBackupAndAddThemToListOfDeleteCommandsTestNoParents() {
+        doReturn(List.of()).when(kbossBackupProviderSpy).getBackupJoinParents(backupVoMock, true);
+
+        Pair<List<InternalBackupJoinVO>, InternalBackupJoinVO> result =
+                kbossBackupProviderSpy.getParentsToBeExpungedWithBackupAndAddThemToListOfDeleteCommands(backupVoMock, new Commands(Command.OnError.Stop));
+
+        assertEquals(List.of(), result.first());
+        assertNull(result.second());
+    }
+
+    @Test
+    public void getParentsToBeExpungedWithBackupAndAddThemToListOfDeleteCommandsTestAliveParents() {
+        doReturn(List.of(internalBackupJoinVoMock)).when(kbossBackupProviderSpy).getBackupJoinParents(backupVoMock, true);
+        doReturn(Backup.Status.BackedUp).when(internalBackupJoinVoMock).getStatus();
+
+        Pair<List<InternalBackupJoinVO>, InternalBackupJoinVO> result =
+                kbossBackupProviderSpy.getParentsToBeExpungedWithBackupAndAddThemToListOfDeleteCommands(backupVoMock, new Commands(Command.OnError.Stop));
+
+        assertEquals(List.of(), result.first());
+        assertEquals(internalBackupJoinVoMock, result.second());
+    }
+
+    @Test
+    public void getParentsToBeExpungedWithBackupAndAddThemToListOfDeleteCommandsTestDeadParents() {
+        InternalBackupJoinVO deadParent = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(Backup.Status.Removed).when(deadParent).getStatus();
+        doReturn(backupId).when(deadParent).getId();
+
+        doReturn(List.of(deadParent)).when(kbossBackupProviderSpy).getBackupJoinParents(backupVoMock, true);
+        doReturn(null).when(kbossBackupProviderSpy).addBackupDeltasToDeleteCommand(anyLong(), any());
+        Commands commands = new Commands(Command.OnError.Stop);
+
+        Pair<List<InternalBackupJoinVO>, InternalBackupJoinVO> result =
+                kbossBackupProviderSpy.getParentsToBeExpungedWithBackupAndAddThemToListOfDeleteCommands(backupVoMock, commands);
+
+        assertEquals(List.of(deadParent), result.first());
+        assertNull(result.second());
+        verify(kbossBackupProviderSpy).addBackupDeltasToDeleteCommand(backupId, commands);
+    }
+
+    @Test
+    public void getParentsToBeExpungedWithBackupAndAddThemToListOfDeleteCommandsTestDeadAndAliveParents() {
+        InternalBackupJoinVO deadParent = Mockito.mock(InternalBackupJoinVO.class);
+        doReturn(Backup.Status.Removed).when(deadParent).getStatus();
+        doReturn(backupId).when(deadParent).getId();
+
+        doReturn(List.of(deadParent, internalBackupJoinVoMock)).when(kbossBackupProviderSpy).getBackupJoinParents(backupVoMock, true);
+        doReturn(Backup.Status.BackedUp).when(internalBackupJoinVoMock).getStatus();
+        doReturn(null).when(kbossBackupProviderSpy).addBackupDeltasToDeleteCommand(anyLong(), any());
+        Commands commands = new Commands(Command.OnError.Stop);
+
+        Pair<List<InternalBackupJoinVO>, InternalBackupJoinVO> result =
+                kbossBackupProviderSpy.getParentsToBeExpungedWithBackupAndAddThemToListOfDeleteCommands(backupVoMock, commands);
+
+        assertEquals(List.of(deadParent), result.first());
+        assertEquals(internalBackupJoinVoMock, result.second());
+        verify(kbossBackupProviderSpy).addBackupDeltasToDeleteCommand(backupId, commands);
+    }
+
+    @Test
+    public void configureValidationStepsTestScreenshot() {
+        long backupOfferingId = 32L;
+
+        doReturn(backupOfferingId).when(backupVoMock).getBackupOfferingId();
+        doReturn(backupOfferingId).when(backupOfferingMock).getId();
+        doReturn(backupOfferingMock).when(backupOfferingDaoMock).findByIdIncludingRemoved(backupOfferingId);
+        doReturn(backupOfferingDetailsVoMock).when(backupOfferingDetailsDaoMock).findDetail(backupOfferingId, ApiConstants.VALIDATION_STEPS);
+        doReturn("screenshot").when(backupOfferingDetailsVoMock).getValue();
+
+        ValidateKbossVmCommand cmd = new ValidateKbossVmCommand(null, null);
+
+        kbossBackupProviderSpy.configureValidationSteps(cmd, backupVoMock);
+
+        assertTrue(cmd.isTakeScreenshot());
+        assertFalse(cmd.isWaitForBoot());
+        assertFalse(cmd.isExecuteScript());
+    }
+
+    @Test
+    public void configureValidationStepsTestWaitForBoot() {
+        long backupOfferingId = 32L;
+
+        doReturn(backupOfferingId).when(backupVoMock).getBackupOfferingId();
+        doReturn(backupOfferingId).when(backupOfferingMock).getId();
+        doReturn(backupOfferingMock).when(backupOfferingDaoMock).findByIdIncludingRemoved(backupOfferingId);
+        doReturn(backupOfferingDetailsVoMock).when(backupOfferingDetailsDaoMock).findDetail(backupOfferingId, ApiConstants.VALIDATION_STEPS);
+        doReturn("wait_for_boot").when(backupOfferingDetailsVoMock).getValue();
+
+        ValidateKbossVmCommand cmd = new ValidateKbossVmCommand(null, null);
+
+        kbossBackupProviderSpy.configureValidationSteps(cmd, backupVoMock);
+
+        assertFalse(cmd.isTakeScreenshot());
+        assertTrue(cmd.isWaitForBoot());
+        assertFalse(cmd.isExecuteScript());
+    }
+
+    @Test
+    public void configureValidationStepsTestExecuteCommand() {
+        long backupOfferingId = 32L;
+
+        doReturn(backupOfferingId).when(backupVoMock).getBackupOfferingId();
+        doReturn(backupOfferingId).when(backupOfferingMock).getId();
+        doReturn(backupOfferingMock).when(backupOfferingDaoMock).findByIdIncludingRemoved(backupOfferingId);
+        doReturn(backupOfferingDetailsVoMock).when(backupOfferingDetailsDaoMock).findDetail(backupOfferingId, ApiConstants.VALIDATION_STEPS);
+        doReturn("execute_command").when(backupOfferingDetailsVoMock).getValue();
+        doReturn(vmInstanceDetailVoMock).when(vmInstanceDetailsDaoMock).findDetail(vmId, VmDetailConstants.VALIDATION_COMMAND);
+        doReturn(vmId).when(backupVoMock).getVmId();
+
+        ValidateKbossVmCommand cmd = new ValidateKbossVmCommand(null, null);
+
+        kbossBackupProviderSpy.configureValidationSteps(cmd, backupVoMock);
+
+        assertFalse(cmd.isTakeScreenshot());
+        assertFalse(cmd.isWaitForBoot());
+        assertTrue(cmd.isExecuteScript());
+    }
+
+    @Test
+    public void configureValidationStepsTestAllSteps() {
+        long backupOfferingId = 32L;
+
+        doReturn(backupOfferingId).when(backupVoMock).getBackupOfferingId();
+        doReturn(backupOfferingId).when(backupOfferingMock).getId();
+        doReturn(backupOfferingMock).when(backupOfferingDaoMock).findByIdIncludingRemoved(backupOfferingId);
+        doReturn(backupOfferingDetailsVoMock).when(backupOfferingDetailsDaoMock).findDetail(backupOfferingId, ApiConstants.VALIDATION_STEPS);
+        doReturn("screenshot,wait_for_boot,execute_command").when(backupOfferingDetailsVoMock).getValue();
+        doReturn(vmInstanceDetailVoMock).when(vmInstanceDetailsDaoMock).findDetail(vmId, VmDetailConstants.VALIDATION_COMMAND);
+        doReturn(vmId).when(backupVoMock).getVmId();
+
+        ValidateKbossVmCommand cmd = new ValidateKbossVmCommand(null, null);
+
+        kbossBackupProviderSpy.configureValidationSteps(cmd, backupVoMock);
+
+        assertTrue(cmd.isTakeScreenshot());
+        assertTrue(cmd.isWaitForBoot());
+        assertTrue(cmd.isExecuteScript());
+    }
+
+    @Test
+    public void validateCompressionStateForRestoreAndGetBackupTestUnableToLock() {
+        doReturn(null).when(kbossBackupProviderSpy).lockBackup(backupId);
+
+        Pair<Boolean, BackupVO> result = kbossBackupProviderSpy.validateCompressionStateForRestoreAndGetBackup(backupId);
+
+        assertFalse(result.first());
+        verify(kbossBackupProviderSpy, never()).releaseBackup(backupId);
+    }
+
+    @Test
+    public void validateCompressionStateForRestoreAndGetBackupTestFinalizingCompression() {
+        doReturn(backupVoMock).when(kbossBackupProviderSpy).lockBackup(backupId);
+        doReturn(Backup.CompressionStatus.FinalizingCompression).when(backupVoMock).getCompressionStatus();
+
+        Pair<Boolean, BackupVO> result = kbossBackupProviderSpy.validateCompressionStateForRestoreAndGetBackup(backupId);
+
+        assertFalse(result.first());
+        verify(backupVoMock).getCompressionStatus();
+        verify(kbossBackupProviderSpy).releaseBackup(backupId);
+    }
+
+    @Test
+    public void validateCompressionStateForRestoreAndGetBackupTestValidState() {
+        doReturn(backupVoMock).when(kbossBackupProviderSpy).lockBackup(backupId);
+        doReturn(Backup.CompressionStatus.Compressed).when(backupVoMock).getCompressionStatus();
+
+        Pair<Boolean, BackupVO> result = kbossBackupProviderSpy.validateCompressionStateForRestoreAndGetBackup(backupId);
+
+        assertTrue(result.first());
+        assertEquals(backupVoMock, result.second());
+        verify(backupVoMock).getCompressionStatus();
+        verify(backupVoMock).setStatus(Backup.Status.Restoring);
+        verify(backupDaoMock).update(backupId, backupVoMock);
+        verify(kbossBackupProviderSpy).releaseBackup(backupId);
+    }
+
+    @Test
+    public void validateBackupStateForRemovalTestUnableToLock() {
+        doReturn(null).when(kbossBackupProviderSpy).lockBackup(backupId);
+
+        boolean result = kbossBackupProviderSpy.validateBackupStateForRemoval(backupId);
+
+        assertFalse(result);
+        verify(kbossBackupProviderSpy, never()).releaseBackup(backupId);
+    }
+
+    @Test
+    public void validateBackupStateForRemovalTestInvalidState() {
+        doReturn(backupVoMock).when(kbossBackupProviderSpy).lockBackup(backupId);
+        doReturn(Backup.Status.Restoring).when(backupVoMock).getStatus();
+
+        boolean result = kbossBackupProviderSpy.validateBackupStateForRemoval(backupId);
+
+        assertFalse(result);
+        verify(backupVoMock, Mockito.atLeast(1)).getStatus();
+        verify(kbossBackupProviderSpy).releaseBackup(backupId);
+    }
+
+    @Test
+    public void validateBackupStateForRemovalTestCompressing() {
+        doReturn(backupVoMock).when(kbossBackupProviderSpy).lockBackup(backupId);
+        doReturn(Backup.Status.BackedUp).when(backupVoMock).getStatus();
+        doReturn(Backup.CompressionStatus.Compressing).when(backupVoMock).getCompressionStatus();
+
+        boolean result = kbossBackupProviderSpy.validateBackupStateForRemoval(backupId);
+
+        assertFalse(result);
+        verify(backupVoMock).getCompressionStatus();
+        verify(kbossBackupProviderSpy).releaseBackup(backupId);
+    }
+
+    @Test
+    public void validateBackupStateForRemovalTestValidating() {
+        doReturn(backupVoMock).when(kbossBackupProviderSpy).lockBackup(backupId);
+        doReturn(Backup.Status.BackedUp).when(backupVoMock).getStatus();
+        doReturn(Backup.CompressionStatus.Compressed).when(backupVoMock).getCompressionStatus();
+        doReturn(Backup.ValidationStatus.Validating).when(backupVoMock).getValidationStatus();
+
+        boolean result = kbossBackupProviderSpy.validateBackupStateForRemoval(backupId);
+
+        assertFalse(result);
+        verify(backupVoMock).getValidationStatus();
+        verify(kbossBackupProviderSpy).releaseBackup(backupId);
+    }
+
+    @Test
+    public void validateBackupStateForRemovalTestValidStates() {
+        doReturn(backupVoMock).when(kbossBackupProviderSpy).lockBackup(backupId);
+        doReturn(Backup.Status.BackedUp).when(backupVoMock).getStatus();
+        doReturn(Backup.CompressionStatus.Compressed).when(backupVoMock).getCompressionStatus();
+        doReturn(Backup.ValidationStatus.UnableToValidate).when(backupVoMock).getValidationStatus();
+
+        boolean result = kbossBackupProviderSpy.validateBackupStateForRemoval(backupId);
+
+        assertTrue(result);
+        verify(backupVoMock).getStatus();
+        verify(backupVoMock).getValidationStatus();
+        verify(backupVoMock).getCompressionStatus();
+        verify(kbossBackupProviderSpy).releaseBackup(backupId);
+    }
+
+    @Test
+    public void validateBackupStateForStartCompressionAndUpdateCompressionStatusTestUnableToLock() {
+        doReturn(null).when(kbossBackupProviderSpy).lockBackup(backupId);
+
+        Pair<Boolean, BackupVO> result = kbossBackupProviderSpy.validateBackupStateForStartCompressionAndUpdateCompressionStatus(backupId);
+
+        assertFalse(result.first());
+        verify(backupDaoMock, never()).update(backupId, backupVoMock);
+        verify(kbossBackupProviderSpy, never()).releaseBackup(backupId);
+    }
+
+    @Test
+    public void validateBackupStateForStartCompressionAndUpdateCompressionStatusTestInvalidState() {
+        doReturn(backupVoMock).when(kbossBackupProviderSpy).lockBackup(backupId);
+        doReturn(Backup.Status.Error).when(backupVoMock).getStatus();
+
+        Pair<Boolean, BackupVO> result = kbossBackupProviderSpy.validateBackupStateForStartCompressionAndUpdateCompressionStatus(backupId);
+
+        assertFalse(result.first());
+        verify(backupVoMock, Mockito.atLeastOnce()).getStatus();
+        verify(backupDaoMock, never()).update(backupId, backupVoMock);
+        verify(kbossBackupProviderSpy).releaseBackup(backupId);
+    }
+
+    @Test
+    public void validateBackupStateForStartCompressionAndUpdateCompressionStatusTestValidStates() {
+        doReturn(backupVoMock).when(kbossBackupProviderSpy).lockBackup(backupId);
+        doReturn(Backup.Status.BackedUp).when(backupVoMock).getStatus();
+
+        Pair<Boolean, BackupVO> result = kbossBackupProviderSpy.validateBackupStateForStartCompressionAndUpdateCompressionStatus(backupId);
+
+        assertTrue(result.first());
+        assertEquals(backupVoMock, result.second());
+        verify(backupVoMock).getStatus();
+        verify(backupVoMock).setCompressionStatus(Backup.CompressionStatus.Compressing);
+        verify(backupDaoMock).update(backupId, backupVoMock);
+        verify(kbossBackupProviderSpy).releaseBackup(backupId);
+    }
+
+    @Test
+    public void validateBackupStateForFinalizeCompressionTestUnableToLock() {
+        doReturn(null).when(kbossBackupProviderSpy).lockBackup(backupId);
+
+        Pair<Boolean, BackupVO> result = kbossBackupProviderSpy.validateBackupStateForFinalizeCompression(backupId);
+
+        assertFalse(result.first());
+        verify(backupDaoMock, never()).update(backupId, backupVoMock);
+        verify(kbossBackupProviderSpy, never()).releaseBackup(backupId);
+    }
+
+    @Test
+    public void validateBackupStateForFinalizeCompressionTestRestoringBackup() {
+        doReturn(backupVoMock).when(kbossBackupProviderSpy).lockBackup(backupId);
+        doReturn(Backup.Status.Restoring).when(backupVoMock).getStatus();
+
+        Pair<Boolean, BackupVO> result = kbossBackupProviderSpy.validateBackupStateForFinalizeCompression(backupId);
+
+        assertFalse(result.first());
+        verify(backupDaoMock, never()).update(backupId, backupVoMock);
+        verify(kbossBackupProviderSpy).releaseBackup(backupId);
+    }
+
+    @Test
+    public void validateBackupStateForFinalizeCompressionTestRestoringChildBackup() {
+        doReturn(backupVoMock).when(kbossBackupProviderSpy).lockBackup(backupId);
+        doReturn(Backup.Status.BackedUp).when(backupVoMock).getStatus();
+        doReturn(List.of(internalBackupJoinVoMock)).when(kbossBackupProviderSpy).getBackupJoinChildren(backupVoMock);
+        doReturn(Backup.Status.Restoring).when(internalBackupJoinVoMock).getStatus();
+
+        Pair<Boolean, BackupVO> result = kbossBackupProviderSpy.validateBackupStateForFinalizeCompression(backupId);
+
+        assertFalse(result.first());
+        verify(backupDaoMock, never()).update(backupId, backupVoMock);
+        verify(kbossBackupProviderSpy).releaseBackup(backupId);
+    }
+
+    @Test
+    public void validateBackupStateForFinalizeCompressionTestAllBackedUp() {
+        doReturn(backupVoMock).when(kbossBackupProviderSpy).lockBackup(backupId);
+        doReturn(Backup.Status.BackedUp).when(backupVoMock).getStatus();
+        doReturn(List.of(internalBackupJoinVoMock)).when(kbossBackupProviderSpy).getBackupJoinChildren(backupVoMock);
+        doReturn(Backup.Status.BackedUp).when(internalBackupJoinVoMock).getStatus();
+
+        Pair<Boolean, BackupVO> result = kbossBackupProviderSpy.validateBackupStateForFinalizeCompression(backupId);
+
+        assertTrue(result.first());
+        assertEquals(backupVoMock, result.second());
+        verify(backupVoMock).setCompressionStatus(Backup.CompressionStatus.FinalizingCompression);
+        verify(backupDaoMock).update(backupId, backupVoMock);
+        verify(kbossBackupProviderSpy).releaseBackup(backupId);
+    }
+
+    @Test
+    public void validateBackupStateForFinalizeCompressionTestRemovedBackup() {
+        doReturn(backupVoMock).when(kbossBackupProviderSpy).lockBackup(backupId);
+        doReturn(Backup.Status.Removed).when(backupVoMock).getStatus();
+
+        Pair<Boolean, BackupVO> result = kbossBackupProviderSpy.validateBackupStateForFinalizeCompression(backupId);
+
+        assertTrue(result.first());
+        assertEquals(backupVoMock, result.second());
+        verify(backupVoMock).setCompressionStatus(Backup.CompressionStatus.CompressionError);
+        verify(backupDaoMock).update(backupId, backupVoMock);
+        verify(kbossBackupProviderSpy).releaseBackup(backupId);
+    }
+
+    @Test
+    public void validateBackupStateForRestoreBackupToVMTestUnableToLock() {
+        doReturn(null).when(kbossBackupProviderSpy).lockBackup(backupId);
+
+        Pair<Boolean, Backup.Status> result = kbossBackupProviderSpy.validateBackupStateForRestoreBackupToVM(backupId);
+
+        assertFalse(result.first());
+        verify(backupDaoMock, never()).update(backupId, backupVoMock);
+        verify(kbossBackupProviderSpy, never()).releaseBackup(backupId);
+    }
+
+    @Test
+    public void validateBackupStateForRestoreBackupToVMTestBackedUp() {
+        doReturn(backupVoMock).when(kbossBackupProviderSpy).lockBackup(backupId);
+        doReturn(Backup.Status.BackedUp).when(backupVoMock).getStatus();
+
+        Pair<Boolean, Backup.Status> result = kbossBackupProviderSpy.validateBackupStateForRestoreBackupToVM(backupId);
+
+        assertTrue(result.first());
+        assertEquals(Backup.Status.BackedUp, result.second());
+        verify(backupDaoMock).update(backupId, backupVoMock);
+        verify(kbossBackupProviderSpy).releaseBackup(backupId);
+    }
+
+    @Test
+    public void validateBackupStateForRestoreBackupToVMTestRestoring() {
+        doReturn(backupVoMock).when(kbossBackupProviderSpy).lockBackup(backupId);
+        doReturn(Backup.Status.Restoring).when(backupVoMock).getStatus();
+
+        Pair<Boolean, Backup.Status> result = kbossBackupProviderSpy.validateBackupStateForRestoreBackupToVM(backupId);
+
+        assertTrue(result.first());
+        assertEquals(Backup.Status.Restoring, result.second());
+        verify(backupDaoMock).update(backupId, backupVoMock);
+        verify(kbossBackupProviderSpy).releaseBackup(backupId);
+    }
+
+    @Test
+    public void validateBackupStateForRestoreBackupToVMTestError() {
+        doReturn(backupVoMock).when(kbossBackupProviderSpy).lockBackup(backupId);
+        doReturn(Backup.Status.Error).when(backupVoMock).getStatus();
+
+        Pair<Boolean, Backup.Status> result = kbossBackupProviderSpy.validateBackupStateForRestoreBackupToVM(backupId);
+
+        assertFalse(result.first());
+        verify(backupDaoMock, never()).update(backupId, backupVoMock);
+        verify(kbossBackupProviderSpy).releaseBackup(backupId);
+    }
+
+
+    @Test
+    public void validateBackupStateForValidationTestUnableToLock() {
+        doReturn(null).when(kbossBackupProviderSpy).lockBackup(backupId);
+
+        boolean result = kbossBackupProviderSpy.validateBackupStateForValidation(backupId);
+
+        assertFalse(result);
+        verify(kbossBackupProviderSpy, never()).releaseBackup(backupId);
+    }
+
+    @Test
+    public void validateBackupStateForValidationTestInvalidState() {
+        doReturn(backupVoMock).when(kbossBackupProviderSpy).lockBackup(backupId);
+        doReturn(Backup.Status.Removed).when(backupVoMock).getStatus();
+
+        boolean result = kbossBackupProviderSpy.validateBackupStateForValidation(backupId);
+
+        assertFalse(result);
+        verify(kbossBackupProviderSpy).releaseBackup(backupId);
+    }
+
+    @Test
+    public void validateBackupStateForValidationTestValidState() {
+        doReturn(backupVoMock).when(kbossBackupProviderSpy).lockBackup(backupId);
+        doReturn(Backup.Status.BackedUp).when(backupVoMock).getStatus();
+
+        boolean result = kbossBackupProviderSpy.validateBackupStateForValidation(backupId);
+
+        assertTrue(result);
+        verify(kbossBackupProviderSpy).releaseBackup(backupId);
+    }
+
+}
diff --git a/plugins/backup/nas/src/main/java/org/apache/cloudstack/backup/NASBackupChainKeys.java b/plugins/backup/nas/src/main/java/org/apache/cloudstack/backup/NASBackupChainKeys.java
new file mode 100644
index 000000000000..511f0ccb7114
--- /dev/null
+++ b/plugins/backup/nas/src/main/java/org/apache/cloudstack/backup/NASBackupChainKeys.java
@@ -0,0 +1,62 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.backup;
+
+/**
+ * Keys used by the NAS backup provider when storing incremental-chain metadata
+ * in the existing {@code backup_details} key/value table. Stored here (not on
+ * the {@code backups} table) so other providers do not need a schema change to
+ * support their own incremental implementations.
+ */
+public final class NASBackupChainKeys {
+
+    /** UUID of the parent backup (full or previous incremental). Empty for full backups. */
+    public static final String PARENT_BACKUP_ID = "nas.parent_backup_id";
+
+    /** QEMU dirty-bitmap name created by this backup, used as the {@code <incremental>} reference for the next one. */
+    public static final String BITMAP_NAME = "nas.bitmap_name";
+
+    /** Identifier shared by every backup in the same chain (the full anchors a chain; its incrementals inherit the id). */
+    public static final String CHAIN_ID = "nas.chain_id";
+
+    /** Position within the chain: 0 for the full, 1 for the first incremental, and so on. */
+    public static final String CHAIN_POSITION = "nas.chain_position";
+
+    /**
+     * In-memory chain-mode sentinels used by {@code ChainDecision.mode}. The persisted
+     * full-vs-incremental backup type lives on the {@code backup.type} column (set in
+     * {@code takeBackup}) — single source of truth. Not duplicated into backup_details.
+     */
+    public static final String TYPE_FULL = "full";
+    public static final String TYPE_INCREMENTAL = "incremental";
+    // Feature disabled: behave exactly like the pre-incremental full-only backup — no QEMU
+    // bitmap/checkpoint is created and no chain metadata is persisted. Matches nasbackup.sh's
+    // "legacy-full" mode token (which sets make_checkpoint=0).
+    public static final String TYPE_LEGACY_FULL = "legacy-full";
+
+    /**
+     * VM-scoped detail (stored in {@code vm_instance_details}) holding the QEMU dirty-bitmap
+     * name that currently exists on the running VM and is therefore the only valid parent
+     * for the next incremental backup. Written by {@link #BITMAP_NAME} on each successful
+     * backup; cleared on restore (the restored disk image has no bitmap, so the next backup
+     * must be a fresh full). When the VM has no detail, {@code decideChain} forces full.
+     */
+    public static final String VM_ACTIVE_CHECKPOINT_ID = "nas.active_checkpoint_id";
+
+    private NASBackupChainKeys() {
+    }
+}
diff --git a/plugins/backup/nas/src/main/java/org/apache/cloudstack/backup/NASBackupProvider.java b/plugins/backup/nas/src/main/java/org/apache/cloudstack/backup/NASBackupProvider.java
index a7121f149e30..8e6d33c4e668 100644
--- a/plugins/backup/nas/src/main/java/org/apache/cloudstack/backup/NASBackupProvider.java
+++ b/plugins/backup/nas/src/main/java/org/apache/cloudstack/backup/NASBackupProvider.java
@@ -19,6 +19,7 @@
 import com.cloud.agent.AgentManager;
 import com.cloud.exception.AgentUnavailableException;
 import com.cloud.exception.OperationTimedoutException;
+import com.cloud.configuration.Resource;
 import com.cloud.host.Host;
 import com.cloud.host.HostVO;
 import com.cloud.host.Status;
@@ -37,17 +38,21 @@
 import com.cloud.storage.dao.VolumeDao;
 import com.cloud.utils.Pair;
 import com.cloud.utils.component.AdapterBase;
+import com.cloud.utils.db.GlobalLock;
 import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.user.ResourceLimitService;
+import com.cloud.vm.VMInstanceDetailVO;
 import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.dao.VMInstanceDao;
+import com.cloud.vm.dao.VMInstanceDetailsDao;
 import com.cloud.vm.snapshot.VMSnapshot;
 import com.cloud.vm.snapshot.VMSnapshotDetailsVO;
 import com.cloud.vm.snapshot.VMSnapshotVO;
 import com.cloud.vm.snapshot.dao.VMSnapshotDao;
 import com.cloud.vm.snapshot.dao.VMSnapshotDetailsDao;
 
-
 import org.apache.cloudstack.backup.dao.BackupDao;
+import org.apache.cloudstack.backup.dao.BackupDetailsDao;
 import org.apache.cloudstack.backup.dao.BackupRepositoryDao;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreManager;
@@ -78,6 +83,8 @@
 public class NASBackupProvider extends AdapterBase implements BackupProvider, Configurable {
     private static final Logger LOG = LogManager.getLogger(NASBackupProvider.class);
 
+    private static final int CHAIN_LOCK_TIMEOUT_SECONDS = 300;
+
     ConfigKey<Integer> NASBackupRestoreMountTimeout = new ConfigKey<>("Advanced", Integer.class,
             "nas.backup.restore.mount.timeout",
             "30",
@@ -85,6 +92,29 @@ public class NASBackupProvider extends AdapterBase implements BackupProvider, Co
             true,
             BackupFrameworkEnabled.key());
 
+    ConfigKey<Integer> NASBackupFullEvery = new ConfigKey<>("Advanced", Integer.class,
+            "nas.backup.full.every",
+            "10",
+            "Take a full NAS backup every Nth backup; remaining backups in between are incremental. " +
+                    "Counts backups, not days, so it works for hourly, daily, and ad-hoc schedules. " +
+                    "Set to 1 to disable incrementals (every backup is full).",
+            true,
+            ConfigKey.Scope.Zone,
+            BackupFrameworkEnabled.key());
+
+    ConfigKey<Boolean> NASBackupIncrementalEnabled = new ConfigKey<>("Advanced", Boolean.class,
+            "nas.backup.incremental.enabled",
+            "false",
+            "Master switch for NAS incremental backups. Defaults to false so existing zones keep the " +
+                    "legacy full-only behavior on upgrade; opt in per-zone when ready to use chains. " +
+                    "When false, every NAS backup is taken as a full regardless of nas.backup.full.every. " +
+                    "Toggling this is safe at any time: switching off forces the next backup to be a fresh " +
+                    "full anchor (existing chains stay restorable), switching back on resumes incrementals " +
+                    "on the next full + incremental cycle.",
+            true,
+            ConfigKey.Scope.Zone,
+            BackupFrameworkEnabled.key());
+
     @Inject
     private BackupDao backupDao;
 
@@ -106,6 +136,9 @@ public class NASBackupProvider extends AdapterBase implements BackupProvider, Co
     @Inject
     private VMInstanceDao vmInstanceDao;
 
+    @Inject
+    private VMInstanceDetailsDao vmInstanceDetailsDao;
+
     @Inject
     private PrimaryDataStoreDao primaryDataStoreDao;
 
@@ -115,6 +148,9 @@ public class NASBackupProvider extends AdapterBase implements BackupProvider, Co
     @Inject
     private AgentManager agentManager;
 
+    @Inject
+    private ResourceLimitService resourceLimitMgr;
+
     @Inject
     private VMSnapshotDao vmSnapshotDao;
 
@@ -130,6 +166,9 @@ public class NASBackupProvider extends AdapterBase implements BackupProvider, Co
     @Inject
     private DiskOfferingDao diskOfferingDao;
 
+    @Inject
+    private BackupDetailsDao backupDetailsDao;
+
     private Long getClusterIdFromRootVolume(VirtualMachine vm) {
         VolumeVO rootVolume = volumeDao.getInstanceRootVolume(vm.getId());
         StoragePoolVO rootDiskPool = primaryDataStoreDao.findById(rootVolume.getPoolId());
@@ -168,6 +207,330 @@ protected Host getVMHypervisorHost(VirtualMachine vm) {
         return resourceManager.findOneRandomRunningHostByHypervisor(Hypervisor.HypervisorType.KVM, vm.getDataCenterId());
     }
 
+    /**
+     * Returned by {@link #decideChain(VirtualMachine)} to describe the next backup's place in
+     * the chain: full vs incremental, the bitmap name to create, and (for incrementals) the
+     * parent bitmap and parent file path.
+     */
+    static final class ChainDecision {
+        final String mode;            // "full" or "incremental"
+        final String bitmapNew;
+        final String bitmapParent;    // null for full
+        // Per-volume parent backup file paths, one per current VM volume in deviceId order.
+        // null/empty for full. Each volume needs its own parent file because backup files
+        // are named after each volume's own UUID (root.<uuid>.qcow2 / datadisk.<uuid>.qcow2).
+        final List<String> parentPaths;
+        final String chainId;         // chain identifier this backup belongs to
+        final int chainPosition;      // 0 for full, N for the Nth incremental in the chain
+
+        private ChainDecision(String mode, String bitmapNew, String bitmapParent, List<String> parentPaths,
+                              String chainId, int chainPosition) {
+            this.mode = mode;
+            this.bitmapNew = bitmapNew;
+            this.bitmapParent = bitmapParent;
+            this.parentPaths = parentPaths;
+            this.chainId = chainId;
+            this.chainPosition = chainPosition;
+        }
+
+        static ChainDecision fullStart(String bitmapName) {
+            return new ChainDecision(NASBackupChainKeys.TYPE_FULL, bitmapName, null, null,
+                    UUID.randomUUID().toString(), 0);
+        }
+
+        /**
+         * Decision used when the incremental feature is disabled: a plain full backup that
+         * creates no bitmap and carries no chain identity, so nothing chain/checkpoint-related
+         * is sent to the agent or persisted. Keeps the feature-off path byte-for-byte legacy.
+         */
+        static ChainDecision legacyFull() {
+            return new ChainDecision(NASBackupChainKeys.TYPE_LEGACY_FULL, null, null, null, null, 0);
+        }
+
+        static ChainDecision incremental(String bitmapNew, String bitmapParent, List<String> parentPaths,
+                                         String chainId, int chainPosition) {
+            return new ChainDecision(NASBackupChainKeys.TYPE_INCREMENTAL, bitmapNew, bitmapParent,
+                    parentPaths, chainId, chainPosition);
+        }
+
+        boolean isIncremental() {
+            return NASBackupChainKeys.TYPE_INCREMENTAL.equals(mode);
+        }
+
+        boolean isLegacyFull() {
+            return NASBackupChainKeys.TYPE_LEGACY_FULL.equals(mode);
+        }
+    }
+
+    /**
+     * Decides whether the next backup for {@code vm} should be a fresh full or an incremental
+     * appended to the existing chain. Stopped VMs are always full (libvirt {@code backup-begin}
+     * requires a running QEMU process). The {@code nas.backup.full.every} ConfigKey controls
+     * how many backups (full + incrementals) form one chain before a new full is forced.
+     *
+     * <p>The decision is anchored on the VM's {@code nas.active_checkpoint_id} detail, which
+     * records the bitmap that currently exists on the running QEMU. After a restore that
+     * detail is cleared, so the next backup is automatically full — even though there may be
+     * a more recent "last backup taken" row in the database. The decision deliberately avoids
+     * relying on "last backup taken", because that row is misleading after a restore.</p>
+     */
+    protected ChainDecision decideChain(VirtualMachine vm) {
+        // Master switch — when the operator disables incrementals at the zone level the backup
+        // behaves exactly like the pre-incremental full-only path: no bitmap is generated and no
+        // chain/checkpoint metadata is created, sent to the agent, or persisted (legacy-full).
+        Boolean incrementalEnabled = NASBackupIncrementalEnabled.valueIn(vm.getDataCenterId());
+        if (incrementalEnabled == null || !incrementalEnabled) {
+            return ChainDecision.legacyFull();
+        }
+
+        // Incremental backups rely on QEMU dirty bitmaps / libvirt checkpoints, which only exist
+        // on file-based qcow2 storage. Storage such as Ceph-RBD and Linstor cannot carry per-disk
+        // checkpoints, so a VM with any volume on such a pool must stay on the full-only (legacy)
+        // path — otherwise an incremental attempt would fail or regress those storages.
+        if (!allVolumesOnCheckpointCapableStorage(vm)) {
+            return ChainDecision.legacyFull();
+        }
+
+        final String newBitmap = "backup-" + System.currentTimeMillis() / 1000L;
+
+        // Stopped VMs cannot do incrementals — script will also fall back, but we make the
+        // decision here so we register the right type up-front.
+        if (VirtualMachine.State.Stopped.equals(vm.getState())) {
+            return ChainDecision.fullStart(newBitmap);
+        }
+
+        Integer fullEvery = NASBackupFullEvery.valueIn(vm.getDataCenterId());
+        if (fullEvery == null || fullEvery <= 1) {
+            // Disabled or every-backup-is-full mode.
+            return ChainDecision.fullStart(newBitmap);
+        }
+
+        // 1. If the VM has no active_checkpoint_id, there is no bitmap on the host to use as
+        //    a parent. This is the case after restore (we clear it), after VM was just assigned
+        //    to the offering, or on the very first backup.
+        String activeCheckpoint = readVmActiveCheckpoint(vm.getId());
+        if (activeCheckpoint == null) {
+            return ChainDecision.fullStart(newBitmap);
+        }
+
+        // 2. The most-recent BackedUp backup is the only safe parent — after restore the
+        //    next backup is always a fresh full, so anything older has a rotated-out bitmap.
+        //    If the latest backup's bitmap doesn't match the VM's active_checkpoint_id, the
+        //    chain is broken: force a full.
+        Backup parent = findLatestBackedUpBackup(vm.getId());
+        if (parent == null || !activeCheckpoint.equals(readDetail(parent, NASBackupChainKeys.BITMAP_NAME))) {
+            LOG.debug("VM {} latest backup does not match active_checkpoint_id={} — forcing full",
+                    vm.getInstanceName(), activeCheckpoint);
+            return ChainDecision.fullStart(newBitmap);
+        }
+
+        String parentChainId = readDetail(parent, NASBackupChainKeys.CHAIN_ID);
+        int parentChainPosition = chainPosition(parent);
+        if (parentChainId == null || parentChainPosition == Integer.MAX_VALUE) {
+            return ChainDecision.fullStart(newBitmap);
+        }
+
+        // Force a fresh full when the chain has reached the configured length.
+        if (parentChainPosition + 1 >= fullEvery) {
+            return ChainDecision.fullStart(newBitmap);
+        }
+
+        // The script needs the parent backup's on-NAS file path PER VOLUME so it can rebase
+        // each new qcow2 onto the matching parent. The paths are stored relative to the NAS
+        // mount root — the script resolves them inside its mount session. When alignment
+        // fails (volume count changed, etc.) compose returns null and we fall back to full
+        // so we don't risk corrupting the chain.
+        List<String> parentPaths = composeParentBackupPaths(parent, vm.getId());
+        if (parentPaths == null) {
+            LOG.debug("VM {} parent backup {} volume layout no longer matches current VM — forcing full",
+                    vm.getInstanceName(), parent.getUuid());
+            return ChainDecision.fullStart(newBitmap);
+        }
+        return ChainDecision.incremental(newBitmap, activeCheckpoint, parentPaths,
+                parentChainId, parentChainPosition + 1);
+    }
+
+    /**
+     * Incremental backups require QEMU dirty bitmaps / libvirt checkpoints, which are only
+     * possible on file-based qcow2 storage. Returns {@code true} only when EVERY volume of the
+     * VM sits on HOST-scope local, {@code SharedMountPoint}, or {@code NetworkFilesystem} (NFS)
+     * storage. Ceph-RBD, Linstor, and any other pool that cannot carry a per-disk checkpoint
+     * make this return {@code false} so the caller falls back to the legacy full-only path. A
+     * volume whose pool can no longer be resolved is treated as incapable (safe default).
+     */
+    protected boolean allVolumesOnCheckpointCapableStorage(VirtualMachine vm) {
+        List<VolumeVO> volumes = volumeDao.findByInstance(vm.getId());
+        if (volumes == null) {
+            return true;
+        }
+        for (VolumeVO volume : volumes) {
+            StoragePoolVO pool = primaryDataStoreDao.findById(volume.getPoolId());
+            if (pool == null) {
+                LOG.debug("VM {} volume {} has no resolvable storage pool — forcing legacy full",
+                        vm.getInstanceName(), volume.getUuid());
+                return false;
+            }
+            boolean checkpointCapable = ScopeType.HOST.equals(pool.getScope())
+                    || Storage.StoragePoolType.SharedMountPoint.equals(pool.getPoolType())
+                    || Storage.StoragePoolType.NetworkFilesystem.equals(pool.getPoolType());
+            if (!checkpointCapable) {
+                LOG.debug("VM {} volume {} is on {} (scope {}) which cannot carry checkpoints — forcing legacy full",
+                        vm.getInstanceName(), volume.getUuid(), pool.getPoolType(), pool.getScope());
+                return false;
+            }
+        }
+        return true;
+    }
+
+    /**
+     * Read the {@code nas.active_checkpoint_id} VM detail. Returns {@code null} when no detail
+     * exists (post-restore, first backup, or after explicit reset).
+     */
+    private String readVmActiveCheckpoint(long vmId) {
+        VMInstanceDetailVO d = vmInstanceDetailsDao.findDetail(vmId, NASBackupChainKeys.VM_ACTIVE_CHECKPOINT_ID);
+        if (d == null) {
+            return null;
+        }
+        String v = d.getValue();
+        return (v == null || v.isEmpty()) ? null : v;
+    }
+
+    /**
+     * Locate the most-recent {@code BackedUp} backup for {@code vmId}. The chain invariant
+     * guarantees the latest backup is the only valid incremental parent — after restore the
+     * next backup is always a fresh full, and {@link #decideChain} checks the bitmap matches.
+     */
+    private Backup findLatestBackedUpBackup(long vmId) {
+        List<Backup> history = backupDao.listByVmId(null, vmId);
+        if (history == null || history.isEmpty()) {
+            return null;
+        }
+        return history.stream()
+                .filter(b -> Backup.Status.BackedUp.equals(b.getStatus()))
+                .max(Comparator.comparing(Backup::getDate))
+                .orElse(null);
+    }
+
+    private String readDetail(Backup backup, String key) {
+        BackupDetailVO d = backupDetailsDao.findDetail(backup.getId(), key);
+        return d == null ? null : d.getValue();
+    }
+
+    /**
+     * Compose the on-NAS path of EVERY parent backup file (one per VM volume) in the same
+     * order the script will iterate the current VM's disks (deviceId asc). Relative to the
+     * NAS mount, matches the layout written by {@code nasbackup.sh}:
+     *   first  disk -> {@code <backupPath>/root.<volUuid>.qcow2}
+     *   others      -> {@code <backupPath>/datadisk.<volUuid>.qcow2}
+     *
+     * Returns {@code null} if the parent's stored volume count doesn't match the current VM's
+     * volume count. Volume attach/detach is blocked while a VM is assigned to a backup offering;
+     * if the offering was removed and re-assigned the active checkpoint is cleared in
+     * {@link #removeVMFromBackupOffering}, so this method doesn't need to revalidate volume
+     * identities — a count mismatch is the only way to reach this branch with a non-null
+     * active_checkpoint_id.
+     */
+    private List<String> composeParentBackupPaths(Backup parent, long vmId) {
+        // backupPath is stored as externalId by createBackupObject — e.g.
+        // "i-2-1234-VM/2026.04.27.13.45.00".
+        String dir = parent.getExternalId();
+        if (dir == null || dir.isEmpty()) {
+            return null;
+        }
+
+        List<Backup.VolumeInfo> parentVols = parent.getBackedUpVolumes();
+        if (parentVols == null || parentVols.isEmpty()) {
+            return null;
+        }
+
+        List<VolumeVO> currentVols = volumeDao.findByInstance(vmId);
+        if (currentVols == null || currentVols.size() != parentVols.size()) {
+            return null;
+        }
+
+        // parentVols is in deviceId order at the time the parent was taken. The script names the
+        // per-disk files from the volume PATH basename (root.<path>.qcow2 / datadisk.<path>.qcow2,
+        // see nasbackup.sh: volUuid="${fullpath##*/}"). Use getPath(), NOT getUuid(): after a
+        // volume migration the uuid and the on-disk path diverge, and the backup file is named by
+        // path — a uuid-based parent path then fails to resolve for the incremental (test 13).
+        List<String> paths = new ArrayList<>(parentVols.size());
+        for (int i = 0; i < parentVols.size(); i++) {
+            String volPath = parentVols.get(i).getPath();
+            String prefix = (i == 0) ? "root" : "datadisk";
+            paths.add(dir + "/" + prefix + "." + volPath + ".qcow2");
+        }
+        return paths;
+    }
+
+    /**
+     * Persist chain metadata under backup_details. Stored here (not on the backups table) so
+     * other providers can implement their own chain semantics without schema changes.
+     */
+    private void persistChainMetadata(Backup backup, ChainDecision decision, String bitmapFromAgent) {
+        // Only persist nas.bitmap_name when the agent confirmed the bitmap exists on the host.
+        // The agent wrapper sets bitmapFromAgent=null when nasbackup.sh exits
+        // EXIT_BITMAP_NOT_SEEDED (=22) — currently only the stopped-VM path where qemu-img
+        // bitmap --add failed on every source disk. Anchoring the next incremental on a
+        // bitmap that doesn't exist would force a non-recoverable failure, so we leave the
+        // detail empty and let the next backup start a fresh full chain.
+        if (bitmapFromAgent != null && !bitmapFromAgent.isEmpty()) {
+            backupDetailsDao.persist(new BackupDetailVO(backup.getId(), NASBackupChainKeys.BITMAP_NAME, bitmapFromAgent, true));
+        }
+        backupDetailsDao.persist(new BackupDetailVO(backup.getId(), NASBackupChainKeys.CHAIN_ID, decision.chainId, true));
+        backupDetailsDao.persist(new BackupDetailVO(backup.getId(), NASBackupChainKeys.CHAIN_POSITION,
+                String.valueOf(decision.chainPosition), true));
+        // Backup full-vs-incremental type lives on backup.type (set by takeBackup) — single
+        // source of truth. Not duplicated into backup_details.
+        if (decision.isIncremental()) {
+            // Resolve the parent backup's UUID so restore can walk the chain by id, not by path.
+            String parentUuid = lookupParentBackupUuid(backup.getVmId(), decision.bitmapParent);
+            if (parentUuid != null) {
+                backupDetailsDao.persist(new BackupDetailVO(backup.getId(), NASBackupChainKeys.PARENT_BACKUP_ID, parentUuid, true));
+            }
+        }
+    }
+
+    /**
+     * Upsert the VM's {@code nas.active_checkpoint_id} detail to {@code bitmapName}. Called
+     * after every successful backup so the next backup's parent-bitmap decision is anchored
+     * on what actually exists on QEMU, not on "last backup taken".
+     */
+    private void upsertVmActiveCheckpoint(long vmId, String bitmapName) {
+        VMInstanceDetailVO existing = vmInstanceDetailsDao.findDetail(vmId, NASBackupChainKeys.VM_ACTIVE_CHECKPOINT_ID);
+        if (existing == null) {
+            vmInstanceDetailsDao.addDetail(vmId, NASBackupChainKeys.VM_ACTIVE_CHECKPOINT_ID, bitmapName, false);
+            return;
+        }
+        existing.setValue(bitmapName);
+        vmInstanceDetailsDao.update(existing.getId(), existing);
+    }
+
+    /**
+     * Remove the VM's {@code nas.active_checkpoint_id} detail. Called from the restore paths:
+     * after restore the disk image has no QEMU bitmap attached, so any future incremental
+     * would be based on stale state. Clearing forces the next backup to be a fresh full.
+     */
+    private void clearVmActiveCheckpoint(long vmId) {
+        VMInstanceDetailVO existing = vmInstanceDetailsDao.findDetail(vmId, NASBackupChainKeys.VM_ACTIVE_CHECKPOINT_ID);
+        if (existing != null) {
+            vmInstanceDetailsDao.removeDetail(vmId, NASBackupChainKeys.VM_ACTIVE_CHECKPOINT_ID);
+            LOG.debug("Cleared nas.active_checkpoint_id for VM id={} (was {})", vmId, existing.getValue());
+        }
+    }
+
+    private String lookupParentBackupUuid(long vmId, String parentBitmap) {
+        if (parentBitmap == null) {
+            return null;
+        }
+        for (Backup b : backupDao.listByVmId(null, vmId)) {
+            String bm = readDetail(b, NASBackupChainKeys.BITMAP_NAME);
+            if (parentBitmap.equals(bm)) {
+                return b.getUuid();
+            }
+        }
+        return null;
+    }
+
     protected Host getVMHypervisorHostForBackup(VirtualMachine vm) {
         Long hostId = vm.getHostId();
         if (hostId == null && VirtualMachine.State.Running.equals(vm.getState())) {
@@ -187,7 +550,7 @@ protected Host getVMHypervisorHostForBackup(VirtualMachine vm) {
     }
 
     @Override
-    public Pair<Boolean, Backup> takeBackup(final VirtualMachine vm, Boolean quiesceVM) {
+    public Pair<Boolean, Backup> takeBackup(final VirtualMachine vm, Boolean quiesceVM, boolean isolated) {
         final Host host = getVMHypervisorHostForBackup(vm);
 
         final BackupRepository backupRepository = backupRepositoryDao.findByBackupOfferingId(vm.getBackupOfferingId());
@@ -205,12 +568,20 @@ public Pair<Boolean, Backup> takeBackup(final VirtualMachine vm, Boolean quiesce
         final String backupPath = String.format("%s/%s", vm.getInstanceName(),
                 new SimpleDateFormat("yyyy.MM.dd.HH.mm.ss").format(creationDate));
 
-        BackupVO backupVO = createBackupObject(vm, backupPath);
+        // Decide full vs incremental for this backup. Stopped VMs are always full
+        // (libvirt backup-begin requires a running QEMU process).
+        ChainDecision decision = decideChain(vm);
+
+        BackupVO backupVO = createBackupObject(vm, backupPath, decision.isIncremental() ? "INCREMENTAL" : "FULL");
         TakeBackupCommand command = new TakeBackupCommand(vm.getInstanceName(), backupPath);
         command.setBackupRepoType(backupRepository.getType());
         command.setBackupRepoAddress(backupRepository.getAddress());
         command.setMountOptions(backupRepository.getMountOptions());
         command.setQuiesce(quiesceVM);
+        command.setMode(decision.mode);
+        command.setBitmapNew(decision.bitmapNew);
+        command.setBitmapParent(decision.bitmapParent);
+        command.setParentPaths(decision.parentPaths);
 
         if (VirtualMachine.State.Stopped.equals(vm.getState())) {
             List<VolumeVO> vmVolumes = volumeDao.findByInstance(vm.getId());
@@ -239,16 +610,38 @@ public Pair<Boolean, Backup> takeBackup(final VirtualMachine vm, Boolean quiesce
             backupVO.setDate(new Date());
             backupVO.setSize(answer.getSize());
             backupVO.setStatus(Backup.Status.BackedUp);
+            // If the agent fell back to full (stopped VM mid-incremental cycle), record this
+            // backup as a full and start a new chain.
+            ChainDecision effective = decision;
+            if (answer.getIncrementalFallback()) {
+                effective = ChainDecision.fullStart(decision.bitmapNew);
+                backupVO.setType("FULL");
+            }
             List<Volume> volumes = new ArrayList<>(volumeDao.findByInstance(vm.getId()));
             backupVO.setBackedUpVolumes(backupManager.createVolumeInfoFromVolumes(volumes));
             if (backupDao.update(backupVO.getId(), backupVO)) {
+                // Legacy-full (incremental feature disabled): persist no chain/checkpoint metadata
+                // and do not touch the VM's active_checkpoint_id — keep the feature-off path legacy.
+                if (!decision.isLegacyFull()) {
+                    persistChainMetadata(backupVO, effective, answer.getBitmapCreated());
+                    // Pin the VM's active_checkpoint_id to whichever bitmap the agent actually
+                    // created — the only valid parent for the next incremental (see decideChain).
+                    // If the agent reports no bitmap (bitmapCreated=null), clear any stale detail
+                    // so the next backup starts a fresh full.
+                    String confirmedBitmap = answer.getBitmapCreated();
+                    if (confirmedBitmap != null) {
+                        upsertVmActiveCheckpoint(vm.getId(), confirmedBitmap);
+                    } else {
+                        clearVmActiveCheckpoint(vm.getId());
+                    }
+                }
                 return new Pair<>(true, backupVO);
             } else {
                 throw new CloudRuntimeException("Failed to update backup");
             }
         } else {
             logger.error("Failed to take backup for VM {}: {}", vm.getInstanceName(), answer != null ? answer.getDetails() : "No answer received");
-            if (answer.getNeedsCleanup()) {
+            if (answer != null && answer.getNeedsCleanup()) {
                 logger.error("Backup cleanup failed for VM {}. Leaving the backup in Error state. Backup should be manually deleted to free up the space", vm.getInstanceName());
                 backupVO.setStatus(Backup.Status.Error);
                 backupDao.update(backupVO.getId(), backupVO);
@@ -260,11 +653,11 @@ public Pair<Boolean, Backup> takeBackup(final VirtualMachine vm, Boolean quiesce
         }
     }
 
-    private BackupVO createBackupObject(VirtualMachine vm, String backupPath) {
+    private BackupVO createBackupObject(VirtualMachine vm, String backupPath, String type) {
         BackupVO backup = new BackupVO();
         backup.setVmId(vm.getId());
         backup.setExternalId(backupPath);
-        backup.setType("FULL");
+        backup.setType(type);
         backup.setDate(new Date());
         long virtualSize = 0L;
         for (final Volume volume: volumeDao.findByInstance(vm.getId())) {
@@ -286,12 +679,12 @@ private BackupVO createBackupObject(VirtualMachine vm, String backupPath) {
     }
 
     @Override
-    public Pair<Boolean, String> restoreBackupToVM(VirtualMachine vm, Backup backup, String hostIp, String dataStoreUuid) {
+    public Pair<Boolean, String> restoreBackupToVM(VirtualMachine vm, Backup backup, String hostIp, String dataStoreUuid, boolean quickrestore) {
         return restoreVMBackup(vm, backup);
     }
 
     @Override
-    public boolean restoreVMFromBackup(VirtualMachine vm, Backup backup) {
+    public boolean restoreVMFromBackup(VirtualMachine vm, Backup backup, boolean quickRestore, Long hostId) {
         return restoreVMBackup(vm, backup).first();
     }
 
@@ -333,6 +726,11 @@ private Pair<Boolean, String> restoreVMBackup(VirtualMachine vm, Backup backup)
         } catch (OperationTimedoutException e) {
             throw new CloudRuntimeException("Operation to restore backup timed out, please try again");
         }
+        // After a restore the QEMU dirty-bitmap chain is gone — clear active_checkpoint_id so
+        // the next backup is taken as a fresh full and starts a new chain. See decideChain.
+        if (answer != null && answer.getResult()) {
+            clearVmActiveCheckpoint(vm.getId());
+        }
         return new Pair<>(answer.getResult(), answer.getDetails());
     }
 
@@ -387,7 +785,8 @@ private String getVolumePathSuffix(StoragePoolVO storagePool) {
     }
 
     @Override
-    public Pair<Boolean, String> restoreBackedUpVolume(Backup backup, Backup.VolumeInfo backupVolumeInfo, String hostIp, String dataStoreUuid, Pair<String, VirtualMachine.State> vmNameAndState) {
+    public Pair<Boolean, String> restoreBackedUpVolume(Backup backup, Backup.VolumeInfo backupVolumeInfo, String hostIp, String dataStoreUuid,
+            Pair<String, VirtualMachine.State> vmNameAndState, VirtualMachine vm, boolean quickRestore) {
         final VolumeVO volume = volumeDao.findByUuid(backupVolumeInfo.getUuid());
         final DiskOffering diskOffering = diskOfferingDao.findByUuid(backupVolumeInfo.getDiskOfferingId());
         final StoragePoolVO pool = primaryDataStoreDao.findByUuid(dataStoreUuid);
@@ -457,6 +856,13 @@ public Pair<Boolean, String> restoreBackedUpVolume(Backup backup, Backup.VolumeI
             } catch (Exception e) {
                 throw new CloudRuntimeException("Unable to create restored volume due to: " + e);
             }
+            // The restored volume is attached to this VM with no QEMU bitmap on its image, so the
+            // VM's tracked checkpoint is now stale; clear it to force the next backup to be a full
+            // (mirrors the full restore paths restoreVMFromBackup/restoreBackupToVM).
+            VirtualMachine restoreTargetVm = vmInstanceDao.findVMByInstanceName(vmNameAndState.first());
+            if (restoreTargetVm != null) {
+                clearVmActiveCheckpoint(restoreTargetVm.getId());
+            }
         }
 
         return new Pair<>(answer.getResult(), answer.getDetails());
@@ -477,6 +883,14 @@ private Backup.VolumeInfo getBackedUpVolumeInfo(List<Backup.VolumeInfo> backedUp
                 .orElse(null);
     }
 
+    @Override
+    public boolean handlesChainDeleteResourceAccounting() {
+        // This provider deletes whole incremental chains (leaf + swept delete-pending ancestors)
+        // and decrements resource count/usage once per physically-removed backup itself, so the
+        // manager must not also decrement or remove the DB row.
+        return true;
+    }
+
     @Override
     public boolean deleteBackup(Backup backup, boolean forced) {
         final BackupRepository backupRepository = backupRepositoryDao.findByBackupOfferingId(backup.getBackupOfferingId());
@@ -495,9 +909,74 @@ public boolean deleteBackup(Backup backup, boolean forced) {
             throw new CloudRuntimeException(String.format("Unable to find a running KVM host in zone %d to delete backup %s", backup.getZoneId(), backup.getUuid()));
         }
 
-        DeleteBackupCommand command = new DeleteBackupCommand(backup.getExternalId(), backupRepository.getType(),
-                backupRepository.getAddress(), backupRepository.getMountOptions());
+        // Backups outside any tracked chain (legacy or non-incremental providers) are
+        // deleted straight away — no children semantics apply.
+        if (readDetail(backup, NASBackupChainKeys.CHAIN_ID) == null) {
+            return deleteBackupFileAndRow(backup, backupRepository, host);
+        }
+
+        // Concurrent deletes can mutate the same chain concurrently resulting in inconsistent states.
+        // take a per-VM lock before modifying the chain.
+        final GlobalLock chainLock = acquireChainDeleteLock(backup.getVmId());
+        try {
+            Backup current = backupDao.findById(backup.getId());
+            if (current == null) {
+                LOG.debug("Backup {} was already removed by a concurrent chain delete", backup.getUuid());
+                return true;
+            }
+            backup = current;
+
+            // Snapshot-style cascade: defer the on-NAS rm + DB row while there are live children,
+            // mark this backup as delete-pending, and let the leaf's deletion sweep it up later.
+            // See DefaultSnapshotStrategy#deleteSnapshotChain for the same pattern on incremental
+            // snapshots. forced=true means the caller wants the entire subtree gone right now.
+            if (forced) {
+                return cascadeDeleteSubtree(backup, backupRepository, host);
+            }
+
+            if (hasLiveChildren(backup)) {
+                markDeletePending(backup);
+                LOG.debug("Backup {} has live descendants in its chain; setting status as Hidden. " +
+                                "The on-NAS file and DB row will be removed once the last descendant is gone, " +
+                                "or pass forced=true.",
+                        backup.getUuid());
+                return true;
+            }
 
+            // No live children — physically delete this backup, then walk up the chain and
+            // collect any ancestors that were left in Hidden state.
+            return deleteLeafBackupAndSweepPendingAncestors(backup, backupRepository, host);
+        } finally {
+            releaseChainDeleteLock(chainLock);
+        }
+    }
+
+    /**
+     * Take the per-VM lock that serializes chain-mutating backup deletes.
+     */
+    protected GlobalLock acquireChainDeleteLock(long vmId) {
+        GlobalLock lock = GlobalLock.getInternLock("nas.backup.chain.vm." + vmId);
+        if (!lock.lock(CHAIN_LOCK_TIMEOUT_SECONDS)) {
+            lock.releaseRef();
+            throw new CloudRuntimeException(String.format(
+                    "Timed out waiting for concurrent backup chain operations on VM %d to finish, please try again", vmId));
+        }
+        return lock;
+    }
+
+    protected void releaseChainDeleteLock(GlobalLock lock) {
+        lock.unlock();
+        lock.releaseRef();
+    }
+
+    /**
+     * The single physical-delete step: rm the on-NAS directory, then remove the DB row.
+     * Returns {@code false} (and leaves both intact) if the agent reports failure, so the
+     * caller's recursion stops cleanly.
+     */
+    private boolean deleteBackupFileAndRow(Backup backup, BackupRepository repo, Host host) {
+        DeleteBackupCommand command = new DeleteBackupCommand(backup.getExternalId(), repo.getType(),
+                repo.getAddress(), repo.getMountOptions());
         BackupAnswer answer;
         try {
             answer = (BackupAnswer) agentManager.send(host.getId(), command);
@@ -506,15 +985,157 @@ public boolean deleteBackup(Backup backup, boolean forced) {
         } catch (OperationTimedoutException e) {
             throw new CloudRuntimeException("Operation to delete backup timed out, please try again");
         }
+        if (answer == null || !answer.getResult()) {
+            logger.error("Failed to delete backup file for {} ({}); leaving DB row intact",
+                    backup.getUuid(), backup.getExternalId());
+            return false;
+        }
+        // Capture the deleted backup's bitmap before the row (and its backup_details) are removed.
+        String deletedBitmap = readDetail(backup, NASBackupChainKeys.BITMAP_NAME);
+        backupDao.remove(backup.getId());
+        // If this backup owned the bitmap the VM's active_checkpoint_id points to, that on-host QEMU
+        // dirty-bitmap is gone with it — clear active_checkpoint_id so the next backup starts a fresh
+        // full chain instead of anchoring an incremental on a deleted checkpoint (test: delete last backup).
+        if (deletedBitmap != null && deletedBitmap.equals(readVmActiveCheckpoint(backup.getVmId()))) {
+            clearVmActiveCheckpoint(backup.getVmId());
+        }
+        // Exactly-once resource accounting: decrement at the single point a backup row + file are
+        // physically removed. This runs for the leaf and for every swept delete-pending ancestor,
+        // so a chain delete decrements once per actually-removed backup. The manager skips its own
+        // accounting for this provider (see handlesChainDeleteResourceAccounting()).
+        long size = backup.getSize() != null ? backup.getSize() : 0L;
+        resourceLimitMgr.decrementResourceCount(backup.getAccountId(), Resource.ResourceType.backup);
+        resourceLimitMgr.decrementResourceCount(backup.getAccountId(), Resource.ResourceType.backup_storage, size);
+        return true;
+    }
 
-        if (answer != null && answer.getResult()) {
-            return backupDao.remove(backup.getId());
+    /**
+     * Tombstone {@code backup} by moving it to {@link Backup.Status#Hidden}. Idempotent.
+     * The row stays in the DB so the chain GC can sweep it once its last descendant is deleted
+     * ({@code listByVmId} is status-agnostic), but it disappears from the user-facing list
+     * ({@link BackupManagerImpl#listBackups} filters Hidden) and all backup operations refuse it
+     * (they require {@code BackedUp}). Replaces the previous {@code nas.delete_pending} detail.
+     */
+    private void markDeletePending(Backup backup) {
+        if (Backup.Status.Hidden.equals(backup.getStatus())) {
+            return;
+        }
+        BackupVO vo = backupDao.findById(backup.getId());
+        if (vo != null) {
+            vo.setStatus(Backup.Status.Hidden);
+            backupDao.update(vo.getId(), vo);
         }
+    }
+
+    /**
+     * @return true if this backup is a tombstone (Hidden) awaiting chain sweep.
+     */
+    private boolean isDeletePending(Backup backup) {
+        return Backup.Status.Hidden.equals(backup.getStatus());
+    }
 
-        logger.debug("There was an error removing the backup with id {}", backup.getId());
+    /**
+     * Whether there are any live (not tombstoned/Hidden, not Removed) descendants of {@code backup} within the
+     * same chain. This uses {@code CHAIN_POSITION} to detect dependents deeper in the chain.
+     */
+    private boolean hasLiveChildren(Backup backup) {
+        String chainId = readDetail(backup, NASBackupChainKeys.CHAIN_ID);
+        if (chainId == null) {
+            return false;
+        }
+        int position = chainPosition(backup);
+        for (Backup b : backupDao.listByVmId(null, backup.getVmId())) {
+            if (b.getId() == backup.getId() || !chainId.equals(readDetail(b, NASBackupChainKeys.CHAIN_ID))) {
+                continue;
+            }
+            if (!isDeletePending(b) && chainPosition(b) > position) {
+                return true;
+            }
+        }
         return false;
     }
 
+    /**
+     * Return the chain containing {@code member}, ordered leaf-first
+     * (highest {@code CHAIN_POSITION} → root).
+     *
+     * <p>Materialises the chain via a single {@link BackupDao#listByVmId} call. Callers that
+     * previously walked the chain by repeatedly calling {@link #findChainParent} were doing
+     * O(N) {@code listByVmId} calls (one per ancestor); this collapses that to one.
+     *
+     * <p>If {@code member} has no {@code CHAIN_ID} metadata it is returned as a one-element
+     * list (it is its own degenerate chain).
+     */
+    private List<Backup> getChainOrderedLeafToRoot(Backup member) {
+        String chainId = readDetail(member, NASBackupChainKeys.CHAIN_ID);
+        if (chainId == null) {
+            return Collections.singletonList(member);
+        }
+        List<Backup> chain = new ArrayList<>();
+        for (Backup b : backupDao.listByVmId(null, member.getVmId())) {
+            if (chainId.equals(readDetail(b, NASBackupChainKeys.CHAIN_ID))) {
+                chain.add(b);
+            }
+        }
+        // Descending CHAIN_POSITION = leaf-first (highest position = furthest from root).
+        chain.sort((a, b) -> Integer.compare(chainPosition(b), chainPosition(a)));
+        return chain;
+    }
+
+    /**
+     * Physically delete the leaf {@code backup}, then walk up the chain while each ancestor
+     * is in Hidden state. Mirrors the snapshot subsystem pattern: once a leaf is
+     * gone, garbage-collect any tombstoned parents.
+     *
+     * <p>Caller must guarantee {@code backup} is a leaf (no live children). Each tombstoned
+     * ancestor is by definition childless once its sole child is deleted here, so no extra
+     * live-children check is needed inside the loop.
+     */
+    private boolean deleteLeafBackupAndSweepPendingAncestors(Backup backup, BackupRepository repo, Host host) {
+        // Snapshot the chain BEFORE the leaf delete — deleteBackupFileAndRow removes the row,
+        // after which the in-memory list still resolves but the DB no longer would.
+        List<Backup> chain = getChainOrderedLeafToRoot(backup);
+        if (!deleteBackupFileAndRow(backup, repo, host)) {
+            return false;
+        }
+        for (Backup member : chain) {
+            if (member.getId() == backup.getId()) {
+                continue;
+            }
+            if (!isDeletePending(member)) {
+                break;
+            }
+            deleteBackupFileAndRow(member, repo, host);
+        }
+        return true;
+    }
+
+    /**
+     * Forced delete of {@code root}'s entire chain, leaf-first. NAS backups form a linear
+     * chain (full → inc → inc → …), not a tree, so we just walk the ordered chain and
+     * delete each member without re-querying parents.
+     */
+    private boolean cascadeDeleteSubtree(Backup root, BackupRepository repo, Host host) {
+        for (Backup b : getChainOrderedLeafToRoot(root)) {
+            if (!deleteBackupFileAndRow(b, repo, host)) {
+                return false;
+            }
+        }
+        return true;
+    }
+
+    private int chainPosition(Backup b) {
+        String s = readDetail(b, NASBackupChainKeys.CHAIN_POSITION);
+        if (s == null) {
+            return Integer.MAX_VALUE; // no metadata => sort to end
+        }
+        try {
+            return Integer.parseInt(s);
+        } catch (NumberFormatException e) {
+            return Integer.MAX_VALUE;
+        }
+    }
+
     public void syncBackupMetrics(Long zoneId) {
     }
 
@@ -543,6 +1164,11 @@ public boolean assignVMToBackupOffering(VirtualMachine vm, BackupOffering backup
 
     @Override
     public boolean removeVMFromBackupOffering(VirtualMachine vm) {
+        // Clear the VM's active checkpoint so any future re-assignment to a backup offering
+        // starts a fresh chain. Without this, a detach-volume + attach-different-volume cycle
+        // while the offering is unassigned would lead to the next backup trying to rebase
+        // onto a stale parent (different volume identity, same VM id).
+        clearVmActiveCheckpoint(vm.getId());
         return true;
     }
 
@@ -629,7 +1255,9 @@ public Boolean crossZoneInstanceCreationEnabled(BackupOffering backupOffering) {
     @Override
     public ConfigKey<?>[] getConfigKeys() {
         return new ConfigKey[]{
-                NASBackupRestoreMountTimeout
+                NASBackupRestoreMountTimeout,
+                NASBackupFullEvery,
+                NASBackupIncrementalEnabled
         };
     }
 
diff --git a/plugins/backup/nas/src/test/java/org/apache/cloudstack/backup/NASBackupProviderTest.java b/plugins/backup/nas/src/test/java/org/apache/cloudstack/backup/NASBackupProviderTest.java
index a512292cd28f..f1d5613ab7fc 100644
--- a/plugins/backup/nas/src/test/java/org/apache/cloudstack/backup/NASBackupProviderTest.java
+++ b/plugins/backup/nas/src/test/java/org/apache/cloudstack/backup/NASBackupProviderTest.java
@@ -28,6 +28,7 @@
 import org.junit.Assert;
 import org.junit.Test;
 import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.Mockito;
@@ -38,22 +39,36 @@
 import com.cloud.agent.AgentManager;
 import com.cloud.exception.AgentUnavailableException;
 import com.cloud.exception.OperationTimedoutException;
+import com.cloud.configuration.Resource;
 import com.cloud.host.Host;
 import com.cloud.host.HostVO;
 import com.cloud.host.Status;
 import com.cloud.host.dao.HostDao;
 import com.cloud.hypervisor.Hypervisor;
 import com.cloud.resource.ResourceManager;
+import com.cloud.storage.DiskOfferingVO;
+import com.cloud.storage.ScopeType;
+import com.cloud.storage.Storage;
 import com.cloud.storage.Volume;
 import com.cloud.storage.VolumeVO;
+import com.cloud.storage.dao.DiskOfferingDao;
 import com.cloud.storage.dao.VolumeDao;
+import com.cloud.user.ResourceLimitService;
 import com.cloud.utils.Pair;
+import com.cloud.utils.db.GlobalLock;
+import com.cloud.vm.VMInstanceDetailVO;
 import com.cloud.vm.VMInstanceVO;
+import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.dao.VMInstanceDao;
+import com.cloud.vm.dao.VMInstanceDetailsDao;
+
+import com.google.gson.Gson;
 
 import org.apache.cloudstack.backup.dao.BackupDao;
+import org.apache.cloudstack.backup.dao.BackupDetailsDao;
 import org.apache.cloudstack.backup.dao.BackupRepositoryDao;
 import org.apache.cloudstack.backup.dao.BackupOfferingDao;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreManager;
 import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
 
@@ -96,6 +111,21 @@ public class NASBackupProviderTest {
     @Mock
     private VMSnapshotDao vmSnapshotDaoMock;
 
+    @Mock
+    private BackupDetailsDao backupDetailsDao;
+
+    @Mock
+    private VMInstanceDetailsDao vmInstanceDetailsDao;
+
+    @Mock
+    private DiskOfferingDao diskOfferingDao;
+
+    @Mock
+    private DataStoreManager dataStoreMgr;
+
+    @Mock
+    private ResourceLimitService resourceLimitMgr;
+
     @Test
     public void testDeleteBackup() throws OperationTimedoutException, AgentUnavailableException {
         Long hostId = 1L;
@@ -221,7 +251,7 @@ public void takeBackupSuccessfully() throws AgentUnavailableException, Operation
         Mockito.when(backupDao.persist(Mockito.any(BackupVO.class))).thenAnswer(invocation -> invocation.getArgument(0));
         Mockito.when(backupDao.update(Mockito.anyLong(), Mockito.any(BackupVO.class))).thenReturn(true);
 
-        Pair<Boolean, Backup> result = nasBackupProvider.takeBackup(vm, false);
+        Pair<Boolean, Backup> result = nasBackupProvider.takeBackup(vm, false, false);
 
         Assert.assertTrue(result.first());
         Assert.assertNotNull(result.second());
@@ -353,4 +383,655 @@ public void testGetVMHypervisorHostFallbackToZoneWideKVMHost() {
         Mockito.verify(hostDao).findHypervisorHostInCluster(clusterId);
         Mockito.verify(resourceManager).findOneRandomRunningHostByHypervisor(Hypervisor.HypervisorType.KVM, zoneId);
     }
+
+    // -- nas.backup.incremental.enabled master switch ------------------------------------
+
+    /**
+     * When the operator sets nas.backup.incremental.enabled=false at the zone level, every
+     * backup must be a fresh full anchor, regardless of VM state or nas.backup.full.every.
+     * This is a single toggle the
+     * operator can flip without having to count remaining backups in a chain.
+     */
+    @Test
+    public void decideChainReturnsLegacyFullWhenIncrementalDisabled() {
+        Long zoneId = 1L;
+        VMInstanceVO vm = mock(VMInstanceVO.class);
+        Mockito.lenient().when(vm.getDataCenterId()).thenReturn(zoneId);
+
+        // Stub the master switch to false. ConfigKey.valueIn delegates to the framework's
+        // ConfigDepot at runtime; for the unit test we override the in-memory value via the
+        // ConfigKey's local override (set by ReflectionTestUtils on the spy provider).
+        ReflectionTestUtils.setField(nasBackupProvider, "NASBackupIncrementalEnabled",
+                new org.apache.cloudstack.framework.config.ConfigKey<>("Advanced", Boolean.class,
+                        "nas.backup.incremental.enabled", "false",
+                        "test override — disabled", true,
+                        org.apache.cloudstack.framework.config.ConfigKey.Scope.Zone));
+
+        NASBackupProvider.ChainDecision decision = nasBackupProvider.decideChain(vm);
+        Assert.assertNotNull(decision);
+        Assert.assertEquals(NASBackupChainKeys.TYPE_LEGACY_FULL, decision.mode);
+        Assert.assertNull("legacy-full must not carry a bitmap", decision.bitmapNew);
+        Assert.assertNull(decision.bitmapParent);
+        Assert.assertNull("legacy-full must not start a chain", decision.chainId);
+        Assert.assertEquals(0, decision.chainPosition);
+    }
+
+    // -- decideChain anchored on VM's active_checkpoint_id -------------------------------
+
+    /**
+     * No active_checkpoint_id on the VM (post-restore, first-ever backup, or detail purged) =>
+     * decideChain must return a fresh full. Relying on the last backup taken as the parent
+     * breaks after a restore, so the decision is anchored on the active checkpoint instead.
+     */
+    @Test
+    public void decideChainReturnsFullWhenVmHasNoActiveCheckpoint() {
+        Long zoneId = 1L;
+        Long vmId = 42L;
+        VMInstanceVO vm = mock(VMInstanceVO.class);
+        Mockito.when(vm.getId()).thenReturn(vmId);
+        Mockito.when(vm.getDataCenterId()).thenReturn(zoneId);
+        Mockito.when(vm.getState()).thenReturn(VMInstanceVO.State.Running);
+
+        // Master switch defaults to false (opt-in by zone) — explicitly enable it for this
+        // test so we exercise the "no active_checkpoint_id" branch rather than short-circuit
+        // at the master-switch gate.
+        ReflectionTestUtils.setField(nasBackupProvider, "NASBackupIncrementalEnabled",
+                new org.apache.cloudstack.framework.config.ConfigKey<>("Advanced", Boolean.class,
+                        "nas.backup.incremental.enabled", "true",
+                        "test override — enabled", true,
+                        org.apache.cloudstack.framework.config.ConfigKey.Scope.Zone));
+
+        Mockito.when(vmInstanceDetailsDao.findDetail(vmId, NASBackupChainKeys.VM_ACTIVE_CHECKPOINT_ID)).thenReturn(null);
+
+        NASBackupProvider.ChainDecision decision = nasBackupProvider.decideChain(vm);
+        Assert.assertNotNull(decision);
+        Assert.assertEquals(NASBackupChainKeys.TYPE_FULL, decision.mode);
+        Assert.assertNull(decision.bitmapParent);
+        Assert.assertEquals(0, decision.chainPosition);
+    }
+
+    // -- incremental storage-capability guard (Ceph-RBD / Linstor stay on legacy full) ----
+
+    /**
+     * Incremental checkpoints are only possible on file-based qcow2 storage. A VM whose every
+     * volume sits on NFS / HOST-scope local / SharedMountPoint is checkpoint-capable.
+     */
+    @Test
+    public void allVolumesOnCheckpointCapableStorageTrueForNfsHostAndSharedMount() {
+        Long vmId = 55L;
+        VMInstanceVO vm = mock(VMInstanceVO.class);
+        Mockito.when(vm.getId()).thenReturn(vmId);
+
+        VolumeVO nfsVol = mock(VolumeVO.class);
+        Mockito.when(nfsVol.getPoolId()).thenReturn(1L);
+        VolumeVO hostVol = mock(VolumeVO.class);
+        Mockito.when(hostVol.getPoolId()).thenReturn(2L);
+        VolumeVO smpVol = mock(VolumeVO.class);
+        Mockito.when(smpVol.getPoolId()).thenReturn(3L);
+        Mockito.when(volumeDao.findByInstance(vmId)).thenReturn(List.of(nfsVol, hostVol, smpVol));
+
+        StoragePoolVO nfs = mock(StoragePoolVO.class);
+        Mockito.when(nfs.getPoolType()).thenReturn(Storage.StoragePoolType.NetworkFilesystem);
+        StoragePoolVO host = mock(StoragePoolVO.class);
+        Mockito.when(host.getScope()).thenReturn(ScopeType.HOST);
+        StoragePoolVO smp = mock(StoragePoolVO.class);
+        Mockito.when(smp.getPoolType()).thenReturn(Storage.StoragePoolType.SharedMountPoint);
+        Mockito.when(storagePoolDao.findById(1L)).thenReturn(nfs);
+        Mockito.when(storagePoolDao.findById(2L)).thenReturn(host);
+        Mockito.when(storagePoolDao.findById(3L)).thenReturn(smp);
+
+        Assert.assertTrue(nasBackupProvider.allVolumesOnCheckpointCapableStorage(vm));
+    }
+
+    /**
+     * A single volume on Ceph-RBD (or any pool that cannot carry a per-disk checkpoint) forces
+     * the whole VM onto the legacy full-only path — avoids regressing RBD/Linstor storages.
+     */
+    @Test
+    public void allVolumesOnCheckpointCapableStorageFalseWhenAnyVolumeOnRbd() {
+        Long vmId = 56L;
+        VMInstanceVO vm = mock(VMInstanceVO.class);
+        Mockito.when(vm.getId()).thenReturn(vmId);
+
+        VolumeVO nfsVol = mock(VolumeVO.class);
+        Mockito.when(nfsVol.getPoolId()).thenReturn(1L);
+        VolumeVO rbdVol = mock(VolumeVO.class);
+        Mockito.when(rbdVol.getPoolId()).thenReturn(9L);
+        Mockito.when(volumeDao.findByInstance(vmId)).thenReturn(List.of(nfsVol, rbdVol));
+
+        StoragePoolVO nfs = mock(StoragePoolVO.class);
+        Mockito.when(nfs.getPoolType()).thenReturn(Storage.StoragePoolType.NetworkFilesystem);
+        StoragePoolVO rbd = mock(StoragePoolVO.class);
+        Mockito.when(rbd.getPoolType()).thenReturn(Storage.StoragePoolType.RBD);
+        Mockito.when(storagePoolDao.findById(1L)).thenReturn(nfs);
+        Mockito.when(storagePoolDao.findById(9L)).thenReturn(rbd);
+
+        Assert.assertFalse(nasBackupProvider.allVolumesOnCheckpointCapableStorage(vm));
+    }
+
+    /** A volume whose storage pool can no longer be resolved is treated as incapable (safe). */
+    @Test
+    public void allVolumesOnCheckpointCapableStorageFalseWhenPoolUnresolvable() {
+        Long vmId = 57L;
+        VMInstanceVO vm = mock(VMInstanceVO.class);
+        Mockito.when(vm.getId()).thenReturn(vmId);
+        VolumeVO vol = mock(VolumeVO.class);
+        Mockito.when(vol.getPoolId()).thenReturn(1L);
+        Mockito.when(volumeDao.findByInstance(vmId)).thenReturn(List.of(vol));
+        Mockito.when(storagePoolDao.findById(1L)).thenReturn(null);
+
+        Assert.assertFalse(nasBackupProvider.allVolumesOnCheckpointCapableStorage(vm));
+    }
+
+    // -- restore clears active_checkpoint_id ---------------------------------------------
+
+    /**
+     * After a successful restoreVMFromBackup, decideChain on the next backup must produce
+     * a full. We verify this end-to-end by checking that vmInstanceDetailsDao.removeDetail
+     * is called with the active_checkpoint_id key.
+     */
+    @Test
+    public void restoreClearsActiveCheckpointDetail() throws AgentUnavailableException, OperationTimedoutException {
+        Long vmId = 7L;
+        Long hostId = 8L;
+        Long backupOfferingId = 9L;
+
+        VMInstanceVO vm = mock(VMInstanceVO.class);
+        Mockito.when(vm.getId()).thenReturn(vmId);
+        Mockito.when(vm.getLastHostId()).thenReturn(hostId);
+        Mockito.when(vm.getRemoved()).thenReturn(null);
+        Mockito.when(vm.getName()).thenReturn("vm7");
+
+        HostVO host = mock(HostVO.class);
+        Mockito.when(host.getStatus()).thenReturn(Status.Up);
+        Mockito.when(host.getId()).thenReturn(hostId);
+        Mockito.when(hostDao.findById(hostId)).thenReturn(host);
+
+        BackupVO backup = new BackupVO();
+        backup.setVmId(vmId);
+        backup.setBackupOfferingId(backupOfferingId);
+        backup.setExternalId("i-2-7-VM/2026.05.16.10.00.00");
+        ReflectionTestUtils.setField(backup, "id", 100L);
+        // backedUpVolumes defaults to null => BackupVO.getBackedUpVolumes returns emptyList().
+
+        BackupRepositoryVO repo = new BackupRepositoryVO(1L, "nas", "test-repo",
+                "nfs", "address", "sync", 1024L, null);
+        Mockito.when(backupRepositoryDao.findByBackupOfferingId(backupOfferingId)).thenReturn(repo);
+
+        Mockito.when(volumeDao.findByInstance(vmId)).thenReturn(Collections.emptyList());
+
+        BackupAnswer answer = mock(BackupAnswer.class);
+        Mockito.when(answer.getResult()).thenReturn(true);
+        Mockito.when(agentManager.send(Mockito.anyLong(), Mockito.any(RestoreBackupCommand.class))).thenReturn(answer);
+
+        // Pre-existing checkpoint detail so removeDetail has something to "clear".
+        VMInstanceDetailVO existing = mock(VMInstanceDetailVO.class);
+        Mockito.when(existing.getValue()).thenReturn("backup-1715000000");
+        Mockito.when(vmInstanceDetailsDao.findDetail(vmId, NASBackupChainKeys.VM_ACTIVE_CHECKPOINT_ID)).thenReturn(existing);
+
+        boolean ok = nasBackupProvider.restoreVMFromBackup(vm, backup, false, null);
+        Assert.assertTrue(ok);
+        Mockito.verify(vmInstanceDetailsDao).removeDetail(vmId, NASBackupChainKeys.VM_ACTIVE_CHECKPOINT_ID);
+    }
+
+    /**
+     * Single-volume restore (restoreBackedUpVolume) must also clear the target VM's
+     * active_checkpoint_id, so the next backup of that VM is a fresh full — the restored
+     * volume's image carries no QEMU bitmap.
+     */
+    @Test
+    public void restoreBackedUpVolumeClearsTargetVmActiveCheckpoint()
+            throws AgentUnavailableException, OperationTimedoutException {
+        Long targetVmId = 42L;
+        Long backupOfferingId = 9L;
+        String targetVmName = "i-2-42-VM";
+        String volUuid = "vol-uuid-1";
+        String hostIp = "10.0.0.5";
+        String dsUuid = "ds-uuid-1";
+
+        VolumeVO srcVolume = mock(VolumeVO.class);
+        Mockito.when(srcVolume.getUuid()).thenReturn(volUuid);
+        Mockito.when(srcVolume.getName()).thenReturn("data1");
+        Mockito.when(volumeDao.findByUuid(volUuid)).thenReturn(srcVolume);
+
+        DiskOfferingVO diskOffering = mock(DiskOfferingVO.class);
+        Mockito.when(diskOffering.getId()).thenReturn(5L);
+        Mockito.when(diskOffering.getProvisioningType()).thenReturn(Storage.ProvisioningType.THIN);
+        Mockito.when(diskOfferingDao.findByUuid(Mockito.anyString())).thenReturn(diskOffering);
+
+        StoragePoolVO pool = mock(StoragePoolVO.class);
+        Mockito.when(pool.getId()).thenReturn(11L);
+        Mockito.when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.NetworkFilesystem);
+        Mockito.when(storagePoolDao.findByUuid(dsUuid)).thenReturn(pool);
+
+        HostVO host = mock(HostVO.class);
+        Mockito.when(host.getId()).thenReturn(8L);
+        Mockito.when(hostDao.findByIp(hostIp)).thenReturn(host);
+
+        Backup.VolumeInfo backedUp = new Backup.VolumeInfo(volUuid, "i-2-99-VM/2026/data1.qcow2",
+                Volume.Type.DATADISK, 1024L, 1L, "disk-offering-uuid", null, null);
+
+        BackupVO backup = new BackupVO();
+        backup.setVmId(99L);
+        backup.setBackupOfferingId(backupOfferingId);
+        backup.setExternalId("i-2-99-VM/2026.06.22.10.00.00");
+        backup.setSize(1024L);
+        backup.setBackedUpVolumes(new Gson().toJson(Collections.singletonList(backedUp)));
+        ReflectionTestUtils.setField(backup, "id", 200L);
+
+        BackupRepositoryVO repo = new BackupRepositoryVO(1L, "nas", "test-repo",
+                "nfs", "address", "sync", 1024L, null);
+        Mockito.when(backupRepositoryDao.findByBackupOfferingId(backupOfferingId)).thenReturn(repo);
+
+        BackupAnswer answer = mock(BackupAnswer.class);
+        Mockito.when(answer.getResult()).thenReturn(true);
+        Mockito.when(agentManager.send(Mockito.anyLong(), Mockito.any(RestoreBackupCommand.class))).thenReturn(answer);
+
+        VMInstanceVO targetVm = mock(VMInstanceVO.class);
+        Mockito.when(targetVm.getId()).thenReturn(targetVmId);
+        Mockito.when(vmInstanceDao.findVMByInstanceName(targetVmName)).thenReturn(targetVm);
+
+        VMInstanceDetailVO existing = mock(VMInstanceDetailVO.class);
+        Mockito.when(existing.getValue()).thenReturn("backup-1718000000");
+        Mockito.when(vmInstanceDetailsDao.findDetail(targetVmId, NASBackupChainKeys.VM_ACTIVE_CHECKPOINT_ID)).thenReturn(existing);
+
+        Pair<Boolean, String> result = nasBackupProvider.restoreBackedUpVolume(
+                backup, backedUp, hostIp, dsUuid, new Pair<>(targetVmName, VirtualMachine.State.Stopped), null, false);
+
+        Assert.assertTrue(result.first());
+        Mockito.verify(vmInstanceDetailsDao).removeDetail(targetVmId, NASBackupChainKeys.VM_ACTIVE_CHECKPOINT_ID);
+    }
+
+    // -- delete-pending cascade ----------------------------------------------------------
+
+    /**
+     * Deleting an incremental that has a live child must mark the incremental as
+     * delete-pending in backup_details and NOT touch the on-NAS file or the backups row.
+     * A parent with live children is soft-deleted (delete-pending) rather than removed.
+     */
+    @Test
+    public void deleteWithLiveChildMarksDeletePendingAndPreservesFile()
+            throws AgentUnavailableException, OperationTimedoutException {
+        Long zoneId = 1L;
+        Long vmId = 2L;
+        Long hostId = 3L;
+        Long offeringId = 4L;
+
+        BackupVO parent = new BackupVO();
+        parent.setVmId(vmId);
+        parent.setBackupOfferingId(offeringId);
+        parent.setExternalId("i-2-2-VM/2026.05.10.10.00.00");
+        parent.setZoneId(zoneId);
+        ReflectionTestUtils.setField(parent, "id", 50L);
+        ReflectionTestUtils.setField(parent, "uuid", "parent-uuid");
+
+        VMInstanceVO vm = mock(VMInstanceVO.class);
+        Mockito.when(vm.getLastHostId()).thenReturn(hostId);
+        HostVO host = mock(HostVO.class);
+        Mockito.when(host.getStatus()).thenReturn(Status.Up);
+        // Note: host.getId() is intentionally not stubbed — the live-child path never
+        // contacts the agent (verified below), so the stub would be unnecessary.
+        Mockito.when(hostDao.findById(hostId)).thenReturn(host);
+
+        BackupRepositoryVO repo = new BackupRepositoryVO(1L, "nas", "test-repo",
+                "nfs", "address", "sync", 1024L, null);
+        Mockito.when(backupRepositoryDao.findByBackupOfferingId(offeringId)).thenReturn(repo);
+        Mockito.when(vmInstanceDao.findByIdIncludingRemoved(vmId)).thenReturn(vm);
+
+        // CHAIN_ID on the parent => not the no-chain fast path.
+        BackupDetailVO chainIdDetail = new BackupDetailVO(50L, NASBackupChainKeys.CHAIN_ID, "chain-1", true);
+        BackupDetailVO chainPosDetail = new BackupDetailVO(50L, NASBackupChainKeys.CHAIN_POSITION, "0", true);
+        Mockito.when(backupDetailsDao.findDetail(50L, NASBackupChainKeys.CHAIN_ID)).thenReturn(chainIdDetail);
+        Mockito.when(backupDetailsDao.findDetail(50L, NASBackupChainKeys.CHAIN_POSITION)).thenReturn(chainPosDetail);
+
+        // A live child sits deeper in the chain (higher CHAIN_POSITION).
+        BackupVO child = new BackupVO();
+        child.setVmId(vmId);
+        child.setBackupOfferingId(offeringId);
+        child.setExternalId("i-2-2-VM/2026.05.10.10.30.00");
+        child.setZoneId(zoneId);
+        child.setStatus(Backup.Status.BackedUp);
+        ReflectionTestUtils.setField(child, "id", 51L);
+        ReflectionTestUtils.setField(child, "uuid", "child-uuid");
+
+        BackupDetailVO childChainId = new BackupDetailVO(51L, NASBackupChainKeys.CHAIN_ID, "chain-1", true);
+        BackupDetailVO childChainPos = new BackupDetailVO(51L, NASBackupChainKeys.CHAIN_POSITION, "1", true);
+        Mockito.when(backupDetailsDao.findDetail(51L, NASBackupChainKeys.CHAIN_ID)).thenReturn(childChainId);
+        Mockito.when(backupDetailsDao.findDetail(51L, NASBackupChainKeys.CHAIN_POSITION)).thenReturn(childChainPos);
+
+        Mockito.when(backupDao.listByVmId(null, vmId)).thenReturn(List.of(parent, child));
+        // Re-read under the chain lock + markDeletePending both load the row by id.
+        Mockito.when(backupDao.findById(50L)).thenReturn(parent);
+        Mockito.doReturn(mock(GlobalLock.class)).when(nasBackupProvider).acquireChainDeleteLock(vmId);
+
+        boolean result = nasBackupProvider.deleteBackup(parent, false);
+        Assert.assertTrue(result);
+
+        // No agent traffic — the on-NAS file must be preserved while children are alive.
+        Mockito.verify(agentManager, Mockito.never()).send(Mockito.anyLong(), Mockito.any(DeleteBackupCommand.class));
+        // No DB row removal — the row is the tombstone marker.
+        Mockito.verify(backupDao, Mockito.never()).remove(50L);
+        // A tombstoned backup is NOT decremented — its space is still occupied until swept.
+        Mockito.verify(resourceLimitMgr, Mockito.never()).decrementResourceCount(Mockito.anyLong(), Mockito.eq(Resource.ResourceType.backup));
+        // The tombstoned backup is moved to Status.Hidden (replaces the old DELETE_PENDING detail).
+        ArgumentCaptor<BackupVO> captor = ArgumentCaptor.forClass(BackupVO.class);
+        Mockito.verify(backupDao).update(Mockito.eq(50L), captor.capture());
+        Assert.assertEquals(Backup.Status.Hidden, captor.getValue().getStatus());
+        Mockito.verify(backupDetailsDao, Mockito.never()).persist(Mockito.any(BackupDetailVO.class));
+    }
+
+    /**
+     * Deleting a leaf incremental whose parent is delete-pending must (a) delete the leaf and
+     * then (b) sweep up the tombstoned parent. Mirrors DefaultSnapshotStrategy's
+     * "delete leaf, then walk up while parent is destroying-and-childless".
+     */
+    @Test
+    public void deletingLeafSweepsUpDeletePendingParent()
+            throws AgentUnavailableException, OperationTimedoutException {
+        Long zoneId = 1L;
+        Long vmId = 2L;
+        Long hostId = 3L;
+        Long offeringId = 4L;
+
+        BackupVO leaf = new BackupVO();
+        leaf.setVmId(vmId);
+        leaf.setBackupOfferingId(offeringId);
+        leaf.setExternalId("i-2-2-VM/2026.05.10.11.00.00");
+        leaf.setZoneId(zoneId);
+        ReflectionTestUtils.setField(leaf, "id", 51L);
+        ReflectionTestUtils.setField(leaf, "uuid", "leaf-uuid");
+
+        BackupVO parent = new BackupVO();
+        parent.setVmId(vmId);
+        parent.setBackupOfferingId(offeringId);
+        parent.setExternalId("i-2-2-VM/2026.05.10.10.30.00");
+        parent.setZoneId(zoneId);
+        ReflectionTestUtils.setField(parent, "id", 50L);
+        ReflectionTestUtils.setField(parent, "uuid", "parent-uuid");
+
+        VMInstanceVO vm = mock(VMInstanceVO.class);
+        Mockito.when(vm.getLastHostId()).thenReturn(hostId);
+        HostVO host = mock(HostVO.class);
+        Mockito.when(host.getStatus()).thenReturn(Status.Up);
+        Mockito.when(host.getId()).thenReturn(hostId);
+        Mockito.when(hostDao.findById(hostId)).thenReturn(host);
+
+        BackupRepositoryVO repo = new BackupRepositoryVO(1L, "nas", "test-repo",
+                "nfs", "address", "sync", 1024L, null);
+        Mockito.when(backupRepositoryDao.findByBackupOfferingId(offeringId)).thenReturn(repo);
+        Mockito.when(vmInstanceDao.findByIdIncludingRemoved(vmId)).thenReturn(vm);
+
+        // Leaf details. CHAIN_POSITION=1 puts the leaf after the full anchor in the
+        // ordered chain — getChainOrderedLeafToRoot sorts by CHAIN_POSITION descending.
+        BackupDetailVO leafChainId = new BackupDetailVO(51L, NASBackupChainKeys.CHAIN_ID, "chain-1", true);
+        BackupDetailVO leafChainPos = new BackupDetailVO(51L, NASBackupChainKeys.CHAIN_POSITION, "1", true);
+        Mockito.when(backupDetailsDao.findDetail(51L, NASBackupChainKeys.CHAIN_ID)).thenReturn(leafChainId);
+        Mockito.when(backupDetailsDao.findDetail(51L, NASBackupChainKeys.CHAIN_POSITION)).thenReturn(leafChainPos);
+
+        // Parent is the tombstoned full anchor (CHAIN_POSITION=0).
+        BackupDetailVO parentChainId = new BackupDetailVO(50L, NASBackupChainKeys.CHAIN_ID, "chain-1", true);
+        BackupDetailVO parentChainPos = new BackupDetailVO(50L, NASBackupChainKeys.CHAIN_POSITION, "0", true);
+        // The parent is the tombstone — now represented by Status.Hidden (was the DELETE_PENDING detail).
+        parent.setStatus(Backup.Status.Hidden);
+        Mockito.when(backupDetailsDao.findDetail(50L, NASBackupChainKeys.CHAIN_ID)).thenReturn(parentChainId);
+        Mockito.when(backupDetailsDao.findDetail(50L, NASBackupChainKeys.CHAIN_POSITION)).thenReturn(parentChainPos);
+
+        // We still use a mutable list + remove() answer so the DAO contract is realistic.
+        java.util.List<Backup> liveBackups = new java.util.ArrayList<>(List.of(parent, leaf));
+        Mockito.when(backupDao.listByVmId(null, vmId)).thenAnswer(inv -> new java.util.ArrayList<>(liveBackups));
+        // The target row is re-read under the chain lock before any chain decision.
+        Mockito.when(backupDao.findById(51L)).thenReturn(leaf);
+        Mockito.doReturn(mock(GlobalLock.class)).when(nasBackupProvider).acquireChainDeleteLock(vmId);
+
+        // Agent acknowledges every delete.
+        Mockito.when(agentManager.send(Mockito.anyLong(), Mockito.any(DeleteBackupCommand.class)))
+                .thenReturn(new BackupAnswer(new DeleteBackupCommand(null, null, null, null), true, "ok"));
+        // backupDao.remove(id) drops the corresponding row from the live list so the next
+        // listByVmId call reflects post-delete state — mirrors the real DAO contract.
+        Mockito.when(backupDao.remove(Mockito.anyLong())).thenAnswer(inv -> {
+            Long id = inv.getArgument(0);
+            liveBackups.removeIf(b -> b.getId() == id);
+            return true;
+        });
+
+        boolean result = nasBackupProvider.deleteBackup(leaf, false);
+        Assert.assertTrue(result);
+
+        // Both backups must be physically deleted (leaf first, then tombstoned parent).
+        Mockito.verify(agentManager, Mockito.times(2))
+                .send(Mockito.anyLong(), Mockito.any(DeleteBackupCommand.class));
+        Mockito.verify(backupDao).remove(51L);
+        Mockito.verify(backupDao).remove(50L);
+        // Exactly-once resource accounting: decremented for BOTH physically-removed backups
+        // (leaf + swept ancestor), not just one.
+        Mockito.verify(resourceLimitMgr, Mockito.times(2))
+                .decrementResourceCount(Mockito.anyLong(), Mockito.eq(Resource.ResourceType.backup));
+        Mockito.verify(resourceLimitMgr, Mockito.times(2))
+                .decrementResourceCount(Mockito.anyLong(), Mockito.eq(Resource.ResourceType.backup_storage), Mockito.any());
+    }
+
+    @Test
+    public void deletingLastLiveMemberCollectsDeeperOrphanTombstones()
+            throws AgentUnavailableException, OperationTimedoutException {
+        Long zoneId = 1L;
+        Long vmId = 2L;
+        Long hostId = 3L;
+        Long offeringId = 4L;
+
+        BackupVO full = new BackupVO();
+        full.setVmId(vmId);
+        full.setBackupOfferingId(offeringId);
+        full.setExternalId("i-2-2-VM/2026.05.10.10.00.00");
+        full.setZoneId(zoneId);
+        full.setStatus(Backup.Status.BackedUp);
+        ReflectionTestUtils.setField(full, "id", 50L);
+
+        // The last live incremental — the one being deleted.
+        BackupVO inc1 = new BackupVO();
+        inc1.setVmId(vmId);
+        inc1.setBackupOfferingId(offeringId);
+        inc1.setExternalId("i-2-2-VM/2026.05.10.10.30.00");
+        inc1.setZoneId(zoneId);
+        inc1.setStatus(Backup.Status.BackedUp);
+        ReflectionTestUtils.setField(inc1, "id", 51L);
+
+        // A stranded tombstone deeper in the chain: its own descendants are long gone, so
+        // only a sweep triggered by an ancestor's deletion can ever collect it.
+        BackupVO orphan = new BackupVO();
+        orphan.setVmId(vmId);
+        orphan.setBackupOfferingId(offeringId);
+        orphan.setExternalId("i-2-2-VM/2026.05.10.11.00.00");
+        orphan.setZoneId(zoneId);
+        orphan.setStatus(Backup.Status.Hidden);
+        ReflectionTestUtils.setField(orphan, "id", 52L);
+
+        VMInstanceVO vm = mock(VMInstanceVO.class);
+        Mockito.when(vm.getLastHostId()).thenReturn(hostId);
+        HostVO host = mock(HostVO.class);
+        Mockito.when(host.getStatus()).thenReturn(Status.Up);
+        Mockito.when(host.getId()).thenReturn(hostId);
+        Mockito.when(hostDao.findById(hostId)).thenReturn(host);
+
+        BackupRepositoryVO repo = new BackupRepositoryVO(1L, "nas", "test-repo",
+                "nfs", "address", "sync", 1024L, null);
+        Mockito.when(backupRepositoryDao.findByBackupOfferingId(offeringId)).thenReturn(repo);
+        Mockito.when(vmInstanceDao.findByIdIncludingRemoved(vmId)).thenReturn(vm);
+
+        Mockito.when(backupDetailsDao.findDetail(50L, NASBackupChainKeys.CHAIN_ID))
+                .thenReturn(new BackupDetailVO(50L, NASBackupChainKeys.CHAIN_ID, "chain-1", true));
+        Mockito.when(backupDetailsDao.findDetail(50L, NASBackupChainKeys.CHAIN_POSITION))
+                .thenReturn(new BackupDetailVO(50L, NASBackupChainKeys.CHAIN_POSITION, "0", true));
+        Mockito.when(backupDetailsDao.findDetail(51L, NASBackupChainKeys.CHAIN_ID))
+                .thenReturn(new BackupDetailVO(51L, NASBackupChainKeys.CHAIN_ID, "chain-1", true));
+        Mockito.when(backupDetailsDao.findDetail(51L, NASBackupChainKeys.CHAIN_POSITION))
+                .thenReturn(new BackupDetailVO(51L, NASBackupChainKeys.CHAIN_POSITION, "1", true));
+        Mockito.when(backupDetailsDao.findDetail(52L, NASBackupChainKeys.CHAIN_ID))
+                .thenReturn(new BackupDetailVO(52L, NASBackupChainKeys.CHAIN_ID, "chain-1", true));
+        Mockito.when(backupDetailsDao.findDetail(52L, NASBackupChainKeys.CHAIN_POSITION))
+                .thenReturn(new BackupDetailVO(52L, NASBackupChainKeys.CHAIN_POSITION, "2", true));
+
+        Mockito.when(backupDao.listByVmId(null, vmId)).thenReturn(List.of(full, inc1, orphan));
+        Mockito.when(backupDao.findById(51L)).thenReturn(inc1);
+        Mockito.doReturn(mock(GlobalLock.class)).when(nasBackupProvider).acquireChainDeleteLock(vmId);
+
+        Mockito.when(agentManager.send(Mockito.anyLong(), Mockito.any(DeleteBackupCommand.class)))
+                .thenReturn(new BackupAnswer(new DeleteBackupCommand(null, null, null, null), true, "ok"));
+
+        Assert.assertTrue(nasBackupProvider.deleteBackup(inc1, false));
+
+        // inc1 and the deeper orphan tombstone are physically removed; the live full survives.
+        Mockito.verify(agentManager, Mockito.times(2))
+                .send(Mockito.anyLong(), Mockito.any(DeleteBackupCommand.class));
+        Mockito.verify(backupDao).remove(51L);
+        Mockito.verify(backupDao).remove(52L);
+        Mockito.verify(backupDao, Mockito.never()).remove(50L);
+    }
+
+    @Test
+    public void deletingAncestorOfTombstoneWithLiveDescendantTombstonesIt()
+            throws AgentUnavailableException, OperationTimedoutException {
+        Long zoneId = 1L;
+        Long vmId = 2L;
+        Long hostId = 3L;
+        Long offeringId = 4L;
+
+        BackupVO full = new BackupVO();
+        full.setVmId(vmId);
+        full.setBackupOfferingId(offeringId);
+        full.setExternalId("i-2-2-VM/2026.05.10.10.00.00");
+        full.setZoneId(zoneId);
+        full.setStatus(Backup.Status.BackedUp);
+        ReflectionTestUtils.setField(full, "id", 50L);
+
+        BackupVO inc1 = new BackupVO();
+        inc1.setVmId(vmId);
+        inc1.setBackupOfferingId(offeringId);
+        inc1.setExternalId("i-2-2-VM/2026.05.10.10.30.00");
+        inc1.setZoneId(zoneId);
+        inc1.setStatus(Backup.Status.Hidden);
+        ReflectionTestUtils.setField(inc1, "id", 51L);
+
+        BackupVO inc2 = new BackupVO();
+        inc2.setVmId(vmId);
+        inc2.setBackupOfferingId(offeringId);
+        inc2.setExternalId("i-2-2-VM/2026.05.10.11.00.00");
+        inc2.setZoneId(zoneId);
+        inc2.setStatus(Backup.Status.BackedUp);
+        ReflectionTestUtils.setField(inc2, "id", 52L);
+
+        VMInstanceVO vm = mock(VMInstanceVO.class);
+        Mockito.when(vm.getLastHostId()).thenReturn(hostId);
+        HostVO host = mock(HostVO.class);
+        Mockito.when(host.getStatus()).thenReturn(Status.Up);
+        Mockito.when(hostDao.findById(hostId)).thenReturn(host);
+
+        BackupRepositoryVO repo = new BackupRepositoryVO(1L, "nas", "test-repo",
+                "nfs", "address", "sync", 1024L, null);
+        Mockito.when(backupRepositoryDao.findByBackupOfferingId(offeringId)).thenReturn(repo);
+        Mockito.when(vmInstanceDao.findByIdIncludingRemoved(vmId)).thenReturn(vm);
+
+        Mockito.when(backupDetailsDao.findDetail(50L, NASBackupChainKeys.CHAIN_ID))
+                .thenReturn(new BackupDetailVO(50L, NASBackupChainKeys.CHAIN_ID, "chain-1", true));
+        Mockito.when(backupDetailsDao.findDetail(50L, NASBackupChainKeys.CHAIN_POSITION))
+                .thenReturn(new BackupDetailVO(50L, NASBackupChainKeys.CHAIN_POSITION, "0", true));
+        Mockito.when(backupDetailsDao.findDetail(51L, NASBackupChainKeys.CHAIN_ID))
+                .thenReturn(new BackupDetailVO(51L, NASBackupChainKeys.CHAIN_ID, "chain-1", true));
+        Mockito.when(backupDetailsDao.findDetail(52L, NASBackupChainKeys.CHAIN_ID))
+                .thenReturn(new BackupDetailVO(52L, NASBackupChainKeys.CHAIN_ID, "chain-1", true));
+        Mockito.when(backupDetailsDao.findDetail(52L, NASBackupChainKeys.CHAIN_POSITION))
+                .thenReturn(new BackupDetailVO(52L, NASBackupChainKeys.CHAIN_POSITION, "2", true));
+
+        Mockito.when(backupDao.listByVmId(null, vmId)).thenReturn(List.of(full, inc1, inc2));
+        Mockito.when(backupDao.findById(50L)).thenReturn(full);
+        Mockito.doReturn(mock(GlobalLock.class)).when(nasBackupProvider).acquireChainDeleteLock(vmId);
+
+        Assert.assertTrue(nasBackupProvider.deleteBackup(full, false));
+
+        // The full anchor must NOT be physically deleted — inc2 (live) still restores
+        // through inc1's and full's files. It becomes a tombstone instead.
+        Mockito.verify(agentManager, Mockito.never()).send(Mockito.anyLong(), Mockito.any(DeleteBackupCommand.class));
+        Mockito.verify(backupDao, Mockito.never()).remove(Mockito.anyLong());
+        ArgumentCaptor<BackupVO> captor = ArgumentCaptor.forClass(BackupVO.class);
+        Mockito.verify(backupDao).update(Mockito.eq(50L), captor.capture());
+        Assert.assertEquals(Backup.Status.Hidden, captor.getValue().getStatus());
+    }
+
+    @Test
+    public void sweepContinuesPastFailedTombstoneDelete()
+            throws AgentUnavailableException, OperationTimedoutException {
+        Long zoneId = 1L;
+        Long vmId = 2L;
+        Long hostId = 3L;
+        Long offeringId = 4L;
+
+        BackupVO full = new BackupVO();
+        full.setVmId(vmId);
+        full.setBackupOfferingId(offeringId);
+        full.setExternalId("i-2-2-VM/2026.05.10.10.00.00");
+        full.setZoneId(zoneId);
+        full.setStatus(Backup.Status.Hidden);
+        ReflectionTestUtils.setField(full, "id", 50L);
+
+        BackupVO inc1 = new BackupVO();
+        inc1.setVmId(vmId);
+        inc1.setBackupOfferingId(offeringId);
+        inc1.setExternalId("i-2-2-VM/2026.05.10.10.30.00");
+        inc1.setZoneId(zoneId);
+        inc1.setStatus(Backup.Status.Hidden);
+        ReflectionTestUtils.setField(inc1, "id", 51L);
+
+        // The last live member — deleting it triggers the sweep of both tombstones.
+        BackupVO inc2 = new BackupVO();
+        inc2.setVmId(vmId);
+        inc2.setBackupOfferingId(offeringId);
+        inc2.setExternalId("i-2-2-VM/2026.05.10.11.00.00");
+        inc2.setZoneId(zoneId);
+        inc2.setStatus(Backup.Status.BackedUp);
+        ReflectionTestUtils.setField(inc2, "id", 52L);
+
+        VMInstanceVO vm = mock(VMInstanceVO.class);
+        Mockito.when(vm.getLastHostId()).thenReturn(hostId);
+        HostVO host = mock(HostVO.class);
+        Mockito.when(host.getStatus()).thenReturn(Status.Up);
+        Mockito.when(host.getId()).thenReturn(hostId);
+        Mockito.when(hostDao.findById(hostId)).thenReturn(host);
+
+        BackupRepositoryVO repo = new BackupRepositoryVO(1L, "nas", "test-repo",
+                "nfs", "address", "sync", 1024L, null);
+        Mockito.when(backupRepositoryDao.findByBackupOfferingId(offeringId)).thenReturn(repo);
+        Mockito.when(vmInstanceDao.findByIdIncludingRemoved(vmId)).thenReturn(vm);
+
+        Mockito.when(backupDetailsDao.findDetail(50L, NASBackupChainKeys.CHAIN_ID))
+                .thenReturn(new BackupDetailVO(50L, NASBackupChainKeys.CHAIN_ID, "chain-1", true));
+        Mockito.when(backupDetailsDao.findDetail(50L, NASBackupChainKeys.CHAIN_POSITION))
+                .thenReturn(new BackupDetailVO(50L, NASBackupChainKeys.CHAIN_POSITION, "0", true));
+        Mockito.when(backupDetailsDao.findDetail(51L, NASBackupChainKeys.CHAIN_ID))
+                .thenReturn(new BackupDetailVO(51L, NASBackupChainKeys.CHAIN_ID, "chain-1", true));
+        Mockito.when(backupDetailsDao.findDetail(51L, NASBackupChainKeys.CHAIN_POSITION))
+                .thenReturn(new BackupDetailVO(51L, NASBackupChainKeys.CHAIN_POSITION, "1", true));
+        Mockito.when(backupDetailsDao.findDetail(52L, NASBackupChainKeys.CHAIN_ID))
+                .thenReturn(new BackupDetailVO(52L, NASBackupChainKeys.CHAIN_ID, "chain-1", true));
+        Mockito.when(backupDetailsDao.findDetail(52L, NASBackupChainKeys.CHAIN_POSITION))
+                .thenReturn(new BackupDetailVO(52L, NASBackupChainKeys.CHAIN_POSITION, "2", true));
+
+        Mockito.when(backupDao.listByVmId(null, vmId)).thenReturn(List.of(full, inc1, inc2));
+        Mockito.when(backupDao.findById(52L)).thenReturn(inc2);
+        Mockito.doReturn(mock(GlobalLock.class)).when(nasBackupProvider).acquireChainDeleteLock(vmId);
+
+        // Deletes run leaf-to-root: inc2 succeeds, inc1's rm FAILS, full succeeds.
+        DeleteBackupCommand dummy = new DeleteBackupCommand(null, null, null, null);
+        Mockito.when(agentManager.send(Mockito.anyLong(), Mockito.any(DeleteBackupCommand.class)))
+                .thenReturn(new BackupAnswer(dummy, true, "ok"),
+                        new BackupAnswer(dummy, false, "rm failed"),
+                        new BackupAnswer(dummy, true, "ok"));
+
+        Assert.assertTrue(nasBackupProvider.deleteBackup(inc2, false));
+
+        // All three members were attempted; the failed inc1 keeps its row, full is collected.
+        Mockito.verify(agentManager, Mockito.times(3))
+                .send(Mockito.anyLong(), Mockito.any(DeleteBackupCommand.class));
+        Mockito.verify(backupDao).remove(52L);
+        Mockito.verify(backupDao, Mockito.never()).remove(51L);
+        Mockito.verify(backupDao).remove(50L);
+    }
 }
diff --git a/plugins/backup/networker/src/main/java/org/apache/cloudstack/backup/NetworkerBackupProvider.java b/plugins/backup/networker/src/main/java/org/apache/cloudstack/backup/NetworkerBackupProvider.java
index 4cf4bd111ef1..1cf962edae51 100644
--- a/plugins/backup/networker/src/main/java/org/apache/cloudstack/backup/NetworkerBackupProvider.java
+++ b/plugins/backup/networker/src/main/java/org/apache/cloudstack/backup/NetworkerBackupProvider.java
@@ -357,7 +357,7 @@ public boolean removeVMFromBackupOffering(VirtualMachine vm) {
     }
 
     @Override
-    public boolean restoreVMFromBackup(VirtualMachine vm, Backup backup) {
+    public boolean restoreVMFromBackup(VirtualMachine vm, Backup backup, boolean quickRestore, Long hostId) {
         String networkerServer;
         HostVO hostVO;
 
@@ -407,7 +407,8 @@ public boolean restoreVMFromBackup(VirtualMachine vm, Backup backup) {
     }
 
     @Override
-    public Pair<Boolean, String> restoreBackedUpVolume(Backup backup, Backup.VolumeInfo backupVolumeInfo, String hostIp, String dataStoreUuid, Pair<String, VirtualMachine.State> vmNameAndState) {
+    public Pair<Boolean, String> restoreBackedUpVolume(Backup backup, Backup.VolumeInfo backupVolumeInfo, String hostIp, String dataStoreUuid,
+            Pair<String, VirtualMachine.State> vmNameAndState, VirtualMachine vm, boolean quickRestore) {
         String networkerServer;
         VolumeVO volume = volumeDao.findByUuid(backupVolumeInfo.getUuid());
         final DiskOffering diskOffering = diskOfferingDao.findByUuid(backupVolumeInfo.getDiskOfferingId());
@@ -491,7 +492,7 @@ public Pair<Boolean, String> restoreBackedUpVolume(Backup backup, Backup.VolumeI
     }
 
     @Override
-    public Pair<Boolean, Backup> takeBackup(VirtualMachine vm, Boolean quiesceVM) {
+    public Pair<Boolean, Backup> takeBackup(VirtualMachine vm, Boolean quiesceVM, boolean isolated) {
         String networkerServer;
         String clusterName;
 
@@ -648,7 +649,7 @@ public void syncBackupStorageStats(Long zoneId) {
     public boolean willDeleteBackupsOnOfferingRemoval() { return false; }
 
     @Override
-    public Pair<Boolean, String> restoreBackupToVM(VirtualMachine vm, Backup backup, String hostIp, String dataStoreUuid) {
+    public Pair<Boolean, String> restoreBackupToVM(VirtualMachine vm, Backup backup, String hostIp, String dataStoreUuid, boolean quickrestore) {
         return new Pair<>(true, null);
     }
 }
diff --git a/plugins/backup/veeam/src/main/java/org/apache/cloudstack/backup/VeeamBackupProvider.java b/plugins/backup/veeam/src/main/java/org/apache/cloudstack/backup/VeeamBackupProvider.java
index 39970dab3427..9b34af2d6f49 100644
--- a/plugins/backup/veeam/src/main/java/org/apache/cloudstack/backup/VeeamBackupProvider.java
+++ b/plugins/backup/veeam/src/main/java/org/apache/cloudstack/backup/VeeamBackupProvider.java
@@ -219,7 +219,7 @@ public boolean willDeleteBackupsOnOfferingRemoval() {
     }
 
     @Override
-    public Pair<Boolean, Backup> takeBackup(final VirtualMachine vm, Boolean quiesceVM) {
+    public Pair<Boolean, Backup> takeBackup(final VirtualMachine vm, Boolean quiesceVM, boolean isolated) {
         final VeeamClient client = getClient(vm.getDataCenterId());
         Boolean result = client.startBackupJob(vm.getBackupExternalId());
         return new Pair<>(result, null);
@@ -256,7 +256,7 @@ public boolean deleteBackup(Backup backup, boolean forced) {
     }
 
     @Override
-    public boolean restoreVMFromBackup(VirtualMachine vm, Backup backup) {
+    public boolean restoreVMFromBackup(VirtualMachine vm, Backup backup, boolean quickRestore, Long hostId) {
         final String restorePointId = backup.getExternalId();
         try {
             return getClient(vm.getDataCenterId()).restoreFullVM(vm.getInstanceName(), restorePointId);
@@ -291,7 +291,8 @@ private void prepareForBackupRestoration(VirtualMachine vm) {
     }
 
     @Override
-    public Pair<Boolean, String> restoreBackedUpVolume(Backup backup, Backup.VolumeInfo backupVolumeInfo, String hostIp, String dataStoreUuid, Pair<String, VirtualMachine.State> vmNameAndState) {
+    public Pair<Boolean, String> restoreBackedUpVolume(Backup backup, Backup.VolumeInfo backupVolumeInfo, String hostIp, String dataStoreUuid,
+            Pair<String, VirtualMachine.State> vmNameAndState, VirtualMachine vm, boolean quickRestore) {
         final Long zoneId = backup.getZoneId();
         final String restorePointId = backup.getExternalId();
         return getClient(zoneId).restoreVMToDifferentLocation(restorePointId, null, hostIp, dataStoreUuid);
@@ -337,7 +338,7 @@ public List<Backup.RestorePoint> listRestorePoints(VirtualMachine vm) {
     }
 
     @Override
-    public Pair<Boolean, String> restoreBackupToVM(VirtualMachine vm, Backup backup, String hostIp, String dataStoreUuid) {
+    public Pair<Boolean, String> restoreBackupToVM(VirtualMachine vm, Backup backup, String hostIp, String dataStoreUuid, boolean quickrestore) {
         final Long zoneId = backup.getZoneId();
         final String restorePointId = backup.getExternalId();
         final String restoreLocation = vm.getInstanceName();
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaCreditsCmd.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaCreditsCmd.java
index a6d1db41ddd2..0c99efd9a2d2 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaCreditsCmd.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaCreditsCmd.java
@@ -21,14 +21,13 @@
 import org.apache.cloudstack.api.ACL;
 import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.ApiConstants;
-import org.apache.cloudstack.api.ApiErrorCode;
 import org.apache.cloudstack.api.BaseCmd;
 import org.apache.cloudstack.api.Parameter;
-import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.AccountResponse;
 import org.apache.cloudstack.api.response.DomainResponse;
+import org.apache.cloudstack.api.response.ProjectResponse;
 import org.apache.cloudstack.api.response.QuotaCreditsResponse;
 import org.apache.cloudstack.api.response.QuotaResponseBuilder;
-import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.quota.QuotaService;
 
 import javax.inject.Inject;
@@ -42,22 +41,35 @@ public class QuotaCreditsCmd extends BaseCmd {
     @Inject
     QuotaService _quotaService;
 
-
-
-    @Parameter(name = ApiConstants.ACCOUNT, type = CommandType.STRING, required = true, description = "Account Id for which quota credits need to be added")
+    @Deprecated
+    @Parameter(name = ApiConstants.ACCOUNT, type = CommandType.STRING, description = "Name of the Account for which Quota credits will be added. Deprecated, please use '" +
+            ApiConstants.ACCOUNT_ID + "' instead.")
     private String accountName;
 
     @ACL
-    @Parameter(name = ApiConstants.DOMAIN_ID, type = CommandType.UUID, required = true, entityType = DomainResponse.class, description = "Domain for which quota credits need to be added")
+    @Deprecated
+    @Parameter(name = ApiConstants.DOMAIN_ID, type = CommandType.UUID, entityType = DomainResponse.class,
+            description = "Domain of the Account specified by '" + ApiConstants.ACCOUNT + "' for which Quota credits will be added. " +
+                    "Deprecated, please use '" + ApiConstants.ACCOUNT_ID + "' instead.")
     private Long domainId;
 
-    @Parameter(name = ApiConstants.VALUE, type = CommandType.DOUBLE, required = true, description = "Value of the credits to be added+, subtracted-")
+    @ACL
+    @Parameter(name = ApiConstants.ACCOUNT_ID, type = CommandType.UUID, entityType = AccountResponse.class,
+            description = "ID of the Account for which Quota credits will be added. Cannot be specified with '" + ApiConstants.PROJECT_ID + "'.")
+    private Long accountId;
+
+    @ACL
+    @Parameter(name = ApiConstants.PROJECT_ID, type = CommandType.UUID, entityType = ProjectResponse.class,
+            description = "ID of the Project for which Quota credits will be added. Cannot be specified with '" + ApiConstants.ACCOUNT_ID + "'.")
+    private Long projectId;
+
+    @Parameter(name = ApiConstants.VALUE, type = CommandType.DOUBLE, required = true, description = "Amount of credits to be added (in case of a positive value) or subtracted (in case of a negative value).")
     private Double value;
 
-    @Parameter(name = "min_balance", type = CommandType.DOUBLE, required = false, description = "Minimum balance threshold of the Account")
+    @Parameter(name = "min_balance", type = CommandType.DOUBLE, description = "An email will be sent to the Account when the Quota credits get below this threshold.")
     private Double minBalance;
 
-    @Parameter(name = "quota_enforce", type = CommandType.BOOLEAN, required = false, description = "Account for which quota enforce is set to false will not be locked when there is no credit balance")
+    @Parameter(name = "quota_enforce", type = CommandType.BOOLEAN, description = "Whether to lock the Account when Quota credits are below zero.")
     private Boolean quotaEnforce;
 
     public Double getMinBalance() {
@@ -100,31 +112,21 @@ public void setValue(Double value) {
         this.value = value;
     }
 
+    public Long getAccountId() {
+        return accountId;
+    }
+
+    public Long getProjectId() {
+        return projectId;
+    }
+
     public QuotaCreditsCmd() {
         super();
     }
 
     @Override
     public void execute() {
-        Long accountId = null;
-        Account account = _accountService.getActiveAccountByName(accountName, domainId);
-        if (account != null) {
-            accountId = account.getAccountId();
-        }
-        if (accountId == null) {
-            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "The Account does not exists or has been removed/disabled");
-        }
-        if (getValue() == null) {
-            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "Please send a valid non-empty quota value");
-        }
-        if (getQuotaEnforce() != null) {
-            _quotaService.setLockAccount(accountId, getQuotaEnforce());
-        }
-        if (getMinBalance() != null) {
-            _quotaService.setMinBalance(accountId, getMinBalance());
-        }
-
-        final QuotaCreditsResponse response = _responseBuilder.addQuotaCredits(accountId, getDomainId(), getValue(), CallContext.current().getCallingUserId(), getQuotaEnforce());
+        QuotaCreditsResponse response = _responseBuilder.addQuotaCredits(this);
         response.setResponseName(getCommandName());
         response.setObjectName("quotacredits");
         setResponseObject(response);
@@ -132,10 +134,6 @@ public void execute() {
 
     @Override
     public long getEntityOwnerId() {
-        Account account = _accountService.getActiveAccountByName(accountName, domainId);
-        if (account != null) {
-            return account.getAccountId();
-        }
         return Account.ACCOUNT_ID_SYSTEM;
     }
 
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaCreditsListCmd.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaCreditsListCmd.java
index 48bb7ef79e70..7555923600d9 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaCreditsListCmd.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaCreditsListCmd.java
@@ -18,7 +18,7 @@
 
 import com.cloud.utils.Pair;
 
-import org.apache.cloudstack.api.ACL;
+import org.apache.cloudstack.acl.RoleType;
 import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.BaseCmd;
@@ -26,8 +26,10 @@
 import org.apache.cloudstack.api.response.AccountResponse;
 import org.apache.cloudstack.api.response.DomainResponse;
 import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.api.response.ProjectResponse;
 import org.apache.cloudstack.api.response.QuotaCreditsResponse;
 import org.apache.cloudstack.api.response.QuotaResponseBuilder;
+import org.apache.commons.lang3.BooleanUtils;
 import org.apache.commons.lang3.ObjectUtils;
 import org.apache.commons.lang3.time.DateUtils;
 
@@ -44,13 +46,16 @@ public class QuotaCreditsListCmd extends BaseCmd {
     @Inject
     QuotaResponseBuilder quotaResponseBuilder;
 
-    @ACL
-    @Parameter(name = ApiConstants.ACCOUNT_ID, type = CommandType.UUID, entityType = AccountResponse.class, description = "ID of the account for which the credit statement will be generated.")
+    @Parameter(name = ApiConstants.ACCOUNT_ID, type = CommandType.UUID, entityType = AccountResponse.class,
+            description = "ID of the Account for which the credit statement will be generated. Cannot be specified with '" + ApiConstants.PROJECT_ID + "'.")
     private Long accountId;
 
-    @ACL
-    @Parameter(name = ApiConstants.DOMAIN_ID, type = CommandType.UUID, entityType = DomainResponse.class, description = "ID of the domain for which credit statement will be generated. " +
-            "Available only for administrators.")
+    @Parameter(name = ApiConstants.PROJECT_ID, type = CommandType.UUID, entityType = ProjectResponse.class,
+            description = "ID of the Project for which the credit statement will be generated. Cannot be specified with '" + ApiConstants.ACCOUNT_ID + "'.")
+    private Long projectId;
+
+    @Parameter(name = ApiConstants.DOMAIN_ID, type = CommandType.UUID, entityType = DomainResponse.class, description = "ID of the Domain for which credit statement will be generated. " +
+            "Available only for administrators.", authorized = {RoleType.Admin, RoleType.DomainAdmin})
     private Long domainId;
 
     @Parameter(name = ApiConstants.END_DATE, type = CommandType.DATE, description = "End date of the credit statement. If not provided, the current date will be " +
@@ -97,14 +102,18 @@ public void setStartDate(Date startDate) {
         this.startDate = startDate;
     }
 
-    public Boolean getRecursive() {
-        return recursive;
+    public boolean isRecursive() {
+        return BooleanUtils.isTrue(recursive);
     }
 
     public void setRecursive(Boolean recursive) {
         this.recursive = recursive;
     }
 
+    public Long getProjectId() {
+        return projectId;
+    }
+
     @Override
     public void execute() {
         Pair<List<QuotaCreditsResponse>, Integer> responses = quotaResponseBuilder.createQuotaCreditsListResponse(this);
@@ -116,7 +125,10 @@ public void execute() {
 
     @Override
     public long getEntityOwnerId() {
-        return -1;
+        if (ObjectUtils.allNull(accountId, projectId)) {
+            return -1;
+        }
+        return _accountService.finalizeAccountId(accountId, null, null, projectId);
     }
 
 }
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaSummaryCmd.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaSummaryCmd.java
index 870b9b6df6e5..89ab96ebb9f8 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaSummaryCmd.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaSummaryCmd.java
@@ -116,6 +116,9 @@ public void setListAll(Boolean listAll) {
     }
 
     public Long getProjectId() {
+        if (projectId == null || projectId == -1L) {
+            return null;
+        }
         return projectId;
     }
 
@@ -129,9 +132,10 @@ public QuotaAccountStateFilter getAccountStateToShow() {
 
     @Override
     public long getEntityOwnerId() {
-        if (ObjectUtils.allNull(accountId, accountName, projectId)) {
+        Long convertedProjectId = getProjectId();
+        if (ObjectUtils.allNull(accountId, accountName, convertedProjectId)) {
             return -1;
         }
-        return _accountService.finalizeAccountId(accountId, accountName, domainId, projectId);
+        return _accountService.finalizeAccountId(accountId, accountName, domainId, convertedProjectId);
     }
 }
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilder.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilder.java
index 63bf043f4fa9..c1a677da9355 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilder.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilder.java
@@ -19,6 +19,7 @@
 import com.cloud.user.User;
 import org.apache.cloudstack.api.command.QuotaBalanceCmd;
 import org.apache.cloudstack.api.command.QuotaConfigureEmailCmd;
+import org.apache.cloudstack.api.command.QuotaCreditsCmd;
 import org.apache.cloudstack.api.command.QuotaCreditsListCmd;
 import org.apache.cloudstack.api.command.QuotaEmailTemplateListCmd;
 import org.apache.cloudstack.api.command.QuotaEmailTemplateUpdateCmd;
@@ -54,7 +55,7 @@ public interface QuotaResponseBuilder {
 
     Pair<List<QuotaSummaryResponse>, Integer> createQuotaSummaryResponse(QuotaSummaryCmd cmd);
 
-    QuotaCreditsResponse addQuotaCredits(Long accountId, Long domainId, Double amount, Long updatedBy, Boolean enforce);
+    QuotaCreditsResponse addQuotaCredits(QuotaCreditsCmd cmd);
 
     List<QuotaEmailTemplateResponse> listQuotaEmailTemplates(QuotaEmailTemplateListCmd cmd);
 
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java
index b71057e64234..6727ab58141f 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java
@@ -44,13 +44,23 @@
 import com.cloud.event.ActionEvent;
 import com.cloud.event.EventTypes;
 import com.cloud.exception.InvalidParameterValueException;
-import com.cloud.exception.PermissionDeniedException;
+import com.cloud.network.VpnUserVO;
 import com.cloud.network.dao.IPAddressDao;
 import com.cloud.network.dao.IPAddressVO;
+import com.cloud.network.dao.LoadBalancerDao;
+import com.cloud.network.dao.LoadBalancerVO;
 import com.cloud.network.dao.NetworkDao;
 import com.cloud.network.dao.NetworkVO;
+import com.cloud.network.dao.VpnUserDao;
+import com.cloud.network.rules.PortForwardingRuleVO;
+import com.cloud.network.rules.dao.PortForwardingRulesDao;
+import com.cloud.network.security.SecurityGroupVO;
+import com.cloud.network.security.dao.SecurityGroupDao;
+import com.cloud.network.vpc.VpcVO;
 import com.cloud.offerings.dao.NetworkOfferingDao;
 import com.cloud.offerings.NetworkOfferingVO;
+import com.cloud.storage.BucketVO;
+import com.cloud.storage.dao.BucketDao;
 import com.cloud.storage.dao.VMTemplateDao;
 import com.cloud.storage.dao.VolumeDao;
 import com.cloud.storage.dao.SnapshotDao;
@@ -67,7 +77,9 @@
 import com.cloud.utils.DateUtil;
 import com.cloud.utils.Pair;
 import com.cloud.utils.db.EntityManager;
+import com.cloud.utils.db.TransactionLegacy;
 import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.utils.net.Ip;
 import com.cloud.vm.VMInstanceVO;
 import com.cloud.vm.dao.VMInstanceDao;
 import org.apache.cloudstack.acl.ControlledEntity;
@@ -77,6 +89,7 @@
 import org.apache.cloudstack.api.ServerApiException;
 import org.apache.cloudstack.api.command.QuotaBalanceCmd;
 import org.apache.cloudstack.api.command.QuotaConfigureEmailCmd;
+import org.apache.cloudstack.api.command.QuotaCreditsCmd;
 import org.apache.cloudstack.api.command.QuotaCreditsListCmd;
 import org.apache.cloudstack.api.command.QuotaEmailTemplateListCmd;
 import org.apache.cloudstack.api.command.QuotaEmailTemplateUpdateCmd;
@@ -114,6 +127,7 @@
 import org.apache.cloudstack.quota.dao.QuotaTariffUsageDao;
 import org.apache.cloudstack.quota.dao.QuotaUsageDao;
 import org.apache.cloudstack.quota.dao.QuotaUsageJoinDao;
+import org.apache.cloudstack.quota.dao.VpcDao;
 import org.apache.cloudstack.quota.vo.QuotaAccountVO;
 import org.apache.cloudstack.quota.vo.QuotaBalanceVO;
 import org.apache.cloudstack.quota.vo.QuotaCreditsVO;
@@ -180,6 +194,8 @@ public class QuotaResponseBuilderImpl implements QuotaResponseBuilder {
     @Inject
     private NetworkDao networkDao;
     @Inject
+    private VpcDao vpcDao;
+    @Inject
     private NetworkOfferingDao networkOfferingDao;
     @Inject
     private SnapshotDao snapshotDao;
@@ -190,6 +206,16 @@ public class QuotaResponseBuilderImpl implements QuotaResponseBuilder {
     @Inject
     private VolumeDao volumeDao;
     @Inject
+    private BucketDao bucketDao;
+    @Inject
+    private VpnUserDao vpnUserDao;
+    @Inject
+    private LoadBalancerDao loadBalancerDao;
+    @Inject
+    private PortForwardingRulesDao portForwardingRulesDao;
+    @Inject
+    private SecurityGroupDao securityGroupDao;
+    @Inject
     private QuotaUsageJoinDao quotaUsageJoinDao;
     @Inject
     private QuotaTariffUsageDao quotaTariffUsageDao;
@@ -412,45 +438,52 @@ protected QuotaStatementItemResponse createStatementItem(int usageType, List<Quo
         QuotaTypes quotaType = QuotaTypes.listQuotaTypes().get(type);
 
         QuotaStatementItemResponse item = new QuotaStatementItemResponse(type);
-        item.setQuotaUsed(usageRecords.stream().map(QuotaUsageJoinVO::getQuotaUsed).filter(Objects::nonNull).reduce(BigDecimal.ZERO, BigDecimal::add));
+
+        BigDecimal quotaUsed = usageRecords.stream().map(QuotaUsageJoinVO::getQuotaUsed).filter(Objects::nonNull).reduce(BigDecimal.ZERO, BigDecimal::add);
+        item.setQuotaUsed(quotaUsed);
         item.setUsageUnit(quotaType.getQuotaUnit());
         item.setUsageName(quotaType.getQuotaName());
 
-        setStatementItemResources(item, usageType, usageRecords, showResources);
+        if (showResources) {
+            setStatementItemResources(item, usageType, usageRecords);
+        } else {
+            List<QuotaStatementItemHistoryResponse> history = createQuotaConsumptionHistory(usageRecords, quotaUsed);
+            item.setHistory(history);
+        }
+
         return item;
     }
 
-    protected void setStatementItemResources(QuotaStatementItemResponse statementItem, int usageType, List<QuotaUsageJoinVO> quotaUsageRecords, boolean showResources) {
-        if (!showResources) {
-            return;
-        }
-
+    protected void setStatementItemResources(QuotaStatementItemResponse statementItem, int usageType, List<QuotaUsageJoinVO> quotaUsageRecords) {
         List<QuotaStatementItemResourceResponse> itemDetails = new ArrayList<>();
 
-        Map<Long, BigDecimal> quotaUsagesValuesAggregatedById = quotaUsageRecords
+        Map<Long, List<QuotaUsageJoinVO>> quotaUsagesAggregatedByResourceId = quotaUsageRecords
                 .stream()
                 .filter(quotaUsageJoinVo -> getResourceIdByUsageType(quotaUsageJoinVo, usageType) != null)
-                .collect(Collectors.groupingBy(
-                        quotaUsageJoinVo -> getResourceIdByUsageType(quotaUsageJoinVo, usageType),
-                        Collectors.reducing(new BigDecimal(0), QuotaUsageJoinVO::getQuotaUsed, BigDecimal::add)
+                .collect(Collectors.groupingBy(quotaUsageJoinVo -> getResourceIdByUsageType(quotaUsageJoinVo, usageType)
                 ));
 
-        for (Map.Entry<Long, BigDecimal> entry : quotaUsagesValuesAggregatedById.entrySet()) {
-            QuotaStatementItemResourceResponse detail = new QuotaStatementItemResourceResponse();
-
-            detail.setQuotaUsed(entry.getValue());
-
+        for (Map.Entry<Long, List<QuotaUsageJoinVO>> entry : quotaUsagesAggregatedByResourceId.entrySet()) {
             QuotaUsageResourceVO resource = getResourceFromIdAndType(entry.getKey(), usageType);
+
+            QuotaStatementItemResourceResponse detail = new QuotaStatementItemResourceResponse();
             if (resource != null) {
                 detail.setResourceId(resource.getUuid());
                 detail.setDisplayName(resource.getName());
                 detail.setRemoved(resource.isRemoved());
             } else {
                 detail.setDisplayName("<untraceable>");
-
             }
+            BigDecimal quotaUsed = entry.getValue().stream()
+                    .map(QuotaUsageJoinVO::getQuotaUsed)
+                    .reduce(BigDecimal.ZERO, BigDecimal::add);
+            List<QuotaStatementItemHistoryResponse> history = createQuotaConsumptionHistory(entry.getValue(), quotaUsed);
+            detail.setQuotaUsed(quotaUsed);
+            detail.setHistory(history);
+
             itemDetails.add(detail);
         }
+
         statementItem.setResources(itemDetails);
     }
 
@@ -470,6 +503,7 @@ protected QuotaUsageResourceVO getResourceFromIdAndType(long resourceId, int usa
         switch (usageType) {
             case QuotaTypes.ALLOCATED_VM:
             case QuotaTypes.RUNNING_VM:
+            case QuotaTypes.BACKUP:
                 VMInstanceVO vmInstance = vmInstanceDao.findByIdIncludingRemoved(resourceId);
                 if (vmInstance != null) {
                     return new QuotaUsageResourceVO(vmInstance.getUuid(), vmInstance.getHostName(), vmInstance.getRemoved());
@@ -496,11 +530,18 @@ protected QuotaUsageResourceVO getResourceFromIdAndType(long resourceId, int usa
                 break;
             case QuotaTypes.NETWORK_BYTES_SENT:
             case QuotaTypes.NETWORK_BYTES_RECEIVED:
+            case QuotaTypes.NETWORK:
                 NetworkVO network = networkDao.findByIdIncludingRemoved(resourceId);
                 if (network != null) {
                     return new QuotaUsageResourceVO(network.getUuid(), network.getName(), network.getRemoved());
                 }
                 break;
+            case QuotaTypes.VPC:
+                VpcVO vpc = vpcDao.findByIdIncludingRemoved(resourceId);
+                if (vpc != null) {
+                    return new QuotaUsageResourceVO(vpc.getUuid(), vpc.getName(), vpc.getRemoved());
+                }
+                break;
             case QuotaTypes.TEMPLATE:
             case QuotaTypes.ISO:
                 VMTemplateVO vmTemplate = vmTemplateDao.findByIdIncludingRemoved(resourceId);
@@ -520,10 +561,76 @@ protected QuotaUsageResourceVO getResourceFromIdAndType(long resourceId, int usa
                     return new QuotaUsageResourceVO(ipAddress.getUuid(), ipAddress.getName(), ipAddress.getRemoved());
                 }
                 break;
+            case QuotaTypes.BUCKET:
+                BucketVO bucket = bucketDao.findByIdIncludingRemoved(resourceId);
+                if (bucket != null) {
+                    return new QuotaUsageResourceVO(bucket.getUuid(), bucket.getName(), bucket.getRemoved());
+                }
+                break;
+            case QuotaTypes.VPN_USERS:
+                VpnUserVO vpnUser = vpnUserDao.findByIdIncludingRemoved(resourceId);
+                if (vpnUser != null) {
+                    return new QuotaUsageResourceVO(vpnUser.getUuid(), vpnUser.getUsername(), null);
+                }
+                break;
+            case QuotaTypes.SECURITY_GROUP:
+                SecurityGroupVO securityGroup = securityGroupDao.findByIdIncludingRemoved(resourceId);
+                if (securityGroup != null) {
+                    return new QuotaUsageResourceVO(securityGroup.getUuid(), securityGroup.getName(), null);
+                }
+                break;
+            case QuotaTypes.LOAD_BALANCER_POLICY:
+                LoadBalancerVO loadBalancer = loadBalancerDao.findByIdIncludingRemoved(resourceId);
+                if (loadBalancer != null) {
+                    return new QuotaUsageResourceVO(loadBalancer.getUuid(), loadBalancer.getName(), loadBalancer.getRemoved());
+                }
+                break;
+            case QuotaTypes.PORT_FORWARDING_RULE:
+                PortForwardingRuleVO portForwardingRule = portForwardingRulesDao.findByIdIncludingRemoved(resourceId);
+                if (portForwardingRule == null) {
+                    return null;
+                }
+                IPAddressVO source = ipAddressDao.findByIdIncludingRemoved(portForwardingRule.getSourceIpAddressId());
+                Ip destination = portForwardingRule.getDestinationIpAddress();
+                if (ObjectUtils.anyNull(source, destination)) {
+                    return null;
+                }
+                String displayName = String.format("%s:%s-%s to %s:%s-%s", source.getAddress(), portForwardingRule.getSourcePortStart(),
+                        portForwardingRule.getSourcePortEnd(), destination, portForwardingRule.getDestinationPortStart(),
+                        portForwardingRule.getDestinationPortEnd());
+                return new QuotaUsageResourceVO(portForwardingRule.getUuid(), displayName, portForwardingRule.getRemoved());
         }
         return null;
     }
 
+    protected List<QuotaStatementItemHistoryResponse> createQuotaConsumptionHistory(List<QuotaUsageJoinVO> quotaUsage, BigDecimal quotaUsed) {
+        if (quotaUsed.equals(BigDecimal.ZERO)) {
+            logger.debug("Not generating Quota consumption history because the item has not consumed any Quota in the period.");
+            return null;
+        }
+
+        Map<Date, QuotaStatementItemHistoryResponse> history = new HashMap<>();
+        for (QuotaUsageJoinVO record : quotaUsage) {
+            if (ObjectUtils.anyNull(record.getUsageItemId(), record.getQuotaUsed())) {
+                continue;
+            }
+
+            QuotaStatementItemHistoryResponse item = history.computeIfAbsent(
+                    record.getEndDate(),
+                    key -> new QuotaStatementItemHistoryResponse()
+            );
+            if (item.getStartDate() == null || item.getStartDate().after(record.getStartDate())) {
+                item.setStartDate(record.getStartDate());
+            }
+            item.setEndDate(record.getEndDate());
+            item.setQuotaConsumed(item.getQuotaConsumed().add(record.getQuotaUsed()));
+
+            history.put(record.getEndDate(), item);
+        }
+
+        return history.values().stream().sorted(Comparator.comparing(QuotaStatementItemHistoryResponse::getEndDate)).collect(Collectors.toList());
+    }
+
     @Override
     public Pair<List<QuotaTariffVO>, Integer> listQuotaTariffPlans(final QuotaTariffListCmd cmd) {
         Date startDate = cmd.getEffectiveDate();
@@ -661,49 +768,88 @@ protected void validateEndDateOnCreatingNewQuotaTariff(QuotaTariffVO newQuotaTar
     }
 
     @Override
-    public QuotaCreditsResponse addQuotaCredits(Long accountId, Long domainId, Double amount, Long updatedBy, Boolean enforce) {
-        Date depositedOn = new Date();
-        QuotaBalanceVO qb = _quotaBalanceDao.findLaterBalanceEntry(accountId, domainId, depositedOn);
+    public QuotaCreditsResponse addQuotaCredits(QuotaCreditsCmd cmd) {
+        Double value = cmd.getValue();
+        if (value == null) {
+            throw new InvalidParameterValueException("Please specify a valid amount of credits.");
+        }
 
-        if (qb != null) {
-            throw new InvalidParameterValueException(String.format("Incorrect deposit date [%s], as there are balance entries after this date.",
-                    depositedOn));
+        Long accountId = _accountMgr.finalizeAccountId(cmd.getAccountId(), cmd.getAccountName(), cmd.getDomainId(), cmd.getProjectId());
+        AccountVO account = _accountDao.findById(accountId);
+        Long domainId = account.getDomainId();
+
+        Date depositedOn = new Date();
+        boolean lockAccountEnforcement = "true".equalsIgnoreCase(QuotaConfig.QuotaEnableEnforcement.value());
+
+        QuotaCreditsVO result;
+        try (TransactionLegacy ignored = TransactionLegacy.open(TransactionLegacy.USAGE_DB)) {
+            QuotaBalanceVO qb = _quotaBalanceDao.findLaterBalanceEntry(accountId, domainId, depositedOn);
+            if (qb != null) {
+                throw new InvalidParameterValueException(String.format("Incorrect deposit date [%s], as there are balance entries after this date.",
+                        depositedOn));
+            }
+            result = persistQuotaCredits(cmd, value, depositedOn, account, lockAccountEnforcement);
+        } finally {
+            // Swap back to cloud
+            TransactionLegacy.open(TransactionLegacy.CLOUD_DB).close();
         }
 
-        QuotaCreditsVO credits = new QuotaCreditsVO(accountId, domainId, new BigDecimal(amount), updatedBy);
+        UserVO creditor = getCreditorForQuotaCredits(result);
+        return createQuotaCreditsResponse(result, creditor);
+    }
+
+    protected QuotaCreditsVO persistQuotaCredits(QuotaCreditsCmd cmd, Double value, Date depositedOn, AccountVO account, boolean lockAccountEnforcement) {
+        Long accountId = account.getId();
+        Long domainId = account.getDomainId();
+        long callingUserId = CallContext.current().getCallingUserId();
+        QuotaCreditsVO credits = new QuotaCreditsVO(accountId, domainId, new BigDecimal(value), callingUserId);
         credits.setUpdatedOn(depositedOn);
         QuotaCreditsVO result = quotaCreditsDao.saveCredits(credits);
-        if (result == null) {
-            logger.error("Unable to add credits to account ID [{}].", accountId);
-            throw new CloudRuntimeException("Unable to add credits to account.");
-        }
 
-        final AccountVO account = _accountDao.findById(accountId);
-        if (account == null) {
-            throw new InvalidParameterValueException("Account does not exist with account id " + accountId);
-        }
-        final boolean lockAccountEnforcement = "true".equalsIgnoreCase(QuotaConfig.QuotaEnableEnforcement.value());
-        final BigDecimal currentAccountBalance = _quotaBalanceDao.getLastQuotaBalance(accountId, domainId);
-        logger.debug("Depositing [{}] credits on adjusted date [{}]; current balance is [{}].", amount,
+        BigDecimal currentAccountBalance = _quotaBalanceDao.getLastQuotaBalance(accountId, domainId);
+        logger.debug("Depositing [{}] credits on adjusted date [{}]; current balance is [{}].", value,
                 DateUtil.displayDateInTimezone(QuotaManagerImpl.getUsageAggregationTimeZone(), depositedOn), currentAccountBalance);
-        // update quota account with the balance
         _quotaService.saveQuotaAccount(account, currentAccountBalance, depositedOn);
+
+        Boolean enforceQuota = cmd.getQuotaEnforce();
+        if (enforceQuota != null) {
+            _quotaService.setLockAccount(accountId, enforceQuota);
+        }
+
+        Double minBalance = cmd.getMinBalance();
+        if (minBalance != null) {
+            _quotaService.setMinBalance(accountId, minBalance);
+        }
+
         if (lockAccountEnforcement) {
-            if (currentAccountBalance.compareTo(new BigDecimal(0)) >= 0) {
-                if (account.getState() == Account.State.LOCKED) {
-                    logger.info("UnLocking account " + account.getAccountName() + " , due to positive balance " + currentAccountBalance);
-                    _accountMgr.enableAccount(account.getAccountName(), domainId, accountId);
-                }
-            } else { // currentAccountBalance < 0 then lock the account
-                if (_quotaManager.isLockable(account) && account.getState() == Account.State.ENABLED && enforce) {
-                    logger.info("Locking account " + account.getAccountName() + " , due to negative balance " + currentAccountBalance);
-                    _accountMgr.lockAccount(account.getAccountName(), domainId, accountId);
-                }
+            // Need to open a transaction for the cloud data base, and then swap back to cloud_usage
+            try (TransactionLegacy ignored = TransactionLegacy.open(TransactionLegacy.CLOUD_DB)) {
+                lockOrUnlockAccountIfRequired(currentAccountBalance, account, enforceQuota);
+            } finally {
+                TransactionLegacy.open(TransactionLegacy.USAGE_DB).close();
             }
         }
 
-        UserVO creditor = getCreditorForQuotaCredits(result);
-        return createQuotaCreditsResponse(result, creditor);
+        return result;
+    }
+
+    protected void lockOrUnlockAccountIfRequired(BigDecimal currentAccountBalance, AccountVO account, Boolean enforceQuota) {
+        Long accountId = account.getId();
+        Long domainId = account.getDomainId();
+        String accountName = account.getAccountName();
+
+        if (currentAccountBalance.compareTo(BigDecimal.ZERO) >= 0) {
+            if (account.getState() == Account.State.LOCKED) {
+                logger.info("Unlocking Account [{}] due to positive balance.", accountName);
+                _accountMgr.enableAccount(accountName, domainId, accountId);
+            }
+            return;
+        }
+
+        if (Boolean.TRUE.equals(enforceQuota) && account.getState() == Account.State.ENABLED && _quotaManager.isLockable(account)) {
+            logger.info("Locking Account [{}] due to negative balance.", accountName);
+            _accountMgr.lockAccount(accountName, domainId, accountId);
+        }
     }
 
     private QuotaEmailTemplateResponse createQuotaEmailResponse(QuotaEmailTemplatesVO template) {
@@ -1036,26 +1182,16 @@ public Pair<List<QuotaCreditsResponse>, Integer> createQuotaCreditsListResponse(
     }
 
     protected List<QuotaCreditsVO> getCreditsForQuotaCreditsList(QuotaCreditsListCmd cmd) {
-        Long accountId = cmd.getAccountId();
-        Long domainId = cmd.getDomainId();
+        Long accountId = getAccountIdForQuotaStatement(cmd.getEntityOwnerId(), null);
+        Pair<Long, List<Long>> baseDomainAndFilteredDomains = getDomainIdsForQuotaStatement(accountId, cmd.getDomainId(), cmd.isRecursive());
         Date startDate = cmd.getStartDate();
         Date endDate = cmd.getEndDate();
-        boolean isRecursive = cmd.getRecursive();
-
-        if (ObjectUtils.allNull(accountId, domainId)) {
-            throw new InvalidParameterValueException("Please provide either account ID or domain ID.");
-        }
 
         if (startDate.after(endDate)) {
             throw new InvalidParameterValueException("The start date must be before the end date.");
         }
 
-        Account caller = CallContext.current().getCallingAccount();
-        if (domainId != null && _accountMgr.isNormalUser(caller.getAccountId())) {
-            throw new PermissionDeniedException("Regular users are not allowed to generate domain statements.");
-        }
-
-        return quotaCreditsDao.findCredits(accountId, domainId, startDate, endDate, isRecursive);
+        return quotaCreditsDao.findCredits(accountId, baseDomainAndFilteredDomains.second(), startDate, endDate);
     }
 
     /**
@@ -1208,6 +1344,14 @@ public QuotaResourceStatementResponse createQuotaResourceStatement(QuotaResource
         return createQuotaResourceStatementResponse(resourceUuid, usageType, quotaResourceStatementItemResponseList, totalQuotaUsed);
     }
 
+    /**
+     * Determines the appropriate Account ID to use for Quota statement-related operations while ensuring correct permissions.
+     *
+     * @param providedAccountId the ID of the Account provided to the command.
+     * @param fallbackAccountId the ID of a fallback Account to use for User Accounts if no specific Account ID was provided.
+     *                          If null, then we fallback to the User Account itself.
+     * @return the account ID to be used for the Quota statement, or null if no specific Account limitation is required.
+     */
     protected Long getAccountIdForQuotaStatement(long providedAccountId, Long fallbackAccountId) {
         Account caller = CallContext.current().getCallingAccount();
 
@@ -1235,6 +1379,17 @@ protected Long getAccountIdForQuotaStatement(long providedAccountId, Long fallba
         return caller.getAccountId();
     }
 
+    /**
+     * Determines the Domains for which a Quota statement should be generated while ensuring correct permissions.
+     *
+     * @param finalAccountId the Account ID determined via <code>org.apache.cloudstack.api.response.QuotaResponseBuilderImpl#getAccountIdForQuotaStatement(long, java.lang.Long)</code>.
+     * @param providedDomainId the Domain ID provided to the command.
+     * @param isRecursive the recursion flag provided to the command.
+     * @return A pair containing:
+     *         - The base Domain's ID as the first element. This can be null if we are not limiting by Domain.
+     *         - A list containing the base Domain's ID and optionally its children if
+     *           the recursion flag is true. Also nullable.
+     */
     protected Pair<Long, List<Long>> getDomainIdsForQuotaStatement(Long finalAccountId, Long providedDomainId, boolean isRecursive) {
         if (finalAccountId != null) {
             // Access to the provided account has already been validated
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaStatementItemHistoryResponse.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaStatementItemHistoryResponse.java
new file mode 100644
index 000000000000..7799326ea54b
--- /dev/null
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaStatementItemHistoryResponse.java
@@ -0,0 +1,68 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//with the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+package org.apache.cloudstack.api.response;
+
+import com.cloud.serializer.Param;
+import com.google.gson.annotations.SerializedName;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseResponse;
+
+import java.math.BigDecimal;
+import java.util.Date;
+
+public class QuotaStatementItemHistoryResponse extends BaseResponse {
+
+    @SerializedName(ApiConstants.START_DATE)
+    @Param(description = "Start date of the item.")
+    private Date startDate;
+
+    @SerializedName(ApiConstants.END_DATE)
+    @Param(description = "End date of the item.")
+    private Date endDate;
+
+    @SerializedName(ApiConstants.QUOTA_CONSUMED)
+    @Param(description = "Amount of quota consumed.")
+    private BigDecimal quotaConsumed = BigDecimal.ZERO;
+
+    public QuotaStatementItemHistoryResponse() {
+    }
+
+    public Date getStartDate() {
+        return startDate;
+    }
+
+    public void setStartDate(Date startDate) {
+        this.startDate = startDate;
+    }
+
+    public Date getEndDate() {
+        return endDate;
+    }
+
+    public void setEndDate(Date endDate) {
+        this.endDate = endDate;
+    }
+
+    public BigDecimal getQuotaConsumed() {
+        return quotaConsumed;
+    }
+
+    public void setQuotaConsumed(BigDecimal quotaConsumed) {
+        this.quotaConsumed = quotaConsumed;
+    }
+
+}
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaStatementItemResourceResponse.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaStatementItemResourceResponse.java
index 3e052f733391..68585a90d393 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaStatementItemResourceResponse.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaStatementItemResourceResponse.java
@@ -17,6 +17,7 @@
 package org.apache.cloudstack.api.response;
 
 import java.math.BigDecimal;
+import java.util.List;
 
 import com.google.gson.annotations.SerializedName;
 
@@ -43,6 +44,10 @@ public class QuotaStatementItemResourceResponse extends BaseResponse {
     @Param(description = "Indicates whether the resource is removed or active.")
     private boolean removed;
 
+    @SerializedName(ApiConstants.HISTORY)
+    @Param(description = "Quota consumption history.")
+    private List<QuotaStatementItemHistoryResponse> history;
+
     public void setQuotaUsed(BigDecimal quotaUsed) {
         this.quotaUsed = quotaUsed;
     }
@@ -58,4 +63,9 @@ public void setDisplayName(String displayName) {
     public void setRemoved(boolean removed) {
         this.removed = removed;
     }
+
+    public void setHistory(List<QuotaStatementItemHistoryResponse> history) {
+        this.history = history;
+    }
+
 }
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaStatementItemResponse.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaStatementItemResponse.java
index 0747c5a9172d..f04fffdf7790 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaStatementItemResponse.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaStatementItemResponse.java
@@ -48,6 +48,10 @@ public class QuotaStatementItemResponse extends BaseResponse {
     @Param(description = "Item's resources.")
     private List<QuotaStatementItemResourceResponse> resources;
 
+    @SerializedName(ApiConstants.HISTORY)
+    @Param(description = "Quota consumption history.")
+    private List<QuotaStatementItemHistoryResponse> history;
+
     public QuotaStatementItemResponse(final int usageType) {
         this.usageType = usageType;
     }
@@ -92,4 +96,7 @@ public void setResources(List<QuotaStatementItemResourceResponse> resources) {
         this.resources = resources;
     }
 
+    public void setHistory(List<QuotaStatementItemHistoryResponse> history) {
+        this.history = history;
+    }
 }
diff --git a/plugins/database/quota/src/test/java/org/apache/cloudstack/api/command/QuotaCreditsCmdTest.java b/plugins/database/quota/src/test/java/org/apache/cloudstack/api/command/QuotaCreditsCmdTest.java
index 06dd57ad41d3..b02cffbd2f0a 100644
--- a/plugins/database/quota/src/test/java/org/apache/cloudstack/api/command/QuotaCreditsCmdTest.java
+++ b/plugins/database/quota/src/test/java/org/apache/cloudstack/api/command/QuotaCreditsCmdTest.java
@@ -16,16 +16,9 @@
 // under the License.
 package org.apache.cloudstack.api.command;
 
-import static org.mockito.ArgumentMatchers.anyBoolean;
-import static org.mockito.ArgumentMatchers.anyDouble;
-import static org.mockito.ArgumentMatchers.anyLong;
-import static org.mockito.ArgumentMatchers.nullable;
-
 import java.lang.reflect.Field;
 
-import org.apache.cloudstack.api.ApiErrorCode;
 import org.apache.cloudstack.api.BaseCmd;
-import org.apache.cloudstack.api.ServerApiException;
 import org.apache.cloudstack.api.response.QuotaCreditsResponse;
 import org.apache.cloudstack.api.response.QuotaResponseBuilder;
 import org.apache.cloudstack.quota.QuotaService;
@@ -78,23 +71,13 @@ public void testQuotaCreditsCmd() throws NoSuchFieldException, IllegalAccessExce
         AccountVO acc = new AccountVO();
         acc.setId(2L);
 
-        Mockito.when(accountService.getActiveAccountByName(nullable(String.class), nullable(Long.class))).thenReturn(acc);
-
-        Mockito.when(responseBuilder.addQuotaCredits(nullable(Long.class), nullable(Long.class), nullable(Double.class), nullable(Long.class), nullable(Boolean.class))).thenReturn(new QuotaCreditsResponse());
-
-        // No value provided test
-        try {
-            cmd.execute();
-        } catch (ServerApiException e) {
-            assertTrue(e.getErrorCode().equals(ApiErrorCode.PARAM_ERROR));
-        }
+        Mockito.when(responseBuilder.addQuotaCredits(cmd)).thenReturn(new QuotaCreditsResponse());
 
         // With value provided test
         cmd.setValue(11.80);
         cmd.execute();
-        Mockito.verify(quotaService, Mockito.times(0)).setLockAccount(anyLong(), anyBoolean());
-        Mockito.verify(quotaService, Mockito.times(1)).setMinBalance(anyLong(), anyDouble());
-        Mockito.verify(responseBuilder, Mockito.times(1)).addQuotaCredits(nullable(Long.class), nullable(Long.class), nullable(Double.class), nullable(Long.class), nullable(Boolean.class));
+
+        Mockito.verify(responseBuilder, Mockito.times(1)).addQuotaCredits(cmd);
     }
 
 }
diff --git a/plugins/database/quota/src/test/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImplTest.java b/plugins/database/quota/src/test/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImplTest.java
index 37307db45629..bcc1c02cde74 100644
--- a/plugins/database/quota/src/test/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImplTest.java
+++ b/plugins/database/quota/src/test/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImplTest.java
@@ -44,6 +44,7 @@
 import org.apache.cloudstack.api.ServerApiException;
 import org.apache.cloudstack.api.command.QuotaBalanceCmd;
 import org.apache.cloudstack.api.command.QuotaConfigureEmailCmd;
+import org.apache.cloudstack.api.command.QuotaCreditsCmd;
 import org.apache.cloudstack.api.command.QuotaCreditsListCmd;
 import org.apache.cloudstack.api.command.QuotaEmailTemplateListCmd;
 import org.apache.cloudstack.api.command.QuotaEmailTemplateUpdateCmd;
@@ -52,6 +53,7 @@
 import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.discovery.ApiDiscoveryService;
 import org.apache.cloudstack.jsinterpreter.JsInterpreterHelper;
+import org.apache.cloudstack.quota.QuotaManager;
 import org.apache.cloudstack.quota.QuotaService;
 import org.apache.cloudstack.quota.QuotaStatement;
 import org.apache.cloudstack.quota.activationrule.presetvariables.PresetVariableDefinition;
@@ -192,6 +194,12 @@ public class QuotaResponseBuilderImplTest extends TestCase {
     @Mock
     EntityManager entityManagerMock;
 
+    @Mock
+    QuotaManager quotaManagerMock;
+
+    @Mock
+    QuotaBalanceVO quotaBalanceVoMock;
+
     @Before
     public void setup() {
         CallContext.register(callerUserMock, callerAccountMock);
@@ -243,28 +251,6 @@ public void createQuotaTariffResponseTestIfReturnsActivationRuleWithoutPermissio
         assertNull(tariffResponse.getActivationRule());
     }
 
-    @Test
-    public void testAddQuotaCredits() {
-        final long accountId = 2L;
-        final long domainId = 1L;
-        final double amount = 11.0;
-        final long updatedBy = 2L;
-
-        QuotaCreditsVO credit = new QuotaCreditsVO();
-        credit.setCredit(new BigDecimal(amount));
-
-        Mockito.when(quotaCreditsDaoMock.saveCredits(Mockito.any(QuotaCreditsVO.class))).thenReturn(credit);
-        Mockito.when(quotaBalanceDaoMock.getLastQuotaBalance(Mockito.anyLong(), Mockito.anyLong())).thenReturn(new BigDecimal(111));
-        Mockito.doReturn(userVoMock).when(quotaResponseBuilderSpy).getCreditorForQuotaCredits(credit);
-
-        AccountVO account = new AccountVO();
-        account.setState(Account.State.LOCKED);
-        Mockito.when(accountDaoMock.findById(Mockito.anyLong())).thenReturn(account);
-
-        QuotaCreditsResponse resp = quotaResponseBuilderSpy.addQuotaCredits(accountId, domainId, amount, updatedBy, true);
-        assertTrue(resp.getCredit().compareTo(credit.getCredit()) == 0);
-    }
-
     @Test
     public void testListQuotaEmailTemplates() {
         QuotaEmailTemplateListCmd cmd = new QuotaEmailTemplateListCmd();
@@ -710,33 +696,18 @@ public void createQuotaCreditsListResponseTestReturnsObject() {
     }
 
     private QuotaCreditsListCmd createQuotaCreditsListCmdForTests() {
-        Mockito.doReturn(false).when(accountManagerMock).isNormalUser(Mockito.anyLong());
-        QuotaCreditsListCmd cmd = new QuotaCreditsListCmd();
-        cmd.setAccountId(1L);
-        cmd.setDomainId(2L);
+        QuotaCreditsListCmd cmd = Mockito.mock(QuotaCreditsListCmd.class);
+        Mockito.doReturn(1L).when(cmd).getEntityOwnerId();
+        Mockito.doReturn(2L).when(cmd).getDomainId();
+        Mockito.doReturn(new Date()).when(cmd).getStartDate();
+        Mockito.doReturn(new Date()).when(cmd).getEndDate();
         return cmd;
     }
 
-    @Test(expected = InvalidParameterValueException.class)
-    public void getCreditsForQuotaCreditsListTestThrowsInvalidParameterValueExceptionWhenBothAccountIdAndDomainIdAreNull() {
-        QuotaCreditsListCmd cmd = new QuotaCreditsListCmd();
-
-        quotaResponseBuilderSpy.getCreditsForQuotaCreditsList(cmd);
-    }
-
     @Test(expected = InvalidParameterValueException.class)
     public void getCreditsForQuotaCreditsListTestThrowsInvalidParameterValueExceptionWhenStartDateIsAfterEndDate() {
         QuotaCreditsListCmd cmd = createQuotaCreditsListCmdForTests();
-        cmd.setStartDate(new Date());
-        cmd.setEndDate(DateUtils.addDays(new Date(), -1));
-
-        quotaResponseBuilderSpy.getCreditsForQuotaCreditsList(cmd);
-    }
-
-    @Test(expected = PermissionDeniedException.class)
-    public void getCreditsForQuotaCreditsListTestThrowsPermissionDeniedExceptionWhenDomainIdIsProvidedAndCallerIsNormalUser() {
-        QuotaCreditsListCmd cmd = createQuotaCreditsListCmdForTests();
-        Mockito.doReturn(true).when(accountManagerMock).isNormalUser(Mockito.anyLong());
+        Mockito.doReturn(DateUtils.addDays(new Date(), -1)).when(cmd).getEndDate();
 
         quotaResponseBuilderSpy.getCreditsForQuotaCreditsList(cmd);
     }
@@ -747,7 +718,7 @@ public void getCreditsForQuotaCreditsListTestReturnsData() {
         List<QuotaCreditsVO> expected = new ArrayList<>();
         expected.add(new QuotaCreditsVO());
 
-        Mockito.doReturn(expected).when(quotaCreditsDaoMock).findCredits(Mockito.anyLong(), Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.anyBoolean());
+        Mockito.doReturn(expected).when(quotaCreditsDaoMock).findCredits(Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.any());
 
         List<QuotaCreditsVO> result = quotaResponseBuilderSpy.getCreditsForQuotaCreditsList(cmd);
 
@@ -1007,7 +978,6 @@ private List<QuotaUsageJoinVO> getQuotaUsagesForTest() {
     @Test
     public void createStatementItemTestReturnItem() {
         List<QuotaUsageJoinVO> quotaUsages = getQuotaUsagesForTest();
-        Mockito.doNothing().when(quotaResponseBuilderSpy).setStatementItemResources(Mockito.any(), Mockito.anyInt(), Mockito.any(), Mockito.anyBoolean());
 
         QuotaStatementItemResponse result = quotaResponseBuilderSpy.createStatementItem(0, quotaUsages, false);
 
@@ -1018,15 +988,6 @@ public void createStatementItemTestReturnItem() {
         Assert.assertEquals(quotaTypeExpected.getQuotaName(), result.getUsageName());
     }
 
-    @Test
-    public void setStatementItemResourcesTestDoNotShowResourcesDoNothing() {
-        QuotaStatementItemResponse item = new QuotaStatementItemResponse(1);
-
-        quotaResponseBuilderSpy.setStatementItemResources(item, 0, getQuotaUsagesForTest(), false);
-
-        Assert.assertNull(item.getResources());
-    }
-
     @Test
     public void getAccountIdForQuotaStatementTestReturnsProvidedAccount() {
         long providedAccountId = 200L;
@@ -1185,4 +1146,226 @@ public void retrieveResourceTestReturnsCorrectResource() {
         Assert.assertNotNull(result);
         Assert.assertEquals(mockResource, result);
     }
+
+    @Test
+    public void lockOrUnlockAccountIfRequiredTestPositiveBalanceUnlocksAccount() {
+        Mockito.doReturn(Account.State.LOCKED).when(accountMock).getState();
+
+        quotaResponseBuilderSpy.lockOrUnlockAccountIfRequired(BigDecimal.TEN, accountMock, true);
+
+        Mockito.verify(accountManagerMock).enableAccount(accountMock.getAccountName(), domainVoMock.getId(), accountMock.getId());
+        Mockito.verify(accountManagerMock, Mockito.never()).lockAccount(Mockito.anyString(), Mockito.anyLong(), Mockito.anyLong());
+    }
+
+    @Test
+    public void lockOrUnlockAccountIfRequiredTestNegativeBalanceLocksAccount() {
+        Mockito.doReturn(Account.State.ENABLED).when(accountMock).getState();
+        Mockito.doReturn(true).when(quotaManagerMock).isLockable(accountMock);
+
+        quotaResponseBuilderSpy.lockOrUnlockAccountIfRequired(BigDecimal.valueOf(-10), accountMock, true);
+
+        Mockito.verify(accountManagerMock).lockAccount(accountMock.getAccountName(), domainVoMock.getId(), accountMock.getId());
+        Mockito.verify(accountManagerMock, Mockito.never()).enableAccount(Mockito.anyString(), Mockito.anyLong(), Mockito.anyLong());
+    }
+
+    @Test
+    public void addQuotaCreditsTestValidParameters() {
+        QuotaCreditsCmd cmd = Mockito.mock(QuotaCreditsCmd.class);
+        Mockito.doReturn(10D).when(cmd).getValue();
+        Mockito.doReturn(BigDecimal.TEN).when(quotaCreditsVoMock).getCredit();
+        Mockito.doReturn(accountMock).when(accountDaoMock).findById(Mockito.anyLong());
+        Mockito.doReturn(null).when(quotaBalanceDaoMock).findLaterBalanceEntry(Mockito.anyLong(), Mockito.anyLong(),
+                Mockito.any());
+        Mockito.doReturn(quotaCreditsVoMock).when(quotaResponseBuilderSpy).persistQuotaCredits(Mockito.any(), Mockito.anyDouble(),
+                Mockito.any(), Mockito.any(), Mockito.anyBoolean());
+        Mockito.doReturn(userVoMock).when(quotaResponseBuilderSpy).getCreditorForQuotaCredits(Mockito.any());
+
+        QuotaCreditsResponse response = quotaResponseBuilderSpy.addQuotaCredits(cmd);
+
+        Assert.assertEquals(BigDecimal.TEN, response.getCredit());
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void addQuotaCreditsTestThrowsExceptionWhenValueIsNull() {
+        QuotaCreditsCmd cmd = Mockito.mock(QuotaCreditsCmd.class);
+        Mockito.doReturn(null).when(cmd).getValue();
+
+        quotaResponseBuilderSpy.addQuotaCredits(cmd);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void addQuotaCreditsTestThrowsExceptionWhenDepositDateIsIncorrect() {
+        QuotaCreditsCmd cmd = Mockito.mock(QuotaCreditsCmd.class);
+        Mockito.doReturn(100.0).when(cmd).getValue();
+        Mockito.doReturn(accountMock).when(accountDaoMock).findById(Mockito.anyLong());
+        Mockito.doReturn(quotaBalanceVoMock).when(quotaBalanceDaoMock).findLaterBalanceEntry(Mockito.anyLong(), Mockito.anyLong(), Mockito.any());
+
+        quotaResponseBuilderSpy.addQuotaCredits(cmd);
+    }
+
+    @Test
+    public void persistQuotaCreditsTestSavesCreditsAndBalanceSuccessfully() {
+        QuotaCreditsCmd cmd = Mockito.mock(QuotaCreditsCmd.class);
+        Long accountId = 1L;
+        Long domainId = 2L;
+        Double value = 10D;
+        Date depositedOn = new Date();
+        AccountVO account = Mockito.mock(AccountVO.class);
+        BigDecimal currentBalance = BigDecimal.ZERO;
+
+        Mockito.doReturn(accountId).when(account).getId();
+        Mockito.doReturn(domainId).when(account).getDomainId();
+        Mockito.doReturn(null).when(cmd).getQuotaEnforce();
+        Mockito.doReturn(null).when(cmd).getMinBalance();
+        Mockito.when(quotaCreditsDaoMock.saveCredits(Mockito.any(QuotaCreditsVO.class))).thenAnswer(invocation -> invocation.getArgument(0));
+        Mockito.when(quotaBalanceDaoMock.getLastQuotaBalance(accountId, domainId)).thenReturn(currentBalance);
+
+        QuotaCreditsVO result = quotaResponseBuilderSpy.persistQuotaCredits(cmd, value, depositedOn, account, false);
+
+        Assert.assertNotNull(result);
+        Assert.assertEquals(BigDecimal.TEN, result.getCredit());
+        Assert.assertEquals(accountId, result.getAccountId());
+        Assert.assertEquals(depositedOn, result.getUpdatedOn());
+        Mockito.verify(quotaServiceMock).saveQuotaAccount(account, currentBalance, depositedOn);
+        Mockito.verify(quotaServiceMock, Mockito.never()).setLockAccount(Mockito.anyLong(), Mockito.anyBoolean());
+        Mockito.verify(quotaServiceMock, Mockito.never()).setMinBalance(Mockito.anyLong(), Mockito.anyDouble());
+        Mockito.verify(quotaResponseBuilderSpy, Mockito.never()).lockOrUnlockAccountIfRequired(Mockito.any(), Mockito.any(), Mockito.anyBoolean());
+    }
+
+    @Test
+    public void persistQuotaCreditsTestCallsSetLockAccountWhenQuotaEnforceProvided() {
+        QuotaCreditsCmd cmd = Mockito.mock(QuotaCreditsCmd.class);
+        Long accountId = 1L;
+        Double value = 100.0;
+        Date depositedOn = new Date();
+        AccountVO account = Mockito.mock(AccountVO.class);
+
+        Mockito.doReturn(accountId).when(account).getId();
+        Mockito.when(cmd.getQuotaEnforce()).thenReturn(Boolean.TRUE);
+        Mockito.when(quotaCreditsDaoMock.saveCredits(Mockito.any(QuotaCreditsVO.class))).thenAnswer(invocation -> invocation.getArgument(0));
+
+        quotaResponseBuilderSpy.persistQuotaCredits(cmd, value, depositedOn, account, false);
+
+        Mockito.verify(quotaServiceMock).setLockAccount(accountId, Boolean.TRUE);
+    }
+
+    @Test
+    public void persistQuotaCreditsTestCallsSetMinBalanceWhenProvided() {
+        QuotaCreditsCmd cmd = Mockito.mock(QuotaCreditsCmd.class);
+        Long accountId = 1L;
+        Double value = 100.0;
+        Date depositedOn = new Date();
+        AccountVO account = Mockito.mock(AccountVO.class);
+
+        Mockito.when(cmd.getMinBalance()).thenReturn(50.0);
+        Mockito.doReturn(accountId).when(account).getId();
+        Mockito.when(quotaCreditsDaoMock.saveCredits(Mockito.any(QuotaCreditsVO.class))).thenAnswer(invocation -> invocation.getArgument(0));
+
+        quotaResponseBuilderSpy.persistQuotaCredits(cmd, value, depositedOn, account, false);
+
+        Mockito.verify(quotaServiceMock).setMinBalance(accountId, 50.0);
+    }
+
+    @Test
+    public void persistQuotaCreditsTestLocksOrUnlocksAccountWhenEnforcementIsEnabledGlobally() {
+        QuotaCreditsCmd cmd = Mockito.mock(QuotaCreditsCmd.class);
+        Long accountId = 1L;
+        Long domainId = 2L;
+        Double value = 100.0;
+        Date depositedOn = new Date();
+        AccountVO account = Mockito.mock(AccountVO.class);
+        BigDecimal currentBalance = BigDecimal.ZERO;
+
+        Mockito.doReturn(accountId).when(account).getId();
+        Mockito.doReturn(domainId).when(account).getDomainId();
+        Mockito.when(cmd.getMinBalance()).thenReturn(50.0);
+        Mockito.when(quotaCreditsDaoMock.saveCredits(Mockito.any(QuotaCreditsVO.class))).thenAnswer(invocation -> invocation.getArgument(0));
+        Mockito.when(quotaBalanceDaoMock.getLastQuotaBalance(accountId, domainId)).thenReturn(currentBalance);
+
+        quotaResponseBuilderSpy.persistQuotaCredits(cmd, value, depositedOn, account, true);
+
+        Mockito.verify(quotaResponseBuilderSpy).lockOrUnlockAccountIfRequired(currentBalance, account, false);
+    }
+
+    @Test
+    public void createQuotaConsumptionHistoryTestReturnsNullForZeroQuotaUsed() {
+        List<QuotaStatementItemHistoryResponse> result = quotaResponseBuilderSpy.createQuotaConsumptionHistory(new ArrayList<>(), BigDecimal.ZERO);
+
+        Assert.assertNull(result);
+    }
+
+    @Test
+    public void createQuotaConsumptionHistoryTestIgnoresNullQuotaUsed() {
+        Date now = new Date();
+
+        List<QuotaUsageJoinVO> usageRecords = new ArrayList<>();
+        QuotaUsageJoinVO record1 = new QuotaUsageJoinVO();
+        record1.setStartDate(now);
+        record1.setEndDate(now);
+        record1.setQuotaUsed(null);
+        record1.setUsageItemId(10L);
+
+        QuotaUsageJoinVO record2 = new QuotaUsageJoinVO();
+        record2.setStartDate(new Date(now.getTime() + 1000));
+        record2.setEndDate(new Date(now.getTime() + 1000));
+        record2.setQuotaUsed(BigDecimal.valueOf(10));
+        record2.setUsageItemId(11L);
+
+        usageRecords.add(record1);
+        usageRecords.add(record2);
+
+        BigDecimal totalQuotaUsed = BigDecimal.valueOf(10);
+
+        List<QuotaStatementItemHistoryResponse> result = quotaResponseBuilderSpy.createQuotaConsumptionHistory(usageRecords, totalQuotaUsed);
+
+        Assert.assertNotNull(result);
+        Assert.assertEquals(1, result.size());
+        Assert.assertEquals(BigDecimal.valueOf(10), result.get(0).getQuotaConsumed());
+    }
+
+    @Test
+    public void createQuotaConsumptionHistoryTestCorrectlyAggregatesRecords() {
+        List<QuotaUsageJoinVO> usageRecords = new ArrayList<>();
+        Date now = new Date();
+
+        QuotaUsageJoinVO record1 = new QuotaUsageJoinVO();
+        record1.setStartDate(now);
+        record1.setEndDate(new Date(now.getTime() + 1000));
+        record1.setQuotaUsed(BigDecimal.valueOf(5));
+        record1.setUsageItemId(10L);
+
+        QuotaUsageJoinVO record2 = new QuotaUsageJoinVO();
+        record2.setStartDate(new Date(now.getTime() + 2000));
+        record2.setEndDate(new Date(now.getTime() + 3000));
+        record2.setQuotaUsed(BigDecimal.valueOf(15));
+        record2.setUsageItemId(11L);
+
+        QuotaUsageJoinVO record3 = new QuotaUsageJoinVO();
+        record3.setStartDate(new Date(now.getTime() + 2000));
+        record3.setEndDate(new Date(now.getTime() + 3000));
+        record3.setQuotaUsed(BigDecimal.valueOf(5));
+        record3.setUsageItemId(11L);
+
+        usageRecords.add(record1);
+        usageRecords.add(record2);
+        usageRecords.add(record3);
+
+        BigDecimal totalQuotaUsed = BigDecimal.valueOf(25);
+
+        List<QuotaStatementItemHistoryResponse> result = quotaResponseBuilderSpy.createQuotaConsumptionHistory(usageRecords, totalQuotaUsed);
+
+        Assert.assertNotNull(result);
+        Assert.assertEquals(2, result.size());
+
+        QuotaStatementItemHistoryResponse firstHistory = result.get(0);
+        QuotaStatementItemHistoryResponse secondHistory = result.get(1);
+
+        Assert.assertEquals(BigDecimal.valueOf(5), firstHistory.getQuotaConsumed());
+        Assert.assertEquals(record1.getStartDate(), firstHistory.getStartDate());
+        Assert.assertEquals(record1.getEndDate(), firstHistory.getEndDate());
+
+        Assert.assertEquals(BigDecimal.valueOf(20), secondHistory.getQuotaConsumed());
+        Assert.assertEquals(record2.getStartDate(), secondHistory.getStartDate());
+        Assert.assertEquals(record2.getEndDate(), secondHistory.getEndDate());
+    }
 }
diff --git a/plugins/hypervisors/hyperv/DotNet/ServerResource/HypervResource/HypervResourceController.cs b/plugins/hypervisors/hyperv/DotNet/ServerResource/HypervResource/HypervResourceController.cs
index 7e31ced3e389..84c67d7a9650 100644
--- a/plugins/hypervisors/hyperv/DotNet/ServerResource/HypervResource/HypervResourceController.cs
+++ b/plugins/hypervisors/hyperv/DotNet/ServerResource/HypervResource/HypervResourceController.cs
@@ -1159,7 +1159,11 @@ public JContainer StartCommand([FromBody]dynamic cmd)
                 try
                 {
                     string systemVmIsoPath = null;
-                    String uriStr = (String)cmd.secondaryStorage;
+                    String uriStr;
+                    foreach (var item in cmd.secondaryStorages)
+                    {
+                        uriStr = item;
+                    }
                     if (!String.IsNullOrEmpty(uriStr))
                     {
                         NFSTO share = new NFSTO();
diff --git a/plugins/hypervisors/hyperv/src/main/java/com/cloud/hypervisor/hyperv/resource/HypervDirectConnectResource.java b/plugins/hypervisors/hyperv/src/main/java/com/cloud/hypervisor/hyperv/resource/HypervDirectConnectResource.java
index 6ad06f426a79..12d6c42fd7e6 100644
--- a/plugins/hypervisors/hyperv/src/main/java/com/cloud/hypervisor/hyperv/resource/HypervDirectConnectResource.java
+++ b/plugins/hypervisors/hyperv/src/main/java/com/cloud/hypervisor/hyperv/resource/HypervDirectConnectResource.java
@@ -455,7 +455,7 @@ public final Answer executeRequest(final Command cmd) {
                     if (s_hypervMgr != null) {
                         final String secondary = s_hypervMgr.prepareSecondaryStorageStore(Long.parseLong(zoneId));
                         if (secondary != null) {
-                            ((StartCommand)cmd).setSecondaryStorage(secondary);
+                            ((StartCommand)cmd).setSecondaryStorages(List.of(secondary));
                         }
                     } else {
                         logger.error("Hyperv manager isn't available. Couldn't check and copy the System VM ISO.");
diff --git a/plugins/hypervisors/kvm/pom.xml b/plugins/hypervisors/kvm/pom.xml
index 255ada09ef4f..a00530268e83 100644
--- a/plugins/hypervisors/kvm/pom.xml
+++ b/plugins/hypervisors/kvm/pom.xml
@@ -62,6 +62,21 @@
             <artifactId>rados</artifactId>
             <version>${cs.rados-java.version}</version>
         </dependency>
+        <dependency>
+            <groupId>com.github.jai-imageio</groupId>
+            <artifactId>jai-imageio-core</artifactId>
+            <version>1.4.0</version>
+        </dependency>
+        <dependency>
+            <groupId>com.dynatrace.hash4j</groupId>
+            <artifactId>hash4j</artifactId>
+            <version>0.29.0</version>
+        </dependency>
+        <dependency>
+            <groupId>com.mikesamuel</groupId>
+            <artifactId>json-sanitizer</artifactId>
+            <version>1.2.3</version>
+        </dependency>
         <dependency>
             <groupId>com.linbit.linstor.api</groupId>
             <artifactId>java-linstor</artifactId>
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/BlockCommitListener.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/BlockCommitListener.java
index d360aa481372..ab4513642efa 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/BlockCommitListener.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/BlockCommitListener.java
@@ -27,18 +27,14 @@
 import org.libvirt.event.BlockJobStatus;
 import org.libvirt.event.BlockJobType;
 
-import java.util.concurrent.Semaphore;
-
 public class BlockCommitListener implements BlockJobListener {
-    private Semaphore semaphore;
     private String result;
     private String vmName;
 
     private Logger logger;
     private String logid;
 
-    protected BlockCommitListener(Semaphore semaphore, String vmName, String logid) {
-        this.semaphore = semaphore;
+    protected BlockCommitListener(String vmName, String logid) {
         this.vmName = vmName;
         this.logid = logid;
         logger = LogManager.getLogger(getClass());
@@ -54,24 +50,22 @@ public void onEvent(Domain domain, String diskPath, BlockJobType type, BlockJobS
             return;
         }
 
+        ThreadContext.put("logcontextid", logid);
+        logger.debug("Received status [{}] on disk [{}] while listening for block commit of VM [{}].", status, diskPath, vmName);
         switch (status) {
             case COMPLETED:
                 result = null;
-                semaphore.release();
                 return;
             case READY:
                 try {
-                    ThreadContext.put("logcontextid", logid);
                     logger.debug("Pivoting disk [{}] of VM [{}].", diskPath, vmName);
                     domain.blockJobAbort(diskPath, Domain.BlockJobAbortFlags.PIVOT);
                 } catch (LibvirtException ex) {
                     result = String.format("Failed to pivot disk due to [%s].", ex.getMessage());
-                    semaphore.release();
                 }
                 return;
             default:
                 result = String.format("Failed to block commit disk with status [%s].", status);
-                semaphore.release();
         }
     }
 }
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/BridgeVifDriver.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/BridgeVifDriver.java
index d6fc0479faf1..327ec46e0ecf 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/BridgeVifDriver.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/BridgeVifDriver.java
@@ -48,6 +48,7 @@ public class BridgeVifDriver extends VifDriverBase {
     private final Object _vnetBridgeMonitor = new Object();
     private String _modifyVlanPath;
     private String _modifyVxlanPath;
+    private String _macIpScriptPath;
     private String _controlCidr = NetUtils.getLinkLocalCIDR();
     private Long libvirtVersion;
 
@@ -83,6 +84,14 @@ public void configure(Map<String, Object> params) throws ConfigurationException
             throw new ConfigurationException("Unable to find " + vxlanScript);
         }
 
+        if (Boolean.TRUE.equals(AgentPropertiesFileHandler.getPropertyValue(AgentProperties.VM_NETWORK_MACIP_STATIC))) {
+            _macIpScriptPath = Script.findScript(networkScriptsDir, "modifymacip.sh");
+            if (_macIpScriptPath == null) {
+                throw new ConfigurationException("Unable to find modifymacip.sh");
+            }
+            logger.info("VM network MAC/IP static script configured: {}", _macIpScriptPath);
+        }
+
         libvirtVersion = (Long) params.get("libvirtVersion");
         if (libvirtVersion == null) {
             libvirtVersion = 0L;
@@ -279,11 +288,14 @@ public LibvirtVMDef.InterfaceDef plug(NicTO nic, String guestOsType, String nicA
         }
         intf.setLinkStateUp(nic.isEnabled());
 
+        executeMacIpScript(intf.getBrName(), nic.getMac(), nic.getIp(), nic.getIp6Address(), nic.getNicSecIps());
+
         return intf;
     }
 
     @Override
     public void unplug(LibvirtVMDef.InterfaceDef iface, boolean deleteBr) {
+        executeMacIpScript(iface.getBrName(), iface.getMacAddress());
         deleteVnetBr(iface.getBrName(), deleteBr);
     }
 
@@ -403,6 +415,60 @@ private void deleteVnetBr(String brName, boolean deleteBr) {
         }
     }
 
+    private void executeMacIpScript(String brName, String mac) {
+        if (_macIpScriptPath == null || mac == null || brName == null) {
+            return;
+        }
+        try {
+            final Script command = new Script(_macIpScriptPath, _timeout, logger);
+            command.add("-o", "delete");
+            command.add("-b", brName);
+            command.add("-m", mac);
+            final String result = command.execute();
+            if (result != null) {
+                logger.warn("MAC/IP script returned error for delete on {}: {}", mac, result);
+            }
+        } catch (Exception e) {
+            // Managing host neighbour/route entries is best-effort and must never break VM lifecycle operations
+            logger.warn("Failed to run MAC/IP script for delete on {} ({})", mac, brName, e);
+        }
+    }
+
+    private void executeMacIpScript(String brName, String mac, String ipv4, String ipv6, List<String> secondaryIps) {
+        if (_macIpScriptPath == null || mac == null || brName == null) {
+            return;
+        }
+        try {
+            final Script command = new Script(_macIpScriptPath, _timeout, logger);
+            command.add("-o", "add");
+            command.add("-b", brName);
+            command.add("-m", mac);
+            if (ipv4 != null && !ipv4.isEmpty()) {
+                command.add("-4", ipv4);
+            }
+            command.add("-6", NetUtils.ipv6LinkLocal(mac).toString());
+            if (ipv6 != null && !ipv6.isEmpty()) {
+                command.add("-6", ipv6);
+            }
+            if (secondaryIps != null) {
+                for (String secIp : secondaryIps) {
+                    if (NetUtils.isValidIp6(secIp)) {
+                        command.add("-6", secIp);
+                    } else {
+                        command.add("-4", secIp);
+                    }
+                }
+            }
+            final String result = command.execute();
+            if (result != null) {
+                logger.warn("MAC/IP script returned error for add on {}: {}", mac, result);
+            }
+        } catch (Exception e) {
+            // Managing host neighbour/route entries is best-effort and must never break VM lifecycle operations
+            logger.warn("Failed to run MAC/IP script for add on {} ({})", mac, brName, e);
+        }
+    }
+
     private void deleteExistingLinkLocalRouteTable(String linkLocalBr) {
         Script command = new Script("/bin/bash", _timeout);
         command.add("-c");
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
index 41716881fa4a..4281036d9456 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
@@ -36,6 +36,7 @@
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.nio.file.Files;
+import java.nio.file.Path;
 import java.nio.file.Paths;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -51,8 +52,6 @@
 import java.util.UUID;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.concurrent.CopyOnWriteArrayList;
-import java.util.concurrent.Semaphore;
-import java.util.concurrent.TimeUnit;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
 import java.util.stream.Collectors;
@@ -74,6 +73,9 @@
 import javax.xml.xpath.XPathFactory;
 
 import com.cloud.agent.api.to.VirtualMachineMetadataTO;
+import com.cloud.utils.exception.BackupException;
+import org.apache.cloudstack.storage.to.DeltaMergeTreeTO;
+import com.cloud.agent.api.to.DataObjectType;
 import org.apache.cloudstack.api.ApiConstants.IoDriverPolicy;
 import org.apache.cloudstack.command.CommandInfo;
 import org.apache.cloudstack.command.ReconcileCommandService;
@@ -394,6 +396,20 @@ public class LibvirtComputingResource extends ServerResourceBase implements Serv
     public static final int IMAGE_SERVER_DEFAULT_PORT = 54322;
     public static final String IMAGE_SERVER_SYSTEMD_UNIT_NAME = "cloudstack-image-server";
 
+    private static final String BLOCK_PULL_COMMAND = "virsh blockpull --domain %s --path %s";
+
+    private static final String SNAPSHOT_XML = "<domainsnapshot>\n" +
+            "<name>%s</name>\n" +
+            "<memory snapshot='no'/>\n" +
+            "<disks> \n" +
+            "%s" +
+            "</disks> \n" +
+            "</domainsnapshot>";
+
+    private static final String TAG_DISK_SNAPSHOT = "<disk name='%s' snapshot='external'>\n" +
+            "<source file='%s'/>\n" +
+            "</disk>\n";
+
     protected int qcow2DeltaMergeTimeout;
 
     private String modifyVlanPath;
@@ -594,6 +610,8 @@ public class LibvirtComputingResource extends ServerResourceBase implements Serv
 
     public static final String CGROUP_V2 = "cgroup2fs";
 
+    public static final String AGENT_IS_NOT_CONNECTED = "QEMU guest agent is not connected";
+
     /**
      * Virsh command to merge (blockcommit) snapshot into the base file.<br><br>
      * 1st parameter: VM's name;<br>
@@ -612,7 +630,7 @@ public long getHypervisorQemuVersion() {
 
     @Override
     public synchronized void registerStatusUpdater(AgentStatusUpdater updater) {
-        if (AgentPropertiesFileHandler.getPropertyValue(AgentProperties.LIBVIRT_EVENTS_ENABLED)) {
+        if (isLibvirtEventsEnabled()) {
             try {
                 Connect conn = LibvirtConnection.getConnection();
                 if (libvirtDomainListener != null) {
@@ -2358,7 +2376,7 @@ public String startVM(final Connect conn, final String vmName, final String doma
     public boolean stop() {
         try {
             final Connect conn = LibvirtConnection.getConnection();
-            if (AgentPropertiesFileHandler.getPropertyValue(AgentProperties.LIBVIRT_EVENTS_ENABLED) && libvirtDomainListener != null) {
+            if (isLibvirtEventsEnabled() && libvirtDomainListener != null) {
                 LOGGER.debug("Clearing old domain listener");
                 conn.removeLifecycleListener(libvirtDomainListener);
             }
@@ -4409,6 +4427,7 @@ public StartupCommand[] initialize() {
         if (hostSupportsOvfExport()) {
             cmd.getHostDetails().put(HOST_OVFTOOL_VERSION, getHostOvfToolVersion());
         }
+        addBackupJobDetails(cmd.getHostDetails());
         HealthCheckResult healthCheckResult = getHostHealthCheckResult();
         if (healthCheckResult != HealthCheckResult.IGNORE) {
             cmd.setHostHealthCheckResult(healthCheckResult == HealthCheckResult.SUCCESS);
@@ -4442,6 +4461,18 @@ public StartupCommand[] initialize() {
         return startupCommandsArray;
     }
 
+    private void addBackupJobDetails(Map<String, String> details) {
+        Integer maxCompressionOperations = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.BACKUP_COMPRESSION_MAX_CONCURRENT_OPERATIONS_PER_HOST);
+        if (maxCompressionOperations != null) {
+            details.put(AgentProperties.BACKUP_COMPRESSION_MAX_CONCURRENT_OPERATIONS_PER_HOST.getName(), maxCompressionOperations.toString());
+        }
+
+        Integer maxValidationOperations = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.BACKUP_VALIDATION_MAX_CONCURRENT_OPERATIONS_PER_HOST);
+        if (maxValidationOperations != null) {
+            details.put(AgentProperties.BACKUP_VALIDATION_MAX_CONCURRENT_OPERATIONS_PER_HOST.getName(), maxValidationOperations.toString());
+        }
+    }
+
     protected List<String> getHostTags() {
         List<String> hostTagsList = new ArrayList<>();
         String hostTags = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.HOST_TAGS);
@@ -5147,7 +5178,7 @@ public DiskDef getDiskWithPathOfVolumeObjectTO(List<DiskDef> disks, VolumeObject
         return disks.stream()
                 .filter(diskDef -> diskDef.getDiskPath() != null && diskDef.getDiskPath().contains(vol.getPath()))
                 .findFirst()
-                .orElseThrow(() -> new CloudRuntimeException(String.format("Unable to find volume [%s].", vol.getUuid())));
+                .orElseThrow(() -> new CloudRuntimeException(String.format("Unable to find volume [%s] with path [%s].", vol.getUuid(), vol.getPath())));
     }
 
     protected String getDiskPathFromDiskDef(DiskDef disk) {
@@ -6579,7 +6610,7 @@ public static String generateSecretUUIDFromString(String seed) {
     }
 
     /**
-     * Merges the snapshot into base file.
+     * Merges the delta into a base file.
      *
      * @param vm           Domain of the VM;
      * @param diskLabel    Disk label to manage snapshot and base file;
@@ -6591,15 +6622,19 @@ public static String generateSecretUUIDFromString(String seed) {
      * @param conn Libvirt connection;
      * @throws LibvirtException
      */
-    public void mergeSnapshotIntoBaseFile(Domain vm, String diskLabel, String baseFilePath, String topFilePath, boolean active, String snapshotName, VolumeObjectTO volume,
+    public void mergeDeltaIntoBaseFile(Domain vm, String diskLabel, String baseFilePath, String topFilePath, boolean active, String snapshotName, VolumeObjectTO volume,
             Connect conn) throws LibvirtException {
-        if (AgentPropertiesFileHandler.getPropertyValue(AgentProperties.LIBVIRT_EVENTS_ENABLED)) {
+        if (isLibvirtEventsEnabled()) {
             mergeSnapshotIntoBaseFileWithEventsAndConfigurableTimeout(vm, diskLabel, baseFilePath, topFilePath, active, snapshotName, volume, conn);
         } else {
             mergeSnapshotIntoBaseFileWithoutEvents(vm, diskLabel, baseFilePath, topFilePath, active, snapshotName, volume, conn);
         }
     }
 
+    protected Boolean isLibvirtEventsEnabled() {
+        return AgentPropertiesFileHandler.getPropertyValue(AgentProperties.LIBVIRT_EVENTS_ENABLED);
+    }
+
     /**
      * This method only works if LIBVIRT_EVENTS_ENABLED is true.
      * */
@@ -6616,40 +6651,26 @@ protected void mergeSnapshotIntoBaseFileWithEventsAndConfigurableTimeout(Domain
             commitFlags |= Domain.BlockCommitFlags.ACTIVE;
         }
 
-        Semaphore semaphore = getSemaphoreToWaitForMerge();
-        BlockCommitListener blockCommitListener = getBlockCommitListener(semaphore, vmName);
-        vm.addBlockJobListener(blockCommitListener);
-
-        logger.info("Starting block commit of snapshot [{}] of VM [{}]. Using parameters: diskLabel [{}]; baseFilePath [{}]; topFilePath [{}]; commitFlags [{}]", snapshotName,
-                vmName, diskLabel, baseFilePath, topFilePath, commitFlags);
+        BlockCommitListener blockCommitListener = getBlockCommitListener(vmName);
+        try {
+            vm.addBlockJobListener(blockCommitListener);
 
-        vm.blockCommit(diskLabel, baseFilePath, topFilePath, 0, commitFlags);
+            logger.info("Starting block commit of QCOW2 delta [{}] of VM [{}]. Using parameters: diskLabel [{}]; baseFilePath [{}]; topFilePath [{}]; commitFlags [{}]",
+                    snapshotName,
+                    vmName, diskLabel, baseFilePath, topFilePath, commitFlags);
 
-        Thread checkProgressThread = new Thread(() -> checkBlockCommitProgress(vm, diskLabel, vmName, snapshotName, topFilePath, baseFilePath));
-        checkProgressThread.start();
+            vm.blockCommit(diskLabel, baseFilePath, topFilePath, 0, commitFlags);
 
-        String errorMessage = String.format("the block commit of top file [%s] into base file [%s] for snapshot [%s] of VM [%s]." +
-                " The job will be left running to avoid data corruption, but ACS will return an error and volume [%s] will need to be normalized manually. If the commit" +
-                " involved the active image, the pivot will need to be manually done.", topFilePath, baseFilePath, snapshotName, vmName, volume);
-        try {
-            if (!semaphore.tryAcquire(qcow2DeltaMergeTimeout, TimeUnit.SECONDS)) {
-                throw new CloudRuntimeException("Timed out while waiting for " + errorMessage);
-            }
-        } catch (InterruptedException e) {
-            throw new CloudRuntimeException("Interrupted while waiting for " + errorMessage);
+            checkBlockCommitProgress(vm, diskLabel, vmName, snapshotName, topFilePath, baseFilePath);
         } finally {
             vm.removeBlockJobListener(blockCommitListener);
         }
 
         String mergeResult = blockCommitListener.getResult();
-        try {
-            checkProgressThread.join();
-        } catch (InterruptedException ex) {
-            throw new CloudRuntimeException(String.format("Exception while running wait block commit task of snapshot [%s] and VM [%s].", snapshotName, vmName));
-        }
-
         if (mergeResult != null) {
-            String commitError = String.format("Failed %s The failure occurred due to [%s].", errorMessage, mergeResult);
+            String commitError = String.format("Failed the block commit of top file [%s] into base file [%s] for snapshot [%s] of VM [%s]. The job will be left running to avoid" +
+                    " data corruption, but ACS will return an error and volume [%s] will need to be normalized manually. If the commit involved the active image, the pivot will" +
+                    " need to be manually done. The failure occurred due to [%s].", topFilePath, baseFilePath, snapshotName, vmName, volume, mergeResult);
             logger.error(commitError);
             throw new CloudRuntimeException(commitError);
         }
@@ -6706,15 +6727,8 @@ protected String buildMergeCommand(String vmName, String diskLabel, String baseF
     /**
      * This was created to facilitate testing.
      * */
-    protected BlockCommitListener getBlockCommitListener(Semaphore semaphore, String vmName) {
-        return new BlockCommitListener(semaphore, vmName, ThreadContext.get("logcontextid"));
-    }
-
-    /**
-     * This was created to facilitate testing.
-     * */
-    protected Semaphore getSemaphoreToWaitForMerge() {
-        return new Semaphore(0);
+    protected BlockCommitListener getBlockCommitListener(String vmName) {
+        return new BlockCommitListener(vmName, ThreadContext.get("logcontextid"));
     }
 
     protected void checkBlockCommitProgress(Domain vm, String diskLabel, String vmName, String snapshotName, String topFilePath, String baseFilePath) {
@@ -6730,8 +6744,8 @@ protected void checkBlockCommitProgress(Domain vm, String diskLabel, String vmNa
             try {
                 Thread.sleep(1000);
             } catch (InterruptedException ex) {
-                logger.debug("Thread that was tracking the progress {} was interrupted.", partialLog, ex);
-                return;
+                logger.trace("Thread that was tracking the progress for the block commit job {} was interrupted. Ignoring.", partialLog, ex);
+                continue;
             }
 
             try {
@@ -7038,7 +7052,7 @@ private static boolean isClvmVolume(DiskDef disk, VirtualMachineTO vmSpec) {
                         continue;
                     }
                     VolumeObjectTO volumeTO = (VolumeObjectTO) diskTO.getData();
-                    if (!diskPath.equals(volumeTO.getPath()) && !diskPath.equals(diskTO.getPath())) {
+                    if (!diskPath.substring(diskPath.lastIndexOf(File.separator) + 1).equals(volumeTO.getPath())) {
                         continue;
                     }
                     DataStoreTO dataStore = volumeTO.getDataStore();
@@ -7141,4 +7155,261 @@ static boolean checkIfVolumeGroupIsClustered(String vgName) {
 
         return false;
     }
+
+    public Map<String, Long> createDiskOnlyVmSnapshotForRunningVm(List<Pair<VolumeObjectTO, String>> volumeTosAndNewPaths, String vmName, String snapshotName,
+            boolean quiesceVm) throws BackupException {
+        logger.info("Taking disk-only VM snapshot of running VM [{}].", vmName);
+
+        Domain dm = null;
+        try {
+            LibvirtUtilitiesHelper libvirtUtilitiesHelper = getLibvirtUtilitiesHelper();
+            Connect conn = libvirtUtilitiesHelper.getConnection();
+            List<LibvirtVMDef.DiskDef> disks = getDisks(conn, vmName);
+
+            dm = getDomain(conn, vmName);
+
+            if (dm == null) {
+                throw new BackupException(String.format("Creation of disk-only VM snapshot failed as we could not find the VM [%s].", vmName), true);
+            }
+
+            Pair<String, Map<String, Long>> snapshotXmlAndVolumeToNewPathMap = createSnapshotXmlAndNewVolumePathMap(volumeTosAndNewPaths, disks, snapshotName);
+
+            int flagsToUseForRunningVmSnapshotCreation = getFlagsToUseForRunningVmSnapshotCreation(quiesceVm);
+            String snapshotXml = snapshotXmlAndVolumeToNewPathMap.first();
+
+            logger.info("Creating disk-only VM snapshot for VM [{}] using parameters: snapshotXml [{}]; flags [{}].", vmName, snapshotXml, flagsToUseForRunningVmSnapshotCreation);
+
+            dm.snapshotCreateXML(snapshotXml, flagsToUseForRunningVmSnapshotCreation);
+
+            return snapshotXmlAndVolumeToNewPathMap.second();
+        } catch (LibvirtException e) {
+            String errorMsg = String.format("Creation of disk-only VM snapshot for VM [%s] failed due to %s.", vmName, e.getMessage());
+            boolean isVmConsistent = false;
+            if (e.getMessage().contains(AGENT_IS_NOT_CONNECTED)) {
+                errorMsg = "QEMU guest agent is not connected. If the VM has been recently started, it might connect soon. Otherwise the VM does not have the" +
+                        " guest agent installed; thus the QuiesceVM parameter is not supported.";
+                isVmConsistent = true;
+            }
+            logger.error(errorMsg, e);
+            throw new BackupException(errorMsg, isVmConsistent);
+        } finally {
+            if (dm != null) {
+                try {
+                    dm.free();
+                } catch (LibvirtException l) {
+                    logger.trace("Ignoring Libvirt error.", l);
+                }
+            }
+        }
+    }
+
+    public Map<String, Long> createDiskOnlyVMSnapshotOfStoppedVm(List<Pair<VolumeObjectTO, String>> volumeTosAndNewPaths, String vmName) {
+        logger.info("Creating volume deltas for stopped VM [{}].", vmName);
+
+        Map<String, Long> mapVolumeToSnapshotSize = new HashMap<>();
+        try {
+            for (Pair<VolumeObjectTO, String> volumeObjectTOAndNewPath : volumeTosAndNewPaths) {
+                VolumeObjectTO volumeObjectTO = volumeObjectTOAndNewPath.first();
+                PrimaryDataStoreTO primaryDataStoreTO = (PrimaryDataStoreTO) volumeObjectTO.getDataStore();
+                KVMStoragePool kvmStoragePool = getStoragePoolMgr().getStoragePool(primaryDataStoreTO.getPoolType(), primaryDataStoreTO.getUuid());
+
+                String snapshotPath = volumeObjectTOAndNewPath.second();
+                String snapshotFullPath = kvmStoragePool.getLocalPathFor(snapshotPath);
+                QemuImgFile newDelta = new QemuImgFile(snapshotFullPath, QemuImg.PhysicalDiskFormat.QCOW2);
+
+                String currentDeltaFullPath = kvmStoragePool.getLocalPathFor(volumeObjectTO.getPath());
+                QemuImgFile currentDelta = new QemuImgFile(currentDeltaFullPath, QemuImg.PhysicalDiskFormat.QCOW2);
+
+                QemuImg qemuImg = new QemuImg(0);
+
+                logger.debug("Creating new delta [{}] for volume [{}] as part of the delta creation process for VM [{}].", newDelta, volumeObjectTO.getUuid(), vmName);
+                qemuImg.create(newDelta, currentDelta);
+
+                mapVolumeToSnapshotSize.put(volumeObjectTO.getUuid(), getFileSize(currentDeltaFullPath));
+            }
+        } catch (Exception e) {
+            logger.error("Exception while creating volume delta for VM [{}]. Deleting leftover deltas.", vmName, e);
+            cleanupLeftoverDeltas(volumeTosAndNewPaths, mapVolumeToSnapshotSize);
+            throw new BackupException(String.format("An exception was caught during the delta creation for VM [%s]. The leftover deltas have been deleted.", vmName), true);
+        }
+
+        return mapVolumeToSnapshotSize;
+    }
+
+    protected void cleanupLeftoverDeltas(List<Pair<VolumeObjectTO, String>> volumeTosAndNewPaths, Map<String, Long> mapVolumeToSnapshotSize) {
+        for (Pair<VolumeObjectTO, String> volumeObjectTOAndNewPath : volumeTosAndNewPaths) {
+            VolumeObjectTO volumeObjectTO = volumeObjectTOAndNewPath.first();
+            Long volSize = mapVolumeToSnapshotSize.get(volumeObjectTO.getUuid());
+            if (volSize == null) {
+                continue;
+            }
+            PrimaryDataStoreTO primaryDataStoreTO = (PrimaryDataStoreTO) volumeObjectTO.getDataStore();
+            KVMStoragePool kvmStoragePool = getStoragePoolMgr().getStoragePool(primaryDataStoreTO.getPoolType(), primaryDataStoreTO.getUuid());
+            try {
+                Files.deleteIfExists(Path.of(kvmStoragePool.getLocalPathFor(volumeObjectTOAndNewPath.second())));
+            } catch (IOException ex) {
+                logger.warn("Tried to delete leftover delta at [{}]. Failed.", volumeObjectTOAndNewPath.second(), ex);
+            }
+        }
+    }
+
+    public void mergeDeltaForStoppedVm(DeltaMergeTreeTO deltaMergeTreeTO) throws QemuImgException, IOException, LibvirtException {
+        logger.debug("Merging delta [{}] for stopped VM.", deltaMergeTreeTO);
+
+        QemuImg qemuImg = new QemuImg(qcow2DeltaMergeTimeout * 1000);
+        DataTO parentTo = deltaMergeTreeTO.getParent();
+        PrimaryDataStoreTO primaryDataStoreTO = (PrimaryDataStoreTO) parentTo.getDataStore();
+        KVMStoragePool storagePool = storagePoolManager.getStoragePool(primaryDataStoreTO.getPoolType(), primaryDataStoreTO.getUuid());
+        String childLocalPath = storagePool.getLocalPathFor(deltaMergeTreeTO.getChild().getPath());
+
+        QemuImgFile parent = new QemuImgFile(storagePool.getLocalPathFor(parentTo.getPath()), QemuImg.PhysicalDiskFormat.QCOW2);
+        QemuImgFile child = new QemuImgFile(childLocalPath, QemuImg.PhysicalDiskFormat.QCOW2);
+
+        logger.debug("Committing child delta [{}] into parent delta [{}].", parentTo, deltaMergeTreeTO.getChild());
+        qemuImg.commit(child, parent, true);
+
+        List<QemuImgFile> grandChildren = deltaMergeTreeTO.getGrandChildren().stream()
+                .map(deltaTo -> new QemuImgFile(storagePool.getLocalPathFor(deltaTo.getPath()), QemuImg.PhysicalDiskFormat.QCOW2))
+                .collect(Collectors.toList());
+
+        logger.debug("Rebasing grand-children [{}] into parent at [{}].", grandChildren, parent.getFileName());
+        for (QemuImgFile grandChild : grandChildren) {
+            qemuImg.rebase(grandChild, parent, parent.getFormat().toString(), false);
+        }
+
+        logger.debug("Deleting child at [{}] as it is useless.", childLocalPath);
+
+        Files.deleteIfExists(Path.of(childLocalPath));
+    }
+
+    public void mergeDeltaForRunningVm(DeltaMergeTreeTO mergeTreeTO, String vmName, VolumeObjectTO volumeObjectTO) throws LibvirtException, QemuImgException {
+        logger.debug("Merging delta [{}] for running VM [{}].", mergeTreeTO, vmName);
+
+        QemuImg qemuImg = new QemuImg(qcow2DeltaMergeTimeout * 1000);
+        Connect conn = libvirtUtilitiesHelper.getConnection();
+        Domain domain = getDomain(conn, vmName);
+        List<LibvirtVMDef.DiskDef> disks = getDisks(conn, vmName);
+
+        DataTO childTO = mergeTreeTO.getChild();
+        DataTO parentSnapshotTO = mergeTreeTO.getParent();
+        KVMStoragePool storagePool = libvirtUtilitiesHelper.getPrimaryPoolFromDataTo(volumeObjectTO, storagePoolManager);
+
+        boolean active = DataObjectType.VOLUME.equals(childTO.getObjectType());
+        String label = getDiskWithPathOfVolumeObjectTO(disks, volumeObjectTO).getDiskLabel();
+        String parentSnapshotLocalPath = storagePool.getLocalPathFor(parentSnapshotTO.getPath());
+        String childDeltaPath = storagePool.getLocalPathFor(childTO.getPath());
+
+        logger.debug("Found label [{}] for [{}]. Will merge delta at [{}] into delta at [{}].", label, volumeObjectTO, parentSnapshotLocalPath, childDeltaPath);
+
+        mergeDeltaIntoBaseFile(domain, label, parentSnapshotLocalPath, childDeltaPath, active, childTO.getPath(), volumeObjectTO, conn);
+
+        QemuImgFile parent = new QemuImgFile(parentSnapshotLocalPath, QemuImg.PhysicalDiskFormat.QCOW2);
+
+        logger.debug("Rebasing grand-children [{}] into parent at [{}].", mergeTreeTO.getGrandChildren(), parentSnapshotLocalPath);
+        for (DataTO grandChildTo : mergeTreeTO.getGrandChildren()) {
+            if (checkIfFileIsInActiveChainForVm(domain, grandChildTo)) {
+                logger.debug("Grand-child [{}] is on the active chain of VM [{}], thus Libvirt has already rebased it, will ignore it.", grandChildTo, vmName);
+                continue;
+            }
+            QemuImgFile grandChild = new QemuImgFile(storagePool.getLocalPathFor(grandChildTo.getPath()), QemuImg.PhysicalDiskFormat.QCOW2);
+            qemuImg.rebase(grandChild, parent, parent.getFormat().toString(), false);
+        }
+    }
+
+    private boolean checkIfFileIsInActiveChainForVm(Domain vm, DataTO dataTO) throws LibvirtException {
+        String xml = vm.getXMLDesc(0);
+        KVMStoragePool storagePool = libvirtUtilitiesHelper.getPrimaryPoolFromDataTo(dataTO, storagePoolManager);
+        return xml.contains(storagePool.getLocalPathFor(dataTO.getPath()));
+    }
+
+    public int getFlagsToUseForRunningVmSnapshotCreation(boolean quiesceVm) {
+        int flags = quiesceVm ? Domain.SnapshotCreateFlags.QUIESCE : 0;
+        flags += Domain.SnapshotCreateFlags.DISK_ONLY +
+                Domain.SnapshotCreateFlags.ATOMIC +
+                Domain.SnapshotCreateFlags.NO_METADATA;
+        return flags;
+    }
+
+    public Pair<String, Map<String, Long>> createSnapshotXmlAndNewVolumePathMap(List<Pair<VolumeObjectTO, String>> volumeTosAndNewPaths, List<LibvirtVMDef.DiskDef> disks, String snapshotName) {
+        StringBuilder stringBuilder = new StringBuilder();
+        Map<String, Long> volumeObjectToNewPathMap = new HashMap<>();
+
+        for (Pair<VolumeObjectTO, String> volumeObjectTOAndPath : volumeTosAndNewPaths) {
+            LibvirtVMDef.DiskDef diskdef = getDiskWithPathOfVolumeObjectTO(disks, volumeObjectTOAndPath.first());
+            String newPath = volumeObjectTOAndPath.second();
+            stringBuilder.append(String.format(TAG_DISK_SNAPSHOT, diskdef.getDiskLabel(), getSnapshotTemporaryPath(diskdef.getDiskPath(), newPath)));
+
+            long snapSize = getFileSize(diskdef.getDiskPath());
+
+            volumeObjectToNewPathMap.put(volumeObjectTOAndPath.first().getUuid(), snapSize);
+        }
+
+        String snapshotXml = String.format(SNAPSHOT_XML, snapshotName, stringBuilder);
+        return new Pair<>(snapshotXml, volumeObjectToNewPathMap);
+    }
+
+    public long getFileSize(String path) {
+        return new File(path).length();
+    }
+
+    public boolean pullVolumeBackingFile(VolumeObjectTO volumeObjectTO, String vmName) throws LibvirtException {
+        Connect conn = libvirtUtilitiesHelper.getConnection();
+
+        Domain vm = getDomain(conn, vmName);
+        List<LibvirtVMDef.DiskDef> disks = getDisks(conn, vmName);
+        DiskDef diskDef = getDiskWithPathOfVolumeObjectTO(disks, volumeObjectTO);
+
+        String diskLabel = diskDef.getDiskLabel();
+        Script.runSimpleBashScript(String.format(BLOCK_PULL_COMMAND, vmName, diskLabel));
+
+        boolean result = checkBlockPullProgress(vm, diskLabel, vmName, volumeObjectTO.getUuid());
+
+        if (!result) {
+            logger.warn("Failed to block pull volume [{}] of VM [{}], aborting.", volumeObjectTO, vmName);
+            vm.blockJobAbort(diskLabel, Domain.BlockJobAbortFlags.ASYNC);
+        }
+        return result;
+    }
+
+    protected Boolean checkBlockPullProgress(Domain vm, String diskLabel, String vmName, String volumeUuid) {
+        int timeout = qcow2DeltaMergeTimeout;
+        DomainBlockJobInfo result;
+        long lastCommittedBytes = 0;
+        long endBytes = 0;
+        String partialLog = String.format("for volume [%s] of VM [%s]", volumeUuid, vmName);
+        while (timeout > 0) {
+            timeout -= 1;
+
+            try {
+                Thread.sleep(1000);
+            } catch (InterruptedException ex) {
+                logger.trace("Thread that was tracking the block pull progress {} was interrupted. Ignoring.", partialLog, ex);
+                continue;
+            }
+
+            try {
+                result = vm.getBlockJobInfo(diskLabel, 0);
+            } catch (LibvirtException ex) {
+                logger.warn("Exception while getting block job info {}: [{}].", partialLog, ex.getMessage(), ex);
+                return false;
+            }
+
+            if (result == null || result.type == 0 && result.end == 0 && result.cur == 0) {
+                logger.debug("Block pull job {} has finished.", partialLog);
+                return true;
+            }
+
+            long currentCommittedBytes = result.cur;
+            if (currentCommittedBytes > lastCommittedBytes) {
+                logger.debug("The block pull {} is at [{}] of [{}].", partialLog, currentCommittedBytes, result.end);
+            }
+            lastCommittedBytes = currentCommittedBytes;
+            endBytes = result.end;
+        }
+        logger.warn(String.format("Block pull %s has timed out after waiting at least %s seconds. The progress of the operation was [%s] of [%s].", partialLog,
+                qcow2DeltaMergeTimeout, lastCommittedBytes, endBytes));
+        return false;
+    }
+
+
 }
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtDomainXMLParser.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtDomainXMLParser.java
index e114669b8b56..1a4d23af1c90 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtDomainXMLParser.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtDomainXMLParser.java
@@ -131,6 +131,7 @@ public boolean parseDomainXML(String domXML) {
                                 fmt = DiskDef.DiskFmtType.valueOf(diskFmtType.toUpperCase());
                             }
                             def.defFileBasedDisk(diskFile, diskLabel, DiskDef.DiskBus.valueOf(bus.toUpperCase()), fmt);
+                            parseBackingFiles(disk, def);
                         } else if (device.equalsIgnoreCase("cdrom")) {
                             def.defISODisk(diskFile, i+1, diskLabel, DiskDef.DiskType.FILE);
                         }
@@ -405,6 +406,21 @@ public boolean parseDomainXML(String domXML) {
         return false;
     }
 
+    private void parseBackingFiles(Element disk, DiskDef def) {
+        NodeList backingStoreNodeList = disk.getElementsByTagName("backingStore");
+        List<String> backingStoreList = new ArrayList<>();
+        while (backingStoreNodeList.getLength() > 0) {
+            Element backingStore = (Element)backingStoreNodeList.item(0);
+            String path = getAttrValue("source", "file", backingStore);
+            if (StringUtils.isEmpty(path)) {
+                break;
+            }
+            backingStoreList.add(path.substring(path.lastIndexOf(File.separator))+1);
+            backingStoreNodeList = backingStore.getElementsByTagName("backingStore");
+        }
+        def.setBackingStoreList(backingStoreList);
+    }
+
     /**
      * Parse the memballoon tag.
      * @param devices the devices tag.
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtMigrateResourceBetweenSecondaryStorages.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtMigrateResourceBetweenSecondaryStorages.java
new file mode 100644
index 000000000000..a3dd2040cfc8
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtMigrateResourceBetweenSecondaryStorages.java
@@ -0,0 +1,123 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package com.cloud.hypervisor.kvm.resource;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.Command;
+import com.cloud.agent.api.to.DataTO;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.utils.Pair;
+import com.cloud.utils.exception.BackupException;
+import com.cloud.utils.script.Script;
+import org.apache.cloudstack.utils.qemu.QemuImageOptions;
+import org.apache.cloudstack.utils.qemu.QemuImg;
+import org.apache.cloudstack.utils.qemu.QemuImgException;
+import org.apache.cloudstack.utils.qemu.QemuImgFile;
+import org.libvirt.LibvirtException;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.List;
+import java.util.Set;
+
+public abstract class LibvirtMigrateResourceBetweenSecondaryStorages<T extends Command> extends CommandWrapper<T, Answer, LibvirtComputingResource> {
+
+    protected static final String BACKUP = "backup";
+    protected static final String SNAPSHOT = "snapshot";
+
+    protected Set<String> filesToRemove;
+    protected List<Pair<Long, String>> resourcesToUpdate;
+    protected String resourceType;
+    protected int wait;
+
+    public String copyResourceToDestDataStore(DataTO resource, String resourceCurrentPath, KVMStoragePool destImagePool, String resourceParentPath) throws QemuImgException, LibvirtException {
+        String resourceDestDataStoreFullPath = destImagePool.getLocalPathFor(resource.getPath());
+        String resourceDestCheckpointPath = resourceDestDataStoreFullPath.replace("snapshots", "checkpoints");
+
+        QemuImgFile resourceOrigin = new QemuImgFile(resourceCurrentPath, QemuImg.PhysicalDiskFormat.QCOW2);
+        QemuImgFile resourceDestination = new QemuImgFile(resourceDestDataStoreFullPath, QemuImg.PhysicalDiskFormat.QCOW2);
+        QemuImgFile parentResource = null;
+
+        if (resourceParentPath != null) {
+            parentResource = new QemuImgFile(resourceParentPath, QemuImg.PhysicalDiskFormat.QCOW2);
+        }
+
+        logger.debug("Migrating {} [{}] to [{}] with {}", resourceType, resourceOrigin, resourceDestination, parentResource == null ? "no parent." : String.format("parent [%s].", parentResource));
+
+        long resourceId = resource.getId();
+
+        createDirsIfNeeded(resourceDestDataStoreFullPath, resourceId);
+
+        QemuImg qemuImg = new QemuImg(wait);
+        qemuImg.convert(resourceOrigin, resourceDestination, parentResource, null, null,  new QemuImageOptions(resourceOrigin.getFormat(), resourceOrigin.getFileName(), null),
+                null, true, false, false, false, null, null);
+
+        filesToRemove.add(resourceCurrentPath);
+
+        if (SNAPSHOT.equals(resourceType)) {
+            String resourceCurrentCheckpointPath = resourceCurrentPath.replace("snapshots", "checkpoints");
+            createDirsIfNeeded(resourceDestCheckpointPath, resourceId);
+            migrateCheckpointFile(resourceCurrentPath, resourceDestDataStoreFullPath);
+            filesToRemove.add(resourceCurrentCheckpointPath);
+            resourcesToUpdate.add(new Pair<>(resourceId, resourceDestCheckpointPath));
+        }
+
+        return resourceDestDataStoreFullPath;
+    }
+
+    private void migrateCheckpointFile(String resourceCurrentPath, String resourceDestDataStoreFullPath) {
+        resourceCurrentPath = resourceCurrentPath.replace("snapshots", "checkpoints");
+        resourceDestDataStoreFullPath = resourceDestDataStoreFullPath.replace("snapshots", "checkpoints");
+
+        String copyCommand = String.format("cp %s %s", resourceCurrentPath, resourceDestDataStoreFullPath);
+        Script.runSimpleBashScript(copyCommand);
+    }
+
+    public void removeResourceFromSourceDataStore(String resourcePath) {
+        logger.debug("Removing file [{}].", resourcePath);
+        try {
+            Files.deleteIfExists(Path.of(resourcePath));
+        } catch (IOException ex) {
+            logger.error("Failed to remove {} [{}].", resourceType, resourcePath, ex);
+        }
+    }
+
+    public String rebaseResourceToNewParentPath(String resourcePath, String parentResourcePath) throws LibvirtException, QemuImgException {
+        QemuImgFile resource = new QemuImgFile(resourcePath, QemuImg.PhysicalDiskFormat.QCOW2);
+        QemuImgFile parentResource = new QemuImgFile(parentResourcePath, QemuImg.PhysicalDiskFormat.QCOW2);
+
+        QemuImg qemuImg = new QemuImg(wait);
+        qemuImg.rebase(resource, parentResource, parentResource.getFormat().toString(), false);
+
+        return resourcePath;
+    }
+
+    private void createDirsIfNeeded(String resourceFullPath, Long resourceId) {
+        String dirs = resourceFullPath.substring(0, resourceFullPath.lastIndexOf(File.separator));
+        try {
+            Files.createDirectories(Path.of(dirs));
+        } catch (IOException e) {
+            throw new BackupException(String.format("Error while creating directories for migration of %s [%s].", resourceType, resourceId), e, true);
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtStorageVolumeXMLParser.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtStorageVolumeXMLParser.java
index 1b6f73039ca5..00126a07cd3a 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtStorageVolumeXMLParser.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtStorageVolumeXMLParser.java
@@ -61,6 +61,26 @@ public LibvirtStorageVolumeDef parseStorageVolumeXML(String volXML) {
         return null;
     }
 
+    public String getBackingFileNameIfExists(String volXML) {
+        try {
+            DocumentBuilder builder = ParserUtils.getSaferDocumentBuilderFactory().newDocumentBuilder();
+
+            InputSource is = new InputSource();
+            is.setCharacterStream(new StringReader(volXML));
+            Document doc = builder.parse(is);
+
+            Element rootElement = doc.getDocumentElement();
+            Element backingStore = (Element)rootElement.getElementsByTagName("backingStore").item(0);
+            if (backingStore != null) {
+                String[] paths = getTagValue("path", backingStore).split("/");
+                return paths[paths.length-1];
+            }
+        } catch (ParserConfigurationException | SAXException | IOException e) {
+            logger.error(e.toString(), e);
+        }
+        return null;
+    }
+
     private static String getTagValue(String tag, Element eElement) {
         NodeList nlList = eElement.getElementsByTagName(tag).item(0).getChildNodes();
         Node nValue = nlList.item(0);
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtVMDef.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtVMDef.java
index 7f6725b6d152..74529d9d5fa2 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtVMDef.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtVMDef.java
@@ -975,6 +975,7 @@ public String toString() {
         private BlockIOSize logicalBlockIOSize = null;
         private BlockIOSize physicalBlockIOSize = null;
         private DiskGeometry geometry = null;
+        private List<String> backingStoreList = null; // Ordered list of backing stores, the first in the list is the immediate backing store, and the last in the list is the base
 
         public DiscardType getDiscard() {
             return _discard;
@@ -1346,6 +1347,14 @@ public String getSourcePath() {
             return _sourcePath;
         }
 
+        public List<String> getBackingStoreList() {
+            return backingStoreList;
+        }
+
+        public void setBackingStoreList(List<String> backingStoreList) {
+            this.backingStoreList = backingStoreList;
+        }
+
         @Override
         public String toString() {
             StringBuilder diskBuilder = new StringBuilder();
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtBaseConvertCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtBaseConvertCommandWrapper.java
new file mode 100644
index 000000000000..dc34a4cb62d8
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtBaseConvertCommandWrapper.java
@@ -0,0 +1,283 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.Command;
+import com.cloud.agent.api.to.DataStoreTO;
+import com.cloud.agent.api.to.NfsTO;
+import com.cloud.hypervisor.kvm.resource.LibvirtDomainXMLParser;
+import com.cloud.hypervisor.kvm.resource.LibvirtVMDef;
+import com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ServerResource;
+import com.cloud.storage.Storage;
+import com.cloud.utils.FileUtil;
+import com.cloud.utils.Pair;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.utils.script.Script;
+import org.apache.cloudstack.storage.to.PrimaryDataStoreTO;
+import org.apache.cloudstack.vm.UnmanagedInstanceTO;
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.io.IOUtils;
+import org.apache.commons.lang3.StringUtils;
+
+import java.io.BufferedInputStream;
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+import java.nio.charset.Charset;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.UUID;
+import java.util.stream.Collectors;
+
+public abstract class LibvirtBaseConvertCommandWrapper <T extends Command, A extends Answer, R extends ServerResource> extends CommandWrapper<T, A, R> {
+
+    protected KVMStoragePool getTemporaryStoragePool(DataStoreTO conversionTemporaryLocation, KVMStoragePoolManager storagePoolMgr) {
+        if (conversionTemporaryLocation instanceof NfsTO) {
+            NfsTO nfsTO = (NfsTO) conversionTemporaryLocation;
+            return storagePoolMgr.getStoragePoolByURI(nfsTO.getUrl());
+        } else {
+            PrimaryDataStoreTO primaryDataStoreTO = (PrimaryDataStoreTO) conversionTemporaryLocation;
+            return storagePoolMgr.getStoragePool(primaryDataStoreTO.getPoolType(), primaryDataStoreTO.getUuid());
+        }
+    }
+
+    protected List<KVMPhysicalDisk> getTemporaryDisksFromParsedXml(KVMStoragePool pool, LibvirtDomainXMLParser xmlParser,
+                                                                   String convertedBasePath,
+                                                                   String conversionPoolPath, String vmVolumesPrefix) {
+        List<LibvirtVMDef.DiskDef> disksDefs = xmlParser.getDisks();
+        disksDefs = disksDefs.stream().filter(x -> x.getDiskType() == LibvirtVMDef.DiskDef.DiskType.FILE &&
+                x.getDeviceType() == LibvirtVMDef.DiskDef.DeviceType.DISK).collect(Collectors.toList());
+        if (CollectionUtils.isEmpty(disksDefs)) {
+            String err = String.format("Cannot find any disk defined on the converted XML domain %s.xml, " +
+                    "checking disks at: %s with prefix: %s", convertedBasePath, conversionPoolPath, vmVolumesPrefix);
+            logger.warn(err);
+            return getTemporaryDisksWithPrefixFromTemporaryPool(pool, conversionPoolPath, vmVolumesPrefix);
+        }
+        sanitizeDisksPath(disksDefs);
+        return getPhysicalDisksFromDefPaths(disksDefs, pool);
+    }
+
+    private List<KVMPhysicalDisk> getPhysicalDisksFromDefPaths(List<LibvirtVMDef.DiskDef> disksDefs, KVMStoragePool pool) {
+        List<KVMPhysicalDisk> disks = new ArrayList<>();
+        for (LibvirtVMDef.DiskDef diskDef : disksDefs) {
+            KVMPhysicalDisk physicalDisk = pool.getPhysicalDisk(diskDef.getDiskPath());
+            disks.add(physicalDisk);
+        }
+        return disks;
+    }
+
+    protected List<KVMPhysicalDisk> getTemporaryDisksWithPrefixFromTemporaryPool(KVMStoragePool pool, String path, String prefix) {
+        String msg = String.format("Could not parse correctly the converted XML domain, checking for disks on %s with prefix %s", path, prefix);
+        logger.info(msg);
+        pool.refresh();
+        List<KVMPhysicalDisk> disksWithPrefix = pool.listPhysicalDisks()
+                .stream()
+                .filter(x -> x.getName().startsWith(prefix) && !x.getName().endsWith(".xml"))
+                .collect(Collectors.toList());
+        if (CollectionUtils.isEmpty(disksWithPrefix)) {
+            msg = String.format("Could not find any converted disk with prefix %s on temporary location %s", prefix, path);
+            logger.error(msg);
+            throw new CloudRuntimeException(msg);
+        }
+        return disksWithPrefix;
+    }
+
+    protected void cleanupDisksAndDomainFromTemporaryLocation(List<KVMPhysicalDisk> disks,
+                                                            KVMStoragePool temporaryStoragePool,
+                                                            String temporaryConvertUuid, boolean xmlExists) {
+        for (KVMPhysicalDisk disk : disks) {
+            logger.info(String.format("Cleaning up temporary disk %s after conversion from temporary location", disk.getName()));
+            temporaryStoragePool.deletePhysicalDisk(disk.getName(), Storage.ImageFormat.QCOW2);
+        }
+        if (xmlExists) {
+            logger.info(String.format("Cleaning up temporary domain %s after conversion from temporary location", temporaryConvertUuid));
+            FileUtil.deleteFiles(temporaryStoragePool.getLocalPath(), temporaryConvertUuid, ".xml");
+        }
+    }
+
+    protected void sanitizeDisksPath(List<LibvirtVMDef.DiskDef> disks) {
+        for (LibvirtVMDef.DiskDef disk : disks) {
+            String[] diskPathParts = disk.getDiskPath().split("/");
+            String relativePath = diskPathParts[diskPathParts.length - 1];
+            disk.setDiskPath(relativePath);
+        }
+    }
+
+    protected List<KVMPhysicalDisk> moveTemporaryDisksToDestination(List<KVMPhysicalDisk> temporaryDisks,
+                                                                    List<String> destinationStoragePools,
+                                                                    KVMStoragePoolManager storagePoolMgr) {
+        List<KVMPhysicalDisk> targetDisks = new ArrayList<>();
+        if (temporaryDisks.size() != destinationStoragePools.size()) {
+            String warn = String.format("Discrepancy between the converted instance disks (%s) " +
+                    "and the expected number of disks (%s)", temporaryDisks.size(), destinationStoragePools.size());
+            logger.warn(warn);
+        }
+        for (int i = 0; i < temporaryDisks.size(); i++) {
+            String poolPath = destinationStoragePools.get(i);
+            KVMStoragePool destinationPool = storagePoolMgr.getStoragePool(Storage.StoragePoolType.NetworkFilesystem, poolPath);
+            if (destinationPool == null) {
+                String err = String.format("Could not find a storage pool by URI: %s", poolPath);
+                logger.error(err);
+                continue;
+            }
+            if (destinationPool.getType() != Storage.StoragePoolType.NetworkFilesystem) {
+                String err = String.format("Storage pool by URI: %s is not an NFS storage", poolPath);
+                logger.error(err);
+                continue;
+            }
+            KVMPhysicalDisk sourceDisk = temporaryDisks.get(i);
+            if (logger.isDebugEnabled()) {
+                String msg = String.format("Trying to copy converted instance disk number %s from the temporary location %s" +
+                        " to destination storage pool %s", i, sourceDisk.getPool().getLocalPath(), destinationPool.getUuid());
+                logger.debug(msg);
+            }
+
+            String destinationName = UUID.randomUUID().toString();
+
+            try {
+                if (destinationPool.getAvailable() < sourceDisk.getSize()) {
+                    String msg = String.format("Not enough space on destination pool %s (%s bytes) to copy disk %s (size %s)",
+                            destinationPool.getUuid(), destinationPool.getAvailable(), sourceDisk.getName(), sourceDisk.getSize());
+                    logger.error(msg);
+                    throw new CloudRuntimeException(msg);
+                }
+
+                KVMPhysicalDisk destinationDisk = storagePoolMgr.copyPhysicalDisk(sourceDisk, destinationName, destinationPool, 7200 * 1000);
+                targetDisks.add(destinationDisk);
+            } catch (Exception e) {
+                String err = String.format("Error copying converted instance disk number %s from the temporary location %s" +
+                        " to destination storage pool %s: %s", i, sourceDisk.getPool().getLocalPath(), destinationPool.getUuid(), e.getMessage());
+                logger.error(err, e);
+                cleanupMovedDisksOnDestinationPool(targetDisks);
+                return null;
+            }
+        }
+        return targetDisks;
+    }
+
+    private void cleanupMovedDisksOnDestinationPool(List<KVMPhysicalDisk> targetDisks) {
+        if (CollectionUtils.isEmpty(targetDisks)) {
+            return;
+        }
+        for (KVMPhysicalDisk disk : targetDisks) {
+            logger.info(String.format("Cleaning up disk %s from pool %s after conversion", disk.getName(), disk.getPool().getUuid()));
+            disk.getPool().deletePhysicalDisk(disk.getName(), Storage.ImageFormat.QCOW2);
+        }
+    }
+
+    protected UnmanagedInstanceTO getConvertedUnmanagedInstance(String baseName,
+                                                              List<KVMPhysicalDisk> vmDisks,
+                                                              LibvirtDomainXMLParser xmlParser) {
+        UnmanagedInstanceTO instanceTO = new UnmanagedInstanceTO();
+        instanceTO.setName(baseName);
+        instanceTO.setDisks(getUnmanagedInstanceDisks(vmDisks, xmlParser));
+        instanceTO.setNics(getUnmanagedInstanceNics(xmlParser));
+        return instanceTO;
+    }
+
+    private List<UnmanagedInstanceTO.Nic> getUnmanagedInstanceNics(LibvirtDomainXMLParser xmlParser) {
+        List<UnmanagedInstanceTO.Nic> nics = new ArrayList<>();
+        if (xmlParser != null) {
+            List<LibvirtVMDef.InterfaceDef> interfaces = xmlParser.getInterfaces();
+            for (LibvirtVMDef.InterfaceDef interfaceDef : interfaces) {
+                UnmanagedInstanceTO.Nic nic = new UnmanagedInstanceTO.Nic();
+                nic.setMacAddress(interfaceDef.getMacAddress());
+                nic.setNicId(interfaceDef.getBrName());
+                nic.setAdapterType(interfaceDef.getModel().toString());
+                nics.add(nic);
+            }
+        }
+        return nics;
+    }
+
+    protected List<UnmanagedInstanceTO.Disk> getUnmanagedInstanceDisks(List<KVMPhysicalDisk> vmDisks, LibvirtDomainXMLParser xmlParser) {
+        List<UnmanagedInstanceTO.Disk> instanceDisks = new ArrayList<>();
+        List<LibvirtVMDef.DiskDef> diskDefs = xmlParser != null ? xmlParser.getDisks() : null;
+        for (int i = 0; i< vmDisks.size(); i++) {
+            KVMPhysicalDisk physicalDisk = vmDisks.get(i);
+            KVMStoragePool storagePool = physicalDisk.getPool();
+            UnmanagedInstanceTO.Disk disk = new UnmanagedInstanceTO.Disk();
+            disk.setPosition(i);
+            Pair<String, String> storagePoolHostAndPath = getNfsStoragePoolHostAndPath(storagePool);
+            disk.setDatastoreHost(storagePoolHostAndPath.first());
+            disk.setDatastorePath(storagePoolHostAndPath.second());
+            disk.setDatastoreName(storagePool.getUuid());
+            disk.setDatastoreType(storagePool.getType().name());
+            disk.setCapacity(physicalDisk.getVirtualSize());
+            disk.setFileBaseName(physicalDisk.getName());
+            if (CollectionUtils.isNotEmpty(diskDefs)) {
+                LibvirtVMDef.DiskDef diskDef = diskDefs.get(i);
+                disk.setController(diskDef.getBusType() != null ? diskDef.getBusType().toString() : LibvirtVMDef.DiskDef.DiskBus.VIRTIO.toString());
+            } else {
+                // If the job is finished but we cannot parse the XML, the guest VM can use the virtio driver
+                disk.setController(LibvirtVMDef.DiskDef.DiskBus.VIRTIO.toString());
+            }
+            instanceDisks.add(disk);
+        }
+        return instanceDisks;
+    }
+
+    protected Pair<String, String> getNfsStoragePoolHostAndPath(KVMStoragePool storagePool) {
+        String sourceHostIp = null;
+        String sourcePath = null;
+        List<String[]> commands = new ArrayList<>();
+        commands.add(new String[]{Script.getExecutableAbsolutePath("mount")});
+        commands.add(new String[]{Script.getExecutableAbsolutePath("grep"), storagePool.getLocalPath()});
+        String storagePoolMountPoint = Script.executePipedCommands(commands, 0).second();
+        logger.debug(String.format("NFS Storage pool: %s - local path: %s, mount point: %s", storagePool.getUuid(), storagePool.getLocalPath(), storagePoolMountPoint));
+        if (StringUtils.isNotEmpty(storagePoolMountPoint)) {
+            String[] res = storagePoolMountPoint.strip().split(" ");
+            res = res[0].split(":");
+            if (res.length > 1) {
+                sourceHostIp = res[0].strip();
+                sourcePath = res[1].strip();
+            }
+        }
+        return new Pair<>(sourceHostIp, sourcePath);
+    }
+
+    protected LibvirtDomainXMLParser parseMigratedVMXmlDomain(String installPath) throws IOException {
+        String xmlPath = String.format("%s.xml", installPath);
+        if (!new File(xmlPath).exists()) {
+            String err = String.format("Conversion failed. Unable to find the converted XML domain, expected %s", xmlPath);
+            logger.error(err);
+            throw new CloudRuntimeException(err);
+        }
+        String xml;
+        try (InputStream is = new BufferedInputStream(new FileInputStream(xmlPath))) {
+            xml = IOUtils.toString(is, Charset.defaultCharset());
+        }
+        final LibvirtDomainXMLParser parser = new LibvirtDomainXMLParser();
+        try {
+            parser.parseDomainXML(xml);
+            return parser;
+        } catch (RuntimeException e) {
+            String err = String.format("Error parsing the converted instance XML domain at %s: %s", xmlPath, e.getMessage());
+            logger.error(err, e);
+            logger.debug(xml);
+            return null;
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCleanupConvertedInstanceDisksCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCleanupConvertedInstanceDisksCommandWrapper.java
new file mode 100644
index 000000000000..05afd8b2234d
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCleanupConvertedInstanceDisksCommandWrapper.java
@@ -0,0 +1,67 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.CleanupConvertedInstanceDisksCommand;
+import com.cloud.agent.api.to.DataStoreTO;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.resource.LibvirtDomainXMLParser;
+import com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.resource.ResourceWrapper;
+
+import java.io.File;
+import java.util.List;
+
+@ResourceWrapper(handles = CleanupConvertedInstanceDisksCommand.class)
+public class LibvirtCleanupConvertedInstanceDisksCommandWrapper extends LibvirtBaseConvertCommandWrapper<CleanupConvertedInstanceDisksCommand, Answer, LibvirtComputingResource> {
+
+    @Override
+    public Answer execute(CleanupConvertedInstanceDisksCommand command, LibvirtComputingResource serverResource) {
+        DataStoreTO vmVolumesStore = command.getVmVolumesStore();
+        String vmVolumesPrefix = command.getVmVolumesPrefix();
+
+        final KVMStoragePoolManager storagePoolMgr = serverResource.getStoragePoolMgr();
+        KVMStoragePool conversionPool = getTemporaryStoragePool(vmVolumesStore, storagePoolMgr);
+        final String conversionPoolPath = conversionPool.getLocalPath();
+
+        try {
+            String volumesBasePath = String.format("%s/%s", conversionPoolPath, vmVolumesPrefix);
+            String xmlPath = String.format("%s.xml", volumesBasePath);
+            boolean xmlExists = new File(xmlPath).exists();
+
+            LibvirtDomainXMLParser xmlParser = xmlExists ? parseMigratedVMXmlDomain(volumesBasePath) : null;
+            List<KVMPhysicalDisk> temporaryDisks = xmlExists && xmlParser != null ?
+                    getTemporaryDisksFromParsedXml(conversionPool, xmlParser, volumesBasePath, conversionPoolPath, vmVolumesPrefix) :
+                    getTemporaryDisksWithPrefixFromTemporaryPool(conversionPool, conversionPoolPath, vmVolumesPrefix);
+
+            cleanupDisksAndDomainFromTemporaryLocation(temporaryDisks, conversionPool, vmVolumesPrefix, xmlExists);
+
+        } catch (Exception e) {
+            String error = String.format("Error cleaning up converted disks with prefix %s from %s, due to: %s",
+                    vmVolumesPrefix, conversionPoolPath, e.getMessage());
+            logger.error(error, e);
+            return new Answer(command, false, error);
+        }
+
+        return new Answer(command);
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCleanupKbossValidationCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCleanupKbossValidationCommandWrapper.java
new file mode 100644
index 000000000000..c23a3ef0c979
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCleanupKbossValidationCommandWrapper.java
@@ -0,0 +1,50 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import org.apache.cloudstack.backup.CleanupKbossValidationCommand;
+
+@ResourceWrapper(handles = CleanupKbossValidationCommand.class)
+public class LibvirtCleanupKbossValidationCommandWrapper extends CommandWrapper<CleanupKbossValidationCommand, Answer, LibvirtComputingResource> {
+    @Override
+    public Answer execute(CleanupKbossValidationCommand command, LibvirtComputingResource serverResource) {
+        KVMStoragePoolManager storagePoolMgr = serverResource.getStoragePoolMgr();
+        cleanupSecondaryStorages(command, storagePoolMgr);
+        return new Answer(command);
+    }
+
+    /**
+     * The objective of this command is to remove the secondary storage references after the validation VM was stopped.
+     * Since the <code>getStoragePoolByURI</code> and <code>deleteStoragePool</code> have a reference counter, where the first method increases the count and the second one
+     * decreases the count, we must call the deleteStoragePool twice so that the command is count negative.
+     * */
+    private void cleanupSecondaryStorages(CleanupKbossValidationCommand command, KVMStoragePoolManager storagePoolMgr) {
+        logger.info("Cleaning up secondary storage references after backup validation process using VM [{}].", command.getVmName());
+        for (String secondaryUrl : command.getSecondaryStorages()) {
+            logger.debug("Cleaning up secondary storage reference for secondary at [{}].", secondaryUrl);
+            KVMStoragePool secondary = storagePoolMgr.getStoragePoolByURI(secondaryUrl);
+            storagePoolMgr.deleteStoragePool(secondary.getType(), secondary.getUuid());
+            storagePoolMgr.deleteStoragePool(secondary.getType(), secondary.getUuid());
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCleanupKbossVmBackupCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCleanupKbossVmBackupCommandWrapper.java
new file mode 100644
index 000000000000..430d1c6ea3c2
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCleanupKbossVmBackupCommandWrapper.java
@@ -0,0 +1,231 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.resource.LibvirtDomainXMLParser;
+import com.cloud.hypervisor.kvm.resource.LibvirtVMDef;
+import com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.utils.Pair;
+import org.apache.cloudstack.backup.CleanupKbossBackupErrorAnswer;
+import org.apache.cloudstack.backup.CleanupKbossBackupErrorCommand;
+import org.apache.cloudstack.storage.to.BackupDeltaTO;
+import org.apache.cloudstack.storage.to.DeltaMergeTreeTO;
+import org.apache.cloudstack.storage.to.KbossTO;
+import org.apache.cloudstack.storage.to.PrimaryDataStoreTO;
+import org.apache.cloudstack.storage.to.VolumeObjectTO;
+import org.apache.cloudstack.utils.qemu.QemuImgException;
+import org.apache.commons.lang3.StringUtils;
+import org.libvirt.Domain;
+import org.libvirt.Error;
+import org.libvirt.LibvirtException;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.List;
+
+@ResourceWrapper(handles = CleanupKbossBackupErrorCommand.class)
+public class LibvirtCleanupKbossVmBackupCommandWrapper extends CommandWrapper<CleanupKbossBackupErrorCommand, Answer, LibvirtComputingResource> {
+    @Override
+    public Answer execute(CleanupKbossBackupErrorCommand command, LibvirtComputingResource serverResource) {
+        List<KbossTO> kbossTOS = command.getKbossTOs();
+        KVMStoragePoolManager storagePoolManager = serverResource.getStoragePoolMgr();
+
+        logger.info("Cleaning up backup error for VM [{}].", command.getVmName());
+        cleanupBackupDeltasOnSecondary(command, storagePoolManager, kbossTOS);
+
+        if (command.isRunningVM()) {
+            Pair<List<VolumeObjectTO>, Boolean> volumeTosAndIsVmRunning = cleanupRunningVm(command, serverResource);
+            return new CleanupKbossBackupErrorAnswer(command, volumeTosAndIsVmRunning.first(), volumeTosAndIsVmRunning.second());
+        }
+
+        return new CleanupKbossBackupErrorAnswer(command, mergeDeltasForStoppedVmIfNeeded(command, serverResource), false);
+    }
+
+    private Pair<List<VolumeObjectTO>, Boolean> cleanupRunningVm(CleanupKbossBackupErrorCommand command, LibvirtComputingResource serverResource) {
+        Domain dm = null;
+        try {
+            dm = serverResource.getDomain(serverResource.getLibvirtUtilitiesHelper().getConnection(), command.getVmName());
+            return new Pair<>(mergeDeltasForRunningVmIfNeeded(command, serverResource, dm), true);
+        } catch (LibvirtException e) {
+            if (e.getError().getCode() == Error.ErrorNumber.VIR_ERR_NO_DOMAIN && isVmReallyStopped(command, serverResource)) {
+                return new Pair<>(mergeDeltasForStoppedVmIfNeeded(command, serverResource), false);
+            }
+            logger.error("Error while trying to get VM [{}]. Aborting the process.", command.getVmName(), e);
+            return new Pair<>(List.of(), false);
+        } finally {
+            if (dm != null) {
+                try {
+                    dm.free();
+                } catch (LibvirtException e) {
+                    logger.warn("Ignoring Libvirt exception.", e);
+                }
+            }
+        }
+    }
+
+    private List<VolumeObjectTO> mergeDeltasForStoppedVmIfNeeded(CleanupKbossBackupErrorCommand command, LibvirtComputingResource serverResource) {
+        List<VolumeObjectTO> volumeObjectTOList = new ArrayList<>();
+        for (KbossTO kbossTO : command.getKbossTOs()) {
+            VolumeObjectTO volumeObjectTO = kbossTO.getVolumeObjectTO();
+            PrimaryDataStoreTO primaryDataStoreTO = (PrimaryDataStoreTO)volumeObjectTO.getDataStore();
+            KVMStoragePool kvmStoragePool = serverResource.getStoragePoolMgr().getStoragePool(primaryDataStoreTO.getPoolType(), primaryDataStoreTO.getUuid());
+            boolean backupErrorDeltaExists = Files.exists(Path.of(kvmStoragePool.getLocalPathFor(volumeObjectTO.getPath())));
+            boolean parentBackupDeltaExists = Files.exists(Path.of(kvmStoragePool.getLocalPathFor(kbossTO.getDeltaPathOnPrimary())));
+            boolean shouldBaseDeltaExist = kbossTO.getParentDeltaPathOnPrimary() != null;
+            boolean baseDeltaExists = shouldBaseDeltaExist && Files.exists(Path.of(kvmStoragePool.getLocalPathFor(kbossTO.getParentDeltaPathOnPrimary())));
+
+            if(!mergeDeltaIfNeeded(serverResource, kbossTO, backupErrorDeltaExists, parentBackupDeltaExists, shouldBaseDeltaExist, baseDeltaExists,
+                    false, volumeObjectTO, volumeObjectTOList)) {
+                return List.of();
+            }
+        }
+        return volumeObjectTOList;
+    }
+
+    private List<VolumeObjectTO> mergeDeltasForRunningVmIfNeeded(CleanupKbossBackupErrorCommand command, LibvirtComputingResource serverResource, Domain dm) throws LibvirtException {
+        String xmlDesc = dm.getXMLDesc(0);
+        LibvirtDomainXMLParser parser = new LibvirtDomainXMLParser();
+        parser.parseDomainXML(xmlDesc);
+        List<VolumeObjectTO> volumeObjectTOList = new ArrayList<>();
+        for (KbossTO kbossTO : command.getKbossTOs()) {
+            LibvirtVMDef.DiskDef diskDef = parser.getDisks().stream()
+                    .filter(disk -> StringUtils.contains(disk.getDiskPath(), kbossTO.getVolumeObjectTO().getPath()) ||
+                            StringUtils.contains(disk.getDiskPath(), kbossTO.getDeltaPathOnPrimary()) ||
+                            StringUtils.contains(disk.getDiskPath(), kbossTO.getParentDeltaPathOnPrimary())).findFirst().orElse(null);
+
+            if (diskDef == null) {
+                logger.warn("Volume [{}] does not match any record we have. This must be manually normalized.", kbossTO.getVolumeObjectTO().getUuid());
+                return List.of();
+            }
+
+            boolean backupErrorDeltaExists = diskDef.getDiskPath().contains(kbossTO.getVolumeObjectTO().getPath());
+            boolean parentBackupDeltaExists = diskDef.getDiskPath().contains(kbossTO.getDeltaPathOnPrimary()) ||
+                    diskDef.getBackingStoreList().stream().anyMatch(path -> path.contains(kbossTO.getDeltaPathOnPrimary()));
+            boolean shouldBaseDeltaExist = kbossTO.getParentDeltaPathOnPrimary() != null;
+            boolean baseDeltaExists = shouldBaseDeltaExist && StringUtils.contains(diskDef.getDiskPath(), kbossTO.getParentDeltaPathOnPrimary()) ||
+                    diskDef.getBackingStoreList().stream().anyMatch(path -> StringUtils.contains(path, kbossTO.getParentDeltaPathOnPrimary()));
+
+            mergeDeltaIfNeeded(serverResource, kbossTO, backupErrorDeltaExists, parentBackupDeltaExists, shouldBaseDeltaExist, baseDeltaExists, true,
+                    kbossTO.getVolumeObjectTO(), volumeObjectTOList);
+        }
+
+        return volumeObjectTOList;
+    }
+
+    private boolean mergeDeltaIfNeeded(LibvirtComputingResource serverResource, KbossTO kbossTO, boolean backupErrorDeltaExists,
+            boolean parentBackupDeltaExists, boolean shouldBaseDeltaExist, boolean baseDeltaExists, boolean runningVm, VolumeObjectTO volumeObjectTO,
+            List<VolumeObjectTO> volumeObjectTOList) {
+        DeltaMergeTreeTO deltaMergeTreeTO;
+        if (!backupErrorDeltaExists) {
+            if (parentBackupDeltaExists && (!shouldBaseDeltaExist || baseDeltaExists)) {
+                volumeObjectTO.setPath(kbossTO.getDeltaPathOnPrimary());
+                logger.debug("Volume [{}] is already consistent. Its path is [{}].", volumeObjectTO.getUuid(), volumeObjectTO.getPath());
+                volumeObjectTOList.add(volumeObjectTO);
+                return true;
+            } else if (baseDeltaExists) {
+                volumeObjectTO.setPath(kbossTO.getParentDeltaPathOnPrimary());
+                logger.debug("Volume [{}] is already consistent. Its path is [{}].", volumeObjectTO.getUuid(), volumeObjectTO.getPath());
+                volumeObjectTOList.add(volumeObjectTO);
+                return true;
+            } else {
+                logger.warn("Volume [{}] is inconsistent in an anomalous way. We cannot normalize it automatically.", volumeObjectTO.getUuid());
+                return false;
+            }
+        } else if (parentBackupDeltaExists) {
+            logger.debug("Volume [{}] is inconsistent, but we can normalize it. We will merge the delta created by this backup with the delta created by the previous " +
+                    "backup.", volumeObjectTO.getUuid());
+            deltaMergeTreeTO = new DeltaMergeTreeTO(volumeObjectTO, new BackupDeltaTO(volumeObjectTO.getDataStore(), Hypervisor.HypervisorType.KVM,
+                    kbossTO.getDeltaPathOnPrimary()), volumeObjectTO, List.of());
+        } else if (baseDeltaExists) {
+            logger.debug("Volume [{}] is inconsistent, but we can normalize it. We will merge the delta created by this backup with the base volume.",
+                    volumeObjectTO.getUuid());
+            deltaMergeTreeTO = new DeltaMergeTreeTO(volumeObjectTO, new BackupDeltaTO(volumeObjectTO.getDataStore(), Hypervisor.HypervisorType.KVM,
+                    kbossTO.getParentDeltaPathOnPrimary()), volumeObjectTO, List.of());
+        } else {
+            logger.warn("Volume [{}] is inconsistent in an anomalous way. We cannot normalize it automatically.", volumeObjectTO.getUuid());
+            return false;
+        }
+
+        try {
+            if (runningVm) {
+                serverResource.mergeDeltaForRunningVm(deltaMergeTreeTO, volumeObjectTO.getVmName(), volumeObjectTO);
+            } else {
+                serverResource.mergeDeltaForStoppedVm(deltaMergeTreeTO);
+            }
+            volumeObjectTO.setPath(deltaMergeTreeTO.getParent().getPath());
+            volumeObjectTOList.add(volumeObjectTO);
+            return true;
+        } catch (QemuImgException | IOException | LibvirtException ex) {
+            logger.error("Got an exception while trying to merge delta for volume [{}].", volumeObjectTO.getUuid(), ex);
+            return false;
+        }
+    }
+
+    private boolean isVmReallyStopped(CleanupKbossBackupErrorCommand command, LibvirtComputingResource serverResource) {
+        VolumeObjectTO volume = command.getKbossTOs().stream()
+                .filter(kbossTO -> kbossTO.getVolumeObjectTO().getDeviceId() == 0)
+                .map(KbossTO::getVolumeObjectTO).findFirst().orElseThrow();
+        PrimaryDataStoreTO primary = (PrimaryDataStoreTO)volume.getDataStore();
+        KVMStoragePool storage = serverResource.getStoragePoolMgr().getStoragePool(primary.getPoolType(), primary.getUuid());
+        KVMPhysicalDisk disk = storage.getPhysicalDisk(volume.getUuid());
+        File diskFile = new File(disk.getPath());
+        long time1 = diskFile.lastModified();
+        try {
+            Thread.sleep(30 * 1000);
+        } catch (InterruptedException ex) {
+            throw new RuntimeException(ex);
+        }
+        long time2 = diskFile.lastModified();
+        if (time1 != time2) {
+            logger.info("VM root disk [{}] has been modified in the last 30 seconds. It seems the VM is running, even though we were unable to find it. If the VM is " +
+                    "running on this host, you can try again later. If the VM was somehow migrated, you should update the database directly.");
+            return false;
+        }
+        logger.warn("VM [{}] was not found by Libvirt and the root disk has not had any writes on the last 30 seconds. Assuming that it is stopped.", command.getVmName());
+        return true;
+    }
+
+    private void cleanupBackupDeltasOnSecondary(CleanupKbossBackupErrorCommand command, KVMStoragePoolManager storagePoolManager, List<KbossTO> kbossTOS) {
+        KVMStoragePool storagePool = null;
+        try {
+            storagePool = storagePoolManager.getStoragePoolByURI(command.getImageStoreUrl());
+            for (KbossTO kbossTO : kbossTOS) {
+                String deltaPath = storagePool.getLocalPathFor(kbossTO.getDeltaPathOnSecondary());
+                logger.debug("Cleaning up file at [{}] if it exists.", deltaPath);
+                try {
+                    Files.deleteIfExists(Path.of(deltaPath));
+                } catch (IOException e) {
+                    logger.error("Unable to delete leftover backup delta at [{}].", deltaPath);
+                }
+            }
+        } finally {
+            if (storagePool != null) {
+                storagePoolManager.deleteStoragePool(storagePool.getType(), storagePool.getUuid());
+            }
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCompressBackupCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCompressBackupCommandWrapper.java
new file mode 100644
index 000000000000..2cc08311cbce
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCompressBackupCommandWrapper.java
@@ -0,0 +1,150 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.to.DataTO;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.utils.exception.CloudRuntimeException;
+import org.apache.cloudstack.backup.Backup;
+import org.apache.cloudstack.backup.CompressBackupCommand;
+import org.apache.cloudstack.storage.formatinspector.Qcow2Inspector;
+import org.apache.cloudstack.storage.to.DeltaMergeTreeTO;
+import org.apache.cloudstack.utils.qemu.QemuImageOptions;
+import org.apache.cloudstack.utils.qemu.QemuImg;
+import org.apache.cloudstack.utils.qemu.QemuImgException;
+import org.apache.cloudstack.utils.qemu.QemuImgFile;
+import org.libvirt.LibvirtException;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.stream.Collectors;
+
+@ResourceWrapper(handles = CompressBackupCommand.class)
+public class LibvirtCompressBackupCommandWrapper extends CommandWrapper<CompressBackupCommand, Answer, LibvirtComputingResource>  {
+    public static final String COMPRESSION_TYPE = "compression_type";
+    private static final int MIN_QCOW_2_VERSION_FOR_ZSTD = 3;
+
+    @Override
+    public Answer execute(CompressBackupCommand command, LibvirtComputingResource serverResource) {
+        List<KVMStoragePool> secondaryStorages = new ArrayList<>();
+        List<DeltaMergeTreeTO> deltas = command.getBackupDeltasToCompress();
+        KVMStoragePoolManager storagePoolManager = serverResource.getStoragePoolMgr();
+
+        logger.info("Starting compression for backup deltas [{}].", deltas);
+        try {
+            QemuImg qemuImg = new QemuImg(command.getWait() * 1000);
+            Integer rateLimit = validateAndGetRateLimit(command, qemuImg);
+
+            KVMStoragePool mainSecStorage = storagePoolManager.getStoragePoolByURI(deltas.stream().findFirst().orElseThrow().getChild().getDataStore().getUrl());
+            secondaryStorages.add(mainSecStorage);
+            secondaryStorages.addAll(command.getBackupChainImageStoreUrls().stream().map(storagePoolManager::getStoragePoolByURI).collect(Collectors.toList()));
+
+            if (!checkAvailableStorage(command, mainSecStorage, storagePoolManager)) {
+                return new Answer(command, false, "Not enough available space on secondary.");
+            }
+
+            for (DeltaMergeTreeTO delta : deltas) {
+                DataTO child = delta.getChild();
+
+                QemuImgFile backingFile = null;
+                DataTO parent = delta.getParent();
+                if (parent != null) {
+                    KVMStoragePool parentSecondaryStorage = storagePoolManager.getStoragePoolByURI(parent.getDataStore().getUrl());
+                    secondaryStorages.add(parentSecondaryStorage);
+                    backingFile = new QemuImgFile(parentSecondaryStorage.getLocalPathFor(parent.getPath()), QemuImg.PhysicalDiskFormat.QCOW2);
+                }
+
+                String fullDeltaPath = mainSecStorage.getLocalPathFor(child.getPath());
+                String compressedPath = fullDeltaPath + ".comp";
+                QemuImgFile originalBackup = new QemuImgFile(fullDeltaPath, QemuImg.PhysicalDiskFormat.QCOW2);
+                QemuImgFile compressedBackup = new QemuImgFile(compressedPath, QemuImg.PhysicalDiskFormat.QCOW2);
+
+                HashMap<String, String> options = new HashMap<>();
+                Backup.CompressionLibrary compressionLib = getCompressionLibrary(command, fullDeltaPath);
+                setCompressionTypeOptionIfAvailable(qemuImg, options, compressionLib);
+                int coroutines = command.getCoroutines();
+                logger.info("Starting compression for backup delta [{}] with parent [{}] using [{}] coroutines.", child, parent, coroutines);
+                qemuImg.convert(originalBackup, compressedBackup, backingFile, options, null, new QemuImageOptions(originalBackup.getFormat(), originalBackup.getFileName(),
+                        null), null, false, false, true, true, coroutines, rateLimit);
+            }
+        } catch (LibvirtException | QemuImgException e) {
+            return new Answer(command, e);
+        } finally {
+            for (KVMStoragePool secondaryStorage : secondaryStorages) {
+                storagePoolManager.deleteStoragePool(secondaryStorage.getType(), secondaryStorage.getUuid());
+            }
+        }
+
+        return new Answer(command);
+    }
+
+    private Integer validateAndGetRateLimit(CompressBackupCommand command, QemuImg qemuImg) {
+        if (command.getRateLimit() < 1) {
+            return null;
+        }
+
+        if (qemuImg.getVersion() < QemuImg.QEMU_5_2) {
+            throw new CloudRuntimeException("Qemu version is lower than 5.2.0, unable to set the rate limit.");
+        }
+
+        return command.getRateLimit();
+    }
+
+    /**
+     * Sets the compression type option if qemu-img is at least in version 5.1. Otherwise, will not set it and qemu will use zlib.
+     * */
+    private void setCompressionTypeOptionIfAvailable(QemuImg qemuImg, HashMap<String, String> options, Backup.CompressionLibrary compressionLib) {
+        if (qemuImg.getVersion() >= QemuImg.QEMU_5_1) {
+            options.put(COMPRESSION_TYPE, compressionLib.name());
+            return;
+        }
+        logger.warn("Qemu is at a lower version than 5.1, we will not be able to use zstd to compress backups. Only zlib is supported for this version. Current version is [{}].",
+                qemuImg.getVersion());
+    }
+
+    private Backup.CompressionLibrary getCompressionLibrary(CompressBackupCommand command, String fullDeltaPath) {
+        Backup.CompressionLibrary compressionLib = command.getCompressionLib();
+        if (compressionLib == Backup.CompressionLibrary.zlib || !Qcow2Inspector.validateQcow2Version(fullDeltaPath, MIN_QCOW_2_VERSION_FOR_ZSTD)) {
+            logger.debug("Compression for delta [{}] will use zlib as the compression library.", fullDeltaPath);
+            return Backup.CompressionLibrary.zlib;
+        }
+
+        logger.debug("Compression for delta [{}] will try to use zstd as the compression library.", fullDeltaPath);
+        return Backup.CompressionLibrary.zstd;
+    }
+
+    /**
+     * Validates available storage. Forces Libvirt to refresh storage info so that we have the most up to date data.
+     * */
+    private boolean checkAvailableStorage(CompressBackupCommand command, KVMStoragePool mainSecStorage, KVMStoragePoolManager storagePoolManager) {
+        logger.debug("Checking available storage [{}].", mainSecStorage);
+        mainSecStorage = storagePoolManager.getStoragePool(mainSecStorage.getType(), mainSecStorage.getUuid(), true, false);
+        if (mainSecStorage.getAvailable() < command.getMinFreeStorage()) {
+            logger.warn("There is not enough available space for compression of backup! Available size is [{}], needed [{}]. Aborting compression.",
+                    mainSecStorage.getAvailable(), command.getMinFreeStorage());
+            return false;
+        }
+        return true;
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtConsolidateVolumesCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtConsolidateVolumesCommandWrapper.java
new file mode 100644
index 000000000000..30c8849df5fa
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtConsolidateVolumesCommandWrapper.java
@@ -0,0 +1,59 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.storage.Storage;
+import org.apache.cloudstack.backup.ConsolidateVolumesAnswer;
+import org.apache.cloudstack.backup.ConsolidateVolumesCommand;
+import org.apache.cloudstack.storage.to.VolumeObjectTO;
+import org.libvirt.LibvirtException;
+
+import java.util.ArrayList;
+import java.util.List;
+
+@ResourceWrapper(handles = ConsolidateVolumesCommand.class)
+public class LibvirtConsolidateVolumesCommandWrapper extends CommandWrapper<ConsolidateVolumesCommand, Answer, LibvirtComputingResource> {
+
+    @Override
+    public Answer execute(ConsolidateVolumesCommand command, LibvirtComputingResource serverResource) {
+        List<VolumeObjectTO> volumeObjectTOs = command.getVolumesToConsolidate();
+        String vmName = command.getVmName();
+
+        List<VolumeObjectTO> successfulConsolidations = new ArrayList<>();
+        try {
+            for (VolumeObjectTO volumeObjectTO : volumeObjectTOs) {
+                if (!serverResource.pullVolumeBackingFile(volumeObjectTO, vmName)) {
+                    return new ConsolidateVolumesAnswer(command, false, "Failed to consolidate all volumes.", successfulConsolidations);
+                }
+                successfulConsolidations.add(volumeObjectTO);
+            }
+        } catch (LibvirtException ex) {
+            return new ConsolidateVolumesAnswer(command, false, ex.getMessage(), successfulConsolidations);
+        }
+
+        KVMStoragePoolManager kvmStoragePoolManager = serverResource.getStoragePoolMgr();
+        for (String secStorageUuid : command.getSecondaryStorageUuids()) {
+            kvmStoragePoolManager.deleteStoragePool(Storage.StoragePoolType.NetworkFilesystem, secStorageUuid);
+        }
+        return new ConsolidateVolumesAnswer(command, true, "Success", successfulConsolidations);
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateDiskOnlyVMSnapshotCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateDiskOnlyVMSnapshotCommandWrapper.java
index 98e4bddbb7e9..26265f82467b 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateDiskOnlyVMSnapshotCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateDiskOnlyVMSnapshotCommandWrapper.java
@@ -19,193 +19,29 @@
 package com.cloud.hypervisor.kvm.resource.wrapper;
 
 import com.cloud.agent.api.Answer;
-import com.cloud.agent.api.VMSnapshotTO;
 import com.cloud.agent.api.storage.CreateDiskOnlyVmSnapshotAnswer;
 import com.cloud.agent.api.storage.CreateDiskOnlyVmSnapshotCommand;
 import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
-import com.cloud.hypervisor.kvm.resource.LibvirtVMDef;
-import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
-import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
 import com.cloud.resource.CommandWrapper;
 import com.cloud.resource.ResourceWrapper;
-import com.cloud.utils.Pair;
+import com.cloud.utils.exception.BackupException;
 import com.cloud.vm.VirtualMachine;
-import org.apache.cloudstack.storage.to.PrimaryDataStoreTO;
-import org.apache.cloudstack.storage.to.VolumeObjectTO;
-import org.apache.cloudstack.utils.qemu.QemuImg;
-import org.apache.cloudstack.utils.qemu.QemuImgException;
-import org.apache.cloudstack.utils.qemu.QemuImgFile;
-import org.libvirt.Connect;
-import org.libvirt.Domain;
-import org.libvirt.LibvirtException;
-
-import java.io.File;
-import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
-import java.util.HashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.UUID;
 
 @ResourceWrapper(handles = CreateDiskOnlyVmSnapshotCommand.class)
 public class LibvirtCreateDiskOnlyVMSnapshotCommandWrapper extends CommandWrapper<CreateDiskOnlyVmSnapshotCommand, Answer, LibvirtComputingResource> {
 
-    private static final String SNAPSHOT_XML = "<domainsnapshot>\n" +
-            "<name>%s</name>\n" +
-            "<memory snapshot='no'/>\n" +
-            "<disks> \n" +
-            "%s" +
-            "</disks> \n" +
-            "</domainsnapshot>";
-
-    private static final String TAG_DISK_SNAPSHOT = "<disk name='%s' snapshot='external'>\n" +
-            "<source file='%s'/>\n" +
-            "</disk>\n";
-
     @Override
     public Answer execute(CreateDiskOnlyVmSnapshotCommand cmd, LibvirtComputingResource resource) {
         VirtualMachine.State state = cmd.getVmState();
 
-        if (VirtualMachine.State.Running.equals(state)) {
-            return takeDiskOnlyVmSnapshotOfRunningVm(cmd, resource);
-        }
-
-        return takeDiskOnlyVmSnapshotOfStoppedVm(cmd, resource);
-    }
-
-    protected Answer takeDiskOnlyVmSnapshotOfRunningVm(CreateDiskOnlyVmSnapshotCommand cmd, LibvirtComputingResource resource) {
-        String vmName = cmd.getVmName();
-        logger.info("Taking disk-only VM snapshot of running VM [{}].", vmName);
-
-        Domain dm = null;
         try {
-            LibvirtUtilitiesHelper libvirtUtilitiesHelper = resource.getLibvirtUtilitiesHelper();
-            Connect conn = libvirtUtilitiesHelper.getConnection();
-            List<VolumeObjectTO> volumeObjectTOS = cmd.getVolumeTOs();
-            List<LibvirtVMDef.DiskDef> disks = resource.getDisks(conn, vmName);
-
-            dm = resource.getDomain(conn, vmName);
-
-            if (dm == null) {
-                return new CreateDiskOnlyVmSnapshotAnswer(cmd, false, String.format("Creation of disk-only VM Snapshot failed as we could not find the VM [%s].", vmName), null);
-            }
-
-            VMSnapshotTO target = cmd.getTarget();
-            Pair<String, Map<String, Pair<Long, String>>> snapshotXmlAndVolumeToNewPathMap = createSnapshotXmlAndNewVolumePathMap(volumeObjectTOS, disks, target, resource);
-
-            dm.snapshotCreateXML(snapshotXmlAndVolumeToNewPathMap.first(), getFlagsToUseForRunningVmSnapshotCreation(target));
-
-            return new CreateDiskOnlyVmSnapshotAnswer(cmd, true, null, snapshotXmlAndVolumeToNewPathMap.second());
-        } catch (LibvirtException e) {
-            String errorMsg = String.format("Creation of disk-only VM snapshot for VM [%s] failed due to %s.", vmName, e.getMessage());
-            logger.error(errorMsg, e);
-            if (e.getMessage().contains("QEMU guest agent is not connected")) {
-                errorMsg = "QEMU guest agent is not connected. If the VM has been recently started, it might connect soon. Otherwise the VM does not have the" +
-                        " guest agent installed; thus the QuiesceVM parameter is not supported.";
-                return new CreateDiskOnlyVmSnapshotAnswer(cmd, false, errorMsg, null);
-            }
-            return new CreateDiskOnlyVmSnapshotAnswer(cmd, false, e.getMessage(), null);
-        } catch (Exception e) {
-            String errorMsg = String.format("Creation of disk-only VM snapshot for VM [%s] failed due to %s.", vmName, e.getMessage());
-            logger.error(errorMsg, e);
-            return new CreateDiskOnlyVmSnapshotAnswer(cmd, false, errorMsg, null);
-        } finally {
-            if (dm != null) {
-                try {
-                    dm.free();
-                } catch (LibvirtException l) {
-                    logger.trace("Ignoring libvirt error.", l);
-                }
+            if (VirtualMachine.State.Running.equals(state)) {
+                return new CreateDiskOnlyVmSnapshotAnswer(cmd, true, null, resource.createDiskOnlyVmSnapshotForRunningVm(cmd.getVolumeTosAndNewPaths(), cmd.getVmName(),
+                        cmd.getTarget().getSnapshotName(), cmd.getTarget().getQuiescevm()));
             }
+            return new CreateDiskOnlyVmSnapshotAnswer(cmd, true, null, resource.createDiskOnlyVMSnapshotOfStoppedVm(cmd.getVolumeTosAndNewPaths(), cmd.getVmName()));
+        } catch (BackupException ex) {
+            return new Answer(cmd, ex);
         }
     }
-
-    protected Answer takeDiskOnlyVmSnapshotOfStoppedVm(CreateDiskOnlyVmSnapshotCommand cmd, LibvirtComputingResource resource) {
-        String vmName = cmd.getVmName();
-        logger.info("Taking disk-only VM snapshot of stopped VM [{}].", vmName);
-
-        Map<String, Pair<Long, String>> mapVolumeToSnapshotSizeAndNewVolumePath = new HashMap<>();
-
-        List<VolumeObjectTO> volumeObjectTos = cmd.getVolumeTOs();
-        KVMStoragePoolManager storagePoolMgr = resource.getStoragePoolMgr();
-        try {
-            for (VolumeObjectTO volumeObjectTO : volumeObjectTos) {
-                PrimaryDataStoreTO primaryDataStoreTO = (PrimaryDataStoreTO) volumeObjectTO.getDataStore();
-                KVMStoragePool kvmStoragePool = storagePoolMgr.getStoragePool(primaryDataStoreTO.getPoolType(), primaryDataStoreTO.getUuid());
-
-                String snapshotPath = UUID.randomUUID().toString();
-                String snapshotFullPath = kvmStoragePool.getLocalPathFor(snapshotPath);
-                QemuImgFile newDelta = new QemuImgFile(snapshotFullPath, QemuImg.PhysicalDiskFormat.QCOW2);
-
-                String currentDeltaFullPath = kvmStoragePool.getLocalPathFor(volumeObjectTO.getPath());
-                QemuImgFile currentDelta = new QemuImgFile(currentDeltaFullPath, QemuImg.PhysicalDiskFormat.QCOW2);
-
-                QemuImg qemuImg = new QemuImg(0);
-
-                logger.debug("Creating new delta for volume [{}] as part of the disk-only VM snapshot process for VM [{}].", volumeObjectTO.getUuid(), vmName);
-                qemuImg.create(newDelta, currentDelta);
-
-                mapVolumeToSnapshotSizeAndNewVolumePath.put(volumeObjectTO.getUuid(), new Pair<>(getFileSize(currentDeltaFullPath), snapshotPath));
-            }
-        } catch (LibvirtException | QemuImgException e) {
-            logger.error("Exception while creating disk-only VM snapshot for VM [{}]. Deleting leftover deltas.", vmName, e);
-            cleanupLeftoverDeltas(volumeObjectTos, mapVolumeToSnapshotSizeAndNewVolumePath, storagePoolMgr);
-            return new Answer(cmd, e);
-        } catch (Exception e) {
-            logger.error("Unexpected exception while creating disk-only VM snapshot for VM [{}]. Deleting leftover deltas.", vmName, e);
-            cleanupLeftoverDeltas(volumeObjectTos, mapVolumeToSnapshotSizeAndNewVolumePath, storagePoolMgr);
-            return new CreateDiskOnlyVmSnapshotAnswer(cmd, false,
-                    String.format("Creation of disk-only VM snapshot for VM [%s] failed due to %s.", vmName, e.getMessage()), null);
-        }
-
-        return new CreateDiskOnlyVmSnapshotAnswer(cmd, true, null, mapVolumeToSnapshotSizeAndNewVolumePath);
-    }
-
-    protected int getFlagsToUseForRunningVmSnapshotCreation(VMSnapshotTO target) {
-        int flags = target.getQuiescevm() ? Domain.SnapshotCreateFlags.QUIESCE : 0;
-        flags += Domain.SnapshotCreateFlags.DISK_ONLY +
-                Domain.SnapshotCreateFlags.ATOMIC +
-                Domain.SnapshotCreateFlags.NO_METADATA;
-        return flags;
-    }
-
-    protected Pair<String, Map<String, Pair<Long, String>>> createSnapshotXmlAndNewVolumePathMap(List<VolumeObjectTO> volumeObjectTOS, List<LibvirtVMDef.DiskDef> disks, VMSnapshotTO target, LibvirtComputingResource resource) {
-        StringBuilder stringBuilder = new StringBuilder();
-        Map<String, Pair<Long, String>> volumeObjectToNewPathMap = new HashMap<>();
-
-        for (VolumeObjectTO volumeObjectTO : volumeObjectTOS) {
-            LibvirtVMDef.DiskDef diskdef = resource.getDiskWithPathOfVolumeObjectTO(disks, volumeObjectTO);
-            String newPath = UUID.randomUUID().toString();
-            stringBuilder.append(String.format(TAG_DISK_SNAPSHOT, diskdef.getDiskLabel(), resource.getSnapshotTemporaryPath(diskdef.getDiskPath(), newPath)));
-
-            long snapSize = getFileSize(diskdef.getDiskPath());
-
-            volumeObjectToNewPathMap.put(volumeObjectTO.getUuid(), new Pair<>(snapSize, newPath));
-        }
-
-        String snapshotXml = String.format(SNAPSHOT_XML, target.getSnapshotName(), stringBuilder);
-        return new Pair<>(snapshotXml, volumeObjectToNewPathMap);
-    }
-
-    protected void cleanupLeftoverDeltas(List<VolumeObjectTO> volumeObjectTos, Map<String, Pair<Long, String>> mapVolumeToSnapshotSizeAndNewVolumePath, KVMStoragePoolManager storagePoolMgr) {
-        for (VolumeObjectTO volumeObjectTO : volumeObjectTos) {
-            Pair<Long, String> volSizeAndNewPath = mapVolumeToSnapshotSizeAndNewVolumePath.get(volumeObjectTO.getUuid());
-            PrimaryDataStoreTO primaryDataStoreTO = (PrimaryDataStoreTO) volumeObjectTO.getDataStore();
-            KVMStoragePool kvmStoragePool = storagePoolMgr.getStoragePool(primaryDataStoreTO.getPoolType(), primaryDataStoreTO.getUuid());
-
-            if (volSizeAndNewPath == null) {
-                continue;
-            }
-            try {
-                Files.deleteIfExists(Path.of(kvmStoragePool.getLocalPathFor(volSizeAndNewPath.second())));
-            } catch (IOException ex) {
-                logger.warn("Tried to delete leftover snapshot at [{}] failed.", volSizeAndNewPath.second(), ex);
-            }
-        }
-    }
-
-    protected long getFileSize(String path) {
-        return new File(path).length();
-    }
 }
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtFinalizeBackupCompressionCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtFinalizeBackupCompressionCommandWrapper.java
new file mode 100644
index 000000000000..4b02c20c6d26
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtFinalizeBackupCompressionCommandWrapper.java
@@ -0,0 +1,73 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+
+import org.apache.cloudstack.backup.FinalizeBackupCompressionCommand;
+import org.apache.cloudstack.storage.to.BackupDeltaTO;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardCopyOption;
+
+@ResourceWrapper(handles = FinalizeBackupCompressionCommand.class)
+public class LibvirtFinalizeBackupCompressionCommandWrapper extends CommandWrapper<FinalizeBackupCompressionCommand, Answer, LibvirtComputingResource> {
+    @Override
+    public Answer execute(FinalizeBackupCompressionCommand command, LibvirtComputingResource serverResource) {
+        KVMStoragePool storagePool = null;
+        KVMStoragePoolManager storagePoolManager = serverResource.getStoragePoolMgr();
+        long totalPhysicalSize = 0;
+
+        if (command.isCleanup()) {
+            logger.info("Cleaning up compressed backup deltas [{}].", command.getBackupDeltaTOList());
+        } else {
+            logger.info("Finalizing backup compression for deltas [{}].", command.getBackupDeltaTOList());
+        }
+        try {
+            storagePool = storagePoolManager.getStoragePoolByURI(command.getBackupDeltaTOList().get(0).getDataStore().getUrl());
+            for (BackupDeltaTO delta : command.getBackupDeltaTOList()) {
+                Path deltaPath = Path.of(storagePool.getLocalPathFor(delta.getPath()));
+                Path compressedDeltaPath = Path.of(deltaPath + ".comp");
+
+                if (command.isCleanup()) {
+                    logger.debug("Cleaning up backup delta at [{}].", compressedDeltaPath);
+                    Files.deleteIfExists(compressedDeltaPath);
+                    continue;
+                }
+
+                logger.debug("Moving compressed backup delta at [{}] to [{}].", compressedDeltaPath, deltaPath);
+                Files.move(compressedDeltaPath, deltaPath, StandardCopyOption.REPLACE_EXISTING);
+                totalPhysicalSize += Files.size(deltaPath);
+            }
+        } catch (IOException e) {
+            return new Answer(command, e);
+        } finally {
+            if (storagePool != null) {
+                storagePoolManager.deleteStoragePool(storagePool.getType(), storagePool.getUuid());
+            }
+        }
+        return new Answer(command, true, String.valueOf(totalPhysicalSize));
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetStorageStatsCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetStorageStatsCommandWrapper.java
index 419b54492583..424622dfc2ce 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetStorageStatsCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetStorageStatsCommandWrapper.java
@@ -36,7 +36,7 @@ public final class LibvirtGetStorageStatsCommandWrapper extends CommandWrapper<G
     public Answer execute(final GetStorageStatsCommand command, final LibvirtComputingResource libvirtComputingResource) {
         try {
             final KVMStoragePoolManager storagePoolMgr = libvirtComputingResource.getStoragePoolMgr();
-            final KVMStoragePool sp = storagePoolMgr.getStoragePool(command.getPooltype(), command.getStorageId(), true);
+            final KVMStoragePool sp = storagePoolMgr.getStoragePool(command.getPooltype(), command.getStorageId(), true, true);
             if (sp == null) {
                 return new GetStorageStatsAnswer(command, "no storage pool to get statistics from");
             }
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVolumesOnStorageCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVolumesOnStorageCommandWrapper.java
index ab6bdd6135d5..1109d240a035 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVolumesOnStorageCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVolumesOnStorageCommandWrapper.java
@@ -62,7 +62,7 @@ public Answer execute(final GetVolumesOnStorageCommand command, final LibvirtCom
         final String keyword = command.getKeyword();
 
         final KVMStoragePoolManager storagePoolMgr = libvirtComputingResource.getStoragePoolMgr();
-        final KVMStoragePool storagePool = storagePoolMgr.getStoragePool(pool.getType(), pool.getUuid(), true);
+        final KVMStoragePool storagePool = storagePoolMgr.getStoragePool(pool.getType(), pool.getUuid(), true, true);
 
         if (StringUtils.isNotBlank(volumePath)) {
             return addVolumeByVolumePath(command, storagePool, volumePath);
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtImportConvertedInstanceCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtImportConvertedInstanceCommandWrapper.java
index 5602da156799..28e24a9e0f2d 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtImportConvertedInstanceCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtImportConvertedInstanceCommandWrapper.java
@@ -18,22 +18,9 @@
 //
 package com.cloud.hypervisor.kvm.resource.wrapper;
 
-import java.io.BufferedInputStream;
-import java.io.File;
-import java.io.FileInputStream;
-import java.io.IOException;
-import java.io.InputStream;
-import java.nio.charset.Charset;
-import java.util.ArrayList;
 import java.util.List;
-import java.util.UUID;
-import java.util.stream.Collectors;
 
-import org.apache.cloudstack.storage.to.PrimaryDataStoreTO;
 import org.apache.cloudstack.vm.UnmanagedInstanceTO;
-import org.apache.commons.collections.CollectionUtils;
-import org.apache.commons.io.IOUtils;
-import org.apache.commons.lang3.StringUtils;
 
 import com.cloud.agent.api.Answer;
 import com.cloud.agent.api.ImportConvertedInstanceAnswer;
@@ -44,20 +31,14 @@
 import com.cloud.hypervisor.Hypervisor;
 import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
 import com.cloud.hypervisor.kvm.resource.LibvirtDomainXMLParser;
-import com.cloud.hypervisor.kvm.resource.LibvirtVMDef;
 import com.cloud.hypervisor.kvm.storage.KVMPhysicalDisk;
 import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
 import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
-import com.cloud.resource.CommandWrapper;
 import com.cloud.resource.ResourceWrapper;
-import com.cloud.storage.Storage;
-import com.cloud.utils.FileUtil;
-import com.cloud.utils.Pair;
-import com.cloud.utils.exception.CloudRuntimeException;
-import com.cloud.utils.script.Script;
+import org.apache.commons.collections4.CollectionUtils;
 
 @ResourceWrapper(handles =  ImportConvertedInstanceCommand.class)
-public class LibvirtImportConvertedInstanceCommandWrapper extends CommandWrapper<ImportConvertedInstanceCommand, Answer, LibvirtComputingResource> {
+public class LibvirtImportConvertedInstanceCommandWrapper extends LibvirtBaseConvertCommandWrapper<ImportConvertedInstanceCommand, Answer, LibvirtComputingResource> {
 
     @Override
     public Answer execute(ImportConvertedInstanceCommand cmd, LibvirtComputingResource serverResource) {
@@ -79,16 +60,22 @@ public Answer execute(ImportConvertedInstanceCommand cmd, LibvirtComputingResour
 
             List<KVMPhysicalDisk> temporaryDisks = xmlParser == null ?
                     getTemporaryDisksWithPrefixFromTemporaryPool(temporaryStoragePool, temporaryConvertPath, temporaryConvertUuid) :
-                    getTemporaryDisksFromParsedXml(temporaryStoragePool, xmlParser, convertedBasePath);
+                    getTemporaryDisksFromParsedXml(temporaryStoragePool, xmlParser, convertedBasePath, temporaryConvertPath, temporaryConvertUuid);
 
-            List<KVMPhysicalDisk> disks = null;
+            List<KVMPhysicalDisk> disks;
             if (forceConvertToPool) {
                 // Force flag to use the conversion path, no need to move disks
                 disks = temporaryDisks;
             } else {
                 disks = moveTemporaryDisksToDestination(temporaryDisks,
                         destinationStoragePools, storagePoolMgr);
-                cleanupDisksAndDomainFromTemporaryLocation(temporaryDisks, temporaryStoragePool, temporaryConvertUuid);
+                cleanupDisksAndDomainFromTemporaryLocation(temporaryDisks, temporaryStoragePool, temporaryConvertUuid, true);
+            }
+
+            if (CollectionUtils.isEmpty(disks)) {
+                String msg = String.format("Unable to import the converted disks for VM %s from destination pools", sourceInstanceName);
+                logger.error(msg);
+                return new ImportConvertedInstanceAnswer(cmd, false, msg);
             }
 
             UnmanagedInstanceTO convertedInstanceTO = getConvertedUnmanagedInstance(temporaryConvertUuid,
@@ -106,200 +93,4 @@ public Answer execute(ImportConvertedInstanceCommand cmd, LibvirtComputingResour
             }
         }
     }
-
-    protected KVMStoragePool getTemporaryStoragePool(DataStoreTO conversionTemporaryLocation, KVMStoragePoolManager storagePoolMgr) {
-        if (conversionTemporaryLocation instanceof NfsTO) {
-            NfsTO nfsTO = (NfsTO) conversionTemporaryLocation;
-            return storagePoolMgr.getStoragePoolByURI(nfsTO.getUrl());
-        } else {
-            PrimaryDataStoreTO primaryDataStoreTO = (PrimaryDataStoreTO) conversionTemporaryLocation;
-            return storagePoolMgr.getStoragePool(primaryDataStoreTO.getPoolType(), primaryDataStoreTO.getUuid());
-        }
-    }
-
-    protected List<KVMPhysicalDisk> getTemporaryDisksFromParsedXml(KVMStoragePool pool, LibvirtDomainXMLParser xmlParser, String convertedBasePath) {
-        List<LibvirtVMDef.DiskDef> disksDefs = xmlParser.getDisks();
-        disksDefs = disksDefs.stream().filter(x -> x.getDiskType() == LibvirtVMDef.DiskDef.DiskType.FILE &&
-                x.getDeviceType() == LibvirtVMDef.DiskDef.DeviceType.DISK).collect(Collectors.toList());
-        if (CollectionUtils.isEmpty(disksDefs)) {
-            String err = String.format("Cannot find any disk defined on the converted XML domain %s.xml", convertedBasePath);
-            logger.error(err);
-            throw new CloudRuntimeException(err);
-        }
-        sanitizeDisksPath(disksDefs);
-        return getPhysicalDisksFromDefPaths(disksDefs, pool);
-    }
-
-    private List<KVMPhysicalDisk> getPhysicalDisksFromDefPaths(List<LibvirtVMDef.DiskDef> disksDefs, KVMStoragePool pool) {
-        List<KVMPhysicalDisk> disks = new ArrayList<>();
-        for (LibvirtVMDef.DiskDef diskDef : disksDefs) {
-            KVMPhysicalDisk physicalDisk = pool.getPhysicalDisk(diskDef.getDiskPath());
-            disks.add(physicalDisk);
-        }
-        return disks;
-    }
-
-    protected List<KVMPhysicalDisk> getTemporaryDisksWithPrefixFromTemporaryPool(KVMStoragePool pool, String path, String prefix) {
-        String msg = String.format("Could not parse correctly the converted XML domain, checking for disks on %s with prefix %s", path, prefix);
-        logger.info(msg);
-        pool.refresh();
-        List<KVMPhysicalDisk> disksWithPrefix = pool.listPhysicalDisks()
-                .stream()
-                .filter(x -> x.getName().startsWith(prefix) && !x.getName().endsWith(".xml"))
-                .collect(Collectors.toList());
-        if (CollectionUtils.isEmpty(disksWithPrefix)) {
-            msg = String.format("Could not find any converted disk with prefix %s on temporary location %s", prefix, path);
-            logger.error(msg);
-            throw new CloudRuntimeException(msg);
-        }
-        return disksWithPrefix;
-    }
-
-    private void cleanupDisksAndDomainFromTemporaryLocation(List<KVMPhysicalDisk> disks,
-                                                            KVMStoragePool temporaryStoragePool,
-                                                            String temporaryConvertUuid) {
-        for (KVMPhysicalDisk disk : disks) {
-            logger.info(String.format("Cleaning up temporary disk %s after conversion from temporary location", disk.getName()));
-            temporaryStoragePool.deletePhysicalDisk(disk.getName(), Storage.ImageFormat.QCOW2);
-        }
-        logger.info(String.format("Cleaning up temporary domain %s after conversion from temporary location", temporaryConvertUuid));
-        FileUtil.deleteFiles(temporaryStoragePool.getLocalPath(), temporaryConvertUuid, ".xml");
-    }
-
-    protected void sanitizeDisksPath(List<LibvirtVMDef.DiskDef> disks) {
-        for (LibvirtVMDef.DiskDef disk : disks) {
-            String[] diskPathParts = disk.getDiskPath().split("/");
-            String relativePath = diskPathParts[diskPathParts.length - 1];
-            disk.setDiskPath(relativePath);
-        }
-    }
-
-    protected List<KVMPhysicalDisk> moveTemporaryDisksToDestination(List<KVMPhysicalDisk> temporaryDisks,
-                                                                    List<String> destinationStoragePools,
-                                                                    KVMStoragePoolManager storagePoolMgr) {
-        List<KVMPhysicalDisk> targetDisks = new ArrayList<>();
-        if (temporaryDisks.size() != destinationStoragePools.size()) {
-            String warn = String.format("Discrepancy between the converted instance disks (%s) " +
-                    "and the expected number of disks (%s)", temporaryDisks.size(), destinationStoragePools.size());
-            logger.warn(warn);
-        }
-        for (int i = 0; i < temporaryDisks.size(); i++) {
-            String poolPath = destinationStoragePools.get(i);
-            KVMStoragePool destinationPool = storagePoolMgr.getStoragePool(Storage.StoragePoolType.NetworkFilesystem, poolPath);
-            if (destinationPool == null) {
-                String err = String.format("Could not find a storage pool by URI: %s", poolPath);
-                logger.error(err);
-                continue;
-            }
-            if (destinationPool.getType() != Storage.StoragePoolType.NetworkFilesystem) {
-                String err = String.format("Storage pool by URI: %s is not an NFS storage", poolPath);
-                logger.error(err);
-                continue;
-            }
-            KVMPhysicalDisk sourceDisk = temporaryDisks.get(i);
-            if (logger.isDebugEnabled()) {
-                String msg = String.format("Trying to copy converted instance disk number %s from the temporary location %s" +
-                        " to destination storage pool %s", i, sourceDisk.getPool().getLocalPath(), destinationPool.getUuid());
-                logger.debug(msg);
-            }
-
-            String destinationName = UUID.randomUUID().toString();
-
-            KVMPhysicalDisk destinationDisk = storagePoolMgr.copyPhysicalDisk(sourceDisk, destinationName, destinationPool, 7200 * 1000);
-            targetDisks.add(destinationDisk);
-        }
-        return targetDisks;
-    }
-
-    private UnmanagedInstanceTO getConvertedUnmanagedInstance(String baseName,
-                                                              List<KVMPhysicalDisk> vmDisks,
-                                                              LibvirtDomainXMLParser xmlParser) {
-        UnmanagedInstanceTO instanceTO = new UnmanagedInstanceTO();
-        instanceTO.setName(baseName);
-        instanceTO.setDisks(getUnmanagedInstanceDisks(vmDisks, xmlParser));
-        instanceTO.setNics(getUnmanagedInstanceNics(xmlParser));
-        return instanceTO;
-    }
-
-    private List<UnmanagedInstanceTO.Nic> getUnmanagedInstanceNics(LibvirtDomainXMLParser xmlParser) {
-        List<UnmanagedInstanceTO.Nic> nics = new ArrayList<>();
-        if (xmlParser != null) {
-            List<LibvirtVMDef.InterfaceDef> interfaces = xmlParser.getInterfaces();
-            for (LibvirtVMDef.InterfaceDef interfaceDef : interfaces) {
-                UnmanagedInstanceTO.Nic nic = new UnmanagedInstanceTO.Nic();
-                nic.setMacAddress(interfaceDef.getMacAddress());
-                nic.setNicId(interfaceDef.getBrName());
-                nic.setAdapterType(interfaceDef.getModel().toString());
-                nics.add(nic);
-            }
-        }
-        return nics;
-    }
-
-    protected List<UnmanagedInstanceTO.Disk> getUnmanagedInstanceDisks(List<KVMPhysicalDisk> vmDisks, LibvirtDomainXMLParser xmlParser) {
-        List<UnmanagedInstanceTO.Disk> instanceDisks = new ArrayList<>();
-        List<LibvirtVMDef.DiskDef> diskDefs = xmlParser != null ? xmlParser.getDisks() : null;
-        for (int i = 0; i< vmDisks.size(); i++) {
-            KVMPhysicalDisk physicalDisk = vmDisks.get(i);
-            KVMStoragePool storagePool = physicalDisk.getPool();
-            UnmanagedInstanceTO.Disk disk = new UnmanagedInstanceTO.Disk();
-            disk.setPosition(i);
-            Pair<String, String> storagePoolHostAndPath = getNfsStoragePoolHostAndPath(storagePool);
-            disk.setDatastoreHost(storagePoolHostAndPath.first());
-            disk.setDatastorePath(storagePoolHostAndPath.second());
-            disk.setDatastoreName(storagePool.getUuid());
-            disk.setDatastoreType(storagePool.getType().name());
-            disk.setCapacity(physicalDisk.getVirtualSize());
-            disk.setFileBaseName(physicalDisk.getName());
-            if (CollectionUtils.isNotEmpty(diskDefs)) {
-                LibvirtVMDef.DiskDef diskDef = diskDefs.get(i);
-                disk.setController(diskDef.getBusType() != null ? diskDef.getBusType().toString() : LibvirtVMDef.DiskDef.DiskBus.VIRTIO.toString());
-            } else {
-                // If the job is finished but we cannot parse the XML, the guest VM can use the virtio driver
-                disk.setController(LibvirtVMDef.DiskDef.DiskBus.VIRTIO.toString());
-            }
-            instanceDisks.add(disk);
-        }
-        return instanceDisks;
-    }
-
-    protected Pair<String, String> getNfsStoragePoolHostAndPath(KVMStoragePool storagePool) {
-        String sourceHostIp = null;
-        String sourcePath = null;
-        List<String[]> commands = new ArrayList<>();
-        commands.add(new String[]{Script.getExecutableAbsolutePath("mount")});
-        commands.add(new String[]{Script.getExecutableAbsolutePath("grep"), storagePool.getLocalPath()});
-        String storagePoolMountPoint = Script.executePipedCommands(commands, 0).second();
-        logger.debug(String.format("NFS Storage pool: %s - local path: %s, mount point: %s", storagePool.getUuid(), storagePool.getLocalPath(), storagePoolMountPoint));
-        if (StringUtils.isNotEmpty(storagePoolMountPoint)) {
-            String[] res = storagePoolMountPoint.strip().split(" ");
-            res = res[0].split(":");
-            if (res.length > 1) {
-                sourceHostIp = res[0].strip();
-                sourcePath = res[1].strip();
-            }
-        }
-        return new Pair<>(sourceHostIp, sourcePath);
-    }
-
-    protected LibvirtDomainXMLParser parseMigratedVMXmlDomain(String installPath) throws IOException {
-        String xmlPath = String.format("%s.xml", installPath);
-        if (!new File(xmlPath).exists()) {
-            String err = String.format("Conversion failed. Unable to find the converted XML domain, expected %s", xmlPath);
-            logger.error(err);
-            throw new CloudRuntimeException(err);
-        }
-        InputStream is = new BufferedInputStream(new FileInputStream(xmlPath));
-        String xml = IOUtils.toString(is, Charset.defaultCharset());
-        final LibvirtDomainXMLParser parser = new LibvirtDomainXMLParser();
-        try {
-            parser.parseDomainXML(xml);
-            return parser;
-        } catch (RuntimeException e) {
-            String err = String.format("Error parsing the converted instance XML domain at %s: %s", xmlPath, e.getMessage());
-            logger.error(err, e);
-            logger.debug(xml);
-            return null;
-        }
-    }
 }
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.java
index ad0678080ed7..ad687cbb3be1 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtMergeDiskOnlyVMSnapshotCommandWrapper.java
@@ -21,42 +21,26 @@
 import com.cloud.agent.api.Answer;
 
 import com.cloud.agent.api.storage.MergeDiskOnlyVmSnapshotCommand;
-import com.cloud.agent.api.storage.SnapshotMergeTreeTO;
-import com.cloud.agent.api.to.DataObjectType;
-import com.cloud.agent.api.to.DataTO;
+import org.apache.cloudstack.storage.to.DeltaMergeTreeTO;
 import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
-import com.cloud.hypervisor.kvm.resource.LibvirtVMDef;
-import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
-import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
 import com.cloud.resource.CommandWrapper;
 import com.cloud.resource.ResourceWrapper;
 import com.cloud.utils.exception.CloudRuntimeException;
-import com.cloud.vm.VirtualMachine;
-import org.apache.cloudstack.storage.to.PrimaryDataStoreTO;
-import org.apache.cloudstack.storage.to.SnapshotObjectTO;
-import org.apache.cloudstack.storage.to.VolumeObjectTO;
-import org.apache.cloudstack.utils.qemu.QemuImg;
 import org.apache.cloudstack.utils.qemu.QemuImgException;
-import org.apache.cloudstack.utils.qemu.QemuImgFile;
-import org.libvirt.Connect;
-import org.libvirt.Domain;
 import org.libvirt.LibvirtException;
 
 import java.io.IOException;
-import java.nio.file.Files;
-import java.nio.file.Path;
 import java.util.List;
-import java.util.stream.Collectors;
 
 @ResourceWrapper(handles = MergeDiskOnlyVmSnapshotCommand.class)
 public class LibvirtMergeDiskOnlyVMSnapshotCommandWrapper extends CommandWrapper<MergeDiskOnlyVmSnapshotCommand, Answer, LibvirtComputingResource> {
 
     @Override
     public Answer execute(MergeDiskOnlyVmSnapshotCommand command, LibvirtComputingResource serverResource) {
-        VirtualMachine.State vmState = command.getVmState();
+        boolean isVmRunning = command.isVmRunning();
 
         try {
-            if (VirtualMachine.State.Running.equals(vmState)) {
+            if (isVmRunning) {
                 return mergeDiskOnlySnapshotsForRunningVM(command, serverResource);
             }
             return mergeDiskOnlySnapshotsForStoppedVM(command, serverResource);
@@ -66,83 +50,28 @@ public Answer execute(MergeDiskOnlyVmSnapshotCommand command, LibvirtComputingRe
     }
 
     protected Answer mergeDiskOnlySnapshotsForStoppedVM(MergeDiskOnlyVmSnapshotCommand cmd, LibvirtComputingResource resource) throws QemuImgException, LibvirtException {
-        QemuImg qemuImg = new QemuImg(resource.getCmdsTimeout());
-        KVMStoragePoolManager storageManager = resource.getStoragePoolMgr();
+        List<DeltaMergeTreeTO> deltaMergeTreeTOList = cmd.getDeltaMergeTreeToList();
 
-        List<SnapshotMergeTreeTO> snapshotMergeTreeTOList = cmd.getSnapshotMergeTreeToList();
+        logger.debug("Merging deltas for stopped VM [{}] using the following Delta Merge Trees [{}].", cmd.getVmName(), deltaMergeTreeTOList);
 
-        logger.debug("Merging disk-only snapshots for stopped VM [{}] using the following Snapshot Merge Trees [{}].", cmd.getVmName(), snapshotMergeTreeTOList);
-
-        for (SnapshotMergeTreeTO snapshotMergeTreeTO : snapshotMergeTreeTOList) {
-            DataTO parentTo = snapshotMergeTreeTO.getParent();
-            PrimaryDataStoreTO primaryDataStoreTO = (PrimaryDataStoreTO) parentTo.getDataStore();
-            KVMStoragePool storagePool = storageManager.getStoragePool(primaryDataStoreTO.getPoolType(), primaryDataStoreTO.getUuid());
-            String childLocalPath = storagePool.getLocalPathFor(snapshotMergeTreeTO.getChild().getPath());
-
-            QemuImgFile parent = new QemuImgFile(storagePool.getLocalPathFor(parentTo.getPath()), QemuImg.PhysicalDiskFormat.QCOW2);
-            QemuImgFile child = new QemuImgFile(childLocalPath, QemuImg.PhysicalDiskFormat.QCOW2);
-
-            logger.debug("Committing child delta [{}] into parent snapshot [{}].", parentTo, snapshotMergeTreeTO.getChild());
-            qemuImg.commit(child, parent, true);
-
-            List<QemuImgFile> grandChildren = snapshotMergeTreeTO.getGrandChildren().stream()
-                    .map(snapshotTo -> new QemuImgFile(storagePool.getLocalPathFor(snapshotTo.getPath()), QemuImg.PhysicalDiskFormat.QCOW2))
-                    .collect(Collectors.toList());
-
-            logger.debug("Rebasing grandChildren [{}] into parent at [{}].", grandChildren, parent.getFileName());
-            for (QemuImgFile grandChild : grandChildren) {
-                qemuImg.rebase(grandChild, parent, parent.getFormat().toString(), false);
-            }
-
-            logger.debug("Deleting child at [{}] as it is useless.", childLocalPath);
+        for (DeltaMergeTreeTO deltaMergeTreeTO : deltaMergeTreeTOList) {
             try {
-                Files.deleteIfExists(Path.of(childLocalPath));
-            } catch (IOException e) {
-                return new Answer(cmd, e);
+                resource.mergeDeltaForStoppedVm(deltaMergeTreeTO);
+            } catch (IOException ex) {
+                return new Answer(cmd, ex);
             }
         }
         return new Answer(cmd, true, null);
     }
 
-    protected Answer mergeDiskOnlySnapshotsForRunningVM(MergeDiskOnlyVmSnapshotCommand cmd, LibvirtComputingResource resource) throws LibvirtException, QemuImgException {
+    protected Answer mergeDiskOnlySnapshotsForRunningVM(MergeDiskOnlyVmSnapshotCommand cmd, LibvirtComputingResource resource) throws QemuImgException, LibvirtException {
         String vmName = cmd.getVmName();
-        List<SnapshotMergeTreeTO> snapshotMergeTreeTOList = cmd.getSnapshotMergeTreeToList();
-
-        LibvirtUtilitiesHelper libvirtUtilitiesHelper = resource.getLibvirtUtilitiesHelper();
-        Connect conn = libvirtUtilitiesHelper.getConnection();
-        Domain domain = resource.getDomain(conn, vmName);
-        List<LibvirtVMDef.DiskDef> disks = resource.getDisks(conn, vmName);
-        KVMStoragePoolManager storageManager = resource.getStoragePoolMgr();
-        QemuImg qemuImg = new QemuImg(resource.getCmdsTimeout());
+        List<DeltaMergeTreeTO> deltaMergeTreeTOs = cmd.getDeltaMergeTreeToList();
 
-        logger.debug("Merging disk-only snapshots for running VM [{}] using the following Snapshot Merge Trees [{}].", vmName, snapshotMergeTreeTOList);
+        logger.debug("Merging deltas for running VM [{}] using the following Delta Merge Trees [{}].", vmName, deltaMergeTreeTOs);
 
-        for (SnapshotMergeTreeTO mergeTreeTO : snapshotMergeTreeTOList) {
-            DataTO childTO = mergeTreeTO.getChild();
-            SnapshotObjectTO parentSnapshotTO = (SnapshotObjectTO) mergeTreeTO.getParent();
-            VolumeObjectTO volumeObjectTO = parentSnapshotTO.getVolume();
-            KVMStoragePool storagePool = libvirtUtilitiesHelper.getPrimaryPoolFromDataTo(volumeObjectTO, storageManager);
-
-            boolean active = DataObjectType.VOLUME.equals(childTO.getObjectType());
-            String label = resource.getDiskWithPathOfVolumeObjectTO(disks, volumeObjectTO).getDiskLabel();
-            String parentSnapshotLocalPath = storagePool.getLocalPathFor(parentSnapshotTO.getPath());
-            String childDeltaPath = storagePool.getLocalPathFor(childTO.getPath());
-
-            logger.debug("Found label [{}] for [{}]. Will merge delta at [{}] into delta at [{}].", label, volumeObjectTO, parentSnapshotLocalPath, childDeltaPath);
-
-            resource.mergeSnapshotIntoBaseFile(domain, label, parentSnapshotLocalPath, childDeltaPath, active, childTO.getPath(),
-                    volumeObjectTO, conn);
-
-            QemuImgFile parent = new QemuImgFile(parentSnapshotLocalPath, QemuImg.PhysicalDiskFormat.QCOW2);
-
-            List<QemuImgFile> grandChildren = mergeTreeTO.getGrandChildren().stream()
-                    .map(snapshotTo -> new QemuImgFile(storagePool.getLocalPathFor(snapshotTo.getPath()), QemuImg.PhysicalDiskFormat.QCOW2))
-                    .collect(Collectors.toList());
-
-            logger.debug("Rebasing grandChildren [{}] into parent at [{}].", grandChildren, parentSnapshotLocalPath);
-            for (QemuImgFile grandChild : grandChildren) {
-                qemuImg.rebase(grandChild, parent, parent.getFormat().toString(), false);
-            }
+        for (DeltaMergeTreeTO deltaMergeTreeTO : deltaMergeTreeTOs) {
+            resource.mergeDeltaForRunningVm(deltaMergeTreeTO, vmName, deltaMergeTreeTO.getVolumeObjectTO());
         }
 
         return new Answer(cmd, true, null);
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtMigrateBackupsBetweenSecondaryStoragesCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtMigrateBackupsBetweenSecondaryStoragesCommandWrapper.java
new file mode 100644
index 000000000000..f786a0821d05
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtMigrateBackupsBetweenSecondaryStoragesCommandWrapper.java
@@ -0,0 +1,132 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.MigrateBackupsBetweenSecondaryStoragesCommand;
+import com.cloud.agent.api.MigrateBetweenSecondaryStoragesCommandAnswer;
+import com.cloud.agent.api.to.DataStoreTO;
+import com.cloud.agent.api.to.DataTO;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.resource.LibvirtMigrateResourceBetweenSecondaryStorages;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.utils.Pair;
+import org.apache.cloudstack.utils.qemu.QemuImgException;
+import org.apache.commons.lang3.BooleanUtils;
+import org.libvirt.LibvirtException;
+
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
+@ResourceWrapper(handles = MigrateBackupsBetweenSecondaryStoragesCommand.class)
+public class LibvirtMigrateBackupsBetweenSecondaryStoragesCommandWrapper extends LibvirtMigrateResourceBetweenSecondaryStorages<MigrateBackupsBetweenSecondaryStoragesCommand> {
+
+    @Override
+    public Answer execute(MigrateBackupsBetweenSecondaryStoragesCommand command, LibvirtComputingResource serverResource) {
+        resourceType = BACKUP;
+        filesToRemove = new HashSet<>();
+        resourcesToUpdate = new ArrayList<>();
+        wait = command.getWait() * 1000;
+
+        DataStoreTO srcDataStore = command.getSrcDataStore();
+        DataStoreTO destDataStore = command.getDestDataStore();
+        KVMStoragePoolManager storagePoolManager = serverResource.getStoragePoolMgr();
+
+        Set<KVMStoragePool> imagePools = new HashSet<>();
+        KVMStoragePool destImagePool = storagePoolManager.getStoragePoolByURI(destDataStore.getUrl());
+        imagePools.add(destImagePool);
+
+        String imagePoolUrl;
+        KVMStoragePool imagePool = null;
+
+        List<List<DataTO>> backupChains = command.getBackupChain();
+
+        try {
+            Map<String, String> parentBackupPathMap = new HashMap<>();
+            Map<String, Boolean> parentBackupMigrationMap = new HashMap<>();
+
+            Map<String, String> backupPathMap = new HashMap<>();
+            Map<String, Boolean> backupMigrationMap = new HashMap<>();
+
+            for (List<DataTO> chain : backupChains) {
+                long lastBackupId = 0;
+                boolean backupWasMigrated = false;
+
+                backupPathMap.clear();
+                backupMigrationMap.clear();
+
+                for (DataTO backup : chain) {
+                    lastBackupId = backup.getId();
+
+                    imagePoolUrl = backup.getDataStore().getUrl();
+                    imagePool = storagePoolManager.getStoragePoolByURI(imagePoolUrl);
+                    imagePools.add(imagePool);
+
+                    String volumeId = backup.getPath().split("/")[2];
+                    String resourceCurrentPath = imagePool.getLocalPathFor(backup.getPath());
+                    String resourceParentPath = parentBackupPathMap.get(volumeId);
+
+                    if (imagePoolUrl.equals(srcDataStore.getUrl())) {
+                        backupPathMap.put(volumeId, copyResourceToDestDataStore(backup, resourceCurrentPath, destImagePool, resourceParentPath));
+                        backupMigrationMap.put(volumeId, true);
+                        backupWasMigrated = true;
+                    } else {
+                        if (BooleanUtils.isTrue(parentBackupMigrationMap.get(volumeId))) {
+                            backupPathMap.put(volumeId, rebaseResourceToNewParentPath(resourceCurrentPath, resourceParentPath));
+                        } else {
+                            backupPathMap.put(volumeId, resourceCurrentPath);
+                        }
+                        backupMigrationMap.put(volumeId, false);
+                    }
+                }
+
+                parentBackupPathMap.clear();
+                parentBackupPathMap.putAll(backupPathMap);
+
+                parentBackupMigrationMap.clear();
+                parentBackupMigrationMap.putAll(backupMigrationMap);
+
+                if (backupWasMigrated) {
+                    resourcesToUpdate.add(new Pair<>(lastBackupId, null));
+                }
+            }
+        } catch (LibvirtException | QemuImgException e) {
+            logger.error("Exception while migrating backups [{}] to secondary storage [{}] due to: [{}].",
+                    command.getBackupChain(), imagePool, e.getMessage(), e);
+            return new MigrateBetweenSecondaryStoragesCommandAnswer(command, false, "Migration of backups between secondary storages failed", resourcesToUpdate);
+        } finally {
+            for (String file : filesToRemove) {
+                removeResourceFromSourceDataStore(file);
+            }
+
+            for (KVMStoragePool storagePool : imagePools) {
+                storagePoolManager.deleteStoragePool(storagePool.getType(), storagePool.getUuid());
+            }
+        }
+
+        return new MigrateBetweenSecondaryStoragesCommandAnswer(command, true, "success", resourcesToUpdate);
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPrepareValidationCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPrepareValidationCommandWrapper.java
new file mode 100644
index 000000000000..1d9ed5631fa1
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtPrepareValidationCommandWrapper.java
@@ -0,0 +1,91 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.to.DataStoreTO;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.utils.Pair;
+import com.cloud.utils.exception.CloudRuntimeException;
+import org.apache.cloudstack.backup.PrepareValidationCommand;
+import org.apache.cloudstack.storage.to.BackupDeltaTO;
+import org.apache.cloudstack.storage.to.PrimaryDataStoreTO;
+import org.apache.cloudstack.storage.to.VolumeObjectTO;
+import org.apache.cloudstack.utils.qemu.QemuImg;
+import org.apache.cloudstack.utils.qemu.QemuImgException;
+import org.apache.cloudstack.utils.qemu.QemuImgFile;
+import org.libvirt.LibvirtException;
+
+import java.util.ArrayList;
+import java.util.List;
+
+@ResourceWrapper(handles =  PrepareValidationCommand.class)
+public class LibvirtPrepareValidationCommandWrapper extends CommandWrapper<PrepareValidationCommand, Answer, LibvirtComputingResource> {
+    @Override
+    public Answer execute(PrepareValidationCommand command, LibvirtComputingResource resource) {
+        List<Pair<BackupDeltaTO, VolumeObjectTO>> backingFileAndVolumeList = command.getBackupToVolumeList();
+
+        List<KVMStoragePool> secondaryReferences = new ArrayList<>();
+        KVMStoragePoolManager storagePoolMgr = resource.getStoragePoolMgr();
+        try {
+            for (String imageStoreUri : command.getImageStoreSet()) {
+                secondaryReferences.add(storagePoolMgr.getStoragePoolByURI(imageStoreUri));
+            }
+
+            for (Pair<BackupDeltaTO, VolumeObjectTO> backingFileAndVolume : backingFileAndVolumeList) {
+                logger.debug("Preparing volume [{}] for validation.", backingFileAndVolume.second());
+                BackupDeltaTO backupDelta = backingFileAndVolume.first();
+                DataStoreTO dataStoreTO = backupDelta.getDataStore();
+                KVMStoragePool imageStore = storagePoolMgr.getStoragePoolByURI(dataStoreTO.getUrl());
+                secondaryReferences.add(imageStore);
+
+                createVolume(command, backingFileAndVolume, imageStore, backupDelta, storagePoolMgr);
+            }
+        } catch (LibvirtException | QemuImgException e) {
+            logger.error("Failed to prepare VM [{}] for validation due to:", backingFileAndVolumeList.get(0).second().getVmName(), e);
+            throw new CloudRuntimeException(e);
+        } finally {
+            for (KVMStoragePool secondary : secondaryReferences) {
+                storagePoolMgr.deleteStoragePool(secondary.getType(), secondary.getUuid());
+            }
+        }
+        return new Answer(command);
+    }
+
+    private void createVolume(PrepareValidationCommand command, Pair<BackupDeltaTO, VolumeObjectTO> volumeAndBackingFile, KVMStoragePool imageStore, BackupDeltaTO backupDelta,
+            KVMStoragePoolManager storagePoolMgr) throws LibvirtException, QemuImgException {
+        String fullBackupPath = imageStore.getLocalPathFor(backupDelta.getPath());
+
+        VolumeObjectTO volumeObjectTO = volumeAndBackingFile.second();
+        PrimaryDataStoreTO primaryDataStoreTO = (PrimaryDataStoreTO) volumeObjectTO.getDataStore();
+        KVMStoragePool primaryStoragePool = storagePoolMgr.getStoragePool(primaryDataStoreTO.getPoolType(), primaryDataStoreTO.getUuid());
+        String fullVolumePath = primaryStoragePool.getLocalPathFor(volumeObjectTO.getPath());
+
+        QemuImgFile backup = new QemuImgFile(fullBackupPath, QemuImg.PhysicalDiskFormat.QCOW2);
+        QemuImgFile volume = new QemuImgFile(fullVolumePath, QemuImg.PhysicalDiskFormat.QCOW2);
+
+        QemuImg qemuImg = new QemuImg(command.getWait() * 1000);
+
+        qemuImg.create(volume, backup);
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRestoreBackupCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRestoreBackupCommandWrapper.java
index 22dbfbdd67a2..cc2a0868fe17 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRestoreBackupCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRestoreBackupCommandWrapper.java
@@ -60,6 +60,15 @@ public class LibvirtRestoreBackupCommandWrapper extends CommandWrapper<RestoreBa
     private static final String ATTACH_RBD_DISK_XML_COMMAND = " virsh attach-device %s /dev/stdin <<EOF%sEOF";
     private static final String CURRRENT_DEVICE = "virsh domblklist --domain %s | tail -n 3 | head -n 1 | awk '{print $1}'";
     private static final String RSYNC_COMMAND = "rsync -az %s %s";
+    // Flattens the backing-file chain into a single self-contained qcow2 written to the
+    // destination volume path. Used when the source backup is an incremental whose qcow2
+    // has a backing reference to its parent (chain set up by nasbackup.sh's qemu-img rebase).
+    private static final String QEMU_IMG_FLATTEN_COMMAND = "qemu-img convert -O qcow2 %s %s";
+    // Detects whether a qcow2 file references a parent in its backing-file metadata.
+    // Returns 0 (true) when a backing file is present, 1 when not. Uses --output=json
+    // so the test is robust to qemu-img version differences in human-readable output.
+    private static final String QEMU_IMG_HAS_BACKING_COMMAND =
+            "qemu-img info --output=json %s 2>/dev/null | grep -q '\"backing-filename\"'";
 
     private String getVolumeUuidFromPath(String volumePath, PrimaryDataStoreTO volumePool) {
         if (Storage.StoragePoolType.Linstor.equals(volumePool.getPoolType())) {
@@ -270,10 +279,27 @@ private boolean replaceVolumeWithBackup(KVMStoragePoolManager storagePoolMgr, Pr
             return replaceBlockDeviceWithBackup(storagePoolMgr, volumePool, volumePath, backupPath, timeout, createTargetVolume, size);
         }
 
+        // For NAS-backed incremental backups, the source qcow2 has a backing-file
+        // reference to its parent (set by nasbackup.sh's qemu-img rebase). A plain
+        // rsync would copy only the differential blocks, leaving a volume that
+        // depends on a backing file the primary storage doesn't have. Flatten the
+        // chain via qemu-img convert, which follows the backing-file links and
+        // produces a single self-contained qcow2.
+        if (hasBackingChain(backupPath)) {
+            int flattenExit = Script.runSimpleBashScriptForExitValue(
+                    String.format(QEMU_IMG_FLATTEN_COMMAND, backupPath, volumePath), timeout, false);
+            return flattenExit == 0;
+        }
+
         int exitValue = Script.runSimpleBashScriptForExitValue(String.format(RSYNC_COMMAND, backupPath, volumePath), timeout, false);
         return exitValue == 0;
     }
 
+    private boolean hasBackingChain(String qcow2Path) {
+        return Script.runSimpleBashScriptForExitValue(
+                String.format(QEMU_IMG_HAS_BACKING_COMMAND, qcow2Path)) == 0;
+    }
+
     private boolean replaceBlockDeviceWithBackup(KVMStoragePoolManager storagePoolMgr, PrimaryDataStoreTO volumePool, String volumePath, String backupPath, int timeout, boolean createTargetVolume, Long size) {
         KVMStoragePool volumeStoragePool = storagePoolMgr.getStoragePool(volumePool.getPoolType(), volumePool.getUuid());
         QemuImg qemu;
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRestoreKbossBackupCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRestoreKbossBackupCommandWrapper.java
new file mode 100644
index 000000000000..a9010b46c1d4
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRestoreKbossBackupCommandWrapper.java
@@ -0,0 +1,123 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.storage.Storage;
+import com.cloud.utils.Pair;
+import org.apache.cloudstack.backup.RestoreKbossBackupAnswer;
+import org.apache.cloudstack.backup.RestoreKbossBackupCommand;
+import org.apache.cloudstack.storage.to.BackupDeltaTO;
+import org.apache.cloudstack.storage.to.PrimaryDataStoreTO;
+import org.apache.cloudstack.storage.to.VolumeObjectTO;
+import org.apache.cloudstack.utils.qemu.QemuImg;
+import org.apache.cloudstack.utils.qemu.QemuImgException;
+import org.apache.cloudstack.utils.qemu.QemuImgFile;
+import org.libvirt.LibvirtException;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.HashSet;
+import java.util.Set;
+
+@ResourceWrapper(handles = RestoreKbossBackupCommand.class)
+public class LibvirtRestoreKbossBackupCommandWrapper extends CommandWrapper<RestoreKbossBackupCommand, Answer, LibvirtComputingResource> {
+    @Override
+    public Answer execute(RestoreKbossBackupCommand cmd, LibvirtComputingResource resource) {
+        Set<Pair<BackupDeltaTO, VolumeObjectTO>> backupToAndVolumeObjectPairs = cmd.getBackupAndVolumePairs();
+        Set<BackupDeltaTO> deltasToRemove = cmd.getDeltasToRemove();
+        Set<String> secondaryStorageUrls = cmd.getSecondaryStorageUrls();
+
+        KVMStoragePoolManager storagePoolManager = resource.getStoragePoolMgr();
+
+        Set<String> secondaryStorageUuids = new HashSet<>();
+        try {
+            KVMStoragePool secondaryStorage = mountSecondaryStorages(secondaryStorageUrls, backupToAndVolumeObjectPairs.stream().findFirst().get().first().getDataStore().getUrl(),
+                    storagePoolManager, secondaryStorageUuids);
+
+            restoreVolumes(backupToAndVolumeObjectPairs, secondaryStorage, storagePoolManager, cmd.isQuickRestore(), cmd.getWait() * 1000);
+
+            deleteDeltas(deltasToRemove, storagePoolManager);
+        } catch (LibvirtException | QemuImgException | IOException e) {
+            return new RestoreKbossBackupAnswer(cmd, e, secondaryStorageUuids);
+        } finally {
+            if (!cmd.isQuickRestore()) {
+                for (String uuid : secondaryStorageUuids) {
+                    storagePoolManager.deleteStoragePool(Storage.StoragePoolType.NetworkFilesystem, uuid);
+                }
+            }
+        }
+        return new RestoreKbossBackupAnswer(cmd, secondaryStorageUuids);
+    }
+
+    protected void restoreVolumes(Set<Pair<BackupDeltaTO, VolumeObjectTO>> backupToAndVolumeObjectPairs, KVMStoragePool secondaryStorage, KVMStoragePoolManager storagePoolManager,
+            boolean quickRestore, int timeoutInMillis) throws LibvirtException, QemuImgException {
+        for (Pair<BackupDeltaTO, VolumeObjectTO> backupToVolumeToPair : backupToAndVolumeObjectPairs) {
+            String fullBackupPath = secondaryStorage.getLocalPathFor(backupToVolumeToPair.first().getPath());
+
+            VolumeObjectTO volumeObjectTO = backupToVolumeToPair.second();
+            PrimaryDataStoreTO primaryDataStoreTO = (PrimaryDataStoreTO) volumeObjectTO.getDataStore();
+            KVMStoragePool primaryStoragePool = storagePoolManager.getStoragePool(primaryDataStoreTO.getPoolType(), primaryDataStoreTO.getUuid());
+            String fullVolumePath = primaryStoragePool.getLocalPathFor(volumeObjectTO.getPath());
+
+            QemuImgFile backup = new QemuImgFile(fullBackupPath, QemuImg.PhysicalDiskFormat.QCOW2);
+            QemuImgFile volume = new QemuImgFile(fullVolumePath, QemuImg.PhysicalDiskFormat.QCOW2);
+
+            QemuImg qemuImg = getQemuImg(timeoutInMillis);
+
+            if (quickRestore) {
+                logger.info("Creating delta over old volume [{}] at [{}] with backing store stored at [{}].", volumeObjectTO.getUuid(), fullVolumePath, fullBackupPath);
+                qemuImg.create(volume, backup);
+            } else {
+                logger.info("Restoring volume [{}] at [{}] with backup stored at [{}].", volumeObjectTO.getUuid(), fullVolumePath, fullBackupPath);
+                qemuImg.convert(backup, volume);
+            }
+        }
+    }
+
+    protected QemuImg getQemuImg(int timeoutInMillis) throws LibvirtException, QemuImgException {
+        return new QemuImg(timeoutInMillis);
+    }
+
+    protected void deleteDeltas(Set<BackupDeltaTO> deltasToRemove, KVMStoragePoolManager storagePoolManager) throws IOException {
+        for (BackupDeltaTO deltaToRemove : deltasToRemove) {
+            PrimaryDataStoreTO primaryDataStoreTO = (PrimaryDataStoreTO) deltaToRemove.getDataStore();
+            KVMStoragePool primaryStoragePool = storagePoolManager.getStoragePool(primaryDataStoreTO.getPoolType(), primaryDataStoreTO.getUuid());
+            String fullDeltaPath = primaryStoragePool.getLocalPathFor(deltaToRemove.getPath());
+            logger.debug("Deleting leftover delta [{}].", fullDeltaPath);
+            Files.deleteIfExists(Path.of(fullDeltaPath));
+        }
+    }
+
+    protected KVMStoragePool mountSecondaryStorages(Set<String> parentSecondaryStorageUrls, String secondaryStorageUrl, KVMStoragePoolManager storagePoolManager, Set<String> secondaryStorageUuids) {
+        for (String url : parentSecondaryStorageUrls) {
+            KVMStoragePool pool = storagePoolManager.getStoragePoolByURI(url);
+            secondaryStorageUuids.add(pool.getUuid());
+        }
+        KVMStoragePool pool = storagePoolManager.getStoragePoolByURI(secondaryStorageUrl);
+        secondaryStorageUuids.add(pool.getUuid());
+        return pool;
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRevertSnapshotCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRevertSnapshotCommandWrapper.java
index 16c1a5a2fac1..507744fdc316 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRevertSnapshotCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRevertSnapshotCommandWrapper.java
@@ -28,6 +28,7 @@
 
 import com.cloud.agent.properties.AgentProperties;
 import com.cloud.agent.properties.AgentPropertiesFileHandler;
+import com.cloud.storage.Storage;
 import org.apache.cloudstack.storage.command.RevertSnapshotCommand;
 import org.apache.cloudstack.storage.to.PrimaryDataStoreTO;
 import org.apache.cloudstack.storage.to.SnapshotObjectTO;
@@ -58,6 +59,8 @@
 import org.apache.cloudstack.utils.qemu.QemuImgFile;
 import org.libvirt.LibvirtException;
 
+import static com.cloud.hypervisor.kvm.storage.KVMStorageProcessor.poolTypesToDeleteChainInfo;
+
 @ResourceWrapper(handles = RevertSnapshotCommand.class)
 public class LibvirtRevertSnapshotCommandWrapper extends CommandWrapper<RevertSnapshotCommand, Answer, LibvirtComputingResource> {
 
@@ -128,7 +131,7 @@ public Answer execute(final RevertSnapshotCommand command, final LibvirtComputin
                         return new Answer(command, false, result);
                     }
                 } else {
-                    revertVolumeToSnapshot(secondaryStoragePool, snapshotOnPrimaryStorage, snapshot, primaryPool, libvirtComputingResource);
+                    revertVolumeToSnapshot(secondaryStoragePool, snapshotOnPrimaryStorage, snapshot, primaryPool, libvirtComputingResource, command.isDeleteChain());
                 }
             }
 
@@ -161,7 +164,7 @@ protected String getFullPathAccordingToStorage(KVMStoragePool kvmStoragePool, St
      * Reverts the volume to the snapshot.
      */
     protected void revertVolumeToSnapshot(KVMStoragePool kvmStoragePoolSecondary, SnapshotObjectTO snapshotOnPrimaryStorage, SnapshotObjectTO snapshotOnSecondaryStorage,
-                                          KVMStoragePool kvmStoragePoolPrimary, LibvirtComputingResource resource) {
+                                          KVMStoragePool kvmStoragePoolPrimary, LibvirtComputingResource resource, boolean deleteChain) {
         VolumeObjectTO volumeObjectTo = snapshotOnSecondaryStorage.getVolume();
         String volumePath = getFullPathAccordingToStorage(kvmStoragePoolPrimary, volumeObjectTo.getPath());
 
@@ -178,6 +181,11 @@ protected void revertVolumeToSnapshot(KVMStoragePool kvmStoragePoolSecondary, Sn
 
         try {
             replaceVolumeWithSnapshot(volumePath, snapshotPath);
+            if (volumeObjectTo.getChainInfo() != null && poolTypesToDeleteChainInfo.contains(kvmStoragePoolPrimary.getType()) &&
+                    volumeObjectTo.getFormat() == Storage.ImageFormat.QCOW2 && deleteChain) {
+                logger.debug("Deleting leftover backup delta at [{}].", volumeObjectTo.getChainInfo());
+                kvmStoragePoolPrimary.deletePhysicalDisk(volumeObjectTo.getChainInfo(), volumeObjectTo.getFormat());
+            }
             logger.debug(String.format("Successfully reverted volume [%s] to snapshot [%s].", volumeObjectTo, snapshotToPrint));
         } catch (LibvirtException | QemuImgException ex) {
             throw new CloudRuntimeException(String.format("Unable to revert volume [%s] to snapshot [%s] due to [%s].", volumeObjectTo, snapshotToPrint, ex.getMessage()), ex);
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartCommandWrapper.java
index 567986465906..486989661909 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartCommandWrapper.java
@@ -21,13 +21,16 @@
 
 import java.io.File;
 import java.net.URISyntaxException;
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
 import java.util.stream.Collectors;
 
 import com.cloud.agent.resource.virtualnetwork.VRScripts;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
 import com.cloud.utils.FileUtil;
 import org.apache.cloudstack.storage.to.VolumeObjectTO;
+import org.apache.commons.collections4.CollectionUtils;
 import org.libvirt.Connect;
 import org.libvirt.DomainInfo.DomainState;
 import org.libvirt.LibvirtException;
@@ -64,7 +67,9 @@ public Answer execute(final StartCommand command, final LibvirtComputingResource
         final KVMStoragePoolManager storagePoolMgr = libvirtComputingResource.getStoragePoolMgr();
         final LibvirtUtilitiesHelper libvirtUtilitiesHelper = libvirtComputingResource.getLibvirtUtilitiesHelper();
         Connect conn = null;
+        List<KVMStoragePool> secondaryStorages = new ArrayList<>();
         try {
+            mountSecondaryStoragesIfNeeded(command, libvirtComputingResource, secondaryStorages);
 
             vm = libvirtComputingResource.createVMFromSpec(vmSpec);
             conn = libvirtUtilitiesHelper.getConnectionByType(vm.getHvsType());
@@ -167,6 +172,17 @@ public Answer execute(final StartCommand command, final LibvirtComputingResource
         } finally {
             if (state != DomainState.VIR_DOMAIN_RUNNING) {
                 storagePoolMgr.disconnectPhysicalDisksViaVmSpec(vmSpec);
+                for (KVMStoragePool secondaryStorage : secondaryStorages) {
+                    libvirtComputingResource.getStoragePoolMgr().deleteStoragePool(secondaryStorage.getType(), secondaryStorage.getUuid());
+                }
+            }
+        }
+    }
+
+    private void mountSecondaryStoragesIfNeeded(StartCommand command, LibvirtComputingResource libvirtComputingResource, List<KVMStoragePool> secondaryStorages) {
+        if (CollectionUtils.isNotEmpty(command.getSecondaryStorages())) {
+            for (String secondaryStorageUrl : command.getSecondaryStorages()) {
+                secondaryStorages.add(libvirtComputingResource.getStoragePoolMgr().getStoragePoolByURI(secondaryStorageUrl));
             }
         }
     }
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtTakeBackupCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtTakeBackupCommandWrapper.java
index 42953aa9f835..106fe31a0f18 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtTakeBackupCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtTakeBackupCommandWrapper.java
@@ -42,6 +42,16 @@
 @ResourceWrapper(handles = TakeBackupCommand.class)
 public class LibvirtTakeBackupCommandWrapper extends CommandWrapper<TakeBackupCommand, Answer, LibvirtComputingResource> {
     private static final Integer EXIT_CLEANUP_FAILED = 20;
+    // nasbackup.sh prints this on stdout when it could not proceed as an incremental and
+    // completed a full backup instead; the orchestrator then records the backup as a full.
+    private static final String INCREMENTAL_FALLBACK_MARKER = "INCREMENTAL_FALLBACK=true";
+
+    private static final String MODE_FULL = "full";
+    private static final String MODE_INCREMENTAL = "incremental";
+    // Incremental feature disabled: plain full backup with no QEMU bitmap/checkpoint and no
+    // chain metadata. Matches nasbackup.sh's "legacy-full" mode (make_checkpoint=0).
+    private static final String MODE_LEGACY_FULL = "legacy-full";
+
     @Override
     public Answer execute(TakeBackupCommand command, LibvirtComputingResource libvirtComputingResource) {
         final String vmName = command.getVmName();
@@ -54,6 +64,13 @@ public Answer execute(TakeBackupCommand command, LibvirtComputingResource libvir
         KVMStoragePoolManager storagePoolMgr = libvirtComputingResource.getStoragePoolMgr();
         int timeout = command.getWait() > 0 ? command.getWait() * 1000 : libvirtComputingResource.getCmdsTimeout();
 
+        // Pre-validate incremental args here rather than relying on the script to error out.
+        // Keeps the script agnostic to caller policy (it just does what it's told).
+        String validationError = validateBackupArgs(command);
+        if (validationError != null) {
+            return new BackupAnswer(command, false, validationError);
+        }
+
         List<String> diskPaths = new ArrayList<>();
         if (Objects.nonNull(volumePaths)) {
             for (int idx = 0; idx < volumePaths.size(); idx++) {
@@ -69,8 +86,63 @@ public Answer execute(TakeBackupCommand command, LibvirtComputingResource libvir
             }
         }
 
-        List<String[]> commands = new ArrayList<>();
-        commands.add(new String[]{
+        Pair<Integer, String> result = runBackupScript(libvirtComputingResource, command, vmName, backupRepoType, backupRepoAddress,
+                mountOptions, backupPath, diskPaths, command.getMode(),
+                command.getBitmapNew(), command.getBitmapParent(), command.getParentPaths(), timeout);
+
+        if (result.first() != 0) {
+            logger.debug("Failed to take VM backup: " + result.second());
+            BackupAnswer answer = new BackupAnswer(command, false, result.second().trim());
+            if (EXIT_CLEANUP_FAILED.equals(result.first())) {
+                logger.debug("Backup cleanup failed");
+                answer.setNeedsCleanup(true);
+            }
+            return answer;
+        }
+
+        // The script self-heals to a full backup when an incremental can't proceed (e.g. the
+        // parent checkpoint can't be re-registered) and signals it with INCREMENTAL_FALLBACK
+        // on stdout. Detect it, then strip the marker line before parsing the backup size.
+        String rawStdout = result.second();
+        boolean incrementalFallback = rawStdout.contains(INCREMENTAL_FALLBACK_MARKER);
+        String stdout = stripMarkerLines(rawStdout).trim();
+        long backupSize = parseBackupSize(stdout, diskPaths);
+
+        BackupAnswer answer = new BackupAnswer(command, true, stdout);
+        answer.setSize(backupSize);
+        // A successful run always created command.getBitmapNew() (full and incremental both do;
+        // it is null for legacy-full, which the orchestrator treats as "no bitmap").
+        answer.setBitmapCreated(command.getBitmapNew());
+        answer.setIncrementalFallback(incrementalFallback);
+        return answer;
+    }
+
+    /** Remove nasbackup.sh's stdout signalling marker lines so they don't pollute size parsing. */
+    private String stripMarkerLines(String stdout) {
+        if (stdout == null || stdout.isEmpty()) {
+            return "";
+        }
+        StringBuilder sb = new StringBuilder();
+        for (String line : stdout.split("\n", -1)) {
+            if (line.contains(INCREMENTAL_FALLBACK_MARKER)) {
+                continue;
+            }
+            if (sb.length() > 0) {
+                sb.append('\n');
+            }
+            sb.append(line);
+        }
+        return sb.toString();
+    }
+
+    /**
+     * Run nasbackup.sh once with the given args. Returns the exit code + captured stdout.
+     */
+    private Pair<Integer, String> runBackupScript(LibvirtComputingResource libvirtComputingResource,
+            TakeBackupCommand command, String vmName, String backupRepoType, String backupRepoAddress,
+            String mountOptions, String backupPath, List<String> diskPaths, String mode,
+            String bitmapNew, String bitmapParent, List<String> parentPaths, int timeout) {
+        List<String> argv = new ArrayList<>(Arrays.asList(
                 libvirtComputingResource.getNasBackupPath(),
                 "-o", "backup",
                 "-v", vmName,
@@ -80,35 +152,79 @@ public Answer execute(TakeBackupCommand command, LibvirtComputingResource libvir
                 "-p", backupPath,
                 "-q", command.getQuiesce() != null && command.getQuiesce() ? "true" : "false",
                 "-d", diskPaths.isEmpty() ? "" : String.join(",", diskPaths)
-        });
+        ));
+        if (mode != null && !mode.isEmpty()) {
+            argv.add("-M");
+            argv.add(mode);
+        }
+        if (bitmapNew != null && !bitmapNew.isEmpty()) {
+            argv.add("--bitmap-new");
+            argv.add(bitmapNew);
+        }
+        if (bitmapParent != null && !bitmapParent.isEmpty()) {
+            argv.add("--bitmap-parent");
+            argv.add(bitmapParent);
+        }
+        if (parentPaths != null && !parentPaths.isEmpty()) {
+            argv.add("--parent-paths");
+            argv.add(String.join(",", parentPaths));
+        }
 
-        Pair<Integer, String> result = Script.executePipedCommands(commands, timeout);
+        List<String[]> commands = new ArrayList<>();
+        commands.add(argv.toArray(new String[0]));
+        return Script.executePipedCommands(commands, timeout);
+    }
 
-        if (result.first() != 0) {
-            logger.debug("Failed to take VM backup: " + result.second());
-            BackupAnswer answer = new BackupAnswer(command, false, result.second().trim());
-            if (result.first() == EXIT_CLEANUP_FAILED) {
-                logger.debug("Backup cleanup failed");
-                answer.setNeedsCleanup(true);
+    /**
+     * Return a human-readable validation error string, or {@code null} if the command's
+     * incremental-backup args are internally consistent.
+     */
+    private String validateBackupArgs(TakeBackupCommand command) {
+        String mode = command.getMode();
+        if (mode == null || mode.isEmpty()) {
+            return null; // legacy full-only — no extra args expected
+        }
+        if (MODE_INCREMENTAL.equals(mode)) {
+            if (command.getBitmapNew() == null || command.getBitmapNew().isEmpty()) {
+                return "incremental mode requires bitmapNew";
             }
-            return answer;
+            if (command.getBitmapParent() == null || command.getBitmapParent().isEmpty()) {
+                return "incremental mode requires bitmapParent";
+            }
+            if (command.getParentPaths() == null || command.getParentPaths().isEmpty()) {
+                return "incremental mode requires parentPaths";
+            }
+            return null;
+        }
+        if (MODE_FULL.equals(mode)) {
+            if (command.getBitmapNew() == null || command.getBitmapNew().isEmpty()) {
+                return "full mode requires bitmapNew (the bitmap to create for the next incremental)";
+            }
+            return null;
+        }
+        if (MODE_LEGACY_FULL.equals(mode)) {
+            return null; // feature-off full backup — no bitmap or chain args expected
         }
+        return "Unknown backup mode: " + mode;
+    }
 
+    /**
+     * Sum the per-disk size lines emitted by nasbackup.sh. Single-volume mode emits one
+     * line containing just the byte count; multi-volume mode emits one line per disk
+     * whose first whitespace-separated token is the byte count.
+     */
+    private long parseBackupSize(String stdout, List<String> diskPaths) {
         long backupSize = 0L;
         if (CollectionUtils.isNullOrEmpty(diskPaths)) {
-            List<String> outputLines = Arrays.asList(result.second().trim().split("\n"));
+            List<String> outputLines = Arrays.asList(stdout.split("\n"));
             if (!outputLines.isEmpty()) {
                 backupSize = Long.parseLong(outputLines.get(outputLines.size() - 1).trim());
             }
         } else {
-            String[] outputLines = result.second().trim().split("\n");
-            for(String line : outputLines) {
+            for (String line : stdout.split("\n")) {
                 backupSize = backupSize + Long.parseLong(line.split(" ")[0].trim());
             }
         }
-
-        BackupAnswer answer = new BackupAnswer(command, true, result.second().trim());
-        answer.setSize(backupSize);
-        return answer;
+        return backupSize;
     }
 }
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtTakeBackupHashCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtTakeBackupHashCommandWrapper.java
new file mode 100644
index 000000000000..64669b3b4b5c
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtTakeBackupHashCommandWrapper.java
@@ -0,0 +1,72 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.dynatrace.hash4j.hashing.HashStream128;
+import com.dynatrace.hash4j.hashing.HashValue128;
+import com.dynatrace.hash4j.hashing.Hashing;
+import org.apache.cloudstack.backup.TakeBackupHashCommand;
+import org.apache.cloudstack.storage.to.BackupDeltaTO;
+
+import java.io.BufferedInputStream;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.io.InputStream;
+
+@ResourceWrapper(handles = TakeBackupHashCommand.class)
+public class LibvirtTakeBackupHashCommandWrapper extends CommandWrapper<TakeBackupHashCommand, Answer, LibvirtComputingResource> {
+
+    @Override
+    public Answer execute(TakeBackupHashCommand command, LibvirtComputingResource resource) {
+        String backupUuid = command.getBackupUuid();
+        logger.info("Taking hash of backup [{}].", backupUuid);
+
+        KVMStoragePoolManager storagePoolManager = resource.getStoragePoolMgr();
+        KVMStoragePool imagePool = null;
+        try {
+            imagePool = storagePoolManager.getStoragePoolByURI(command.getBackupDeltaTOList().get(0).getDataStore().getUrl());
+            HashStream128 hashStream128 = Hashing.xxh3_128().hashStream();
+            for (BackupDeltaTO backupDelta : command.getBackupDeltaTOList()) {
+                try (InputStream is = new BufferedInputStream(new FileInputStream(imagePool.getLocalPathFor(backupDelta.getPath())))) {
+                    byte[] buffer = new byte[8192];
+                    int bytesRead;
+                    while ((bytesRead = is.read(buffer)) != -1) {
+                        hashStream128.putBytes(buffer, 0, bytesRead);
+                    }
+                } catch (IOException e) {
+                    throw new CloudRuntimeException(e);
+                }
+            }
+            HashValue128 hash = hashStream128.get();
+            String hashString = hash.toString();
+            logger.info("The xxHash128 of backup [{}] is [{}].", backupUuid, hashString);
+            return new Answer(command, true, hashString);
+        } finally {
+            if (imagePool != null) {
+                storagePoolManager.deleteStoragePool(imagePool.getType(), imagePool.getUuid());
+            }
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtTakeKbossBackupCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtTakeKbossBackupCommandWrapper.java
new file mode 100644
index 000000000000..d2332f4f99b1
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtTakeKbossBackupCommandWrapper.java
@@ -0,0 +1,393 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.utils.Pair;
+import com.cloud.utils.exception.BackupException;
+import org.apache.cloudstack.backup.TakeKbossBackupAnswer;
+import org.apache.cloudstack.backup.TakeKbossBackupCommand;
+import org.apache.cloudstack.storage.to.BackupDeltaTO;
+import org.apache.cloudstack.storage.to.DeltaMergeTreeTO;
+import org.apache.cloudstack.storage.to.KbossTO;
+import org.apache.cloudstack.storage.to.PrimaryDataStoreTO;
+import org.apache.cloudstack.storage.to.VolumeObjectTO;
+import org.apache.cloudstack.utils.qemu.QemuImageOptions;
+import org.apache.cloudstack.utils.qemu.QemuImg;
+import org.apache.cloudstack.utils.qemu.QemuImgException;
+import org.apache.cloudstack.utils.qemu.QemuImgFile;
+import org.apache.commons.collections4.CollectionUtils;
+import org.libvirt.LibvirtException;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+import java.util.concurrent.TimeoutException;
+import java.util.stream.Collectors;
+
+@ResourceWrapper(handles = TakeKbossBackupCommand.class)
+public class LibvirtTakeKbossBackupCommandWrapper extends CommandWrapper<TakeKbossBackupCommand, Answer, LibvirtComputingResource> {
+    @Override
+    public Answer execute(TakeKbossBackupCommand command, LibvirtComputingResource resource) {
+        String vmName = command.getVmName();
+        logger.info("Starting backup process for VM [{}].", vmName);
+        List<KbossTO> kbossTOS = command.getKbossTOs();
+        List<Pair<VolumeObjectTO, String>> volumeTosAndNewPaths =
+                kbossTOS.stream().map(kbossTO -> new Pair<>(kbossTO.getVolumeObjectTO(), kbossTO.getDeltaPathOnPrimary())).collect(Collectors.toList());
+
+        Map<String, Pair<String, Long>> mapVolumeUuidToDeltaPathOnSecondaryAndDeltaSize = new HashMap<>();
+        Map<String, String> mapVolumeUuidToNewVolumePath = new HashMap<>();
+
+        KVMStoragePoolManager storagePoolManager = resource.getStoragePoolMgr();
+        boolean runningVM = command.isRunningVM();
+
+        try {
+            if (runningVM) {
+                resource.createDiskOnlyVmSnapshotForRunningVm(volumeTosAndNewPaths, vmName, UUID.randomUUID().toString(), command.isQuiesceVm());
+            } else {
+                resource.createDiskOnlyVMSnapshotOfStoppedVm(volumeTosAndNewPaths, vmName);
+            }
+
+            backupVolumes(command, resource, storagePoolManager, kbossTOS, volumeTosAndNewPaths, vmName, runningVM, mapVolumeUuidToDeltaPathOnSecondaryAndDeltaSize);
+
+            cleanupVm(command, resource, kbossTOS, vmName, runningVM, mapVolumeUuidToNewVolumePath);
+        } catch (BackupException ex) {
+            return new TakeKbossBackupAnswer(command, ex);
+        }
+
+        return new TakeKbossBackupAnswer(command, true, mapVolumeUuidToNewVolumePath, mapVolumeUuidToDeltaPathOnSecondaryAndDeltaSize);
+    }
+
+    /**
+     * Backup (copy) volumes to secondary storage. Will also populate the mapVolumeUuidToDeltaPathOnSecondaryAndDeltaSize argument.
+     * The timeout for this method is guided by the wait time for the given command, if the wait time is bigger than 24 days, there will be an overflow on the timeout.
+     * <br/>
+     * If an exception is caught while copying the volumes, will try to recover the VM to the previous state so that it is consistent.
+     * */
+    protected void backupVolumes(TakeKbossBackupCommand command, LibvirtComputingResource resource, KVMStoragePoolManager storagePoolManager, List<KbossTO> kbossTOS,
+            List<Pair<VolumeObjectTO, String>> volumeTosAndNewPaths, String vmName, boolean runningVM,
+            Map<String, Pair<String, Long>> mapVolumeUuidToDeltaPathOnSecondaryAndDeltaSize) {
+        try {
+            int maxWaitInMillis = command.getWait() * 1000;
+            for (KbossTO kbossTO : kbossTOS) {
+                long startTimeMillis = System.currentTimeMillis();
+                VolumeObjectTO volumeObjectTO = kbossTO.getVolumeObjectTO();
+                String volumeUuid = volumeObjectTO.getUuid();
+
+                logger.debug("Backing up volume [{}].", volumeUuid);
+                Pair<String, Long> deltaPathOnSecondaryAndSize = copyBackupDeltaToSecondary(storagePoolManager, kbossTO, command.getBackupChainImageStoreUrls(),
+                        command.getImageStoreUrl(), maxWaitInMillis);
+
+                mapVolumeUuidToDeltaPathOnSecondaryAndDeltaSize.put(volumeUuid, deltaPathOnSecondaryAndSize);
+                maxWaitInMillis = calculateRemainingTime(maxWaitInMillis, startTimeMillis);
+            }
+        } catch (Exception ex) {
+            logger.error("There has been an exception during the backup creation process. We will try to revert the VM [{}] to its previous state. The exception is: {}", vmName,
+                    ex.getMessage(), ex);
+            recoverPreviousVmStateAndDeletePartialBackup(resource, volumeTosAndNewPaths, vmName, runningVM, mapVolumeUuidToDeltaPathOnSecondaryAndDeltaSize, storagePoolManager,
+                    command.getImageStoreUrl());
+
+            throw new BackupException(String.format("There was an exception during the backup process for VM [%s], but the VM has been successfully normalized.", vmName), ex,
+                    true);
+        }
+    }
+
+    protected int calculateRemainingTime(int maxWaitInMillis, long startTimeMillis) throws TimeoutException {
+        maxWaitInMillis -= (int)(System.currentTimeMillis() - startTimeMillis);
+        if (maxWaitInMillis < 0) {
+            throw new TimeoutException("Timeout while converting backups to secondary storage.");
+        }
+        return maxWaitInMillis;
+    }
+
+    /**
+     * For each KbossTO, will merge its DeltaMergeTreeTO (if it exists). Also, if this is the end of the chain, will also end the chain for the volume.
+     * Will populate the mapVolumeUuidToNewVolumePath argument.
+     * */
+    protected void cleanupVm(TakeKbossBackupCommand command, LibvirtComputingResource resource, List<KbossTO> kbossTOS, String vmName, boolean runningVM,
+            Map<String, String> mapVolumeUuidToNewVolumePath) {
+        for (KbossTO kbossTO : kbossTOS) {
+            VolumeObjectTO volumeObjectTO = kbossTO.getVolumeObjectTO();
+            String currentVolumePath = volumeObjectTO.getPath();
+            String volumeUuid = volumeObjectTO.getUuid();
+            DeltaMergeTreeTO deltaMergeTreeTO = kbossTO.getDeltaMergeTreeTO();
+            volumeObjectTO.setPath(kbossTO.getDeltaPathOnPrimary());
+
+            if (deltaMergeTreeTO != null) {
+                List<String> snapshotDataStoreVos = kbossTO.getVmSnapshotDeltaPaths();
+                mergeBackupDelta(resource, deltaMergeTreeTO, volumeObjectTO, vmName, runningVM, volumeUuid, snapshotDataStoreVos.isEmpty());
+            }
+
+            if (command.isEndChain() || command.isIsolated()) {
+                String baseVolumePath = currentVolumePath;
+                if (deltaMergeTreeTO != null && deltaMergeTreeTO.getChild().getPath().equals(baseVolumePath)) {
+                    baseVolumePath = deltaMergeTreeTO.getParent().getPath();
+                }
+                endChainForVolume(resource, volumeObjectTO, vmName, runningVM, volumeUuid, baseVolumePath);
+                mapVolumeUuidToNewVolumePath.put(volumeUuid, baseVolumePath);
+            } else {
+                mapVolumeUuidToNewVolumePath.put(volumeUuid, kbossTO.getDeltaPathOnPrimary());
+            }
+        }
+    }
+
+    /**
+     * Copy the backup delta to the secondary storage. Since we created a snapshot on top of the volume, the volume is now the backup delta.
+     * If there were snapshots created after the last backup, they'll be copied alongside and merged in the secondary storage.
+     * */
+    protected Pair<String, Long> copyBackupDeltaToSecondary(KVMStoragePoolManager storagePoolManager, KbossTO kbossTO, List<String> chainImageStoreUrls, String imageStoreUrl,
+            int waitInMillis) {
+        VolumeObjectTO delta = kbossTO.getVolumeObjectTO();
+        String parentDeltaPathOnSecondary = kbossTO.getPathBackupParentOnSecondary();
+        List<String> deltaPathsToCopy = CollectionUtils.isEmpty(kbossTO.getVmSnapshotDeltaPaths()) ? new ArrayList<>() : new ArrayList<>(kbossTO.getVmSnapshotDeltaPaths());
+        deltaPathsToCopy.add(delta.getPath());
+
+        KVMStoragePool parentImagePool = null;
+        List<KVMStoragePool> chainImagePools = null;
+        KVMStoragePool imagePool = null;
+        long backupSize;
+        final String backupOnSecondary = kbossTO.getDeltaPathOnSecondary();
+        ArrayList<String> temporaryDeltasToRemove = new ArrayList<>();
+        boolean result = false;
+        try {
+            imagePool = storagePoolManager.getStoragePoolByURI(imageStoreUrl);
+            if (chainImageStoreUrls != null) {
+                parentImagePool = storagePoolManager.getStoragePoolByURI(chainImageStoreUrls.get(0));
+                chainImagePools = chainImageStoreUrls.subList(1, chainImageStoreUrls.size()).stream().map(storagePoolManager::getStoragePoolByURI).collect(Collectors.toList());
+            }
+
+            PrimaryDataStoreTO primaryDataStoreTO = (PrimaryDataStoreTO) delta.getDataStore();
+            KVMStoragePool primaryPool = storagePoolManager.getStoragePool(primaryDataStoreTO.getPoolType(), primaryDataStoreTO.getUuid());
+
+            String topDelta = backupOnSecondary;
+            while (!deltaPathsToCopy.isEmpty()) {
+                String backupDeltaFullPathOnSecondary = imagePool.getLocalPathFor(topDelta);
+                temporaryDeltasToRemove.add(backupDeltaFullPathOnSecondary);
+                String parentBackupFullPath = null;
+
+                if (parentDeltaPathOnSecondary != null) {
+                    parentBackupFullPath = parentImagePool.getLocalPathFor(parentDeltaPathOnSecondary);
+                }
+
+                String backupDeltaFullPathOnPrimary = primaryPool.getLocalPathFor(deltaPathsToCopy.remove(0));
+                convertDeltaToSecondary(backupDeltaFullPathOnPrimary, backupDeltaFullPathOnSecondary, parentBackupFullPath, delta.getUuid(), waitInMillis);
+
+                if (!deltaPathsToCopy.isEmpty()) {
+                    parentDeltaPathOnSecondary = topDelta;
+                    topDelta = getRelativePathOnSecondaryForBackup(delta.getAccountId(), delta.getVolumeId(), UUID.randomUUID().toString());
+                    parentImagePool = imagePool;
+                }
+            }
+
+            String backupOnSecondaryFullPath = imagePool.getLocalPathFor(backupOnSecondary);
+
+            commitTopDeltaOnBaseBackupOnSecondaryIfNeeded(topDelta, backupOnSecondary, imagePool, backupOnSecondaryFullPath, waitInMillis);
+
+            backupSize = Files.size(Path.of(backupOnSecondaryFullPath));
+            result = true;
+        } catch (LibvirtException | QemuImgException | IOException e) {
+            logger.error("Exception while converting backup [{}] to secondary storage [{}] due to: [{}].", delta.getPath(), imagePool, e.getMessage(), e);
+            throw new BackupException("Exception while converting backup to secondary storage.", e, true);
+        } finally {
+            removeTemporaryDeltas(temporaryDeltasToRemove, result);
+
+            if (parentImagePool != null) {
+                storagePoolManager.deleteStoragePool(parentImagePool.getType(), parentImagePool.getUuid());
+            }
+            if (chainImagePools != null) {
+                chainImagePools.forEach(pool -> storagePoolManager.deleteStoragePool(pool.getType(), pool.getUuid()));
+            }
+            if (imagePool != null) {
+                storagePoolManager.deleteStoragePool(imagePool.getType(), imagePool.getUuid());
+            }
+        }
+        return new Pair<>(backupOnSecondary, backupSize);
+    }
+
+    /**
+     * If there were VM snapshots created after the last backup, we will have copied them alongside the backup delta. If this is the case, we will commit all of them into a single
+     * base file so that we are left with one file per volume per backup.
+     * */
+    protected void commitTopDeltaOnBaseBackupOnSecondaryIfNeeded(String topDelta, String backupOnSecondary, KVMStoragePool imagePool, String backupOnSecondaryFullPath,
+            int waitInMillis) throws LibvirtException, QemuImgException {
+        if (topDelta.equals(backupOnSecondary)) {
+            return;
+        }
+
+        QemuImg qemuImg = new QemuImg(waitInMillis);
+        QemuImgFile topDeltaImg = new QemuImgFile(imagePool.getLocalPathFor(topDelta), QemuImg.PhysicalDiskFormat.QCOW2);
+        QemuImgFile baseDeltaImg = new QemuImgFile(backupOnSecondaryFullPath, QemuImg.PhysicalDiskFormat.QCOW2);
+
+        logger.debug("Committing top delta [{}] on base delta [{}].", topDeltaImg, baseDeltaImg);
+        qemuImg.commit(topDeltaImg, baseDeltaImg, true);
+    }
+
+    /**
+     * Will remove any temporary deltas created on secondary storage. If result is true, this means that the backup was a success and the first "temporary delta" is our backup, so
+     * it will not be removed.
+     * <br/>
+     * There are two uses for this method:<br/>
+     * - If we fail to backup we have to clean up the secondary storage.<br/>
+     * - If we had VM snapshots created after the last backup, we copied multiple files to secondary storage, and thus we have to clean them up after merging them.
+     * */
+    protected void removeTemporaryDeltas(List<String> temporaryDeltasToRemove, boolean result) {
+        if (result) {
+            temporaryDeltasToRemove.remove(0);
+        }
+        logger.debug("Removing temporary deltas {}.", temporaryDeltasToRemove);
+        for (String delta : temporaryDeltasToRemove) {
+            try {
+                Files.deleteIfExists(Path.of(delta));
+            } catch (IOException ex) {
+                logger.error("Failed to remove temporary delta [{}]. Will not stop the backup process, but this should be investigated.", delta, ex);
+            }
+        }
+    }
+
+    /**
+     * Converts a delta from primary storage to secondary storage, if a parent was given, will set it as the backing file for the delta being copied.
+     *
+     * @param pathDeltaOnPrimary absolute path of the delta to be copied.
+     * @param pathDeltaOnSecondary absolute path of the destination of the delta to be copied.
+     * @param pathParentOnSecondary absolute path of the parent delta, if it exists.
+     * @param volumeUuid volume uuid, used for logging.
+     * @param waitInMillis timeout in milliseconds.
+     * */
+    protected void convertDeltaToSecondary(String pathDeltaOnPrimary, String pathDeltaOnSecondary, String pathParentOnSecondary, String volumeUuid, int waitInMillis)
+            throws QemuImgException, LibvirtException {
+        QemuImgFile backupDestination = new QemuImgFile(pathDeltaOnSecondary, QemuImg.PhysicalDiskFormat.QCOW2);
+        QemuImgFile backupOrigin = new QemuImgFile(pathDeltaOnPrimary, QemuImg.PhysicalDiskFormat.QCOW2);
+        QemuImgFile parentBackup = null;
+
+        if (pathParentOnSecondary != null) {
+            parentBackup = new QemuImgFile(pathParentOnSecondary, QemuImg.PhysicalDiskFormat.QCOW2);
+        }
+
+        logger.debug("Converting delta [{}] to [{}] with {}", backupOrigin, backupDestination, parentBackup == null ? "no parent." : String.format("parent [%s].", parentBackup));
+
+        createDirsIfNeeded(pathDeltaOnSecondary, volumeUuid);
+
+        QemuImg qemuImg = new QemuImg(waitInMillis);
+        qemuImg.convert(backupOrigin, backupDestination, parentBackup, null, null,  new QemuImageOptions(backupOrigin.getFormat(), backupOrigin.getFileName(), null), null,
+                true, false, false, false, null, null);
+    }
+
+
+    protected void endChainForVolume(LibvirtComputingResource resource, VolumeObjectTO volumeObjectTO, String vmName, boolean isVmRunning, String volumeUuid, String baseVolumePath)
+            throws BackupException {
+
+        BackupDeltaTO baseVolume = new BackupDeltaTO(volumeObjectTO.getDataStore(), Hypervisor.HypervisorType.KVM, baseVolumePath);
+        DeltaMergeTreeTO deltaMergeTreeTO = new DeltaMergeTreeTO(volumeObjectTO, baseVolume, volumeObjectTO, new ArrayList<>());
+
+        logger.debug("Ending backup chain for volume [{}], the next backup will be a full backup.", volumeObjectTO.getUuid());
+
+        mergeBackupDelta(resource, deltaMergeTreeTO, volumeObjectTO, vmName, isVmRunning, volumeUuid, false);
+    }
+
+    /**
+     * Tries to recover the previous state of the VM. Should only be called if an exception in the backup creation process happened.<br/>
+     * For each volume, will:<br/>
+     *  - Merge back any backup deltas created;
+     *  - Remove the data backed up to the secondary storage;
+     * */
+    protected void recoverPreviousVmStateAndDeletePartialBackup(LibvirtComputingResource resource, List<Pair<VolumeObjectTO, String>> volumeTosAndNewPaths, String vmName,
+            boolean runningVm, Map<String, Pair<String, Long>> mapVolumeUuidToDeltaPathOnSecondaryAndSize, KVMStoragePoolManager storagePoolManager, String imageStoreUrl) {
+        for (Pair<VolumeObjectTO, String> volumeObjectTOAndNewPath : volumeTosAndNewPaths) {
+            VolumeObjectTO volumeObjectTO = volumeObjectTOAndNewPath.first();
+            String volumeUuid = volumeObjectTO.getUuid();
+
+            BackupDeltaTO oldDelta = new BackupDeltaTO(volumeObjectTO.getDataStore(), Hypervisor.HypervisorType.KVM, volumeObjectTO.getPath());
+            volumeObjectTO.setPath(volumeObjectTOAndNewPath.second());
+            DeltaMergeTreeTO deltaMergeTreeTO = new DeltaMergeTreeTO(volumeObjectTO, oldDelta, volumeObjectTO, new ArrayList<>());
+
+            mergeBackupDelta(resource, deltaMergeTreeTO, volumeObjectTO, vmName, runningVm, volumeUuid, false);
+
+            Pair<String, Long> deltaPathOnSecondaryAndSize = mapVolumeUuidToDeltaPathOnSecondaryAndSize.get(volumeUuid);
+            if (deltaPathOnSecondaryAndSize == null) {
+                continue;
+            }
+
+            cleanupDeltaOnSecondary(storagePoolManager, imageStoreUrl, deltaPathOnSecondaryAndSize.first());
+        }
+    }
+
+    protected void cleanupDeltaOnSecondary(KVMStoragePoolManager storagePoolManager, String imageStoreUrl, String deltaPath) {
+        KVMStoragePool imagePool = null;
+
+        try {
+            imagePool = storagePoolManager.getStoragePoolByURI(imageStoreUrl);
+            String fullDeltaPath = imagePool.getLocalPathFor(deltaPath);
+
+            logger.debug("Cleaning up delta at [{}] as part of the post backup error normalization effort.", fullDeltaPath);
+
+            Files.deleteIfExists(Path.of(fullDeltaPath));
+        } catch (IOException e) {
+            logger.error("Exception while trying to cleanup delta at [{}].", deltaPath, e);
+        } finally {
+            if (imagePool != null) {
+                storagePoolManager.deleteStoragePool(imagePool.getType(), imagePool.getUuid());
+            }
+        }
+    }
+
+
+    protected void mergeBackupDelta(LibvirtComputingResource resource, DeltaMergeTreeTO deltaMergeTreeTO, VolumeObjectTO volumeObjectTO, String vmName, boolean isVmRunning,
+            String volumeUuid, boolean countNewestDeltaAsGrandchild) throws BackupException {
+        try {
+            if (isVmRunning) {
+                resource.mergeDeltaForRunningVm(deltaMergeTreeTO, vmName, volumeObjectTO);
+            } else {
+                if (countNewestDeltaAsGrandchild) {
+                    deltaMergeTreeTO.addGrandChild(volumeObjectTO);
+                }
+                resource.mergeDeltaForStoppedVm(deltaMergeTreeTO);
+            }
+        } catch (LibvirtException | QemuImgException | IOException e) {
+            logger.error("Exception while merging the last backup delta using delta merge tree [{}] for VM [{}] and volume [{}].", deltaMergeTreeTO, vmName, volumeUuid, e);
+            throw new BackupException(String.format("Exception during backup wrap-up phase for VM [%s].", vmName), e, false);
+        }
+    }
+
+    protected String getRelativePathOnSecondaryForBackup(long accountId, long volumeId, String backupPath) {
+        return String.format("%s%s%s%s%s%s%s", "backups", File.separator, accountId, File.separator, volumeId, File.separator, backupPath);
+    }
+
+    protected void createDirsIfNeeded(String deltaFullPath, String volumeUuid) {
+        String dirs = deltaFullPath.substring(0, deltaFullPath.lastIndexOf(File.separator));
+        try {
+            Files.createDirectories(Path.of(dirs));
+        } catch (IOException e) {
+            throw new BackupException(String.format("Error while creating directories for backup of volume [%s].", volumeUuid), e, true);
+        }
+    }
+
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtValidateKbossVmCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtValidateKbossVmCommandWrapper.java
new file mode 100644
index 000000000000..eec68cd464e3
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtValidateKbossVmCommandWrapper.java
@@ -0,0 +1,225 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.to.VirtualMachineTO;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.utils.DateUtil;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.utils.script.Script;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+import com.google.json.JsonSanitizer;
+import org.apache.cloudstack.backup.ValidateKbossVmAnswer;
+import org.apache.cloudstack.backup.ValidateKbossVmCommand;
+import org.libvirt.Domain;
+import org.libvirt.LibvirtException;
+
+import javax.imageio.ImageIO;
+import java.awt.image.BufferedImage;
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Random;
+
+@ResourceWrapper(handles =  ValidateKbossVmCommand.class)
+public class LibvirtValidateKbossVmCommandWrapper extends CommandWrapper<ValidateKbossVmCommand, Answer, LibvirtComputingResource> {
+
+    private static final String SCREENSHOT_COMMAND = "virsh screenshot --domain %s --file %s";
+    private static final String GUEST_SYNC_COMMAND = "{\"execute\": \"guest-sync\", \"arguments\":{\"id\":%s}}";
+    private static final String GUEST_EXEC_COMMAND = "{\"execute\": \"guest-exec\", \"arguments\":{\"path\":\"%s\",\"arg\":%s,\"capture-output\":true}}";
+    private static final String GUEST_EXEC_STATUS_COMMAND = "{\"execute\": \"guest-exec-status\", \"arguments\":{\"pid\":%s}}";
+
+    @Override
+    public Answer execute(ValidateKbossVmCommand command, LibvirtComputingResource serverResource) {
+        VirtualMachineTO vmTo = command.getVm();
+        KVMStoragePool secondaryStorage = null;
+        KVMStoragePoolManager storagePoolMgr = serverResource.getStoragePoolMgr();
+        try {
+            Domain vm = serverResource.getDomain(serverResource.getLibvirtUtilitiesHelper().getConnection(), vmTo.getName());
+            secondaryStorage = storagePoolMgr.getStoragePoolByURI(command.getBackupDeltaTO().getDataStore().getUrl());
+            logger.info("Validating VM [{}].", vm.getName());
+            boolean bootValidated = waitForBoot(command, vm);
+            String screenshotPath = takeScreenshot(command, vm, secondaryStorage);
+            String scriptResult = runScript(command, vm);
+            return new  ValidateKbossVmAnswer(command, bootValidated, screenshotPath, scriptResult);
+        } catch (LibvirtException e) {
+            logger.error("Received Libvirt exception while trying to validate VM [{}].", vmTo.getName(), e);
+            return new Answer(command, e);
+        } finally {
+            if (secondaryStorage != null) {
+                storagePoolMgr.deleteStoragePool(secondaryStorage.getType(), secondaryStorage.getUuid());
+            }
+        }
+    }
+
+    private boolean waitForBoot(ValidateKbossVmCommand cmd, Domain vm) throws LibvirtException {
+        if (!cmd.isWaitForBoot()) {
+            return false;
+        }
+        Random random = new Random();
+        Integer bootTimeout = cmd.getBootTimeout();
+        logger.debug("Waiting for validation VM [{}] to boot. We will wait for [{}] seconds at most.", vm.getName(), bootTimeout);
+        while (bootTimeout > 0) {
+            bootTimeout -= 5;
+            int randomInt = random.nextInt();
+            try {
+                String result = vm.qemuAgentCommand(String.format(GUEST_SYNC_COMMAND, randomInt), 1, 0);
+                if (result.contains(String.valueOf(randomInt))) {
+                    logger.info("Validation VM [{}] has booted.", vm.getName());
+                    return true;
+                }
+            } catch (LibvirtException ex) {
+                if (!ex.getMessage().contains(LibvirtComputingResource.AGENT_IS_NOT_CONNECTED)) {
+                    logger.error("Got an unexpected Libvirt Exception, giving up on validating VM [{}].", vm.getName(), ex);
+                    throw ex;
+                }
+            }
+            try {
+                Thread.sleep(5 * 1000L);
+            } catch (InterruptedException e) {
+                logger.debug("Got interrupted while waiting for VM [{}] to boot. Ignoring.", vm.getName());
+            }
+        }
+        logger.debug("Boot wait timed out for VM [{}].", vm.getName());
+        return false;
+    }
+
+    private String takeScreenshot(ValidateKbossVmCommand command, Domain vm, KVMStoragePool secondaryStorage) throws LibvirtException {
+        if (!command.isTakeScreenshot()) {
+            return null;
+        }
+        String vmName = vm.getName();
+        try {
+            logger.info("Waiting [{}] seconds to take screenshot of validation VM [{}].", command.getScreenshotWait(), vm.getName());
+            Thread.sleep(command.getScreenshotWait() * 1000L);
+        } catch (InterruptedException e) {
+            logger.debug("Got interrupted while waiting to take screenshot of validation VM [{}].", vm.getName());
+        }
+        logger.info("Taking screenshot of VM [{}].", vmName);
+        String ssPath = secondaryStorage.getLocalPathFor(command.getBackupDeltaTO().getPath()) + String.format("-screenshot-%s", DateUtil.getDateInSystemTimeZone());
+        if (Script.runSimpleBashScript(String.format(SCREENSHOT_COMMAND, vmName, ssPath)) == null) {
+            throw new CloudRuntimeException(String.format("Got an unexpected error while trying to execute the screenshot validation step for VM [%s].", vmName));
+        }
+        try {
+            return tryToConvertFileToPng(ssPath);
+        } catch (IOException ex) {
+            throw new CloudRuntimeException(ex);
+        }
+    }
+
+    private String tryToConvertFileToPng(String ssPath) throws IOException {
+        File inputFile = new File(ssPath);
+        String pngPath = ssPath + ".png";
+        File outputFile = new File(pngPath);
+        BufferedImage image = ImageIO.read(inputFile);
+
+        String warnMessage = String.format("Unable to convert screenshot at [%s] to PNG. Leaving it as is.", ssPath);
+        if (image == null) {
+            logger.warn(warnMessage);
+            return ssPath.substring(ssPath.indexOf("backups"));
+        }
+        boolean result = ImageIO.write(image, "png", outputFile);
+
+        if (result) {
+            logger.debug("Successfully converted image at [{}] to PNG at [{}].", ssPath, pngPath);
+            Files.deleteIfExists(Path.of(ssPath));
+            return pngPath.substring(ssPath.indexOf("backups"));
+        } else {
+            logger.warn(warnMessage);
+            return ssPath.substring(ssPath.indexOf("backups"));
+        }
+    }
+
+    private String runScript(ValidateKbossVmCommand command, Domain vm) throws LibvirtException {
+        if (!command.isExecuteScript()) {
+            return null;
+        }
+        String script = command.getScriptToExecute();
+        if (script == null) {
+            logger.warn("This command is malformed, we should execute an script for VM [{}], but no script was configured. Please review the original VM configurations.", vm.getName());
+            return null;
+        }
+        String arguments = command.getScriptArguments();
+        if (arguments == null) {
+            arguments = "[]";
+        } else {
+            arguments = "[\"" + arguments.replace(",", "\",\"") + "\"]";
+        }
+        logger.debug("Running validation script [{}] with arguments [{}] on dummy validation VM [{}].", script, arguments, vm.getName());
+        String guestCommand = String.format(GUEST_EXEC_COMMAND, script, arguments);
+        String sanitizedGuestCommand = JsonSanitizer.sanitize(guestCommand);
+        String execResult;
+        try {
+            execResult = vm.qemuAgentCommand(sanitizedGuestCommand, command.getScriptTimeout(), 0);
+        } catch (LibvirtException ex) {
+            return ex.getMessage();
+        }
+        JsonObject root = new JsonParser().parse(execResult).getAsJsonObject();
+        JsonObject ret = root.getAsJsonObject("return");
+        String pid = ret.get("pid").getAsString();
+
+        return waitForCommandResult(command, vm, pid, script, arguments);
+    }
+
+    private String waitForCommandResult(ValidateKbossVmCommand command, Domain vm, String pid, String script, String arguments) throws LibvirtException {
+        JsonObject root;
+        JsonObject ret;
+        String expectedResult = command.getExpectedResult();
+        Integer timeout = command.getScriptTimeout();
+        while (timeout > 0) {
+            timeout -= 5;
+            try {
+                String statusResult = vm.qemuAgentCommand(String.format(GUEST_EXEC_STATUS_COMMAND, pid), 1, 0);
+                root = new JsonParser().parse(statusResult).getAsJsonObject();
+                ret = root.getAsJsonObject("return");
+
+                boolean exited = ret.get("exited").getAsBoolean();
+                if (exited) {
+                    int exitCode = ret.get("exitcode").getAsInt();
+                    String outData64Coded = ret.get("out-data").getAsString();
+                    logger.debug("Script [{}] with arguments [{}] that ran on validation VM [{}] exited with code [{}] and had output [{}].", script, arguments, vm.getName(),
+                            exitCode, outData64Coded);
+                    if (expectedResult.equals("0") && exitCode == 0) {
+                        return null;
+                    }
+                    if (outData64Coded.equals(expectedResult)) {
+                        return null;
+                    }
+                    return outData64Coded;
+                }
+            } catch (LibvirtException ex) {
+                logger.error("Caught unexpected Libvirt exception while waiting for validation script result of VM [{}]. Will try again later.", vm.getName(), ex);
+            }
+            try {
+                Thread.sleep(5 * 1000L);
+            } catch (InterruptedException e) {
+                logger.debug("Got interrupted while waiting for execution of validation script for VM [{}]. Ignoring.", vm.getName());
+            }
+        }
+        logger.error("Script [{}] that was executed on validation VM [{}] has timed out, giving up.", script, vm.getName());
+        return "Timeout";
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStoragePoolManager.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStoragePoolManager.java
index 996398a286ff..d99847fd921a 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStoragePoolManager.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStoragePoolManager.java
@@ -275,10 +275,10 @@ public boolean disconnectPhysicalDisksViaVmSpec(VirtualMachineTO vmSpec) {
     }
 
     public KVMStoragePool getStoragePool(StoragePoolType type, String uuid) {
-        return this.getStoragePool(type, uuid, false);
+        return this.getStoragePool(type, uuid, false, true);
     }
 
-    public KVMStoragePool getStoragePool(StoragePoolType type, String uuid, boolean refreshInfo) {
+    public synchronized KVMStoragePool getStoragePool(StoragePoolType type, String uuid, boolean refreshInfo, boolean addDetails) {
 
         StorageAdaptor adaptor = getStorageAdaptor(type);
         KVMStoragePool pool = null;
@@ -293,10 +293,9 @@ public KVMStoragePool getStoragePool(StoragePoolType type, String uuid, boolean
             }
         }
 
-        if (pool instanceof LibvirtStoragePool) {
+        if (pool instanceof LibvirtStoragePool && addDetails) {
             LibvirtStoragePool libvirtPool = (LibvirtStoragePool) pool;
             addPoolDetails(uuid, libvirtPool);
-
             ((LibvirtStoragePool) pool).setType(type);
             updatePoolTypeIfApplicable(libvirtPool, pool, type, uuid);
         }
@@ -444,7 +443,7 @@ public boolean disconnectPhysicalDisk(StoragePoolType type, String poolUuid, Str
         return adaptor.disconnectPhysicalDisk(volPath, pool);
     }
 
-    public boolean deleteStoragePool(StoragePoolType type, String uuid) {
+    public synchronized boolean deleteStoragePool(StoragePoolType type, String uuid) {
         StorageAdaptor adaptor = getStorageAdaptor(type);
         if (type == StoragePoolType.NetworkFilesystem) {
             _haMonitor.removeStoragePool(uuid);
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java
index 009e1decee2b..11acb9546b53 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java
@@ -84,6 +84,7 @@
 import org.apache.cloudstack.storage.command.SnapshotAndCopyCommand;
 import org.apache.cloudstack.storage.command.SyncVolumePathCommand;
 import org.apache.cloudstack.storage.formatinspector.Qcow2Inspector;
+import org.apache.cloudstack.storage.to.BackupDeltaTO;
 import org.apache.cloudstack.storage.to.PrimaryDataStoreTO;
 import org.apache.cloudstack.storage.to.SnapshotObjectTO;
 import org.apache.cloudstack.storage.to.TemplateObjectTO;
@@ -248,6 +249,7 @@ public class KVMStorageProcessor implements StorageProcessor {
             "  </devices>\n" +
             "</domain>";
 
+    public static final List<StoragePoolType> poolTypesToDeleteChainInfo = Arrays.asList(StoragePoolType.Filesystem, StoragePoolType.NetworkFilesystem, StoragePoolType.SharedMountPoint);
 
     public KVMStorageProcessor(final KVMStoragePoolManager storagePoolMgr, final LibvirtComputingResource resource) {
         this.storagePoolMgr = storagePoolMgr;
@@ -570,7 +572,11 @@ public Answer cloneVolumeFromBaseTemplate(final CopyCommand cmd) {
 
             final VolumeObjectTO newVol = new VolumeObjectTO();
             newVol.setPath(vol.getName());
-            newVol.setSize(volume.getSize());
+            if (StoragePoolType.CLVM_NG.equals(primaryStore.getPoolType()) && vol != null && vol.getVirtualSize() > 0) {
+                newVol.setSize(vol.getVirtualSize());
+            } else {
+                newVol.setSize(volume.getSize());
+            }
             if (vol.getQemuEncryptFormat() != null) {
                 newVol.setEncryptFormat(vol.getQemuEncryptFormat().toString());
             }
@@ -2315,23 +2321,24 @@ protected void rebaseSnapshot(SnapshotObjectTO snapshotObjectTO, KVMStoragePool
 
         logger.debug("Rebasing snapshot [{}] with parent [{}].", snapshotName, parentSnapshotPath);
 
+        long snapshotTimeoutInMillis = wait * 1000L;
         try {
-            QemuImg qemuImg = new QemuImg(wait);
+            QemuImg qemuImg = new QemuImg(snapshotTimeoutInMillis);
             qemuImg.rebase(snapshotFile, parentSnapshotFile, PhysicalDiskFormat.QCOW2.toString(), false);
         } catch (LibvirtException | QemuImgException e) {
             if (!StringUtils.contains(e.getMessage(), "Is another process using the image")) {
                 logger.error("Exception while rebasing incremental snapshot [{}] due to: [{}].", snapshotName, e.getMessage(), e);
                 throw new CloudRuntimeException(e);
             }
-            retryRebase(snapshotName, wait, e, snapshotFile, parentSnapshotFile);
+            retryRebase(snapshotName, snapshotTimeoutInMillis, e, snapshotFile, parentSnapshotFile);
         }
     }
 
-    private void retryRebase(String snapshotName, int wait, Exception e, QemuImgFile snapshotFile, QemuImgFile parentSnapshotFile) {
+    private void retryRebase(String snapshotName, long waitInMilliseconds, Exception e, QemuImgFile snapshotFile, QemuImgFile parentSnapshotFile) {
         logger.warn("Libvirt still has not released the lock, will wait [{}] milliseconds and try again later.", incrementalSnapshotRetryRebaseWait);
         try {
             Thread.sleep(incrementalSnapshotRetryRebaseWait);
-            QemuImg qemuImg = new QemuImg(wait);
+            QemuImg qemuImg = new QemuImg(waitInMilliseconds);
             qemuImg.rebase(snapshotFile, parentSnapshotFile, PhysicalDiskFormat.QCOW2.toString(), false);
         } catch (LibvirtException | QemuImgException | InterruptedException ex) {
             logger.error("Unable to rebase snapshot [{}].", snapshotName, ex);
@@ -2488,7 +2495,7 @@ private SnapshotObjectTO takeFullVolumeSnapshotOfRunningVm(CreateObjectCommand c
 
             String convertResult = convertBaseFileToSnapshotFileInStorageDir(ObjectUtils.defaultIfNull(secondaryPool, primaryPool), disk, snapshotPath, directoryPath, volume, cmd.getWait());
 
-            resource.mergeSnapshotIntoBaseFile(vm, diskLabel, diskPath, null, true, snapshotName, volume, conn);
+            resource.mergeDeltaIntoBaseFile(vm, diskLabel, diskPath, null, true, snapshotName, volume, conn);
 
             validateConvertResult(convertResult, snapshotPath);
         } catch (LibvirtException e) {
@@ -2759,7 +2766,7 @@ private void convertTheBaseFileToSnapshot(KVMPhysicalDisk baseFile, String snaps
         QemuImgFile destFile = new QemuImgFile(snapshotPath);
         destFile.setFormat(PhysicalDiskFormat.QCOW2);
 
-        QemuImg q = new QemuImg(wait);
+        QemuImg q = new QemuImg(wait * 1000L);
         q.convert(srcFile, destFile, options, qemuObjects, qemuImageOpts, null, true);
     }
 
@@ -2899,6 +2906,10 @@ public Answer deleteVolume(final DeleteCommand cmd) {
                 }
             }
             pool.deletePhysicalDisk(vol.getPath(), vol.getFormat());
+            if (vol.getChainInfo() != null && poolTypesToDeleteChainInfo.contains(pool.getType()) && vol.getFormat() == ImageFormat.QCOW2 && cmd.isDeleteChain()) {
+                logger.debug("Deleting leftover backup delta at [{}].", vol.getChainInfo());
+                pool.deletePhysicalDisk(vol.getChainInfo(), vol.getFormat());
+            }
             return new Answer(null);
         } catch (final CloudRuntimeException e) {
             logger.debug("Failed to delete volume: ", e);
@@ -3469,6 +3480,20 @@ public Answer syncVolumePath(SyncVolumePathCommand cmd) {
         return new Answer(cmd, false, "Not currently applicable for KVMStorageProcessor");
     }
 
+    @Override
+    public Answer deleteBackup(DeleteCommand cmd) {
+        BackupDeltaTO delta = (BackupDeltaTO)cmd.getData();
+        logger.debug("Deleting backup delta [{}].", delta);
+        PrimaryDataStoreTO primaryStore = (PrimaryDataStoreTO)delta.getDataStore();
+        KVMStoragePool pool = storagePoolMgr.getStoragePool(primaryStore.getPoolType(), primaryStore.getUuid());
+        try {
+            pool.deletePhysicalDisk(delta.getPath(), delta.getFormat());
+        } catch (CloudRuntimeException e) {
+            return new Answer(cmd, e);
+        }
+        return new Answer(cmd);
+    }
+
     /**
      * Determine if migration is using host-local source pool. If so, return this host's storage as the template source,
      * rather than remote host's
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptor.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptor.java
index db37a7e948c4..4bfac31b68f9 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptor.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStorageAdaptor.java
@@ -1605,8 +1605,9 @@ to support snapshots(backuped) as qcow2 files. */
                             if (destPool.getType() == StoragePoolType.CLVM) {
                                 keepBitmaps = false;
                             }
-                            qemu.convert(srcFile, destFile, null, null, new QemuImageOptions(srcFile.getFormat(), srcFile.getFileName(), null),
-                                    null, false, keepBitmaps);
+                            qemu.convert(srcFile, destFile, null, null, null, new QemuImageOptions(srcFile.getFormat(), srcFile.getFileName(), null),
+                                    null, false, keepBitmaps, false,
+                                    false, null, null);
                             Map<String, String> destInfo = qemu.info(destFile);
                             Long virtualSize = Long.parseLong(destInfo.get(QemuImg.VIRTUAL_SIZE));
                             newDisk.setVirtualSize(virtualSize);
diff --git a/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/utils/qemu/QemuImg.java b/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/utils/qemu/QemuImg.java
index 1fec561dc890..cae6832999eb 100644
--- a/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/utils/qemu/QemuImg.java
+++ b/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/utils/qemu/QemuImg.java
@@ -54,14 +54,15 @@ public class QemuImg {
     public static final String TARGET_ZERO_FLAG = "--target-is-zero";
     public static final String PREALLOCATION = "preallocation";
     public static final long QEMU_2_10 = 2010000;
-    public static final long QEMU_5_10 = 5010000;
+    public static final long QEMU_5_1 = 5001000;
+    public static final long QEMU_5_2 = 5002000;
 
     public static final int MIN_BITMAP_VERSION = 3;
 
     /* The qemu-img binary. We expect this to be in $PATH */
     public String _qemuImgPath = "qemu-img";
     private String cloudQemuImgPath = "cloud-qemu-img";
-    private int timeout;
+    private long timeout;
     private boolean skipZero = false;
     private boolean skipTargetVolumeCreation = false;
     private boolean noCache = false;
@@ -129,7 +130,7 @@ public enum BitmapOperation {
      * @param skipZeroIfSupported Don't write zeroes to target device during convert, if supported by qemu-img
      * @param noCache Ensure we flush writes to target disk (useful for block device targets)
      */
-    public QemuImg(final int timeout, final boolean skipZeroIfSupported, final boolean noCache) throws LibvirtException {
+    public QemuImg(final long timeout, final boolean skipZeroIfSupported, final boolean noCache) throws LibvirtException {
         if (skipZeroIfSupported) {
             final Script s = new Script(_qemuImgPath, timeout);
             s.add("--help");
@@ -159,7 +160,7 @@ public QemuImg(final int timeout, final boolean skipZeroIfSupported, final boole
      * @param timeout
      *            The timeout of scripts executed by this QemuImg object.
      */
-    public QemuImg(final int timeout) throws LibvirtException, QemuImgException {
+    public QemuImg(final long timeout) throws LibvirtException, QemuImgException {
         this(timeout, false, false);
     }
 
@@ -186,6 +187,12 @@ public QemuImg(final String qemuImgPath) throws LibvirtException {
         _qemuImgPath = qemuImgPath;
     }
 
+    /**
+     * Created for testing purposes
+     * */
+    protected QemuImg() {
+    }
+
     /* These are all methods supported by the qemu-img tool. */
 
     /**
@@ -392,7 +399,7 @@ public void convert(final QemuImgFile srcFile, final QemuImgFile destFile,
      */
     public void convert(final QemuImgFile srcFile, final QemuImgFile destFile,
                         final Map<String, String> options, final List<QemuObject> qemuObjects, final QemuImageOptions srcImageOpts, final String snapshotName, final boolean forceSourceFormat) throws QemuImgException {
-        convert(srcFile, destFile, options, qemuObjects, srcImageOpts, snapshotName, forceSourceFormat, false);
+        convert(srcFile, destFile, null, options, qemuObjects, srcImageOpts, snapshotName, forceSourceFormat, false, false, false, null, null);
     }
 
     protected Map<String, String> getResizeOptionsFromConvertOptions(final Map<String, String> options) {
@@ -408,31 +415,41 @@ protected Map<String, String> getResizeOptionsFromConvertOptions(final Map<Strin
 
     /**
      * Converts an image from source to destination.
-     *
+     * <p>
      * This method is a facade for 'qemu-img convert' and converts a disk image or snapshot into a disk image with the specified filename and format.
      *
      * @param srcFile
-     *            The source file.
+     *         The source file.
      * @param destFile
-     *            The destination file.
+     *         The destination file.
+     * @param backingFile
+     *         The destination's backing file.
      * @param options
-     *            Options for the conversion. Takes a Map<String, String> with key value
-     *            pairs which are passed on to qemu-img without validation.
+     *         Options for the conversion. Takes a Map<String, String> with key value
+     *         pairs which are passed on to qemu-img without validation.
      * @param qemuObjects
-     *            Pass qemu Objects to create - see objects in the qemu main page.
+     *         Pass qemu Objects to create - see objects in the qemu main page.
      * @param srcImageOpts
-     *            pass qemu --image-opts to convert.
+     *         pass qemu --image-opts to convert.
      * @param snapshotName
-     *            If it is provided, conversion uses it as parameter.
+     *         If it is provided, conversion uses it as parameter.
      * @param forceSourceFormat
-     *            If true, specifies the source format in the conversion command.
+     *         If true, specifies the source format in the conversion command.
      * @param keepBitmaps
-     *            If true, copies the bitmaps to the destination image.
+     *         If true, copies the bitmaps to the destination image.
+     * @param outOfOrderWrites
+     *         If true, inform -W to convert
+     * @param compress
+     *         If true, inform -c to convert
+     * @param coroutines
+     *         If not null, inform -m and number of coroutines. By default, qemu uses 8 coroutines.
+     * @param rateLimit
+     *         If not null, inform -r and rate limit in MB/s. By default, qemu does not limit the convert rate.
      * @return void
      */
-    public void convert(final QemuImgFile srcFile, final QemuImgFile destFile,
-                        final Map<String, String> options, final List<QemuObject> qemuObjects, final QemuImageOptions srcImageOpts, final String snapshotName, final boolean forceSourceFormat,
-                        boolean keepBitmaps) throws QemuImgException {
+    public void convert(final QemuImgFile srcFile, final QemuImgFile destFile, QemuImgFile backingFile, final Map<String, String> options, final List<QemuObject> qemuObjects,
+            final QemuImageOptions srcImageOpts, final String snapshotName, final boolean forceSourceFormat, boolean keepBitmaps, boolean outOfOrderWrites, boolean compress,
+            Integer coroutines, Integer rateLimit) throws QemuImgException {
         Script script = new Script(_qemuImgPath, timeout);
         if (StringUtils.isNotBlank(snapshotName)) {
             String qemuPath = Script.runSimpleBashScript(getQemuImgPathScript);
@@ -455,9 +472,28 @@ public void convert(final QemuImgFile srcFile, final QemuImgFile destFile,
         script.add("-O");
         script.add(destFile.getFormat().toString());
 
+        addBackingFileToConvertCommand(script, backingFile);
         addScriptOptionsFromMap(options, script);
         addSnapshotToConvertCommand(srcFile.getFormat().toString(), snapshotName, forceSourceFormat, script, version);
 
+        if (outOfOrderWrites) {
+            script.add("-W");
+        }
+
+        if (rateLimit != null) {
+            script.add("-r");
+            script.add(rateLimit + "M");
+        }
+
+        if (coroutines != null) {
+            script.add("-m");
+            script.add(String.valueOf(coroutines));
+        }
+
+        if (compress) {
+            script.add("-c");
+        }
+
         if (noCache) {
             script.add("-t");
             script.add("none");
@@ -484,7 +520,7 @@ public void convert(final QemuImgFile srcFile, final QemuImgFile destFile,
             script.add(srcFile.getFileName());
         }
 
-        if (this.version >= QEMU_5_10 && keepBitmaps && Qcow2Inspector.validateQcow2Version(srcFile.getFileName(), MIN_BITMAP_VERSION)) {
+        if (this.version >= QEMU_5_1 && keepBitmaps && Qcow2Inspector.validateQcow2Version(srcFile.getFileName(), MIN_BITMAP_VERSION)) {
             script.add("--bitmaps");
         }
 
@@ -500,6 +536,23 @@ public void convert(final QemuImgFile srcFile, final QemuImgFile destFile,
         }
     }
 
+
+    protected void addBackingFileToConvertCommand(Script script, QemuImgFile backingFile) {
+        if (backingFile == null) {
+            return;
+        }
+
+        script.add("-o");
+
+        String opts;
+        if (backingFile.getFormat() == null) {
+            opts = String.format("backing_file=%s", backingFile.getFileName());
+        } else {
+            opts = String.format("backing_file=%s,backing_fmt=%s", backingFile.getFileName(), backingFile.getFormat().toString());
+        }
+        script.add(opts);
+    }
+
     /**
      * Qemu version 2.0.0 added (via commit <a href="https://github.com/qemu/qemu/commit/ef80654d0dc1edf2dd2a51feff8cc3e1102a6583">ef80654d0dc1edf2dd2a51feff8cc3e1102a6583</a>) the
      * flag "-l" to inform the snapshot name or ID
@@ -871,11 +924,8 @@ public void commit(QemuImgFile file, QemuImgFile base, boolean skipEmptyingFiles
             throw new QemuImgException("File should not be null");
         }
 
-        final Script s = new Script(_qemuImgPath, timeout);
+        final Script s = createScript(_qemuImgPath, timeout);
         s.add("commit");
-        if (skipEmptyingFiles) {
-            s.add("-d");
-        }
 
         if (file.getFormat() != null) {
             s.add("-f");
@@ -885,6 +935,8 @@ public void commit(QemuImgFile file, QemuImgFile base, boolean skipEmptyingFiles
         if (base != null) {
             s.add("-b");
             s.add(base.getFileName());
+        } else if (skipEmptyingFiles) {
+            s.add("-d");
         }
 
         s.add(file.getFileName());
@@ -894,6 +946,13 @@ public void commit(QemuImgFile file, QemuImgFile base, boolean skipEmptyingFiles
         }
     }
 
+    /**
+     * This was created to facilitate testing
+     * */
+    protected Script createScript(String path, long timeout) {
+        return new Script(path, timeout);
+    }
+
     /**
      * Does qemu-img support --target-is-zero
      * @return boolean
@@ -927,7 +986,10 @@ public boolean supportsImageFormat(QemuImg.PhysicalDiskFormat format) {
     }
 
     protected static boolean helpSupportsImageFormat(String text, QemuImg.PhysicalDiskFormat format) {
-        Pattern pattern = Pattern.compile("Supported\\sformats:[a-zA-Z0-9-_\\s]*?\\b" + format + "\\b", CASE_INSENSITIVE);
+        // QEMU >= 10.1.0 changed the qemu-img --help header from
+        // "Supported formats:" to "Supported image formats:", so the word
+        // "image" must be treated as optional here.
+        Pattern pattern = Pattern.compile("Supported\\s(image\\s)?formats:[a-zA-Z0-9-_\\s]*?\\b" + format + "\\b", CASE_INSENSITIVE);
         return pattern.matcher(text).find();
     }
 
@@ -1006,4 +1068,9 @@ private void removeBitmap(QemuImgFile srcFile, String bitmapName) throws QemuImg
             throw new QemuImgException(String.format("Exception while removing bitmap [%s] from file [%s]. Result is [%s].", srcFile.getFileName(), bitmapName, result));
         }
     }
+
+    public long getVersion() {
+        return this.version;
+    }
+
 }
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java
index 0b72f2232ed0..639f1dc2894c 100644
--- a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java
@@ -52,7 +52,6 @@
 import java.util.Random;
 import java.util.UUID;
 import java.util.Vector;
-import java.util.concurrent.Semaphore;
 
 import javax.naming.ConfigurationException;
 import javax.xml.parsers.DocumentBuilderFactory;
@@ -2407,7 +2406,7 @@ public void testGetStorageStatsCommand() {
         final KVMStoragePool secondaryPool = Mockito.mock(KVMStoragePool.class);
 
         when(libvirtComputingResourceMock.getStoragePoolMgr()).thenReturn(storagePoolMgr);
-        when(storagePoolMgr.getStoragePool(command.getPooltype(), command.getStorageId(), true)).thenReturn(secondaryPool);
+        when(storagePoolMgr.getStoragePool(command.getPooltype(), command.getStorageId(), true, true)).thenReturn(secondaryPool);
 
         final LibvirtRequestWrapper wrapper = LibvirtRequestWrapper.getInstance();
         assertNotNull(wrapper);
@@ -2416,7 +2415,7 @@ public void testGetStorageStatsCommand() {
         assertTrue(answer.getResult());
 
         verify(libvirtComputingResourceMock, times(1)).getStoragePoolMgr();
-        verify(storagePoolMgr, times(1)).getStoragePool(command.getPooltype(), command.getStorageId(), true);
+        verify(storagePoolMgr, times(1)).getStoragePool(command.getPooltype(), command.getStorageId(), true, true);
     }
 
     @SuppressWarnings("unchecked")
@@ -6688,10 +6687,12 @@ public void mergeSnapshotIntoBaseFileTestActiveAndDeleteFlags() throws Exception
         libvirtComputingResourceSpy.qcow2DeltaMergeTimeout = 10;
 
         try (MockedStatic<LibvirtUtilitiesHelper> libvirtUtilitiesHelperMockedStatic = Mockito.mockStatic(LibvirtUtilitiesHelper.class);
-                MockedStatic<ThreadContext> threadContextMockedStatic = Mockito.mockStatic(ThreadContext.class)) {
+                MockedStatic<ThreadContext> threadContextMockedStatic = Mockito.mockStatic(ThreadContext.class);
+                MockedStatic<AgentPropertiesFileHandler> agentPropertiesFileHandlerMockedStatic = Mockito.mockStatic(AgentPropertiesFileHandler.class)) {
+
+            agentPropertiesFileHandlerMockedStatic.when(() -> AgentPropertiesFileHandler.getPropertyValue(Mockito.any())).thenAnswer(invocation -> true);
             libvirtUtilitiesHelperMockedStatic.when(() ->
                     LibvirtUtilitiesHelper.isLibvirtSupportingFlagDeleteOnCommandVirshBlockcommit(Mockito.any())).thenAnswer(invocation -> true);
-            Mockito.doReturn(new Semaphore(1)).when(libvirtComputingResourceSpy).getSemaphoreToWaitForMerge();
 
             threadContextMockedStatic.when(() ->
                     ThreadContext.get(Mockito.anyString())).thenReturn("logid");
@@ -6703,7 +6704,7 @@ public void mergeSnapshotIntoBaseFileTestActiveAndDeleteFlags() throws Exception
             String baseFilePath = "/file";
             String snapshotName = "snap";
 
-            libvirtComputingResourceSpy.mergeSnapshotIntoBaseFileWithEventsAndConfigurableTimeout(domainMock, diskLabel, baseFilePath, null, true, snapshotName, volumeObjectToMock, connMock);
+            libvirtComputingResourceSpy.mergeDeltaIntoBaseFile(domainMock, diskLabel, baseFilePath, null, true, snapshotName, volumeObjectToMock, connMock);
 
             Mockito.verify(domainMock, Mockito.times(1)).blockCommit(diskLabel, baseFilePath, null, 0, Domain.BlockCommitFlags.ACTIVE | Domain.BlockCommitFlags.DELETE);
             Mockito.verify(libvirtComputingResourceSpy, Mockito.times(1)).manuallyDeleteUnusedSnapshotFile(true, "/" + snapshotName);
@@ -6713,10 +6714,12 @@ public void mergeSnapshotIntoBaseFileTestActiveAndDeleteFlags() throws Exception
     @Test
     public void mergeSnapshotIntoBaseFileTestActiveFlag() throws Exception {
         try (MockedStatic<LibvirtUtilitiesHelper> libvirtUtilitiesHelperMockedStatic = Mockito.mockStatic(LibvirtUtilitiesHelper.class);
-                MockedStatic<ThreadContext> threadContextMockedStatic = Mockito.mockStatic(ThreadContext.class)) {
+                MockedStatic<ThreadContext> threadContextMockedStatic = Mockito.mockStatic(ThreadContext.class);
+                MockedStatic<AgentPropertiesFileHandler> agentPropertiesFileHandlerMockedStatic = Mockito.mockStatic(AgentPropertiesFileHandler.class)) {
+
+            agentPropertiesFileHandlerMockedStatic.when(() -> AgentPropertiesFileHandler.getPropertyValue(Mockito.any())).thenAnswer(invocation -> true);
             libvirtUtilitiesHelperMockedStatic.when(() ->
                     LibvirtUtilitiesHelper.isLibvirtSupportingFlagDeleteOnCommandVirshBlockcommit(Mockito.any())).thenAnswer(invocation -> false);
-            Mockito.doReturn(new Semaphore(1)).when(libvirtComputingResourceSpy).getSemaphoreToWaitForMerge();
 
             threadContextMockedStatic.when(() ->
                     ThreadContext.get(Mockito.anyString())).thenReturn("logid");
@@ -6728,7 +6731,7 @@ public void mergeSnapshotIntoBaseFileTestActiveFlag() throws Exception {
             String baseFilePath = "/file";
             String snapshotName = "snap";
 
-            libvirtComputingResourceSpy.mergeSnapshotIntoBaseFileWithEventsAndConfigurableTimeout(domainMock, diskLabel, baseFilePath, null, true, snapshotName, volumeObjectToMock, connMock);
+            libvirtComputingResourceSpy.mergeDeltaIntoBaseFile(domainMock, diskLabel, baseFilePath, null, true, snapshotName, volumeObjectToMock, connMock);
 
             Mockito.verify(domainMock, Mockito.times(1)).blockCommit(diskLabel, baseFilePath, null, 0, Domain.BlockCommitFlags.ACTIVE);
             Mockito.verify(libvirtComputingResourceSpy, Mockito.times(1)).manuallyDeleteUnusedSnapshotFile(false, "/" + snapshotName);
@@ -6738,10 +6741,12 @@ public void mergeSnapshotIntoBaseFileTestActiveFlag() throws Exception {
     @Test
     public void mergeSnapshotIntoBaseFileTestDeleteFlag() throws Exception {
         try (MockedStatic<LibvirtUtilitiesHelper> libvirtUtilitiesHelperMockedStatic = Mockito.mockStatic(LibvirtUtilitiesHelper.class);
-                MockedStatic<ThreadContext> threadContextMockedStatic = Mockito.mockStatic(ThreadContext.class)) {
+                MockedStatic<ThreadContext> threadContextMockedStatic = Mockito.mockStatic(ThreadContext.class);
+                MockedStatic<AgentPropertiesFileHandler> agentPropertiesFileHandlerMockedStatic = Mockito.mockStatic(AgentPropertiesFileHandler.class)) {
+
+            agentPropertiesFileHandlerMockedStatic.when(() -> AgentPropertiesFileHandler.getPropertyValue(Mockito.any())).thenAnswer(invocation -> true);
             libvirtComputingResourceSpy.qcow2DeltaMergeTimeout = 10;
             libvirtUtilitiesHelperMockedStatic.when(() -> LibvirtUtilitiesHelper.isLibvirtSupportingFlagDeleteOnCommandVirshBlockcommit(Mockito.any())).thenReturn(true);
-            Mockito.doReturn(new Semaphore(1)).when(libvirtComputingResourceSpy).getSemaphoreToWaitForMerge();
             threadContextMockedStatic.when(() -> ThreadContext.get(Mockito.anyString())).thenReturn("logid");
             Mockito.doNothing().when(domainMock).addBlockJobListener(Mockito.any());
             Mockito.doReturn(null).when(domainMock).getBlockJobInfo(Mockito.anyString(), Mockito.anyInt());
@@ -6752,7 +6757,7 @@ public void mergeSnapshotIntoBaseFileTestDeleteFlag() throws Exception {
             String baseFilePath = "/file";
             String snapshotName = "snap";
 
-            libvirtComputingResourceSpy.mergeSnapshotIntoBaseFileWithEventsAndConfigurableTimeout(domainMock, diskLabel, baseFilePath, null, false, snapshotName, volumeObjectToMock, connMock);
+            libvirtComputingResourceSpy.mergeDeltaIntoBaseFile(domainMock, diskLabel, baseFilePath, null, false, snapshotName, volumeObjectToMock, connMock);
 
             Mockito.verify(domainMock, Mockito.times(1)).blockCommit(diskLabel, baseFilePath, null, 0, Domain.BlockCommitFlags.DELETE);
             Mockito.verify(libvirtComputingResourceSpy, Mockito.times(1)).manuallyDeleteUnusedSnapshotFile(true, "/" + snapshotName);
@@ -6762,10 +6767,12 @@ public void mergeSnapshotIntoBaseFileTestDeleteFlag() throws Exception {
     @Test
     public void mergeSnapshotIntoBaseFileTestNoFlags() throws Exception {
         try (MockedStatic<LibvirtUtilitiesHelper> libvirtUtilitiesHelperMockedStatic = Mockito.mockStatic(LibvirtUtilitiesHelper.class);
-                MockedStatic<ThreadContext> threadContextMockedStatic = Mockito.mockStatic(ThreadContext.class)) {
+                MockedStatic<ThreadContext> threadContextMockedStatic = Mockito.mockStatic(ThreadContext.class);
+                MockedStatic<AgentPropertiesFileHandler> agentPropertiesFileHandlerMockedStatic = Mockito.mockStatic(AgentPropertiesFileHandler.class)) {
+
+            agentPropertiesFileHandlerMockedStatic.when(() -> AgentPropertiesFileHandler.getPropertyValue(Mockito.any())).thenAnswer(invocation -> true);
             libvirtComputingResourceSpy.qcow2DeltaMergeTimeout = 10;
             libvirtUtilitiesHelperMockedStatic.when(() -> LibvirtUtilitiesHelper.isLibvirtSupportingFlagDeleteOnCommandVirshBlockcommit(Mockito.any())).thenReturn(false);
-            Mockito.doReturn(new Semaphore(1)).when(libvirtComputingResourceSpy).getSemaphoreToWaitForMerge();
             threadContextMockedStatic.when(() -> ThreadContext.get(Mockito.anyString())).thenReturn("logid");
             Mockito.doNothing().when(domainMock).addBlockJobListener(Mockito.any());
             Mockito.doReturn(null).when(domainMock).getBlockJobInfo(Mockito.anyString(), Mockito.anyInt());
@@ -6776,7 +6783,7 @@ public void mergeSnapshotIntoBaseFileTestNoFlags() throws Exception {
             String baseFilePath = "/file";
             String snapshotName = "snap";
 
-            libvirtComputingResourceSpy.mergeSnapshotIntoBaseFileWithEventsAndConfigurableTimeout(domainMock, diskLabel, baseFilePath, null, false, snapshotName, volumeObjectToMock, connMock);
+            libvirtComputingResourceSpy.mergeDeltaIntoBaseFile(domainMock, diskLabel, baseFilePath, null, false, snapshotName, volumeObjectToMock, connMock);
 
             Mockito.verify(domainMock, Mockito.times(1)).blockCommit(diskLabel, baseFilePath, null, 0, 0);
             Mockito.verify(libvirtComputingResourceSpy, Mockito.times(1)).manuallyDeleteUnusedSnapshotFile(false, "/" + snapshotName);
@@ -6789,20 +6796,20 @@ public void mergeSnapshotIntoBaseFileTestMergeFailsThrowException() throws Excep
                 MockedStatic<ThreadContext> threadContextMockedStatic = Mockito.mockStatic(ThreadContext.class)) {
             libvirtComputingResourceSpy.qcow2DeltaMergeTimeout = 10;
             libvirtUtilitiesHelperMockedStatic.when(() -> LibvirtUtilitiesHelper.isLibvirtSupportingFlagDeleteOnCommandVirshBlockcommit(Mockito.any())).thenReturn(false);
-            Mockito.doReturn(new Semaphore(1)).when(libvirtComputingResourceSpy).getSemaphoreToWaitForMerge();
             threadContextMockedStatic.when(() -> ThreadContext.get(Mockito.anyString())).thenReturn("logid");
+            Mockito.doReturn(Boolean.TRUE).when(libvirtComputingResourceSpy).isLibvirtEventsEnabled();
             Mockito.doNothing().when(domainMock).addBlockJobListener(Mockito.any());
             Mockito.doReturn(null).when(domainMock).getBlockJobInfo(Mockito.anyString(), Mockito.anyInt());
             Mockito.doNothing().when(domainMock).removeBlockJobListener(Mockito.any());
 
-            Mockito.doReturn(blockCommitListenerMock).when(libvirtComputingResourceSpy).getBlockCommitListener(Mockito.any(), Mockito.any());
+            Mockito.doReturn(blockCommitListenerMock).when(libvirtComputingResourceSpy).getBlockCommitListener(Mockito.any());
             Mockito.doReturn("Failed").when(blockCommitListenerMock).getResult();
 
             String diskLabel = "vda";
             String baseFilePath = "/file";
             String snapshotName = "snap";
 
-            libvirtComputingResourceSpy.mergeSnapshotIntoBaseFileWithEventsAndConfigurableTimeout(domainMock, diskLabel, baseFilePath, null, false, snapshotName, volumeObjectToMock, connMock);
+            libvirtComputingResourceSpy.mergeDeltaIntoBaseFile(domainMock, diskLabel, baseFilePath, null, false, snapshotName, volumeObjectToMock, connMock);
         }
     }
 
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirTakeKbossBackupCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirTakeKbossBackupCommandWrapperTest.java
new file mode 100644
index 000000000000..8354993e61a1
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirTakeKbossBackupCommandWrapperTest.java
@@ -0,0 +1,377 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyBoolean;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.ArgumentMatchers.anyList;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+
+import java.io.IOException;
+import java.nio.file.Files;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.backup.TakeKbossBackupAnswer;
+import org.apache.cloudstack.backup.TakeKbossBackupCommand;
+import org.apache.cloudstack.storage.to.BackupDeltaTO;
+import org.apache.cloudstack.storage.to.DeltaMergeTreeTO;
+import org.apache.cloudstack.storage.to.KbossTO;
+import org.apache.cloudstack.storage.to.PrimaryDataStoreTO;
+import org.apache.cloudstack.storage.to.VolumeObjectTO;
+import org.apache.cloudstack.utils.qemu.QemuImgException;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.libvirt.LibvirtException;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+import com.cloud.utils.Pair;
+import com.cloud.utils.exception.BackupException;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirTakeKbossBackupCommandWrapperTest {
+
+    @Mock
+    private TakeKbossBackupCommand takeKbossBackupCommandMock;
+
+    @Mock
+    private LibvirtComputingResource libvirtComputingResourceMock;
+
+    @Mock
+    private KVMStoragePoolManager kvmStoragePoolManagerMock;
+
+    @Mock
+    private KVMStoragePool kvmStoragePool1;
+
+    @Mock
+    private KVMStoragePool kvmStoragePool2;
+
+    @Mock
+    private KVMStoragePool kvmStoragePool3;
+
+    @Mock
+    private KbossTO kbossTO1;
+
+    @Mock
+    private KbossTO kbossTO2;
+
+    @Mock
+    private VolumeObjectTO volumeObjectToMock1;
+
+    @Mock
+    private VolumeObjectTO volumeObjectToMock2;
+
+    @Mock
+    private DeltaMergeTreeTO deltaMergeTreeToMock;
+
+    @Mock
+    private BackupDeltaTO backupDeltaTOMock;
+
+    @Mock
+    private PrimaryDataStoreTO primaryDataStoreToMock;
+
+    @Spy
+    @InjectMocks
+    private LibvirtTakeKbossBackupCommandWrapper libvirtTakeKbossBackupCommandWrapperSpy;
+
+    private String volUuid1 = "uuid1";
+
+    private String volUuid2 = "uuid2";
+
+    private String deltaPath1 = "deltapath1";
+
+    private String deltaPath2 = "deltapath2";
+
+    private String secondaryUrl = "nfs://1.1.1.2:/mnt";
+
+    private String secondaryUrl2 = "nfs://2.2.2.2:/mnt2";
+
+    @Test
+    public void executeTestBackupException() {
+        doReturn(List.of()).when(takeKbossBackupCommandMock).getKbossTOs();
+        doThrow(new BackupException("tst", false)).when(libvirtComputingResourceMock).createDiskOnlyVMSnapshotOfStoppedVm(any(), any());
+
+        TakeKbossBackupAnswer answer = (TakeKbossBackupAnswer)libvirtTakeKbossBackupCommandWrapperSpy.execute(takeKbossBackupCommandMock, libvirtComputingResourceMock);
+
+        assertFalse(answer.getResult());
+        assertFalse(answer.isVmConsistent());
+    }
+
+    @Test
+    public void executeTestSuccessStoppedVm() {
+        doReturn(List.of()).when(takeKbossBackupCommandMock).getKbossTOs();
+        doNothing().when(libvirtTakeKbossBackupCommandWrapperSpy).backupVolumes(any(), any(), any(), any(), any(), any(), anyBoolean(), any());
+        doNothing().when(libvirtTakeKbossBackupCommandWrapperSpy).cleanupVm(any(), any(), any(), any(), anyBoolean(), any());
+
+        TakeKbossBackupAnswer answer = (TakeKbossBackupAnswer)libvirtTakeKbossBackupCommandWrapperSpy.execute(takeKbossBackupCommandMock, libvirtComputingResourceMock);
+
+        verify(libvirtComputingResourceMock).createDiskOnlyVMSnapshotOfStoppedVm(any(), any());
+        verify(libvirtTakeKbossBackupCommandWrapperSpy).backupVolumes(any(), any(), any(), any(), any(), any(), anyBoolean(), any());
+        verify(libvirtTakeKbossBackupCommandWrapperSpy).cleanupVm(any(), any(), any(), any(), anyBoolean(), any());
+        assertTrue(answer.getResult());
+    }
+
+    @Test
+    public void executeTestSuccessRunningVm() {
+        doReturn(List.of()).when(takeKbossBackupCommandMock).getKbossTOs();
+        doReturn(true).when(takeKbossBackupCommandMock).isRunningVM();
+        doNothing().when(libvirtTakeKbossBackupCommandWrapperSpy).backupVolumes(any(), any(), any(), any(), any(), any(), anyBoolean(), any());
+        doNothing().when(libvirtTakeKbossBackupCommandWrapperSpy).cleanupVm(any(), any(), any(), any(), anyBoolean(), any());
+
+        TakeKbossBackupAnswer answer = (TakeKbossBackupAnswer)libvirtTakeKbossBackupCommandWrapperSpy.execute(takeKbossBackupCommandMock, libvirtComputingResourceMock);
+
+        verify(libvirtComputingResourceMock).createDiskOnlyVmSnapshotForRunningVm(any(), any(), any(), anyBoolean());
+        verify(libvirtTakeKbossBackupCommandWrapperSpy).backupVolumes(any(), any(), any(), any(), any(), any(), anyBoolean(), any());
+        verify(libvirtTakeKbossBackupCommandWrapperSpy).cleanupVm(any(), any(), any(), any(), anyBoolean(), any());
+        assertTrue(answer.getResult());
+    }
+
+    @Test (expected = BackupException.class)
+    public void backupVolumesTestRecoverIfExceptionThrown() {
+        List<Pair<VolumeObjectTO, String>> volumeTosAndNewPaths = new ArrayList<>();
+        Map<String, Pair<String, Long>> mapVolumeUuidToDeltaPathOnSecondaryAndDeltaSize = new HashMap<>();
+        String secondaryUrl = "nfs://1.1.1.2:/mnt";
+
+        doReturn(secondaryUrl).when(takeKbossBackupCommandMock).getImageStoreUrl();
+        doThrow(new RuntimeException("odasij")).when(kbossTO1).getVolumeObjectTO();
+
+        libvirtTakeKbossBackupCommandWrapperSpy.backupVolumes(takeKbossBackupCommandMock, libvirtComputingResourceMock, kvmStoragePoolManagerMock, List.of(kbossTO1),
+                volumeTosAndNewPaths, "tst", false, mapVolumeUuidToDeltaPathOnSecondaryAndDeltaSize);
+
+
+        verify(libvirtTakeKbossBackupCommandWrapperSpy).recoverPreviousVmStateAndDeletePartialBackup(libvirtComputingResourceMock, volumeTosAndNewPaths, "tst", false,
+                mapVolumeUuidToDeltaPathOnSecondaryAndDeltaSize, kvmStoragePoolManagerMock, secondaryUrl);
+    }
+
+    @Test
+    public void backupVolumesTestHappyPath() {
+        setupKbossTos();
+        List<Pair<VolumeObjectTO, String>> volumeTosAndNewPaths = new ArrayList<>();
+        Map<String, Pair<String, Long>> mapVolumeUuidToDeltaPathOnSecondaryAndDeltaSize = new HashMap<>();
+
+        doReturn(100).when(takeKbossBackupCommandMock).getWait();
+        doReturn(secondaryUrl).when(takeKbossBackupCommandMock).getImageStoreUrl();
+        Pair<String, Long> pair1 = new Pair<>("p1", 10L);
+        doReturn(pair1).when(libvirtTakeKbossBackupCommandWrapperSpy).copyBackupDeltaToSecondary(eq(kvmStoragePoolManagerMock), eq(kbossTO1), anyList(),
+                        eq(secondaryUrl), anyInt());
+        Pair<String, Long> pair2 = new Pair<>("p2", 13L);
+        doReturn(pair2).when(libvirtTakeKbossBackupCommandWrapperSpy).copyBackupDeltaToSecondary(eq(kvmStoragePoolManagerMock), eq(kbossTO2), anyList(),
+                eq(secondaryUrl), anyInt());
+
+        libvirtTakeKbossBackupCommandWrapperSpy.backupVolumes(takeKbossBackupCommandMock, libvirtComputingResourceMock, kvmStoragePoolManagerMock, List.of(kbossTO1, kbossTO2),
+                volumeTosAndNewPaths, "tst", false, mapVolumeUuidToDeltaPathOnSecondaryAndDeltaSize);
+
+        verify(libvirtTakeKbossBackupCommandWrapperSpy, never()).recoverPreviousVmStateAndDeletePartialBackup(libvirtComputingResourceMock, volumeTosAndNewPaths, "tst", false,
+                mapVolumeUuidToDeltaPathOnSecondaryAndDeltaSize, kvmStoragePoolManagerMock, secondaryUrl);
+        assertEquals(pair1, mapVolumeUuidToDeltaPathOnSecondaryAndDeltaSize.get(volUuid1));
+        assertEquals(pair2, mapVolumeUuidToDeltaPathOnSecondaryAndDeltaSize.get(volUuid2));
+    }
+
+    @Test
+    public void cleanupVmTestEndOfChain() {
+        setupKbossTos();
+        Map<String, String> mapVolumeUUidToNewVolumePath = new HashMap<>();
+        String path1 = "path1";
+        String path2 = "path2";
+        String path3 = "path3";
+        String vmName = "ttt";
+        doReturn(path1).when(volumeObjectToMock1).getPath();
+        doReturn(path2).when(volumeObjectToMock2).getPath();
+        doReturn(deltaPath1).when(kbossTO1).getDeltaPathOnPrimary();
+        doReturn(deltaPath2).when(kbossTO2).getDeltaPathOnPrimary();
+        doReturn(deltaMergeTreeToMock).when(kbossTO1).getDeltaMergeTreeTO();
+        doNothing().when(libvirtTakeKbossBackupCommandWrapperSpy).mergeBackupDelta(any(), any(), any(), any(), anyBoolean(), any(), anyBoolean());
+        doReturn(true).when(takeKbossBackupCommandMock).isEndChain();
+        doReturn(volumeObjectToMock1).when(deltaMergeTreeToMock).getChild();
+        doReturn(backupDeltaTOMock).when(deltaMergeTreeToMock).getParent();
+        doReturn(path3).when(backupDeltaTOMock).getPath();
+        doNothing().when(libvirtTakeKbossBackupCommandWrapperSpy).endChainForVolume(libvirtComputingResourceMock, volumeObjectToMock1, vmName, true, volUuid1, path3);
+
+        libvirtTakeKbossBackupCommandWrapperSpy.cleanupVm(takeKbossBackupCommandMock, libvirtComputingResourceMock, List.of(kbossTO1, kbossTO2), vmName, true,
+                mapVolumeUUidToNewVolumePath);
+
+        verify(volumeObjectToMock1).setPath(deltaPath1);
+        verify(volumeObjectToMock2).setPath(deltaPath2);
+        verify(libvirtTakeKbossBackupCommandWrapperSpy).mergeBackupDelta(eq(libvirtComputingResourceMock), eq(deltaMergeTreeToMock), eq(volumeObjectToMock1), eq(vmName), eq(true),
+                eq(volUuid1), anyBoolean());
+        verify(libvirtTakeKbossBackupCommandWrapperSpy).endChainForVolume(libvirtComputingResourceMock, volumeObjectToMock1, vmName, true, volUuid1, path3);
+        assertEquals(path3, mapVolumeUUidToNewVolumePath.get(volUuid1));
+        assertEquals(path2, mapVolumeUUidToNewVolumePath.get(volUuid2));
+    }
+
+    @Test
+    public void cleanupVmTestNotEndOfChainAndNotIsolated() {
+        setupKbossTos();
+        Map<String, String> mapVolumeUUidToNewVolumePath = new HashMap<>();
+        String vmName = "ttt";
+        doReturn(deltaPath1).when(kbossTO1).getDeltaPathOnPrimary();
+        doReturn(deltaPath2).when(kbossTO2).getDeltaPathOnPrimary();
+
+        libvirtTakeKbossBackupCommandWrapperSpy.cleanupVm(takeKbossBackupCommandMock, libvirtComputingResourceMock, List.of(kbossTO1, kbossTO2), vmName, true,
+                mapVolumeUUidToNewVolumePath);
+
+        verify(volumeObjectToMock1).setPath(deltaPath1);
+        verify(volumeObjectToMock2).setPath(deltaPath2);
+        assertEquals(deltaPath1, mapVolumeUUidToNewVolumePath.get(volUuid1));
+        assertEquals(deltaPath2, mapVolumeUUidToNewVolumePath.get(volUuid2));
+    }
+
+    @Test
+    public void copyBackupDeltaToSecondaryTest() throws LibvirtException, QemuImgException {
+        String parentPath = "parentPath";
+        String volumePath = "volPath";
+        String parentBackupFullPath = "parentBackupFullPath";
+        String backupDeltaFullPathOnPrimary1 = "backupDeltaFullPathOnPrimary1";
+        String backupDeltaFullPathOnSecondary1 = "backupDeltaFullPathOnSecondary1";
+        String randomPath1 = "random";
+        String backupDeltaFullPathOnPrimary2 = "backupDeltaFullPathOnPrimary2";
+
+        doReturn(volumeObjectToMock1).when(kbossTO1).getVolumeObjectTO();
+        doReturn(volumePath).when(volumeObjectToMock1).getPath();
+        doReturn(volUuid1).when(volumeObjectToMock1).getUuid();
+        doReturn(parentPath).when(kbossTO1).getPathBackupParentOnSecondary();
+        doReturn(new ArrayList<>(List.of(deltaPath2))).when(kbossTO1).getVmSnapshotDeltaPaths();
+        doReturn(deltaPath1).when(kbossTO1).getDeltaPathOnSecondary();
+        doReturn(kvmStoragePool1).when(kvmStoragePoolManagerMock).getStoragePoolByURI(secondaryUrl);
+        doReturn(kvmStoragePool2).when(kvmStoragePoolManagerMock).getStoragePoolByURI(secondaryUrl2);
+        doReturn(primaryDataStoreToMock).when(volumeObjectToMock1).getDataStore();
+        doReturn(kvmStoragePool3).when(kvmStoragePoolManagerMock).getStoragePool(any(), any());
+
+        doReturn(parentBackupFullPath).when(kvmStoragePool2).getLocalPathFor(parentPath);
+        doReturn(backupDeltaFullPathOnPrimary1).when(kvmStoragePool3).getLocalPathFor(deltaPath2);
+        doReturn(backupDeltaFullPathOnSecondary1).when(kvmStoragePool1).getLocalPathFor(deltaPath1);
+        doNothing().when(libvirtTakeKbossBackupCommandWrapperSpy).convertDeltaToSecondary(backupDeltaFullPathOnPrimary1, backupDeltaFullPathOnSecondary1, parentBackupFullPath, volUuid1, 100000);
+
+        doReturn(randomPath1).when(libvirtTakeKbossBackupCommandWrapperSpy).getRelativePathOnSecondaryForBackup(anyLong(), anyLong(), any());
+        doReturn("random2").when(kvmStoragePool1).getLocalPathFor(randomPath1);
+        doReturn(backupDeltaFullPathOnPrimary2).when(kvmStoragePool3).getLocalPathFor(volumePath);
+        doNothing().when(libvirtTakeKbossBackupCommandWrapperSpy).convertDeltaToSecondary(eq(backupDeltaFullPathOnPrimary2), eq("random2"), eq(backupDeltaFullPathOnSecondary1),
+                any(), anyInt());
+
+        doNothing().when(libvirtTakeKbossBackupCommandWrapperSpy).commitTopDeltaOnBaseBackupOnSecondaryIfNeeded(randomPath1, deltaPath1, kvmStoragePool1,
+                backupDeltaFullPathOnSecondary1, 100000);
+        doNothing().when(libvirtTakeKbossBackupCommandWrapperSpy).removeTemporaryDeltas(any(), anyBoolean());
+
+        try(MockedStatic<Files> filesMockedStatic = Mockito.mockStatic(Files.class)) {
+            filesMockedStatic.when(() -> Files.size(any())).thenReturn(1000L);
+            Pair<String, Long> result = libvirtTakeKbossBackupCommandWrapperSpy.copyBackupDeltaToSecondary(kvmStoragePoolManagerMock, kbossTO1, List.of(secondaryUrl2),
+                    secondaryUrl, 100000);
+
+            assertEquals(deltaPath1, result.first());
+            assertEquals(Long.valueOf(1000L), result.second());
+        }
+
+        verify(libvirtTakeKbossBackupCommandWrapperSpy).convertDeltaToSecondary(backupDeltaFullPathOnPrimary1, backupDeltaFullPathOnSecondary1, parentBackupFullPath, volUuid1, 100000);
+        verify(libvirtTakeKbossBackupCommandWrapperSpy).convertDeltaToSecondary(eq(backupDeltaFullPathOnPrimary2), eq("random2"), eq(backupDeltaFullPathOnSecondary1),
+                any(), anyInt());
+        verify(libvirtTakeKbossBackupCommandWrapperSpy).commitTopDeltaOnBaseBackupOnSecondaryIfNeeded(randomPath1, deltaPath1, kvmStoragePool1,
+                backupDeltaFullPathOnSecondary1, 100000);
+        verify(libvirtTakeKbossBackupCommandWrapperSpy).removeTemporaryDeltas(any(), anyBoolean());
+    }
+
+    @Test
+    public void removeTemporaryDeltasTestResultTrue() {
+        ArrayList<String> input = new ArrayList<>(List.of("a", "b"));
+
+        try(MockedStatic<Files> filesMockedStatic = Mockito.mockStatic(Files.class)) {
+            libvirtTakeKbossBackupCommandWrapperSpy.removeTemporaryDeltas(input, true);
+
+            filesMockedStatic.verify(() -> Files.deleteIfExists(any()), Mockito.times(1));
+        }
+    }
+
+    @Test
+    public void removeTemporaryDeltasTestResultFalse() {
+        ArrayList<String> input = new ArrayList<>(List.of("a", "b"));
+
+        try(MockedStatic<Files> filesMockedStatic = Mockito.mockStatic(Files.class)) {
+            libvirtTakeKbossBackupCommandWrapperSpy.removeTemporaryDeltas(input, false);
+
+            filesMockedStatic.verify(() -> Files.deleteIfExists(any()), Mockito.times(2));
+        }
+    }
+
+    @Test
+    public void removeTemporaryDeltasTestExceptionIsIgnored() {
+        ArrayList<String> input = new ArrayList<>(List.of("a", "b"));
+
+        try(MockedStatic<Files> filesMockedStatic = Mockito.mockStatic(Files.class)) {
+            filesMockedStatic.when(() -> Files.deleteIfExists(any())).thenThrow(new IOException("das"));
+            libvirtTakeKbossBackupCommandWrapperSpy.removeTemporaryDeltas(input, false);
+
+            filesMockedStatic.verify(() -> Files.deleteIfExists(any()), Mockito.times(2));
+        }
+    }
+
+    @Test (expected = BackupException.class)
+    public void mergeBackupDeltaTestThrowsException() throws LibvirtException, QemuImgException {
+        doThrow(new QemuImgException("a")).when(libvirtComputingResourceMock).mergeDeltaForRunningVm(any(), any(), any());
+
+        libvirtTakeKbossBackupCommandWrapperSpy.mergeBackupDelta(libvirtComputingResourceMock, deltaMergeTreeToMock, volumeObjectToMock1, "ttt", true, volUuid1, false);
+    }
+
+    @Test
+    public void mergeBackupDeltaTestRunningVm() throws LibvirtException, QemuImgException {
+        libvirtTakeKbossBackupCommandWrapperSpy.mergeBackupDelta(libvirtComputingResourceMock, deltaMergeTreeToMock, volumeObjectToMock1, "ttt", true, volUuid1, false);
+
+        verify(libvirtComputingResourceMock).mergeDeltaForRunningVm(deltaMergeTreeToMock, "ttt", volumeObjectToMock1);
+    }
+
+    @Test
+    public void mergeBackupDeltaTestStoppedVm() throws LibvirtException, QemuImgException, IOException {
+        libvirtTakeKbossBackupCommandWrapperSpy.mergeBackupDelta(libvirtComputingResourceMock, deltaMergeTreeToMock, volumeObjectToMock1, "ttt", false, volUuid1, false);
+
+        verify(libvirtComputingResourceMock).mergeDeltaForStoppedVm(deltaMergeTreeToMock);
+    }
+
+    @Test
+    public void mergeBackupDeltaTestStoppedVmCountNewestDeltaAsGrandChild() throws LibvirtException, QemuImgException, IOException {
+        libvirtTakeKbossBackupCommandWrapperSpy.mergeBackupDelta(libvirtComputingResourceMock, deltaMergeTreeToMock, volumeObjectToMock1, "ttt", false, volUuid1, true);
+
+        verify(deltaMergeTreeToMock).addGrandChild(volumeObjectToMock1);
+        verify(libvirtComputingResourceMock).mergeDeltaForStoppedVm(deltaMergeTreeToMock);
+    }
+
+    private void setupKbossTos() {
+        doReturn(volumeObjectToMock1).when(kbossTO1).getVolumeObjectTO();
+        doReturn(volUuid1).when(volumeObjectToMock1).getUuid();
+        doReturn(volumeObjectToMock2).when(kbossTO2).getVolumeObjectTO();
+        doReturn(volUuid2).when(volumeObjectToMock2).getUuid();
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVolumesOnStorageCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVolumesOnStorageCommandWrapperTest.java
index 4e039f318928..f4c85aa611f4 100644
--- a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVolumesOnStorageCommandWrapperTest.java
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtGetVolumesOnStorageCommandWrapperTest.java
@@ -88,7 +88,7 @@ public void setUp() {
         Mockito.when(pool.getUuid()).thenReturn(poolUuid);
         Mockito.when(pool.getType()).thenReturn(poolType);
         Mockito.when(libvirtComputingResource.getStoragePoolMgr()).thenReturn(storagePoolMgr);
-        Mockito.when(storagePoolMgr.getStoragePool(poolType, poolUuid, true)).thenReturn(storagePool);
+        Mockito.when(storagePoolMgr.getStoragePool(poolType, poolUuid, true, true)).thenReturn(storagePool);
 
         qemuImg = Mockito.mockConstruction(QemuImg.class, (mock, context) -> {
             Mockito.when(mock.info(Mockito.any(QemuImgFile.class), Mockito.eq(true))).thenReturn(qemuImgInfo);
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtImportConvertedInstanceCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtImportConvertedInstanceCommandWrapperTest.java
index 343a15b367d4..a30168266c0c 100644
--- a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtImportConvertedInstanceCommandWrapperTest.java
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtImportConvertedInstanceCommandWrapperTest.java
@@ -127,7 +127,7 @@ public void testGetTemporaryDisksFromParsedXml() {
         Mockito.when(convertedDisk1.getName()).thenReturn("disk1");
         Mockito.when(temporaryPool.getPhysicalDisk(relativePath)).thenReturn(convertedDisk1);
 
-        List<KVMPhysicalDisk> disks = importInstanceCommandWrapper.getTemporaryDisksFromParsedXml(temporaryPool, parser, "");
+        List<KVMPhysicalDisk> disks = importInstanceCommandWrapper.getTemporaryDisksFromParsedXml(temporaryPool, parser, "", "", "prefix");
         Mockito.verify(importInstanceCommandWrapper).sanitizeDisksPath(List.of(diskDef));
         Assert.assertEquals(1, disks.size());
         Assert.assertEquals("disk1", disks.get(0).getName());
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRestoreBackupCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRestoreBackupCommandWrapperTest.java
index ef6b5c08189d..fd8a3b02e0a0 100644
--- a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRestoreBackupCommandWrapperTest.java
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRestoreBackupCommandWrapperTest.java
@@ -407,6 +407,8 @@ public void testExecuteWithRsyncFailure() throws Exception {
                                 return 0; // File exists
                             } else if (command.contains("qemu-img check")) {
                                 return 0; // File is valid
+                            } else if (command.contains("qemu-img info") && command.contains("backing-filename")) {
+                                return 1; // No backing chain — exercise the rsync path (full backups)
                             }
                             return 0; // Other commands success
                         });
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRestoreKbossBackupCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRestoreKbossBackupCommandWrapperTest.java
new file mode 100644
index 000000000000..75668ad15f3b
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRestoreKbossBackupCommandWrapperTest.java
@@ -0,0 +1,181 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import com.cloud.storage.Storage;
+import com.cloud.utils.Pair;
+import org.apache.cloudstack.backup.RestoreKbossBackupAnswer;
+import org.apache.cloudstack.backup.RestoreKbossBackupCommand;
+import org.apache.cloudstack.storage.to.BackupDeltaTO;
+import org.apache.cloudstack.storage.to.DeltaMergeTreeTO;
+import org.apache.cloudstack.storage.to.KbossTO;
+import org.apache.cloudstack.storage.to.PrimaryDataStoreTO;
+import org.apache.cloudstack.storage.to.VolumeObjectTO;
+import org.apache.cloudstack.utils.qemu.QemuImg;
+import org.apache.cloudstack.utils.qemu.QemuImgException;
+import org.apache.cloudstack.utils.qemu.QemuImgFile;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.libvirt.LibvirtException;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePool;
+import com.cloud.hypervisor.kvm.storage.KVMStoragePoolManager;
+
+import java.io.IOException;
+import java.util.Set;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyBoolean;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtRestoreKbossBackupCommandWrapperTest {
+
+    @Mock
+    private LibvirtComputingResource libvirtComputingResourceMock;
+
+    @Mock
+    private KVMStoragePoolManager kvmStoragePoolManagerMock;
+
+    @Mock
+    private KVMStoragePool kvmStoragePool1;
+
+    @Mock
+    private KVMStoragePool kvmStoragePool2;
+
+    @Mock
+    private KVMStoragePool kvmStoragePool3;
+
+    @Mock
+    private KbossTO kbossTO1;
+
+    @Mock
+    private KbossTO kbossTO2;
+
+    @Mock
+    private VolumeObjectTO volumeObjectToMock1;
+
+    @Mock
+    private VolumeObjectTO volumeObjectToMock2;
+
+    @Mock
+    private DeltaMergeTreeTO deltaMergeTreeToMock;
+
+    @Mock
+    private BackupDeltaTO backupDeltaTOMock;
+
+    @Mock
+    private PrimaryDataStoreTO primaryDataStoreToMock;
+
+    @Mock
+    private RestoreKbossBackupCommand cmdMock;
+
+    @Mock
+    private QemuImg qemuImgMock;
+
+    @Spy
+    @InjectMocks
+    private LibvirtRestoreKbossBackupCommandWrapper libvirtRestoreKbossBackupCommandWrapperSpy;
+
+    @Test
+    public void executeTestException() throws LibvirtException, QemuImgException {
+        doReturn(primaryDataStoreToMock).when(backupDeltaTOMock).getDataStore();
+        doReturn(Set.of(new Pair<>(backupDeltaTOMock, volumeObjectToMock1))).when(cmdMock).getBackupAndVolumePairs();
+        doReturn(null).when(libvirtRestoreKbossBackupCommandWrapperSpy).mountSecondaryStorages(any(), any(), any(), any());
+        doThrow(new QemuImgException("asd")).when(libvirtRestoreKbossBackupCommandWrapperSpy).restoreVolumes(any(), any(), any(), anyBoolean(), anyInt());
+
+        RestoreKbossBackupAnswer answer = (RestoreKbossBackupAnswer)libvirtRestoreKbossBackupCommandWrapperSpy.execute(cmdMock, libvirtComputingResourceMock);
+        assertFalse(answer.getResult());
+    }
+
+
+    @Test
+    public void executeTestLibvirtNotQuickRestore() throws LibvirtException, QemuImgException, IOException {
+        doReturn(primaryDataStoreToMock).when(backupDeltaTOMock).getDataStore();
+        doReturn(Set.of(new Pair<>(backupDeltaTOMock, volumeObjectToMock1))).when(cmdMock).getBackupAndVolumePairs();
+        doReturn(kvmStoragePoolManagerMock).when(libvirtComputingResourceMock).getStoragePoolMgr();
+        doReturn(kvmStoragePool1).when(kvmStoragePoolManagerMock).getStoragePoolByURI(any());
+        doReturn("uuid").when(kvmStoragePool1).getUuid();
+        doNothing().when(libvirtRestoreKbossBackupCommandWrapperSpy).restoreVolumes(any(), any(), any(), anyBoolean(), anyInt());
+        doNothing().when(libvirtRestoreKbossBackupCommandWrapperSpy).deleteDeltas(any(), any());
+
+        doReturn(false).when(cmdMock).isQuickRestore();
+
+        RestoreKbossBackupAnswer answer = (RestoreKbossBackupAnswer)libvirtRestoreKbossBackupCommandWrapperSpy.execute(cmdMock, libvirtComputingResourceMock);
+        assertTrue(answer.getResult());
+        verify(kvmStoragePoolManagerMock).deleteStoragePool(Storage.StoragePoolType.NetworkFilesystem, "uuid");
+    }
+
+
+    @Test
+    public void executeTestLibvirtQuickRestore() throws LibvirtException, QemuImgException, IOException {
+        doReturn(primaryDataStoreToMock).when(backupDeltaTOMock).getDataStore();
+        doReturn(Set.of(new Pair<>(backupDeltaTOMock, volumeObjectToMock1))).when(cmdMock).getBackupAndVolumePairs();
+        doReturn(kvmStoragePoolManagerMock).when(libvirtComputingResourceMock).getStoragePoolMgr();
+        doReturn(kvmStoragePool1).when(kvmStoragePoolManagerMock).getStoragePoolByURI(any());
+        doReturn("uuid").when(kvmStoragePool1).getUuid();
+        doNothing().when(libvirtRestoreKbossBackupCommandWrapperSpy).restoreVolumes(any(), any(), any(), anyBoolean(), anyInt());
+        doNothing().when(libvirtRestoreKbossBackupCommandWrapperSpy).deleteDeltas(any(), any());
+
+        doReturn(true).when(cmdMock).isQuickRestore();
+
+        RestoreKbossBackupAnswer answer = (RestoreKbossBackupAnswer)libvirtRestoreKbossBackupCommandWrapperSpy.execute(cmdMock, libvirtComputingResourceMock);
+        assertTrue(answer.getResult());
+        verify(kvmStoragePoolManagerMock, never()).deleteStoragePool(Storage.StoragePoolType.NetworkFilesystem, "uuid");
+    }
+
+    @Test
+    public void restoreVolumesTestQuickRestore() throws LibvirtException, QemuImgException {
+        doReturn(primaryDataStoreToMock).when(volumeObjectToMock1).getDataStore();
+        doReturn(kvmStoragePool2).when(kvmStoragePoolManagerMock).getStoragePool(any(), any());
+        doReturn("p2").when(kvmStoragePool2).getLocalPathFor(any());
+        doReturn(qemuImgMock).when(libvirtRestoreKbossBackupCommandWrapperSpy).getQemuImg(anyInt());
+
+        libvirtRestoreKbossBackupCommandWrapperSpy.restoreVolumes(Set.of(new Pair<>(backupDeltaTOMock, volumeObjectToMock1)), kvmStoragePool1, kvmStoragePoolManagerMock,
+                true, 1000);
+
+        verify(qemuImgMock).create(any(), (QemuImgFile)any());
+    }
+
+    @Test
+    public void restoreVolumesTestNormalRestore() throws LibvirtException, QemuImgException {
+        doReturn(primaryDataStoreToMock).when(volumeObjectToMock1).getDataStore();
+        doReturn(kvmStoragePool2).when(kvmStoragePoolManagerMock).getStoragePool(any(), any());
+        doReturn("p2").when(kvmStoragePool2).getLocalPathFor(any());
+        doReturn(qemuImgMock).when(libvirtRestoreKbossBackupCommandWrapperSpy).getQemuImg(anyInt());
+
+        libvirtRestoreKbossBackupCommandWrapperSpy.restoreVolumes(Set.of(new Pair<>(backupDeltaTOMock, volumeObjectToMock1)), kvmStoragePool1, kvmStoragePoolManagerMock,
+                false, 1000);
+
+        verify(qemuImgMock).convert(any(), any());
+    }
+
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRevertSnapshotCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRevertSnapshotCommandWrapperTest.java
index cfcb2a2f972d..368f963a9a8b 100644
--- a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRevertSnapshotCommandWrapperTest.java
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtRevertSnapshotCommandWrapperTest.java
@@ -148,8 +148,8 @@ public void validateRevertVolumeToSnapshotReplaceSuccessfully() throws LibvirtEx
         Mockito.doReturn(volumeObjectToMock).when(snapshotObjectToSecondaryMock).getVolume();
         Mockito.doReturn(pairStringSnapshotObjectToMock).when(libvirtRevertSnapshotCommandWrapperSpy).getSnapshot(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
         Mockito.doNothing().when(libvirtRevertSnapshotCommandWrapperSpy).replaceVolumeWithSnapshot(Mockito.any(), Mockito.any());
-        libvirtRevertSnapshotCommandWrapperSpy.revertVolumeToSnapshot(kvmStoragePoolSecondaryMock, snapshotObjectToPrimaryMock, snapshotObjectToSecondaryMock, kvmStoragePoolPrimaryMock, resourceMock
-        );
+        libvirtRevertSnapshotCommandWrapperSpy.revertVolumeToSnapshot(kvmStoragePoolSecondaryMock, snapshotObjectToPrimaryMock, snapshotObjectToSecondaryMock, kvmStoragePoolPrimaryMock, resourceMock,
+                false);
     }
 
     @Test (expected = CloudRuntimeException.class)
@@ -157,8 +157,8 @@ public void validateRevertVolumeToSnapshotReplaceVolumeThrowsQemuImgException()
         Mockito.doReturn(volumeObjectToMock).when(snapshotObjectToSecondaryMock).getVolume();
         Mockito.doReturn(pairStringSnapshotObjectToMock).when(libvirtRevertSnapshotCommandWrapperSpy).getSnapshot(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
         Mockito.doThrow(QemuImgException.class).when(libvirtRevertSnapshotCommandWrapperSpy).replaceVolumeWithSnapshot(Mockito.any(), Mockito.any());
-        libvirtRevertSnapshotCommandWrapperSpy.revertVolumeToSnapshot(kvmStoragePoolSecondaryMock, snapshotObjectToPrimaryMock, snapshotObjectToSecondaryMock, kvmStoragePoolPrimaryMock, resourceMock
-        );
+        libvirtRevertSnapshotCommandWrapperSpy.revertVolumeToSnapshot(kvmStoragePoolSecondaryMock, snapshotObjectToPrimaryMock, snapshotObjectToSecondaryMock, kvmStoragePoolPrimaryMock, resourceMock,
+                false);
     }
 
     @Test (expected = CloudRuntimeException.class)
@@ -167,6 +167,6 @@ public void validateRevertVolumeToSnapshotReplaceVolumeThrowsLibvirtException()
         Mockito.doReturn(pairStringSnapshotObjectToMock).when(libvirtRevertSnapshotCommandWrapperSpy).getSnapshot(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
         Mockito.doThrow(LibvirtException.class).when(libvirtRevertSnapshotCommandWrapperSpy).replaceVolumeWithSnapshot(Mockito.any(), Mockito.any());
         libvirtRevertSnapshotCommandWrapperSpy.revertVolumeToSnapshot(kvmStoragePoolSecondaryMock, snapshotObjectToPrimaryMock, snapshotObjectToSecondaryMock, kvmStoragePoolPrimaryMock, resourceMock
-        );
+        , false);
     }
 }
diff --git a/plugins/hypervisors/kvm/src/test/java/org/apache/cloudstack/utils/qemu/QemuImgTest.java b/plugins/hypervisors/kvm/src/test/java/org/apache/cloudstack/utils/qemu/QemuImgTest.java
index 140302590ba2..5b089ad37031 100644
--- a/plugins/hypervisors/kvm/src/test/java/org/apache/cloudstack/utils/qemu/QemuImgTest.java
+++ b/plugins/hypervisors/kvm/src/test/java/org/apache/cloudstack/utils/qemu/QemuImgTest.java
@@ -20,6 +20,11 @@
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
 
 import java.io.File;
 import java.nio.file.Path;
@@ -41,7 +46,9 @@
 import org.junit.runner.RunWith;
 import org.libvirt.Connect;
 import org.libvirt.LibvirtException;
+import org.mockito.Mock;
 import org.mockito.Mockito;
+import org.mockito.Spy;
 import org.mockito.junit.MockitoJUnitRunner;
 
 import com.cloud.utils.script.Script;
@@ -390,6 +397,21 @@ public void testHelpSupportsImageFormat() throws QemuImgException, LibvirtExcept
         Assert.assertFalse("should not support http", QemuImg.helpSupportsImageFormat(partialHelp, PhysicalDiskFormat.SHEEPDOG));
     }
 
+    @Test
+    public void testHelpSupportsImageFormatQemu101Header() throws QemuImgException, LibvirtException {
+        // qemu-img 10.1.0 (e.g. RHEL 9.8: qemu-kvm-10.1.0-17.el9_8.3) changed the
+        // help header from "Supported formats:" to "Supported image formats:"
+        String help = "Supported image formats:\n" +
+                "  blkdebug blklogwrites blkverify compress copy-before-write copy-on-read\n" +
+                "  file ftp ftps host_cdrom host_device http https io_uring luks nbd null-aio\n" +
+                "  null-co nvme nvme-io_uring preallocate qcow2 quorum raw rbd\n" +
+                "  snapshot-access throttle vdi vhdx virtio-blk-vfio-pci\n" +
+                "  virtio-blk-vhost-user virtio-blk-vhost-vdpa vmdk vpc\n";
+        Assert.assertTrue("should support luks", QemuImg.helpSupportsImageFormat(help, PhysicalDiskFormat.LUKS));
+        Assert.assertTrue("should support qcow2", QemuImg.helpSupportsImageFormat(help, PhysicalDiskFormat.QCOW2));
+        Assert.assertFalse("should not support sheepdog", QemuImg.helpSupportsImageFormat(help, PhysicalDiskFormat.SHEEPDOG));
+    }
+
     @Test
     public void testCheckAndRepair() throws LibvirtException {
         String filename = "/tmp/" + UUID.randomUUID() + ".qcow2";
@@ -417,8 +439,8 @@ public void addScriptOptionsFromMapAddsValidOptions() throws LibvirtException, Q
         QemuImg qemu = new QemuImg(0);
         qemu.addScriptOptionsFromMap(options, script);
 
-        Mockito.verify(script, Mockito.times(1)).add("-o");
-        Mockito.verify(script, Mockito.times(1)).add("key1=value1,key2=value2");
+        verify(script, Mockito.times(1)).add("-o");
+        verify(script, Mockito.times(1)).add("key1=value1,key2=value2");
     }
 
     @Test
@@ -429,7 +451,7 @@ public void addScriptOptionsFromMapHandlesEmptyOptions() throws LibvirtException
         QemuImg qemu = new QemuImg(0);
         qemu.addScriptOptionsFromMap(options, script);
 
-        Mockito.verify(script, Mockito.never()).add(Mockito.anyString());
+        verify(script, never()).add(Mockito.anyString());
     }
 
     @Test
@@ -439,7 +461,7 @@ public void addScriptOptionsFromMapHandlesNullOptions() throws LibvirtException,
         QemuImg qemu = new QemuImg(0);
         qemu.addScriptOptionsFromMap(null, script);
 
-        Mockito.verify(script, Mockito.never()).add(Mockito.anyString());
+        verify(script, never()).add(Mockito.anyString());
     }
 
     @Test
@@ -451,8 +473,8 @@ public void addScriptOptionsFromMapHandlesTrailingComma() throws LibvirtExceptio
         QemuImg qemu = new QemuImg(0);
         qemu.addScriptOptionsFromMap(options, script);
 
-        Mockito.verify(script, Mockito.times(1)).add("-o");
-        Mockito.verify(script, Mockito.times(1)).add("key1=value1");
+        verify(script, Mockito.times(1)).add("-o");
+        verify(script, Mockito.times(1)).add("key1=value1");
     }
 
     @Test
@@ -521,8 +543,8 @@ public void addScriptResizeOptionsFromMapAddsPreallocationOption() throws Libvir
         QemuImg qemuImg = new QemuImg(0);
         qemuImg.addScriptResizeOptionsFromMap(options, script);
 
-        Mockito.verify(script, Mockito.times(1)).add("--preallocation=metadata");
-        Mockito.verify(script, Mockito.never()).add("-o");
+        verify(script, Mockito.times(1)).add("--preallocation=metadata");
+        verify(script, never()).add("-o");
         assertTrue(options.isEmpty());
     }
 
@@ -534,7 +556,7 @@ public void addScriptResizeOptionsFromMapHandlesEmptyOptions() throws LibvirtExc
         QemuImg qemuImg = new QemuImg(0);
         qemuImg.addScriptResizeOptionsFromMap(options, script);
 
-        Mockito.verify(script, Mockito.never()).add(Mockito.anyString());
+        verify(script, never()).add(Mockito.anyString());
     }
 
     @Test
@@ -544,7 +566,7 @@ public void addScriptResizeOptionsFromMapHandlesNullOptions() throws LibvirtExce
         QemuImg qemuImg = new QemuImg(0);
         qemuImg.addScriptResizeOptionsFromMap(null, script);
 
-        Mockito.verify(script, Mockito.never()).add(Mockito.anyString());
+        verify(script, never()).add(Mockito.anyString());
     }
 
     @Test
@@ -557,9 +579,92 @@ public void addScriptResizeOptionsFromMapHandlesMixedOptions() throws LibvirtExc
         QemuImg qemuImg = new QemuImg(0);
         qemuImg.addScriptResizeOptionsFromMap(options, script);
 
-        Mockito.verify(script, Mockito.times(1)).add("--preallocation=full");
-        Mockito.verify(script, Mockito.times(1)).add("-o");
-        Mockito.verify(script, Mockito.times(1)).add("key=value");
+        verify(script, Mockito.times(1)).add("--preallocation=full");
+        verify(script, Mockito.times(1)).add("-o");
+        verify(script, Mockito.times(1)).add("key=value");
         assertFalse(options.containsKey(QemuImg.PREALLOCATION));
     }
+
+    @Spy
+    private QemuImg qemuImgSpy;
+
+    @Mock
+    private Script scriptMock;
+
+    @Mock
+    private QemuImgFile qemuImgFileMock1;
+
+    @Mock
+    private QemuImgFile qemuImgFileMock2;
+
+    @Test(expected = QemuImgException.class)
+    public void commitTestNullFileThrows() throws Exception {
+        qemuImgSpy.commit(null, null, false);
+    }
+
+    @Test
+    public void commitTestBasicCommand() throws Exception {
+        doReturn(scriptMock).when(qemuImgSpy).createScript(any(), anyLong());
+        doReturn(null).when(scriptMock).execute();
+        doReturn(null).when(qemuImgFileMock1).getFormat();
+        doReturn("file.qcow2").when(qemuImgFileMock1).getFileName();
+
+        qemuImgSpy.commit(qemuImgFileMock1, null, false);
+
+        verify(scriptMock).add("commit");
+        verify(scriptMock).add("file.qcow2");
+    }
+
+    @Test
+    public void commitTestWithFormat() throws Exception {
+        doReturn(scriptMock).when(qemuImgSpy).createScript(any(), anyLong());
+        doReturn(null).when(scriptMock).execute();
+        doReturn(PhysicalDiskFormat.QCOW2).when(qemuImgFileMock1).getFormat();
+        doReturn("file.qcow2").when(qemuImgFileMock1).getFileName();
+
+        qemuImgSpy.commit(qemuImgFileMock1, null, false);
+
+        verify(scriptMock).add("-f");
+        verify(scriptMock).add("qcow2");
+    }
+
+    @Test
+    public void commitTestWithBase() throws Exception {
+        doReturn(scriptMock).when(qemuImgSpy).createScript(any(), anyLong());
+        doReturn(null).when(scriptMock).execute();
+
+        doReturn(null).when(qemuImgFileMock1).getFormat();
+        doReturn("file.qcow2").when(qemuImgFileMock1).getFileName();
+        doReturn("base.qcow2").when(qemuImgFileMock2).getFileName();
+
+        qemuImgSpy.commit(qemuImgFileMock1, qemuImgFileMock2, true);
+
+        verify(scriptMock).add("-b");
+        verify(scriptMock).add("base.qcow2");
+        verify(scriptMock, never()).add("-d");
+    }
+
+    @Test
+    public void commitTestSkipEmptyingFiles() throws Exception {
+        doReturn(scriptMock).when(qemuImgSpy).createScript(any(), anyLong());
+        doReturn(null).when(scriptMock).execute();
+
+        doReturn(null).when(qemuImgFileMock1).getFormat();
+        doReturn("file.qcow2").when(qemuImgFileMock1).getFileName();
+
+        qemuImgSpy.commit(qemuImgFileMock1, null, true);
+
+        verify(scriptMock).add("-d");
+    }
+
+    @Test(expected = QemuImgException.class)
+    public void commitTestExecutionFails() throws Exception {
+        doReturn(scriptMock).when(qemuImgSpy).createScript(any(), anyLong());
+        doReturn("error").when(scriptMock).execute();
+
+        doReturn(null).when(qemuImgFileMock1).getFormat();
+        doReturn("file.qcow2").when(qemuImgFileMock1).getFileName();
+
+        qemuImgSpy.commit(qemuImgFileMock1, null, false);
+    }
 }
diff --git a/plugins/hypervisors/simulator/src/main/java/com/cloud/simulator/SimulatorGuru.java b/plugins/hypervisors/simulator/src/main/java/com/cloud/simulator/SimulatorGuru.java
index aae28c428b8d..a361018b0d8a 100644
--- a/plugins/hypervisors/simulator/src/main/java/com/cloud/simulator/SimulatorGuru.java
+++ b/plugins/hypervisors/simulator/src/main/java/com/cloud/simulator/SimulatorGuru.java
@@ -38,6 +38,7 @@
 import com.cloud.vm.VirtualMachineProfile;
 import com.cloud.vm.dao.VMInstanceDao;
 import com.cloud.vm.dao.NicDao;
+import org.apache.cloudstack.backup.BackupProvider;
 
 public class SimulatorGuru extends HypervisorGuruBase implements HypervisorGuru {
     @Inject
@@ -74,7 +75,7 @@ public VirtualMachineTO implement(VirtualMachineProfile vm) {
 
     @Override
     public VirtualMachine importVirtualMachineFromBackup(long zoneId, long domainId, long accountId, long userId,
-                                                  String vmInternalName, Backup backup) {
+                                                  String vmInternalName, Backup backup, BackupProvider backupProvider) {
         VMInstanceVO vm = instanceDao.findVMByInstanceNameIncludingRemoved(vmInternalName);
         if (vm.getRemoved() != null) {
             vm.setState(VirtualMachine.State.Stopped);
@@ -92,7 +93,7 @@ public VirtualMachine importVirtualMachineFromBackup(long zoneId, long domainId,
     }
 
     @Override
-    public boolean attachRestoredVolumeToVirtualMachine(long zoneId, String location, Backup.VolumeInfo volumeInfo, VirtualMachine vm, long poolId, Backup backup) {
+    public boolean attachRestoredVolumeToVirtualMachine(long zoneId, String location, Backup.VolumeInfo volumeInfo, VirtualMachine vm, long poolId, Backup backup, BackupProvider backupProvider) {
 
         VMInstanceVO targetVM = instanceDao.findVMByInstanceNameIncludingRemoved(vm.getName());
         List<VolumeVO> vmVolumes = volumeDao.findByInstance(targetVM.getId());
diff --git a/plugins/hypervisors/vmware/src/main/java/com/cloud/hypervisor/guru/VMwareGuru.java b/plugins/hypervisors/vmware/src/main/java/com/cloud/hypervisor/guru/VMwareGuru.java
index 1a8d9f7b59e2..f41bf3e76f84 100644
--- a/plugins/hypervisors/vmware/src/main/java/com/cloud/hypervisor/guru/VMwareGuru.java
+++ b/plugins/hypervisors/vmware/src/main/java/com/cloud/hypervisor/guru/VMwareGuru.java
@@ -41,6 +41,7 @@
 import com.vmware.vim25.VirtualMachinePowerState;
 import org.apache.cloudstack.acl.ControlledEntity;
 import org.apache.cloudstack.backup.Backup;
+import org.apache.cloudstack.backup.BackupProvider;
 import org.apache.cloudstack.engine.subsystem.api.storage.ObjectInDataStoreStateMachine;
 import org.apache.cloudstack.engine.subsystem.api.storage.PrimaryDataStore;
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeDataFactory;
@@ -1162,9 +1163,10 @@ private ManagedObjectReference getDestStoreMor(VirtualMachineMO vmMo) throws Exc
     }
 
     @Override
-    public VirtualMachine importVirtualMachineFromBackup(long zoneId, long domainId, long accountId, long userId, String vmInternalName, Backup backup) throws Exception {
+    public VirtualMachine importVirtualMachineFromBackup(long zoneId, long domainId, long accountId, long userId, String vmInternalName, Backup backup,
+            BackupProvider backupProvider) throws Exception {
         logger.debug(String.format("Trying to import VM [vmInternalName: %s] from Backup [%s].", vmInternalName,
-                ReflectionToStringBuilderUtils.reflectOnlySelectedFields(backup, "id", "uuid", "vmId", "externalId", "backupType")));
+                ReflectionToStringBuilderUtils.reflectOnlySelectedFields(backup, "id", "uuid", "vmId", "externalId", "type")));
         DatacenterMO dcMo = getDatacenterMO(zoneId);
         VirtualMachineMO vmToImport = dcMo.findVm(vmInternalName);
         if (vmToImport == null) {
@@ -1191,7 +1193,8 @@ public VirtualMachine importVirtualMachineFromBackup(long zoneId, long domainId,
     }
 
     @Override
-    public boolean attachRestoredVolumeToVirtualMachine(long zoneId, String location, Backup.VolumeInfo volumeInfo, VirtualMachine vm, long poolId, Backup backup)
+    public boolean attachRestoredVolumeToVirtualMachine(long zoneId, String location, Backup.VolumeInfo volumeInfo, VirtualMachine vm, long poolId, Backup backup,
+            BackupProvider backupProvider)
             throws Exception {
         DatacenterMO dcMo = getDatacenterMO(zoneId);
         VirtualMachineMO vmRestored = findVM(dcMo, location);
diff --git a/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/XenServerStorageProcessor.java b/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/XenServerStorageProcessor.java
index c9e6118340cc..a1d27b65abac 100644
--- a/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/XenServerStorageProcessor.java
+++ b/plugins/hypervisors/xenserver/src/main/java/com/cloud/hypervisor/xenserver/resource/XenServerStorageProcessor.java
@@ -859,12 +859,19 @@ public Answer cloneVolumeFromBaseTemplate(final CopyCommand cmd) {
         final DataTO srcData = cmd.getSrcTO();
         final DataTO destData = cmd.getDestTO();
         final VolumeObjectTO volume = (VolumeObjectTO) destData;
+        final DataStoreTO destStore = volume.getDataStore();
+        final boolean fullClone = destStore instanceof PrimaryDataStoreTO
+                && Boolean.TRUE.equals(((PrimaryDataStoreTO) destStore).isFullCloneFlag());
         VDI vdi = null;
         try {
             VDI tmpltvdi = null;
 
             tmpltvdi = getVDIbyUuid(conn, srcData.getPath());
-            vdi = tmpltvdi.createClone(conn, new HashMap<String, String>());
+            if (fullClone) {
+                vdi = tmpltvdi.copy(conn, tmpltvdi.getSR(conn));
+            } else {
+                vdi = tmpltvdi.createClone(conn, new HashMap<String, String>());
+            }
             Long virtualSize  = vdi.getVirtualSize(conn);
             if (volume.getSize() > virtualSize) {
                 logger.debug("Overriding provided Template's size with new size " + toHumanReadableSize(volume.getSize()) + " for volume: " + volume.getName());
diff --git a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java
index fea20eb124fc..aa5ddf0cd006 100644
--- a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java
+++ b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java
@@ -2986,9 +2986,8 @@ private void createNetworkOfferingForKubernetes(String offeringName, String offe
         defaultKubernetesServiceNetworkOfferingProviders.put(Service.UserData, provider);
         if (forVpc) {
             defaultKubernetesServiceNetworkOfferingProviders.put(Service.NetworkACL, forNsx ? Network.Provider.Nsx : provider);
-        } else {
-            defaultKubernetesServiceNetworkOfferingProviders.put(Service.Firewall, forNsx ? Network.Provider.Nsx : provider);
         }
+        defaultKubernetesServiceNetworkOfferingProviders.put(Service.Firewall, forNsx ? Network.Provider.Nsx : provider);
         defaultKubernetesServiceNetworkOfferingProviders.put(Service.Lb, forNsx ? Network.Provider.Nsx : provider);
         defaultKubernetesServiceNetworkOfferingProviders.put(Service.SourceNat, forNsx ? Network.Provider.Nsx : provider);
         defaultKubernetesServiceNetworkOfferingProviders.put(Service.StaticNat, forNsx ? Network.Provider.Nsx : provider);
diff --git a/plugins/integrations/kubernetes-service/src/test/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImplTest.java b/plugins/integrations/kubernetes-service/src/test/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImplTest.java
index 71949459c865..1fab5420c3c3 100644
--- a/plugins/integrations/kubernetes-service/src/test/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImplTest.java
+++ b/plugins/integrations/kubernetes-service/src/test/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImplTest.java
@@ -155,7 +155,7 @@ public void validateIsolatedNetworkIpRulesNoRules() {
     }
 
     private FirewallRuleVO createRule(int startPort, int endPort) {
-        FirewallRuleVO rule = new FirewallRuleVO(null, null, startPort, endPort, "tcp", 1, 1, 1, FirewallRule.Purpose.Firewall, List.of("0.0.0.0/0"), null, null, null, FirewallRule.TrafficType.Ingress);
+        FirewallRuleVO rule = new FirewallRuleVO(null, null, startPort, endPort, "tcp", 1L, 1, 1, FirewallRule.Purpose.Firewall, List.of("0.0.0.0/0"), null, null, null, FirewallRule.TrafficType.Ingress);
         return rule;
     }
 
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ServerAdapter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ServerAdapter.java
index 109fe71a8d75..8297c74864c3 100644
--- a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ServerAdapter.java
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ServerAdapter.java
@@ -1610,7 +1610,7 @@ public DiskAttachment attachInstanceDisk(final String vmUuid, final DiskAttachme
         context.setEventDetails("Volume Id: " + volumeVO.getUuid() + " VmId: " + vmVo.getUuid());
         context.setEventResourceType(ApiCommandResourceType.Volume);
         context.setEventResourceId(volumeVO.getId());
-        Volume volume = volumeApiService.attachVolumeToVM(vmVo.getId(), volumeVO.getId(), deviceId, true);
+        Volume volume = volumeApiService.attachVolumeToVM(vmVo.getId(), volumeVO.getId(), deviceId, true, false);
         processInstanceRestoreConfigIfNeeded(vmVo, volume);
         VolumeJoinVO attachedVolumeVO = volumeJoinDao.findById(volume.getId());
         return VolumeJoinVOToDiskConverter.toDiskAttachment(attachedVolumeVO, this::getVolumePhysicalSize);
@@ -1696,7 +1696,7 @@ public void deleteDisk(String uuid) {
         context.setEventDetails("Volume Id: " + vo.getUuid());
         context.setEventResourceType(ApiCommandResourceType.Volume);
         context.setEventResourceId(vo.getId());
-        volumeApiService.destroyVolume(vo.getId(), CallContext.current().getCallingAccount(), true, false);
+        volumeApiService.destroyVolume(vo.getId(), CallContext.current().getCallingAccount(), true, false, null);
     }
 
     @ApiAccess(command = UpdateVolumeCmd.class)
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/adapter/ServerAdapterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/adapter/ServerAdapterTest.java
index f3f1f45584f4..b105e7306e5f 100644
--- a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/adapter/ServerAdapterTest.java
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/adapter/ServerAdapterTest.java
@@ -970,7 +970,7 @@ public void testDeleteDisk_Found_DeletesVolume() {
 
         serverAdapter.deleteDisk("vol-uuid");
 
-        verify(volumeApiService).destroyVolume(10L, account, true, false);
+        verify(volumeApiService).destroyVolume(10L, account, true, false, null);
     }
 
 
diff --git a/plugins/network-elements/palo-alto/src/test/java/com/cloud/network/resource/PaloAltoResourceTest.java b/plugins/network-elements/palo-alto/src/test/java/com/cloud/network/resource/PaloAltoResourceTest.java
index 58f962f13727..ae8520e005a7 100644
--- a/plugins/network-elements/palo-alto/src/test/java/com/cloud/network/resource/PaloAltoResourceTest.java
+++ b/plugins/network-elements/palo-alto/src/test/java/com/cloud/network/resource/PaloAltoResourceTest.java
@@ -290,7 +290,7 @@ public void addEgressFirewallRule() throws ConfigurationException, Exception {
         List<FirewallRuleTO> rules = new ArrayList<FirewallRuleTO>();
         List<String> cidrList = new ArrayList<String>();
         cidrList.add("0.0.0.0/0");
-        FirewallRuleVO activeVO = new FirewallRuleVO(null, null, 80, 80, "tcp", 1, 1, 1, Purpose.Firewall, cidrList, null, null, null, FirewallRule.TrafficType.Egress);
+        FirewallRuleVO activeVO = new FirewallRuleVO(null, null, 80, 80, "tcp", 1L, 1, 1, Purpose.Firewall, cidrList, null, null, null, FirewallRule.TrafficType.Egress);
         FirewallRuleTO active = new FirewallRuleTO(activeVO, Long.toString(vlanId), null, Purpose.Firewall, FirewallRule.TrafficType.Egress);
         rules.add(active);
 
@@ -319,7 +319,7 @@ public void removeEgressFirewallRule() throws ConfigurationException, Exception
 
         long vlanId = 3954;
         List<FirewallRuleTO> rules = new ArrayList<FirewallRuleTO>();
-        FirewallRuleVO revokedVO = new FirewallRuleVO(null, null, 80, 80, "tcp", 1, 1, 1, Purpose.Firewall, null, null, null, null, FirewallRule.TrafficType.Egress);
+        FirewallRuleVO revokedVO = new FirewallRuleVO(null, null, 80, 80, "tcp", 1L, 1, 1, Purpose.Firewall, null, null, null, null, FirewallRule.TrafficType.Egress);
         revokedVO.setState(State.Revoke);
         FirewallRuleTO revoked = new FirewallRuleTO(revokedVO, Long.toString(vlanId), null, Purpose.Firewall, FirewallRule.TrafficType.Egress);
         rules.add(revoked);
diff --git a/plugins/pom.xml b/plugins/pom.xml
index e1e1ba08889b..bcd1ca59f03b 100755
--- a/plugins/pom.xml
+++ b/plugins/pom.xml
@@ -63,6 +63,7 @@
         <module>backup/dummy</module>
         <module>backup/networker</module>
         <module>backup/nas</module>
+        <module>backup/kboss</module>
 
         <module>ca/root-ca</module>
 
diff --git a/plugins/storage/image/default/src/main/java/org/apache/cloudstack/storage/datastore/driver/CloudStackImageStoreDriverImpl.java b/plugins/storage/image/default/src/main/java/org/apache/cloudstack/storage/datastore/driver/CloudStackImageStoreDriverImpl.java
index 179d68efea7f..f4c310be40f4 100644
--- a/plugins/storage/image/default/src/main/java/org/apache/cloudstack/storage/datastore/driver/CloudStackImageStoreDriverImpl.java
+++ b/plugins/storage/image/default/src/main/java/org/apache/cloudstack/storage/datastore/driver/CloudStackImageStoreDriverImpl.java
@@ -66,15 +66,15 @@ public DataStoreTO getStoreTO(DataStore store) {
     }
 
     private String createObjectNameForExtractUrl(String installPath, ImageFormat format, DataObject dataObject) {
-        String objectNameInUrl = dataObject.getName();
+        String objectNameInUrl;
         try {
-            objectNameInUrl = cleanObjectName(objectNameInUrl);
+            objectNameInUrl = cleanObjectName(dataObject.getName());
         } catch (Exception e) {
             objectNameInUrl = UUID.randomUUID().toString();
         }
 
         if (format != null) {
-            if (dataObject.getTO() != null
+            if (dataObject != null && dataObject.getTO() != null
                     && DataObjectType.VOLUME.equals(dataObject.getTO().getObjectType())
                     && HypervisorType.KVM.equals(dataObject.getTO().getHypervisorType())) {
                 // Fix: The format of KVM volumes on image store is qcow2
diff --git a/plugins/storage/sharedfs/storagevm/src/main/java/org/apache/cloudstack/storage/sharedfs/lifecycle/StorageVmSharedFSLifeCycle.java b/plugins/storage/sharedfs/storagevm/src/main/java/org/apache/cloudstack/storage/sharedfs/lifecycle/StorageVmSharedFSLifeCycle.java
index f47a35ced44a..ed799e9030be 100644
--- a/plugins/storage/sharedfs/storagevm/src/main/java/org/apache/cloudstack/storage/sharedfs/lifecycle/StorageVmSharedFSLifeCycle.java
+++ b/plugins/storage/sharedfs/storagevm/src/main/java/org/apache/cloudstack/storage/sharedfs/lifecycle/StorageVmSharedFSLifeCycle.java
@@ -298,7 +298,7 @@ public boolean deleteSharedFS(SharedFS sharedFS) {
             expunge = true;
             forceExpunge = true;
         }
-        volumeApiService.destroyVolume(volume.getId(), CallContext.current().getCallingAccount(), expunge, forceExpunge);
+        volumeApiService.destroyVolume(volume.getId(), CallContext.current().getCallingAccount(), expunge, forceExpunge, null);
         return true;
     }
 
diff --git a/plugins/storage/volume/default/src/main/java/org/apache/cloudstack/storage/datastore/driver/CloudStackPrimaryDataStoreDriverImpl.java b/plugins/storage/volume/default/src/main/java/org/apache/cloudstack/storage/datastore/driver/CloudStackPrimaryDataStoreDriverImpl.java
index 3e9fa8a5438d..d002cd1caa4f 100644
--- a/plugins/storage/volume/default/src/main/java/org/apache/cloudstack/storage/datastore/driver/CloudStackPrimaryDataStoreDriverImpl.java
+++ b/plugins/storage/volume/default/src/main/java/org/apache/cloudstack/storage/datastore/driver/CloudStackPrimaryDataStoreDriverImpl.java
@@ -29,6 +29,7 @@
 import com.cloud.agent.api.to.DiskTO;
 import com.cloud.ha.HighAvailabilityManager;
 import com.cloud.storage.VolumeVO;
+import org.apache.cloudstack.backup.InternalBackupService;
 import org.apache.cloudstack.engine.orchestration.service.VolumeOrchestrationService;
 import org.apache.cloudstack.engine.subsystem.api.storage.ChapInfo;
 import org.apache.cloudstack.engine.subsystem.api.storage.CopyCommandResult;
@@ -146,6 +147,9 @@ public Map<String, String> getCapabilities() {
     @Inject
     private AgentManager agentMgr;
 
+    @Inject
+    private InternalBackupService internalBackupService;
+
     @Override
     public DataTO getTO(DataObject data) {
         return null;
@@ -253,12 +257,14 @@ private boolean commandCanBypassHostMaintenance(DataObject data) {
 
     @Override
     public void deleteAsync(DataStore dataStore, DataObject data, AsyncCompletionCallback<CommandResult> callback) {
-        DeleteCommand cmd = new DeleteCommand(data.getTO());
+        DataTO dataTO = data.getTO();
+        DeleteCommand cmd = new DeleteCommand(dataTO);
         cmd.setBypassHostMaintenance(commandCanBypassHostMaintenance(data));
         CommandResult result = new CommandResult();
         try {
             EndPoint ep;
             if (data.getType() == DataObjectType.VOLUME) {
+                internalBackupService.configureChainInfo(dataTO, cmd);
                 ep = epSelector.select(data, StorageAction.DELETEVOLUME);
             } else if (data.getType() == DataObjectType.SNAPSHOT) {
                 ep = epSelector.select(data, StorageAction.DELETESNAPSHOT);
@@ -431,22 +437,20 @@ public void revertSnapshot(SnapshotInfo snapshot, SnapshotInfo snapshotOnPrimary
         if (snapshotOnPrimaryStore != null) {
             dataOnPrimaryStorage = (SnapshotObjectTO)snapshotOnPrimaryStore.getTO();
         }
-        RevertSnapshotCommand cmd = new RevertSnapshotCommand((SnapshotObjectTO)snapshot.getTO(), dataOnPrimaryStorage);
+
+        SnapshotObjectTO snapshotObjectTO = (SnapshotObjectTO)snapshot.getTO();
+
+        RevertSnapshotCommand cmd = new RevertSnapshotCommand(snapshotObjectTO, dataOnPrimaryStorage);
+        internalBackupService.configureChainInfo(snapshotObjectTO.getVolume(), cmd);
 
         CommandResult result = new CommandResult();
         try {
             EndPoint ep = null;
-            VolumeInfo volumeInfo = volFactory.getVolume(snapshot.getVolumeId(), DataStoreRole.Primary);
-
-            StoragePoolVO storagePool = primaryStoreDao.findById(volumeInfo.getPoolId());
-            if (storagePool != null && storagePool.getPoolType() == StoragePoolType.CLVM) {
-                ep = epSelector.select(volumeInfo);
+            if (snapshotOnPrimaryStore != null) {
+                ep = epSelector.select(snapshotOnPrimaryStore);
             } else {
-                if (snapshotOnPrimaryStore != null) {
-                    ep = epSelector.select(snapshotOnPrimaryStore);
-                } else {
-                    ep = epSelector.select(volumeInfo);
-                }
+                VolumeInfo volumeInfo = volFactory.getVolume(snapshot.getVolumeId(), DataStoreRole.Primary);
+                ep = epSelector.select(volumeInfo);
             }
 
             if ( ep == null ){
diff --git a/plugins/storage/volume/flasharray/src/main/java/org/apache/cloudstack/storage/datastore/adapter/flasharray/FlashArrayAdapter.java b/plugins/storage/volume/flasharray/src/main/java/org/apache/cloudstack/storage/datastore/adapter/flasharray/FlashArrayAdapter.java
index 01207c6d224d..fae94bb1bea0 100644
--- a/plugins/storage/volume/flasharray/src/main/java/org/apache/cloudstack/storage/datastore/adapter/flasharray/FlashArrayAdapter.java
+++ b/plugins/storage/volume/flasharray/src/main/java/org/apache/cloudstack/storage/datastore/adapter/flasharray/FlashArrayAdapter.java
@@ -28,10 +28,13 @@
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.ConcurrentHashMap;
 
 import javax.net.ssl.HostnameVerifier;
 import javax.net.ssl.SSLContext;
 
+import org.apache.commons.collections4.CollectionUtils;
 import org.apache.http.Header;
 import org.apache.http.NameValuePair;
 import org.apache.cloudstack.storage.datastore.adapter.ProviderAdapter;
@@ -62,6 +65,7 @@
 import com.cloud.utils.exception.CloudRuntimeException;
 import com.fasterxml.jackson.core.JsonProcessingException;
 import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
@@ -86,6 +90,10 @@ public class FlashArrayAdapter implements ProviderAdapter {
     private static final String API_LOGIN_VERSION_DEFAULT = "1.19";
     private static final String API_VERSION_DEFAULT = "2.23";
 
+    // URLs for which the legacy-auth deprecation WARN has already been emitted,
+    // so we don't spam the logs once per refresh per pool while it's still configured.
+    private static final Set<String> WARNED_LEGACY_URLS = ConcurrentHashMap.newKeySet();
+
     static final ObjectMapper mapper = new ObjectMapper();
     public String pod = null;
     public String hostgroup = null;
@@ -492,18 +500,49 @@ public void disconnect() {
     @Override
     public ProviderVolumeStorageStats getManagedStorageStats() {
         FlashArrayPod pod = getVolumeNamespace(this.pod);
-        // just in case
-        if (pod == null || pod.getFootprint() == 0) {
+        if (pod == null) {
             return null;
         }
         Long capacityBytes = pod.getQuotaLimit();
-        Long usedBytes = pod.getQuotaLimit() - (pod.getQuotaLimit() - pod.getFootprint());
+        if (capacityBytes == null || capacityBytes == 0) {
+            // Pod has no explicit quota set; report the array total physical
+            // capacity so the CloudStack allocator has a real ceiling to plan
+            // against rather than bailing out with a zero-capacity pool.
+            capacityBytes = getArrayTotalCapacity();
+        }
+        if (capacityBytes == null || capacityBytes == 0) {
+            return null;
+        }
+        Long usedBytes = pod.getFootprint();
+        if (usedBytes == null) {
+            usedBytes = 0L;
+        }
         ProviderVolumeStorageStats stats = new ProviderVolumeStorageStats();
         stats.setCapacityInBytes(capacityBytes);
         stats.setActualUsedInBytes(usedBytes);
         return stats;
     }
 
+    private Long getArrayTotalCapacity() {
+        try {
+            FlashArrayList<Map<String, Object>> list = GET("/arrays?space=true",
+                    new TypeReference<FlashArrayList<Map<String, Object>>>() {
+                    });
+            if (list != null && CollectionUtils.isNotEmpty(list.getItems())) {
+                Object cap = list.getItems().get(0).get("capacity");
+                if (cap instanceof Number) {
+                    return ((Number) cap).longValue();
+                }
+            }
+        } catch (Exception e) {
+            logger.warn("Could not retrieve total capacity for FlashArray [{}] (pod [{}]): {}",
+                    this.url, this.pod, e.getMessage());
+            logger.debug("Stack trace for array total capacity lookup failure on FlashArray [{}] (pod [{}])",
+                    this.url, this.pod, e);
+        }
+        return null;
+    }
+
     @Override
     public ProviderVolumeStats getVolumeStats(ProviderAdapterContext context, ProviderAdapterDataObject dataObject) {
         ProviderVolume vol = getVolume(dataObject.getExternalName());
@@ -557,6 +596,91 @@ private String getAccessToken() {
         return accessToken;
     }
 
+    /**
+     * Discover the latest supported Purity REST API version by hitting the unauthenticated
+     * {@code /api/api_version} endpoint (returns {@code {"version":["1.0",...,"2.36"]}}).
+     * The discovered version is stored on {@link #apiVersion}; on failure the caller-configured
+     * default remains in place.
+     */
+    private void fetchApiVersionFromPurity(CloseableHttpClient client) {
+        HttpGet vReq = new HttpGet(url + "/api_version");
+        CloseableHttpResponse vResp = null;
+        try {
+            vResp = client.execute(vReq);
+            if (vResp.getStatusLine().getStatusCode() == 200) {
+                JsonNode root = mapper.readTree(vResp.getEntity().getContent());
+                JsonNode versions = root.get("version");
+                if (versions != null && versions.isArray() && versions.size() > 0) {
+                    apiVersion = versions.get(versions.size() - 1).asText();
+                }
+            } else {
+                logger.warn("Unexpected HTTP " + vResp.getStatusLine().getStatusCode()
+                        + " from FlashArray [" + url + "] /api_version, falling back to default "
+                        + API_VERSION_DEFAULT);
+            }
+        } catch (Exception e) {
+            logger.warn("Failed to discover Purity REST API version from " + url
+                    + "/api_version, falling back to default " + API_VERSION_DEFAULT, e);
+        } finally {
+            if (vResp != null) {
+                try {
+                    vResp.close();
+                } catch (IOException e) {
+                    logger.debug("Error closing /api_version response from FlashArray [" + url + "]", e);
+                }
+            }
+        }
+    }
+
+    /**
+     * Exchange the operator-configured username/password for a long-lived Purity api-token
+     * via REST 1.x {@code /auth/apitoken}. Emits the once-per-URL deprecation WARN.
+     * @return the api-token to feed into the REST 2.x /login exchange.
+     */
+    private String getApiTokenUsingUserPass(CloseableHttpClient client) throws IOException {
+        if (WARNED_LEGACY_URLS.add(url)) {
+            logger.warn("FlashArray adapter at [" + url + "] is using deprecated username/password "
+                    + "login against Purity REST 1.x. Replace with a pre-minted "
+                    + ProviderAdapter.API_TOKEN_KEY + " detail; the username/password code path will be "
+                    + "removed in a future release.");
+        }
+        HttpPost request = new HttpPost(url + "/" + apiLoginVersion + "/auth/apitoken");
+        ArrayList<NameValuePair> postParms = new ArrayList<NameValuePair>();
+        postParms.add(new BasicNameValuePair("username", username));
+        postParms.add(new BasicNameValuePair("password", password));
+        request.setEntity(new UrlEncodedFormEntity(postParms, "UTF-8"));
+        CloseableHttpResponse response = null;
+        try {
+            response = client.execute(request);
+            int statusCode = response.getStatusLine().getStatusCode();
+            if (statusCode == 200 || statusCode == 201) {
+                FlashArrayApiToken legacyToken = mapper.readValue(response.getEntity().getContent(),
+                        FlashArrayApiToken.class);
+                if (legacyToken == null || legacyToken.getApiToken() == null) {
+                    throw new CloudRuntimeException(
+                            "Authentication responded successfully but no api token was returned");
+                }
+                return legacyToken.getApiToken();
+            } else if (statusCode == 401 || statusCode == 403) {
+                throw new CloudRuntimeException(
+                        "Authentication or Authorization to FlashArray [" + url + "] with user [" + username
+                                + "] failed, unable to retrieve session token");
+            } else {
+                throw new CloudRuntimeException(
+                        "Unexpected HTTP response code from FlashArray [" + url + "] - [" + statusCode
+                                + "] - " + response.getStatusLine().getReasonPhrase());
+            }
+        } finally {
+            if (response != null) {
+                try {
+                    response.close();
+                } catch (IOException e) {
+                    logger.debug("Error closing legacy auth/apitoken response from FlashArray [" + url + "]", e);
+                }
+            }
+        }
+    }
+
     private synchronized void refreshSession(boolean force) {
         try {
             if (force || keyExpiration < System.currentTimeMillis()) {
@@ -631,9 +755,11 @@ private void login() {
         }
 
         apiVersion = connectionDetails.get(FlashArrayAdapter.API_VERSION);
-        if (apiVersion == null) {
+        boolean apiVersionExplicit = apiVersion != null;
+        if (!apiVersionExplicit) {
             apiVersion = queryParms.get(FlashArrayAdapter.API_VERSION);
-            if (apiVersion == null) {
+            apiVersionExplicit = apiVersion != null;
+            if (!apiVersionExplicit) {
                 apiVersion = API_VERSION_DEFAULT;
             }
         }
@@ -700,72 +826,66 @@ private void login() {
             skipTlsValidation = true;
         }
 
+        // Resolve the long-lived API token. Prefer a pre-minted api_token (Purity REST 2.x flow);
+        // fall back to legacy username/password auth via Purity REST 1.x for backward compatibility.
+        String apiToken = connectionDetails.get(ProviderAdapter.API_TOKEN_KEY);
+        if (apiToken != null && apiToken.isEmpty()) {
+            apiToken = null;
+        }
+        boolean usingLegacyUserPass = apiToken == null;
+        if (usingLegacyUserPass && (username == null || password == null)) {
+            throw new CloudRuntimeException("FlashArray adapter requires either " + ProviderAdapter.API_TOKEN_KEY
+                    + " (preferred) or both " + ProviderAdapter.API_USERNAME_KEY + " and "
+                    + ProviderAdapter.API_PASSWORD_KEY + " in the connection details");
+        }
+
+        CloseableHttpClient client = getClient();
         CloseableHttpResponse response = null;
         try {
-            HttpPost request = new HttpPost(url + "/" + apiLoginVersion + "/auth/apitoken");
-            // request.addHeader("Content-Type", "application/json");
-            // request.addHeader("Accept", "application/json");
-            ArrayList<NameValuePair> postParms = new ArrayList<NameValuePair>();
-            postParms.add(new BasicNameValuePair("username", username));
-            postParms.add(new BasicNameValuePair("password", password));
-            request.setEntity(new UrlEncodedFormEntity(postParms, "UTF-8"));
-            CloseableHttpClient client = getClient();
-            response = (CloseableHttpResponse) client.execute(request);
-
-            int statusCode = response.getStatusLine().getStatusCode();
-            FlashArrayApiToken apitoken = null;
-            if (statusCode == 200 | statusCode == 201) {
-                apitoken = mapper.readValue(response.getEntity().getContent(), FlashArrayApiToken.class);
-                if (apitoken == null) {
-                    throw new CloudRuntimeException(
-                            "Authentication responded successfully but no api token was returned");
-                }
-            } else if (statusCode == 401 || statusCode == 403) {
-                throw new CloudRuntimeException(
-                        "Authentication or Authorization to FlashArray [" + url + "] with user [" + username
-                                + "] failed, unable to retrieve session token");
-            } else {
-                throw new CloudRuntimeException(
-                        "Unexpected HTTP response code from FlashArray [" + url + "] - [" + statusCode
-                                + "] - " + response.getStatusLine().getReasonPhrase());
+            // Discover the latest supported API version from the array unless one was explicitly configured.
+            // GET /api/api_version is unauthenticated and returns {"version":["1.0",...,"2.36"]}.
+            if (!apiVersionExplicit) {
+                fetchApiVersionFromPurity(client);
             }
 
-            // now we need to get the access token
-            request = new HttpPost(url + "/" + apiVersion + "/login");
-            request.addHeader("api-token", apitoken.getApiToken());
-            response = (CloseableHttpResponse) client.execute(request);
+            if (usingLegacyUserPass) {
+                apiToken = getApiTokenUsingUserPass(client);
+            }
 
-            statusCode = response.getStatusLine().getStatusCode();
-            if (statusCode == 200 | statusCode == 201) {
+            // Exchange the long-lived api-token for a short-lived x-auth-token (REST 2.x).
+            HttpPost request = new HttpPost(url + "/" + apiVersion + "/login");
+            request.addHeader("api-token", apiToken);
+            response = client.execute(request);
+            int statusCode = response.getStatusLine().getStatusCode();
+            if (statusCode == 200 || statusCode == 201) {
                 Header[] headers = response.getHeaders("x-auth-token");
                 if (headers == null || headers.length == 0) {
                     throw new CloudRuntimeException(
-                            "Getting access token responded successfully but access token was not available");
+                            "FlashArray /login responded successfully but no x-auth-token header was returned");
                 }
                 accessToken = headers[0].getValue();
             } else if (statusCode == 401 || statusCode == 403) {
                 throw new CloudRuntimeException(
-                        "Authentication or Authorization to FlashArray [" + url + "] with user [" + username
-                                + "] failed, unable to retrieve session token");
+                        "FlashArray [" + url + "] rejected the api-token at /" + apiVersion + "/login");
             } else {
                 throw new CloudRuntimeException(
-                        "Unexpected HTTP response code from FlashArray [" + url + "] - [" + statusCode
-                                + "] - " + response.getStatusLine().getReasonPhrase());
+                        "Unexpected HTTP response code from FlashArray [" + url + "] /" + apiVersion
+                                + "/login - [" + statusCode + "] - "
+                                + response.getStatusLine().getReasonPhrase());
             }
-
         } catch (UnsupportedEncodingException e) {
-            throw new CloudRuntimeException("Error creating input for login, check username/password encoding");
+            throw new CloudRuntimeException("Error encoding login form for FlashArray [" + url + "]", e);
         } catch (UnsupportedOperationException e) {
             throw new CloudRuntimeException("Error processing login response from FlashArray [" + url + "]", e);
         } catch (IOException e) {
             throw new CloudRuntimeException("Error sending login request to FlashArray [" + url + "]", e);
         } finally {
-            try {
-                if (response != null) {
+            if (response != null) {
+                try {
                     response.close();
+                } catch (IOException e) {
+                    logger.debug("Error closing response from login attempt to FlashArray", e);
                 }
-            } catch (IOException e) {
-                logger.debug("Error closing response from login attempt to FlashArray", e);
             }
         }
     }
@@ -933,7 +1053,7 @@ private <T> T PATCH(String path, Object input, final TypeReference<T> type) {
             request.setEntity(new StringEntity(data));
 
             CloseableHttpClient client = getClient();
-            response = (CloseableHttpResponse) client.execute(request);
+            response = client.execute(request);
 
             final int statusCode = response.getStatusLine().getStatusCode();
             if (statusCode == 200 || statusCode == 201) {
@@ -988,7 +1108,7 @@ private <T> T GET(String path, final TypeReference<T> type) {
             request.addHeader("X-auth-token", getAccessToken());
 
             CloseableHttpClient client = getClient();
-            response = (CloseableHttpResponse) client.execute(request);
+            response = client.execute(request);
             final int statusCode = response.getStatusLine().getStatusCode();
             if (statusCode == 200) {
                 try {
@@ -1030,7 +1150,7 @@ private void DELETE(String path) {
             request.addHeader("X-auth-token", getAccessToken());
 
             CloseableHttpClient client = getClient();
-            response = (CloseableHttpResponse) client.execute(request);
+            response = client.execute(request);
             final int statusCode = response.getStatusLine().getStatusCode();
             if (statusCode == 200 || statusCode == 404 || statusCode == 400) {
                 // this means the volume was deleted successfully, or doesn't exist (effective
diff --git a/plugins/storage/volume/linstor/CHANGELOG.md b/plugins/storage/volume/linstor/CHANGELOG.md
index 070a752db04f..a6ab050b090e 100644
--- a/plugins/storage/volume/linstor/CHANGELOG.md
+++ b/plugins/storage/volume/linstor/CHANGELOG.md
@@ -24,6 +24,14 @@ All notable changes to Linstor CloudStack plugin will be documented in this file
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [2026-06-24]
+
+### Fixed
+
+- Restore of encrypted volume snapshots: snapshots of encrypted volumes are now
+  stored as LUKS-encrypted qcow2 files and decrypted on revert (previously the
+  restored data was corrupted and the root device unbootable).
+
 ## [2026-06-03]
 
 ### Added
diff --git a/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LinstorBackupSnapshotCommandWrapper.java b/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LinstorBackupSnapshotCommandWrapper.java
index fab4829da551..c111d320cb4e 100644
--- a/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LinstorBackupSnapshotCommandWrapper.java
+++ b/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LinstorBackupSnapshotCommandWrapper.java
@@ -18,6 +18,10 @@
 
 import java.io.File;
 import java.io.IOException;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
 
 import com.cloud.agent.api.to.DataStoreTO;
 import com.cloud.agent.api.to.NfsTO;
@@ -31,9 +35,11 @@
 import com.cloud.utils.script.Script;
 import org.apache.cloudstack.storage.command.CopyCmdAnswer;
 import org.apache.cloudstack.storage.to.SnapshotObjectTO;
+import org.apache.cloudstack.utils.cryptsetup.KeyFile;
 import org.apache.cloudstack.utils.qemu.QemuImg;
 import org.apache.cloudstack.utils.qemu.QemuImgException;
 import org.apache.cloudstack.utils.qemu.QemuImgFile;
+import org.apache.cloudstack.utils.qemu.QemuObject;
 import org.apache.commons.io.FileUtils;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
@@ -83,6 +89,7 @@ private String convertImageToQCow2(
         final String srcPath,
         final SnapshotObjectTO dst,
         final KVMStoragePool secondaryPool,
+        final byte[] passphrase,
         int waitMilliSeconds
         )
         throws LibvirtException, QemuImgException, IOException
@@ -94,9 +101,22 @@ private String convertImageToQCow2(
         final QemuImgFile srcFile = new QemuImgFile(srcPath, QemuImg.PhysicalDiskFormat.RAW);
         final QemuImgFile dstFile = new QemuImgFile(dstPath, QemuImg.PhysicalDiskFormat.QCOW2);
 
-        // NOTE: the qemu img will also contain the drbd metadata at the end
         final QemuImg qemu = new QemuImg(waitMilliSeconds);
-        qemu.convert(srcFile, dstFile);
+        if (passphrase != null && passphrase.length > 0) {
+            // Encrypted volumes are backed up from their decrypted DRBD device, so the snapshot
+            // data here is plaintext. Encrypt the destination qcow2 with the volume's passphrase
+            // (LUKS), so the snapshot is not stored in clear text on secondary storage.
+            try (KeyFile keyFile = new KeyFile(passphrase)) {
+                final Map<String, String> options = new HashMap<>();
+                final List<QemuObject> qemuObjects = new ArrayList<>();
+                qemuObjects.add(QemuObject.prepareSecretForQemuImg(QemuImg.PhysicalDiskFormat.QCOW2,
+                    QemuObject.EncryptFormat.LUKS, keyFile.toString(), "sec0", options));
+                qemu.convert(srcFile, dstFile, options, qemuObjects, null, true);
+            }
+        } else {
+            // NOTE: the qemu img will also contain the drbd metadata at the end
+            qemu.convert(srcFile, dstFile);
+        }
         LOGGER.info("Backup snapshot '{}' to '{}'", srcPath, dstPath);
         return dstPath;
     }
@@ -153,14 +173,21 @@ public CopyCmdAnswer execute(LinstorBackupSnapshotCommand cmd, LibvirtComputingR
 
             secondaryPool = storagePoolMgr.getStoragePoolByURI(dstDataStore.getUrl());
 
-            String dstPath = convertImageToQCow2(srcPath, dst, secondaryPool, cmd.getWaitInMillSeconds());
+            final byte[] passphrase = src.getVolume() != null ? src.getVolume().getPassphrase() : null;
+            final boolean encrypted = passphrase != null && passphrase.length > 0;
 
-            // resize to real volume size, cutting of drbd metadata
-            String result = qemuShrink(dstPath, src.getVolume().getSize(), cmd.getWaitInMillSeconds());
-            if (result != null) {
-                return new CopyCmdAnswer("qemu-img shrink failed: " + result);
+            String dstPath = convertImageToQCow2(srcPath, dst, secondaryPool, passphrase, cmd.getWaitInMillSeconds());
+
+            if (!encrypted) {
+                // resize to real volume size, cutting of drbd metadata
+                // For encrypted volumes the source is the decrypted DRBD device (already net-sized,
+                // no drbd metadata to cut); shrinking an encrypted qcow2 would also need the secret.
+                String result = qemuShrink(dstPath, src.getVolume().getSize(), cmd.getWaitInMillSeconds());
+                if (result != null) {
+                    return new CopyCmdAnswer("qemu-img shrink failed: " + result);
+                }
+                LOGGER.info("Backup shrunk " + dstPath + " to actual size " + src.getVolume().getSize());
             }
-            LOGGER.info("Backup shrunk " + dstPath + " to actual size " + src.getVolume().getSize());
 
             SnapshotObjectTO snapshot = setCorrectSnapshotSize(dst, dstPath);
             LOGGER.info("Actual file size for '{}' is {}", dstPath, snapshot.getPhysicalSize());
@@ -171,6 +198,9 @@ public CopyCmdAnswer execute(LinstorBackupSnapshotCommand cmd, LibvirtComputingR
             LOGGER.error(error);
             return new CopyCmdAnswer(cmd, e);
         } finally {
+            if (src.getVolume() != null) {
+                src.getVolume().clearPassphrase();
+            }
             cleanupSecondaryPool(secondaryPool);
             if (zfsHidden) {
                 zfsSnapdev(true, src.getPath());
diff --git a/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LinstorRevertBackupSnapshotCommandWrapper.java b/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LinstorRevertBackupSnapshotCommandWrapper.java
index 2d6df5f2296a..51d0ed88e340 100644
--- a/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LinstorRevertBackupSnapshotCommandWrapper.java
+++ b/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LinstorRevertBackupSnapshotCommandWrapper.java
@@ -17,6 +17,7 @@
 package com.cloud.hypervisor.kvm.resource.wrapper;
 
 import java.io.File;
+import java.util.Collections;
 
 import com.cloud.agent.api.to.DataStoreTO;
 import com.cloud.api.storage.LinstorRevertBackupSnapshotCommand;
@@ -31,9 +32,12 @@
 import org.apache.cloudstack.storage.datastore.util.LinstorUtil;
 import org.apache.cloudstack.storage.to.SnapshotObjectTO;
 import org.apache.cloudstack.storage.to.VolumeObjectTO;
+import org.apache.cloudstack.utils.cryptsetup.KeyFile;
+import org.apache.cloudstack.utils.qemu.QemuImageOptions;
 import org.apache.cloudstack.utils.qemu.QemuImg;
 import org.apache.cloudstack.utils.qemu.QemuImgException;
 import org.apache.cloudstack.utils.qemu.QemuImgFile;
+import org.apache.cloudstack.utils.qemu.QemuObject;
 import org.joda.time.Duration;
 import org.libvirt.LibvirtException;
 
@@ -43,8 +47,9 @@ public final class LinstorRevertBackupSnapshotCommandWrapper
 {
 
     private void convertQCow2ToRAW(
-            KVMStoragePool pool, final String srcPath, final String dstUuid, int waitMilliSeconds)
-        throws LibvirtException, QemuImgException
+            KVMStoragePool pool, final String srcPath, final String dstUuid, final byte[] passphrase,
+            int waitMilliSeconds)
+        throws LibvirtException, QemuImgException, java.io.IOException
     {
         final String dstPath = pool.getPhysicalDisk(dstUuid).getPath();
         final QemuImgFile srcQemuFile = new QemuImgFile(
@@ -60,7 +65,20 @@ private void convertQCow2ToRAW(
         }
         final QemuImg qemu = new QemuImg(waitMilliSeconds, zeroedDevice, true);
         final QemuImgFile dstFile = new QemuImgFile(dstPath, QemuImg.PhysicalDiskFormat.RAW);
-        qemu.convert(srcQemuFile, dstFile);
+        if (passphrase != null && passphrase.length > 0) {
+            // The backed-up qcow2 is LUKS-encrypted with the volume's passphrase. Decrypt it while
+            // writing plaintext to the (decrypted) DRBD device; the Linstor LUKS layer re-encrypts it,
+            // so no qemu encryption must be applied to the destination.
+            try (KeyFile keyFile = new KeyFile(passphrase)) {
+                final QemuObject srcSecret = QemuObject.prepareSecretForQemuImg(
+                    QemuImg.PhysicalDiskFormat.QCOW2, QemuObject.EncryptFormat.LUKS, keyFile.toString(), "sec0", null);
+                final QemuImageOptions srcImageOpts = new QemuImageOptions(
+                    QemuImg.PhysicalDiskFormat.QCOW2, srcPath, "sec0");
+                qemu.convert(srcQemuFile, dstFile, null, Collections.singletonList(srcSecret), srcImageOpts, null, false);
+            }
+        } else {
+            qemu.convert(srcQemuFile, dstFile);
+        }
     }
 
     @Override
@@ -84,10 +102,13 @@ public CopyCmdAnswer execute(LinstorRevertBackupSnapshotCommand cmd, LibvirtComp
             secondaryPool = storagePoolMgr.getStoragePoolByURI(
                 srcDataStore.getUrl() + File.separator + srcFile.getParent());
 
+            // The destination volume is the (same) original volume, whose passphrase the backed-up
+            // qcow2 was encrypted with; use it to decrypt while restoring.
             convertQCow2ToRAW(
                 linstorPool,
                 secondaryPool.getLocalPath() + File.separator + srcFile.getName(),
                 dst.getPath(),
+                dst.getPassphrase(),
                 cmd.getWaitInMillSeconds());
 
             final VolumeObjectTO dstVolume = new VolumeObjectTO();
@@ -99,6 +120,7 @@ public CopyCmdAnswer execute(LinstorRevertBackupSnapshotCommand cmd, LibvirtComp
             logger.error(error);
             return new CopyCmdAnswer(cmd, e);
         } finally {
+            dst.clearPassphrase();
             LinstorBackupSnapshotCommandWrapper.cleanupSecondaryPool(secondaryPool);
         }
     }
diff --git a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImpl.java b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImpl.java
index fedb4a9cc977..bc0e0a897065 100644
--- a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImpl.java
+++ b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImpl.java
@@ -1135,12 +1135,22 @@ protected Answer copySnapshot(DataObject srcData, DataObject destData) {
                 VirtualMachineManager.ExecuteInSequence.value());
             cmd.setOptions(options);
 
-            Optional<RemoteHostEndPoint> optEP = getDiskfullEP(api, pool, rscName);
+            // For encrypted volumes Linstor adds a LUKS layer (DRBD -> LUKS -> STORAGE). The storage
+            // layer snapshot device (getSnapshotPath) therefore only exposes the raw LUKS ciphertext,
+            // while restore writes onto the decrypted DRBD device (/dev/drbd/by-res/.../0). Backing up
+            // the ciphertext and writing it back to the decrypted layer corrupts the volume (and the
+            // shrink to the net volume size would even truncate the ciphertext). So for encrypted
+            // volumes we never read the storage snapshot directly: restore the snapshot into a temporary
+            // resource and back up its decrypted DRBD device instead, symmetric to the restore path.
+            final boolean encrypted = snapshotObject.getBaseVolume().getPassphraseId() != null;
+            Optional<RemoteHostEndPoint> optEP = encrypted ?
+                Optional.empty() : getDiskfullEP(api, pool, rscName);
             Answer answer;
             if (optEP.isPresent()) {
                 answer = optEP.get().sendMessage(cmd);
             } else {
-                logger.debug("No diskfull endpoint found to copy image, creating diskless endpoint");
+                logger.debug("No diskfull endpoint used to copy image (encrypted={}), using temporary resource",
+                    encrypted);
                 answer = copyFromTemporaryResource(api, pool, rscName, snapshotName, snapshotObject, cmd);
             }
             return answer;
diff --git a/plugins/storage/volume/ontap/pom.xml b/plugins/storage/volume/ontap/pom.xml
index ce9b8683ebaf..7af43a2325ff 100644
--- a/plugins/storage/volume/ontap/pom.xml
+++ b/plugins/storage/volume/ontap/pom.xml
@@ -37,9 +37,7 @@
         <jackson-databind.version>2.13.4</jackson-databind.version>
         <assertj.version>3.24.2</assertj.version>
         <junit-jupiter.version>5.8.1</junit-jupiter.version>
-        <mockito.version>3.12.4</mockito.version>
-        <mockito-junit-jupiter.version>5.2.0</mockito-junit-jupiter.version>
-        <byte-buddy-agent.version>1.11.13</byte-buddy-agent.version>
+        <byte-buddy-agent.version>1.15.11</byte-buddy-agent.version>
     </properties>
     <dependencyManagement>
         <dependencies>
@@ -105,21 +103,13 @@
         <dependency>
             <groupId>org.mockito</groupId>
             <artifactId>mockito-core</artifactId>
-            <version>${mockito.version}</version>
+            <version>${cs.mockito.version}</version>
             <scope>test</scope>
         </dependency>
         <dependency>
             <groupId>org.mockito</groupId>
             <artifactId>mockito-junit-jupiter</artifactId>
-            <version>${mockito-junit-jupiter.version}</version>
-            <scope>test</scope>
-        </dependency>
-
-        <!-- Mockito Inline (for static method mocking) -->
-        <dependency>
-            <groupId>org.mockito</groupId>
-            <artifactId>mockito-inline</artifactId>
-            <version>${mockito.version}</version>
+            <version>${cs.mockito.version}</version>
             <scope>test</scope>
         </dependency>
         <dependency>
@@ -163,7 +153,6 @@
                 <artifactId>maven-surefire-plugin</artifactId>
                 <version>${maven-surefire-plugin.version}</version>
                 <configuration>
-                    <skipTests>false</skipTests>
                     <includes>
                         <include>**/*Test.java</include>
                     </includes>
diff --git a/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/driver/OntapPrimaryDatastoreDriver.java b/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/driver/OntapPrimaryDatastoreDriver.java
index 04996b74d2a5..ece29f7cd0ac 100644
--- a/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/driver/OntapPrimaryDatastoreDriver.java
+++ b/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/driver/OntapPrimaryDatastoreDriver.java
@@ -413,7 +413,7 @@ public boolean grantAccess(DataObject dataObject, Host host, DataStore dataStore
     private void grantAccessIscsi(Host host, VolumeVO volumeVO, Map<String, String> details, String svmName, StoragePoolVO storagePool) {
         String cloudStackVolumeName = volumeDetailsDao.findDetail(volumeVO.getId(), OntapStorageConstants.LUN_DOT_NAME).getValue();
         UnifiedSANStrategy sanStrategy = (UnifiedSANStrategy) OntapStorageUtils.getStrategyByStoragePoolDetails(details);
-        String accessGroupName = OntapStorageUtils.getIgroupName(svmName, host.getName());
+        String accessGroupName = OntapStorageUtils.getIgroupName(svmName, host.getUuid());
 
         // Validate if Igroup exist ONTAP for this host as we may be using delete_on_unmap= true and igroup may be deleted by ONTAP automatically
         Map<String, String> getAccessGroupMap = Map.of(
@@ -506,7 +506,7 @@ private void revokeAccessForVolume(StoragePoolVO storagePool, VolumeVO volumeVO,
         String svmName = details.get(OntapStorageConstants.SVM_NAME);
 
         if (ProtocolType.ISCSI.name().equalsIgnoreCase(details.get(OntapStorageConstants.PROTOCOL))) {
-            String accessGroupName = OntapStorageUtils.getIgroupName(svmName, host.getName());
+            String accessGroupName = OntapStorageUtils.getIgroupName(svmName, host.getUuid());
 
             // Retrieve LUN name from volume details; if missing, volume may not have been fully created
             VolumeDetailVO lunDetail = volumeDetailsDao.findDetail(volumeVO.getId(), OntapStorageConstants.LUN_DOT_NAME);
diff --git a/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/feign/model/Volume.java b/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/feign/model/Volume.java
index e7c538d7cd04..736d70de2178 100644
--- a/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/feign/model/Volume.java
+++ b/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/feign/model/Volume.java
@@ -19,9 +19,11 @@
 
 package org.apache.cloudstack.storage.feign.model;
 
+import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonInclude;
 import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.annotation.JsonValue;
 
 import java.util.List;
 import java.util.Objects;
@@ -50,6 +52,9 @@ public class Volume {
     @JsonProperty("space")
     private VolumeSpace space;
 
+    @JsonProperty("guarantee")
+    private Guarantee guarantee;
+
     @JsonProperty("anti_ransomware")
     private AntiRansomware antiRansomware;
 
@@ -112,6 +117,14 @@ public void setSpace(VolumeSpace space) {
         this.space = space;
     }
 
+    public Guarantee getGuarantee() {
+        return guarantee;
+    }
+
+    public void setGuarantee(Guarantee guarantee) {
+        this.guarantee = guarantee;
+    }
+
     public AntiRansomware getAntiRansomware() {
         return antiRansomware;
     }
@@ -139,4 +152,66 @@ public boolean equals(Object o) {
     public int hashCode() {
         return Objects.hashCode(uuid);
     }
+
+    public static class Guarantee {
+
+        /**
+         * ONTAP FlexVolume space guarantee (provisioning) type.
+         * <ul>
+         *   <li>{@link #NONE}   - thin provisioning (space is not reserved up front)</li>
+         *   <li>{@link #VOLUME} - thick provisioning (full volume size is reserved on the aggregate)</li>
+         * </ul>
+         */
+        public enum TypeEnum {
+            NONE("none"),
+
+            VOLUME("volume");
+
+            private String value;
+
+            TypeEnum(String value) {
+                this.value = value;
+            }
+
+            @JsonValue
+            public String getValue() {
+                return value;
+            }
+
+            @Override
+            public String toString() {
+                return String.valueOf(value);
+            }
+
+            @JsonCreator
+            public static TypeEnum fromValue(String text) {
+                if (text == null) return null;
+                for (TypeEnum b : TypeEnum.values()) {
+                    if (text.equalsIgnoreCase(b.value)) {
+                        return b;
+                    }
+                }
+                return null;
+            }
+        }
+
+        @JsonProperty("type")
+        private TypeEnum type;
+
+        public Guarantee() {
+        }
+
+        public Guarantee(TypeEnum type) {
+            this.type = type;
+        }
+
+        public TypeEnum getType() {
+            return type;
+        }
+
+        public void setType(TypeEnum type) {
+            this.type = type;
+        }
+    }
+
 }
diff --git a/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/lifecycle/OntapPrimaryDatastoreLifecycle.java b/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/lifecycle/OntapPrimaryDatastoreLifecycle.java
index 9854f02e6960..fec594ea0ea6 100755
--- a/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/lifecycle/OntapPrimaryDatastoreLifecycle.java
+++ b/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/lifecycle/OntapPrimaryDatastoreLifecycle.java
@@ -337,9 +337,12 @@ public boolean attachZone(DataStore dataStore, ZoneScope scope, Hypervisor.Hyper
             logger.error("attachZone : Storage Pool not found for id: " + dataStore.getId());
             throw new CloudRuntimeException("Storage Pool not found for id: " + dataStore.getId());
         }
-
+        if (!Hypervisor.HypervisorType.KVM.equals(hypervisorType)) {
+            logger.error("attachZone : ONTAP primary storage is supported only for KVM hypervisor");
+            throw new CloudRuntimeException("ONTAP primary storage is supported only for KVM hypervisor");
+        }
         PrimaryDataStoreInfo primaryStore = (PrimaryDataStoreInfo)dataStore;
-        List<HostVO> hostsToConnect = _resourceMgr.getEligibleUpAndEnabledHostsInZoneForStorageConnection(dataStore, scope.getScopeId(), Hypervisor.HypervisorType.KVM);
+        List<HostVO> hostsToConnect = _resourceMgr.getEligibleUpAndEnabledHostsInZoneForStorageConnection(dataStore, scope.getScopeId(), hypervisorType);
         logger.debug(String.format("In createPool. Attaching the pool to each of the hosts in %s.", hostsToConnect));
 
         Map<String, String> details = storagePoolDetailsDao.listDetailsKeyPairs(primaryStore.getId());
@@ -364,7 +367,7 @@ public boolean attachZone(DataStore dataStore, ZoneScope scope, Hypervisor.Hyper
                 return  false;
             }
         }
-        _dataStoreHelper.attachZone(dataStore);
+        _dataStoreHelper.attachZone(dataStore, hypervisorType);
         return true;
     }
 
diff --git a/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/service/StorageStrategy.java b/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/service/StorageStrategy.java
index bd808a26d6f8..c13b255c67ea 100644
--- a/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/service/StorageStrategy.java
+++ b/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/service/StorageStrategy.java
@@ -49,6 +49,7 @@
 import org.apache.logging.log4j.Logger;
 
 import java.util.HashMap;
+import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
 import java.util.Objects;
@@ -135,31 +136,42 @@ public boolean connect() {
                 logger.error("No aggregates are assigned to SVM " + svmName);
                 throw new CloudRuntimeException("No aggregates are assigned to SVM " + svmName);
             }
+            // Collect all online aggregates assigned to the SVM. Capacity-based selection is
+            // intentionally deferred to createStorageVolume(name, size), which validates the
+            // available space against the actual requested volume size.
+            List<Aggregate> eligibleAggregates = new ArrayList<>();
             for (Aggregate aggr : aggrs) {
                 logger.debug("Found aggregate: " + aggr.getName() + " with UUID: " + aggr.getUuid());
                 Aggregate aggrResp = aggregateFeignClient.getAggregateByUUID(authHeader, aggr.getUuid());
                 if (aggrResp == null) {
                     logger.warn("Aggregate details response is null for aggregate " + aggr.getName() + ". Skipping.");
-                    break;
+                    continue;
                 }
                 if (!Objects.equals(aggrResp.getState(), Aggregate.StateEnum.ONLINE)) {
                     logger.warn("Aggregate " + aggr.getName() + " is not in online state. Skipping this aggregate.");
                     continue;
-                } else if (aggrResp.getSpace() == null || aggrResp.getAvailableBlockStorageSpace() == null ||
-                        aggrResp.getAvailableBlockStorageSpace() <= storage.getSize().doubleValue()) {
-                    logger.warn("Aggregate " + aggr.getName() + " does not have sufficient available space. Skipping this aggregate.");
-                    continue;
                 }
-                logger.info("Selected aggregate: " + aggr.getName() + " for volume operations.");
-                this.aggregates = List.of(aggr);
-                break;
+                logger.debug("Aggregate " + aggr.getName() + " is online and eligible for volume operations.");
+                eligibleAggregates.add(aggr);
             }
-            if (this.aggregates == null || this.aggregates.isEmpty()) {
-                logger.error("No suitable aggregates found on SVM " + svmName + " for volume creation.");
-                throw new CloudRuntimeException("No suitable aggregates found on SVM " + svmName + " for volume creation.");
+            if (eligibleAggregates.isEmpty()) {
+                logger.error("No suitable aggregates found on SVM " + svmName + " for volume operations.");
+                throw new CloudRuntimeException("No suitable aggregates found on SVM " + svmName + " for volume operations.");
             }
+            this.aggregates = eligibleAggregates;
+            logger.info("Found " + eligibleAggregates.size() + " online aggregate(s) on SVM " + svmName + " for volume operations.");
 
             logger.info("Successfully connected to ONTAP cluster and validated ONTAP details provided");
+        } catch (FeignException.Unauthorized e) {
+            logger.error("Authentication failed while connecting to ONTAP cluster at " + storage.getStorageIP() +
+                    ". Please verify the username and password.", e);
+            throw new CloudRuntimeException("Authentication failed: Invalid credentials for ONTAP cluster at " +
+                    storage.getStorageIP() + ". Please verify the username and password.");
+        } catch (FeignException.Forbidden e) {
+            logger.error("Authorization failed while connecting to ONTAP cluster at " + storage.getStorageIP() +
+                    ". The user does not have sufficient privileges.", e);
+            throw new CloudRuntimeException("Authorization failed: User does not have sufficient privileges on ONTAP cluster at " +
+                    storage.getStorageIP() + ". Please verify user permissions.");
         } catch (Exception e) {
             logger.error("Failed to connect to ONTAP cluster: " + e.getMessage(), e);
             throw new CloudRuntimeException("Failed to connect to ONTAP cluster: " + e.getMessage(), e);
@@ -211,7 +223,7 @@ public Volume createStorageVolume(String volumeName, Long size) {
 
             if (aggrResp == null) {
                 logger.warn("Aggregate details response is null for aggregate " + aggr.getName() + ". Skipping.");
-                break;
+                continue;
             }
 
             if (!Objects.equals(aggrResp.getState(), Aggregate.StateEnum.ONLINE)) {
@@ -227,7 +239,7 @@ public Volume createStorageVolume(String volumeName, Long size) {
             final long availableBytes = aggrResp.getAvailableBlockStorageSpace().longValue();
             logger.debug("Aggregate " + aggr.getName() + " available bytes=" + availableBytes + ", requested=" + size);
 
-            if (availableBytes <= size) {
+            if (availableBytes < size) {
                 logger.warn("Aggregate " + aggr.getName() + " does not have sufficient available space. Required=" +
                         size + " bytes, available=" + availableBytes + " bytes. Skipping this aggregate.");
                 continue;
@@ -251,6 +263,7 @@ public Volume createStorageVolume(String volumeName, Long size) {
         volumeRequest.setAggregates(List.of(aggr));
         volumeRequest.setSize(size);
         volumeRequest.setNas(nas);
+        volumeRequest.setGuarantee(new Volume.Guarantee(Volume.Guarantee.TypeEnum.NONE));
         try {
             JobResponse jobResponse = volumeFeignClient.createVolumeWithJob(authHeader, volumeRequest);
             if (jobResponse == null || jobResponse.getJob() == null) {
diff --git a/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/service/UnifiedSANStrategy.java b/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/service/UnifiedSANStrategy.java
index 5f1ac265fc50..2b0e65f9f7ea 100644
--- a/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/service/UnifiedSANStrategy.java
+++ b/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/service/UnifiedSANStrategy.java
@@ -207,7 +207,7 @@ public AccessGroup createAccessGroup(AccessGroup accessGroup) {
             igroupRequest.setOsType(Igroup.OsTypeEnum.Linux);
 
             for (HostVO host : accessGroup.getHostsToConnect()) {
-                igroupName = OntapStorageUtils.getIgroupName(svmName, host.getName());
+                igroupName = OntapStorageUtils.getIgroupName(svmName, host.getUuid());
                 igroupRequest.setName(igroupName);
 
                 List<Initiator> initiators = new ArrayList<>();
@@ -271,7 +271,7 @@ public void deleteAccessGroup(AccessGroup accessGroup) {
             //Get iGroup name per host
             if(!CollectionUtils.isEmpty(accessGroup.getHostsToConnect())) {
                 for (HostVO host : accessGroup.getHostsToConnect()) {
-                    String igroupName = OntapStorageUtils.getIgroupName(svmName, host.getName());
+                    String igroupName = OntapStorageUtils.getIgroupName(svmName, host.getUuid());
                     logger.info("deleteAccessGroup: iGroup name '{}'", igroupName);
 
                     // Get the iGroup to retrieve its UUID
diff --git a/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/utils/OntapStorageConstants.java b/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/utils/OntapStorageConstants.java
index 4ad0412d2593..e5224237e526 100644
--- a/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/utils/OntapStorageConstants.java
+++ b/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/utils/OntapStorageConstants.java
@@ -96,6 +96,7 @@ public class OntapStorageConstants {
     public static final String IGROUP_DOT_UUID = "igroup.uuid";
     public static final String UNDERSCORE = "_";
     public static final String CS = "cs";
+    public static final int IGROUP_NAME_MAX_LENGTH = 96;
     public static final String SRC_CS_VOLUME_ID = "src_cs_volume_id";
     public static final String BASE_ONTAP_FV_ID = "base_ontap_fv_id";
     public static final String ONTAP_SNAP_ID = "ontap_snap_id";
diff --git a/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/utils/OntapStorageUtils.java b/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/utils/OntapStorageUtils.java
index 596372edcf16..8a74e77b3371 100644
--- a/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/utils/OntapStorageUtils.java
+++ b/plugins/storage/volume/ontap/src/main/java/org/apache/cloudstack/storage/utils/OntapStorageUtils.java
@@ -139,10 +139,15 @@ public static StorageStrategy getStrategyByStoragePoolDetails(Map<String, String
         }
     }
 
-    public static String getIgroupName(String svmName, String hostName) {
-        //Igroup name format: cs_svmName_hostName
-        String sanitizedHostName = hostName.split("\\.")[0].replaceAll("[^a-zA-Z0-9_-]", "_");
-        return OntapStorageConstants.CS + OntapStorageConstants.UNDERSCORE + svmName + OntapStorageConstants.UNDERSCORE + sanitizedHostName;
+    public static String getIgroupName(String svmName, String hostUuid) {
+        //Igroup name format: cs_hostUuid_svmName
+        String sanitizedHostUuid = hostUuid.replaceAll("[^a-zA-Z0-9_-]", "_");
+        String igroupName = OntapStorageConstants.CS + OntapStorageConstants.UNDERSCORE + sanitizedHostUuid + OntapStorageConstants.UNDERSCORE + svmName;
+        // ONTAP igroup names are limited to 96 characters; truncate if longer.
+        if (igroupName.length() > OntapStorageConstants.IGROUP_NAME_MAX_LENGTH) {
+            igroupName = igroupName.substring(0, OntapStorageConstants.IGROUP_NAME_MAX_LENGTH);
+        }
+        return igroupName;
     }
 
     public static String generateExportPolicyName(String svmName, String volumeName){
diff --git a/plugins/storage/volume/ontap/src/test/java/org/apache/cloudstack/storage/driver/OntapPrimaryDatastoreDriverTest.java b/plugins/storage/volume/ontap/src/test/java/org/apache/cloudstack/storage/driver/OntapPrimaryDatastoreDriverTest.java
index b535217fd235..3c139e23cb88 100644
--- a/plugins/storage/volume/ontap/src/test/java/org/apache/cloudstack/storage/driver/OntapPrimaryDatastoreDriverTest.java
+++ b/plugins/storage/volume/ontap/src/test/java/org/apache/cloudstack/storage/driver/OntapPrimaryDatastoreDriverTest.java
@@ -348,6 +348,7 @@ void testGrantAccess_ClusterScope_Success() {
         when(volumeVO.getId()).thenReturn(100L);
 
         when(host.getName()).thenReturn("host1");
+        when(host.getUuid()).thenReturn("host-uuid-1");
 
         VolumeDetailVO lunNameDetail = new VolumeDetailVO(100L, OntapStorageConstants.LUN_DOT_NAME, "/vol/vol1/lun1", false);
         when(volumeDetailsDao.findDetail(100L, OntapStorageConstants.LUN_DOT_NAME)).thenReturn(lunNameDetail);
@@ -384,6 +385,7 @@ void testGrantAccess_IgroupNotFound_CreatesNewIgroup() {
         // Setup - use HostVO mock since production code casts Host to HostVO
         HostVO hostVO = mock(HostVO.class);
         when(hostVO.getName()).thenReturn("host1");
+        when(hostVO.getUuid()).thenReturn("host-uuid-1");
 
         when(dataStore.getId()).thenReturn(1L);
         when(volumeInfo.getType()).thenReturn(VOLUME);
@@ -477,6 +479,7 @@ void testRevokeAccess_ISCSIVolume_Success() {
 
         when(host.getStorageUrl()).thenReturn("iqn.1993-08.org.debian:01:host1");
         when(host.getName()).thenReturn("host1");
+        when(host.getUuid()).thenReturn("host-uuid-1");
 
         VolumeDetailVO lunNameDetail = new VolumeDetailVO(100L, OntapStorageConstants.LUN_DOT_NAME, "/vol/vol1/lun1", false);
         when(volumeDetailsDao.findDetail(100L, OntapStorageConstants.LUN_DOT_NAME)).thenReturn(lunNameDetail);
diff --git a/plugins/storage/volume/ontap/src/test/java/org/apache/cloudstack/storage/lifecycle/OntapPrimaryDatastoreLifecycleTest.java b/plugins/storage/volume/ontap/src/test/java/org/apache/cloudstack/storage/lifecycle/OntapPrimaryDatastoreLifecycleTest.java
index 604ab400474c..751b864ecfcc 100644
--- a/plugins/storage/volume/ontap/src/test/java/org/apache/cloudstack/storage/lifecycle/OntapPrimaryDatastoreLifecycleTest.java
+++ b/plugins/storage/volume/ontap/src/test/java/org/apache/cloudstack/storage/lifecycle/OntapPrimaryDatastoreLifecycleTest.java
@@ -344,17 +344,24 @@ public void testInitialize_clusterNotKVM() {
         clusterVO.setHypervisorType("XenServer");
         when(_clusterDao.findById(2L)).thenReturn(clusterVO);
 
+        HashMap<String, String> detailsMap = new HashMap<>();
+        detailsMap.put(OntapStorageConstants.USERNAME, "testUser");
+        detailsMap.put(OntapStorageConstants.PASSWORD, "testPassword");
+        detailsMap.put(OntapStorageConstants.STORAGE_IP, "10.10.10.10");
+        detailsMap.put(OntapStorageConstants.SVM_NAME, "vs0");
+        detailsMap.put(OntapStorageConstants.PROTOCOL, "NFS3");
+
         Map<String, Object> dsInfos = new HashMap<>();
-        dsInfos.put("zoneId",1L);
-        dsInfos.put("podId",1L);
+        dsInfos.put("zoneId", 1L);
+        dsInfos.put("podId", 1L);
         dsInfos.put("clusterId", 2L);
         dsInfos.put("name", "testStoragePool");
         dsInfos.put("providerName", "testProvider");
-        dsInfos.put("capacityBytes",200000L);
-        dsInfos.put("managed",true);
+        dsInfos.put("capacityBytes", 200000L);
+        dsInfos.put("managed", true);
         dsInfos.put("tags", "testTag");
         dsInfos.put("isTagARule", false);
-        dsInfos.put("details", new HashMap<String, String>());
+        dsInfos.put("details", detailsMap);
 
         Exception ex = assertThrows(CloudRuntimeException.class, () -> {
             try (MockedStatic<StorageProviderFactory> storageProviderFactory = Mockito.mockStatic(StorageProviderFactory.class)) {
@@ -605,7 +612,7 @@ public void testAttachZone_positive() throws Exception {
         when(_resourceMgr.getEligibleUpAndEnabledHostsInZoneForStorageConnection(any(), eq(1L), eq(Hypervisor.HypervisorType.KVM)))
                 .thenReturn(mockHosts);
         when(storagePoolDetailsDao.listDetailsKeyPairs(1L)).thenReturn(poolDetails);
-        when(_dataStoreHelper.attachZone(any(DataStore.class))).thenReturn(dataStore);
+        when(_dataStoreHelper.attachZone(any(DataStore.class), eq(Hypervisor.HypervisorType.KVM))).thenReturn(dataStore);
 
         try (MockedStatic<OntapStorageUtils> utilityMock = Mockito.mockStatic(OntapStorageUtils.class)) {
             utilityMock.when(() -> OntapStorageUtils.getStrategyByStoragePoolDetails(any()))
@@ -626,7 +633,7 @@ public void testAttachZone_positive() throws Exception {
             verify(storagePoolDetailsDao, times(1)).listDetailsKeyPairs(1L);
             verify(storageStrategy, times(1)).createAccessGroup(any(AccessGroup.class));
             verify(_storageMgr, times(2)).connectHostToSharedPool(any(HostVO.class), eq(1L));
-            verify(_dataStoreHelper, times(1)).attachZone(any(DataStore.class));
+            verify(_dataStoreHelper, times(1)).attachZone(any(DataStore.class), eq(Hypervisor.HypervisorType.KVM));
         }
     }
 
@@ -640,7 +647,7 @@ public void testAttachZone_withSingleHost() throws Exception {
         when(_resourceMgr.getEligibleUpAndEnabledHostsInZoneForStorageConnection(any(), eq(1L), eq(Hypervisor.HypervisorType.KVM)))
                 .thenReturn(singleHost);
         when(storagePoolDetailsDao.listDetailsKeyPairs(1L)).thenReturn(poolDetails);
-        when(_dataStoreHelper.attachZone(any(DataStore.class))).thenReturn(dataStore);
+        when(_dataStoreHelper.attachZone(any(DataStore.class), eq(Hypervisor.HypervisorType.KVM))).thenReturn(dataStore);
 
         try (MockedStatic<OntapStorageUtils> utilityMock = Mockito.mockStatic(OntapStorageUtils.class)) {
             utilityMock.when(() -> OntapStorageUtils.getStrategyByStoragePoolDetails(any()))
@@ -655,7 +662,7 @@ public void testAttachZone_withSingleHost() throws Exception {
             // Verify
             assertTrue(result, "attachZone should return true with single host");
             verify(_storageMgr, times(1)).connectHostToSharedPool(any(HostVO.class), eq(1L));
-            verify(_dataStoreHelper, times(1)).attachZone(any(DataStore.class));
+            verify(_dataStoreHelper, times(1)).attachZone(any(DataStore.class), eq(Hypervisor.HypervisorType.KVM));
         }
     }
 
@@ -672,7 +679,7 @@ public void testAttachZone_withMultipleHosts() throws Exception {
         when(_resourceMgr.getEligibleUpAndEnabledHostsInZoneForStorageConnection(any(), eq(1L), eq(Hypervisor.HypervisorType.KVM)))
                 .thenReturn(mockHosts);
         when(storagePoolDetailsDao.listDetailsKeyPairs(1L)).thenReturn(poolDetails);
-        when(_dataStoreHelper.attachZone(any(DataStore.class))).thenReturn(dataStore);
+        when(_dataStoreHelper.attachZone(any(DataStore.class), eq(Hypervisor.HypervisorType.KVM))).thenReturn(dataStore);
 
         try (MockedStatic<OntapStorageUtils> utilityMock = Mockito.mockStatic(OntapStorageUtils.class)) {
             utilityMock.when(() -> OntapStorageUtils.getStrategyByStoragePoolDetails(any()))
@@ -687,7 +694,7 @@ public void testAttachZone_withMultipleHosts() throws Exception {
             // Verify
             assertTrue(result, "attachZone should return true with multiple hosts");
             verify(_storageMgr, times(3)).connectHostToSharedPool(any(HostVO.class), eq(1L));
-            verify(_dataStoreHelper, times(1)).attachZone(any(DataStore.class));
+            verify(_dataStoreHelper, times(1)).attachZone(any(DataStore.class), eq(Hypervisor.HypervisorType.KVM));
         }
     }
 
@@ -717,7 +724,7 @@ public void testAttachZone_hostConnectionFailure() throws Exception {
             verify(storageStrategy, times(1)).createAccessGroup(any(AccessGroup.class));
             verify(_storageMgr, times(1)).connectHostToSharedPool(any(HostVO.class), eq(1L));
             // _dataStoreHelper.attachZone should NOT be called due to early return
-            verify(_dataStoreHelper, times(0)).attachZone(any(DataStore.class));
+            verify(_dataStoreHelper, times(0)).attachZone(any(DataStore.class), eq(Hypervisor.HypervisorType.KVM));
         }
     }
 
@@ -730,7 +737,7 @@ public void testAttachZone_emptyHostList() throws Exception {
         when(_resourceMgr.getEligibleUpAndEnabledHostsInZoneForStorageConnection(any(), eq(1L), eq(Hypervisor.HypervisorType.KVM)))
                 .thenReturn(emptyHosts);
         when(storagePoolDetailsDao.listDetailsKeyPairs(1L)).thenReturn(poolDetails);
-        when(_dataStoreHelper.attachZone(any(DataStore.class))).thenReturn(dataStore);
+        when(_dataStoreHelper.attachZone(any(DataStore.class), eq(Hypervisor.HypervisorType.KVM))).thenReturn(dataStore);
 
         try (MockedStatic<OntapStorageUtils> utilityMock = Mockito.mockStatic(OntapStorageUtils.class)) {
             utilityMock.when(() -> OntapStorageUtils.getStrategyByStoragePoolDetails(any()))
@@ -744,7 +751,7 @@ public void testAttachZone_emptyHostList() throws Exception {
             // Verify
             assertTrue(result, "attachZone should return true even with no hosts");
             verify(_storageMgr, times(0)).connectHostToSharedPool(any(HostVO.class), anyLong());
-            verify(_dataStoreHelper, times(1)).attachZone(any(DataStore.class));
+            verify(_dataStoreHelper, times(1)).attachZone(any(DataStore.class), eq(Hypervisor.HypervisorType.KVM));
         }
     }
 
@@ -773,7 +780,7 @@ public void testAttachZone_secondHostConnectionFails() throws Exception {
             // Verify
             assertFalse(result, "attachZone should return false when any host connection fails");
             verify(_storageMgr, times(2)).connectHostToSharedPool(any(HostVO.class), eq(1L));
-            verify(_dataStoreHelper, times(0)).attachZone(any(DataStore.class));
+            verify(_dataStoreHelper, times(0)).attachZone(any(DataStore.class), eq(Hypervisor.HypervisorType.KVM));
         }
     }
 
@@ -784,7 +791,7 @@ public void testAttachZone_createAccessGroupCalled() throws Exception {
         when(_resourceMgr.getEligibleUpAndEnabledHostsInZoneForStorageConnection(any(), eq(1L), eq(Hypervisor.HypervisorType.KVM)))
                 .thenReturn(mockHosts);
         when(storagePoolDetailsDao.listDetailsKeyPairs(1L)).thenReturn(poolDetails);
-        when(_dataStoreHelper.attachZone(any(DataStore.class))).thenReturn(dataStore);
+        when(_dataStoreHelper.attachZone(any(DataStore.class), eq(Hypervisor.HypervisorType.KVM))).thenReturn(dataStore);
 
         try (MockedStatic<OntapStorageUtils> utilityMock = Mockito.mockStatic(OntapStorageUtils.class)) {
             utilityMock.when(() -> OntapStorageUtils.getStrategyByStoragePoolDetails(any()))
@@ -802,4 +809,49 @@ public void testAttachZone_createAccessGroupCalled() throws Exception {
         }
     }
 
+    @Test
+    public void testAttachZone_nonKvmHypervisorThrowsException() {
+        // Non-KVM hypervisor type must be rejected before any further processing
+        Exception ex = assertThrows(CloudRuntimeException.class, () ->
+                ontapPrimaryDatastoreLifecycle.attachZone(
+                        dataStore, zoneScope, Hypervisor.HypervisorType.VMware));
+
+        assertTrue(ex.getMessage().contains("ONTAP primary storage is supported only for KVM hypervisor"));
+        // update should never be reached
+        verify(storagePoolDao, times(0)).update(anyLong(), any(StoragePoolVO.class));
+    }
+
+    @Test
+    public void testAttachZone_nullHypervisorThrowsException() {
+        // null hypervisorType is not a valid case — only KVM is accepted
+        Exception ex = assertThrows(CloudRuntimeException.class, () ->
+                ontapPrimaryDatastoreLifecycle.attachZone(dataStore, zoneScope, null));
+
+        assertTrue(ex.getMessage().contains("ONTAP primary storage is supported only for KVM hypervisor"));
+        verify(storagePoolDao, times(0)).update(anyLong(), any(StoragePoolVO.class));
+    }
+
+    @Test
+    public void testAttachZone_kvmHypervisorSetsAndUpdatesPool() throws Exception {
+        // KVM hypervisorType should be set on the pool and persisted via storagePoolDao.update
+        when(zoneScope.getScopeId()).thenReturn(1L);
+        when(_resourceMgr.getEligibleUpAndEnabledHostsInZoneForStorageConnection(any(), eq(1L), eq(Hypervisor.HypervisorType.KVM)))
+                .thenReturn(mockHosts);
+        when(storagePoolDetailsDao.listDetailsKeyPairs(1L)).thenReturn(poolDetails);
+        when(_dataStoreHelper.attachZone(any(DataStore.class), eq(Hypervisor.HypervisorType.KVM))).thenReturn(dataStore);
+
+        try (MockedStatic<OntapStorageUtils> utilityMock = Mockito.mockStatic(OntapStorageUtils.class)) {
+            utilityMock.when(() -> OntapStorageUtils.getStrategyByStoragePoolDetails(any()))
+                    .thenReturn(storageStrategy);
+            when(storageStrategy.createAccessGroup(any(AccessGroup.class))).thenReturn(null);
+            when(_storageMgr.connectHostToSharedPool(any(HostVO.class), anyLong())).thenReturn(true);
+
+            boolean result = ontapPrimaryDatastoreLifecycle.attachZone(
+                    dataStore, zoneScope, Hypervisor.HypervisorType.KVM);
+
+            assertTrue(result, "attachZone should succeed for KVM hypervisor");
+            verify(_dataStoreHelper, times(1)).attachZone(any(DataStore.class), eq(Hypervisor.HypervisorType.KVM));
+        }
+    }
+
 }
diff --git a/plugins/storage/volume/ontap/src/test/java/org/apache/cloudstack/storage/service/StorageStrategyTest.java b/plugins/storage/volume/ontap/src/test/java/org/apache/cloudstack/storage/service/StorageStrategyTest.java
index 86ef1d7c79b6..df9afe2542f9 100644
--- a/plugins/storage/volume/ontap/src/test/java/org/apache/cloudstack/storage/service/StorageStrategyTest.java
+++ b/plugins/storage/volume/ontap/src/test/java/org/apache/cloudstack/storage/service/StorageStrategyTest.java
@@ -230,6 +230,69 @@ public void testConnect_positive() {
         verify(svmFeignClient, times(1)).getSvmResponse(anyMap(), anyString());
     }
 
+    @Test
+    public void testConnect_succeedsWhenAggregateSpaceBelowPoolCapacity() {
+        // Regression: connect() must validate connectivity/SVM/aggregate-state ONLY.
+        // Capacity is validated per-volume in createStorageVolume(name, size). Previously
+        // connect() compared aggregate free space against the whole storage pool size
+        // (storage.getSize()), which incorrectly failed data-path operations (volume/LUN
+        // create, grant/revoke access, delete) once the pool FlexVolume already existed.
+        Svm svm = new Svm();
+        svm.setName("svm1");
+        svm.setState(OntapStorageConstants.RUNNING);
+        svm.setNfsEnabled(true);
+
+        Aggregate aggregate = new Aggregate();
+        aggregate.setName("aggr1");
+        aggregate.setUuid("aggr-uuid-1");
+        svm.setAggregates(List.of(aggregate));
+
+        OntapResponse<Svm> svmResponse = new OntapResponse<>();
+        svmResponse.setRecords(List.of(svm));
+
+        when(svmFeignClient.getSvmResponse(anyMap(), anyString())).thenReturn(svmResponse);
+
+        // Aggregate is ONLINE but has far less free space than the configured pool size (5GB).
+        Aggregate aggregateDetail = mock(Aggregate.class);
+        when(aggregateDetail.getName()).thenReturn("aggr1");
+        when(aggregateDetail.getUuid()).thenReturn("aggr-uuid-1");
+        when(aggregateDetail.getState()).thenReturn(Aggregate.StateEnum.ONLINE);
+        when(aggregateFeignClient.getAggregateByUUID(anyString(), eq("aggr-uuid-1"))).thenReturn(aggregateDetail);
+
+        // Execute & Verify - connect() should succeed regardless of available space.
+        boolean result = storageStrategy.connect();
+        assertTrue(result, "connect() should succeed for an online aggregate even when its free space is below the pool capacity");
+    }
+
+    @Test
+    public void testConnect_noOnlineAggregates() {
+        // Setup - aggregate assigned to the SVM exists but is not ONLINE
+        Svm svm = new Svm();
+        svm.setName("svm1");
+        svm.setState(OntapStorageConstants.RUNNING);
+        svm.setNfsEnabled(true);
+
+        Aggregate aggregate = new Aggregate();
+        aggregate.setName("aggr1");
+        aggregate.setUuid("aggr-uuid-1");
+        svm.setAggregates(List.of(aggregate));
+
+        OntapResponse<Svm> svmResponse = new OntapResponse<>();
+        svmResponse.setRecords(List.of(svm));
+
+        when(svmFeignClient.getSvmResponse(anyMap(), anyString())).thenReturn(svmResponse);
+
+        Aggregate aggregateDetail = mock(Aggregate.class);
+        when(aggregateDetail.getName()).thenReturn("aggr1");
+        when(aggregateDetail.getUuid()).thenReturn("aggr-uuid-1");
+        when(aggregateDetail.getState()).thenReturn(null); // not online
+        when(aggregateFeignClient.getAggregateByUUID(anyString(), eq("aggr-uuid-1"))).thenReturn(aggregateDetail);
+
+        // Execute & Verify
+        CloudRuntimeException ex = assertThrows(CloudRuntimeException.class, () -> storageStrategy.connect());
+        assertTrue(ex.getMessage().contains("No suitable aggregates found"));
+    }
+
     @Test
     public void testConnect_svmNotFound() {
         // Setup
@@ -342,6 +405,20 @@ public void testConnect_nullSvmResponse() {
         assertTrue(ex.getMessage().contains("No SVM found"));
     }
 
+    @Test
+    public void testConnect_invalidCredentials() {
+        // Setup - ONTAP rejects the supplied username/password with HTTP 401 Unauthorized.
+        when(svmFeignClient.getSvmResponse(anyMap(), anyString()))
+                .thenThrow(mock(FeignException.Unauthorized.class));
+
+        // Execute & Verify - connect() must surface a clear "invalid credentials" error.
+        CloudRuntimeException ex = assertThrows(CloudRuntimeException.class, () -> storageStrategy.connect());
+        assertTrue(ex.getMessage().contains("Authentication failed: Invalid credentials"),
+                "Expected an authentication failure message but got: " + ex.getMessage());
+        assertTrue(ex.getMessage().contains("Please verify the username and password"),
+                "Expected the message to prompt verifying username/password but got: " + ex.getMessage());
+    }
+
     // ========== createStorageVolume() Tests ==========
 
     @Test
diff --git a/plugins/storage/volume/ontap/src/test/java/org/apache/cloudstack/storage/service/UnifiedSANStrategyTest.java b/plugins/storage/volume/ontap/src/test/java/org/apache/cloudstack/storage/service/UnifiedSANStrategyTest.java
index 1c0c84ef91dd..ec9023a6c760 100644
--- a/plugins/storage/volume/ontap/src/test/java/org/apache/cloudstack/storage/service/UnifiedSANStrategyTest.java
+++ b/plugins/storage/volume/ontap/src/test/java/org/apache/cloudstack/storage/service/UnifiedSANStrategyTest.java
@@ -304,7 +304,7 @@ void testCreateAccessGroup_Success() {
 
         List<HostVO> hosts = new ArrayList<>();
         HostVO host1 = mock(HostVO.class);
-        when(host1.getName()).thenReturn("host1");
+        when(host1.getUuid()).thenReturn("host1");
         when(host1.getStorageUrl()).thenReturn("iqn.1993-08.org.debian:01:host1");
         hosts.add(host1);
         accessGroup.setHostsToConnect(hosts);
@@ -357,7 +357,7 @@ void testCreateAccessGroup_AlreadyExists_ReturnsSuccessfully() {
 
         List<HostVO> hosts = new ArrayList<>();
         HostVO host1 = mock(HostVO.class);
-        when(host1.getName()).thenReturn("host1");
+        when(host1.getUuid()).thenReturn("host1");
         when(host1.getStorageUrl()).thenReturn("iqn.1993-08.org.debian:01:host1");
         hosts.add(host1);
         accessGroup.setHostsToConnect(hosts);
@@ -396,7 +396,7 @@ void testDeleteAccessGroup_Success() {
 
         List<HostVO> hosts = new ArrayList<>();
         HostVO host1 = mock(HostVO.class);
-        lenient().when(host1.getName()).thenReturn("host1");
+        lenient().when(host1.getUuid()).thenReturn("host1");
         hosts.add(host1);
         accessGroup.setHostsToConnect(hosts);
 
@@ -444,7 +444,7 @@ void testDeleteAccessGroup_NotFound_SkipsDeletion() {
 
         List<HostVO> hosts = new ArrayList<>();
         HostVO host1 = mock(HostVO.class);
-        lenient().when(host1.getName()).thenReturn("host1");
+        lenient().when(host1.getUuid()).thenReturn("host1");
         hosts.add(host1);
         accessGroup.setHostsToConnect(hosts);
 
@@ -1042,7 +1042,7 @@ void testDeleteAccessGroup_EmptyIgroupUuid_ThrowsException() {
 
         List<HostVO> hosts = new ArrayList<>();
         HostVO host1 = mock(HostVO.class);
-        when(host1.getName()).thenReturn("host1");
+        when(host1.getUuid()).thenReturn("host1");
         hosts.add(host1);
         accessGroup.setHostsToConnect(hosts);
 
@@ -1079,7 +1079,7 @@ void testDeleteAccessGroup_FeignExceptionNon404_ThrowsException() {
 
         List<HostVO> hosts = new ArrayList<>();
         HostVO host1 = mock(HostVO.class);
-        when(host1.getName()).thenReturn("host1");
+        when(host1.getUuid()).thenReturn("host1");
         hosts.add(host1);
         accessGroup.setHostsToConnect(hosts);
 
@@ -1728,7 +1728,7 @@ void testDeleteAccessGroup_FeignException404_SkipsDeletion() {
         accessGroup.setStoragePoolId(1L);
         List<HostVO> hosts = new ArrayList<>();
         HostVO host1 = mock(HostVO.class);
-        when(host1.getName()).thenReturn("host1");
+        when(host1.getUuid()).thenReturn("host1");
         hosts.add(host1);
         accessGroup.setHostsToConnect(hosts);
 
@@ -1754,7 +1754,7 @@ void testDeleteAccessGroup_NotFoundInResponse_SkipsDeletion() {
         accessGroup.setStoragePoolId(1L);
         List<HostVO> hosts = new ArrayList<>();
         HostVO host1 = mock(HostVO.class);
-        when(host1.getName()).thenReturn("host1");
+        when(host1.getUuid()).thenReturn("host1");
         hosts.add(host1);
         accessGroup.setHostsToConnect(hosts);
 
diff --git a/plugins/storage/volume/ontap/src/test/java/org/apache/cloudstack/storage/utils/OntapStorageUtilsTest.java b/plugins/storage/volume/ontap/src/test/java/org/apache/cloudstack/storage/utils/OntapStorageUtilsTest.java
new file mode 100644
index 000000000000..372a75ad257d
--- /dev/null
+++ b/plugins/storage/volume/ontap/src/test/java/org/apache/cloudstack/storage/utils/OntapStorageUtilsTest.java
@@ -0,0 +1,82 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.cloudstack.storage.utils;
+
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+public class OntapStorageUtilsTest {
+
+    @Test
+    public void getIgroupName_returnsExpectedFormat_whenWithinLimit() {
+        String result = OntapStorageUtils.getIgroupName("svm1", "host-uuid-123");
+
+        assertEquals("cs_host-uuid-123_svm1", result);
+        assertTrue(result.length() <= OntapStorageConstants.IGROUP_NAME_MAX_LENGTH);
+    }
+
+    @Test
+    public void getIgroupName_sanitizesInvalidCharacters() {
+        // Characters outside [a-zA-Z0-9_-] in the host uuid must be replaced with '_'.
+        String result = OntapStorageUtils.getIgroupName("svm1", "host.uuid:123/abc");
+
+        assertEquals("cs_host_uuid_123_abc_svm1", result);
+    }
+
+    @Test
+    public void getIgroupName_doesNotTruncate_whenExactlyAtMaxLength() {
+        // Format: cs(2) + _(1) + hostUuid + _(1) + svmName
+        // For an overall length of 96 with a 4-char uuid, svmName must be 88 chars.
+        String svmName = "a".repeat(88);
+        String hostUuid = "uuid";
+
+        String result = OntapStorageUtils.getIgroupName(svmName, hostUuid);
+
+        assertEquals(OntapStorageConstants.IGROUP_NAME_MAX_LENGTH, result.length());
+        assertEquals("cs_" + hostUuid + "_" + svmName, result);
+    }
+
+    @Test
+    public void getIgroupName_truncates_whenExceedingMaxLength() {
+        String svmName = "a".repeat(200);
+        String hostUuid = "host-uuid-123";
+
+        String result = OntapStorageUtils.getIgroupName(svmName, hostUuid);
+
+        assertEquals(OntapStorageConstants.IGROUP_NAME_MAX_LENGTH, result.length());
+        // The truncated value must still be a prefix of the full, untruncated name.
+        String fullName = "cs_" + hostUuid + "_" + svmName;
+        assertEquals(fullName.substring(0, OntapStorageConstants.IGROUP_NAME_MAX_LENGTH), result);
+        assertTrue(result.startsWith("cs_"));
+    }
+
+    @Test
+    public void getIgroupName_truncates_whenOneCharOverMaxLength() {
+        // Build a name that is exactly one character over the limit (97 chars):
+        // svmName of 89 chars + 4-char uuid -> 2 + 1 + 4 + 1 + 89 = 97.
+        String svmName = "a".repeat(89);
+        String hostUuid = "uuid";
+
+        String result = OntapStorageUtils.getIgroupName(svmName, hostUuid);
+
+        assertEquals(OntapStorageConstants.IGROUP_NAME_MAX_LENGTH, result.length());
+    }
+}
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2AuthManager.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2AuthManager.java
index ece012db3a40..133131d3928a 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2AuthManager.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2AuthManager.java
@@ -18,6 +18,7 @@
 //
 package org.apache.cloudstack.oauth2;
 
+import com.cloud.domain.Domain;
 import com.cloud.utils.component.PluggableService;
 import org.apache.cloudstack.api.auth.PluggableAPIAuthenticator;
 import org.apache.cloudstack.auth.UserOAuth2Authenticator;
@@ -27,10 +28,15 @@
 import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
 
 import java.util.List;
+import java.util.Map;
 
 public interface OAuth2AuthManager extends PluggableAPIAuthenticator, PluggableService {
+    String GLOBAL_DOMAIN_FILTER = "-1";
+    Long GLOBAL_DOMAIN_ID = -1L;
+
     public static ConfigKey<Boolean> OAuth2IsPluginEnabled = new ConfigKey<Boolean>("Advanced", Boolean.class, "oauth2.enabled", "false",
-            "Indicates whether OAuth plugin is enabled or not", false);
+            "Indicates whether OAuth plugin is enabled or not. This can be configured at domain level.", true, ConfigKey.Scope.Domain)
+            .withStrictScope();
     public static final ConfigKey<String> OAuth2Plugins = new ConfigKey<String>("Advanced", String.class, "oauth2.plugins", "google,github",
             "List of OAuth plugins", true);
     public static final ConfigKey<String> OAuth2PluginsExclude = new ConfigKey<String>("Advanced", String.class, "oauth2.plugins.exclude", "",
@@ -49,13 +55,30 @@ public interface OAuth2AuthManager extends PluggableAPIAuthenticator, PluggableS
      */
     UserOAuth2Authenticator getUserOAuth2AuthenticationProvider(final String providerName);
 
-    String verifyCodeAndFetchEmail(String code, String provider);
+    String verifySecretCodeAndFetchEmail(String code, String provider, Long domainId);
 
     OauthProviderVO registerOauthProvider(RegisterOAuthProviderCmd cmd);
 
-    List<OauthProviderVO> listOauthProviders(String provider, String uuid);
+    List<OauthProviderVO> listOauthProviders(String provider, String uuid, Long domainId);
 
     boolean deleteOauthProvider(Long id);
 
     OauthProviderVO updateOauthProvider(UpdateOAuthProviderCmd cmd);
+
+    Long resolveDomainId(Map<String, Object[]> params);
+
+    /**
+     * Resolves whether the OAuth plugin is enabled for the given domain scope.
+     * A null domain or the ROOT domain is treated as the global scope, since the
+     * ROOT domain has no domain-level override and inherits the global value;
+     * any other domain is checked strictly at its own domain scope (no inheritance).
+     * @param domainId domain id, or null for global
+     * @return true if OAuth is enabled for that scope
+     */
+    static boolean isPluginEnabledForDomain(Long domainId) {
+        if (domainId == null || domainId == Domain.ROOT_DOMAIN) {
+            return Boolean.TRUE.equals(OAuth2IsPluginEnabled.value());
+        }
+        return Boolean.TRUE.equals(OAuth2IsPluginEnabled.valueInScope(ConfigKey.Scope.Domain, domainId, true));
+    }
 }
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2AuthManagerImpl.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2AuthManagerImpl.java
index b1bb8292f24a..c3bad43be40e 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2AuthManagerImpl.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2AuthManagerImpl.java
@@ -23,9 +23,11 @@
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 
 import javax.inject.Inject;
 
+import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.auth.UserOAuth2Authenticator;
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.framework.config.Configurable;
@@ -39,15 +41,28 @@
 import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
 import org.apache.commons.lang3.StringUtils;
 
+import org.apache.commons.lang3.ArrayUtils;
+
+import com.cloud.domain.Domain;
+import com.cloud.domain.DomainVO;
+import com.cloud.user.DomainManager;
+import com.cloud.user.DomainService;
 import com.cloud.utils.component.Manager;
 import com.cloud.utils.component.ManagerBase;
 import com.cloud.utils.exception.CloudRuntimeException;
+import org.apache.cloudstack.framework.messagebus.MessageBus;
 
 public class OAuth2AuthManagerImpl extends ManagerBase implements OAuth2AuthManager, Manager, Configurable {
 
     @Inject
     protected OauthProviderDao _oauthProviderDao;
 
+    @Inject
+    private DomainService _domainService;
+
+    @Inject
+    private MessageBus _messageBus;
+
     protected static Map<String, UserOAuth2Authenticator> userOAuth2AuthenticationProvidersMap = new HashMap<>();
 
     private List<UserOAuth2Authenticator> userOAuth2AuthenticationProviders;
@@ -63,17 +78,29 @@ public List<Class<?>> getAuthCommands() {
 
     @Override
     public boolean start() {
-        if (isOAuthPluginEnabled()) {
-            logger.info("OAUTH plugin loaded");
-            initializeUserOAuth2AuthenticationProvidersMap();
-        } else {
-            logger.info("OAUTH plugin not enabled so not loading");
-        }
+        initializeUserOAuth2AuthenticationProvidersMap();
+        addDomainRemovalListener();
+        logger.info("OAUTH plugin loaded");
         return true;
     }
 
-    protected boolean isOAuthPluginEnabled() {
-        return OAuth2IsPluginEnabled.value();
+    private void addDomainRemovalListener() {
+        _messageBus.subscribe(DomainManager.MESSAGE_PRE_REMOVE_DOMAIN_EVENT, (senderAddress, subject, args) -> {
+            try {
+                long domainId = ((DomainVO) args).getId();
+                List<OauthProviderVO> providers = _oauthProviderDao.listByDomain(domainId);
+                for (OauthProviderVO provider : providers) {
+                    _oauthProviderDao.expunge(provider.getId());
+                    logger.debug("Removed OAuth provider {} for deleted domain {}", provider.getProvider(), domainId);
+                }
+            } catch (Exception e) {
+                logger.error("Failed to remove OAuth providers for deleted domain", e);
+            }
+        });
+    }
+
+    protected boolean isOAuthPluginEnabled(Long domainId) {
+        return OAuth2AuthManager.isPluginEnabledForDomain(domainId);
     }
 
     @Override
@@ -124,9 +151,11 @@ protected void initializeUserOAuth2AuthenticationProvidersMap() {
     }
 
     @Override
-    public String verifyCodeAndFetchEmail(String code, String provider) {
+    public String verifySecretCodeAndFetchEmail(String code, String provider, Long domainId) {
         UserOAuth2Authenticator authenticator = getUserOAuth2AuthenticationProvider(provider);
-        return authenticator.verifyCodeAndFetchEmail(code);
+        String email = authenticator.verifySecretCodeAndFetchEmail(code, domainId);
+
+        return email;
     }
 
     @Override
@@ -136,27 +165,38 @@ public OauthProviderVO registerOauthProvider(RegisterOAuthProviderCmd cmd) {
         String clientId = StringUtils.trim(cmd.getClientId());
         String redirectUri = StringUtils.trim(cmd.getRedirectUri());
         String secretKey = StringUtils.trim(cmd.getSecretKey());
+        Long domainId = normalizeGlobalScope(resolveDomainIdFromIdOrPath(cmd.getDomainId(), cmd.getDomainPath()));
         String authorizeUrl = StringUtils.trim(cmd.getAuthorizeUrl());
         String tokenUrl = StringUtils.trim(cmd.getTokenUrl());
 
-        if (!isOAuthPluginEnabled()) {
+        if (!isOAuthPluginEnabled(domainId)) {
             throw new CloudRuntimeException("OAuth is not enabled, please enable to register");
         }
-        OauthProviderVO providerVO = _oauthProviderDao.findByProvider(provider);
+
+        // Check for existing provider with same name and domain
+        OauthProviderVO providerVO = _oauthProviderDao.findByProviderAndDomain(provider, domainId);
         if (providerVO != null) {
-            throw new CloudRuntimeException(String.format("Provider with the name %s is already registered", provider));
+            if (domainId == null) {
+                throw new CloudRuntimeException(String.format("Global provider with the name %s is already registered", provider));
+            } else {
+                throw new CloudRuntimeException(String.format("Provider with the name %s is already registered for domain %d", provider, domainId));
+            }
         }
 
-        return saveOauthProvider(provider, description, clientId, secretKey, redirectUri, authorizeUrl, tokenUrl);
+        return saveOauthProvider(provider, description, clientId, secretKey, redirectUri, authorizeUrl, tokenUrl, domainId);
     }
 
     @Override
-    public List<OauthProviderVO> listOauthProviders(String provider, String uuid) {
+    public List<OauthProviderVO> listOauthProviders(String provider, String uuid, Long domainId) {
         List<OauthProviderVO> providers;
         if (uuid != null) {
             providers = Collections.singletonList(_oauthProviderDao.findByUuid(uuid));
+        } else if (StringUtils.isNotBlank(provider) && domainId != null) {
+            providers = Collections.singletonList(_oauthProviderDao.findByProviderAndDomain(provider, domainId));
         } else if (StringUtils.isNotBlank(provider)) {
-            providers = Collections.singletonList(_oauthProviderDao.findByProvider(provider));
+            providers = Collections.singletonList(_oauthProviderDao.findByProviderAndDomain(provider, null));
+        } else if (domainId != null) {
+            providers = _oauthProviderDao.listByDomainIncludingGlobal(domainId);
         } else {
             providers = _oauthProviderDao.listAll();
         }
@@ -179,6 +219,30 @@ public OauthProviderVO updateOauthProvider(UpdateOAuthProviderCmd cmd) {
             throw new CloudRuntimeException("Provider with the given id is not there");
         }
 
+        Long targetDomainId = providerVO.getDomainId();
+        if (cmd.getDomainId() != null || StringUtils.isNotEmpty(cmd.getDomainPath())) {
+            Long resolved = resolveDomainIdFromIdOrPath(cmd.getDomainId(), cmd.getDomainPath());
+            if (resolved == null) {
+                throw new CloudRuntimeException("Unable to resolve the supplied domain. Provide a valid domain id or path.");
+            }
+            resolved = normalizeGlobalScope(resolved);
+            if (!Objects.equals(resolved, providerVO.getDomainId())) {
+                OauthProviderVO existing = _oauthProviderDao.findByProviderAndDomain(providerVO.getProvider(), resolved);
+                if (existing != null) {
+                    throw new CloudRuntimeException(String.format(
+                            "Provider with the name %s is already registered for domain %s", providerVO.getProvider(),
+                            resolved == null ? "ROOT (global)" : resolved));
+                }
+            }
+            targetDomainId = resolved;
+        }
+
+        if (Boolean.TRUE.equals(enabled) && !isOAuthPluginEnabled(targetDomainId)) {
+            throw new CloudRuntimeException(String.format(
+                    "OAuth plugin is not enabled %s. Enable oauth2.enabled at that scope before enabling this provider.",
+                    targetDomainId == null ? "globally" : "for this domain"));
+        }
+
         if (StringUtils.isNotEmpty(description)) {
             providerVO.setDescription(description);
         }
@@ -200,13 +264,14 @@ public OauthProviderVO updateOauthProvider(UpdateOAuthProviderCmd cmd) {
         if (enabled != null) {
             providerVO.setEnabled(enabled);
         }
+        providerVO.setDomainId(targetDomainId);
 
         _oauthProviderDao.update(id, providerVO);
 
         return _oauthProviderDao.findById(id);
     }
 
-    private OauthProviderVO saveOauthProvider(String provider, String description, String clientId, String secretKey, String redirectUri, String authorizeUrl, String tokenUrl) {
+    private OauthProviderVO saveOauthProvider(String provider, String description, String clientId, String secretKey, String redirectUri, String authorizeUrl, String tokenUrl, Long domainId) {
         final OauthProviderVO oauthProviderVO = new OauthProviderVO();
 
         oauthProviderVO.setProvider(provider);
@@ -214,6 +279,7 @@ private OauthProviderVO saveOauthProvider(String provider, String description, S
         oauthProviderVO.setClientId(clientId);
         oauthProviderVO.setSecretKey(secretKey);
         oauthProviderVO.setRedirectUri(redirectUri);
+        oauthProviderVO.setDomainId(domainId);
         oauthProviderVO.setAuthorizeUrl(authorizeUrl);
         oauthProviderVO.setTokenUrl(tokenUrl);
         oauthProviderVO.setEnabled(true);
@@ -225,7 +291,66 @@ private OauthProviderVO saveOauthProvider(String provider, String description, S
 
     @Override
     public boolean deleteOauthProvider(Long id) {
-        return _oauthProviderDao.remove(id);
+        return _oauthProviderDao.expunge(id);
+    }
+
+    @Override
+    public Long resolveDomainId(Map<String, Object[]> params) {
+        final String[] domainIdArray = (String[])params.get(ApiConstants.DOMAIN_ID);
+        if (ArrayUtils.isNotEmpty(domainIdArray)) {
+            String domainUuid = domainIdArray[0];
+            if (GLOBAL_DOMAIN_FILTER.equals(domainUuid)) {
+                return GLOBAL_DOMAIN_ID;
+            }
+            Domain domain = _domainService.getDomain(domainUuid);
+            if (Objects.nonNull(domain)) {
+                return domain.getId();
+            }
+        }
+        final String[] domainArray = (String[])params.get(ApiConstants.DOMAIN);
+        if (ArrayUtils.isNotEmpty(domainArray)) {
+            String path = normalizeDomainPath(domainArray[0]);
+            if (StringUtils.isNotEmpty(path)) {
+                Domain domain = _domainService.findDomainByIdOrPath(null, path);
+                if (Objects.nonNull(domain)) {
+                    return domain.getId();
+                }
+            }
+        }
+        return null;
+    }
+
+    protected Long resolveDomainIdFromIdOrPath(Long domainId, String domainPath) {
+        if (domainId != null) {
+            return domainId;
+        }
+        String path = normalizeDomainPath(domainPath);
+        if (StringUtils.isNotEmpty(path)) {
+            Domain domain = _domainService.findDomainByIdOrPath(null, path);
+            if (Objects.nonNull(domain)) {
+                return domain.getId();
+            }
+        }
+        return null;
+    }
+
+    // The ROOT domain is the top of the tree, so a provider scoped to it is equivalent
+    // to a global provider; treat it as global so the global oauth2.enabled config applies.
+    protected Long normalizeGlobalScope(Long domainId) {
+        return (domainId != null && Domain.ROOT_DOMAIN == domainId) ? null : domainId;
+    }
+
+    protected String normalizeDomainPath(String path) {
+        if (StringUtils.isEmpty(path)) {
+            return null;
+        }
+        if (!path.startsWith("/")) {
+            path = "/" + path;
+        }
+        if (!path.endsWith("/")) {
+            path += "/";
+        }
+        return path;
     }
 
     @Override
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2UserAuthenticator.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2UserAuthenticator.java
index dde50c8bb34d..49df94709836 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2UserAuthenticator.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/OAuth2UserAuthenticator.java
@@ -30,8 +30,7 @@
 
 import javax.inject.Inject;
 import java.util.Map;
-
-import static org.apache.cloudstack.oauth2.OAuth2AuthManager.OAuth2IsPluginEnabled;
+import java.util.Objects;
 
 public class OAuth2UserAuthenticator extends AdapterBase implements UserAuthenticator {
 
@@ -49,7 +48,7 @@ public Pair<Boolean, ActionOnFailedAuthentication> authenticate(String username,
             logger.debug("Trying OAuth2 auth for user: " + username);
         }
 
-        if (!isOAuthPluginEnabled()) {
+        if (!isOAuthPluginEnabled(domainId)) {
             logger.debug("OAuth2 plugin is disabled");
             return new Pair<Boolean, ActionOnFailedAuthentication>(false, null);
         } else if (requestParameters == null) {
@@ -76,7 +75,7 @@ public Pair<Boolean, ActionOnFailedAuthentication> authenticate(String username,
             String secretCode = ((secretCodeArray == null) ? null : secretCodeArray[0]);
 
             UserOAuth2Authenticator authenticator = userOAuth2mgr.getUserOAuth2AuthenticationProvider(oauthProvider);
-            if (user != null && authenticator.verifyUser(email, secretCode)) {
+            if (Objects.nonNull(user) && authenticator.verifyUser(email, secretCode, domainId)) {
                 return new Pair<Boolean, ActionOnFailedAuthentication>(true, null);
             }
         }
@@ -89,7 +88,7 @@ public String encode(String password) {
         return null;
     }
 
-    protected boolean isOAuthPluginEnabled() {
-        return OAuth2IsPluginEnabled.value();
+    protected boolean isOAuthPluginEnabled(Long domainId) {
+        return OAuth2AuthManager.isPluginEnabledForDomain(domainId);
     }
 }
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/ListOAuthProvidersCmd.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/ListOAuthProvidersCmd.java
index 9b91a1d879c2..2d0a2e2a7417 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/ListOAuthProvidersCmd.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/ListOAuthProvidersCmd.java
@@ -35,14 +35,17 @@
 import org.apache.cloudstack.api.auth.APIAuthenticationType;
 import org.apache.cloudstack.api.auth.APIAuthenticator;
 import org.apache.cloudstack.api.auth.PluggableAPIAuthenticator;
+import org.apache.cloudstack.api.response.DomainResponse;
 import org.apache.cloudstack.api.response.ListResponse;
 import org.apache.cloudstack.auth.UserOAuth2Authenticator;
 import org.apache.cloudstack.oauth2.OAuth2AuthManager;
 import org.apache.cloudstack.oauth2.api.response.OauthProviderResponse;
 import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
-import org.apache.commons.lang.ArrayUtils;
+import org.apache.commons.lang3.ArrayUtils;
 
+import com.cloud.api.ApiDBUtils;
 import com.cloud.api.response.ApiResponseSerializer;
+import com.cloud.domain.Domain;
 import com.cloud.user.Account;
 
 @APICommand(name = "listOauthProvider", description = "List OAuth providers registered", responseObject = OauthProviderResponse.class, entityType = {},
@@ -60,6 +63,14 @@ public class ListOAuthProvidersCmd extends BaseListCmd implements APIAuthenticat
     @Parameter(name = ApiConstants.PROVIDER, type = CommandType.STRING, description = "Name of the provider")
     private String provider;
 
+    @Parameter(name = ApiConstants.DOMAIN_ID, type = CommandType.UUID, entityType = DomainResponse.class,
+            description = "Domain ID to list OAuth providers for a specific domain. Use -1 for global providers only.", since = "4.23.0")
+    private Long domainId;
+
+    @Parameter(name = ApiConstants.DOMAIN, type = CommandType.STRING,
+            description = "Domain path for domain-specific OAuth provider lookup. Ignored when Domain ID is passed.", since = "4.23.0")
+    private String domainPath;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -71,6 +82,10 @@ public String getProvider() {
         return provider;
     }
 
+    public Long getDomainId() {
+        return domainId;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
@@ -99,7 +114,26 @@ public String authenticate(String command, Map<String, Object[]> params, HttpSes
             provider = providerArray[0];
         }
 
-        List<OauthProviderVO> resultList = _oauth2mgr.listOauthProviders(provider, id);
+        boolean domainRequested = ArrayUtils.isNotEmpty((String[])params.get(ApiConstants.DOMAIN_ID))
+                || ArrayUtils.isNotEmpty((String[])params.get(ApiConstants.DOMAIN));
+        domainId = _oauth2mgr.resolveDomainId(params);
+
+        if (domainRequested && domainId == null) {
+            ListResponse<OauthProviderResponse> response = new ListResponse<>();
+            response.setResponses(new ArrayList<>(), 0);
+            response.setResponseName(getCommandName());
+            setResponseObject(response);
+            return ApiResponseSerializer.toSerializedString(response, responseType);
+        }
+
+        List<OauthProviderVO> resultList = _oauth2mgr.listOauthProviders(provider, id, domainId);
+        boolean isAuthenticated = session != null && session.getAttribute(ApiConstants.USER_ID) != null;
+        if (domainRequested && domainId != null && domainId > 0) {
+            resultList.removeIf(p -> p.getDomainId() == null);
+        } else if (!domainRequested && !isAuthenticated) {
+            resultList.removeIf(p -> p.getDomainId() != null);
+        }
+
         List<UserOAuth2Authenticator> userOAuth2AuthenticatorPlugins = _oauth2mgr.listUserOAuth2AuthenticationProviders();
         List<String> authenticatorPluginNames = new ArrayList<>();
         for (UserOAuth2Authenticator authenticator : userOAuth2AuthenticatorPlugins) {
@@ -108,9 +142,11 @@ public String authenticate(String command, Map<String, Object[]> params, HttpSes
         }
         List<OauthProviderResponse> responses = new ArrayList<>();
         for (OauthProviderVO result : resultList) {
+            Domain domain = result.getDomainId() != null ? ApiDBUtils.findDomainById(result.getDomainId()) : null;
             OauthProviderResponse r = new OauthProviderResponse(result.getUuid(), result.getProvider(),
-                    result.getDescription(), result.getClientId(), result.getSecretKey(), result.getRedirectUri(), result.getAuthorizeUrl(), result.getTokenUrl());
-            if (OAuth2AuthManager.OAuth2IsPluginEnabled.value() && authenticatorPluginNames.contains(result.getProvider()) && result.isEnabled()) {
+                    result.getDescription(), result.getClientId(), result.getSecretKey(), result.getRedirectUri(), result.getAuthorizeUrl(), result.getTokenUrl(), domain);
+            boolean oauthEnabled = OAuth2AuthManager.isPluginEnabledForDomain(result.getDomainId());
+            if (oauthEnabled && authenticatorPluginNames.contains(result.getProvider()) && result.isEnabled()) {
                 r.setEnabled(true);
             } else {
                 r.setEnabled(false);
@@ -119,8 +155,20 @@ public String authenticate(String command, Map<String, Object[]> params, HttpSes
             responses.add(r);
         }
 
+        int totalEnabledCount = responses.size();
+        if (!domainRequested && !isAuthenticated) {
+            List<OauthProviderVO> allProviders = _oauth2mgr.listOauthProviders(null, null, null);
+            for (OauthProviderVO domainProvider : allProviders) {
+                if (domainProvider.getDomainId() != null && domainProvider.isEnabled()
+                        && OAuth2AuthManager.isPluginEnabledForDomain(domainProvider.getDomainId())
+                        && authenticatorPluginNames.contains(domainProvider.getProvider())) {
+                    totalEnabledCount++;
+                }
+            }
+        }
+
         ListResponse<OauthProviderResponse> response = new ListResponse<>();
-        response.setResponses(responses, resultList.size());
+        response.setResponses(responses, totalEnabledCount);
         response.setResponseName(getCommandName());
         setResponseObject(response);
 
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/OauthLoginAPIAuthenticatorCmd.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/OauthLoginAPIAuthenticatorCmd.java
index d2af4c24ce43..e9ef030aaab5 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/OauthLoginAPIAuthenticatorCmd.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/OauthLoginAPIAuthenticatorCmd.java
@@ -16,6 +16,8 @@
 // under the License.
 package org.apache.cloudstack.oauth2.api.command;
 
+import java.util.Objects;
+
 import com.cloud.api.ApiServlet;
 import com.cloud.domain.Domain;
 import com.cloud.user.User;
@@ -48,7 +50,7 @@
 import java.util.Map;
 import java.net.InetAddress;
 
-import static org.apache.cloudstack.oauth2.OAuth2AuthManager.OAuth2IsPluginEnabled;
+import org.apache.cloudstack.oauth2.OAuth2AuthManager;
 
 @APICommand(name = "oauthlogin", description = "Logs a user into the CloudStack after successful verification of OAuth secret code from the particular provider." +
         "A successful login attempt will generate a JSESSIONID cookie value that can be passed in subsequent Query command calls until the \"logout\" command has been issued or the session has expired.",
@@ -120,9 +122,6 @@ public void execute() throws ServerApiException {
 
     @Override
     public String authenticate(String command, Map<String, Object[]> params, HttpSession session, InetAddress remoteAddress, String responseType, StringBuilder auditTrailSb, final HttpServletRequest req, final HttpServletResponse resp) throws ServerApiException {
-        if (!OAuth2IsPluginEnabled.value()) {
-            throw new CloudAuthenticationException("OAuth is not enabled in CloudStack, users cannot login using OAuth");
-        }
         final String[] provider = (String[])params.get(ApiConstants.PROVIDER);
         final String[] emailArray = (String[])params.get(ApiConstants.EMAIL);
         final String[] secretCodeArray = (String[])params.get(ApiConstants.SECRET_CODE);
@@ -130,15 +129,41 @@ public String authenticate(String command, Map<String, Object[]> params, HttpSes
         String oauthProvider = ((provider == null) ? null : provider[0]);
         String email = ((emailArray == null) ? null : emailArray[0]);
         String secretCode = ((secretCodeArray == null) ? null : secretCodeArray[0]);
-        if (StringUtils.isAnyEmpty(oauthProvider, email, secretCode)) {
-            throw new CloudAuthenticationException("OAuth provider, email, secretCode any of these cannot be null");
-        }
 
-        Long domainId = getDomainIdFromParams(params, auditTrailSb, responseType);
-        final String[] domainName = (String[])params.get(ApiConstants.DOMAIN);
-        String domain = getDomainName(auditTrailSb, domainName);
+        try {
+            if (StringUtils.isAnyEmpty(oauthProvider, email, secretCode)) {
+                throw new CloudAuthenticationException("OAuth provider, email, secretCode any of these cannot be null");
+            }
+
+            Long domainId = getDomainIdFromParams(params, auditTrailSb, responseType);
+            final String[] domainName = (String[])params.get(ApiConstants.DOMAIN);
+            String domain = getDomainName(auditTrailSb, domainName);
+
+            final Domain userDomain = _domainService.findDomainByIdOrPath(domainId, domain);
+            if (Objects.nonNull(userDomain)) {
+                domainId = userDomain.getId();
+            }
+
+            boolean oauthEnabled = OAuth2AuthManager.isPluginEnabledForDomain(domainId);
+            if (!oauthEnabled) {
+                logger.debug(String.format("OAuth is not enabled %s, users cannot login using OAuth", domainId == null ? "globally" : "in domain " + domainId));
+                throw new CloudAuthenticationException(String.format(
+                        "OAuth login is not enabled %s. Please contact your administrator.",
+                        domainId == null ? "globally" : "for this domain"));
+            }
+
+            return doOauthAuthentication(session, domainId, domain, email, params, remoteAddress, responseType, auditTrailSb);
+        } catch (final CloudAuthenticationException ex) {
+            throw toServerApiException(session, params, responseType, auditTrailSb, ex);
+        }
+    }
 
-        return doOauthAuthentication(session, domainId, domain, email, params, remoteAddress, responseType, auditTrailSb);
+    private ServerApiException toServerApiException(HttpSession session, Map<String, Object[]> params, String responseType, StringBuilder auditTrailSb, CloudAuthenticationException ex) {
+        ApiServlet.invalidateHttpSession(session, "fall through to API key,");
+        String msg = ex.getMessage() != null ? ex.getMessage() : "failed to authenticate user via OAuth";
+        auditTrailSb.append(" " + ApiErrorCode.ACCOUNT_ERROR + " " + msg);
+        String serializedResponse = _apiServer.getSerializedApiError(ApiErrorCode.ACCOUNT_ERROR.getHttpCode(), msg, params, responseType);
+        return new ServerApiException(ApiErrorCode.ACCOUNT_ERROR, serializedResponse);
     }
 
     private String doOauthAuthentication(HttpSession session, Long domainId, String domain, String email, Map<String, Object[]> params, InetAddress remoteAddress, String responseType, StringBuilder auditTrailSb) {
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/RegisterOAuthProviderCmd.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/RegisterOAuthProviderCmd.java
index 8eb4493d76d8..79274ba904b1 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/RegisterOAuthProviderCmd.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/RegisterOAuthProviderCmd.java
@@ -26,6 +26,7 @@
 import org.apache.cloudstack.api.BaseCmd;
 import org.apache.cloudstack.api.Parameter;
 import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.DomainResponse;
 import org.apache.cloudstack.api.response.SuccessResponse;
 import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.oauth2.OAuth2AuthManager;
@@ -35,6 +36,8 @@
 import org.apache.commons.collections.MapUtils;
 import org.apache.commons.lang3.StringUtils;
 
+import com.cloud.api.ApiDBUtils;
+import com.cloud.domain.Domain;
 import com.cloud.exception.ConcurrentOperationException;
 
 @APICommand(name = "registerOauthProvider", responseObject = SuccessResponse.class, description = "Register the OAuth2 provider in CloudStack", since = "4.19.0")
@@ -59,6 +62,14 @@ public class RegisterOAuthProviderCmd extends BaseCmd {
     @Parameter(name = ApiConstants.REDIRECT_URI, type = CommandType.STRING, description = "Redirect URI pre-registered in the specific OAuth provider", required = true)
     private String redirectUri;
 
+    @Parameter(name = ApiConstants.DOMAIN_ID, type = CommandType.UUID, entityType = DomainResponse.class,
+            description = "Domain ID for domain-specific OAuth provider. If not provided, registers as global provider", since = "4.23.0")
+    private Long domainId;
+
+    @Parameter(name = ApiConstants.DOMAIN, type = CommandType.STRING,
+            description = "Domain path for domain-specific OAuth provider. Ignored when Domain ID is passed.", since = "4.23.0")
+    private String domainPath;
+
     @Parameter(name = ApiConstants.AUTHORIZE_URL, type = CommandType.STRING, description = "Authorize URL for OAuth initialization (only required for keycloak provider)")
     private String authorizeUrl;
 
@@ -94,6 +105,14 @@ public String getRedirectUri() {
         return redirectUri;
     }
 
+    public Long getDomainId() {
+        return domainId;
+    }
+
+    public String getDomainPath() {
+        return domainPath;
+    }
+
     public String getAuthorizeUrl() {
         return authorizeUrl;
     }
@@ -126,9 +145,10 @@ public void execute() throws ServerApiException, ConcurrentOperationException, E
 
         OauthProviderVO provider = _oauth2mgr.registerOauthProvider(this);
 
+        Domain domain = provider.getDomainId() != null ? ApiDBUtils.findDomainById(provider.getDomainId()) : null;
         OauthProviderResponse response = new OauthProviderResponse(provider.getUuid(), provider.getProvider(),
                 provider.getDescription(), provider.getClientId(), provider.getSecretKey(), provider.getRedirectUri(),
-                provider.getAuthorizeUrl(), provider.getTokenUrl());
+                provider.getAuthorizeUrl(), provider.getTokenUrl(), domain);
         response.setResponseName(getCommandName());
         response.setObjectName(ApiConstants.OAUTH_PROVIDER);
         setResponseObject(response);
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/UpdateOAuthProviderCmd.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/UpdateOAuthProviderCmd.java
index a8b0604a9bba..f32c08e048eb 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/UpdateOAuthProviderCmd.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/UpdateOAuthProviderCmd.java
@@ -28,12 +28,16 @@
 import org.apache.cloudstack.api.BaseCmd;
 import org.apache.cloudstack.api.Parameter;
 import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.response.DomainResponse;
 import org.apache.cloudstack.auth.UserOAuth2Authenticator;
 import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.oauth2.OAuth2AuthManager;
 import org.apache.cloudstack.oauth2.api.response.OauthProviderResponse;
 import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
 
+import com.cloud.api.ApiDBUtils;
+import com.cloud.domain.Domain;
+
 @APICommand(name = "updateOauthProvider", description = "Updates the registered OAuth provider details", responseObject = OauthProviderResponse.class,
         requestHasSensitiveInfo = false, responseHasSensitiveInfo = false, since = "4.19.0")
 public final class UpdateOAuthProviderCmd extends BaseCmd {
@@ -66,6 +70,14 @@ public final class UpdateOAuthProviderCmd extends BaseCmd {
     @Parameter(name = ApiConstants.ENABLED, type = CommandType.BOOLEAN, description = "OAuth provider will be enabled or disabled based on this value")
     private Boolean enabled;
 
+    @Parameter(name = ApiConstants.DOMAIN_ID, type = CommandType.UUID, entityType = DomainResponse.class,
+            description = "Domain ID to reassign this OAuth provider to. If not provided, the current domain assignment is kept.", since = "4.23.0")
+    private Long domainId;
+
+    @Parameter(name = ApiConstants.DOMAIN, type = CommandType.STRING,
+            description = "Domain path to reassign this OAuth provider to. Ignored when Domain ID is passed. If neither is provided, the current domain assignment is kept.", since = "4.23.0")
+    private String domainPath;
+
     @Inject
     OAuth2AuthManager _oauthMgr;
 
@@ -105,6 +117,14 @@ public Boolean getEnabled() {
         return enabled;
     }
 
+    public Long getDomainId() {
+        return domainId;
+    }
+
+    public String getDomainPath() {
+        return domainPath;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
@@ -128,9 +148,10 @@ public ApiCommandResourceType getApiResourceType() {
     public void execute() {
         OauthProviderVO result = _oauthMgr.updateOauthProvider(this);
         if (result != null) {
+            Domain domain = result.getDomainId() != null ? ApiDBUtils.findDomainById(result.getDomainId()) : null;
             OauthProviderResponse r = new OauthProviderResponse(result.getUuid(), result.getProvider(),
                     result.getDescription(), result.getClientId(), result.getSecretKey(), result.getRedirectUri(),
-                    result.getAuthorizeUrl(), result.getTokenUrl());
+                    result.getAuthorizeUrl(), result.getTokenUrl(), domain);
 
             List<UserOAuth2Authenticator> userOAuth2AuthenticatorPlugins = _oauthMgr.listUserOAuth2AuthenticationProviders();
             List<String> authenticatorPluginNames = new ArrayList<>();
@@ -138,7 +159,8 @@ public void execute() {
                 String name = authenticator.getName();
                 authenticatorPluginNames.add(name);
             }
-            if (OAuth2AuthManager.OAuth2IsPluginEnabled.value() && authenticatorPluginNames.contains(result.getProvider()) && result.isEnabled()) {
+            boolean oauthEnabled = OAuth2AuthManager.isPluginEnabledForDomain(result.getDomainId());
+            if (oauthEnabled && authenticatorPluginNames.contains(result.getProvider()) && result.isEnabled()) {
                 r.setEnabled(true);
             } else {
                 r.setEnabled(false);
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/VerifyOAuthCodeAndGetUserCmd.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/VerifyOAuthCodeAndGetUserCmd.java
index b3d2d335ba25..d5c7455d0f33 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/VerifyOAuthCodeAndGetUserCmd.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/command/VerifyOAuthCodeAndGetUserCmd.java
@@ -20,6 +20,9 @@
 import java.util.List;
 import java.util.Map;
 
+import com.cloud.api.response.ApiResponseSerializer;
+import com.cloud.user.Account;
+
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
@@ -34,13 +37,11 @@
 import org.apache.cloudstack.api.auth.APIAuthenticationType;
 import org.apache.cloudstack.api.auth.APIAuthenticator;
 import org.apache.cloudstack.api.auth.PluggableAPIAuthenticator;
+import org.apache.cloudstack.api.response.DomainResponse;
 import org.apache.cloudstack.api.response.UserResponse;
 import org.apache.cloudstack.oauth2.OAuth2AuthManager;
 import org.apache.cloudstack.oauth2.api.response.OauthProviderResponse;
-import org.apache.commons.lang.ArrayUtils;
-
-import com.cloud.api.response.ApiResponseSerializer;
-import com.cloud.user.Account;
+import org.apache.commons.lang3.ArrayUtils;
 
 @APICommand(name = "verifyOAuthCodeAndGetUser", description = "Verify the OAuth Code and fetch the corresponding user from provider", responseObject = OauthProviderResponse.class, entityType = {},
         requestHasSensitiveInfo = false, responseHasSensitiveInfo = false,
@@ -58,6 +59,14 @@ public class VerifyOAuthCodeAndGetUserCmd extends BaseListCmd implements APIAuth
     @Parameter(name = ApiConstants.SECRET_CODE, type = CommandType.STRING, description = "Code that is provided by OAuth provider (Eg. google, github) after successful login")
     private String secretCode;
 
+    @Parameter(name = ApiConstants.DOMAIN_ID, type = CommandType.UUID, entityType = DomainResponse.class,
+            description = "Domain ID for domain-specific OAuth provider lookup. If not provided, uses global provider", since = "4.23.0")
+    private Long domainId;
+
+    @Parameter(name = ApiConstants.DOMAIN, type = CommandType.STRING,
+            description = "Domain path for domain-specific OAuth provider lookup. Ignored when Domain ID is passed.", since = "4.23.0")
+    private String domainPath;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -70,6 +79,10 @@ public String getSecretCode() {
         return secretCode;
     }
 
+    public Long getDomainId() {
+        return domainId;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
@@ -97,8 +110,9 @@ public String authenticate(String command, Map<String, Object[]> params, HttpSes
         if (ArrayUtils.isNotEmpty(providerArray)) {
             provider = providerArray[0];
         }
+        domainId = _oauth2mgr.resolveDomainId(params);
 
-        String email = _oauth2mgr.verifyCodeAndFetchEmail(secretCode, provider);
+        String email = _oauth2mgr.verifySecretCodeAndFetchEmail(secretCode, provider, domainId);
         if (email != null) {
             UserResponse response = new UserResponse();
             response.setEmail(email);
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/response/OauthProviderResponse.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/response/OauthProviderResponse.java
index 289dc6650137..b363e13516bc 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/response/OauthProviderResponse.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/api/response/OauthProviderResponse.java
@@ -16,11 +16,14 @@
 // under the License.
 package org.apache.cloudstack.oauth2.api.response;
 
+import java.util.Objects;
+
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.BaseResponse;
 import org.apache.cloudstack.api.EntityReference;
 import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
 
+import com.cloud.domain.Domain;
 import com.cloud.serializer.Param;
 import com.google.gson.annotations.SerializedName;
 
@@ -55,6 +58,18 @@ public class OauthProviderResponse extends BaseResponse {
     @Param(description = "Redirect URI registered in the OAuth provider")
     private String redirectUri;
 
+    @SerializedName(ApiConstants.DOMAIN_ID)
+    @Param(description = "UUID of the domain the provider belongs to (empty for global)", since = "4.23.0")
+    private String domainUuid;
+
+    @SerializedName(ApiConstants.DOMAIN)
+    @Param(description = "name of the domain the provider belongs to (empty for global)", since = "4.23.0")
+    private String domainName;
+
+    @SerializedName(ApiConstants.DOMAIN_PATH)
+    @Param(description = "path of the domain the provider belongs to (empty for global)", since = "4.23.0")
+    private String domainPath;
+
     @SerializedName(ApiConstants.AUTHORIZE_URL)
     @Param(description = "Authorize URL registered in the OAuth provider")
     private String authorizeUrl;
@@ -67,7 +82,7 @@ public class OauthProviderResponse extends BaseResponse {
     @Param(description = "Whether the OAuth provider is enabled or not")
     private boolean enabled;
 
-    public OauthProviderResponse(String id, String provider, String description, String clientId, String secretKey, String redirectUri, String authorizeUrl, String tokenUrl) {
+    public OauthProviderResponse(String id, String provider, String description, String clientId, String secretKey, String redirectUri, String authorizeUrl, String tokenUrl, Domain domain) {
         this.id = id;
         this.provider = provider;
         this.name = provider;
@@ -77,6 +92,19 @@ public OauthProviderResponse(String id, String provider, String description, Str
         this.redirectUri = redirectUri;
         this.authorizeUrl = authorizeUrl;
         this.tokenUrl = tokenUrl;
+        if (Objects.nonNull(domain)) {
+            this.domainUuid = domain.getUuid();
+            this.domainName = domain.getName();
+            this.domainPath = prettifyDomainPath(domain.getPath());
+        }
+    }
+
+    private static String prettifyDomainPath(String path) {
+        if (path == null) {
+            return null;
+        }
+        String trimmed = path.endsWith("/") ? path.substring(0, path.length() - 1) : path;
+        return "ROOT" + trimmed;
     }
 
     public String getId() {
@@ -128,6 +156,30 @@ public void setRedirectUri(String redirectUri) {
         this.redirectUri = redirectUri;
     }
 
+    public String getDomainUuid() {
+        return domainUuid;
+    }
+
+    public void setDomainUuid(String domainUuid) {
+        this.domainUuid = domainUuid;
+    }
+
+    public String getDomainName() {
+        return domainName;
+    }
+
+    public void setDomainName(String domainName) {
+        this.domainName = domainName;
+    }
+
+    public String getDomainPath() {
+        return domainPath;
+    }
+
+    public void setDomainPath(String domainPath) {
+        this.domainPath = domainPath;
+    }
+
     public String getAuthorizeUrl() {
         return authorizeUrl;
     }
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/dao/OauthProviderDao.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/dao/OauthProviderDao.java
index 31738ac75a0f..629abb0bb2ec 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/dao/OauthProviderDao.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/dao/OauthProviderDao.java
@@ -19,8 +19,16 @@
 import com.cloud.utils.db.GenericDao;
 import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
 
+import java.util.List;
+
 public interface OauthProviderDao extends GenericDao<OauthProviderVO, Long> {
 
-    public OauthProviderVO findByProvider(String provider);
+    public OauthProviderVO findByProviderAndDomain(String provider, Long domainId);
+
+    public List<OauthProviderVO> listByDomainIncludingGlobal(Long domainId);
+
+    public List<OauthProviderVO> listByDomain(Long domainId);
+
+    public OauthProviderVO findByProviderAndDomainWithGlobalFallback(String provider, Long domainId);
 
 }
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/dao/OauthProviderDaoImpl.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/dao/OauthProviderDaoImpl.java
index 27eea4d22a6b..eecff0f4f506 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/dao/OauthProviderDaoImpl.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/dao/OauthProviderDaoImpl.java
@@ -22,23 +22,54 @@
 import com.cloud.utils.db.SearchCriteria;
 import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
 
+import java.util.List;
+import java.util.Objects;
+
 public class OauthProviderDaoImpl extends GenericDaoBase<OauthProviderVO, Long> implements OauthProviderDao {
 
-    private final SearchBuilder<OauthProviderVO> oauthProviderSearchByName;
+    private final SearchBuilder<OauthProviderVO> oauthProviderSearchByProviderAndDomain;
 
     public OauthProviderDaoImpl() {
         super();
 
-        oauthProviderSearchByName = createSearchBuilder();
-        oauthProviderSearchByName.and("provider", oauthProviderSearchByName.entity().getProvider(), SearchCriteria.Op.EQ);
-        oauthProviderSearchByName.done();
+        oauthProviderSearchByProviderAndDomain = createSearchBuilder();
+        oauthProviderSearchByProviderAndDomain.and("provider", oauthProviderSearchByProviderAndDomain.entity().getProvider(), SearchCriteria.Op.EQ);
+        oauthProviderSearchByProviderAndDomain.and("domainId", oauthProviderSearchByProviderAndDomain.entity().getDomainId(), SearchCriteria.Op.EQ);
+        oauthProviderSearchByProviderAndDomain.done();
     }
 
     @Override
-    public OauthProviderVO findByProvider(String provider) {
-        SearchCriteria<OauthProviderVO> sc = oauthProviderSearchByName.create();
+    public OauthProviderVO findByProviderAndDomain(String provider, Long domainId) {
+        SearchCriteria<OauthProviderVO> sc = oauthProviderSearchByProviderAndDomain.create();
         sc.setParameters("provider", provider);
-
+        sc.setParameters("domainId", domainId);
         return findOneBy(sc);
     }
+
+    @Override
+    public List<OauthProviderVO> listByDomainIncludingGlobal(Long domainId) {
+        SearchCriteria<OauthProviderVO> sc = createSearchCriteria();
+        sc.addOr("domainId", SearchCriteria.Op.EQ, domainId);
+        sc.addOr("domainId", SearchCriteria.Op.NULL);
+        return listBy(sc);
+    }
+
+    @Override
+    public List<OauthProviderVO> listByDomain(Long domainId) {
+        SearchCriteria<OauthProviderVO> sc = createSearchCriteria();
+        sc.addAnd("domainId", SearchCriteria.Op.EQ, domainId);
+        return listBy(sc);
+    }
+
+    @Override
+    public OauthProviderVO findByProviderAndDomainWithGlobalFallback(String provider, Long domainId) {
+        OauthProviderVO providerVO = null;
+        if (Objects.nonNull(domainId)) {
+            providerVO = findByProviderAndDomain(provider, domainId);
+        }
+        if (Objects.isNull(providerVO)) {
+            providerVO = findByProviderAndDomain(provider, null);
+        }
+        return providerVO;
+    }
 }
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/github/GithubOAuth2Provider.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/github/GithubOAuth2Provider.java
index 4d426181a94b..7413d22b2fa6 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/github/GithubOAuth2Provider.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/github/GithubOAuth2Provider.java
@@ -56,17 +56,27 @@ public String getDescription() {
 
     @Override
     public boolean verifyUser(String email, String secretCode) {
+        return verifyUser(email, secretCode, null);
+    }
+
+    @Override
+    public String verifySecretCodeAndFetchEmail(String secretCode) {
+        return verifySecretCodeAndFetchEmail(secretCode, null);
+    }
+
+    @Override
+    public boolean verifyUser(String email, String secretCode, Long domainId) {
         if (StringUtils.isAnyEmpty(email, secretCode)) {
             throw new CloudRuntimeException(String.format("Either email or secretcode should not be null/empty"));
         }
 
-        OauthProviderVO providerVO = _oauthProviderDao.findByProvider(getName());
+        OauthProviderVO providerVO = _oauthProviderDao.findByProviderAndDomainWithGlobalFallback(getName(), domainId);
         if (providerVO == null) {
             throw new CloudRuntimeException("Github provider is not registered, so user cannot be verified");
         }
 
-        String verifiedEmail = getUserEmailAddress();
-        if (verifiedEmail == null || !email.equals(verifiedEmail)) {
+        String verifiedEmail = verifySecretCodeAndFetchEmail(secretCode, domainId);
+        if (StringUtils.isEmpty(verifiedEmail) || !email.equals(verifiedEmail)) {
             throw new CloudRuntimeException("Unable to verify the email address with the provided secret");
         }
 
@@ -76,16 +86,19 @@ public boolean verifyUser(String email, String secretCode) {
     }
 
     @Override
-    public String verifyCodeAndFetchEmail(String secretCode) {
-        String accessToken = getAccessToken(secretCode);
-        if (accessToken == null) {
+    public String verifySecretCodeAndFetchEmail(String secretCode, Long domainId) {
+        String accessToken = getAccessToken(secretCode, domainId);
+        if (StringUtils.isEmpty(accessToken)) {
             return null;
         }
         return getUserEmailAddress();
     }
 
-    protected String getAccessToken(String secretCode) throws CloudRuntimeException {
-        OauthProviderVO githubProvider = _oauthProviderDao.findByProvider(getName());
+    protected String getAccessToken(String secretCode, Long domainId) throws CloudRuntimeException {
+        if (StringUtils.isNotEmpty(accessToken)) {
+            return accessToken;
+        }
+        OauthProviderVO githubProvider = _oauthProviderDao.findByProviderAndDomainWithGlobalFallback(getName(), domainId);
         String tokenUrl = "https://github.com/login/oauth/access_token";
         String generatedAccessToken = null;
         try {
@@ -131,7 +144,7 @@ protected String getAccessToken(String secretCode) throws CloudRuntimeException
     }
 
     public String getUserEmailAddress() throws CloudRuntimeException {
-        if (accessToken == null) {
+        if (StringUtils.isEmpty(accessToken)) {
             throw new CloudRuntimeException("Access Token not found to fetch the email address");
         }
 
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/google/GoogleOAuth2Provider.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/google/GoogleOAuth2Provider.java
index 885930181c91..3b37f0f6e0b8 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/google/GoogleOAuth2Provider.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/google/GoogleOAuth2Provider.java
@@ -60,16 +60,36 @@ public String getDescription() {
 
     @Override
     public boolean verifyUser(String email, String secretCode) {
+        return verifyUser(email, secretCode, null);
+    }
+
+    @Override
+    public String verifySecretCodeAndFetchEmail(String secretCode) {
+        return verifySecretCodeAndFetchEmail(secretCode, null);
+    }
+
+    protected void clearAccessAndRefreshTokens() {
+        accessToken = null;
+        refreshToken = null;
+    }
+
+    @Override
+    public String getUserEmailAddress() throws CloudRuntimeException {
+        return null;
+    }
+
+    @Override
+    public boolean verifyUser(String email, String secretCode, Long domainId) {
         if (StringUtils.isAnyEmpty(email, secretCode)) {
             throw new CloudAuthenticationException("Either email or secret code should not be null/empty");
         }
 
-        OauthProviderVO providerVO = _oauthProviderDao.findByProvider(getName());
+        OauthProviderVO providerVO = _oauthProviderDao.findByProviderAndDomainWithGlobalFallback(getName(), domainId);
         if (providerVO == null) {
             throw new CloudAuthenticationException("Google provider is not registered, so user cannot be verified");
         }
 
-        String verifiedEmail = verifyCodeAndFetchEmail(secretCode);
+        String verifiedEmail = verifySecretCodeAndFetchEmail(secretCode, domainId);
         if (verifiedEmail == null || !email.equals(verifiedEmail)) {
             throw new CloudRuntimeException("Unable to verify the email address with the provided secret");
         }
@@ -79,11 +99,11 @@ public boolean verifyUser(String email, String secretCode) {
     }
 
     @Override
-    public String verifyCodeAndFetchEmail(String secretCode) {
-        OauthProviderVO googleProvider = _oauthProviderDao.findByProvider(getName());
-        String clientId = googleProvider.getClientId();
-        String secret = googleProvider.getSecretKey();
-        String redirectURI = googleProvider.getRedirectUri();
+    public String verifySecretCodeAndFetchEmail(String secretCode, Long domainId) {
+        OauthProviderVO provider = _oauthProviderDao.findByProviderAndDomainWithGlobalFallback(getName(), domainId);
+        String clientId = provider.getClientId();
+        String secret = provider.getSecretKey();
+        String redirectURI = provider.getRedirectUri();
         GoogleClientSecrets clientSecrets = new GoogleClientSecrets()
                 .setWeb(new GoogleClientSecrets.Details()
                         .setClientId(clientId)
@@ -129,13 +149,4 @@ public String verifyCodeAndFetchEmail(String secretCode) {
         return userinfo.getEmail();
     }
 
-    protected void clearAccessAndRefreshTokens() {
-        accessToken = null;
-        refreshToken = null;
-    }
-
-    @Override
-    public String getUserEmailAddress() throws CloudRuntimeException {
-        return null;
-    }
 }
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2Provider.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2Provider.java
index 3f537b1984d0..2a625c6f7570 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2Provider.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2Provider.java
@@ -81,16 +81,21 @@ public String getDescription() {
 
     @Override
     public boolean verifyUser(String email, String secretCode) {
+        return verifyUser(email, secretCode, null);
+    }
+
+    @Override
+    public boolean verifyUser(String email, String secretCode, Long domainId) {
         if (StringUtils.isAnyEmpty(email, secretCode)) {
             throw new CloudAuthenticationException("Either email or secret code should not be null/empty");
         }
 
-        OauthProviderVO providerVO = oauthProviderDao.findByProvider(getName());
+        OauthProviderVO providerVO = oauthProviderDao.findByProviderAndDomainWithGlobalFallback(getName(), domainId);
         if (providerVO == null) {
             throw new CloudAuthenticationException("Keycloak provider is not registered, so user cannot be verified");
         }
 
-        String verifiedEmail = verifyCodeAndFetchEmail(secretCode);
+        String verifiedEmail = verifySecretCodeAndFetchEmail(secretCode, domainId);
         if (StringUtils.isBlank(verifiedEmail) || !email.equals(verifiedEmail)) {
             throw new CloudRuntimeException("Unable to verify the email address with the provided secret");
         }
@@ -100,8 +105,13 @@ public boolean verifyUser(String email, String secretCode) {
     }
 
     @Override
-    public String verifyCodeAndFetchEmail(String secretCode) {
-        OauthProviderVO provider = oauthProviderDao.findByProvider(getName());
+    public String verifySecretCodeAndFetchEmail(String secretCode) {
+        return verifySecretCodeAndFetchEmail(secretCode, null);
+    }
+
+    @Override
+    public String verifySecretCodeAndFetchEmail(String secretCode, Long domainId) {
+        OauthProviderVO provider = oauthProviderDao.findByProviderAndDomainWithGlobalFallback(getName(), domainId);
         if (provider == null) {
             throw new CloudAuthenticationException("Keycloak provider is not registered, so user cannot be verified");
         }
diff --git a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/vo/OauthProviderVO.java b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/vo/OauthProviderVO.java
index 54d667bc9143..8aa9006e763e 100644
--- a/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/vo/OauthProviderVO.java
+++ b/plugins/user-authenticators/oauth2/src/main/java/org/apache/cloudstack/oauth2/vo/OauthProviderVO.java
@@ -57,6 +57,9 @@ public class OauthProviderVO implements Identity, InternalIdentity {
     @Column(name = "redirect_uri")
     private String redirectUri;
 
+    @Column(name = "domain_id")
+    private Long domainId;
+
     @Column(name = "authorize_url")
     private String authorizeUrl;
 
@@ -142,6 +145,14 @@ public void setSecretKey(String secretKey) {
         this.secretKey = secretKey;
     }
 
+    public Long getDomainId() {
+        return domainId;
+    }
+
+    public void setDomainId(Long domainId) {
+        this.domainId = domainId;
+    }
+
     public boolean isEnabled() {
         return enabled;
     }
diff --git a/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/OAuth2AuthManagerImplTest.java b/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/OAuth2AuthManagerImplTest.java
index 3fd5636102ce..e3e8f7594b37 100644
--- a/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/OAuth2AuthManagerImplTest.java
+++ b/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/OAuth2AuthManagerImplTest.java
@@ -19,7 +19,13 @@
 
 package org.apache.cloudstack.oauth2;
 
+import com.cloud.domain.Domain;
+import com.cloud.domain.DomainVO;
+import com.cloud.user.DomainService;
 import com.cloud.utils.exception.CloudRuntimeException;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.framework.messagebus.MessageBus;
+import org.apache.cloudstack.framework.messagebus.MessageSubscriber;
 import org.apache.cloudstack.oauth2.api.command.DeleteOAuthProviderCmd;
 import org.apache.cloudstack.oauth2.api.command.RegisterOAuthProviderCmd;
 import org.apache.cloudstack.oauth2.api.command.UpdateOAuthProviderCmd;
@@ -36,12 +42,17 @@
 import org.mockito.Spy;
 
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Collections;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
 public class OAuth2AuthManagerImplTest {
@@ -53,6 +64,12 @@ public class OAuth2AuthManagerImplTest {
     @Mock
     OauthProviderDao _oauthProviderDao;
 
+    @Mock
+    DomainService _domainService;
+
+    @Mock
+    MessageBus _messageBus;
+
     AutoCloseable closeable;
     @Before
     public void setUp() {
@@ -66,7 +83,7 @@ public void tearDown() throws Exception {
 
     @Test
     public void testRegisterOauthProvider() {
-        when(_authManager.isOAuthPluginEnabled()).thenReturn(false);
+        when(_authManager.isOAuthPluginEnabled(Mockito.nullable(Long.class))).thenReturn(false);
         RegisterOAuthProviderCmd cmd = Mockito.mock(RegisterOAuthProviderCmd.class);
         try {
             _authManager.registerOauthProvider(cmd);
@@ -76,25 +93,27 @@ public void testRegisterOauthProvider() {
         }
 
         // Test when provider is already registered
-        when(_authManager.isOAuthPluginEnabled()).thenReturn(true);
+        when(_authManager.isOAuthPluginEnabled(Mockito.nullable(Long.class))).thenReturn(true);
         OauthProviderVO providerVO = new OauthProviderVO();
         providerVO.setProvider("testProvider");
-        when(_authManager._oauthProviderDao.findByProvider(Mockito.anyString())).thenReturn(providerVO);
+        when(_authManager._oauthProviderDao.findByProviderAndDomain(Mockito.anyString(), Mockito.isNull())).thenReturn(providerVO);
         when(cmd.getProvider()).thenReturn("testProvider");
+        when(cmd.getDomainId()).thenReturn(null);
 
         try {
             _authManager.registerOauthProvider(cmd);
             Assert.fail("Expected CloudRuntimeException was not thrown");
         } catch (CloudRuntimeException e) {
-            assertEquals("Provider with the name testProvider is already registered", e.getMessage());
+            assertEquals("Global provider with the name testProvider is already registered", e.getMessage());
         }
 
         // Test when provider is github and secret key is not null
         when(cmd.getSecretKey()).thenReturn("testSecretKey");
         providerVO = null;
-        when(_authManager._oauthProviderDao.findByProvider(Mockito.anyString())).thenReturn(providerVO);
+        when(_authManager._oauthProviderDao.findByProviderAndDomain(Mockito.anyString(), Mockito.isNull())).thenReturn(providerVO);
         OauthProviderVO savedProviderVO = new OauthProviderVO();
         when(cmd.getProvider()).thenReturn("github");
+        when(cmd.getDomainId()).thenReturn(null);
         when(_authManager._oauthProviderDao.persist(Mockito.any(OauthProviderVO.class))).thenReturn(savedProviderVO);
         OauthProviderVO result = _authManager.registerOauthProvider(cmd);
         assertEquals("github", result.getProvider());
@@ -140,6 +159,115 @@ public void testUpdateOauthProvider() {
         assertEquals(secretKey, result.getSecretKey());
     }
 
+    @Test
+    public void testUpdateOauthProviderReassignsDomain() {
+        Long id = 5L;
+        Long oldDomainId = 10L;
+        Long newDomainId = 20L;
+
+        UpdateOAuthProviderCmd cmd = Mockito.mock(UpdateOAuthProviderCmd.class);
+        when(cmd.getId()).thenReturn(id);
+        when(cmd.getDomainId()).thenReturn(newDomainId);
+
+        OauthProviderVO providerVO = new OauthProviderVO();
+        providerVO.setProvider("github");
+        providerVO.setDomainId(oldDomainId);
+        when(_oauthProviderDao.findById(id)).thenReturn(providerVO);
+
+        Domain newDomain = Mockito.mock(Domain.class);
+        when(newDomain.getId()).thenReturn(newDomainId);
+        when(_domainService.getDomain(Mockito.anyString())).thenReturn(newDomain);
+        Mockito.doReturn(newDomainId).when(_authManager).resolveDomainIdFromIdOrPath(newDomainId, null);
+        when(_oauthProviderDao.findByProviderAndDomain("github", newDomainId)).thenReturn(null);
+        when(_oauthProviderDao.update(Mockito.eq(id), Mockito.any(OauthProviderVO.class))).thenReturn(true);
+        when(_oauthProviderDao.findById(id)).thenReturn(providerVO);
+
+        OauthProviderVO result = _authManager.updateOauthProvider(cmd);
+        assertEquals(newDomainId, result.getDomainId());
+    }
+
+    @Test
+    public void testUpdateOauthProviderRejectsDuplicateAtTargetDomain() {
+        Long id = 5L;
+        Long oldDomainId = 10L;
+        Long newDomainId = 20L;
+
+        UpdateOAuthProviderCmd cmd = Mockito.mock(UpdateOAuthProviderCmd.class);
+        when(cmd.getId()).thenReturn(id);
+        when(cmd.getDomainId()).thenReturn(newDomainId);
+
+        OauthProviderVO providerVO = new OauthProviderVO();
+        providerVO.setProvider("github");
+        providerVO.setDomainId(oldDomainId);
+        when(_oauthProviderDao.findById(id)).thenReturn(providerVO);
+
+        Mockito.doReturn(newDomainId).when(_authManager).resolveDomainIdFromIdOrPath(newDomainId, null);
+        OauthProviderVO collision = new OauthProviderVO();
+        collision.setProvider("github");
+        collision.setDomainId(newDomainId);
+        when(_oauthProviderDao.findByProviderAndDomain("github", newDomainId)).thenReturn(collision);
+
+        try {
+            _authManager.updateOauthProvider(cmd);
+            Assert.fail("Expected CloudRuntimeException for duplicate at target domain");
+        } catch (CloudRuntimeException e) {
+            assertTrue(e.getMessage().contains("already registered"));
+        }
+    }
+
+    @Test
+    public void testRegisterOauthProviderForRootDomainTreatedAsGlobal() {
+        RegisterOAuthProviderCmd cmd = Mockito.mock(RegisterOAuthProviderCmd.class);
+        when(cmd.getProvider()).thenReturn("github");
+        when(cmd.getDomainId()).thenReturn(com.cloud.domain.Domain.ROOT_DOMAIN);
+        when(cmd.getSecretKey()).thenReturn("secret");
+        when(cmd.getClientId()).thenReturn("clientId");
+        when(cmd.getRedirectUri()).thenReturn("https://redirect");
+
+        // global check must be consulted (domainId resolves to null), not the ROOT domain scope
+        when(_authManager.isOAuthPluginEnabled(Mockito.isNull())).thenReturn(true);
+        when(_oauthProviderDao.findByProviderAndDomain("github", null)).thenReturn(null);
+        when(_oauthProviderDao.persist(Mockito.any(OauthProviderVO.class))).thenAnswer(i -> i.getArgument(0));
+
+        OauthProviderVO result = _authManager.registerOauthProvider(cmd);
+        assertNull(result.getDomainId());
+        Mockito.verify(_oauthProviderDao).findByProviderAndDomain("github", null);
+    }
+
+    @Test
+    public void testNormalizeGlobalScopeMapsRootToNull() {
+        assertNull(_authManager.normalizeGlobalScope(com.cloud.domain.Domain.ROOT_DOMAIN));
+        assertNull(_authManager.normalizeGlobalScope(null));
+        assertEquals(Long.valueOf(42L), _authManager.normalizeGlobalScope(42L));
+    }
+
+    @Test
+    public void testUpdateOauthProviderRejectsEnableWhenPluginDisabledAtScope() {
+        Long id = 7L;
+        Long domainId = 42L;
+
+        UpdateOAuthProviderCmd cmd = Mockito.mock(UpdateOAuthProviderCmd.class);
+        when(cmd.getId()).thenReturn(id);
+        when(cmd.getEnabled()).thenReturn(true);
+
+        OauthProviderVO providerVO = new OauthProviderVO();
+        providerVO.setProvider("github");
+        providerVO.setDomainId(domainId);
+        providerVO.setEnabled(false);
+
+        when(_oauthProviderDao.findById(id)).thenReturn(providerVO);
+        Mockito.doReturn(false).when(_authManager).isOAuthPluginEnabled(domainId);
+
+        try {
+            _authManager.updateOauthProvider(cmd);
+            Assert.fail("Expected CloudRuntimeException when enabling provider while oauth2.enabled is false at scope");
+        } catch (CloudRuntimeException e) {
+            assertTrue(e.getMessage().contains("OAuth plugin is not enabled"));
+        }
+
+        Mockito.verify(_oauthProviderDao, Mockito.never()).update(Mockito.eq(id), Mockito.any(OauthProviderVO.class));
+    }
+
     @Test
     public void testListOauthProviders() {
         String uuid = "1234-5678-9101";
@@ -150,20 +278,32 @@ public void testListOauthProviders() {
 
         // Test when uuid is not null
         when(_oauthProviderDao.findByUuid(uuid)).thenReturn(providerVO);
-        List<OauthProviderVO> result = _authManager.listOauthProviders(null, uuid);
+        List<OauthProviderVO> result = _authManager.listOauthProviders(null, uuid, null);
         assertEquals(providerList, result);
 
         // Test when provider is not blank
-        when(_oauthProviderDao.findByProvider(provider)).thenReturn(providerVO);
-        result = _authManager.listOauthProviders(provider, null);
+        when(_oauthProviderDao.findByProviderAndDomain(provider, null)).thenReturn(providerVO);
+        result = _authManager.listOauthProviders(provider, null, null);
         assertEquals(providerList, result);
 
         // Test when both uuid and provider are null
         when(_oauthProviderDao.listAll()).thenReturn(providerList);
-        result = _authManager.listOauthProviders(null, null);
+        result = _authManager.listOauthProviders(null, null, null);
         assertEquals(providerList, result);
     }
 
+    @Test
+    public void testDeleteOauthProviderHardDeletes() {
+        Long providerId = 42L;
+        when(_oauthProviderDao.expunge(providerId)).thenReturn(true);
+
+        boolean result = _authManager.deleteOauthProvider(providerId);
+
+        assertTrue(result);
+        Mockito.verify(_oauthProviderDao).expunge(providerId);
+        Mockito.verify(_oauthProviderDao, Mockito.never()).remove(Mockito.anyLong());
+    }
+
     @Test
     public void testGetCommands() {
         List<Class<?>> expectedCmdList = new ArrayList<>();
@@ -178,14 +318,362 @@ public void testGetCommands() {
 
     @Test
     public void testStart() {
-        when(_authManager.isOAuthPluginEnabled()).thenReturn(true);
+        when(_authManager.isOAuthPluginEnabled(Mockito.nullable(Long.class))).thenReturn(true);
         doNothing().when(_authManager).initializeUserOAuth2AuthenticationProvidersMap();
         boolean result = _authManager.start();
         assertTrue(result);
 
-        when(_authManager.isOAuthPluginEnabled()).thenReturn(false);
+        when(_authManager.isOAuthPluginEnabled(Mockito.nullable(Long.class))).thenReturn(false);
         result = _authManager.start();
         assertTrue(result);
     }
 
+    @Test
+    public void testRegisterOauthProviderWithDomain() {
+        when(_authManager.isOAuthPluginEnabled(Mockito.nullable(Long.class))).thenReturn(true);
+        RegisterOAuthProviderCmd cmd = Mockito.mock(RegisterOAuthProviderCmd.class);
+        when(cmd.getProvider()).thenReturn("github");
+        when(cmd.getDomainId()).thenReturn(5L);
+        when(cmd.getSecretKey()).thenReturn("secret");
+        when(cmd.getClientId()).thenReturn("clientId");
+        when(cmd.getRedirectUri()).thenReturn("https://redirect");
+
+        // No existing provider for this domain
+        when(_oauthProviderDao.findByProviderAndDomain("github", 5L)).thenReturn(null);
+        when(_oauthProviderDao.persist(Mockito.any(OauthProviderVO.class))).thenAnswer(i -> i.getArgument(0));
+
+        OauthProviderVO result = _authManager.registerOauthProvider(cmd);
+        assertEquals("github", result.getProvider());
+        assertEquals(Long.valueOf(5L), result.getDomainId());
+    }
+
+    @Test
+    public void testRegisterOauthProviderDuplicateForDomain() {
+        when(_authManager.isOAuthPluginEnabled(Mockito.nullable(Long.class))).thenReturn(true);
+        RegisterOAuthProviderCmd cmd = Mockito.mock(RegisterOAuthProviderCmd.class);
+        when(cmd.getProvider()).thenReturn("github");
+        when(cmd.getDomainId()).thenReturn(5L);
+
+        OauthProviderVO existing = new OauthProviderVO();
+        existing.setProvider("github");
+        existing.setDomainId(5L);
+        when(_oauthProviderDao.findByProviderAndDomain("github", 5L)).thenReturn(existing);
+
+        try {
+            _authManager.registerOauthProvider(cmd);
+            Assert.fail("Expected CloudRuntimeException was not thrown");
+        } catch (CloudRuntimeException e) {
+            assertEquals("Provider with the name github is already registered for domain 5", e.getMessage());
+        }
+    }
+
+    @Test
+    public void testListOauthProvidersWithDomainId() {
+        Long domainId = 5L;
+        OauthProviderVO globalProvider = new OauthProviderVO();
+        globalProvider.setProvider("google");
+        OauthProviderVO domainProvider = new OauthProviderVO();
+        domainProvider.setProvider("github");
+        domainProvider.setDomainId(domainId);
+        List<OauthProviderVO> providers = Arrays.asList(globalProvider, domainProvider);
+
+        when(_oauthProviderDao.listByDomainIncludingGlobal(domainId)).thenReturn(providers);
+        List<OauthProviderVO> result = _authManager.listOauthProviders(null, null, domainId);
+        assertEquals(2, result.size());
+    }
+
+    @Test
+    public void testListOauthProvidersByProviderAndDomain() {
+        Long domainId = 5L;
+        OauthProviderVO domainProvider = new OauthProviderVO();
+        domainProvider.setProvider("github");
+        domainProvider.setDomainId(domainId);
+
+        when(_oauthProviderDao.findByProviderAndDomain("github", domainId)).thenReturn(domainProvider);
+        List<OauthProviderVO> result = _authManager.listOauthProviders("github", null, domainId);
+        assertEquals(1, result.size());
+        assertEquals("github", result.get(0).getProvider());
+        assertEquals(Long.valueOf(5L), result.get(0).getDomainId());
+    }
+
+    @Test
+    public void testResolveDomainIdFromDomainUuid() {
+        Map<String, Object[]> params = new HashMap<>();
+        params.put(ApiConstants.DOMAIN_ID, new String[]{"test-uuid-123"});
+
+        Domain domain = Mockito.mock(Domain.class);
+        when(domain.getId()).thenReturn(10L);
+        when(_domainService.getDomain("test-uuid-123")).thenReturn(domain);
+
+        Long result = _authManager.resolveDomainId(params);
+        assertEquals(Long.valueOf(10L), result);
+    }
+
+    @Test
+    public void testResolveDomainIdGlobalFilter() {
+        Map<String, Object[]> params = new HashMap<>();
+        params.put(ApiConstants.DOMAIN_ID, new String[]{"-1"});
+
+        Long result = _authManager.resolveDomainId(params);
+        assertEquals(Long.valueOf(-1L), result);
+    }
+
+    @Test
+    public void testResolveDomainIdFromDomainPath() {
+        Map<String, Object[]> params = new HashMap<>();
+        params.put(ApiConstants.DOMAIN, new String[]{"ROOT/child"});
+
+        Domain domain = Mockito.mock(Domain.class);
+        when(domain.getId()).thenReturn(20L);
+        when(_domainService.findDomainByIdOrPath(null, "/ROOT/child/")).thenReturn(domain);
+
+        Long result = _authManager.resolveDomainId(params);
+        assertEquals(Long.valueOf(20L), result);
+    }
+
+    @Test
+    public void testResolveDomainIdFromDomainPathWithSlashes() {
+        Map<String, Object[]> params = new HashMap<>();
+        params.put(ApiConstants.DOMAIN, new String[]{"/ROOT/child/"});
+
+        Domain domain = Mockito.mock(Domain.class);
+        when(domain.getId()).thenReturn(20L);
+        when(_domainService.findDomainByIdOrPath(null, "/ROOT/child/")).thenReturn(domain);
+
+        Long result = _authManager.resolveDomainId(params);
+        assertEquals(Long.valueOf(20L), result);
+    }
+
+    @Test
+    public void testResolveDomainIdReturnsNullWhenNotFound() {
+        Map<String, Object[]> params = new HashMap<>();
+        params.put(ApiConstants.DOMAIN_ID, new String[]{"nonexistent-uuid"});
+
+        when(_domainService.getDomain("nonexistent-uuid")).thenReturn(null);
+
+        Long result = _authManager.resolveDomainId(params);
+        assertNull(result);
+    }
+
+    @Test
+    public void testResolveDomainIdReturnsNullForEmptyParams() {
+        Map<String, Object[]> params = new HashMap<>();
+        Long result = _authManager.resolveDomainId(params);
+        assertNull(result);
+    }
+
+    @Test
+    public void testResolveDomainIdPrefersUuidOverPath() {
+        Map<String, Object[]> params = new HashMap<>();
+        params.put(ApiConstants.DOMAIN_ID, new String[]{"test-uuid"});
+        params.put(ApiConstants.DOMAIN, new String[]{"/ROOT/child/"});
+
+        Domain domain = Mockito.mock(Domain.class);
+        when(domain.getId()).thenReturn(10L);
+        when(_domainService.getDomain("test-uuid")).thenReturn(domain);
+
+        Long result = _authManager.resolveDomainId(params);
+        assertEquals(Long.valueOf(10L), result);
+    }
+
+    @Test
+    public void testResolveDomainIdFallsBackToPathWhenUuidNotFound() {
+        Map<String, Object[]> params = new HashMap<>();
+        params.put(ApiConstants.DOMAIN_ID, new String[]{"bad-uuid"});
+        params.put(ApiConstants.DOMAIN, new String[]{"/ROOT/"});
+
+        when(_domainService.getDomain("bad-uuid")).thenReturn(null);
+        Domain domain = Mockito.mock(Domain.class);
+        when(domain.getId()).thenReturn(1L);
+        when(_domainService.findDomainByIdOrPath(null, "/ROOT/")).thenReturn(domain);
+
+        Long result = _authManager.resolveDomainId(params);
+        assertEquals(Long.valueOf(1L), result);
+    }
+
+    @Test
+    public void testUpdateOauthProviderNotFound() {
+        UpdateOAuthProviderCmd cmd = Mockito.mock(UpdateOAuthProviderCmd.class);
+        when(cmd.getId()).thenReturn(999L);
+        when(_oauthProviderDao.findById(999L)).thenReturn(null);
+
+        try {
+            _authManager.updateOauthProvider(cmd);
+            Assert.fail("Expected CloudRuntimeException was not thrown");
+        } catch (CloudRuntimeException e) {
+            assertEquals("Provider with the given id is not there", e.getMessage());
+        }
+    }
+
+    @Test
+    public void testGetUserOAuth2AuthenticationProviderEmptyName() {
+        try {
+            _authManager.getUserOAuth2AuthenticationProvider("");
+            Assert.fail("Expected CloudRuntimeException was not thrown");
+        } catch (CloudRuntimeException e) {
+            assertEquals("OAuth2 authentication provider name is empty", e.getMessage());
+        }
+    }
+
+    @Test
+    public void testGetUserOAuth2AuthenticationProviderNotFound() {
+        try {
+            _authManager.getUserOAuth2AuthenticationProvider("nonexistent");
+            Assert.fail("Expected CloudRuntimeException was not thrown");
+        } catch (CloudRuntimeException e) {
+            assertTrue(e.getMessage().contains("nonexistent"));
+        }
+    }
+
+    //  Multiple-domain OAuth tests
+
+    @Test
+    public void testSameProviderRegisteredInTwoDifferentDomains() {
+        when(_authManager.isOAuthPluginEnabled(Mockito.nullable(Long.class))).thenReturn(true);
+
+        // Register github for domain 5
+        RegisterOAuthProviderCmd cmd1 = Mockito.mock(RegisterOAuthProviderCmd.class);
+        when(cmd1.getProvider()).thenReturn("github");
+        when(cmd1.getDomainId()).thenReturn(5L);
+        when(cmd1.getSecretKey()).thenReturn("secret1");
+        when(_oauthProviderDao.findByProviderAndDomain("github", 5L)).thenReturn(null);
+        when(_oauthProviderDao.persist(Mockito.any(OauthProviderVO.class))).thenAnswer(i -> i.getArgument(0));
+
+        OauthProviderVO result1 = _authManager.registerOauthProvider(cmd1);
+        assertEquals("github", result1.getProvider());
+        assertEquals(Long.valueOf(5L), result1.getDomainId());
+
+        // Register github for domain 10 — should succeed independently
+        RegisterOAuthProviderCmd cmd2 = Mockito.mock(RegisterOAuthProviderCmd.class);
+        when(cmd2.getProvider()).thenReturn("github");
+        when(cmd2.getDomainId()).thenReturn(10L);
+        when(cmd2.getSecretKey()).thenReturn("secret2");
+        when(_oauthProviderDao.findByProviderAndDomain("github", 10L)).thenReturn(null);
+
+        OauthProviderVO result2 = _authManager.registerOauthProvider(cmd2);
+        assertEquals("github", result2.getProvider());
+        assertEquals(Long.valueOf(10L), result2.getDomainId());
+    }
+
+    @Test
+    public void testSameProviderRegisteredGloballyAndForDomain() {
+        when(_authManager.isOAuthPluginEnabled(Mockito.nullable(Long.class))).thenReturn(true);
+
+        // Global registration (domainId = null)
+        RegisterOAuthProviderCmd globalCmd = Mockito.mock(RegisterOAuthProviderCmd.class);
+        when(globalCmd.getProvider()).thenReturn("google");
+        when(globalCmd.getDomainId()).thenReturn(null);
+        when(_oauthProviderDao.findByProviderAndDomain("google", null)).thenReturn(null);
+        when(_oauthProviderDao.persist(Mockito.any(OauthProviderVO.class))).thenAnswer(i -> i.getArgument(0));
+
+        OauthProviderVO globalResult = _authManager.registerOauthProvider(globalCmd);
+        assertNull(globalResult.getDomainId());
+
+        // Domain-specific registration for same provider — should succeed (different scope)
+        RegisterOAuthProviderCmd domainCmd = Mockito.mock(RegisterOAuthProviderCmd.class);
+        when(domainCmd.getProvider()).thenReturn("google");
+        when(domainCmd.getDomainId()).thenReturn(7L);
+        when(_oauthProviderDao.findByProviderAndDomain("google", 7L)).thenReturn(null);
+
+        OauthProviderVO domainResult = _authManager.registerOauthProvider(domainCmd);
+        assertEquals(Long.valueOf(7L), domainResult.getDomainId());
+    }
+
+    @Test
+    public void testListOauthProvidersForDomainIncludesGlobalProviders() {
+        Long domainId = 5L;
+        OauthProviderVO globalGoogle = new OauthProviderVO();
+        globalGoogle.setProvider("google");
+        // domainId is null — global
+
+        OauthProviderVO domainGithub = new OauthProviderVO();
+        domainGithub.setProvider("github");
+        domainGithub.setDomainId(domainId);
+
+        OauthProviderVO otherDomainGoogle = new OauthProviderVO();
+        otherDomainGoogle.setProvider("google");
+        otherDomainGoogle.setDomainId(10L);
+
+        // listByDomainIncludingGlobal returns providers for domain 5 + global (not domain 10)
+        when(_oauthProviderDao.listByDomainIncludingGlobal(domainId))
+                .thenReturn(Arrays.asList(globalGoogle, domainGithub));
+
+        List<OauthProviderVO> result = _authManager.listOauthProviders(null, null, domainId);
+        assertEquals(2, result.size());
+        assertTrue(result.stream().anyMatch(p -> p.getDomainId() == null));         // global included
+        assertTrue(result.stream().anyMatch(p -> Long.valueOf(5L).equals(p.getDomainId()))); // domain-specific included
+        assertTrue(result.stream().noneMatch(p -> Long.valueOf(10L).equals(p.getDomainId()))); // other domain excluded
+    }
+
+    @Test
+    public void testListAllProvidersAcrossAllDomains() {
+        OauthProviderVO global = new OauthProviderVO();
+        global.setProvider("google");
+
+        OauthProviderVO domain5 = new OauthProviderVO();
+        domain5.setProvider("github");
+        domain5.setDomainId(5L);
+
+        OauthProviderVO domain10 = new OauthProviderVO();
+        domain10.setProvider("google");
+        domain10.setDomainId(10L);
+
+        when(_oauthProviderDao.listAll()).thenReturn(Arrays.asList(global, domain5, domain10));
+
+        List<OauthProviderVO> result = _authManager.listOauthProviders(null, null, null);
+        assertEquals(3, result.size());
+    }
+
+    @Test
+    public void testDuplicateGlobalProviderRejected() {
+        when(_authManager.isOAuthPluginEnabled(Mockito.nullable(Long.class))).thenReturn(true);
+        RegisterOAuthProviderCmd cmd = Mockito.mock(RegisterOAuthProviderCmd.class);
+        when(cmd.getProvider()).thenReturn("google");
+        when(cmd.getDomainId()).thenReturn(null);
+
+        OauthProviderVO existing = new OauthProviderVO();
+        existing.setProvider("google");
+        when(_oauthProviderDao.findByProviderAndDomain("google", null)).thenReturn(existing);
+
+        try {
+            _authManager.registerOauthProvider(cmd);
+            Assert.fail("Expected CloudRuntimeException was not thrown");
+        } catch (CloudRuntimeException e) {
+            assertEquals("Global provider with the name google is already registered", e.getMessage());
+        }
+    }
+
+    @Test
+    public void testDomainDeletionCleansUpOAuthProviders() {
+        Long domainId = 42L;
+
+        OauthProviderVO provider1 = new OauthProviderVO();
+        provider1.setProvider("github");
+        provider1.setDomainId(domainId);
+
+        OauthProviderVO provider2 = new OauthProviderVO();
+        provider2.setProvider("google");
+        provider2.setDomainId(domainId);
+
+        when(_oauthProviderDao.listByDomain(domainId)).thenReturn(Arrays.asList(provider1, provider2));
+        when(_oauthProviderDao.expunge(Mockito.anyLong())).thenReturn(true);
+
+        // Capture the subscriber registered during start()
+        doNothing().when(_authManager).initializeUserOAuth2AuthenticationProvidersMap();
+        Mockito.doAnswer(invocation -> {
+            String subject = invocation.getArgument(0);
+            MessageSubscriber subscriber = invocation.getArgument(1);
+            // Simulate domain removal event
+            DomainVO domain = Mockito.mock(DomainVO.class);
+            when(domain.getId()).thenReturn(domainId);
+            subscriber.onPublishMessage("", subject, domain);
+            return null;
+        }).when(_messageBus).subscribe(Mockito.eq(com.cloud.user.DomainManager.MESSAGE_PRE_REMOVE_DOMAIN_EVENT), Mockito.any());
+
+        _authManager.start();
+
+        verify(_oauthProviderDao).listByDomain(domainId);
+        verify(_oauthProviderDao, Mockito.times(2)).expunge(Mockito.anyLong());
+    }
+
 }
diff --git a/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/OAuth2UserAuthenticatorTest.java b/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/OAuth2UserAuthenticatorTest.java
index d1c1889ba999..1351c1ea4791 100644
--- a/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/OAuth2UserAuthenticatorTest.java
+++ b/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/OAuth2UserAuthenticatorTest.java
@@ -69,7 +69,7 @@ public class OAuth2UserAuthenticatorTest {
     @Before
     public void setUp() {
         closeable = MockitoAnnotations.openMocks(this);
-        doReturn(true).when(authenticator).isOAuthPluginEnabled();
+        doReturn(true).when(authenticator).isOAuthPluginEnabled(anyLong());
     }
 
     @After
@@ -93,7 +93,7 @@ public void testAuthenticateWithValidCredentials() {
         when(userAccountDao.getUserAccount(username, domainId)).thenReturn(userAccount);
         when(userDao.getUser(userAccount.getId())).thenReturn(user);
         when(userOAuth2mgr.getUserOAuth2AuthenticationProvider(provider[0])).thenReturn(userOAuth2Authenticator);
-        when(userOAuth2Authenticator.verifyUser(email[0], secretCode[0])).thenReturn(true);
+        when(userOAuth2Authenticator.verifyUser(email[0], secretCode[0], domainId)).thenReturn(true);
 
         Map<String, Object[]> requestParameters = new HashMap<>();
         requestParameters.put("provider", provider);
@@ -108,7 +108,7 @@ public void testAuthenticateWithValidCredentials() {
         verify(userAccountDao).getUserAccount(username, domainId);
         verify(userDao).getUser(userAccount.getId());
         verify(userOAuth2mgr).getUserOAuth2AuthenticationProvider(provider[0]);
-        verify(userOAuth2Authenticator).verifyUser(email[0], secretCode[0]);
+        verify(userOAuth2Authenticator).verifyUser(email[0], secretCode[0], domainId);
     }
 
     @Test
@@ -126,7 +126,7 @@ public void testAuthenticateWithInvalidCredentials() {
         when(userAccountDao.getUserAccount(username, domainId)).thenReturn(userAccount);
         when(userDao.getUser(userAccount.getId())).thenReturn(user);
         when(userOAuth2mgr.getUserOAuth2AuthenticationProvider(provider[0])).thenReturn(userOAuth2Authenticator);
-        when(userOAuth2Authenticator.verifyUser(email[0], secretCode[0])).thenReturn(false);
+        when(userOAuth2Authenticator.verifyUser(email[0], secretCode[0], domainId)).thenReturn(false);
 
         Map<String, Object[]> requestParameters = new HashMap<>();
         requestParameters.put("provider", provider);
@@ -141,7 +141,7 @@ public void testAuthenticateWithInvalidCredentials() {
         verify(userAccountDao).getUserAccount(username, domainId);
         verify(userDao).getUser(userAccount.getId());
         verify(userOAuth2mgr).getUserOAuth2AuthenticationProvider(provider[0]);
-        verify(userOAuth2Authenticator).verifyUser(email[0], secretCode[0]);
+        verify(userOAuth2Authenticator).verifyUser(email[0], secretCode[0], domainId);
     }
 
     @Test
@@ -168,4 +168,48 @@ public void testAuthenticateWithInvalidUserAccount() {
         verify(userDao, never()).getUser(anyLong());
         verify(userOAuth2mgr, never()).getUserOAuth2AuthenticationProvider(anyString());
     }
+
+    @Test
+    public void testAuthenticatePluginDisabled() {
+        doReturn(false).when(authenticator).isOAuthPluginEnabled(anyLong());
+
+        Pair<Boolean, OAuth2UserAuthenticator.ActionOnFailedAuthentication> result =
+                authenticator.authenticate("testuser", null, 1L, new HashMap<>());
+
+        assertFalse(result.first());
+        assertNull(result.second());
+        verify(userAccountDao, never()).getUserAccount(anyString(), anyLong());
+    }
+
+    @Test
+    public void testAuthenticateNullRequestParameters() {
+        Pair<Boolean, OAuth2UserAuthenticator.ActionOnFailedAuthentication> result =
+                authenticator.authenticate("testuser", null, 1L, null);
+
+        assertFalse(result.first());
+        assertNull(result.second());
+        verify(userAccountDao, never()).getUserAccount(anyString(), anyLong());
+    }
+
+    @Test
+    public void testAuthenticateNullProvider() {
+        String username = "testuser";
+        Long domainId = 1L;
+
+        UserAccount userAccount = mock(UserAccount.class);
+        when(userAccountDao.getUserAccount(username, domainId)).thenReturn(userAccount);
+        when(userDao.getUser(userAccount.getId())).thenReturn(mock(UserVO.class));
+
+        Map<String, Object[]> requestParameters = new HashMap<>();
+        requestParameters.put("email", new String[]{"test@email.com"});
+        requestParameters.put("secretcode", new String[]{"code"});
+        // No provider in params
+
+        Pair<Boolean, OAuth2UserAuthenticator.ActionOnFailedAuthentication> result =
+                authenticator.authenticate(username, null, domainId, requestParameters);
+
+        assertFalse(result.first());
+        assertNull(result.second());
+        verify(userOAuth2mgr, never()).getUserOAuth2AuthenticationProvider(anyString());
+    }
 }
diff --git a/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/api/command/OauthLoginAPIAuthenticatorCmdTest.java b/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/api/command/OauthLoginAPIAuthenticatorCmdTest.java
index 962ffefd5ce3..318f609adf83 100644
--- a/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/api/command/OauthLoginAPIAuthenticatorCmdTest.java
+++ b/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/api/command/OauthLoginAPIAuthenticatorCmdTest.java
@@ -19,17 +19,24 @@
 
 import com.cloud.api.ApiServer;
 import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.ServerApiException;
 import org.junit.After;
 import org.junit.Before;
 import org.junit.Test;
 import org.mockito.InjectMocks;
 import org.mockito.MockitoAnnotations;
 
+import java.net.InetAddress;
 import java.util.HashMap;
 import java.util.Map;
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNull;
+import static org.junit.Assert.fail;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 
@@ -76,6 +83,29 @@ public void testGetDomainNameWithEndingSlash() {
         assertEquals(" domain=example/", auditTrailSb.toString());
     }
 
+    @Test
+    public void testAuthenticateWithMissingParamsReturnsSerializedServerApiException() throws Exception {
+        ApiServer apiServer = mock(ApiServer.class);
+        cmd._apiServer = apiServer;
+        String serializedError = "{\"oauthloginresponse\":{\"errorcode\":531,\"errortext\":\"...\"}}";
+        when(apiServer.getSerializedApiError(anyInt(), anyString(), any(), anyString())).thenReturn(serializedError);
+
+        Map<String, Object[]> params = new HashMap<>();
+        // missing provider, email, secretCode — should trip the empty check
+        params.put(ApiConstants.PROVIDER, new String[]{""});
+        params.put(ApiConstants.EMAIL, new String[]{""});
+        params.put(ApiConstants.SECRET_CODE, new String[]{""});
+
+        try {
+            cmd.authenticate("oauthlogin", params, null, InetAddress.getLoopbackAddress(),
+                    "json", new StringBuilder(), null, null);
+            fail("Expected ServerApiException to be thrown");
+        } catch (ServerApiException ex) {
+            assertEquals(ApiErrorCode.ACCOUNT_ERROR, ex.getErrorCode());
+            assertEquals(serializedError, ex.getDescription());
+        }
+    }
+
     @Test
     public void testGetDomainIdFromParams() {
         StringBuilder auditTrailSb = new StringBuilder();
diff --git a/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/api/command/RegisterOAuthProviderCmdTest.java b/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/api/command/RegisterOAuthProviderCmdTest.java
index c61edd4610c3..7e1a96e0c1ea 100644
--- a/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/api/command/RegisterOAuthProviderCmdTest.java
+++ b/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/api/command/RegisterOAuthProviderCmdTest.java
@@ -20,6 +20,7 @@
 package org.apache.cloudstack.oauth2.api.command;
 
 import static org.junit.Assert.assertEquals;
+import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 
@@ -28,40 +29,32 @@
 import org.apache.cloudstack.oauth2.OAuth2AuthManager;
 import org.apache.cloudstack.oauth2.api.response.OauthProviderResponse;
 import org.apache.cloudstack.oauth2.vo.OauthProviderVO;
-import org.junit.After;
 import org.junit.Before;
 import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.mockito.InjectMocks;
-import org.mockito.Mock;
-import org.mockito.MockitoAnnotations;
-import org.mockito.junit.MockitoJUnitRunner;
 
-@RunWith(MockitoJUnitRunner.class)
 public class RegisterOAuthProviderCmdTest {
 
-    @Mock
     private OAuth2AuthManager _oauth2mgr;
-
-    @InjectMocks
     private RegisterOAuthProviderCmd _cmd;
 
-    private AutoCloseable closeable;
-
     @Before
     public void setUp() throws Exception {
-        closeable = MockitoAnnotations.openMocks(this);
-    }
-
-    @After
-    public void tearDown() throws Exception {
-        closeable.close();
+        _oauth2mgr = mock(OAuth2AuthManager.class);
+        _cmd = new RegisterOAuthProviderCmd();
+        _cmd._oauth2mgr = _oauth2mgr;
     }
 
     @Test
     public void testExecute() throws ServerApiException {
         OauthProviderVO provider = mock(OauthProviderVO.class);
-        when(_oauth2mgr.registerOauthProvider(_cmd)).thenReturn(provider);
+        when(provider.getDomainId()).thenReturn(null);
+        when(provider.getUuid()).thenReturn("test-uuid");
+        when(provider.getProvider()).thenReturn("github");
+        when(provider.getDescription()).thenReturn("test");
+        when(provider.getClientId()).thenReturn("client-id");
+        when(provider.getSecretKey()).thenReturn("secret-key");
+        when(provider.getRedirectUri()).thenReturn("http://localhost");
+        when(_oauth2mgr.registerOauthProvider(any(RegisterOAuthProviderCmd.class))).thenReturn(provider);
 
         _cmd.execute();
         assertEquals(ApiConstants.OAUTH_PROVIDER, ((OauthProviderResponse)_cmd.getResponseObject()).getObjectName());
diff --git a/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/api/command/VerifyOAuthCodeAndGetUserCmdTest.java b/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/api/command/VerifyOAuthCodeAndGetUserCmdTest.java
index 59245a4027aa..73888a712bec 100644
--- a/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/api/command/VerifyOAuthCodeAndGetUserCmdTest.java
+++ b/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/api/command/VerifyOAuthCodeAndGetUserCmdTest.java
@@ -19,6 +19,8 @@
 
 package org.apache.cloudstack.oauth2.api.command;
 
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 
@@ -71,7 +73,8 @@ public void testAuthenticate() {
         params.put("secretcode", secretcodeArray);
         params.put("provider", providerArray);
 
-        when(oauth2mgr.verifyCodeAndFetchEmail("secretcode", "provider")).thenReturn("test@example.com");
+        when(oauth2mgr.resolveDomainId(any())).thenReturn(null);
+        when(oauth2mgr.verifySecretCodeAndFetchEmail(eq("secretcode"), eq("provider"), any())).thenReturn("test@example.com");
 
         String response = cmd.authenticate("command", params, session, remoteAddress, responseType, auditTrailSb, req, resp);
 
@@ -89,7 +92,8 @@ public void testAuthenticateWithInvalidCode() throws Exception {
         params.put("secretcode", secretcodeArray);
         params.put("provider", providerArray);
 
-        when(oauth2mgr.verifyCodeAndFetchEmail("invalidcode", "provider")).thenReturn(null);
+        when(oauth2mgr.resolveDomainId(any())).thenReturn(null);
+        when(oauth2mgr.verifySecretCodeAndFetchEmail(eq("invalidcode"), eq("provider"), any())).thenReturn(null);
 
         cmd.authenticate("command", params, session, remoteAddress, responseType, auditTrailSb, req, resp);
     }
@@ -102,7 +106,11 @@ public void testSetAuthenticators() {
         authenticators.add(mock(PluggableAPIAuthenticator.class));
         authenticators.add(oauth2mgr);
         authenticators.add(null);
-        cmd.setAuthenticators(authenticators);
+        try {
+            cmd.setAuthenticators(authenticators);
+        } catch (AssertionError e) {
+            // ComponentContext is not available in unit test environment
+        }
         Assert.assertEquals(oauth2mgr, cmd._oauth2mgr);
     }
 }
diff --git a/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/google/GoogleOAuth2ProviderTest.java b/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/google/GoogleOAuth2ProviderTest.java
index fa8a5a7c03cf..1f4a4eb363c8 100644
--- a/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/google/GoogleOAuth2ProviderTest.java
+++ b/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/google/GoogleOAuth2ProviderTest.java
@@ -74,14 +74,14 @@ public void testVerifyUserWithNullSecretCode() {
 
     @Test(expected = CloudAuthenticationException.class)
     public void testVerifyUserWithUnregisteredProvider() {
-        when(_oauthProviderDao.findByProvider(anyString())).thenReturn(null);
+        when(_oauthProviderDao.findByProviderAndDomainWithGlobalFallback(anyString(), Mockito.isNull())).thenReturn(null);
         _googleOAuth2Provider.verifyUser("email@example.com", "secretCode");
     }
 
     @Test(expected = CloudRuntimeException.class)
     public void testVerifyUserWithInvalidSecretCode() throws IOException {
         OauthProviderVO providerVO = mock(OauthProviderVO.class);
-        when(_oauthProviderDao.findByProvider(anyString())).thenReturn(providerVO);
+        when(_oauthProviderDao.findByProviderAndDomainWithGlobalFallback(anyString(), Mockito.isNull())).thenReturn(providerVO);
         when(providerVO.getProvider()).thenReturn("testProvider");
         when(providerVO.getSecretKey()).thenReturn("testSecret");
         when(providerVO.getClientId()).thenReturn("testClientid");
@@ -105,7 +105,7 @@ public void testVerifyUserWithInvalidSecretCode() throws IOException {
     @Test(expected = CloudRuntimeException.class)
     public void testVerifyUserWithMismatchedEmail() throws IOException {
         OauthProviderVO providerVO = mock(OauthProviderVO.class);
-        when(_oauthProviderDao.findByProvider(anyString())).thenReturn(providerVO);
+        when(_oauthProviderDao.findByProviderAndDomainWithGlobalFallback(anyString(), Mockito.isNull())).thenReturn(providerVO);
         when(providerVO.getProvider()).thenReturn("testProvider");
         when(providerVO.getSecretKey()).thenReturn("testSecret");
         when(providerVO.getClientId()).thenReturn("testClientid");
@@ -129,7 +129,7 @@ public void testVerifyUserWithMismatchedEmail() throws IOException {
     @Test
     public void testVerifyUserEmail() throws IOException {
         OauthProviderVO providerVO = mock(OauthProviderVO.class);
-        when(_oauthProviderDao.findByProvider(anyString())).thenReturn(providerVO);
+        when(_oauthProviderDao.findByProviderAndDomainWithGlobalFallback(anyString(), Mockito.isNull())).thenReturn(providerVO);
         when(providerVO.getProvider()).thenReturn("testProvider");
         when(providerVO.getSecretKey()).thenReturn("testSecret");
         when(providerVO.getClientId()).thenReturn("testClientid");
diff --git a/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2ProviderTest.java b/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2ProviderTest.java
index df390f449cab..cf2e48772173 100644
--- a/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2ProviderTest.java
+++ b/plugins/user-authenticators/oauth2/src/test/java/org/apache/cloudstack/oauth2/keycloak/KeycloakOAuth2ProviderTest.java
@@ -80,13 +80,13 @@ public void testVerifyUserEmptyParams() {
 
     @Test(expected = CloudAuthenticationException.class)
     public void testVerifyUserProviderNotFound() {
-        when(oauthProviderDao.findByProvider("keycloak")).thenReturn(null);
+        when(oauthProviderDao.findByProviderAndDomainWithGlobalFallback("keycloak", null)).thenReturn(null);
         provider.verifyUser("test@example.com", "code123");
     }
 
     @Test(expected = CloudRuntimeException.class)
     public void testVerifyCodeAndFetchEmailHttpError() throws IOException {
-        when(oauthProviderDao.findByProvider("keycloak")).thenReturn(mockProviderVO);
+        when(oauthProviderDao.findByProviderAndDomainWithGlobalFallback("keycloak", null)).thenReturn(mockProviderVO);
 
         CloseableHttpResponse response = mock(CloseableHttpResponse.class);
         StatusLine statusLine = mock(StatusLine.class);
@@ -100,20 +100,20 @@ public void testVerifyCodeAndFetchEmailHttpError() throws IOException {
 
         when(httpClient.execute(any(HttpPost.class))).thenReturn(response);
 
-        provider.verifyCodeAndFetchEmail("invalid-code");
+        provider.verifySecretCodeAndFetchEmail("invalid-code");
     }
 
     @Test(expected = CloudRuntimeException.class)
     public void testVerifyCodeAndFetchEmailNetworkFailure() throws IOException {
-        when(oauthProviderDao.findByProvider("keycloak")).thenReturn(mockProviderVO);
+        when(oauthProviderDao.findByProviderAndDomainWithGlobalFallback("keycloak", null)).thenReturn(mockProviderVO);
         when(httpClient.execute(any(HttpPost.class))).thenThrow(new IOException("Connection refused"));
 
-        provider.verifyCodeAndFetchEmail("code");
+        provider.verifySecretCodeAndFetchEmail("code");
     }
 
     @Test(expected = CloudRuntimeException.class)
     public void testVerifyUserWithMismatchedEmail() throws IOException {
-        when(oauthProviderDao.findByProvider("keycloak")).thenReturn(mockProviderVO);
+        when(oauthProviderDao.findByProviderAndDomainWithGlobalFallback("keycloak", null)).thenReturn(mockProviderVO);
 
         String testEmail = "anotheruser@example.com";
         String secretCode = "valid-auth-code";
@@ -148,7 +148,7 @@ public void testVerifyUserWithMismatchedEmail() throws IOException {
 
     @Test(expected = CloudRuntimeException.class)
     public void testVerifyUserWithMismatchedClient() throws IOException {
-        when(oauthProviderDao.findByProvider("keycloak")).thenReturn(mockProviderVO);
+        when(oauthProviderDao.findByProviderAndDomainWithGlobalFallback("keycloak", null)).thenReturn(mockProviderVO);
 
         String testEmail = "anotheruser@example.com";
         String secretCode = "valid-auth-code";
@@ -183,7 +183,7 @@ public void testVerifyUserWithMismatchedClient() throws IOException {
 
     @Test
     public void testVerifyUserEmail() throws IOException {
-        when(oauthProviderDao.findByProvider("keycloak")).thenReturn(mockProviderVO);
+        when(oauthProviderDao.findByProviderAndDomainWithGlobalFallback("keycloak", null)).thenReturn(mockProviderVO);
 
         String testEmail = "user@example.com";
         String secretCode = "valid-auth-code";
diff --git a/scripts/network/exdhcp/dhcpd_edithosts.py b/scripts/network/exdhcp/dhcpd_edithosts.py
index 4df996dc0321..a0deae63a50b 100644
--- a/scripts/network/exdhcp/dhcpd_edithosts.py
+++ b/scripts/network/exdhcp/dhcpd_edithosts.py
@@ -17,18 +17,18 @@
 # under the License.
 
 
-# Usage: dhcpd_edithosts.py mac ip hostname dns gateway nextserver
+# Usage: dhcpd_edithosts.py mac ip hostname dns gateway nextserver [leasetime]
 import sys, os
 from os.path import exists
 from time import sleep
 from os import remove
 
-usage = '''dhcpd_edithosts.py mac ip hostname dns gateway nextserver'''
+usage = '''dhcpd_edithosts.py mac ip hostname dns gateway nextserver [leasetime]'''
 conf_path = "/etc/dhcpd.conf"
 file_lock = "/etc/dhcpd.conf_locked"
 sleep_max = 20
-host_entry = 'host %s { hardware ethernet %s; fixed-address %s; option domain-name-servers %s; option domain-name "%s"; option routers %s; default-lease-time infinite; max-lease-time infinite; min-lease-time infinite; filename "pxelinux.0";}'
-host_entry1 = 'host %s { hardware ethernet %s; fixed-address %s; option domain-name-servers %s; option domain-name "%s"; option routers %s; default-lease-time infinite; max-lease-time infinite; min-lease-time infinite; next-server %s; filename "pxelinux.0";}'
+host_entry = 'host %s { hardware ethernet %s; fixed-address %s; option domain-name-servers %s; option domain-name "%s"; option routers %s; default-lease-time %s; max-lease-time %s; min-lease-time %s; filename "pxelinux.0";}'
+host_entry1 = 'host %s { hardware ethernet %s; fixed-address %s; option domain-name-servers %s; option domain-name "%s"; option routers %s; default-lease-time %s; max-lease-time %s; min-lease-time %s; next-server %s; filename "pxelinux.0";}'
 def lock():
 	if exists(file_lock):
 		count = 0
@@ -59,10 +59,14 @@ def unlock():
 			print "Cannot remove file lock at %s" % file_lock
 			return False
 
-def insert_host_entry(mac, ip, hostname, dns, gateway, next_server):
+def insert_host_entry(mac, ip, hostname, dns, gateway, next_server, lease_time="infinite"):
 	if lock() == False:
 		return 1
 
+	# Convert 0 to 'infinite' for lease time
+	if lease_time == "0":
+		lease_time = "infinite"
+
 	cmd = 'sed -i /"fixed-address %s"/d %s' % (ip, conf_path)
 	ret = os.system(cmd)
 	if ret != 0:
@@ -78,9 +82,9 @@ def insert_host_entry(mac, ip, hostname, dns, gateway, next_server):
 		return 1
 
 	if next_server != "null":
-		entry = host_entry1 % (hostname, mac, ip, dns, "cloudnine.internal", gateway, next_server)
+		entry = host_entry1 % (hostname, mac, ip, dns, "cloudnine.internal", gateway, lease_time, lease_time, lease_time, next_server)
 	else:
-		entry = host_entry % (hostname, mac, ip, dns, "cloudnine.internal", gateway)
+		entry = host_entry % (hostname, mac, ip, dns, "cloudnine.internal", gateway, lease_time, lease_time, lease_time)
 	cmd = '''echo '%s' >> %s''' % (entry, conf_path)
 	ret = os.system(cmd)
 	if ret != 0:
@@ -111,6 +115,7 @@ def insert_host_entry(mac, ip, hostname, dns, gateway, next_server):
 	dns = sys.argv[4]
 	gateway = sys.argv[5]
 	next_server = sys.argv[6]
+	lease_time = sys.argv[7] if len(sys.argv) > 7 else "infinite"
 
 	if exists(conf_path) == False:
 		conf_path = "/etc/dhcp/dhcpd.conf"
@@ -118,5 +123,5 @@ def insert_host_entry(mac, ip, hostname, dns, gateway, next_server):
 		print "Cannot find dhcpd.conf"
 		sys.exit(1)
 
-	ret = insert_host_entry(mac, ip, hostname, dns, gateway, next_server)
+	ret = insert_host_entry(mac, ip, hostname, dns, gateway, next_server, lease_time)
 	sys.exit(ret)
diff --git a/scripts/network/exdhcp/dnsmasq_edithosts.sh b/scripts/network/exdhcp/dnsmasq_edithosts.sh
index f0744a9a822b..522250d8622b 100755
--- a/scripts/network/exdhcp/dnsmasq_edithosts.sh
+++ b/scripts/network/exdhcp/dnsmasq_edithosts.sh
@@ -21,6 +21,7 @@
 # $1 : the mac address
 # $2 : the associated ip address
 # $3 : the hostname
+# $4 : the lease time (optional, defaults to 'infinite')
 
 wait_for_dnsmasq () {
   local _pid=$(pidof dnsmasq)
@@ -41,11 +42,17 @@ no_dhcp_release=$?
 [ ! -f /etc/dhcphosts.txt ] && touch /etc/dhcphosts.txt
 [ ! -f /var/lib/misc/dnsmasq.leases ] && touch /var/lib/misc/dnsmasq.leases
 
+# Set lease time, default to 'infinite', convert 0 to 'infinite'
+lease_time=${4:-infinite}
+if [ "$lease_time" = "0" ]; then
+  lease_time=infinite
+fi
+
 sed -i  /$1/d /etc/dhcphosts.txt
 sed -i  /$2,/d /etc/dhcphosts.txt
 sed -i  /$3,/d /etc/dhcphosts.txt
 
-echo "$1,$2,$3,infinite" >>/etc/dhcphosts.txt
+echo "$1,$2,$3,$lease_time" >>/etc/dhcphosts.txt
 
 #release previous dhcp lease if present
 if [ $no_dhcp_release -eq 0 ]
diff --git a/scripts/storage/secondary/createtmplt.sh b/scripts/storage/secondary/createtmplt.sh
index cfc4be28a012..280f57e70fb7 100755
--- a/scripts/storage/secondary/createtmplt.sh
+++ b/scripts/storage/secondary/createtmplt.sh
@@ -218,7 +218,7 @@ imgsize=$(ls -l $tmpltimg2| awk -F" " '{print $5}')
 if [ "$cloud" == "true" ]
 then
     create_from_file_user $tmpltfs $tmpltimg2 $tmpltname
-    tmpltfs=/tmp/cloud/templates/
+    tmpltfs=/var/tmp/cloud/templates/
 else
     create_from_file $tmpltfs $tmpltimg2 $tmpltname
 fi
diff --git a/scripts/storage/secondary/setup-sysvm-tmplt b/scripts/storage/secondary/setup-sysvm-tmplt
index 63006cc4e4c2..96939707b91a 100755
--- a/scripts/storage/secondary/setup-sysvm-tmplt
+++ b/scripts/storage/secondary/setup-sysvm-tmplt
@@ -105,7 +105,7 @@ if [[ "$destfiles" != "" ]]; then
   failed 2 "Data already exists at destination $destdir"
 fi
 
-tmpfolder=/tmp/cloud/templates/
+tmpfolder=/var/tmp/cloud/templates/
 mkdir -p $tmpfolder
 tmplfile=$tmpfolder/$localfile
 
diff --git a/scripts/vm/hypervisor/kvm/imageserver/backends/nbd.py b/scripts/vm/hypervisor/kvm/imageserver/backends/nbd.py
index c68a3b5188b6..002d777080e3 100644
--- a/scripts/vm/hypervisor/kvm/imageserver/backends/nbd.py
+++ b/scripts/vm/hypervisor/kvm/imageserver/backends/nbd.py
@@ -32,6 +32,24 @@
 from .base import BackendSession, ImageBackend
 
 
+def _entries_to_pairs(entries: Any) -> List[Tuple[int, int]]:
+    """
+    Normalize block status callback entries to (length, flags) pairs.
+    block_status delivers a flat list [length, flags, ...] while
+    block_status_64 delivers a list of (length, flags) tuples.
+    """
+    raw = list(entries)
+    if not raw:
+        return []
+    if isinstance(raw[0], (tuple, list)):
+        return [(int(length), int(flags)) for length, flags in raw]
+    if isinstance(raw[0], int):
+        return [(int(raw[i]), int(raw[i + 1])) for i in range(0, len(raw) - 1, 2)]
+    raise TypeError(
+        f"unrecognized block status entry type: {type(raw[0]).__name__}"
+    )
+
+
 class NbdConnection:
     """
     Low-level helper to connect to an NBD server over a Unix socket.
@@ -190,19 +208,16 @@ def extent_cb(*args: Any, **kwargs: Any) -> int:
                 return 0
             current = off
             try:
-                flat = list(entries)
-                for i in range(0, len(flat), 2):
-                    if i + 1 >= len(flat):
-                        break
-                    length = int(flat[i])
-                    flags = int(flat[i + 1])
+                for length, flags in _entries_to_pairs(entries):
                     zero = (flags & (NBD_STATE_HOLE | NBD_STATE_ZERO)) != 0
                     allocation_extents.append(
                         {"start": current, "length": length, "zero": zero}
                     )
                     current += length
-            except (TypeError, ValueError, IndexError):
-                pass
+            except (TypeError, ValueError, IndexError) as e:
+                logging.warning(
+                    "get_allocation_extents: unparseable block status entries: %r", e
+                )
             return 0
 
         block_status_fn = getattr(
@@ -261,12 +276,7 @@ def extent_cb(*args: Any, **kwargs: Any) -> int:
                 return 0
             current = off
             try:
-                flat = list(entries)
-                for i in range(0, len(flat), 2):
-                    if i + 1 >= len(flat):
-                        break
-                    length = int(flat[i])
-                    flags = int(flat[i + 1])
+                for length, flags in _entries_to_pairs(entries):
                     if metacontext == "base:allocation":
                         zero = (flags & (NBD_STATE_HOLE | NBD_STATE_ZERO)) != 0
                         allocation_extents.append((current, length, zero))
@@ -274,8 +284,11 @@ def extent_cb(*args: Any, **kwargs: Any) -> int:
                         dirty = (flags & NBD_STATE_DIRTY) != 0
                         dirty_extents.append((current, length, dirty))
                     current += length
-            except (TypeError, ValueError, IndexError):
-                pass
+            except (TypeError, ValueError, IndexError) as e:
+                logging.warning(
+                    "get_extents_dirty_and_zero: unparseable block status entries: %r",
+                    e,
+                )
             return 0
 
         block_status_fn = getattr(
diff --git a/scripts/vm/hypervisor/kvm/imageserver/handler.py b/scripts/vm/hypervisor/kvm/imageserver/handler.py
index 53bef34b95e4..fcdc0b680773 100644
--- a/scripts/vm/hypervisor/kvm/imageserver/handler.py
+++ b/scripts/vm/hypervisor/kvm/imageserver/handler.py
@@ -746,6 +746,11 @@ def _handle_get_extents_with_backend(
                     dirty_bitmap_ctx = f"qemu:dirty-bitmap:{export_bitmap}"
                     extents = backend.get_dirty_extents(dirty_bitmap_ctx)
                     if is_fallback_dirty_response(extents):
+                        logging.warning(
+                            "EXTENTS image_id=%s: no usable dirty bitmap data for "
+                            "context %r; reporting all allocated extents as dirty",
+                            image_id, dirty_bitmap_ctx,
+                        )
                         allocation = backend.get_allocation_extents()
                         extents = [
                             {
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/test_nbd_entries.py b/scripts/vm/hypervisor/kvm/imageserver/tests/test_nbd_entries.py
new file mode 100644
index 000000000000..8654aa5dad6c
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/test_nbd_entries.py
@@ -0,0 +1,194 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""
+Tests for NBD block status entry parsing.
+"""
+
+import os
+import shutil
+import subprocess
+import tempfile
+import unittest
+
+from imageserver.backends.nbd import NbdConnection, _entries_to_pairs
+from imageserver.util import is_fallback_dirty_response
+
+class TestRealLibnbdBlockStatus(unittest.TestCase):
+    """
+    Creates a 1 MiB qcow2 with a persistent dirty bitmap, dirties two
+    64 KiB regions, exports it via qemu-nbd --bitmap, and asserts both the
+    raw callback entry format and the parsed extents.  Fails loudly if a
+    new libnbd version changes the block status response.
+    """
+
+    REAL_BITMAP = "bm0"
+    KB64 = 65536
+    REAL_SIZE = 16 * KB64  # 1 MiB
+
+    @classmethod
+    def setUpClass(cls):
+        cls._tmp = tempfile.mkdtemp(prefix="nbd_entries_test_")
+        cls._img = os.path.join(cls._tmp, "img.qcow2")
+        cls._sock = os.path.join(cls._tmp, "nbd.sock")
+        cls._proc = None
+
+        def run(*cmd):
+            subprocess.run(cmd, check=True, capture_output=True)
+
+        try:
+            run("qemu-img", "create", "-f", "qcow2", cls._img, str(cls.REAL_SIZE))
+            # allocate 0-192 KiB before the bitmap exists (clean, allocated)
+            run("qemu-io", "-f", "qcow2", "-c", "write -P 0xaa 0 192k", cls._img)
+            run("qemu-img", "bitmap", "--add", cls._img, cls.REAL_BITMAP)
+            # dirty two 64 KiB regions while the bitmap is recording
+            run("qemu-io", "-f", "qcow2", "-c", "write -P 0xbb 128k 64k", cls._img)
+            run("qemu-io", "-f", "qcow2", "-c", "write -P 0xcc 512k 64k", cls._img)
+
+            cls._proc = subprocess.Popen(
+                [
+                    "qemu-nbd",
+                    "--socket", cls._sock,
+                    "--format", "qcow2",
+                    "--persistent",
+                    "--shared=0",
+                    "--read-only",
+                    f"--bitmap={cls.REAL_BITMAP}",
+                    cls._img,
+                ],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+            )
+            from .test_base import _wait_for_nbd_socket
+
+            _wait_for_nbd_socket(cls._sock)
+        except BaseException:
+            cls._teardown()
+            raise
+
+    @classmethod
+    def tearDownClass(cls):
+        cls._teardown()
+
+    @classmethod
+    def _teardown(cls):
+        if cls._proc is not None:
+            for pipe in (cls._proc.stdout, cls._proc.stderr):
+                if pipe:
+                    pipe.close()
+            cls._proc.terminate()
+            try:
+                cls._proc.wait(timeout=5)
+            except subprocess.TimeoutExpired:
+                cls._proc.kill()
+                cls._proc.wait(timeout=5)
+            cls._proc = None
+        shutil.rmtree(cls._tmp, ignore_errors=True)
+
+    def _connect(self):
+        return NbdConnection(
+            self._sock,
+            None,
+            need_block_status=True,
+            extra_meta_contexts=[f"qemu:dirty-bitmap:{self.REAL_BITMAP}"],
+        )
+
+    def test_raw_entries_format_is_known(self):
+        """The raw callback entries must be flat ints or (length, flags) pairs."""
+        with self._connect() as conn:
+            size = conn.size()
+            captured = []
+
+            def cb(*args, **kwargs):
+                self.assertGreaterEqual(len(args), 3)
+                captured.append((args[0], list(args[2])))
+                return 0
+
+            fn = getattr(
+                conn._nbd,
+                "block_status_64",
+                getattr(conn._nbd, "block_status", None),
+            )
+            self.assertIsNotNone(
+                fn, "libnbd no longer exposes block_status/block_status_64"
+            )
+            fn(size, 0, cb)
+
+        self.assertTrue(captured, "block status delivered no callbacks")
+        contexts = {ctx for ctx, _ in captured}
+        self.assertIn("base:allocation", contexts)
+        self.assertIn(f"qemu:dirty-bitmap:{self.REAL_BITMAP}", contexts)
+
+        for ctx, entries in captured:
+            self.assertTrue(entries, f"empty entries for context {ctx}")
+            if isinstance(entries[0], (tuple, list)):
+                for item in entries:
+                    self.assertIsInstance(item, (tuple, list))
+                    self.assertEqual(len(item), 2)
+                    self.assertIsInstance(item[0], int)
+                    self.assertIsInstance(item[1], int)
+            else:
+                self.assertTrue(all(isinstance(v, int) for v in entries))
+                self.assertEqual(len(entries) % 2, 0)
+            # entries must parse and tile part of the queried range
+            pairs = _entries_to_pairs(entries)
+            self.assertTrue(pairs)
+            covered = sum(length for length, _ in pairs)
+            self.assertGreater(covered, 0)
+            self.assertLessEqual(covered, size)
+
+    def test_allocation_extents_tile_image(self):
+        with self._connect() as conn:
+            size = conn.size()
+            extents = conn.get_allocation_extents()
+        self.assertEqual(size, self.REAL_SIZE)
+        pos = 0
+        for e in extents:
+            self.assertEqual(e["start"], pos)
+            self.assertGreater(e["length"], 0)
+            pos += e["length"]
+        self.assertEqual(pos, size)
+        self.assertEqual(
+            extents,
+            [
+                {"start": 0, "length": 3 * self.KB64, "zero": False},
+                {"start": 3 * self.KB64, "length": 5 * self.KB64, "zero": True},
+                {"start": 8 * self.KB64, "length": self.KB64, "zero": False},
+                {"start": 9 * self.KB64, "length": 7 * self.KB64, "zero": True},
+            ],
+        )
+
+    def test_dirty_extents_match_writes(self):
+        with self._connect() as conn:
+            extents = conn.get_extents_dirty_and_zero(
+                f"qemu:dirty-bitmap:{self.REAL_BITMAP}"
+            )
+        self.assertEqual(
+            extents,
+            [
+                {"start": 0, "length": 2 * self.KB64, "dirty": False, "zero": False},
+                {"start": 2 * self.KB64, "length": self.KB64, "dirty": True, "zero": False},
+                {"start": 3 * self.KB64, "length": 5 * self.KB64, "dirty": False, "zero": True},
+                {"start": 8 * self.KB64, "length": self.KB64, "dirty": True, "zero": False},
+                {"start": 9 * self.KB64, "length": 7 * self.KB64, "dirty": False, "zero": True},
+            ],
+        )
+        self.assertFalse(is_fallback_dirty_response(extents))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/vm/hypervisor/kvm/nasbackup.sh b/scripts/vm/hypervisor/kvm/nasbackup.sh
index b35908a433ed..5b3bed7c8750 100755
--- a/scripts/vm/hypervisor/kvm/nasbackup.sh
+++ b/scripts/vm/hypervisor/kvm/nasbackup.sh
@@ -33,6 +33,15 @@ MOUNT_OPTS=""
 BACKUP_DIR=""
 DISK_PATHS=""
 QUIESCE=""
+# Incremental backup parameters (all optional; legacy callers omit them)
+MODE=""               # "full" or "incremental"; empty => legacy full-only behavior (no checkpoint created)
+BITMAP_NEW=""         # Bitmap/checkpoint name to create with this backup (e.g. "backup-1711586400")
+BITMAP_PARENT=""      # For incremental: parent bitmap name to read changes since
+PARENT_PATHS=""       # For incremental: comma-separated list of parent backup file paths,
+                      # one per VM volume in the same order as DISK_PATHS. Each new qcow2
+                      # is rebased onto its corresponding parent file. Required because
+                      # data-disk backup files don't share the root volume's UUID, so
+                      # each disk must be rebased onto its own parent.
 logFile="/var/log/cloudstack/agent/agent.log"
 UNMOUNT_TIMEOUT=60
 EXIT_CLEANUP_FAILED=20
@@ -113,20 +122,117 @@ backup_running_vm() {
   mount_operation
   mkdir -p "$dest" || { echo "Failed to create backup directory $dest"; exit 1; }
 
+  # Determine effective mode for this run.
+  # Legacy callers (no -M argument) get the original full-only behavior with no checkpoint.
+  # The Java wrapper (LibvirtTakeBackupCommandWrapper) pre-validates required args before
+  # invoking the script; the case below is a defensive fallback for direct invocations.
+  local effective_mode="${MODE:-legacy-full}"
+  local make_checkpoint=0
+  case "$effective_mode" in
+    incremental|full)
+      make_checkpoint=1
+      ;;
+    legacy-full)
+      make_checkpoint=0
+      ;;
+    *)
+      echo "Unknown mode: $effective_mode"
+      cleanup
+      exit 1
+      ;;
+  esac
+
+  # Incremental needs the parent checkpoint registered with libvirt. CloudStack rebuilds the
+  # domain XML on every VM start, wiping libvirt's checkpoint registry while the dirty bitmap
+  # persists on the qcow2, so a fresh checkpoint-create fails with "Bitmap already exists".
+  # Re-register the parent with --redefine (needs only a name + creationTime) via a minimal
+  # synthesized XML. If the parent bitmap is missing from the qcow2 (e.g. after a migration),
+  # fall back to a full backup instead of letting backup-begin fail below.
+  if [[ "$effective_mode" == "incremental" ]]; then
+    # The parent bitmap must be present on EVERY disk, not just one. A snapshot restore or partial
+    # migration can wipe it on some disks; require it on all by comparing the disk count to the
+    # number of disks that carry it.
+    disk_count=$(virsh -c qemu:///system domblklist "$VM" --details 2>/dev/null | awk '$2=="disk"{c++} END{print c+0}')
+    # Count per-device (one per inserted.file whose dirty-bitmaps holds the parent), mirroring
+    # getVmDiskPathHasFromCheckpointMap(): query-block lists a bitmap under multiple nodes, so raw
+    # name matches double-count. "|| echo 0" keeps a no-match from aborting under "set -eo pipefail"
+    # before the fallback runs.
+    bitmap_count=$(virsh -c qemu:///system qemu-monitor-command "$VM" '{"execute":"query-block"}' 2>/dev/null | python3 -c '
+import sys, json
+target = sys.argv[1]
+try:
+    data = json.load(sys.stdin)
+except Exception:
+    print(0); sys.exit(0)
+files = set()
+for dev in data.get("return", []) or []:
+    inserted = dev.get("inserted") or {}
+    f = inserted.get("file")
+    if not f:
+        continue
+    if any((b or {}).get("name") == target for b in (inserted.get("dirty-bitmaps") or [])):
+        files.add(f)
+print(len(files))
+' "$BITMAP_PARENT" 2>/dev/null || echo 0)
+    if [[ "$disk_count" -eq 0 || "$bitmap_count" -lt "$disk_count" ]]; then
+      log -e "incremental: parent bitmap $BITMAP_PARENT present on $bitmap_count/$disk_count disk(s) — falling back to full"
+      echo "INCREMENTAL_FALLBACK=true"
+      effective_mode="full"
+    fi
+  fi
+
+  if [[ "$effective_mode" == "incremental" ]]; then
+    if ! virsh -c qemu:///system checkpoint-list "$VM" --name 2>/dev/null | grep -qx "$BITMAP_PARENT"; then
+      redefine_xml=$(mktemp)
+      printf '<domaincheckpoint><name>%s</name><creationTime>%s</creationTime></domaincheckpoint>' \
+        "$BITMAP_PARENT" "$(date +%s)" > "$redefine_xml"
+      if virsh -c qemu:///system checkpoint-create "$VM" --xmlfile "$redefine_xml" --redefine > /dev/null 2>&1; then
+        rm -f "$redefine_xml" # parent checkpoint re-registered; the incremental can proceed against it
+      else
+        rm -f "$redefine_xml"
+        # Parent checkpoint could not be re-registered — fall back to a full backup in place so
+        # the chain restarts cleanly instead of failing. Emit a stdout marker so the wrapper
+        # records this backup as a full (incrementalFallback=true).
+        log -e "incremental: parent checkpoint $BITMAP_PARENT could not be re-registered — falling back to full"
+        echo "INCREMENTAL_FALLBACK=true"
+        effective_mode="full"
+      fi
+    fi
+  fi
+
+  # Build backup XML (and matching checkpoint XML when applicable).
   name="root"
-  echo "<domainbackup mode='push'><disks>" > $dest/backup.xml
+  echo "<domainbackup mode='push'>" > $dest/backup.xml
+  if [[ "$effective_mode" == "incremental" ]]; then
+    echo "<incremental>$BITMAP_PARENT</incremental>" >> $dest/backup.xml
+  fi
+  echo "<disks>" >> $dest/backup.xml
+  if [[ $make_checkpoint -eq 1 ]]; then
+    echo "<domaincheckpoint><name>$BITMAP_NEW</name><disks>" > $dest/checkpoint.xml
+  fi
   while read -r disk fullpath; do
     if [[ "$fullpath" == /dev/drbd/by-res/* ]]; then
         volUuid=$(get_linstor_uuid_from_path "$fullpath")
     else
         volUuid="${fullpath##*/}"
     fi
-    echo "<disk name='$disk' backup='yes' type='file' backupmode='full'><driver type='qcow2'/><target file='$dest/$name.$volUuid.qcow2' /></disk>" >> $dest/backup.xml
+    if [[ "$effective_mode" == "incremental" ]]; then
+      # Incremental disk entry — no backupmode attr, libvirt picks it up from <incremental>.
+      echo "<disk name='$disk' backup='yes' type='file'><driver type='qcow2'/><target file='$dest/$name.$volUuid.qcow2' /></disk>" >> $dest/backup.xml
+    else
+      echo "<disk name='$disk' backup='yes' type='file' backupmode='full'><driver type='qcow2'/><target file='$dest/$name.$volUuid.qcow2' /></disk>" >> $dest/backup.xml
+    fi
+    if [[ $make_checkpoint -eq 1 ]]; then
+      echo "<disk name='$disk'/>" >> $dest/checkpoint.xml
+    fi
     name="datadisk"
   done < <(
     virsh -c qemu:///system domblklist "$VM" --details 2>/dev/null | awk '$2=="disk"{print $3, $4}'
   )
   echo "</disks></domainbackup>" >> $dest/backup.xml
+  if [[ $make_checkpoint -eq 1 ]]; then
+    echo "</disks></domaincheckpoint>" >> $dest/checkpoint.xml
+  fi
 
   local thaw=0
   if [[ ${QUIESCE} == "true" ]]; then
@@ -135,14 +241,22 @@ backup_running_vm() {
     fi
   fi
 
-  # Start push backup
+  # Start push backup, atomically registering the new checkpoint when applicable.
   local backup_begin=0
-  if virsh -c qemu:///system backup-begin --domain $VM --backupxml $dest/backup.xml 2>&1 > /dev/null; then
-    backup_begin=1;
+  if [[ $make_checkpoint -eq 1 ]]; then
+    # Order matters: redirect stdout to /dev/null first, then merge stderr into stdout.
+    # The reversed `2>&1 > /dev/null` form leaves stderr pointing at the original tty.
+    if virsh -c qemu:///system backup-begin --domain $VM --backupxml $dest/backup.xml --checkpointxml $dest/checkpoint.xml > /dev/null 2>&1; then
+      backup_begin=1;
+    fi
+  else
+    if virsh -c qemu:///system backup-begin --domain $VM --backupxml $dest/backup.xml > /dev/null 2>&1; then
+      backup_begin=1;
+    fi
   fi
 
   if [[ $thaw -eq 1 ]]; then
-    if ! response=$(virsh -c qemu:///system qemu-agent-command "$VM" '{"execute":"guest-fsfreeze-thaw"}' 2>&1 > /dev/null); then
+    if ! response=$(virsh -c qemu:///system qemu-agent-command "$VM" '{"execute":"guest-fsfreeze-thaw"}' 2>&1); then
       echo "Failed to thaw the filesystem for vm $VM: $response"
       cleanup
       exit 1
@@ -173,9 +287,47 @@ backup_running_vm() {
     sleep 5
   done
 
-  # Use qemu-img convert to sparsify linstor backups which get bloated due to virsh backup-begin.
+  # Sparsify behavior:
+  # - For LINSTOR backups (existing): qemu-img convert sparsifies the bloated output.
+  # - For INCREMENTAL: rebase the resulting thin qcow2 onto its parent so the chain is self-describing
+  #   (so a future restore can flatten without external chain metadata).
   name="root"
+  # PARENT_PATHS arrives as a comma-separated list, one entry per VM volume in the same
+  # order as DISK_PATHS. Split into a bash array so we can index by disk position.
+  local -a parent_paths_arr=()
+  if [[ "$effective_mode" == "incremental" && -n "$PARENT_PATHS" ]]; then
+    IFS=',' read -ra parent_paths_arr <<< "$PARENT_PATHS"
+  fi
+  local disk_idx=0
   while read -r disk fullpath; do
+    if [[ "$effective_mode" == "incremental" ]]; then
+      volUuid="${fullpath##*/}"
+      # Pick this disk's specific parent file. Each volume's backup is named after its
+      # own UUID, so a single PARENT_PATH would wrongly rebase data disks onto the root
+      # parent.
+      if [[ $disk_idx -ge ${#parent_paths_arr[@]} ]]; then
+        echo "PARENT_PATHS list shorter than DISK_PATHS — missing parent for disk index $disk_idx"
+        cleanup
+        exit 1
+      fi
+      local this_parent_rel="${parent_paths_arr[$disk_idx]}"
+      local parent_abs="$mount_point/$this_parent_rel"
+      if [[ ! -f "$parent_abs" ]]; then
+        echo "Parent backup file does not exist on NAS: $parent_abs"
+        cleanup
+        exit 1
+      fi
+      local parent_rel
+      parent_rel=$(realpath --relative-to="$dest" "$parent_abs")
+      if ! qemu-img rebase -u -b "$parent_rel" -F qcow2 "$dest/$name.$volUuid.qcow2" >> "$logFile" 2> >(cat >&2); then
+        echo "qemu-img rebase failed for $dest/$name.$volUuid.qcow2 onto $parent_rel"
+        cleanup
+        exit 1
+      fi
+      name="datadisk"
+      disk_idx=$((disk_idx + 1))
+      continue
+    fi
     if [[ "$fullpath" != /dev/drbd/by-res/* ]]; then
       continue
     fi
@@ -192,9 +344,43 @@ backup_running_vm() {
     virsh -c qemu:///system domblklist "$VM" --details 2>/dev/null | awk '$2=="disk"{print $3, $4}'
   )
 
-  rm -f $dest/backup.xml
+  rm -f $dest/backup.xml $dest/checkpoint.xml
   sync
 
+  # Free the parent bitmap now that the incremental is written and rebased: its delta is captured
+  # here and BITMAP_NEW tracks changes going forward, so it only accrues metadata/IO cost over a
+  # long chain. Remove it per-disk with block-dirty-bitmap-remove (a clean free) rather than
+  # checkpoint-delete, which would merge its bits into BITMAP_NEW and re-copy backed-up regions.
+  # Best-effort: a failure here does not fail the backup, the bitmap is reclaimed on a later run.
+  if [[ "$effective_mode" == "incremental" && -n "$BITMAP_PARENT" ]]; then
+    while read -r node; do
+      [[ -z "$node" ]] && continue
+      if ! virsh -c qemu:///system qemu-monitor-command "$VM" \
+           "{\"execute\":\"block-dirty-bitmap-remove\",\"arguments\":{\"node\":\"$node\",\"name\":\"$BITMAP_PARENT\"}}" \
+           > /dev/null 2>>"$logFile"; then
+        log -e "cleanup: failed to remove parent bitmap $BITMAP_PARENT on node $node (non-fatal)"
+      fi
+    done < <(
+      virsh -c qemu:///system qemu-monitor-command "$VM" '{"execute":"query-block"}' 2>/dev/null | python3 -c '
+import sys, json
+target = sys.argv[1]
+try:
+    data = json.load(sys.stdin)
+except Exception:
+    sys.exit(0)
+seen = set()
+for dev in data.get("return", []) or []:
+    inserted = dev.get("inserted") or {}
+    node = inserted.get("node-name")
+    if not node or node in seen:
+        continue
+    if any((b or {}).get("name") == target for b in (inserted.get("dirty-bitmaps") or [])):
+        seen.add(node)
+        print(node)
+' "$BITMAP_PARENT" 2>/dev/null || true
+    )
+  fi
+
   # Print statistics
   virsh -c qemu:///system domjobinfo $VM --completed
   backup_size=$(du -sb "$dest" 2>>"$logFile" | cut -f1) || { log -ne "WARNING: du failed for $dest, reporting size as 0"; backup_size=0; }
@@ -204,6 +390,8 @@ backup_running_vm() {
 }
 
 backup_stopped_vm() {
+  # Stopped VMs cannot use libvirt's backup-begin (no QEMU process); take a full backup via
+  # qemu-img convert. The orchestrator never sends incremental mode for a stopped VM.
   mount_operation
   mkdir -p "$dest" || { echo "Failed to create backup directory $dest"; exit 1; }
 
@@ -219,16 +407,33 @@ backup_stopped_vm() {
       volUuid="${disk##*/}"
     fi
     output="$dest/$name.$volUuid.qcow2"
-    if ! qemu-img convert -O qcow2 "$disk" "$output" > "$logFile" 2> >(cat >&2); then
+    if ! qemu-img convert -O qcow2 "$disk" "$output" >> "$logFile" 2> >(cat >&2); then
       echo "qemu-img convert failed for $disk $output"
       cleanup
       exit 1
     fi
+
+    # Pre-seed a persistent bitmap on the source disk so the NEXT backup (taken
+    # after this VM is started again) can be incremental against the qcow2 we
+    # just wrote. Without this, every backup after a stopped-VM backup would
+    # fall back to full because no parent bitmap exists on the host yet.
+    # Only applies to file-backed qcow2 sources — RBD/LINSTOR have their own
+    # snapshot mechanisms and qemu-img bitmap is not the right primitive there.
+    # bitmap --add should not fail on a file-backed qcow2; if it does, fail the backup so the
+    # underlying problem is surfaced rather than silently degrading future backups to full.
+    if [[ -n "$BITMAP_NEW" && "$disk" != rbd:* && "$disk" != /dev/drbd/by-res/* ]]; then
+      if ! qemu-img bitmap --add "$disk" "$BITMAP_NEW" 2>>"$logFile"; then
+        echo "Failed to pre-seed bitmap $BITMAP_NEW on $disk"
+        cleanup
+        exit 1
+      fi
+    fi
+
     name="datadisk"
   done
   sync
 
-  ls -l --numeric-uid-gid $dest | awk '{print $5}'
+  find "$dest" -type f -exec stat -c '%s' {} +
 }
 
 delete_backup() {
@@ -293,6 +498,15 @@ cleanup() {
 function usage {
   echo ""
   echo "Usage: $0 -o <operation> -v|--vm <domain name> -t <storage type> -s <storage address> -m <mount options> -p <backup path> -d <disks path> -q|--quiesce <true|false>"
+  echo "         [-M|--mode <full|incremental>] [--bitmap-new <name>] [--bitmap-parent <name>] [--parent-paths <p1,p2,...>]"
+  echo ""
+  echo "Incremental backup options (running VMs only; requires QEMU >= 4.2 and libvirt >= 7.2):"
+  echo "  -M|--mode full          Take a full backup AND create a checkpoint (--bitmap-new required) for future incrementals."
+  echo "  -M|--mode incremental   Take an incremental backup since --bitmap-parent and create new checkpoint --bitmap-new."
+  echo "                          Requires --bitmap-parent, --bitmap-new, and --parent-paths (comma-separated list, one"
+  echo "                          parent qcow2 path per disk: root.<uuid>.qcow2, datadisk.<uuid>.qcow2, … same order"
+  echo "                          as -d|--disks)."
+  echo "  Without -M, behaves as legacy full-only backup with no checkpoint creation."
   echo ""
   exit 1
 }
@@ -339,6 +553,26 @@ while [[ $# -gt 0 ]]; do
       shift
       shift
       ;;
+    -M|--mode)
+      MODE="$2"
+      shift
+      shift
+      ;;
+    --bitmap-new)
+      BITMAP_NEW="$2"
+      shift
+      shift
+      ;;
+    --bitmap-parent)
+      BITMAP_PARENT="$2"
+      shift
+      shift
+      ;;
+    --parent-paths)
+      PARENT_PATHS="$2"
+      shift
+      shift
+      ;;
     -h|--help)
       usage
       shift
@@ -350,7 +584,7 @@ while [[ $# -gt 0 ]]; do
   esac
 done
 
-# Perform Initial sanity checks
+# Perform initial environment sanity checks (QEMU/libvirt version).
 sanity_checks
 
 if [ "$OP" = "backup" ]; then
diff --git a/scripts/vm/network/vnet/modifymacip.sh b/scripts/vm/network/vnet/modifymacip.sh
new file mode 100755
index 000000000000..c8d0b0e290ca
--- /dev/null
+++ b/scripts/vm/network/vnet/modifymacip.sh
@@ -0,0 +1,90 @@
+#!/usr/bin/env bash
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+# modifymacip.sh -- Manage static ARP/NDP entries and host routes for VM NICs
+#
+# Usage:
+#   add:    modifymacip.sh -o add    -b <bridge> -m <mac> [-4 <ipv4>] ... [-6 <ipv6>] ...
+#   delete: modifymacip.sh -o delete -b <bridge> -m <mac>
+#
+# Both -4 and -6 may be specified multiple times to cover primary and secondary
+# addresses (e.g. link-local + global unicast for IPv6).
+# On delete the bridge neighbour table is queried for all entries matching the
+# MAC address; no separate state file is required.
+
+usage() {
+    echo "Usage: $0 -o <add|delete> -b <bridge> -m <mac> [-4 <ipv4>] ... [-6 <ipv6>] ..."
+}
+
+OP=
+BRIDGE=
+MAC=
+IPV4_LIST=()
+IPV6_LIST=()
+
+while getopts 'o:b:m:4:6:' OPTION; do
+    case $OPTION in
+    o) OP="$OPTARG" ;;
+    b) BRIDGE="$OPTARG" ;;
+    m) MAC="$OPTARG" ;;
+    4) IPV4_LIST+=("$OPTARG") ;;
+    6) IPV6_LIST+=("$OPTARG") ;;
+    ?) usage; exit 2 ;;
+    esac
+done
+
+if [[ -z "$OP" || -z "$BRIDGE" || -z "$MAC" ]]; then
+    usage
+    exit 2
+fi
+
+add_entries() {
+    for addr in "${IPV4_LIST[@]}"; do
+        ip neigh replace "${addr}" lladdr "${MAC}" dev "${BRIDGE}" nud permanent
+        ip route replace "${addr}/32" dev "${BRIDGE}"
+    done
+
+    if [[ "${#IPV6_LIST[@]}" -gt 0 ]]; then
+        # Ensure IPv6 is enabled on the bridge before installing NDP entries
+        sysctl -qw "net.ipv6.conf.${BRIDGE}.disable_ipv6=0"
+        for addr in "${IPV6_LIST[@]}"; do
+            ip -6 neigh replace "${addr}" lladdr "${MAC}" dev "${BRIDGE}" nud permanent
+            ip -6 route replace "${addr}/128" dev "${BRIDGE}"
+        done
+    fi
+}
+
+delete_entries() {
+    # Find all IPv4 neighbour entries on the bridge matching this MAC and remove them
+    while read -r addr; do
+        ip neigh del "${addr}" dev "${BRIDGE}" 2>/dev/null || true
+        ip route del "${addr}/32" dev "${BRIDGE}" 2>/dev/null || true
+    done < <(ip neigh show dev "${BRIDGE}" | awk -v mac="${MAC}" 'tolower($3) == tolower(mac) {print $1}')
+
+    # Find all IPv6 neighbour entries on the bridge matching this MAC and remove them
+    while read -r addr; do
+        ip -6 neigh del "${addr}" dev "${BRIDGE}" 2>/dev/null || true
+        ip -6 route del "${addr}/128" dev "${BRIDGE}" 2>/dev/null || true
+    done < <(ip -6 neigh show dev "${BRIDGE}" | awk -v mac="${MAC}" 'tolower($3) == tolower(mac) {print $1}')
+}
+
+case "$OP" in
+    add)    add_entries ;;
+    delete) delete_entries ;;
+    *)      usage; exit 2 ;;
+esac
diff --git a/scripts/vm/network/vnet/modifyvxlan-evpn.sh b/scripts/vm/network/vnet/modifyvxlan-evpn.sh
index 6728fcb780a3..0a726714ecf0 100755
--- a/scripts/vm/network/vnet/modifyvxlan-evpn.sh
+++ b/scripts/vm/network/vnet/modifyvxlan-evpn.sh
@@ -20,11 +20,12 @@
 # Use BGP+EVPN for VXLAN with CloudStack instead of Multicast
 #
 # The default 'modifyvxlan.sh' script from CloudStack uses Multicast instead of EVPN for VXLAN
-# In order to use this script and thus utilize BGP+EVPN, symlink this file:
+# In order to use this script and thus utilize BGP+EVPN, set in agent.properties:
 #
-# cd /usr/share
-# ln -s cloudstack-common/scripts/vm/network/vnet/modifyvxlan-evpn.sh modifyvxlan.sh
+# network.vxlan.mode=evpn
 #
+# This will result in the Agent executing 'modifyvxlan-evpn.sh', which is suited for EVPN configured VXLAN
+# environments.
 #
 # CloudStack will not handle the BGP configuration nor communication, the operator of the hypervisor will
 # need to configure the properly.
@@ -81,6 +82,8 @@ addVxlan() {
     bridge link show|grep ${VXLAN_BR}|awk '{print $2}'|grep "^${VXLAN_DEV}\$" > /dev/null
     if [[ $? -gt 0 ]]; then
         ip link set ${VXLAN_DEV} master ${VXLAN_BR}
+        bridge link set dev ${VXLAN_DEV} neigh_suppress on
+        bridge link set dev ${VXLAN_DEV} learning off
     fi
 }
 
diff --git a/server/src/main/java/com/cloud/api/ApiDBUtils.java b/server/src/main/java/com/cloud/api/ApiDBUtils.java
index 72463ddb1719..934600eb2b61 100644
--- a/server/src/main/java/com/cloud/api/ApiDBUtils.java
+++ b/server/src/main/java/com/cloud/api/ApiDBUtils.java
@@ -1573,6 +1573,10 @@ public static boolean canElementEnableIndividualServices(Provider serviceProvide
         return s_networkModel.canElementEnableIndividualServices(serviceProvider);
     }
 
+    public static boolean canElementEnableIndividualServicesByName(String providerName) {
+        return s_networkModel.canElementEnableIndividualServicesByName(providerName);
+    }
+
     public static Pair<Long, Boolean> getDomainNetworkDetails(long networkId) {
         NetworkDomainVO map = s_networkDomainDao.getDomainNetworkMapByNetworkId(networkId);
 
diff --git a/server/src/main/java/com/cloud/api/ApiResponseHelper.java b/server/src/main/java/com/cloud/api/ApiResponseHelper.java
index 7cebeed71402..2510dc0a88b4 100644
--- a/server/src/main/java/com/cloud/api/ApiResponseHelper.java
+++ b/server/src/main/java/com/cloud/api/ApiResponseHelper.java
@@ -548,6 +548,8 @@ public class ApiResponseHelper implements ResponseGenerator, ResourceIdSupport {
     ResourceIconManager resourceIconManager;
     @Inject
     AsyncJobDao asyncJobDao;
+    @Inject
+    NetworkModel networkModel;
 
 
     public static String getPrettyDomainPath(String path) {
@@ -2966,8 +2968,21 @@ public FirewallResponse createFirewallResponse(FirewallRule fwRule) {
             }
         }
 
-        Network network = ApiDBUtils.findNetworkById(fwRule.getNetworkId());
-        response.setNetworkId(network.getUuid());
+        Long networkId = fwRule.getNetworkId();
+        if (networkId != null) {
+            Network network = ApiDBUtils.findNetworkById(networkId);
+            if (network != null) {
+                response.setNetworkId(network.getUuid());
+            }
+        }
+
+        Long vpcId = fwRule.getVpcId();
+        if (vpcId != null) {
+            Vpc vpc = ApiDBUtils.findVpcById(vpcId);
+            if (vpc != null) {
+                response.setVpcId(vpc.getUuid());
+            }
+        }
 
         FirewallRule.State state = fwRule.getState();
         String stateToSet = state.toString();
@@ -3316,9 +3331,11 @@ public ProviderResponse createNetworkServiceProviderResponse(PhysicalNetworkServ
         }
         response.setServices(services);
 
-        Provider serviceProvider = Provider.getProvider(result.getProviderName());
-        boolean canEnableIndividualServices = ApiDBUtils.canElementEnableIndividualServices(serviceProvider);
-        response.setCanEnableIndividualServices(canEnableIndividualServices);
+        Provider serviceProvider = networkModel.resolveProvider(result.getProviderName());
+        if (serviceProvider != null) {
+            boolean canEnableIndividualServices = ApiDBUtils.canElementEnableIndividualServices(serviceProvider);
+            response.setCanEnableIndividualServices(canEnableIndividualServices);
+        }
 
         response.setObjectName("networkserviceprovider");
         return response;
@@ -5145,6 +5162,7 @@ public BackupScheduleResponse createBackupScheduleResponse(BackupSchedule schedu
         response.setSchedule(schedule.getSchedule());
         response.setTimezone(schedule.getTimezone());
         response.setMaxBackups(schedule.getMaxBackups());
+        response.setIsolated(schedule.isIsolated());
 
         if (schedule.getQuiesceVM() != null) {
             response.setQuiesceVM(schedule.getQuiesceVM());
@@ -5416,8 +5434,21 @@ public FirewallResponse createIpv6FirewallRuleResponse(FirewallRule fwRule) {
         response.setIcmpCode(fwRule.getIcmpCode());
         response.setIcmpType(fwRule.getIcmpType());
 
-        Network network = ApiDBUtils.findNetworkById(fwRule.getNetworkId());
-        response.setNetworkId(network.getUuid());
+        Long networkId = fwRule.getNetworkId();
+        if (networkId != null) {
+            Network network = ApiDBUtils.findNetworkById(networkId);
+            if (network != null) {
+                response.setNetworkId(network.getUuid());
+            }
+        }
+
+        Long vpcId = fwRule.getVpcId();
+        if (vpcId != null) {
+            Vpc vpc = ApiDBUtils.findVpcById(vpcId);
+            if (vpc != null) {
+                response.setVpcId(vpc.getUuid());
+            }
+        }
 
         FirewallRule.State state = fwRule.getState();
         String stateToSet = state.toString();
diff --git a/server/src/main/java/com/cloud/api/ApiServer.java b/server/src/main/java/com/cloud/api/ApiServer.java
index 1aaf593a8da0..4f35ccf05736 100644
--- a/server/src/main/java/com/cloud/api/ApiServer.java
+++ b/server/src/main/java/com/cloud/api/ApiServer.java
@@ -291,11 +291,11 @@ public class ApiServer extends ManagerBase implements HttpRequestHandler, ApiSer
             , "Do URL encoding for the api response, false by default"
             , false
             , ConfigKey.Scope.Global);
-    static final ConfigKey<String> JSONcontentType = new ConfigKey<>(ConfigKey.CATEGORY_ADVANCED
+    static final ConfigKey<String> JSONContentType = new ConfigKey<>(ConfigKey.CATEGORY_ADVANCED
             , String.class
             , "json.content.type"
             , "application/json; charset=UTF-8"
-            , "Http response content type for .js files (default is text/javascript)"
+            , "Http response content type for JSON"
             , false
             , ConfigKey.Scope.Global);
     static final ConfigKey<Boolean> EnableSecureSessionCookie = new ConfigKey<>(ConfigKey.CATEGORY_ADVANCED
@@ -1526,7 +1526,7 @@ private void writeResponse(final HttpResponse resp, final String responseText, f
             final BasicHttpEntity body = new BasicHttpEntity();
             if (HttpUtils.RESPONSE_TYPE_JSON.equalsIgnoreCase(responseType)) {
                 // JSON response
-                body.setContentType(JSONcontentType.value());
+                body.setContentType(JSONContentType.value());
                 if (responseText == null) {
                     body.setContent(new ByteArrayInputStream("{ \"error\" : { \"description\" : \"Internal Server Error\" } }".getBytes(HttpUtils.UTF_8)));
                 }
@@ -1764,7 +1764,7 @@ public ConfigKey<?>[] getConfigKeys() {
                 ConcurrentSnapshotsThresholdPerHost,
                 EncodeApiResponse,
                 EnableSecureSessionCookie,
-                JSONDefaultContentType,
+                JSONContentType,
                 proxyForwardList,
                 useForwardHeader,
                 listOfForwardHeaders,
diff --git a/server/src/main/java/com/cloud/api/ApiServlet.java b/server/src/main/java/com/cloud/api/ApiServlet.java
index bfeb3d276e4e..957366ad22d7 100644
--- a/server/src/main/java/com/cloud/api/ApiServlet.java
+++ b/server/src/main/java/com/cloud/api/ApiServlet.java
@@ -213,7 +213,7 @@ void processRequestInContext(final HttpServletRequest req, final HttpServletResp
                     "UnknownHostException when trying to lookup remote IP-Address", null,
                     HttpUtils.RESPONSE_TYPE_XML);
             HttpUtils.writeHttpResponse(resp, response, HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
-                    HttpUtils.RESPONSE_TYPE_XML, ApiServer.JSONcontentType.value());
+                    HttpUtils.RESPONSE_TYPE_XML, ApiServer.JSONContentType.value());
             return;
         }
 
@@ -339,7 +339,7 @@ void processRequestInContext(final HttpServletRequest req, final HttpServletResp
                             }
                         }
                     }
-                    HttpUtils.writeHttpResponse(resp, responseString, httpResponseCode, responseType, ApiServer.JSONcontentType.value());
+                    HttpUtils.writeHttpResponse(resp, responseString, httpResponseCode, responseType, ApiServer.JSONContentType.value());
                     return;
                 }
             } else {
@@ -374,7 +374,7 @@ void processRequestInContext(final HttpServletRequest req, final HttpServletResp
                 final String serializedResponse =
                         apiServer.getSerializedApiError(new ServerApiException(ApiErrorCode.BAD_REQUEST, errorText), params,
                                 responseType);
-                HttpUtils.writeHttpResponse(resp, serializedResponse, HttpServletResponse.SC_BAD_REQUEST, responseType, ApiServer.JSONcontentType.value());
+                HttpUtils.writeHttpResponse(resp, serializedResponse, HttpServletResponse.SC_BAD_REQUEST, responseType, ApiServer.JSONContentType.value());
                 return;
             }
 
@@ -412,7 +412,7 @@ void processRequestInContext(final HttpServletRequest req, final HttpServletResp
                 setProjectContext(params);
                 setClientAddressForConsoleEndpointAccess(command, params, req);
                 final String response = apiServer.handleRequest(params, responseType, auditTrailSb);
-                HttpUtils.writeHttpResponse(resp, response != null ? response : "", HttpServletResponse.SC_OK, responseType, ApiServer.JSONcontentType.value());
+                HttpUtils.writeHttpResponse(resp, response != null ? response : "", HttpServletResponse.SC_OK, responseType, ApiServer.JSONContentType.value());
             } else {
                 if (session != null) {
                     invalidateHttpSession(session, String.format("request verification failed for %s from %s", userId, remoteAddress.getHostAddress()));
@@ -422,12 +422,12 @@ void processRequestInContext(final HttpServletRequest req, final HttpServletResp
                 final String serializedResponse =
                         apiServer.getSerializedApiError(HttpServletResponse.SC_UNAUTHORIZED, "unable to verify user credentials and/or request signature", params,
                                 responseType);
-                HttpUtils.writeHttpResponse(resp, serializedResponse, HttpServletResponse.SC_UNAUTHORIZED, responseType, ApiServer.JSONcontentType.value());
+                HttpUtils.writeHttpResponse(resp, serializedResponse, HttpServletResponse.SC_UNAUTHORIZED, responseType, ApiServer.JSONContentType.value());
             }
         } catch (final ServerApiException se) {
             final String serializedResponseText = apiServer.getSerializedApiError(se, params, responseType);
             resp.setHeader("X-Description", se.getDescription());
-            HttpUtils.writeHttpResponse(resp, serializedResponseText, se.getErrorCode().getHttpCode(), responseType, ApiServer.JSONcontentType.value());
+            HttpUtils.writeHttpResponse(resp, serializedResponseText, se.getErrorCode().getHttpCode(), responseType, ApiServer.JSONContentType.value());
             auditTrailSb.append(" " + se.getErrorCode() + " " + se.getDescription());
         } catch (final Exception ex) {
             LOGGER.error("unknown exception writing api response", ex);
@@ -555,7 +555,7 @@ protected boolean verify2FA(HttpSession session, String command, StringBuilder a
             if (apiAuthenticator != null) {
                 String responseString = apiAuthenticator.authenticate(command, params, session, remoteAddress, responseType, auditTrailSb, req, resp);
                 session.setAttribute(ApiConstants.IS_2FA_VERIFIED, true);
-                HttpUtils.writeHttpResponse(resp, responseString, HttpServletResponse.SC_OK, responseType, ApiServer.JSONcontentType.value());
+                HttpUtils.writeHttpResponse(resp, responseString, HttpServletResponse.SC_OK, responseType, ApiServer.JSONContentType.value());
                 verify2FA = true;
             } else {
                 LOGGER.error("Cannot find API authenticator while verifying 2FA");
@@ -587,7 +587,7 @@ protected boolean verify2FA(HttpSession session, String command, StringBuilder a
             invalidateHttpSession(session, String.format("Unable to process the API request for %s from %s due to %s", userId, remoteAddress.getHostAddress(), errorMsg));
             auditTrailSb.append(" " + ApiErrorCode.UNAUTHORIZED2FA + " " + errorMsg);
             final String serializedResponse = apiServer.getSerializedApiError(ApiErrorCode.UNAUTHORIZED2FA.getHttpCode(), "Unable to process the API request due to :" + errorMsg, params, responseType);
-            HttpUtils.writeHttpResponse(resp, serializedResponse, ApiErrorCode.UNAUTHORIZED2FA.getHttpCode(), responseType, ApiServer.JSONcontentType.value());
+            HttpUtils.writeHttpResponse(resp, serializedResponse, ApiErrorCode.UNAUTHORIZED2FA.getHttpCode(), responseType, ApiServer.JSONContentType.value());
             verify2FA = false;
         }
 
@@ -616,7 +616,7 @@ private boolean requestChecksoutAsSane(HttpServletResponse resp, StringBuilder a
                 LOGGER.info("missing command, ignoring request...");
                 auditTrailSb.append(" " + HttpServletResponse.SC_BAD_REQUEST + " " + "no command specified");
                 final String serializedResponse = apiServer.getSerializedApiError(HttpServletResponse.SC_BAD_REQUEST, "no command specified", params, responseType);
-                HttpUtils.writeHttpResponse(resp, serializedResponse, HttpServletResponse.SC_BAD_REQUEST, responseType, ApiServer.JSONcontentType.value());
+                HttpUtils.writeHttpResponse(resp, serializedResponse, HttpServletResponse.SC_BAD_REQUEST, responseType, ApiServer.JSONContentType.value());
                 return true;
             }
             final User user = entityMgr.findById(User.class, userId);
@@ -627,7 +627,7 @@ private boolean requestChecksoutAsSane(HttpServletResponse resp, StringBuilder a
             auditTrailSb.append(" " + HttpServletResponse.SC_UNAUTHORIZED + " " + "unable to verify user credentials");
             final String serializedResponse =
                     apiServer.getSerializedApiError(HttpServletResponse.SC_UNAUTHORIZED, "unable to verify user credentials", params, responseType);
-            HttpUtils.writeHttpResponse(resp, serializedResponse, HttpServletResponse.SC_UNAUTHORIZED, responseType, ApiServer.JSONcontentType.value());
+            HttpUtils.writeHttpResponse(resp, serializedResponse, HttpServletResponse.SC_UNAUTHORIZED, responseType, ApiServer.JSONContentType.value());
             return false;
         }
         return true;
@@ -642,7 +642,7 @@ private boolean invalidateHttpSessionIfNeeded(HttpServletRequest req, HttpServle
             auditTrailSb.append(" " + HttpServletResponse.SC_UNAUTHORIZED + " " + "unable to verify user credentials");
             final String serializedResponse =
                     apiServer.getSerializedApiError(HttpServletResponse.SC_UNAUTHORIZED, "unable to verify user credentials", params, responseType);
-            HttpUtils.writeHttpResponse(resp, serializedResponse, HttpServletResponse.SC_UNAUTHORIZED, responseType, ApiServer.JSONcontentType.value());
+            HttpUtils.writeHttpResponse(resp, serializedResponse, HttpServletResponse.SC_UNAUTHORIZED, responseType, ApiServer.JSONContentType.value());
             return true;
         }
         return false;
diff --git a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
index 616e75bfc361..d11913262818 100644
--- a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
+++ b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
@@ -43,8 +43,9 @@
 import org.apache.cloudstack.acl.RoleService;
 import org.apache.cloudstack.acl.RoleVO;
 import org.apache.cloudstack.acl.dao.RoleDao;
-import com.cloud.dc.Pod;
+import com.cloud.dc.DataCenterVO;
 import com.cloud.dc.dao.DataCenterDao;
+import com.cloud.dc.Pod;
 import com.cloud.dc.dao.HostPodDao;
 import com.cloud.org.Cluster;
 import com.cloud.server.ManagementService;
@@ -96,6 +97,7 @@
 import org.apache.cloudstack.api.command.user.account.ListProjectAccountsCmd;
 import org.apache.cloudstack.api.command.user.address.ListQuarantinedIpsCmd;
 import org.apache.cloudstack.api.command.user.affinitygroup.ListAffinityGroupsCmd;
+import org.apache.cloudstack.api.command.user.backup.ListBackupServiceJobsCmd;
 import org.apache.cloudstack.api.command.user.bucket.ListBucketsCmd;
 import org.apache.cloudstack.api.command.user.event.ListEventsCmd;
 import org.apache.cloudstack.api.command.user.iso.ListIsosCmd;
@@ -118,6 +120,7 @@
 import org.apache.cloudstack.api.command.user.zone.ListZonesCmd;
 import org.apache.cloudstack.api.response.AccountResponse;
 import org.apache.cloudstack.api.response.AsyncJobResponse;
+import org.apache.cloudstack.api.response.BackupServiceJobResponse;
 import org.apache.cloudstack.api.response.BucketResponse;
 import org.apache.cloudstack.api.response.ClusterResponse;
 import org.apache.cloudstack.api.response.DetailOptionsResponse;
@@ -155,7 +158,12 @@
 import org.apache.cloudstack.api.response.VirtualMachineResponse;
 import org.apache.cloudstack.api.response.VolumeResponse;
 import org.apache.cloudstack.api.response.ZoneResponse;
+import org.apache.cloudstack.backup.InternalBackupServiceJobType;
+import org.apache.cloudstack.backup.InternalBackupServiceJobVO;
 import org.apache.cloudstack.backup.BackupOfferingVO;
+import org.apache.cloudstack.backup.BackupVO;
+import org.apache.cloudstack.backup.dao.InternalBackupServiceJobDao;
+import org.apache.cloudstack.backup.dao.BackupDao;
 import org.apache.cloudstack.backup.dao.BackupOfferingDao;
 import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
@@ -657,6 +665,12 @@ public class QueryManagerImpl extends MutualExclusiveIdsManagerBase implements Q
     @Inject
     RoleDao roleDao;
 
+    @Inject
+    private InternalBackupServiceJobDao internalBackupServiceJobDao;
+
+    @Inject
+    private BackupDao backupDao;
+
     /*
      * (non-Javadoc)
      *
@@ -5500,6 +5514,13 @@ private void fillVMOrTemplateDetailOptions(final Map<String, List<String>> optio
             options.put(VmDetailConstants.GUEST_CPU_MODEL, Collections.emptyList());
             options.put(VmDetailConstants.KVM_GUEST_OS_MACHINE_TYPE, Collections.emptyList());
             options.put(VmDetailConstants.KVM_SKIP_FORCE_DISK_CONTROLLER, Arrays.asList("true", "false"));
+            options.put(VmDetailConstants.VALIDATION_COMMAND, Collections.emptyList());
+            options.put(VmDetailConstants.VALIDATION_COMMAND_ARGUMENTS, Collections.emptyList());
+            options.put(VmDetailConstants.VALIDATION_COMMAND_EXPECTED_RESULT, Collections.emptyList());
+            options.put(VmDetailConstants.VALIDATION_COMMAND_TIMEOUT, Collections.emptyList());
+            options.put(VmDetailConstants.VALIDATION_BOOT_TIMEOUT, Collections.emptyList());
+            options.put(VmDetailConstants.VALIDATION_SCREENSHOT_WAIT, Collections.emptyList());
+
         }
 
         if (HypervisorType.VMware.equals(hypervisorType)) {
@@ -6354,6 +6375,34 @@ private List<BucketVO> searchForBucketsInternal(ListBucketsCmd cmd) {
         return bucketDao.searchByIds(bktIds);
     }
 
+    @Override
+    public ListResponse<BackupServiceJobResponse> listBackupServiceJobs(ListBackupServiceJobsCmd cmd) {
+        ListResponse<BackupServiceJobResponse> responses = new ListResponse<>();
+        Pair<List<InternalBackupServiceJobVO>, Integer> result = listBackupServiceJobsInternal(cmd);
+        List<BackupServiceJobResponse> compressionJobResponses = new ArrayList<>();
+
+        for (InternalBackupServiceJobVO jobVO : result.first()) {
+            BackupVO backup = backupDao.findByIdIncludingRemoved(jobVO.getBackupId());
+            DataCenterVO zone = dataCenterDao.findByIdIncludingRemoved(jobVO.getZoneId());
+
+            BackupServiceJobResponse response =  new BackupServiceJobResponse(jobVO.getId(), backup.getUuid(), zone.getUuid(), jobVO.getAttempts(),
+                    jobVO.getType().toString(), jobVO.getStartTime(), jobVO.getScheduledStartTime(), jobVO.getRemoved());
+
+            if (jobVO.getHostId() != null) {
+                response.setHostId(hostDao.findByIdIncludingRemoved(jobVO.getHostId()).getUuid());
+            }
+            compressionJobResponses.add(response);
+        }
+
+        responses.setResponses(compressionJobResponses, result.second());
+        return responses;
+    }
+
+    private Pair<List<InternalBackupServiceJobVO>, Integer> listBackupServiceJobsInternal(ListBackupServiceJobsCmd cmd) {
+        return internalBackupServiceJobDao.searchAndCountForListApi(cmd.getId(), cmd.getBackupId(), cmd.getHostId(), cmd.getZoneId(),
+                InternalBackupServiceJobType.valueOf(cmd.getType()), cmd.getExecuting(), cmd.getScheduled(), cmd.getStartIndex(), cmd.getPageSizeVal());
+    }
+
     @Override
     public String getConfigComponentName() {
         return QueryService.class.getSimpleName();
diff --git a/server/src/main/java/com/cloud/api/query/dao/UserVmJoinDaoImpl.java b/server/src/main/java/com/cloud/api/query/dao/UserVmJoinDaoImpl.java
index 3f7f459c2a1b..ebc2326a72d5 100644
--- a/server/src/main/java/com/cloud/api/query/dao/UserVmJoinDaoImpl.java
+++ b/server/src/main/java/com/cloud/api/query/dao/UserVmJoinDaoImpl.java
@@ -46,6 +46,7 @@
 import org.apache.cloudstack.api.response.SecurityGroupResponse;
 import org.apache.cloudstack.api.response.UserVmResponse;
 import org.apache.cloudstack.api.response.VnfNicResponse;
+import org.apache.cloudstack.backup.dao.BackupOfferingDao;
 import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.extension.ExtensionHelper;
 import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
@@ -146,12 +147,15 @@ public class UserVmJoinDaoImpl extends GenericDaoBaseWithTagInformation<UserVmJo
     HostDao hostDao;
     @Inject
     ExtensionHelper extensionHelper;
+    @Inject
+    private BackupOfferingDao backupOfferingDao;
 
     private final SearchBuilder<UserVmJoinVO> VmDetailSearch;
     private final SearchBuilder<UserVmJoinVO> activeVmByIsoSearch;
     private final SearchBuilder<UserVmJoinVO> leaseExpiredInstanceSearch;
     private final SearchBuilder<UserVmJoinVO> remainingLeaseInDaysSearch;
 
+
     protected UserVmJoinDaoImpl() {
 
         VmDetailSearch = createSearchBuilder();
@@ -294,6 +298,9 @@ public UserVmResponse newUserVmResponse(ResponseView view, String objectName, Us
         if (details.contains(VMDetails.all) || details.contains(VMDetails.backoff)) {
             userVmResponse.setBackupOfferingId(userVm.getBackupOfferingUuid());
             userVmResponse.setBackupOfferingName(userVm.getBackupOfferingName());
+            if (userVm.getBackupOfferingUuid() != null) {
+                userVmResponse.setBackupProvider(backupOfferingDao.findByUuidIncludingRemoved(userVm.getBackupOfferingUuid()).getProvider());
+            }
         }
         if (details.contains(VMDetails.all) || details.contains(VMDetails.servoff) || details.contains(VMDetails.stats)) {
             userVmResponse.setCpuNumber(userVm.getCpu());
diff --git a/server/src/main/java/com/cloud/configuration/Config.java b/server/src/main/java/com/cloud/configuration/Config.java
index a82ccb33a4a3..2f4f7fa8ac5d 100644
--- a/server/src/main/java/com/cloud/configuration/Config.java
+++ b/server/src/main/java/com/cloud/configuration/Config.java
@@ -289,15 +289,6 @@ public enum Config {
             "cloud-public",
             "Default network label to be used when fetching interface for GRE endpoints",
             null),
-    VmNetworkThrottlingRate(
-            "Network",
-            ManagementServer.class,
-            Integer.class,
-            "vm.network.throttling.rate",
-            "200",
-            "Default data transfer rate in megabits per second allowed in User vm's default network.",
-            null),
-
     SecurityGroupWorkCleanupInterval(
             "Network",
             ManagementServer.class,
diff --git a/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java b/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
index 0237e688134d..837254ed8b36 100644
--- a/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
+++ b/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
@@ -7263,7 +7263,7 @@ public NetworkOffering createNetworkOffering(final NetworkOfferingBaseCmd cmd) {
             }
 
             if (forVpc == null) {
-                if (service == Service.SecurityGroup || service == Service.Firewall) {
+                if (service == Service.SecurityGroup) {
                     forVpc = false;
                 } else if (service == Service.NetworkACL) {
                     forVpc = true;
@@ -7308,7 +7308,7 @@ public NetworkOffering createNetworkOffering(final NetworkOfferingBaseCmd cmd) {
                     }
                     for (final String prvNameStr : svcPrv.get(serviceStr)) {
                         // check if provider is supported
-                        final Network.Provider provider = Network.Provider.getProvider(prvNameStr);
+                        final Network.Provider provider = _networkModel.resolveProvider(prvNameStr);
                         if (provider == null) {
                             throw new InvalidParameterValueException("Invalid service provider: " + prvNameStr);
                         }
@@ -7994,7 +7994,7 @@ protected void validateNtwkOffDetails(final Map<Detail, String> details, final M
                 // 1) Vaidate the detail values - have to match the lb provider
                 // name
                 final String providerStr = details.get(detail);
-                if (Network.Provider.getProvider(providerStr) == null) {
+                if (_networkModel.resolveProvider(providerStr) == null) {
                     throw new InvalidParameterValueException("Invalid value " + providerStr + " for the detail " + detail);
                 }
                 if (serviceProviderMap.get(Service.Lb) != null) {
@@ -8486,8 +8486,11 @@ private void applySourceOfferingValuesToCloneCmd(CloneNetworkOfferingCmd cmd,
     private Map<String, String> getSourceOfferingDetails(Long sourceOfferingId) {
         List<NetworkOfferingDetailsVO> sourceDetailsVOs = networkOfferingDetailsDao.listDetails(sourceOfferingId);
         Map<String, String> sourceDetailsMap = new HashMap<>();
+        Set<String> ignoredSourceDetails = new HashSet<>(Arrays.asList(Detail.internetProtocol.name(), Detail.domainid.name(), Detail.zoneid.name()));
         for (NetworkOfferingDetailsVO detailVO : sourceDetailsVOs) {
-            sourceDetailsMap.put(detailVO.getName(), detailVO.getValue());
+            if (!ignoredSourceDetails.contains(detailVO.getName())) {
+                sourceDetailsMap.put(detailVO.getName(), detailVO.getValue());
+            }
         }
         return sourceDetailsMap;
     }
@@ -8635,7 +8638,7 @@ private void applyResolvedValuesToCommand(CloneNetworkOfferingCmd cmd, NetworkOf
 
             if (cmd.getDetails() == null || cmd.getDetails().isEmpty()) {
                 if (!sourceDetailsMap.isEmpty()) {
-                    setField(cmd, "details", sourceDetailsMap);
+                    setField(cmd, "sourceDetailsMap", sourceDetailsMap);
                 }
             }
 
@@ -9205,7 +9208,7 @@ public Integer getServiceOfferingNetworkRate(final long serviceOfferingId, final
             if (offering.getVmType() != null && offering.getVmType().equalsIgnoreCase(VirtualMachine.Type.DomainRouter.toString())) {
                 networkRate = NetworkOrchestrationService.NetworkThrottlingRate.valueIn(dataCenterId);
             } else {
-                networkRate = Integer.parseInt(_configDao.getValue(Config.VmNetworkThrottlingRate.key()));
+                networkRate = NetworkOrchestrationService.VmNetworkThrottlingRate.valueIn(dataCenterId);
             }
         }
 
diff --git a/server/src/main/java/com/cloud/consoleproxy/ConsoleProxyManagerImpl.java b/server/src/main/java/com/cloud/consoleproxy/ConsoleProxyManagerImpl.java
index b3da6af21138..d07641eacc8a 100644
--- a/server/src/main/java/com/cloud/consoleproxy/ConsoleProxyManagerImpl.java
+++ b/server/src/main/java/com/cloud/consoleproxy/ConsoleProxyManagerImpl.java
@@ -21,7 +21,6 @@
 import java.util.Arrays;
 import java.util.Date;
 import java.util.HashMap;
-import java.util.HashSet;
 import java.util.Iterator;
 import java.util.LinkedHashMap;
 import java.util.List;
@@ -252,7 +251,7 @@ public class ConsoleProxyManagerImpl extends ManagerBase implements ConsoleProxy
 
     protected Gson jsonParser = new GsonBuilder().setVersion(1.3).create();
 
-    protected Set<State> availableVmStateOnAssignProxy = new HashSet<>(Arrays.asList(State.Starting, State.Running, State.Stopping, State.Migrating));
+    protected Set<State> availableVmStateOnAssignProxy = Set.of(State.Starting, State.Running, State.Stopping, State.Migrating, State.BackingUp, State.BackupError);
 
     @Inject
     private KeystoreDao _ksDao;
@@ -353,9 +352,7 @@ public ConsoleProxyVO doAssignProxy(long dataCenterId, VMInstanceVO vm) {
         ConsoleProxyVO proxy = null;
 
         if (!availableVmStateOnAssignProxy.contains(vm.getState())) {
-            if (logger.isInfoEnabled()) {
-                logger.info(String.format("Detected that %s is not currently in \"Starting\", \"Running\", \"Stopping\" or \"Migrating\" state, it will fail the proxy assignment.", vm.toString()));
-            }
+            logger.info("Detected that {} is not currently in any of the following states: {}. Therefore, it is not possible to assign a console to the VM.", vm, availableVmStateOnAssignProxy);
             return null;
         }
 
@@ -1486,12 +1483,9 @@ public boolean isPoolReadyForScan(Long dataCenterId) {
             return false;
         }
 
-        List<ConsoleProxyVO> l = consoleProxyDao.getProxyListInStates(State.Starting, State.Stopping);
-        if (l.size() > 0) {
-            if (logger.isDebugEnabled()) {
-                logger.debug("Zone {} has {} console proxy VM(s) in transition state", zone, l.size());
-            }
-
+        List<ConsoleProxyVO> consoleProxiesInTransitionStates = consoleProxyDao.getProxyListInStates(dataCenterId, State.Starting, State.Stopping);
+        if (!consoleProxiesInTransitionStates.isEmpty()) {
+            logger.debug("Zone {} has {} console proxy VM(s) in transition state.", zone, consoleProxiesInTransitionStates.size());
             return false;
         }
 
diff --git a/server/src/main/java/com/cloud/hypervisor/HypervisorGuruBase.java b/server/src/main/java/com/cloud/hypervisor/HypervisorGuruBase.java
index c7de3d472e3f..943d1e73c4b5 100644
--- a/server/src/main/java/com/cloud/hypervisor/HypervisorGuruBase.java
+++ b/server/src/main/java/com/cloud/hypervisor/HypervisorGuruBase.java
@@ -54,6 +54,7 @@
 import com.cloud.vm.dao.UserVmDao;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.backup.Backup;
+import org.apache.cloudstack.backup.BackupProvider;
 import org.apache.cloudstack.engine.orchestration.service.NetworkOrchestrationService;
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.framework.config.Configurable;
@@ -449,13 +450,13 @@ public Map<String, String> getClusterSettings(long vmId) {
 
     @Override
     public VirtualMachine importVirtualMachineFromBackup(long zoneId, long domainId, long accountId, long userId,
-                                                         String vmInternalName, Backup backup) throws Exception {
+                                                         String vmInternalName, Backup backup, BackupProvider backupProvider) throws Exception {
         return null;
     }
 
     @Override
     public boolean attachRestoredVolumeToVirtualMachine(long zoneId, String location, Backup.VolumeInfo volumeInfo,
-                                                        VirtualMachine vm, long poolId, Backup backup) throws Exception {
+                                                        VirtualMachine vm, long poolId, Backup backup, BackupProvider backupProvider) throws Exception {
         return false;
     }
 
diff --git a/server/src/main/java/com/cloud/hypervisor/KVMGuru.java b/server/src/main/java/com/cloud/hypervisor/KVMGuru.java
index 6c1c3424b1b9..4aa67c5835f0 100644
--- a/server/src/main/java/com/cloud/hypervisor/KVMGuru.java
+++ b/server/src/main/java/com/cloud/hypervisor/KVMGuru.java
@@ -32,6 +32,7 @@
 import com.cloud.storage.GuestOSHypervisorVO;
 import com.cloud.storage.GuestOSVO;
 import com.cloud.storage.Volume;
+import com.cloud.storage.VolumeApiService;
 import com.cloud.storage.VolumeVO;
 import com.cloud.storage.dao.GuestOSDao;
 import com.cloud.storage.dao.GuestOSHypervisorDao;
@@ -44,6 +45,8 @@
 import com.cloud.vm.VirtualMachineProfile;
 import com.cloud.vm.dao.VMInstanceDao;
 import org.apache.cloudstack.backup.Backup;
+import org.apache.cloudstack.backup.BackupManagerImpl;
+import org.apache.cloudstack.backup.BackupProvider;
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.storage.command.CopyCommand;
 import org.apache.cloudstack.storage.command.StorageSubSystemCommand;
@@ -71,6 +74,9 @@ public class KVMGuru extends HypervisorGuruBase implements HypervisorGuru {
     @Inject
     HypervisorCapabilitiesDao _hypervisorCapabilitiesDao;
 
+    @Inject
+    private VolumeApiService volumeApiService;
+
 
     @Override
     public HypervisorType getHypervisorType() {
@@ -349,14 +355,18 @@ public Map<String, String> getClusterSettings(long vmId) {
     }
 
     @Override
-    public VirtualMachine importVirtualMachineFromBackup(long zoneId, long domainId, long accountId, long userId, String vmInternalName, Backup backup)  {
+    public VirtualMachine importVirtualMachineFromBackup(long zoneId, long domainId, long accountId, long userId, String vmInternalName, Backup backup,
+            BackupProvider backupProvider)  {
         logger.debug(String.format("Trying to import VM [vmInternalName: %s] from Backup [%s].", vmInternalName,
-                ReflectionToStringBuilderUtils.reflectOnlySelectedFields(backup, "id", "uuid", "vmId", "externalId", "backupType")));
+                ReflectionToStringBuilderUtils.reflectOnlySelectedFields(backup, "id", "uuid", "vmId", "externalId", "type")));
 
         VMInstanceVO vm = _instanceDao.findVMByInstanceNameIncludingRemoved(vmInternalName);
         if (vm == null) {
             throw new CloudRuntimeException("Cannot find VM: " + vmInternalName);
         }
+        if (backupProvider.getName().equals(BackupManagerImpl.KBOSS_BACKUP_PROVIDER)) {
+            return vm;
+        }
         try {
             if (vm.getRemoved() == null) {
                 vm.setState(VirtualMachine.State.Stopped);
@@ -384,11 +394,16 @@ public VirtualMachine importVirtualMachineFromBackup(long zoneId, long domainId,
     return vm;
     }
 
-    @Override public boolean attachRestoredVolumeToVirtualMachine(long zoneId, String location, Backup.VolumeInfo volumeInfo, VirtualMachine vm, long poolId, Backup backup) {
+    @Override
+    public boolean attachRestoredVolumeToVirtualMachine(long zoneId, String location, Backup.VolumeInfo volumeInfo, VirtualMachine vm, long poolId, Backup backup,
+            BackupProvider backupProvider) {
 
         VMInstanceVO targetVM = _instanceDao.findVMByInstanceNameIncludingRemoved(vm.getName());
         List<VolumeVO> vmVolumes = _volumeDao.findByInstance(targetVM.getId());
         VolumeVO restoredVolume = _volumeDao.findByUuid(location);
+        if (backupProvider.getName().equals(BackupManagerImpl.KBOSS_BACKUP_PROVIDER)) {
+            return true;
+        }
         if (restoredVolume != null) {
             try {
                 _volumeDao.attachVolume(restoredVolume.getId(), vm.getId(), getNextAvailableDeviceId(vmVolumes));
@@ -405,6 +420,6 @@ public VirtualMachine importVirtualMachineFromBackup(long zoneId, long domainId,
                 throw new RuntimeException("Unable to attach volume " + restoredVolume.getName() + " to VM" + vm.getName() + " due to : " + e.getMessage());
             }
         }
-    return false;
+        return false;
     }
 }
diff --git a/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java b/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
index da84e5058603..3cd42c50c28d 100644
--- a/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
@@ -659,28 +659,58 @@ public boolean applyRules(List<? extends FirewallRule> rules, FirewallRule.Purpo
         }
 
         boolean success = true;
-        Network network = _networksDao.findById(rules.get(0).getNetworkId());
-        FirewallRuleVO.TrafficType trafficType = rules.get(0).getTrafficType();
+        FirewallRule firstRule = rules.get(0);
+        Long networkId = firstRule.getNetworkId();
+        Long vpcId = firstRule.getVpcId();
+        FirewallRuleVO.TrafficType trafficType = firstRule.getTrafficType();
         List<PublicIp> publicIps = new ArrayList<PublicIp>();
 
-        if (!(rules.get(0).getPurpose() == FirewallRule.Purpose.Firewall && trafficType == FirewallRule.TrafficType.Egress)) {
-            // get the list of public ip's owned by the network
-            List<IPAddressVO> userIps = _ipAddressDao.listByAssociatedNetwork(network.getId(), null);
-            if (userIps != null && !userIps.isEmpty()) {
-                for (IPAddressVO userIp : userIps) {
-                    PublicIp publicIp = PublicIp.createFromAddrAndVlan(userIp, _vlanDao.findById(userIp.getVlanId()));
-                    publicIps.add(publicIp);
+        // For VPC firewall rules the networkId on the rule is null; resolve via VPC.
+        Network network = null;
+        Vpc vpc = null;
+        if (networkId != null) {
+            network = _networksDao.findById(networkId);
+        } else if (vpcId != null) {
+            vpc = _vpcDao.findById(vpcId);
+        }
+
+        if (network == null) {
+            logger.warn("Unable to resolve network for firewall rules (networkId={}, vpcId={}); skipping IP association", networkId, vpcId);
+        } else if (!(firstRule.getPurpose() == FirewallRule.Purpose.Firewall && trafficType == FirewallRule.TrafficType.Egress)) {
+            // For VPC ingress rules, collect public IPs tied to the VPC rather than network association
+            if (vpcId != null && networkId == null) {
+                List<IPAddressVO> vpcIps = _ipAddressDao.listByAssociatedVpc(vpcId, null);
+                if (vpcIps != null) {
+                    for (IPAddressVO userIp : vpcIps) {
+                        PublicIp publicIp = PublicIp.createFromAddrAndVlan(userIp, _vlanDao.findById(userIp.getVlanId()));
+                        publicIps.add(publicIp);
+                    }
+                }
+            } else {
+                // get the list of public ip's owned by the network
+                List<IPAddressVO> userIps = _ipAddressDao.listByAssociatedNetwork(network.getId(), null);
+                if (userIps != null && !userIps.isEmpty()) {
+                    for (IPAddressVO userIp : userIps) {
+                        PublicIp publicIp = PublicIp.createFromAddrAndVlan(userIp, _vlanDao.findById(userIp.getVlanId()));
+                        publicIps.add(publicIp);
+                    }
                 }
             }
         }
-        // rules can not programmed unless IP is associated with network service provider, so run IP assoication for
+
+        // rules can not programmed unless IP is associated with network service provider, so run IP association for
         // the network so as to ensure IP is associated before applying rules (in add state)
-        if (checkIfIpAssocRequired(network, false, publicIps)) {
+        if (network != null && checkIfIpAssocRequired(network, false, publicIps)) {
             applyIpAssociations(network, false, continueOnError, publicIps);
         }
 
         try {
-            applier.applyRules(network, purpose, rules);
+            if (network != null || vpc != null) {
+                applier.applyRules(network, vpc, purpose, rules);
+            } else {
+                logger.warn("Skipping applyRules: no network or vpc resolved for rules (networkId={}, vpcId={})", networkId, vpcId);
+                success = false;
+            }
         } catch (ResourceUnavailableException e) {
             if (!continueOnError) {
                 throw e;
@@ -691,7 +721,7 @@ public boolean applyRules(List<? extends FirewallRule> rules, FirewallRule.Purpo
 
         // if there are no active rules associated with a public IP, then public IP need not be associated with a provider.
         // This IPAssoc ensures, public IP is dis-associated after last active rule is revoked.
-        if (checkIfIpAssocRequired(network, true, publicIps)) {
+        if (network != null && checkIfIpAssocRequired(network, true, publicIps)) {
             applyIpAssociations(network, true, continueOnError, publicIps);
         }
 
diff --git a/server/src/main/java/com/cloud/network/NetworkModelImpl.java b/server/src/main/java/com/cloud/network/NetworkModelImpl.java
index 07305c0e6418..f47046cdc434 100644
--- a/server/src/main/java/com/cloud/network/NetworkModelImpl.java
+++ b/server/src/main/java/com/cloud/network/NetworkModelImpl.java
@@ -99,14 +99,19 @@
 import com.cloud.network.element.NetworkElement;
 import com.cloud.network.element.UserDataServiceProvider;
 import com.cloud.network.router.VirtualRouter;
+import org.apache.cloudstack.extension.Extension;
+import org.apache.cloudstack.extension.ExtensionHelper;
+import org.apache.cloudstack.framework.extensions.network.NetworkExtensionElement;
 import com.cloud.network.rules.FirewallRule.Purpose;
 import com.cloud.network.rules.FirewallRuleVO;
 import com.cloud.network.rules.dao.PortForwardingRulesDao;
 import com.cloud.network.vpc.Vpc;
 import com.cloud.network.vpc.VpcGatewayVO;
+import com.cloud.network.vpc.VpcOfferingServiceMapVO;
 import com.cloud.network.vpc.dao.PrivateIpDao;
 import com.cloud.network.vpc.dao.VpcDao;
 import com.cloud.network.vpc.dao.VpcGatewayDao;
+import com.cloud.network.vpc.dao.VpcOfferingServiceMapDao;
 import com.cloud.offering.NetworkOffering;
 import com.cloud.offering.NetworkOffering.Detail;
 import com.cloud.offerings.NetworkOfferingServiceMapVO;
@@ -183,6 +188,8 @@ public class NetworkModelImpl extends ManagerBase implements NetworkModel, Confi
     NetworkPermissionDao _networkPermissionDao;
     @Inject
     VpcDao vpcDao;
+    @Inject
+    VpcOfferingServiceMapDao _vpcOffSvcMapDao;
 
     private List<NetworkElement> networkElements;
 
@@ -234,6 +241,11 @@ public void setNetworkElements(List<NetworkElement> networkElements) {
     private NetworkService _networkService;
     @Inject
     TungstenGuestNetworkIpAddressDao tungstenGuestNetworkIpAddressDao;
+    @Inject
+    ExtensionHelper extensionHelper;
+    @Inject
+    NetworkExtensionElement networkExtensionElement;
+
 
     private final HashMap<String, NetworkOfferingVO> _systemNetworks = new HashMap<String, NetworkOfferingVO>(5);
 
@@ -262,15 +274,39 @@ public NetworkModelImpl() {
     public NetworkElement getElementImplementingProvider(String providerName) {
         String elementName = s_providerToNetworkElementMap.get(providerName);
         NetworkElement element = AdapterBase.getAdapterByName(networkElements, elementName);
+        if (element == null && extensionHelper.isNetworkExtensionProvider(providerName)) {
+            // Provider is an extension-backed external network provider.
+            // Initialize a copy of NetworkExtensionElement
+            if (networkExtensionElement != null) {
+                element = networkExtensionElement.withProviderName(providerName);
+            }
+        }
         return element;
     }
 
+    /**
+     * Returns the effective network capabilities for an extension-backed external
+     * network provider on the given physical network.
+     *
+     * @param physicalNetworkId physical network ID (may be null for offering-level queries)
+     * @param providerName      provider / extension name
+     * @return per-provider capabilities, or empty map if not found
+     */
+    protected Map<Service, Map<Capability, String>> getExternalProviderCapabilities(
+            Long physicalNetworkId, String providerName) {
+        return extensionHelper.getNetworkCapabilitiesForProvider(physicalNetworkId, providerName);
+    }
+
     @Override
     public List<Service> getElementServices(Provider provider) {
         NetworkElement element = getElementImplementingProvider(provider.getName());
         if (element == null) {
             throw new InvalidParameterValueException("Unable to find the Network Element implementing the Service Provider '" + provider.getName() + "'");
         }
+        if (extensionHelper.isNetworkExtensionProvider(provider.getName())) {
+            Map<Service, Map<Capability, String>> caps = getExternalProviderCapabilities(null, provider.getName());
+            return new ArrayList<Service>(caps.keySet());
+        }
         return new ArrayList<Service>(element.getCapabilities().keySet());
     }
 
@@ -283,6 +319,24 @@ public boolean canElementEnableIndividualServices(Provider provider) {
         return element.canEnableIndividualServices();
     }
 
+    @Override
+    public boolean canElementEnableIndividualServicesByName(String providerName) {
+        if (providerName == null) {
+            return false;
+        }
+        // Try resolve to enum Provider first
+        Provider provider = resolveProvider(providerName);
+        if (provider != null) {
+            try {
+                return canElementEnableIndividualServices(provider);
+            } catch (Exception e) {
+                logger.debug("canElementEnableIndividualServices failed for provider {}: {}", providerName, e.getMessage());
+            }
+        }
+        // Unknown provider: be conservative and return false
+        return false;
+    }
+
     Set<Purpose> getPublicIpPurposeInRules(PublicIpAddress ip, boolean includeRevoked, boolean includingFirewall) {
         Set<Purpose> result = new HashSet<Purpose>();
         List<FirewallRuleVO> rules = null;
@@ -435,8 +489,11 @@ Map<Service, Set<Provider>> getServiceProvidersMap(long networkId) {
             if (providers == null) {
                 providers = new HashSet<Provider>();
             }
-            providers.add(Provider.getProvider(nsm.getProvider()));
-            map.put(Service.getService(nsm.getService()), providers);
+            Provider provider = resolveProvider(nsm.getProvider());
+            if (provider != null) {
+                providers.add(provider);
+                map.put(Service.getService(nsm.getService()), providers);
+            }
         }
         return map;
     }
@@ -457,12 +514,16 @@ public boolean canIpUsedForService(PublicIp publicIp, Service service, Long netw
         // We only support one provider for one service now
         Map<Service, Set<Provider>> serviceToProviders = getServiceProvidersMap(networkId);
         // Since IP already has service to bind with, the oldProvider can't be null
-        Set<Provider> newProviders = serviceToProviders.get(service);
+        Set<Provider> newProviders = getProvidersForServiceWithVpcFallback(serviceToProviders, service, publicIp.getVpcId());
         if (newProviders == null || newProviders.isEmpty()) {
             throw new InvalidParameterValueException("There is no new provider for IP " + publicIp.getAddress() + " of service " + service.getName() + "!");
         }
         Provider newProvider = (Provider)newProviders.toArray()[0];
-        Set<Provider> oldProviders = serviceToProviders.get(services.toArray()[0]);
+        Service existingService = (Service) services.toArray()[0];
+        Set<Provider> oldProviders = getProvidersForServiceWithVpcFallback(serviceToProviders, existingService, publicIp.getVpcId());
+        if (oldProviders == null || oldProviders.isEmpty()) {
+            throw new InvalidParameterValueException("There is no existing provider for IP " + publicIp.getAddress() + " of service " + existingService.getName() + "!");
+        }
         Provider oldProvider = (Provider)oldProviders.toArray()[0];
         Network network = _networksDao.findById(networkId);
         NetworkElement oldElement = getElementImplementingProvider(oldProvider.getName());
@@ -477,20 +538,78 @@ public boolean canIpUsedForService(PublicIp publicIp, Service service, Long netw
         return true;
     }
 
+    private Set<Provider> getProvidersForServiceWithVpcFallback(Map<Service, Set<Provider>> serviceToProviders, Service service, Long vpcId) {
+        Set<Provider> providers = serviceToProviders.get(service);
+        if (providers != null && !providers.isEmpty()) {
+            return providers;
+        }
+
+        if (vpcId == null || service != Service.Firewall) {
+            return providers;
+        }
+
+        Set<Provider> vpcProviders = new HashSet<Provider>();
+        Vpc vpc = vpcDao.findById(vpcId);
+        if (vpc == null) {
+            return vpcProviders;
+        }
+
+        List<VpcOfferingServiceMapVO> offeringProviders = _vpcOffSvcMapDao.listProvidersForServiceForVpcOffering(vpc.getVpcOfferingId(), Service.Firewall);
+        if (offeringProviders != null) {
+            for (VpcOfferingServiceMapVO offeringProvider : offeringProviders) {
+                Provider provider = Provider.getProvider(offeringProvider.getProvider());
+                if (provider != null) {
+                    vpcProviders.add(provider);
+                }
+            }
+        }
+
+        return vpcProviders;
+    }
+
     Map<Provider, Set<Service>> getProviderServicesMap(long networkId) {
         Map<Provider, Set<Service>> map = new HashMap<Provider, Set<Service>>();
         List<NetworkServiceMapVO> nsms = _ntwkSrvcDao.getServicesInNetwork(networkId);
         for (NetworkServiceMapVO nsm : nsms) {
-            Set<Service> services = map.get(Provider.getProvider(nsm.getProvider()));
+            Provider provider = resolveProvider(nsm.getProvider());
+            if (provider == null) {
+                continue;
+            }
+            Set<Service> services = map.get(provider);
             if (services == null) {
                 services = new HashSet<Service>();
             }
             services.add(Service.getService(nsm.getService()));
-            map.put(Provider.getProvider(nsm.getProvider()), services);
+            map.put(provider, services);
         }
         return map;
     }
 
+    /**
+     * Resolves a provider name to a {@link Provider} instance.
+     *
+     * <p>For well-known providers, returns the static constant from
+     * {@link Provider#getProvider(String)}.  For dynamic NetworkOrchestrator
+     * extension providers (whose names are not in the static registry), returns
+     * a transient {@link Provider} with the given name so that the caller can
+     * still dispatch to the correct {@link NetworkExtensionElement} via
+     * {@link #getElementImplementingProvider(String)}.</p>
+     *
+     * @param providerName the provider name from {@code ntwk_service_map}
+     * @return a {@link Provider} instance, or {@code null} if not resolvable
+     */
+    @Override
+    public Provider resolveProvider(String providerName) {
+        Provider provider = Provider.getProvider(providerName);
+        if (provider == null && extensionHelper.isNetworkExtensionProvider(providerName)) {
+            // Dynamic extension-backed provider: create a transient Provider that preserves
+            // the actual extension name.  getElementImplementingProvider() handles this name
+            // by detecting it as an extension provider and returning NetworkExtensionElement.
+            provider = Provider.createTransientProvider(providerName);
+        }
+        return provider;
+    }
+
     @Override
     public Map<Provider, ArrayList<PublicIpAddress>> getProviderToIpList(Network network, Map<PublicIpAddress, Set<Service>> ipToServices) {
         NetworkOffering offering = _networkOfferingDao.findById(network.getNetworkOfferingId());
@@ -694,11 +813,21 @@ public Map<Service, Map<Capability, String>> getNetworkCapabilities(long network
 
         // list all services of this networkOffering
         List<NetworkServiceMapVO> servicesMap = _ntwkSrvcDao.getServicesInNetwork(networkId);
+
+        // Resolve the physical network once for external provider lookups
+        NetworkVO network = _networksDao.findById(networkId);
+        Long physicalNetworkId = network != null ? network.getPhysicalNetworkId() : null;
+
         for (NetworkServiceMapVO instance : servicesMap) {
             Service service = Service.getService(instance.getService());
             NetworkElement element = getElementImplementingProvider(instance.getProvider());
             if (element != null) {
-                Map<Service, Map<Capability, String>> elementCapabilities = element.getCapabilities();
+                Map<Service, Map<Capability, String>> elementCapabilities;
+                if (extensionHelper.isNetworkExtensionProvider(instance.getProvider()) && physicalNetworkId != null) {
+                    elementCapabilities = getExternalProviderCapabilities(physicalNetworkId, instance.getProvider());
+                } else {
+                    elementCapabilities = element.getCapabilities();
+                }
                 if (elementCapabilities != null) {
                     networkCapabilities.put(service, elementCapabilities.get(service));
                 }
@@ -724,10 +853,15 @@ public Map<Capability, String> getNetworkServiceCapabilities(long networkId, Ser
 
         NetworkElement element = getElementImplementingProvider(provider);
         if (element != null) {
-            Map<Service, Map<Capability, String>> elementCapabilities = element.getCapabilities();
-            ;
+            Map<Service, Map<Capability, String>> elementCapabilities;
+            if (extensionHelper.isNetworkExtensionProvider(provider)) {
+                elementCapabilities = getExternalProviderCapabilities(null, provider);
+            } else {
+                elementCapabilities = element.getCapabilities();
+            }
 
             if (elementCapabilities == null || !elementCapabilities.containsKey(service)) {
+                // TBD: We should be sending providerId and not the offering object itself.
                 throw new UnsupportedServiceException("Service " + service.getName() + " is not supported by the element=" + element.getName() +
                     " implementing Provider=" + provider);
             }
@@ -758,12 +892,22 @@ public Map<Capability, String> getNetworkOfferingServiceCapabilities(NetworkOffe
         // we have to calculate capabilities for all of them
         String provider = providers.get(0);
 
+        // Check if this is an extension-backed external network provider first.
+        // These providers are not in the static s_providerToNetworkElementMap so
+        // we resolve their capabilities from the extension details directly.
+        if (extensionHelper.isNetworkExtensionProvider(provider)) {
+            Map<Service, Map<Capability, String>> extCaps = getExternalProviderCapabilities(null, provider);
+            if (extCaps != null && extCaps.containsKey(service)) {
+                return extCaps.get(service);
+            }
+            return serviceCapabilities;
+        }
+
         // FIXME we return the capabilities of the first provider of the service - what if we have multiple providers
         // for same Service?
         NetworkElement element = getElementImplementingProvider(provider);
         if (element != null) {
             Map<Service, Map<Capability, String>> elementCapabilities = element.getCapabilities();
-            ;
 
             if (elementCapabilities == null || !elementCapabilities.containsKey(service)) {
                 // TBD: We should be sending providerId and not the offering object itself.
@@ -979,7 +1123,6 @@ public  boolean isSharedNetworkWithoutServices (long networkId) {
         return false;
     }
 
-
     @Override
     public boolean areServicesSupportedByNetworkOffering(long networkOfferingId, Service... services) {
         return (_ntwkOfferingSrvcDao.areServicesSupportedByNetworkOffering(networkOfferingId, services));
@@ -1161,7 +1304,11 @@ public Map<Service, Set<Provider>> getNetworkOfferingServiceProvidersMap(long ne
             if (providers == null) {
                 providers = new HashSet<Provider>();
             }
-            providers.add(Provider.getProvider(instance.getProvider()));
+
+            final Provider provider = resolveProvider(instance.getProvider());
+            if (provider != null) {
+                providers.add(provider);
+            }
             serviceProviderMap.put(Service.getService(service), providers);
         }
 
@@ -1201,9 +1348,98 @@ public List<? extends Provider> listSupportedNetworkServiceProviders(String serv
             }
         }
 
+        // Also include extension-backed NetworkExtension providers.
+        // resolveProvider() creates a transient Provider (not added to the static list)
+        // for extension names that are not in the built-in registry.
+        try {
+            List<PhysicalNetworkServiceProviderVO> nsps = _pNSPDao.listAll();
+            List<Extension> extensions = extensionHelper.listExtensionsByType(Extension.Type.NetworkOrchestrator);
+            if (CollectionUtils.isNotEmpty(nsps)) {
+                Set<String> extensionProviderNames = new HashSet<>();
+                if (extensions != null) {
+                    for (Extension extension : extensions) {
+                        if (extension == null || StringUtils.isBlank(extension.getName())) {
+                            continue;
+                        }
+                        extensionProviderNames.add(extension.getName());
+                    }
+                }
+
+                if (!extensionProviderNames.isEmpty()) {
+                    // Avoid duplicate provider names across multiple physical networks.
+                    Set<String> addedExtProviders = new HashSet<>();
+                    for (PhysicalNetworkServiceProviderVO nsp : nsps) {
+                        String provName = nsp.getProviderName();
+                        if (StringUtils.isBlank(provName)) {
+                            continue;
+                        }
+
+                        if (addedExtProviders.contains(provName) || !extensionProviderNames.contains(provName)) {
+                            continue;
+                        }
+
+                        // Filter by service if requested: check the NSP's service flags.
+                        if (service != null && !isServiceProvidedByNsp(nsp, service)) {
+                            continue;
+                        }
+
+                        // Resolve or create a transient Provider for the extension name.
+                        Provider extProvider = resolveProvider(provName);
+                        if (extProvider == null) {
+                            continue;
+                        }
+
+                        // Check if the network extension provider supports the service
+                        NetworkElement element = getElementImplementingProvider(provName);
+                        if (element == null) {
+                            continue;
+                        }
+                        Map<Service, Map<Capability, String>> elementCapabilities = element.getCapabilities();
+                        if (elementCapabilities == null || !elementCapabilities.containsKey(service)) {
+                            continue;
+                        }
+
+                        supportedProviders.add(extProvider);
+                        addedExtProviders.add(provName);
+                    }
+                }
+            }
+        } catch (Exception e) {
+            logger.debug("Failed to include extension-backed providers in listSupportedNetworkServiceProviders: {}", e.getMessage());
+        }
+
         return new ArrayList<Provider>(supportedProviders);
     }
 
+    /**
+     * Returns {@code true} if the given {@link com.cloud.network.dao.PhysicalNetworkServiceProviderVO}
+     * has its service flag set for {@code service}.
+     *
+     * <p>This is used by {@link #listSupportedNetworkServiceProviders} to filter extension-backed
+     * providers (looked up via {@link com.cloud.network.dao.PhysicalNetworkServiceProviderDao#listAll})
+     * without having to query each extension's capability JSON.</p>
+     */
+    private boolean isServiceProvidedByNsp(
+            PhysicalNetworkServiceProviderVO nsp, Service service) {
+        if (service == null) {
+            return true;
+        }
+        if (service == Service.Dhcp)          return nsp.isDhcpServiceProvided();
+        if (service == Service.Dns)           return nsp.isDnsServiceProvided();
+        if (service == Service.Firewall)      return nsp.isFirewallServiceProvided();
+        if (service == Service.Gateway)       return nsp.isGatewayServiceProvided();
+        if (service == Service.Lb)            return nsp.isLbServiceProvided();
+        if (service == Service.PortForwarding) return nsp.isPortForwardingServiceProvided();
+        if (service == Service.SecurityGroup) return nsp.isSecuritygroupServiceProvided();
+        if (service == Service.SourceNat)     return nsp.isSourcenatServiceProvided();
+        if (service == Service.StaticNat)     return nsp.isStaticnatServiceProvided();
+        if (service == Service.UserData)      return nsp.isUserdataServiceProvided();
+        if (service == Service.Vpn)           return nsp.isVpnServiceProvided();
+        if (service == Service.NetworkACL)    return nsp.isNetworkAclServiceProvided();
+        // Unknown service: fall back to true so extension-backed providers are not filtered out
+        return true;
+    }
+
     @Override
     public Provider getDefaultUniqueProviderForService(String serviceName) {
         List<? extends Provider> providers = listSupportedNetworkServiceProviders(serviceName);
@@ -1540,13 +1776,19 @@ public void canProviderSupportServices(Map<Provider, Set<Service>> providersMap)
                 throw new InvalidParameterValueException("Unable to find the Network Element implementing the Service Provider '" + provider.getName() + "'");
             }
 
+            // For external network providers, get per-provider capabilities
+            final boolean isExternal = extensionHelper.isNetworkExtensionProvider(provider.getName());
+            Map<Service, Map<Capability, String>> providerCaps = isExternal
+                    ? getExternalProviderCapabilities(null, provider.getName())
+                    : element.getCapabilities();
+
             Set<Service> enabledServices = new HashSet<Service>();
             enabledServices.addAll(providersMap.get(provider));
 
             if (enabledServices != null && !enabledServices.isEmpty()) {
-                if (!element.canEnableIndividualServices()) {
+                if (!element.canEnableIndividualServices() && !isExternal) {
                     Set<Service> requiredServices = new HashSet<Service>();
-                    requiredServices.addAll(element.getCapabilities().keySet());
+                    requiredServices.addAll(providerCaps.keySet());
 
                     if (requiredServices.contains(Network.Service.Gateway)) {
                         requiredServices.remove(Network.Service.Gateway);
@@ -1580,7 +1822,7 @@ public void canProviderSupportServices(Map<Provider, Set<Service>> providersMap)
                 List<String> serviceList = new ArrayList<String>();
                 for (Service service : enabledServices) {
                     // check if the service is provided by this Provider
-                    if (!element.getCapabilities().containsKey(service)) {
+                    if (!providerCaps.containsKey(service)) {
                         throw new UnsupportedServiceException(provider.getName() + " Provider cannot provide service " + service.getName());
                     }
                     serviceList.add(service.getName());
@@ -1655,18 +1897,32 @@ public boolean checkIpForService(IpAddress userIp, Service service, Long network
         return true;
     }
 
+
     @Override
     public boolean providerSupportsCapability(Set<Provider> providers, Service service, Capability cap) {
         for (Provider provider : providers) {
             NetworkElement element = getElementImplementingProvider(provider.getName());
             if (element != null) {
-                Map<Service, Map<Capability, String>> elementCapabilities = element.getCapabilities();
+                boolean isExtProvider = extensionHelper.isNetworkExtensionProvider(provider.getName());
+                Map<Service, Map<Capability, String>> elementCapabilities = isExtProvider
+                        ? getExternalProviderCapabilities(null, provider.getName())
+                        : element.getCapabilities();
                 if (elementCapabilities == null || !elementCapabilities.containsKey(service)) {
+                    if (isExtProvider) {
+                        // Extension provider with no declared capabilities for this service —
+                        // treat as "service supported but capability not constrained"
+                        return false;
+                    }
                     throw new UnsupportedServiceException("Service " + service.getName() + " is not supported by the element=" + element.getName() +
                             " implementing Provider=" + provider.getName());
                 }
                 Map<Capability, String> serviceCapabilities = elementCapabilities.get(service);
                 if (serviceCapabilities == null || serviceCapabilities.isEmpty()) {
+                    if (isExtProvider) {
+                        // Extension provider declared the service but without specific capability
+                        // constraints — treat as "capability not constrained, not explicitly supported"
+                        return false;
+                    }
                     throw new UnsupportedServiceException("Service " + service.getName() + " doesn't have capabilites for element=" + element.getName() +
                             " implementing Provider=" + provider.getName());
                 }
@@ -1686,19 +1942,36 @@ public void checkCapabilityForProvider(Set<Provider> providers, Service service,
         for (Provider provider : providers) {
             NetworkElement element = getElementImplementingProvider(provider.getName());
             if (element != null) {
-                Map<Service, Map<Capability, String>> elementCapabilities = element.getCapabilities();
+                boolean isExtProvider = extensionHelper.isNetworkExtensionProvider(provider.getName());
+                Map<Service, Map<Capability, String>> elementCapabilities = isExtProvider
+                        ? getExternalProviderCapabilities(null, provider.getName())
+                        : element.getCapabilities();
                 if (elementCapabilities == null || !elementCapabilities.containsKey(service)) {
+                    if (isExtProvider) {
+                        // Extension provider with no declared capabilities for this service —
+                        // treat as supported without constraints; skip the capability check.
+                        continue;
+                    }
                     throw new UnsupportedServiceException("Service " + service.getName() + " is not supported by the element=" + element.getName() +
                         " implementing Provider=" + provider.getName());
                 }
                 Map<Capability, String> serviceCapabilities = elementCapabilities.get(service);
                 if (serviceCapabilities == null || serviceCapabilities.isEmpty()) {
+                    if (isExtProvider) {
+                        // Extension provider declared the service without capability constraints —
+                        // accept any capability value (the extension handles it at runtime).
+                        continue;
+                    }
                     throw new UnsupportedServiceException("Service " + service.getName() + " doesn't have capabilities for element=" + element.getName() +
                         " implementing Provider=" + provider.getName());
                 }
 
                 String value = serviceCapabilities.get(cap);
                 if (value == null || value.isEmpty()) {
+                    if (isExtProvider) {
+                        // Capability not explicitly declared for this extension — accept it.
+                        continue;
+                    }
                     throw new UnsupportedServiceException("Service " + service.getName() + " doesn't have capability " + cap.getName() + " for element=" +
                         element.getName() + " implementing Provider=" + provider.getName());
                 }
@@ -1953,7 +2226,7 @@ public List<Provider> getNtwkOffDistinctProviders(long ntkwOffId) {
         List<String> providerNames = _ntwkOfferingSrvcDao.getDistinctProviders(ntkwOffId);
         List<Provider> providers = new ArrayList<Provider>();
         for (String providerName : providerNames) {
-            providers.add(Network.Provider.getProvider(providerName));
+            providers.add(resolveProvider(providerName));
         }
 
         return providers;
@@ -2255,7 +2528,7 @@ private List<Provider> getNetworkProviders(long networkId) {
         Map<String, Provider> providers = new HashMap<String, Provider>();
         for (String providerName : providerNames) {
             if (!providers.containsKey(providerName)) {
-                providers.put(providerName, Network.Provider.getProvider(providerName));
+                providers.put(providerName, resolveProvider(providerName));
             }
         }
 
diff --git a/server/src/main/java/com/cloud/network/NetworkServiceImpl.java b/server/src/main/java/com/cloud/network/NetworkServiceImpl.java
index 387fd6e40580..2853fa96330d 100644
--- a/server/src/main/java/com/cloud/network/NetworkServiceImpl.java
+++ b/server/src/main/java/com/cloud/network/NetworkServiceImpl.java
@@ -2975,7 +2975,7 @@ public boolean restartNetwork(NetworkVO network, boolean cleanup, boolean makeRe
             throw new InvalidParameterValueException("Network is not in the right state to be restarted. Correct states are: " + Network.State.Implemented + ", " + Network.State.Setup);
         }
 
-        if (network.getBroadcastDomainType() == BroadcastDomainType.Lswitch) {
+        if (network.getBroadcastDomainType() == BroadcastDomainType.Lswitch && !_networkMgr.isIsolationMethodNetworkExtension(network.getNetworkOfferingId())) {
             /**
              * Unable to restart these networks now.
              * TODO Restarting a SDN based network requires updating the nics and the configuration
@@ -3087,8 +3087,8 @@ public IpAddress getIp(String ipAddress) {
 
     protected boolean providersConfiguredForExternalNetworking(Collection<String> providers) {
         for (String providerStr : providers) {
-            Provider provider = Network.Provider.getProvider(providerStr);
-            if (provider.isExternal()) {
+            Provider provider = _networkModel.resolveProvider(providerStr);
+            if (provider != null && provider.isExternal()) {
                 return true;
             }
         }
@@ -4449,6 +4449,7 @@ public PhysicalNetwork updatePhysicalNetwork(Long id, String networkSpeed, List<
             addOrRemoveVnets(listOfRanges, network);
         }
         _physicalNetworkDao.update(id, network);
+
         return network;
 
     }
@@ -5121,7 +5122,7 @@ public List<? extends Service> listNetworkServices(String providerName) {
 
         Provider provider = null;
         if (providerName != null) {
-            provider = Network.Provider.getProvider(providerName);
+            provider = _networkModel.resolveProvider(providerName);
             if (provider == null) {
                 throw new InvalidParameterValueException("Invalid Network Service Provider=" + providerName);
             }
@@ -5158,7 +5159,7 @@ public PhysicalNetworkServiceProvider addProviderToPhysicalNetwork(Long physical
         }
 
         if (providerName != null) {
-            Provider provider = Network.Provider.getProvider(providerName);
+            Provider provider = _networkModel.resolveProvider(providerName);
             if (provider == null) {
                 throw new InvalidParameterValueException("Invalid Network Service Provider=" + providerName);
             }
diff --git a/server/src/main/java/com/cloud/network/as/AutoScaleManagerImpl.java b/server/src/main/java/com/cloud/network/as/AutoScaleManagerImpl.java
index 33ad8adb207a..1bd642ff7edc 100644
--- a/server/src/main/java/com/cloud/network/as/AutoScaleManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/as/AutoScaleManagerImpl.java
@@ -1482,7 +1482,7 @@ public Counter createCounter(CreateCounterCmd cmd) {
         }
 
         // Validate Provider
-        Network.Provider provider = Network.Provider.getProvider(cmd.getProvider());
+        Network.Provider provider = networkModel.resolveProvider(cmd.getProvider());
         if (provider == null) {
             throw new InvalidParameterValueException("The Provider " + cmd.getProvider() + " does not exist; Unable to create Counter");
         }
@@ -1551,7 +1551,7 @@ public List<? extends Counter> listCounters(ListCountersCmd cmd) {
         }
         String providerStr = cmd.getProvider();
         if (providerStr != null) {
-            Network.Provider provider = Network.Provider.getProvider(providerStr);
+            Network.Provider provider = networkModel.resolveProvider(providerStr);
             if (provider == null) {
                 throw new InvalidParameterValueException("The Provider " + providerStr + " does not exist; Unable to list Counter");
             }
@@ -2026,7 +2026,7 @@ public void checkAutoScaleVmGroupName(String groupName) {
     private UserVmVO startNewVM(long vmId) {
         try {
             CallContext.current().setEventDetails("Instance ID: " + vmId);
-            return userVmMgr.startVirtualMachine(vmId, null, new HashMap<>(), null).first();
+            return userVmMgr.startVirtualMachine(vmId, null, new HashMap<>(), null, false).first();
         } catch (final ResourceUnavailableException ex) {
             logger.warn("Exception: ", ex);
             throw new ServerApiException(ApiErrorCode.RESOURCE_UNAVAILABLE_ERROR, ex.getMessage());
diff --git a/server/src/main/java/com/cloud/network/element/VirtualRouterElement.java b/server/src/main/java/com/cloud/network/element/VirtualRouterElement.java
index 0978fcba51b5..c08246c5a15b 100644
--- a/server/src/main/java/com/cloud/network/element/VirtualRouterElement.java
+++ b/server/src/main/java/com/cloud/network/element/VirtualRouterElement.java
@@ -24,28 +24,21 @@
 
 import javax.inject.Inject;
 
-import org.apache.cloudstack.network.BgpPeer;
-import org.apache.commons.collections.CollectionUtils;
-import org.apache.commons.lang3.ObjectUtils;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.annotation.Qualifier;
-
-import com.cloud.storage.dao.VMTemplateDao;
-import com.cloud.vm.VirtualMachineProfileImpl;
-import com.cloud.vm.VmDetailConstants;
-import com.cloud.vm.dao.NicDao;
-import com.google.gson.Gson;
-
 import org.apache.cloudstack.api.command.admin.router.ConfigureOvsElementCmd;
 import org.apache.cloudstack.api.command.admin.router.ConfigureVirtualRouterElementCmd;
 import org.apache.cloudstack.api.command.admin.router.CreateVirtualRouterElementCmd;
 import org.apache.cloudstack.api.command.admin.router.ListOvsElementsCmd;
 import org.apache.cloudstack.api.command.admin.router.ListVirtualRouterElementsCmd;
 import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
+import org.apache.cloudstack.network.BgpPeer;
 import org.apache.cloudstack.network.router.deployment.RouterDeploymentDefinition;
 import org.apache.cloudstack.network.router.deployment.RouterDeploymentDefinitionBuilder;
 import org.apache.cloudstack.network.topology.NetworkTopology;
 import org.apache.cloudstack.network.topology.NetworkTopologyContext;
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.lang3.ObjectUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
 
 import com.cloud.agent.api.to.LoadBalancerTO;
 import com.cloud.configuration.ConfigurationManager;
@@ -101,6 +94,7 @@
 import com.cloud.offering.NetworkOffering;
 import com.cloud.offerings.NetworkOfferingVO;
 import com.cloud.offerings.dao.NetworkOfferingDao;
+import com.cloud.storage.dao.VMTemplateDao;
 import com.cloud.user.Account;
 import com.cloud.user.AccountManager;
 import com.cloud.utils.component.AdapterBase;
@@ -117,8 +111,12 @@
 import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.VirtualMachine.State;
 import com.cloud.vm.VirtualMachineProfile;
+import com.cloud.vm.VirtualMachineProfileImpl;
+import com.cloud.vm.VmDetailConstants;
 import com.cloud.vm.dao.DomainRouterDao;
+import com.cloud.vm.dao.NicDao;
 import com.cloud.vm.dao.UserVmDao;
+import com.google.gson.Gson;
 
 public class VirtualRouterElement extends AdapterBase implements VirtualRouterElementService, DhcpServiceProvider, UserDataServiceProvider, SourceNatServiceProvider,
 StaticNatServiceProvider, FirewallServiceProvider, LoadBalancingServiceProvider, PortForwardingServiceProvider, RemoteAccessVPNServiceProvider, IpDeployer,
@@ -212,6 +210,10 @@ protected boolean canHandle(final Network network, final Service service) {
         return true;
     }
 
+    protected boolean canHandle(final Vpc vpc, final Service service) {
+        return false;
+    }
+
     @Override
     public boolean implement(final Network network, final NetworkOffering offering, final DeployDestination dest, final ReservationContext context)
             throws ResourceUnavailableException, ConcurrentOperationException, InsufficientCapacityException {
@@ -281,7 +283,7 @@ public boolean applyFWRules(final Network network, final List<? extends Firewall
         if (canHandle(network, Service.Firewall)) {
             final List<DomainRouterVO> routers = getRouters(network);
             if (routers == null || routers.isEmpty()) {
-                logger.debug("Virtual router element doesn't need to apply firewall rules on the backend; virtual router doesn't exist in the network {}", network);
+                logger.debug("Virtual router element doesn't need to apply firewall rules on the backend; virtual router doesn't exist in the network {}");
                 return true;
             }
 
@@ -304,6 +306,7 @@ public boolean applyFWRules(final Network network, final List<? extends Firewall
         return result;
     }
 
+
     @Override
     public boolean validateLBRule(final Network network, final LoadBalancingRule rule) {
         final List<LoadBalancingRule> rules = new ArrayList<LoadBalancingRule>();
@@ -738,7 +741,7 @@ public boolean savePassword(final Network network, final NicProfile nic, final V
 
         _userVmDao.loadDetails(userVmVO);
         userVmVO.setDetail(VmDetailConstants.PASSWORD, password_encrypted);
-        _userVmDao.saveDetails(userVmVO);
+        _userVmDao.saveDetails(userVmVO, List.of(VmDetailConstants.PASSWORD));
 
         userVmVO.setUpdateParameters(true);
         _userVmDao.update(userVmVO.getId(), userVmVO);
diff --git a/server/src/main/java/com/cloud/network/element/VpcVirtualRouterElement.java b/server/src/main/java/com/cloud/network/element/VpcVirtualRouterElement.java
index f393ef8a129d..99f8d8f697b2 100644
--- a/server/src/main/java/com/cloud/network/element/VpcVirtualRouterElement.java
+++ b/server/src/main/java/com/cloud/network/element/VpcVirtualRouterElement.java
@@ -52,6 +52,7 @@
 import com.cloud.network.router.VirtualRouter.Role;
 import com.cloud.network.router.VpcNetworkHelperImpl;
 import com.cloud.network.router.VpcVirtualNetworkApplianceManager;
+import com.cloud.network.rules.FirewallRule;
 import com.cloud.network.vpc.NetworkACLItem;
 import com.cloud.network.vpc.NetworkACLItemDao;
 import com.cloud.network.vpc.NetworkACLItemVO;
@@ -148,6 +149,49 @@ protected boolean canHandle(final Network network, final Service service) {
         return true;
     }
 
+    @Override
+    protected boolean canHandle(final Vpc vpc, final Service service) {
+        if (vpc == null) {
+            return false;
+        }
+
+        if (!_networkMdl.isProviderEnabledInZone(vpc.getZoneId(), Network.Provider.VPCVirtualRouter.getName())) {
+            return false;
+        }
+
+        if (service != null && !_vpcMgr.isProviderSupportServiceInVpc(vpc.getId(), service, getProvider())) {
+            logger.trace("Element " + getProvider().getName() + " doesn't support service " + service.getName() + " in the vpc " + vpc);
+            return false;
+        }
+
+        return true;
+    }
+
+    @Override
+    public boolean applyFWRulesInVPC(final Vpc vpc, final List<? extends FirewallRule> rules) throws ResourceUnavailableException {
+        boolean result = true;
+        if (canHandle(vpc, Service.Firewall)) {
+            final List<DomainRouterVO> routers = _routerDao.listByVpcId(vpc.getId());
+            if (CollectionUtils.isEmpty(routers)) {
+                logger.debug("Virtual router element doesn't need to apply firewall rules on the backend; virtual router doesn't exist in the vpc");
+                return true;
+            }
+
+            Network network = null;
+            if (CollectionUtils.isNotEmpty(rules) && rules.get(0).getNetworkId() != null) {
+                network = _networkModel.getNetwork(rules.get(0).getNetworkId());
+            }
+
+            final DataCenterVO dcVO = _dcDao.findById(vpc.getZoneId());
+            final NetworkTopology networkTopology = networkTopologyContext.retrieveNetworkTopology(dcVO);
+
+            for (final DomainRouterVO domainRouterVO : routers) {
+                result = result && networkTopology.applyFirewallRulesInVPC(vpc, rules, domainRouterVO);
+            }
+        }
+        return result;
+    }
+
     @Override
     public boolean implementVpc(final Vpc vpc, final DeployDestination dest, final ReservationContext context) throws ConcurrentOperationException, ResourceUnavailableException,
     InsufficientCapacityException {
@@ -412,10 +456,6 @@ private static Map<Service, Map<Capability, String>> setCapabilities() {
         vpnCapabilities.putAll(capabilities.get(Service.Vpn));
         vpnCapabilities.put(Capability.VpnTypes, "s2svpn");
         capabilities.put(Service.Vpn, vpnCapabilities);
-
-        // remove firewall capability
-        capabilities.remove(Service.Firewall);
-
         // add network ACL capability
         final Map<Capability, String> networkACLCapabilities = new HashMap<Capability, String>();
         networkACLCapabilities.put(Capability.SupportedProtocols, "tcp,udp,icmp");
diff --git a/server/src/main/java/com/cloud/network/firewall/FirewallManagerImpl.java b/server/src/main/java/com/cloud/network/firewall/FirewallManagerImpl.java
index 3ad826e8977d..dc6fc12a6110 100644
--- a/server/src/main/java/com/cloud/network/firewall/FirewallManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/firewall/FirewallManagerImpl.java
@@ -69,9 +69,11 @@
 import com.cloud.network.dao.IPAddressDao;
 import com.cloud.network.dao.IPAddressVO;
 import com.cloud.network.dao.NetworkDao;
+import com.cloud.network.dao.NetworkServiceMapDao;
 import com.cloud.network.dao.NetworkVO;
 import com.cloud.network.element.FirewallServiceProvider;
 import com.cloud.network.element.NetworkACLServiceProvider;
+import com.cloud.network.element.NetworkElement;
 import com.cloud.network.element.PortForwardingServiceProvider;
 import com.cloud.network.element.StaticNatServiceProvider;
 import com.cloud.network.rules.FirewallManager;
@@ -150,6 +152,9 @@ public class FirewallManagerImpl extends ManagerBase implements FirewallService,
     EntityManager entityManager;
     @Inject
     NsxProviderDao nsxProviderDao;
+    @Inject
+    NetworkServiceMapDao networkServiceMapDao;
+
     List<FirewallServiceProvider> _firewallElements;
 
     List<PortForwardingServiceProvider> _pfElements;
@@ -198,25 +203,67 @@ public FirewallRule createEgressFirewallRule(FirewallRule rule) throws NetworkRu
         if (sourceCidrs != null && !sourceCidrs.isEmpty())
         Collections.replaceAll(sourceCidrs, "0.0.0.0/0", network.getCidr());
 
-        return createFirewallRule(null, caller, rule.getXid(), rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getProtocol(), sourceCidrs, rule.getDestinationCidrList(),
-                rule.getIcmpCode(), rule.getIcmpType(), null, rule.getType(), rule.getNetworkId(), rule.getTrafficType(), rule.isDisplay());
+        return createFirewallRuleForNonVPC(null, caller, rule.getXid(), rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getProtocol(), sourceCidrs,
+                rule.getDestinationCidrList(), rule.getIcmpCode(), rule.getIcmpType(), null, rule.getType(), rule.getNetworkId(), rule.getTrafficType(), rule.isDisplay());
     }
 
     @Override
     @ActionEvent(eventType = EventTypes.EVENT_FIREWALL_OPEN, eventDescription = "creating firewall rule", create = true)
     public FirewallRule createIngressFirewallRule(FirewallRule rule) throws NetworkRuleConflictException {
-         Account caller = CallContext.current().getCallingAccount();
+        Account caller = CallContext.current().getCallingAccount();
         Long sourceIpAddressId = rule.getSourceIpAddressId();
+        IPAddressVO sourceIp = getSourceIpForIngressRule(sourceIpAddressId);
+
+        if (sourceIp.getVpcId() != null) {
+            return createIngressFirewallRuleForVpcIp(rule, caller, sourceIp);
+        }
+        return createIngressFirewallRuleForIsolatedIp(rule, caller, sourceIp);
+    }
+
+    protected IPAddressVO getSourceIpForIngressRule(Long sourceIpAddressId) {
+        if (sourceIpAddressId == null) {
+            return null;
+        }
+        IPAddressVO sourceIp = _ipAddressDao.findById(sourceIpAddressId);
+        if (sourceIp == null) {
+            throw new CloudRuntimeException("Unable to find IP address by id=" + sourceIpAddressId);
+        }
+
+        return sourceIp;
+    }
 
-        return createFirewallRule(sourceIpAddressId, caller, rule.getXid(), rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getProtocol(),
-            rule.getSourceCidrList(), null, rule.getIcmpCode(), rule.getIcmpType(), null, rule.getType(), rule.getNetworkId(), rule.getTrafficType(), rule.isDisplay());
+    protected FirewallRule createIngressFirewallRuleForIsolatedIp(FirewallRule rule, Account caller, IPAddressVO sourceIp)
+            throws NetworkRuleConflictException {
+        return createFirewallRuleForNonVPC(rule.getSourceIpAddressId(), caller, rule.getXid(), rule.getSourcePortStart(), rule.getSourcePortEnd(),
+                rule.getProtocol(), rule.getSourceCidrList(), null, rule.getIcmpCode(), rule.getIcmpType(), null, rule.getType(),
+                rule.getNetworkId(), rule.getTrafficType(), rule.isDisplay());
+    }
+
+    protected FirewallRule createIngressFirewallRuleForVpcIp(FirewallRule rule, Account caller, IPAddressVO sourceIp)
+            throws NetworkRuleConflictException {
+        Long vpcId = sourceIp != null ? sourceIp.getVpcId() : null;
+        return createFirewallRuleForVpc(rule.getSourceIpAddressId(), caller, rule.getXid(), rule.getSourcePortStart(), rule.getSourcePortEnd(),
+                rule.getProtocol(), rule.getSourceCidrList(), null, rule.getIcmpCode(), rule.getIcmpType(), null, rule.getType(),
+                vpcId, rule.getTrafficType(), rule.isDisplay());
     }
 
     //Destination CIDR capability is currently implemented for egress rules only. For others, the field is passed as null.
     @DB
     protected FirewallRule createFirewallRule(final Long ipAddrId, Account caller, final String xId, final Integer portStart, final Integer portEnd, final String protocol,
                                               final List<String> sourceCidrList, final List<String> destCidrList, final Integer icmpCode, final Integer icmpType, final Long relatedRuleId,
-                                              final FirewallRule.FirewallRuleType type, final Long networkId, final FirewallRule.TrafficType trafficType, final Boolean forDisplay) throws NetworkRuleConflictException {
+                                              final FirewallRule.FirewallRuleType type, final Long networkId, final Long vpcId, final FirewallRule.TrafficType trafficType, final Boolean forDisplay) throws NetworkRuleConflictException {
+        if (vpcId != null) {
+            return createFirewallRuleForVpc(ipAddrId, caller, xId, portStart, portEnd, protocol, sourceCidrList, destCidrList, icmpCode, icmpType, relatedRuleId,
+                    type, vpcId, trafficType, forDisplay);
+        }
+        return createFirewallRuleForNonVPC(ipAddrId, caller, xId, portStart, portEnd, protocol, sourceCidrList, destCidrList, icmpCode, icmpType, relatedRuleId,
+                type, networkId, trafficType, forDisplay);
+    }
+
+    @DB
+    protected FirewallRule createFirewallRuleForNonVPC(final Long ipAddrId, Account caller, final String xId, final Integer portStart, final Integer portEnd, final String protocol,
+                                                       final List<String> sourceCidrList, final List<String> destCidrList, final Integer icmpCode, final Integer icmpType, final Long relatedRuleId,
+                                                       final FirewallRule.FirewallRuleType type, final Long networkId, final FirewallRule.TrafficType trafficType, final Boolean forDisplay) throws NetworkRuleConflictException {
         IPAddressVO ipAddress = null;
         try {
             // Validate ip address
@@ -283,6 +330,161 @@ protected FirewallRule createFirewallRule(final Long ipAddrId, Account caller, f
         }
     }
 
+    @DB
+    protected FirewallRule createFirewallRuleForVpc(final Long ipAddrId, Account caller, final String xId, final Integer portStart, final Integer portEnd, final String protocol,
+                                                    final List<String> sourceCidrList, final List<String> destCidrList, final Integer icmpCode, final Integer icmpType,
+                                                    final Long relatedRuleId, final FirewallRuleType type, final Long vpcId,
+                                                    final FirewallRule.TrafficType trafficType, final Boolean forDisplay) throws NetworkRuleConflictException {
+        IPAddressVO ipAddress = null;
+        try {
+            Long resolvedVpcId = vpcId;
+            if (ipAddrId != null) {
+                ipAddress = _ipAddressDao.acquireInLockTable(ipAddrId);
+                if (ipAddress == null) {
+                    throw new InvalidParameterValueException("Unable to create firewall rule; " + "couldn't locate IP address by id in the system");
+                }
+                resolvedVpcId = resolvedVpcId != null ? resolvedVpcId : ipAddress.getVpcId();
+            }
+
+            if (resolvedVpcId == null) {
+                throw new InvalidParameterValueException("Unable to create VPC firewall rule; couldn't locate VPC id");
+            }
+
+            validateFirewallRuleForVpc(caller, ipAddress, portStart, portEnd, protocol, Purpose.Firewall, type, resolvedVpcId, trafficType);
+
+            if (!protocol.equalsIgnoreCase(NetUtils.ICMP_PROTO) && (icmpCode != null || icmpType != null)) {
+                throw new InvalidParameterValueException("Can specify icmpCode and icmpType for ICMP protocol only");
+            }
+
+            if (protocol.equalsIgnoreCase(NetUtils.ICMP_PROTO) && (portStart != null || portEnd != null)) {
+                throw new InvalidParameterValueException("Can't specify start/end port when protocol is ICMP");
+            }
+
+            Long accountId = null;
+            Long domainId = null;
+
+            if (ipAddress != null) {
+                accountId = ipAddress.getAllocatedToAccountId();
+                domainId = ipAddress.getAllocatedInDomainId();
+            } else {
+                Vpc vpc = _vpcMgr.getActiveVpc(resolvedVpcId);
+                if (vpc == null) {
+                    throw new InvalidParameterValueException("Unable to create VPC firewall rule; couldn't locate VPC by id=" + resolvedVpcId);
+                }
+                accountId = vpc.getAccountId();
+                domainId = vpc.getDomainId();
+            }
+
+            final Long accountIdFinal = accountId;
+            final Long domainIdFinal = domainId;
+            final Long resolvedNetworkIdFinal = null;
+            final Long resolvedVpcIdFinal = resolvedVpcId;
+            return Transaction.execute((TransactionCallbackWithException<FirewallRuleVO, NetworkRuleConflictException>) status -> {
+                FirewallRuleVO newRule = new FirewallRuleVO(xId, ipAddrId, portStart, portEnd, protocol.toLowerCase(), resolvedNetworkIdFinal, accountIdFinal, domainIdFinal, Purpose.Firewall,
+                        sourceCidrList, destCidrList, icmpCode, icmpType, relatedRuleId, trafficType);
+                newRule.setVpcId(resolvedVpcIdFinal);
+                newRule.setType(type);
+                if (forDisplay != null) {
+                    newRule.setDisplay(forDisplay);
+                }
+                newRule = _firewallDao.persist(newRule);
+
+                if (type == FirewallRuleType.User)
+                    detectRulesConflict(newRule);
+
+                if (!_firewallDao.setStateToAdd(newRule)) {
+                    throw new CloudRuntimeException("Unable to update the state to add for " + newRule);
+                }
+                CallContext.current().setEventDetails("Rule ID: " + newRule.getUuid());
+                CallContext.current().putContextParameter(FirewallRule.class, newRule.getId());
+
+                return newRule;
+            });
+        } finally {
+            if (ipAddrId != null) {
+                _ipAddressDao.releaseFromLockTable(ipAddrId);
+            }
+        }
+    }
+
+    protected void validateFirewallRuleForVpc(Account caller, IPAddressVO ipAddress, Integer portStart, Integer portEnd, String proto, Purpose purpose,
+                                              FirewallRuleType type, Long vpcId, FirewallRule.TrafficType trafficType) {
+        if (portStart != null && !NetUtils.isValidPort(portStart)) {
+            throw new InvalidParameterValueException("publicPort is an invalid value: " + portStart);
+        }
+        if (portEnd != null && !NetUtils.isValidPort(portEnd)) {
+            throw new InvalidParameterValueException("Public port range is an invalid value: " + portEnd);
+        }
+        if (portStart != null && portEnd != null && portStart > portEnd) {
+            throw new InvalidParameterValueException("Start port can't be bigger than end port");
+        }
+
+        if (ipAddress == null && type == FirewallRuleType.System) {
+            return;
+        }
+
+        if (vpcId == null) {
+            throw new InvalidParameterValueException("Unable to retrieve VPC id to validate the rule");
+        }
+
+        if (ipAddress != null) {
+            _accountMgr.checkAccess(caller, null, true, ipAddress);
+        }
+
+        Vpc vpc = _vpcMgr.getActiveVpc(vpcId);
+        if (vpc == null) {
+            throw new InvalidParameterValueException("Unable to retrieve VPC to validate the rule by id=" + vpcId);
+        }
+
+        Map<Network.Capability, String> caps = null;
+        if (purpose == Purpose.Firewall) {
+            caps = getFirewallServiceCapabilitiesForVpc(vpcId);
+            if (caps == null) {
+                throw new InvalidParameterValueException("Firewall service is not supported in VPC " + vpc);
+            }
+        }
+
+        if (caps != null) {
+            String supportedTrafficTypes = null;
+            if (purpose == FirewallRule.Purpose.Firewall) {
+                supportedTrafficTypes = caps.get(Capability.SupportedTrafficDirection).toLowerCase();
+            }
+
+            String supportedProtocols;
+            if (purpose == FirewallRule.Purpose.Firewall && trafficType == FirewallRule.TrafficType.Egress) {
+                supportedProtocols = caps.get(Capability.SupportedEgressProtocols).toLowerCase();
+            } else {
+                supportedProtocols = caps.get(Capability.SupportedProtocols).toLowerCase();
+            }
+
+            if (!supportedProtocols.contains(proto.toLowerCase())) {
+                throw new InvalidParameterValueException("Protocol " + proto + " is not supported in VPC " + vpcId);
+            } else if (proto.equalsIgnoreCase(NetUtils.ICMP_PROTO) && purpose != Purpose.Firewall) {
+                throw new InvalidParameterValueException("Protocol " + proto + " is currently supported only for rules with purpose " + Purpose.Firewall);
+            } else if (purpose == Purpose.Firewall && !supportedTrafficTypes.contains(trafficType.toString().toLowerCase())) {
+                throw new InvalidParameterValueException(String.format("Traffic Type %s is currently supported by Firewall in VPC %s", trafficType, vpc.getUuid()));
+            }
+        }
+    }
+
+    protected Map<Network.Capability, String> getFirewallServiceCapabilitiesForVpc(Long vpcId) {
+        for (FirewallServiceProvider fwElement : _firewallElements) {
+            Network.Provider provider = fwElement.getProvider();
+            if (_vpcMgr.isProviderSupportServiceInVpc(vpcId, Service.Firewall, provider)) {
+                Map<Service, Map<Capability, String>> capabilities = fwElement.getCapabilities();
+                if (capabilities != null && capabilities.get(Service.Firewall) != null) {
+                    return capabilities.get(Service.Firewall);
+                }
+            }
+        }
+        return null;
+    }
+
+    protected Long resolveIsolatedFirewallRuleNetworkId(IPAddressVO ipAddress, Long networkId) {
+        _networkModel.checkIpForService(ipAddress, Service.Firewall, networkId);
+        return ipAddress.getAssociatedWithNetworkId();
+    }
+
     @Override
     public Pair<List<? extends FirewallRule>, Integer> listFirewallRules(IListFirewallRulesCmd cmd) {
         Long ipId = cmd.getIpAddressId();
@@ -399,9 +601,16 @@ public void detectRulesConflict(FirewallRule newRule) throws NetworkRuleConflict
             assert (rules.size() >= 1);
         }
 
-        NetworkVO newRuleNetwork = getNewRuleNetwork(newRule);
-        boolean newRuleIsOnVpcNetwork = newRuleNetwork.getVpcId() != null;
-        boolean vpcConserveModeEnabled = _vpcMgr.isNetworkOnVpcEnabledConserveMode(newRuleNetwork);
+        Long newRuleVpcId = newRule.getVpcId();
+        boolean newRuleIsVpc = newRuleVpcId != null;
+        NetworkVO newRuleNetwork = null;
+        boolean newRuleIsOnVpcNetwork = false;
+        boolean vpcConserveModeEnabled = false;
+        if (!newRuleIsVpc) {
+            newRuleNetwork = getNewRuleNetwork(newRule);
+            newRuleIsOnVpcNetwork = newRuleNetwork.getVpcId() != null;
+            vpcConserveModeEnabled = newRuleIsOnVpcNetwork && _vpcMgr.isNetworkOnVpcEnabledConserveMode(newRuleNetwork);
+        }
 
         for (FirewallRuleVO rule : rules) {
             if (rule.getId() == newRule.getId()) {
@@ -452,8 +661,8 @@ public void detectRulesConflict(FirewallRule newRule) throws NetworkRuleConflict
 
             // Checking if the rule applied is to the same network that is passed in the rule.
             // (except for VPCs with conserve mode = true)
-            if ((!newRuleIsOnVpcNetwork || !vpcConserveModeEnabled)
-                    && rule.getNetworkId() != newRule.getNetworkId() && rule.getState() != State.Revoke) {
+            if (!newRuleIsVpc && (!newRuleIsOnVpcNetwork || !vpcConserveModeEnabled)
+                    && !Objects.equals(rule.getNetworkId(), newRule.getNetworkId()) && rule.getState() != State.Revoke) {
                 String errMsg = String.format("New rule is for a different network than what's specified in rule %s", rule.getXid());
                 if (newRuleIsOnVpcNetwork) {
                     Vpc vpc = _vpcMgr.getActiveVpc(newRuleNetwork.getVpcId());
@@ -575,11 +784,9 @@ public void validateFirewallRule(Account caller, IPAddressVO ipAddress, Integer
         }
 
         if (ipAddress != null) {
-            if (ipAddress.getAssociatedWithNetworkId() == null) {
-                    throw new InvalidParameterValueException("Unable to create firewall rule ; ip with specified id is not associated with any network");
-            } else {
-                networkId = ipAddress.getAssociatedWithNetworkId();
-            }
+            networkId = isVpcIpAddress(ipAddress)
+                    ? validateFirewallRuleForVpcIp(ipAddress, networkId)
+                    : validateFirewallRuleForIsolatedIp(ipAddress);
 
             // Validate ip address
             _accountMgr.checkAccess(caller, null, true, ipAddress);
@@ -610,20 +817,33 @@ public void validateFirewallRule(Account caller, IPAddressVO ipAddress, Integer
             if (routedIpv4Manager.isVirtualRouterGateway(network)) {
                 throw new CloudRuntimeException("Unable to create routing firewall rule. Please use routing firewall API instead.");
             }
-            caps = _networkModel.getNetworkServiceCapabilities(network.getId(), Service.Firewall);
+            caps = getFirewallServiceCapabilities(network);
         }
 
         if (caps != null) {
             String supportedProtocols;
             String supportedTrafficTypes = null;
             if (purpose == FirewallRule.Purpose.Firewall) {
-                supportedTrafficTypes = caps.get(Capability.SupportedTrafficDirection).toLowerCase();
+                String supportedTrafficTypesStr = caps.get(Capability.SupportedTrafficDirection);
+                if (supportedTrafficTypesStr == null) {
+                    throw new CloudRuntimeException("Supported traffic direction capability is not defined for Firewall service");
+                }
+                supportedTrafficTypes = supportedTrafficTypesStr.toLowerCase();
             }
 
             if (purpose == FirewallRule.Purpose.Firewall && trafficType == FirewallRule.TrafficType.Egress) {
-                supportedProtocols = caps.get(Capability.SupportedEgressProtocols).toLowerCase();
+                // throw an exception if cap is not found
+                String supportedProtocolsStr = caps.get(Capability.SupportedEgressProtocols);
+                if (supportedProtocolsStr == null) {
+                    throw new CloudRuntimeException("Supported egress protocols capability is not defined for Firewall service");
+                }
+                supportedProtocols = supportedProtocolsStr.toLowerCase();
             } else {
-                supportedProtocols = caps.get(Capability.SupportedProtocols).toLowerCase();
+                String supportedProtocolsStr = caps.get(Capability.SupportedProtocols);
+                if (supportedProtocolsStr == null) {
+                    throw new CloudRuntimeException("Supported protocols capability is not defined for " + purpose + " service");
+                }
+                supportedProtocols = supportedProtocolsStr.toLowerCase();
             }
 
             if (!supportedProtocols.contains(proto.toLowerCase())) {
@@ -637,6 +857,41 @@ public void validateFirewallRule(Account caller, IPAddressVO ipAddress, Integer
 
     }
 
+    protected boolean isVpcIpAddress(IPAddressVO ipAddress) {
+        return ipAddress.getVpcId() != null;
+    }
+
+    protected Long validateFirewallRuleForIsolatedIp(IPAddressVO ipAddress) {
+        if (ipAddress.getAssociatedWithNetworkId() == null) {
+            throw new InvalidParameterValueException("Unable to create firewall rule ; ip with specified id is not associated with any network");
+        }
+        return ipAddress.getAssociatedWithNetworkId();
+    }
+
+    protected Long validateFirewallRuleForVpcIp(IPAddressVO ipAddress, Long networkId) {
+        if (networkId == null) {
+            throw new InvalidParameterValueException("Unable to retrieve network id to validate the rule");
+        }
+        return networkId;
+    }
+
+    protected Map<Network.Capability, String> getFirewallServiceCapabilities(Network network) {
+        if (network.getVpcId() == null) {
+            return _networkModel.getNetworkServiceCapabilities(network.getId(), Service.Firewall);
+        }
+
+        for (FirewallServiceProvider fwElement : _firewallElements) {
+            Network.Provider provider = fwElement.getProvider();
+            if (_vpcMgr.isProviderSupportServiceInVpc(network.getVpcId(), Service.Firewall, provider)) {
+                Map<Service, Map<Capability, String>> capabilities = fwElement.getCapabilities();
+                if (capabilities != null && capabilities.get(Service.Firewall) != null) {
+                    return capabilities.get(Service.Firewall);
+                }
+            }
+        }
+        return _networkModel.getNetworkServiceCapabilities(network.getId(), Service.Firewall);
+    }
+
     @Override
     public boolean applyRules(List<? extends FirewallRule> rules, boolean continueOnError, boolean updateRulesInDB) throws ResourceUnavailableException {
         boolean success = true;
@@ -665,7 +920,7 @@ public boolean applyRules(List<? extends FirewallRule> rules, boolean continueOn
                             success = false;
                         } else {
                             removeRule(rule);
-                            if (rule.getSourceIpAddressId() != null) {
+                            if (rule.getSourceIpAddressId() != null && rule.getVpcId() == null) {
                                 //if the rule is the last one for the ip address assigned to VPC, unassign it from the network
                                 _vpcMgr.unassignIPFromVpcNetwork(rule.getSourceIpAddressId(), rule.getNetworkId());
                             }
@@ -683,7 +938,7 @@ public boolean applyRules(List<? extends FirewallRule> rules, boolean continueOn
     }
 
     @Override
-    public boolean applyRules(Network network, Purpose purpose, List<? extends FirewallRule> rules) throws ResourceUnavailableException {
+    public boolean applyRules(Network network, Vpc vpc, Purpose purpose, List<? extends FirewallRule> rules) throws ResourceUnavailableException {
         boolean handled = false;
         switch (purpose) {
         /* StaticNatRule would be applied by Firewall provider, since the incompatible of two object */
@@ -692,26 +947,61 @@ public boolean applyRules(Network network, Purpose purpose, List<? extends Firew
         case Ipv6Firewall:
             for (FirewallServiceProvider fwElement : _firewallElements) {
                 Network.Provider provider = fwElement.getProvider();
-                boolean  isFwProvider = _networkModel.isProviderSupportServiceInNetwork(network.getId(), Service.Firewall, provider);
+                boolean isFwProvider;
+                Long effectiveVpcId = null;
+                if (vpc != null) {
+                    effectiveVpcId = vpc.getId();
+                } else if (network != null) {
+                    effectiveVpcId = network.getVpcId();
+                }
+                if (effectiveVpcId != null) {
+                    isFwProvider = _vpcMgr.isProviderSupportServiceInVpc(effectiveVpcId, Service.Firewall, provider);
+                } else {
+                    isFwProvider = _networkModel.isProviderSupportServiceInNetwork(network.getId(), Service.Firewall, provider);
+                }
                 if (!isFwProvider) {
                     continue;
                 }
-                handled = fwElement.applyFWRules(network, rules);
+                if (vpc != null) {
+                    handled = fwElement.applyFWRulesInVPC(vpc, rules);
+                } else {
+                    handled = fwElement.applyFWRules(network, rules);
+                }
                 if (handled)
                     break;
             }
+            if (!handled) {
+                // Get provider name and get the element by provider name (it could be an external provider)
+                String fwProviderName = networkServiceMapDao.getProviderForServiceInNetwork(network.getId(), Service.Firewall);
+                if (fwProviderName != null) {
+                    NetworkElement element = _networkModel.getElementImplementingProvider(fwProviderName);
+                    if (element instanceof FirewallServiceProvider) {
+                        handled = ((FirewallServiceProvider) element).applyFWRules(network, rules);
+                    }
+                }
+            }
             break;
         case PortForwarding:
-                for (PortForwardingServiceProvider element : _pfElements) {
+            for (PortForwardingServiceProvider element : _pfElements) {
                 Network.Provider provider = element.getProvider();
                 boolean  isPfProvider = _networkModel.isProviderSupportServiceInNetwork(network.getId(), Service.PortForwarding, provider);
                 if (!isPfProvider) {
                     continue;
                 }
-                    handled = element.applyPFRules(network, (List<PortForwardingRule>)rules);
+                handled = element.applyPFRules(network, (List<PortForwardingRule>)rules);
                 if (handled)
                     break;
             }
+            if (!handled) {
+                // Get provider name and get the element by provider name (it could be an external provider)
+                String pfProviderName = networkServiceMapDao.getProviderForServiceInNetwork(network.getId(), Service.PortForwarding);
+                if (pfProviderName != null) {
+                    NetworkElement element = _networkModel.getElementImplementingProvider(pfProviderName);
+                    if (element instanceof PortForwardingServiceProvider) {
+                        handled = ((PortForwardingServiceProvider) element).applyPFRules(network, (List<PortForwardingRule>) rules);
+                    }
+                }
+            }
             break;
             /*        case NetworkACL:
             for (NetworkACLServiceProvider element: _networkAclElements) {
@@ -726,13 +1016,18 @@ public boolean applyRules(Network network, Purpose purpose, List<? extends Firew
             }
             break;*/
         default:
-                assert (false) : "Unexpected fall through in applying rules to the network elements";
+            assert (false) : "Unexpected fall through in applying rules to the network elements";
             logger.error("FirewallManager cannot process rules of type " + purpose);
             throw new CloudRuntimeException("FirewallManager cannot process rules of type " + purpose);
         }
         return handled;
     }
 
+    @Override
+    public boolean applyRules(Network network, Purpose purpose, List<? extends FirewallRule> rules) throws ResourceUnavailableException {
+        return applyRules(network, null, purpose, rules);
+    }
+
     @Override
     public void removeRule(FirewallRule rule) {
 
@@ -779,8 +1074,10 @@ public boolean applyFirewallRules(List<FirewallRuleVO> rules, boolean continueOn
 
         for (FirewallRuleVO rule : rules) {
             // validate rule - for NSX
-            long networkId = rule.getNetworkId();
-            validateNsxConstraints(networkId, rule);
+            Long networkId = rule.getNetworkId();
+            if (networkId != null) {
+                validateNsxConstraints(networkId, rule);
+            }
             // load cidrs if any
             rule.setSourceCidrList(_firewallCidrsDao.getSourceCidrs(rule.getId()));
             rule.setDestinationCidrsList(_firewallDcidrsDao.getDestCidrs(rule.getId()));
@@ -1040,7 +1337,7 @@ public FirewallRule createRuleForAllCidrs(long ipAddrId, Account caller, Integer
         List<String> oneCidr = new ArrayList<String>();
         oneCidr.add(NetUtils.ALL_IP4_CIDRS);
         return createFirewallRule(ipAddrId, caller, null, startPort, endPort, protocol, oneCidr, null, icmpCode, icmpType, relatedRuleId, FirewallRule.FirewallRuleType.User,
-            networkId, FirewallRule.TrafficType.Ingress, true);
+            networkId, null, FirewallRule.TrafficType.Ingress, true);
     }
 
     @Override
@@ -1155,7 +1452,7 @@ public boolean addSystemFirewallRules(IPAddressVO ip, Account acct) {
                     _firewallDao.loadSourceCidrs(rule);
                 }
                 createFirewallRule(ip.getId(), acct, rule.getXid(), rule.getSourcePortStart(), rule.getSourcePortEnd(), rule.getProtocol(), rule.getSourceCidrList(),null,
-                        rule.getIcmpCode(), rule.getIcmpType(), rule.getRelated(), FirewallRuleType.System, rule.getNetworkId(), rule.getTrafficType(), true);
+                        rule.getIcmpCode(), rule.getIcmpType(), rule.getRelated(), FirewallRuleType.System, rule.getNetworkId(), rule.getVpcId(), rule.getTrafficType(), true);
             } catch (Exception e) {
                 logger.debug("Failed to add system wide firewall rule, due to:" + e.toString());
             }
diff --git a/server/src/main/java/com/cloud/network/guru/NetworkExtensionGuestNetworkGuru.java b/server/src/main/java/com/cloud/network/guru/NetworkExtensionGuestNetworkGuru.java
new file mode 100644
index 000000000000..112db7f44c8e
--- /dev/null
+++ b/server/src/main/java/com/cloud/network/guru/NetworkExtensionGuestNetworkGuru.java
@@ -0,0 +1,162 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.network.guru;
+
+import java.util.List;
+
+import javax.inject.Inject;
+
+import com.cloud.dc.DataCenter;
+import com.cloud.deploy.DeployDestination;
+import com.cloud.deploy.DeploymentPlan;
+import com.cloud.exception.InsufficientAddressCapacityException;
+import com.cloud.exception.InsufficientVirtualNetworkCapacityException;
+import com.cloud.network.Network;
+import com.cloud.network.Network.GuestType;
+import com.cloud.network.Network.State;
+import com.cloud.network.PhysicalNetwork;
+import com.cloud.network.dao.NetworkVO;
+import com.cloud.offering.NetworkOffering;
+import com.cloud.user.Account;
+import com.cloud.vm.NicProfile;
+import com.cloud.vm.ReservationContext;
+import com.cloud.vm.VirtualMachineProfile;
+
+import org.apache.cloudstack.extension.ExtensionHelper;
+
+import org.apache.commons.collections.CollectionUtils;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
+
+/**
+ * Guest network guru for extension-backed providers on physical networks whose
+ * isolation method is set to "Extension".
+ *
+ * <p>For <b>isolated</b> networks the allocation path is identical to
+ * {@link GuestNetworkGuru}: a virtual CIDR is managed internally and IPs are
+ * taken from that pool.</p>
+ *
+ * <p>For <b>shared</b> networks (upstream router as gateway) the
+ * allocation is delegated entirely to {@link DirectNetworkGuru}</p>
+ */
+public class NetworkExtensionGuestNetworkGuru extends GuestNetworkGuru {
+
+    @Inject
+    protected ExtensionHelper extensionHelper;
+
+    @Autowired
+    @Qualifier("DirectNetworkGuru")
+    protected DirectNetworkGuru directNetworkGuru;
+
+    @Override
+    protected boolean canHandle(NetworkOffering offering, DataCenter.NetworkType networkType, PhysicalNetwork physicalNetwork) {
+        List<String> providers = networkOfferingServiceMapDao.getDistinctProviders(offering.getId());
+        if (CollectionUtils.isEmpty(providers)) {
+            return false;
+        }
+
+        return providers.stream().anyMatch(providerName ->
+                extensionHelper.isNetworkExtensionProvider(providerName)
+                        && physicalNetwork != null
+                        && extensionHelper.usesNetworkExtensionIsolation(providerName));
+    }
+
+    /**
+     * Designs the network and ensures the state is {@code Allocated}, never {@code Setup}.
+     *
+     * <p>{@link GuestNetworkGuru#design} sets the state to {@code Setup} when
+     * {@code offering.isSpecifyVlan() && !offering.isPersistent()}, which means the
+     * parent considers the physical network already in place and skips
+     * {@code element.implement()} later.
+     * For NetworkExtension-based networks Resetting the state to
+     * {@code Allocated} here guarantees {@code implement-network} is always called.</p>
+     */
+    @Override
+    public Network design(final NetworkOffering offering, final DeploymentPlan plan,
+                          final Network userSpecified, final String name,
+                          final Long vpcId, final Account owner) {
+        final Network network = super.design(offering, plan, userSpecified, name, vpcId, owner);
+        if (network == null) {
+            return null;
+        }
+        if (network instanceof NetworkVO && network.getState() == State.Setup) {
+            NetworkVO networkVO = (NetworkVO) network;
+            networkVO.setState(State.Allocated);
+            return networkVO;
+        }
+        return network;
+    }
+
+    @Override
+    public Network implement(final Network network, final NetworkOffering offering, final DeployDestination dest, final ReservationContext context)
+            throws InsufficientVirtualNetworkCapacityException {
+        assert network.getState() == Network.State.Implementing : "Why are we implementing " + network;
+
+        final long dcId = dest.getDataCenter().getId();
+
+        // physical network id can be null in Guest Network in Basic zone
+        Long physicalNetworkId = network.getPhysicalNetworkId();
+        if (physicalNetworkId == null) {
+            physicalNetworkId = _networkModel.findPhysicalNetworkId(dcId, offering.getTags(), offering.getTrafficType());
+        }
+
+        // The broadcast_domain_type and broadcast_uri are set by the extension script output
+        final NetworkVO implemented = getNetworkVO(network, offering, physicalNetworkId);
+        return implemented;
+    }
+
+    private static NetworkVO getNetworkVO(Network network, NetworkOffering offering, Long physicalNetworkId) {
+        final NetworkVO implemented =
+                new NetworkVO(network.getTrafficType(), network.getMode(), network.getBroadcastDomainType(), network.getNetworkOfferingId(), Network.State.Allocated,
+                        network.getDataCenterId(), physicalNetworkId, offering.isRedundantRouter());
+
+        if (network.getGateway() != null) {
+            implemented.setGateway(network.getGateway());
+        }
+        if (network.getCidr() != null) {
+            implemented.setCidr(network.getCidr());
+        }
+        if (network.getBroadcastUri() != null) {
+            implemented.setBroadcastUri(network.getBroadcastUri());
+        }
+        return implemented;
+    }
+
+    /**
+     * Allocates a NIC for the given network.
+     *
+     * <p>For <b>shared</b> networks the call is forwarded to
+     * {@link DirectNetworkGuru#allocate}, which handles the
+     * {@code user_ip_address} lookup, transaction wrapping, and MAC assignment
+     * identically to how direct/shared networks work elsewhere in CloudStack.</p>
+     *
+     * <p>For <b>isolated</b> networks the standard
+     * {@link GuestNetworkGuru#allocate} path is used unchanged.</p>
+     */
+    @Override
+    public NicProfile allocate(final Network network, final NicProfile nic, final VirtualMachineProfile vm)
+            throws InsufficientVirtualNetworkCapacityException, InsufficientAddressCapacityException {
+
+        if (network.getGuestType() == GuestType.Shared) {
+            // Delegate entirely to DirectNetworkGuru
+            return directNetworkGuru.allocate(network, nic, vm);
+        }
+
+        // Isolated network: use the standard GuestNetworkGuru CIDR pool allocation.
+        return super.allocate(network, nic, vm);
+    }
+}
diff --git a/server/src/main/java/com/cloud/network/lb/LoadBalancingRulesManagerImpl.java b/server/src/main/java/com/cloud/network/lb/LoadBalancingRulesManagerImpl.java
index 37c219b750d4..25c99561b585 100644
--- a/server/src/main/java/com/cloud/network/lb/LoadBalancingRulesManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/lb/LoadBalancingRulesManagerImpl.java
@@ -119,6 +119,7 @@
 import com.cloud.network.dao.NetworkVO;
 import com.cloud.network.dao.SslCertVO;
 import com.cloud.network.element.LoadBalancingServiceProvider;
+import com.cloud.network.element.NetworkElement;
 import com.cloud.network.lb.LoadBalancingRule.LbAutoScalePolicy;
 import com.cloud.network.lb.LoadBalancingRule.LbAutoScaleVmGroup;
 import com.cloud.network.lb.LoadBalancingRule.LbAutoScaleVmProfile;
@@ -2055,6 +2056,16 @@ protected boolean applyLbRules(Network network, List<LoadBalancingRule> rules) t
             if (handled)
                 break;
         }
+        if (!handled) {
+            // Get provider name and get the element by provider name (it could be an external provider)
+            String lbProviderName = _ntwkSrvcDao.getProviderForServiceInNetwork(network.getId(), Service.Lb);
+            if (lbProviderName != null) {
+                NetworkElement element = _networkModel.getElementImplementingProvider(lbProviderName);
+                if (element instanceof LoadBalancingServiceProvider) {
+                    handled = ((LoadBalancingServiceProvider) element).applyLBRules(network, rules);
+                }
+            }
+        }
         return handled;
     }
 
diff --git a/server/src/main/java/com/cloud/network/router/CommandSetupHelper.java b/server/src/main/java/com/cloud/network/router/CommandSetupHelper.java
index c6296682bb09..58b2892e09c3 100644
--- a/server/src/main/java/com/cloud/network/router/CommandSetupHelper.java
+++ b/server/src/main/java/com/cloud/network/router/CommandSetupHelper.java
@@ -296,6 +296,10 @@ public void createDhcpEntryCommand(final VirtualRouter router, final UserVm vm,
         dhcpCommand.setDefault(nic.isDefaultNic());
         dhcpCommand.setRemove(remove);
 
+        // Set DHCP lease timeout from zone-scoped config (0 = infinite)
+        Long leaseTime = (long) NetworkOrchestrationService.DhcpLeaseTimeout.valueIn(router.getDataCenterId());
+        dhcpCommand.setLeaseTime(leaseTime);
+
         dhcpCommand.setAccessDetail(NetworkElementCommand.ROUTER_IP, _routerControlHelper.getRouterControlIp(router.getId()));
         dhcpCommand.setAccessDetail(NetworkElementCommand.ROUTER_NAME, router.getInstanceName());
         dhcpCommand.setAccessDetail(NetworkElementCommand.ROUTER_GUEST_IP, _routerControlHelper.getRouterIpInNetwork(nic.getNetworkId(), router.getId()));
@@ -459,7 +463,8 @@ public void createApplyStaticNatRulesCommands(final List<? extends StaticNatRule
         cmds.addCommand(cmd);
     }
 
-    public void createApplyFirewallRulesCommands(final List<? extends FirewallRule> rules, final VirtualRouter router, final Commands cmds, final long guestNetworkId) {
+    public void createApplyFirewallRulesCommands(final List<? extends FirewallRule> rules, final VirtualRouter router, final Commands cmds,
+            final Long guestNetworkId, final Long vpcId) {
         final List<FirewallRuleTO> rulesTO = new ArrayList<>();
         String systemRule = null;
         Boolean defaultEgressPolicy = false;
@@ -481,6 +486,10 @@ public void createApplyFirewallRulesCommands(final List<? extends FirewallRule>
                     final FirewallRuleTO ruleTO = new FirewallRuleTO(rule, null, srcIp, Purpose.Firewall, traffictype);
                     rulesTO.add(ruleTO);
                 } else if (rule.getTrafficType() == FirewallRule.TrafficType.Egress) {
+                    if (guestNetworkId == null) {
+                        logger.warn("Skipping egress firewall rule {} as guestNetworkId is null", rule.getUuid());
+                        continue;
+                    }
                     final NetworkVO network = _networkDao.findById(guestNetworkId);
                     final NetworkOfferingVO offering = _networkOfferingDao.findById(network.getNetworkOfferingId());
                     defaultEgressPolicy = offering.isEgressDefaultPolicy();
@@ -491,9 +500,14 @@ public void createApplyFirewallRulesCommands(final List<? extends FirewallRule>
             }
         }
 
-        final SetFirewallRulesCommand cmd = new SetFirewallRulesCommand(rulesTO);
+        final SetFirewallRulesCommand cmd = new SetFirewallRulesCommand(rulesTO, vpcId);
         cmd.setAccessDetail(NetworkElementCommand.ROUTER_IP, _routerControlHelper.getRouterControlIp(router.getId()));
-        cmd.setAccessDetail(NetworkElementCommand.ROUTER_GUEST_IP, _routerControlHelper.getRouterIpInNetwork(guestNetworkId, router.getId()));
+        if (guestNetworkId != null) {
+            cmd.setAccessDetail(NetworkElementCommand.ROUTER_GUEST_IP, _routerControlHelper.getRouterIpInNetwork(guestNetworkId, router.getId()));
+        }
+        if (vpcId != null) {
+            cmd.setAccessDetail(NetworkElementCommand.VPC_ID, String.valueOf(vpcId));
+        }
         cmd.setAccessDetail(NetworkElementCommand.ROUTER_NAME, router.getInstanceName());
         final DataCenterVO dcVo = _dcDao.findById(router.getDataCenterId());
         cmd.setAccessDetail(NetworkElementCommand.ZONE_NETWORK_TYPE, dcVo.getNetworkType().toString());
@@ -506,6 +520,10 @@ public void createApplyFirewallRulesCommands(final List<? extends FirewallRule>
         cmds.addCommand(cmd);
     }
 
+    public void createApplyFirewallRulesCommands(final List<? extends FirewallRule> rules, final VirtualRouter router, final Commands cmds, final long guestNetworkId) {
+        createApplyFirewallRulesCommands(rules, router, cmds, guestNetworkId, null);
+    }
+
     public void createApplyIpv6FirewallRulesCommands(final List<? extends FirewallRule> rules, final VirtualRouter router, final Commands cmds, final long guestNetworkId) {
         final List<FirewallRuleTO> rulesTO = new ArrayList<>();
         String systemRule = null;
@@ -547,7 +565,8 @@ public void createApplyIpv6FirewallRulesCommands(final List<? extends FirewallRu
         cmds.addCommand(cmd);
     }
 
-    public void createFirewallRulesCommands(final List<? extends FirewallRule> rules, final VirtualRouter router, final Commands cmds, final long guestNetworkId) {
+    public void createFirewallRulesCommands(final List<? extends FirewallRule> rules, final VirtualRouter router, final Commands cmds, final Long guestNetworkId,
+            final Long vpcId) {
         final List<FirewallRuleTO> rulesTO = new ArrayList<>();
         String systemRule = null;
         Boolean defaultEgressPolicy = false;
@@ -569,6 +588,10 @@ public void createFirewallRulesCommands(final List<? extends FirewallRule> rules
                     final FirewallRuleTO ruleTO = new FirewallRuleTO(rule, null, srcIp, Purpose.Firewall, traffictype);
                     rulesTO.add(ruleTO);
                 } else if (rule.getTrafficType() == FirewallRule.TrafficType.Egress) {
+                    if (guestNetworkId == null) {
+                        logger.warn("Skipping egress firewall rule {} as guestNetworkId is null", rule.getUuid());
+                        continue;
+                    }
                     final NetworkVO network = _networkDao.findById(guestNetworkId);
                     final NetworkOfferingVO offering = _networkOfferingDao.findById(network.getNetworkOfferingId());
                     defaultEgressPolicy = offering.isEgressDefaultPolicy();
@@ -579,9 +602,14 @@ public void createFirewallRulesCommands(final List<? extends FirewallRule> rules
             }
         }
 
-        final SetFirewallRulesCommand cmd = new SetFirewallRulesCommand(rulesTO);
+        final SetFirewallRulesCommand cmd = new SetFirewallRulesCommand(rulesTO, vpcId);
         cmd.setAccessDetail(NetworkElementCommand.ROUTER_IP, _routerControlHelper.getRouterControlIp(router.getId()));
-        cmd.setAccessDetail(NetworkElementCommand.ROUTER_GUEST_IP, _routerControlHelper.getRouterIpInNetwork(guestNetworkId, router.getId()));
+        if (guestNetworkId != null) {
+            cmd.setAccessDetail(NetworkElementCommand.ROUTER_GUEST_IP, _routerControlHelper.getRouterIpInNetwork(guestNetworkId, router.getId()));
+        }
+        if (vpcId != null) {
+            cmd.setAccessDetail(NetworkElementCommand.VPC_ID, String.valueOf(vpcId));
+        }
         cmd.setAccessDetail(NetworkElementCommand.ROUTER_NAME, router.getInstanceName());
         final DataCenterVO dcVo = _dcDao.findById(router.getDataCenterId());
         cmd.setAccessDetail(NetworkElementCommand.ZONE_NETWORK_TYPE, dcVo.getNetworkType().toString());
@@ -594,6 +622,10 @@ public void createFirewallRulesCommands(final List<? extends FirewallRule> rules
         cmds.addCommand(cmd);
     }
 
+    public void createFirewallRulesCommands(final List<? extends FirewallRule> rules, final VirtualRouter router, final Commands cmds, final Long guestNetworkId) {
+        createFirewallRulesCommands(rules, router, cmds, guestNetworkId, router.getVpcId());
+    }
+
     public void createIpv6FirewallRulesCommands(final List<? extends FirewallRule> rules, final VirtualRouter router, final Commands cmds, final long guestNetworkId) {
         final List<FirewallRuleTO> rulesTO = new ArrayList<>();
         String systemRule = null;
diff --git a/server/src/main/java/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java b/server/src/main/java/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
index dd65719ad033..a166e894be1b 100644
--- a/server/src/main/java/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/router/VirtualNetworkApplianceManagerImpl.java
@@ -2018,6 +2018,8 @@ public boolean finalizeVirtualMachineProfile(final VirtualMachineProfile profile
             } else {
                 buf.append(" has_public_network=false");
             }
+            boolean isVpcFirewallEnabled = vpcManager.isProviderSupportServiceInVpc(vpc.getId(), Service.Firewall, Provider.VPCVirtualRouter);
+            buf.append(" vpc_firewall_enabled=").append(isVpcFirewallEnabled);
         } else if (!publicNetwork) {
             type = "dhcpsrvr";
         } else {
@@ -2497,7 +2499,7 @@ protected void finalizeNetworkRulesForNetwork(final Commands cmds, final DomainR
         // Re-apply firewall Egress rules
         logger.debug("Found " + firewallRulesEgress.size() + " firewall Egress rule(s) to apply as a part of domR " + router + " start.");
         if (!firewallRulesEgress.isEmpty()) {
-            _commandSetupHelper.createFirewallRulesCommands(firewallRulesEgress, router, cmds, guestNetworkId);
+            _commandSetupHelper.createFirewallRulesCommands(firewallRulesEgress, router, cmds, guestNetworkId, router.getVpcId());
         }
 
         logger.debug(String.format("Found %d Ipv6 firewall rule(s) to apply as a part of domR %s start.", ipv6firewallRules.size(), router));
@@ -2572,7 +2574,7 @@ protected void finalizeNetworkRulesForNetwork(final Commands cmds, final DomainR
             // Re-apply firewall Ingress rules
             logger.debug("Found " + firewallRulesIngress.size() + " firewall Ingress rule(s) to apply as a part of domR " + router + " start.");
             if (!firewallRulesIngress.isEmpty()) {
-                _commandSetupHelper.createFirewallRulesCommands(firewallRulesIngress, router, cmds, guestNetworkId);
+                _commandSetupHelper.createFirewallRulesCommands(firewallRulesIngress, router, cmds, guestNetworkId, router.getVpcId());
             }
 
             // Re-apply port forwarding rules
diff --git a/server/src/main/java/com/cloud/network/router/VpcVirtualNetworkApplianceManagerImpl.java b/server/src/main/java/com/cloud/network/router/VpcVirtualNetworkApplianceManagerImpl.java
index 67cfe8458518..49c2243d1ecf 100644
--- a/server/src/main/java/com/cloud/network/router/VpcVirtualNetworkApplianceManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/router/VpcVirtualNetworkApplianceManagerImpl.java
@@ -72,6 +72,7 @@
 import com.cloud.network.dao.LoadBalancerVO;
 import com.cloud.network.dao.MonitoringServiceVO;
 import com.cloud.network.dao.NetworkVO;
+import com.cloud.network.rules.FirewallRule;
 import com.cloud.network.dao.RemoteAccessVpnVO;
 import com.cloud.network.dao.Site2SiteVpnConnectionVO;
 import com.cloud.network.lb.LoadBalancingRule;
@@ -567,6 +568,10 @@ public boolean finalizeCommandsOnStart(final Commands cmds, final VirtualMachine
                 finalizeMonitorService(cmds, profile, domainRouterVO, provider, publicNics.get(0).second().getId(), true, routerHealthCheckConfig);
             }
 
+            if (reprogramGuestNtwks) {
+                reapplyVpcFirewallIngressRules(cmds, domainRouterVO, provider);
+            }
+
             for (final Pair<Nic, Network> nicNtwk : guestNics) {
                 final Nic guestNic = nicNtwk.first();
                 final long guestNetworkId = guestNic.getNetworkId();
@@ -638,6 +643,26 @@ protected void finalizeNetworkRulesForNetwork(final Commands cmds, final DomainR
         }
     }
 
+    private void reapplyVpcFirewallIngressRules(final Commands cmds, final DomainRouterVO domainRouterVO, final Provider provider) {
+        final Long vpcId = domainRouterVO.getVpcId();
+        if (vpcId == null) {
+            return;
+        }
+
+        if (!_vpcMgr.isProviderSupportServiceInVpc(vpcId, Service.Firewall, provider)) {
+            return;
+        }
+
+        final List<FirewallRule> firewallRulesIngress = new ArrayList<>(
+                _rulesDao.listByVpcPurposeTrafficType(vpcId, FirewallRule.Purpose.Firewall, FirewallRule.TrafficType.Ingress));
+        if (firewallRulesIngress.isEmpty()) {
+            return;
+        }
+
+        logger.debug("Found {} VPC firewall ingress rule(s) to apply as a part of domR {} start for VPC {}", firewallRulesIngress.size(), domainRouterVO, vpcId);
+        _commandSetupHelper.createFirewallRulesCommands(firewallRulesIngress, domainRouterVO, cmds, null, vpcId);
+    }
+
     protected boolean sendNetworkRulesToRouter(final long routerId, final long networkId, final boolean reprogramNetwork) throws ResourceUnavailableException {
         final DomainRouterVO router = _routerDao.findById(routerId);
         final Commands cmds = new Commands(OnError.Continue);
diff --git a/server/src/main/java/com/cloud/network/rules/FirewallRules.java b/server/src/main/java/com/cloud/network/rules/FirewallRules.java
index e995f143e0e8..11922e676e1e 100644
--- a/server/src/main/java/com/cloud/network/rules/FirewallRules.java
+++ b/server/src/main/java/com/cloud/network/rules/FirewallRules.java
@@ -36,6 +36,7 @@
 import com.cloud.network.router.VirtualRouter;
 import com.cloud.network.rules.FirewallRule.Purpose;
 import com.cloud.network.rules.LoadBalancerContainer.Scheme;
+import com.cloud.network.vpc.Vpc;
 import com.cloud.utils.net.Ip;
 
 public class FirewallRules extends RuleApplier {
@@ -50,6 +51,16 @@ public FirewallRules(final Network network, final List<? extends FirewallRule> r
         _rules = rules;
     }
 
+    public FirewallRules(final Network network, final Vpc vpc, final List<? extends FirewallRule> rules) {
+        super(network, vpc);
+        _rules = rules;
+    }
+
+    public FirewallRules(final Vpc vpc, final List<? extends FirewallRule> rules) {
+        super(null, vpc);
+        _rules = rules;
+    }
+
     @Override
     public boolean accept(final NetworkTopologyVisitor visitor, final VirtualRouter router) throws ResourceUnavailableException {
         _router = router;
diff --git a/server/src/main/java/com/cloud/network/rules/RuleApplier.java b/server/src/main/java/com/cloud/network/rules/RuleApplier.java
index 73c3855361b0..baf4da324845 100644
--- a/server/src/main/java/com/cloud/network/rules/RuleApplier.java
+++ b/server/src/main/java/com/cloud/network/rules/RuleApplier.java
@@ -22,6 +22,7 @@
 import com.cloud.exception.ResourceUnavailableException;
 import com.cloud.network.Network;
 import com.cloud.network.router.VirtualRouter;
+import com.cloud.network.vpc.Vpc;
 import org.apache.logging.log4j.Logger;
 import org.apache.logging.log4j.LogManager;
 
@@ -30,16 +31,27 @@ public abstract class RuleApplier {
     protected Logger logger = LogManager.getLogger(getClass());
 
     protected Network _network;
+    protected Vpc _vpc;
     protected VirtualRouter _router;
 
     public RuleApplier(final Network network) {
         _network = network;
+        _vpc = null;
+    }
+
+    public RuleApplier(final Network network, final Vpc vpc) {
+        _network = network;
+        _vpc = vpc;
     }
 
     public Network getNetwork() {
         return _network;
     }
 
+    public Vpc getVpc() {
+        return _vpc;
+    }
+
     public VirtualRouter getRouter() {
         return _router;
     }
diff --git a/server/src/main/java/com/cloud/network/vpc/NetworkACLManagerImpl.java b/server/src/main/java/com/cloud/network/vpc/NetworkACLManagerImpl.java
index b6dfdbac0be2..77501c5151c4 100644
--- a/server/src/main/java/com/cloud/network/vpc/NetworkACLManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/vpc/NetworkACLManagerImpl.java
@@ -33,8 +33,10 @@
 import com.cloud.network.Network.Service;
 import com.cloud.network.NetworkModel;
 import com.cloud.network.dao.NetworkDao;
+import com.cloud.network.dao.NetworkServiceMapDao;
 import com.cloud.network.dao.NetworkVO;
 import com.cloud.network.element.NetworkACLServiceProvider;
+import com.cloud.network.element.NetworkElement;
 import com.cloud.network.element.VpcProvider;
 import com.cloud.network.vpc.NetworkACLItem.State;
 import com.cloud.network.vpc.dao.NetworkACLDao;
@@ -75,6 +77,8 @@ public class NetworkACLManagerImpl extends ManagerBase implements NetworkACLMana
     private MessageBus _messageBus;
     @Inject
     private ResourceTagDao resourceTagDao;
+    @Inject
+    NetworkServiceMapDao networkServiceMapDao;
 
     private List<NetworkACLServiceProvider> _networkAclElements;
 
@@ -442,12 +446,26 @@ public boolean applyACLItemsToNetwork(final long networkId, final List<NetworkAC
             logger.debug("Applying NetworkACL for network: {} with Network ACL service provider", network);
             handled = element.applyNetworkACLs(network, rules);
             if (handled) {
-                // publish message on message bus, so that network elements implementing distributed routing
-                // capability can act on the event
-                _messageBus.publish(_name, "Network_ACL_Replaced", PublishScope.LOCAL, network);
                 break;
             }
         }
+        if (!foundProvider) {
+            // Get provider name and get the element by provider name (it could be an external provider)
+            String aclProviderName = networkServiceMapDao.getProviderForServiceInNetwork(network.getId(), Service.NetworkACL);
+            if (aclProviderName != null) {
+                foundProvider = true;
+                NetworkElement element = _networkModel.getElementImplementingProvider(aclProviderName);
+                if (element instanceof NetworkACLServiceProvider) {
+                    logger.debug("Applying NetworkACL for network: {} with Network ACL service provider: {}", network, aclProviderName);
+                    handled = ((NetworkACLServiceProvider) element).applyNetworkACLs(network, rules);
+                }
+            }
+        }
+        if (handled) {
+            // publish message on message bus, so that network elements implementing distributed routing
+            // capability can act on the event
+            _messageBus.publish(_name, "Network_ACL_Replaced", PublishScope.LOCAL, network);
+        }
         if (!foundProvider) {
             logger.debug("Unable to find NetworkACL service provider for network: {}", network);
         }
diff --git a/server/src/main/java/com/cloud/network/vpc/VpcManagerImpl.java b/server/src/main/java/com/cloud/network/vpc/VpcManagerImpl.java
index c5f36e856550..bcf2c6176efe 100644
--- a/server/src/main/java/com/cloud/network/vpc/VpcManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/vpc/VpcManagerImpl.java
@@ -64,6 +64,8 @@
 import org.apache.cloudstack.api.command.user.vpc.UpdateVPCCmd;
 import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.engine.orchestration.service.NetworkOrchestrationService;
+import org.apache.cloudstack.extension.Extension;
+import org.apache.cloudstack.extension.ExtensionHelper;
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.framework.config.Configurable;
 import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
@@ -329,10 +331,12 @@ public class VpcManagerImpl extends ManagerBase implements VpcManager, VpcProvis
     Site2SiteVpnConnectionDao site2SiteVpnConnectionDao;
     @Inject
     Site2SiteCustomerGatewayDao site2SiteCustomerGatewayDao;
+    @Inject
+    ExtensionHelper extensionHelper;
 
     private final ScheduledExecutorService _executor = Executors.newScheduledThreadPool(1, new NamedThreadFactory("VpcChecker"));
     private List<VpcProvider> vpcElements = null;
-    private final List<Service> nonSupportedServices = Arrays.asList(Service.SecurityGroup, Service.Firewall);
+    private final List<Service> nonSupportedServices = Arrays.asList(Service.SecurityGroup);
     private final List<Provider> supportedProviders = Arrays.asList(Provider.VPCVirtualRouter, Provider.NiciraNvp, Provider.InternalLbVm, Provider.Netscaler,
             Provider.JuniperContrailVpcRouter, Provider.Ovs, Provider.BigSwitchBcf, Provider.ConfigDrive, Provider.Nsx, Provider.Netris);
 
@@ -701,7 +705,7 @@ public VpcOffering createVpcOffering(final String name, final String displayText
                     final Set<Provider> providers = new HashSet<Provider>();
                     for (final String prvNameStr : serviceEntry.getValue()) {
                         // check if provider is supported
-                        final Network.Provider provider = Network.Provider.getProvider(prvNameStr);
+                        final Network.Provider provider = _ntwkModel.resolveProvider(prvNameStr);
                         if (provider == null) {
                             throw new InvalidParameterValueException("Invalid service provider: " + prvNameStr);
                         }
@@ -1248,12 +1252,18 @@ public Map<Service, Set<Provider>> getVpcOffSvcProvidersMap(final long vpcOffId)
 
         for (final VpcOfferingServiceMapVO instance : map) {
             final Service service = Service.getService(instance.getService());
+            if (service == null) {
+                continue;
+            }
             Set<Provider> providers;
             providers = serviceProviderMap.get(service);
             if (providers == null) {
                 providers = new HashSet<Provider>();
             }
-            providers.add(Provider.getProvider(instance.getProvider()));
+            final Provider provider = _ntwkModel.resolveProvider(instance.getProvider());
+            if (provider != null) {
+                providers.add(provider);
+            }
             serviceProviderMap.put(service, providers);
         }
 
@@ -1846,6 +1856,12 @@ private Map<String, List<String>> finalizeServicesAndProvidersForVpc(final long
             if (provider == null) {
                 // Default to VPCVirtualRouter
                 provider = Provider.VPCVirtualRouter.getName();
+            } else {
+                final Provider resolvedProvider = _ntwkModel.resolveProvider(provider);
+                if (resolvedProvider == null) {
+                    throw new InvalidParameterValueException("Invalid provider " + provider + " configured for service " + service);
+                }
+                provider = resolvedProvider.getName();
             }
 
             if (!_ntwkModel.isProviderEnabledInZone(zoneId, provider)) {
@@ -2035,9 +2051,12 @@ private boolean checkAndUpdateRouterSourceNatIp(Vpc vpc, String sourceNatIp) {
         if (! userIps.isEmpty()) {
             try {
                 _ipAddrMgr.updateSourceNatIpAddress(requestedIp, userIps);
-                if (isVpcForProvider(Provider.Nsx, vpc) || isVpcForProvider(Provider.Netris, vpc)) {
+                if (isVpcForProvider(Provider.Nsx, vpc) || isVpcForProvider(Provider.Netris, vpc)
+                        || isVpcForProvider(Provider.NetworkExtension, vpc)) {
                     boolean isForNsx = _vpcOffSvcMapDao.isProviderForVpcOffering(Provider.Nsx, vpc.getVpcOfferingId());
-                    String providerName = isForNsx ? Provider.Nsx.getName() : Provider.Netris.getName();
+                    boolean isForNetris = _vpcOffSvcMapDao.isProviderForVpcOffering(Provider.Netris, vpc.getVpcOfferingId());
+                    String providerName = isForNsx ? Provider.Nsx.getName()
+                            : (isForNetris ? Provider.Netris.getName() : Provider.NetworkExtension.getName());
                     VpcProvider providerElement = (VpcProvider) _ntwkModel.getElementImplementingProvider(providerName);
                     if (Objects.nonNull(providerElement)) {
                         providerElement.updateVpcSourceNatIp(vpc, requestedIp);
@@ -2511,7 +2530,8 @@ public void validateNtwkOffForVpc(final NetworkOffering guestNtwkOff, final List
         // 1) in current release, only vpc provider is supported by Vpc offering
         final List<Provider> providers = _ntwkModel.getNtwkOffDistinctProviders(guestNtwkOff.getId());
         for (final Provider provider : providers) {
-            if (!supportedProviders.contains(provider)) {
+            if (!supportedProviders.contains(provider)
+                    && !extensionHelper.isNetworkExtensionProvider(provider.getName())) {
                 throw new InvalidParameterValueException("Provider of type " + provider.getName() + " is not supported for network offerings that can be used in VPC");
             }
         }
@@ -2618,17 +2638,32 @@ private void CheckAccountsAccess(Vpc vpc, Account networkAccount) {
     }
 
     public List<VpcProvider> getVpcElements() {
+        // Static providers (VPCVirtualRouter, JuniperContrailVpcRouter) are initialized once.
         if (vpcElements == null) {
             vpcElements = new ArrayList<VpcProvider>();
-            vpcElements.add((VpcProvider) _ntwkModel.getElementImplementingProvider(Provider.VPCVirtualRouter.getName()));
-            vpcElements.add((VpcProvider) _ntwkModel.getElementImplementingProvider(Provider.JuniperContrailVpcRouter.getName()));
+            final NetworkElement vpcVirtualRouter = _ntwkModel.getElementImplementingProvider(Provider.VPCVirtualRouter.getName());
+            if (vpcVirtualRouter instanceof VpcProvider) {
+                vpcElements.add((VpcProvider) vpcVirtualRouter);
+            }
+
+            final NetworkElement contrailVpcRouter = _ntwkModel.getElementImplementingProvider(Provider.JuniperContrailVpcRouter.getName());
+            if (contrailVpcRouter instanceof VpcProvider) {
+                vpcElements.add((VpcProvider) contrailVpcRouter);
+            }
         }
 
-        if (vpcElements == null) {
-            throw new CloudRuntimeException("Failed to initialize vpc elements");
+        // Extension-backed providers are re-fetched every call so that dynamically
+        // registered extensions are picked up without requiring a server restart.
+        final List<VpcProvider> result = new ArrayList<>(vpcElements);
+        for (final Extension extension : extensionHelper.listExtensionsByType(Extension.Type.NetworkOrchestrator)) {
+            final String providerName = extension.getName();
+            final NetworkElement element = _ntwkModel.getElementImplementingProvider(providerName);
+            if (element instanceof VpcProvider) {
+                result.add((VpcProvider) element);
+            }
         }
 
-        return vpcElements;
+        return result;
     }
 
     @Override
@@ -3937,7 +3972,7 @@ private List<Provider> getVpcProviders(final long vpcId) {
         final Map<String, Provider> providers = new HashMap<String, Provider>();
         for (final String providerName : providerNames) {
             if (!providers.containsKey(providerName)) {
-                providers.put(providerName, Network.Provider.getProvider(providerName));
+                providers.put(providerName, _ntwkModel.resolveProvider(providerName));
             }
         }
 
diff --git a/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java b/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
index 8db55790fd8a..32a519c79fe9 100755
--- a/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
+++ b/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
@@ -1613,7 +1613,7 @@ private boolean isClusterWideMigrationPossible(Host host, List<VMInstanceVO> vms
      */
     private void migrateAwayVmWithVolumes(HostVO host, VMInstanceVO vm) {
         final DataCenterDeployment plan = new DataCenterDeployment(host.getDataCenterId(), host.getPodId(), host.getClusterId(), null, null, null);
-        ServiceOfferingVO offeringVO = serviceOfferingDao.findById(vm.getServiceOfferingId());
+        ServiceOfferingVO offeringVO = serviceOfferingDao.findById(vm.getId(), vm.getServiceOfferingId());
         final VirtualMachineProfile profile = new VirtualMachineProfileImpl(vm, null, offeringVO, null, null);
         plan.setMigrationPlan(true);
         DeployDestination dest = getDeployDestination(vm, profile, plan, host);
@@ -2511,7 +2511,8 @@ protected void checkIfAllHostsInUse(List<String> sagsToDelete, Long clusterId, L
             List<HostVO> hostsInZone = _hostDao.findByDataCenterId(zoneId);
             Set<Long> hostIdsInUseSet = hostIdsUsingStorageAccessGroups.stream().collect(Collectors.toSet());
 
-            boolean allInUseZone = hostsInZone.stream()
+            // allMatch returns true on empty stream, need to check whether collection is not empty first
+            boolean allInUseZone = !hostsInZone.isEmpty() && hostsInZone.stream()
                     .map(HostVO::getId)
                     .allMatch(hostIdsInUseSet::contains);
 
@@ -2525,7 +2526,8 @@ protected void checkIfAllHostsInUse(List<String> sagsToDelete, Long clusterId, L
             List<HostVO> hostsInCluster = _hostDao.findByClusterId(clusterId, Type.Routing);
             Set<Long> hostIdsInUseSet = hostIdsUsingStorageAccessGroups.stream().collect(Collectors.toSet());
 
-            boolean allInUseCluster = hostsInCluster.stream()
+            // allMatch returns true on empty stream, need to check whether collection is not empty first
+            boolean allInUseCluster = !hostsInCluster.isEmpty() && hostsInCluster.stream()
                     .map(HostVO::getId)
                     .allMatch(hostIdsInUseSet::contains);
 
@@ -2539,7 +2541,8 @@ protected void checkIfAllHostsInUse(List<String> sagsToDelete, Long clusterId, L
             List<HostVO> hostsInPod = _hostDao.findByPodId(podId, Type.Routing);
             Set<Long> hostIdsInUseSet = hostIdsUsingStorageAccessGroups.stream().collect(Collectors.toSet());
 
-            boolean allInUsePod = hostsInPod.stream()
+            // allMatch returns true on empty stream, need to check whether collection is not empty first
+            boolean allInUsePod = !hostsInPod.isEmpty() && hostsInPod.stream()
                     .map(HostVO::getId)
                     .allMatch(hostIdsInUseSet::contains);
 
diff --git a/server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java b/server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java
index 27facb304eba..bc3abd30d880 100644
--- a/server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java
+++ b/server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java
@@ -1742,8 +1742,8 @@ public List<String> getResourceLimitStorageTags(DiskOffering diskOffering) {
     }
 
     @Override
-    public List<String> getResourceLimitStorageTagsForResourceCountOperation(Boolean display, DiskOffering diskOffering) {
-        if (Boolean.FALSE.equals(display)) {
+    public List<String> getResourceLimitStorageTagsForResourceCountOperation(Boolean display, DiskOffering diskOffering, Boolean enforceResourceLimitOnDisplayFalse) {
+        if (Boolean.FALSE.equals(display) && Boolean.FALSE.equals(enforceResourceLimitOnDisplayFalse)) {
             return new ArrayList<>();
         }
         List<String> tags = getResourceLimitStorageTags(diskOffering);
@@ -1757,7 +1757,7 @@ public List<String> getResourceLimitStorageTagsForResourceCountOperation(Boolean
 
     @Override
     public void checkVolumeResourceLimit(Account owner, Boolean display, Long size, DiskOffering diskOffering, List<Reserver> reservations) throws ResourceAllocationException {
-        List<String> tags = getResourceLimitStorageTagsForResourceCountOperation(display, diskOffering);
+        List<String> tags = getResourceLimitStorageTagsForResourceCountOperation(display, diskOffering, null);
         if (CollectionUtils.isEmpty(tags)) {
             return;
         }
@@ -1773,7 +1773,7 @@ public void checkVolumeResourceLimit(Account owner, Boolean display, Long size,
 
     @Override
     public void checkPrimaryStorageResourceLimit(Account owner, Boolean display, Long size, DiskOffering diskOffering, List<Reserver> reservations) throws ResourceAllocationException {
-        List<String> tags = getResourceLimitStorageTagsForResourceCountOperation(display, diskOffering);
+        List<String> tags = getResourceLimitStorageTagsForResourceCountOperation(display, diskOffering, null);
         if (CollectionUtils.isEmpty(tags)) {
             return;
         }
@@ -1790,8 +1790,8 @@ public void checkVolumeResourceLimitForDiskOfferingChange(Account owner, Boolean
             return;
         }
 
-        List<String> currentTags = getResourceLimitStorageTagsForResourceCountOperation(true, currentOffering);
-        List<String> tagsAfterUpdate = getResourceLimitStorageTagsForResourceCountOperation(true, newOffering);
+        List<String> currentTags = getResourceLimitStorageTagsForResourceCountOperation(true, currentOffering, null);
+        List<String> tagsAfterUpdate = getResourceLimitStorageTagsForResourceCountOperation(true, newOffering, null);
         if (currentTags.isEmpty() && tagsAfterUpdate.isEmpty()) {
             return;
         }
@@ -1811,7 +1811,7 @@ public void incrementVolumeResourceCount(long accountId, Boolean display, Long s
         Transaction.execute(new TransactionCallbackNoReturn() {
             @Override
             public void doInTransactionWithoutResult(TransactionStatus status) {
-                List<String> tags = getResourceLimitStorageTagsForResourceCountOperation(display, diskOffering);
+                List<String> tags = getResourceLimitStorageTagsForResourceCountOperation(display, diskOffering, null);
                 if (CollectionUtils.isEmpty(tags)) {
                     return;
                 }
@@ -1827,11 +1827,11 @@ public void doInTransactionWithoutResult(TransactionStatus status) {
 
     @DB
     @Override
-    public void decrementVolumeResourceCount(long accountId, Boolean display, Long size, DiskOffering diskOffering) {
+    public void decrementVolumeResourceCount(long accountId, Boolean display, Long size, DiskOffering diskOffering, Boolean enforceResourceLimitOnDisplayFalse) {
         Transaction.execute(new TransactionCallbackNoReturn() {
             @Override
             public void doInTransactionWithoutResult(TransactionStatus status) {
-                List<String> tags = getResourceLimitStorageTagsForResourceCountOperation(display, diskOffering);
+                List<String> tags = getResourceLimitStorageTagsForResourceCountOperation(display, diskOffering, enforceResourceLimitOnDisplayFalse);
                 if (CollectionUtils.isEmpty(tags)) {
                     return;
                 }
@@ -1865,11 +1865,11 @@ private Ternary<Set<String>, Set<String>, Set<String>> getResourceLimitHostTagsF
             Boolean display, ServiceOffering currentOffering, ServiceOffering newOffering,
             VirtualMachineTemplate currentTemplate, VirtualMachineTemplate newTemplate
     ) {
-        Set<String> currentOfferingTags = new HashSet<>(getResourceLimitHostTagsForResourceCountOperation(display, currentOffering, currentTemplate));
+        Set<String> currentOfferingTags = new HashSet<>(getResourceLimitHostTagsForResourceCountOperation(display, currentOffering, currentTemplate, null));
         if (currentOffering.getId() == newOffering.getId() && currentTemplate.getId() == newTemplate.getId()) {
             return new Ternary<>(currentOfferingTags, new HashSet<>(), new HashSet<>());
         }
-        Set<String> newOfferingTags = new HashSet<>(getResourceLimitHostTagsForResourceCountOperation(display, newOffering, newTemplate));
+        Set<String> newOfferingTags = new HashSet<>(getResourceLimitHostTagsForResourceCountOperation(display, newOffering, newTemplate, null));
 
         if (currentOfferingTags.isEmpty() && newOfferingTags.isEmpty()) {
             return null;
@@ -1941,11 +1941,11 @@ private void adjustResourceCount(Long newValue, Long currentValue, Resource.Reso
     private Ternary<Set<String>, Set<String>, Set<String>> getResourceLimitStorageTagsForDiskOfferingChange(
             Boolean display, DiskOffering currentOffering, DiskOffering newOffering
     ) {
-        Set<String> currentOfferingTags = new HashSet<>(getResourceLimitStorageTagsForResourceCountOperation(display, currentOffering));
+        Set<String> currentOfferingTags = new HashSet<>(getResourceLimitStorageTagsForResourceCountOperation(display, currentOffering, null));
         if (newOffering == null || currentOffering.getId() == newOffering.getId()) {
             return new Ternary<>(currentOfferingTags, new HashSet<>(), new HashSet<>());
         }
-        Set<String> newOfferingTags = new HashSet<>(getResourceLimitStorageTagsForResourceCountOperation(display, newOffering));
+        Set<String> newOfferingTags = new HashSet<>(getResourceLimitStorageTagsForResourceCountOperation(display, newOffering, null));
         if (currentOfferingTags.isEmpty() && newOfferingTags.isEmpty()) {
             return null;
         }
@@ -1992,7 +1992,7 @@ public void incrementVolumePrimaryStorageResourceCount(long accountId, Boolean d
         if (size == null) {
             return;
         }
-        List<String> tags = getResourceLimitStorageTagsForResourceCountOperation(display, diskOffering);
+        List<String> tags = getResourceLimitStorageTagsForResourceCountOperation(display, diskOffering, null);
         if (CollectionUtils.isEmpty(tags)) {
             return;
         }
@@ -2006,7 +2006,7 @@ public void decrementVolumePrimaryStorageResourceCount(long accountId, Boolean d
         if (size == null) {
             return;
         }
-        List<String> tags = getResourceLimitStorageTagsForResourceCountOperation(display, diskOffering);
+        List<String> tags = getResourceLimitStorageTagsForResourceCountOperation(display, diskOffering, null);
         if (CollectionUtils.isEmpty(tags)) {
             return;
         }
@@ -2015,8 +2015,9 @@ public void decrementVolumePrimaryStorageResourceCount(long accountId, Boolean d
         }
     }
 
-    protected List<String> getResourceLimitHostTagsForResourceCountOperation(Boolean display, ServiceOffering serviceOffering, VirtualMachineTemplate template) {
-        if (Boolean.FALSE.equals(display)) {
+    protected List<String> getResourceLimitHostTagsForResourceCountOperation(Boolean display, ServiceOffering serviceOffering, VirtualMachineTemplate template,
+            Boolean enforceResourceLimitOnDisplayFalse) {
+        if (Boolean.FALSE.equals(display) && Boolean.FALSE.equals(enforceResourceLimitOnDisplayFalse)) {
             return new ArrayList<>();
         }
         List<String> tags = getResourceLimitHostTags(serviceOffering, template);
@@ -2030,7 +2031,7 @@ protected List<String> getResourceLimitHostTagsForResourceCountOperation(Boolean
 
     @Override
     public void checkVmResourceLimit(Account owner, Boolean display, ServiceOffering serviceOffering, VirtualMachineTemplate template, List<Reserver> reservations) throws ResourceAllocationException {
-        List<String> tags = getResourceLimitHostTagsForResourceCountOperation(display, serviceOffering, template);
+        List<String> tags = getResourceLimitHostTagsForResourceCountOperation(display, serviceOffering, template, null);
         if (CollectionUtils.isEmpty(tags)) {
             return;
         }
@@ -2053,11 +2054,12 @@ public void checkVmResourceLimit(Account owner, Boolean display, ServiceOffering
     }
 
     @Override
-    public void incrementVmResourceCount(long accountId, Boolean display, ServiceOffering serviceOffering, VirtualMachineTemplate template) {
+    public void incrementVmResourceCount(long accountId, Boolean display, ServiceOffering serviceOffering, VirtualMachineTemplate template,
+            Boolean countDisplayFalseInResourceLimit) {
         Transaction.execute(new TransactionCallbackNoReturn() {
             @Override
             public void doInTransactionWithoutResult(TransactionStatus status) {
-                List<String> tags = getResourceLimitHostTagsForResourceCountOperation(display, serviceOffering, template);
+                List<String> tags = getResourceLimitHostTagsForResourceCountOperation(display, serviceOffering, template, countDisplayFalseInResourceLimit);
                 if (CollectionUtils.isEmpty(tags)) {
                     return;
                 }
@@ -2076,11 +2078,11 @@ public void doInTransactionWithoutResult(TransactionStatus status) {
 
     @Override
     public void decrementVmResourceCount(long accountId, Boolean display, ServiceOffering serviceOffering,
-            VirtualMachineTemplate template) {
+            VirtualMachineTemplate template, Boolean enforceResourceLimitOnDisplayFalse) {
         Transaction.execute(new TransactionCallbackNoReturn() {
             @Override
             public void doInTransactionWithoutResult(TransactionStatus status) {
-                List<String> tags = getResourceLimitHostTagsForResourceCountOperation(display, serviceOffering, template);
+                List<String> tags = getResourceLimitHostTagsForResourceCountOperation(display, serviceOffering, template, enforceResourceLimitOnDisplayFalse);
                 if (CollectionUtils.isEmpty(tags)) {
                     return;
                 }
@@ -2117,8 +2119,8 @@ private void checkVmResourceLimitsForServiceOfferingAndTemplateChange(Account ow
             Long currentMemory, Long newMemory, ServiceOffering currentOffering, ServiceOffering newOffering,
             VirtualMachineTemplate currentTemplate, VirtualMachineTemplate newTemplate, List<Reserver> reservations
     ) throws ResourceAllocationException {
-        List<String> currentTags = getResourceLimitHostTagsForResourceCountOperation(true, currentOffering, currentTemplate);
-        List<String> tagsAfterUpdate = getResourceLimitHostTagsForResourceCountOperation(true, newOffering, newTemplate);
+        List<String> currentTags = getResourceLimitHostTagsForResourceCountOperation(true, currentOffering, currentTemplate, null);
+        List<String> tagsAfterUpdate = getResourceLimitHostTagsForResourceCountOperation(true, newOffering, newTemplate, null);
         if (currentTags.isEmpty() && tagsAfterUpdate.isEmpty()) {
             return;
         }
@@ -2157,7 +2159,7 @@ private void checkVmResourceLimitsForServiceOfferingAndTemplateChange(Account ow
 
     @Override
     public void incrementVmCpuResourceCount(long accountId, Boolean display, ServiceOffering serviceOffering, VirtualMachineTemplate template, Long cpu) {
-        List<String> tags = getResourceLimitHostTagsForResourceCountOperation(display, serviceOffering, template);
+        List<String> tags = getResourceLimitHostTagsForResourceCountOperation(display, serviceOffering, template, null);
         if (CollectionUtils.isEmpty(tags)) {
             return;
         }
@@ -2171,7 +2173,7 @@ public void incrementVmCpuResourceCount(long accountId, Boolean display, Service
 
     @Override
     public void decrementVmCpuResourceCount(long accountId, Boolean display, ServiceOffering serviceOffering, VirtualMachineTemplate template, Long cpu) {
-        List<String> tags = getResourceLimitHostTagsForResourceCountOperation(display, serviceOffering, template);
+        List<String> tags = getResourceLimitHostTagsForResourceCountOperation(display, serviceOffering, template, null);
         if (CollectionUtils.isEmpty(tags)) {
             return;
         }
@@ -2185,7 +2187,7 @@ public void decrementVmCpuResourceCount(long accountId, Boolean display, Service
 
     @Override
     public void incrementVmMemoryResourceCount(long accountId, Boolean display, ServiceOffering serviceOffering, VirtualMachineTemplate template, Long memory) {
-        List<String> tags = getResourceLimitHostTagsForResourceCountOperation(display, serviceOffering, template);
+        List<String> tags = getResourceLimitHostTagsForResourceCountOperation(display, serviceOffering, template, null);
         if (CollectionUtils.isEmpty(tags)) {
             return;
         }
@@ -2199,7 +2201,7 @@ public void incrementVmMemoryResourceCount(long accountId, Boolean display, Serv
 
     @Override
     public void decrementVmMemoryResourceCount(long accountId, Boolean display, ServiceOffering serviceOffering, VirtualMachineTemplate template, Long memory) {
-        List<String> tags = getResourceLimitHostTagsForResourceCountOperation(display, serviceOffering, template);
+        List<String> tags = getResourceLimitHostTagsForResourceCountOperation(display, serviceOffering, template, null);
         if (CollectionUtils.isEmpty(tags)) {
             return;
         }
@@ -2213,7 +2215,7 @@ public void decrementVmMemoryResourceCount(long accountId, Boolean display, Serv
 
     @Override
     public void incrementVmGpuResourceCount(long accountId, Boolean display, ServiceOffering serviceOffering, VirtualMachineTemplate template, Long gpu) {
-        List<String> tags = getResourceLimitHostTagsForResourceCountOperation(display, serviceOffering, template);
+        List<String> tags = getResourceLimitHostTagsForResourceCountOperation(display, serviceOffering, template, null);
         if (CollectionUtils.isEmpty(tags)) {
             return;
         }
@@ -2227,7 +2229,7 @@ public void incrementVmGpuResourceCount(long accountId, Boolean display, Service
 
     @Override
     public void decrementVmGpuResourceCount(long accountId, Boolean display, ServiceOffering serviceOffering, VirtualMachineTemplate template, Long gpu) {
-        List<String> tags = getResourceLimitHostTagsForResourceCountOperation(display, serviceOffering, template);
+        List<String> tags = getResourceLimitHostTagsForResourceCountOperation(display, serviceOffering, template, null);
         if (CollectionUtils.isEmpty(tags)) {
             return;
         }
diff --git a/server/src/main/java/com/cloud/server/ManagementServerImpl.java b/server/src/main/java/com/cloud/server/ManagementServerImpl.java
index cadcf97626e3..f32857d7cf04 100644
--- a/server/src/main/java/com/cloud/server/ManagementServerImpl.java
+++ b/server/src/main/java/com/cloud/server/ManagementServerImpl.java
@@ -1507,6 +1507,7 @@ protected boolean zoneWideVolumeRequiresStorageMotion(PrimaryDataStore volumeDat
      */
     Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>> getTechnicallyCompatibleHosts(
             final VirtualMachine vm,
+            final Host srcHost,
             final Long startIndex,
             final Long pageSize,
             final String keyword) {
@@ -1517,31 +1518,6 @@ Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boo
             return new Ternary<>(new Pair<>(new ArrayList<>(), 0), new ArrayList<>(), new HashMap<>());
         }
 
-        final long srcHostId = vm.getHostId();
-        final Host srcHost = _hostDao.findById(srcHostId);
-        if (srcHost == null) {
-            if (logger.isDebugEnabled()) {
-                logger.debug("Unable to find the host with ID: " + srcHostId + " of this Instance: " + vm);
-            }
-            final InvalidParameterValueException ex = new InvalidParameterValueException("Unable to find the host (with specified ID) of instance with specified ID");
-            ex.addProxyObject(String.valueOf(srcHostId), "hostId");
-            ex.addProxyObject(vm.getUuid(), "vmId");
-            throw ex;
-        }
-
-        String srcHostVersion = srcHost.getHypervisorVersion();
-        if (HypervisorType.KVM.equals(srcHost.getHypervisorType()) && srcHostVersion == null) {
-            srcHostVersion = "";
-        }
-
-        // Check if the vm can be migrated with storage.
-        boolean canMigrateWithStorage = false;
-
-        List<HypervisorType> hypervisorTypes = Arrays.asList(new HypervisorType[]{HypervisorType.VMware, HypervisorType.KVM});
-        if (VirtualMachine.Type.User.equals(vm.getType()) || hypervisorTypes.contains(vm.getHypervisorType())) {
-            canMigrateWithStorage = _hypervisorCapabilitiesDao.isStorageMotionSupported(srcHost.getHypervisorType(), srcHostVersion);
-        }
-
         // Check if the vm is using any disks on local storage.
         final VirtualMachineProfile vmProfile = new VirtualMachineProfileImpl(vm, null, _offeringDao.findById(vm.getId(), vm.getServiceOfferingId()), null, null);
         final List<VolumeVO> volumes = _volumeDao.findCreatedByInstance(vmProfile.getId());
@@ -1555,12 +1531,14 @@ Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boo
             }
         }
 
+        boolean canMigrateWithStorage = isStorageMigrationSupported(vm, srcHost);
         if (!canMigrateWithStorage && usesLocal) {
             throw new InvalidParameterValueException("Unsupported operation, instance uses Local storage, cannot migrate");
         }
 
         validateVgpuProfileForVmMigration(vmProfile);
 
+        final String srcHostVersion = getHypervisorVersionOfHost(srcHost);
         final Type hostType = srcHost.getType();
         Pair<List<HostVO>, Integer> allHostsPair;
         List<HostVO> allHosts;
@@ -1636,6 +1614,23 @@ Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boo
         return new Ternary<>(allHostsPairResult, filteredHosts, requiresStorageMotion);
     }
 
+    protected boolean isStorageMigrationSupported(final VirtualMachine vm, final Host srcHost) {
+        final List<HypervisorType> hypervisorTypes = Arrays.asList(HypervisorType.VMware, HypervisorType.KVM);
+        if (VirtualMachine.Type.User.equals(vm.getType()) || hypervisorTypes.contains(vm.getHypervisorType())) {
+            final String srcHostVersion = getHypervisorVersionOfHost(srcHost);
+            return _hypervisorCapabilitiesDao.isStorageMotionSupported(srcHost.getHypervisorType(), srcHostVersion);
+        }
+        return false;
+    }
+
+    protected String getHypervisorVersionOfHost(final Host host) {
+        final String version = host.getHypervisorVersion();
+        if (version == null && HypervisorType.KVM.equals(host.getHypervisorType())) {
+            return "";
+        }
+        return version;
+    }
+
     /**
      * Apply affinity group constraints and other exclusion rules for VM migration.
      * This builds an ExcludeList based on affinity groups, DPDK requirements, and dedicated resources.
@@ -1727,9 +1722,19 @@ public Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Ho
 
         validateVmForHostMigration(vm);
 
+        final long srcHostId = vm.getHostId();
+        final Host srcHost = _hostDao.findById(srcHostId);
+        if (srcHost == null) {
+            logger.debug("Unable to find the host with ID: {} of this Instance: {}", srcHostId, vm);
+            final InvalidParameterValueException ex = new InvalidParameterValueException("Unable to find the host (with specified ID) of instance with specified ID");
+            ex.addProxyObject(String.valueOf(srcHostId), "hostId");
+            ex.addProxyObject(vm.getUuid(), "vmId");
+            throw ex;
+        }
+
         // Get technically compatible hosts (storage, hypervisor, UEFI)
         Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>> compatibilityResult =
-            getTechnicallyCompatibleHosts(vm, startIndex, pageSize, keyword);
+            getTechnicallyCompatibleHosts(vm, srcHost, startIndex, pageSize, keyword);
 
         Pair<List<? extends Host>, Integer> allHostsPair = compatibilityResult.first();
         List<? extends Host> filteredHosts = compatibilityResult.second();
@@ -1742,9 +1747,7 @@ public Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Ho
         }
 
         // Create deployment plan and VM profile
-        final Host srcHost = _hostDao.findById(vm.getHostId());
-        final DataCenterDeployment plan = new DataCenterDeployment(
-            srcHost.getDataCenterId(), srcHost.getPodId(), srcHost.getClusterId(), null, null, null);
+        final DataCenterDeployment plan = createDeploymentPlanForMigrationListing(vm, srcHost);
         final VirtualMachineProfile vmProfile = new VirtualMachineProfileImpl(
             vm, null, _offeringDao.findById(vm.getId(), vm.getServiceOfferingId()), null, null);
 
@@ -1769,6 +1772,14 @@ private void validateVgpuProfileForVmMigration(final VirtualMachineProfile vmPro
         }
     }
 
+    protected DataCenterDeployment createDeploymentPlanForMigrationListing(final VirtualMachine vm, final Host srcHost) {
+        final boolean canMigrateWithStorage = isStorageMigrationSupported(vm, srcHost);
+        if (canMigrateWithStorage) {
+            return new DataCenterDeployment(srcHost.getDataCenterId(), srcHost.getPodId(), null, null, null, null);
+        }
+        return new DataCenterDeployment(srcHost.getDataCenterId(), srcHost.getPodId(), srcHost.getClusterId(), null, null, null);
+    }
+
     /**
      * Add non DPDK enabled hosts to the avoid list
      */
@@ -2487,7 +2498,14 @@ public Pair<List<? extends Configuration>, Integer> searchForConfigurations(fina
                 if (configVo != null) {
                     final ConfigKey<?> key = _configDepot.get(param.getName());
                     if (key != null) {
-                        Object value = key.valueInScope(scope, id);
+                        boolean useStrictLookup = key.isStrictScope()
+                                && scope == ConfigKey.Scope.Domain
+                                && id != null
+                                && id.longValue() != Domain.ROOT_DOMAIN;
+                        Object value = key.valueInScope(scope, id, useStrictLookup);
+                        if (value == null && useStrictLookup) {
+                            value = key.defaultValue();
+                        }
                         configVo.setValue(value == null ? null : value.toString());
                         configVOList.add(configVo);
                     } else {
diff --git a/server/src/main/java/com/cloud/storage/StorageManagerImpl.java b/server/src/main/java/com/cloud/storage/StorageManagerImpl.java
index ae2facf38619..d9b9bc629a6b 100644
--- a/server/src/main/java/com/cloud/storage/StorageManagerImpl.java
+++ b/server/src/main/java/com/cloud/storage/StorageManagerImpl.java
@@ -2190,7 +2190,7 @@ public void cleanupStorage(boolean recurring) {
                                     volService.destroyVolume(volume.getId());
                                     // decrement volume resource count
                                     _resourceLimitMgr.decrementVolumeResourceCount(volume.getAccountId(), volume.isDisplayVolume(),
-                                            null, _diskOfferingDao.findByIdIncludingRemoved(volume.getDiskOfferingId()));
+                                            null, _diskOfferingDao.findByIdIncludingRemoved(volume.getDiskOfferingId()), null);
                                     // expunge volume from secondary if volume is on image store
                                     VolumeInfo volOnSecondary = volFactory.getVolume(volume.getId(), DataStoreRole.Image);
                                     if (volOnSecondary != null) {
@@ -4621,12 +4621,14 @@ public ConfigKey<?>[] getConfigKeys() {
                 SecStorageVMAutoScaleDown,
                 MountDisabledStoragePool,
                 VmwareCreateCloneFull,
+                XenserverCreateCloneFull,
                 VmwareAllowParallelExecution,
                 DataStoreDownloadFollowRedirects,
                 AllowVolumeReSizeBeyondAllocation,
                 StoragePoolHostConnectWorkers,
                 ObjectStorageCapacityThreshold,
-                COPY_TEMPLATES_FROM_OTHER_SECONDARY_STORAGES
+                COPY_TEMPLATES_FROM_OTHER_SECONDARY_STORAGES,
+                AgentMaxDataMigrationWaitTime
         };
     }
 
diff --git a/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java b/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java
index 39686b4d3843..535946ecdbcc 100644
--- a/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java
+++ b/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java
@@ -54,6 +54,8 @@
 import org.apache.cloudstack.api.response.GetUploadParamsResponse;
 import org.apache.cloudstack.backup.Backup;
 import org.apache.cloudstack.backup.BackupManager;
+import org.apache.cloudstack.backup.BackupManagerImpl;
+import org.apache.cloudstack.backup.InternalBackupService;
 import org.apache.cloudstack.backup.dao.BackupDao;
 import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.direct.download.DirectDownloadHelper;
@@ -64,6 +66,7 @@
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreCapabilities;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreDriver;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreManager;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreProvider;
 import org.apache.cloudstack.engine.subsystem.api.storage.EndPoint;
 import org.apache.cloudstack.engine.subsystem.api.storage.EndPointSelector;
 import org.apache.cloudstack.engine.subsystem.api.storage.HostScope;
@@ -379,6 +382,11 @@ public class VolumeApiServiceImpl extends ManagerBase implements VolumeApiServic
     private VMSnapshotDetailsDao vmSnapshotDetailsDao;
     @Inject
     private KMSManager kmsManager;
+    @Inject
+    private InternalBackupService internalBackupService;
+
+    @Inject
+    private BackupManager backupManager;
 
     public static final String KVM_FILE_BASED_STORAGE_SNAPSHOT = "kvmFileBasedStorageSnapshot";
 
@@ -974,7 +982,7 @@ public VolumeVO allocVolume(long ownerId, Long zoneId, Long diskOfferingId, Long
 
         Storage.ProvisioningType provisioningType = diskOffering.getProvisioningType();
 
-        List<String> tags = _resourceLimitMgr.getResourceLimitStorageTagsForResourceCountOperation(displayVolume, diskOffering);
+        List<String> tags = _resourceLimitMgr.getResourceLimitStorageTagsForResourceCountOperation(displayVolume, diskOffering, null);
         if (tags.size() == 1 && tags.get(0) == null) {
             tags = new ArrayList<>();
         }
@@ -1154,7 +1162,7 @@ public VolumeVO createVolume(long volumeId, Long vmId, Long snapshotId, Long sto
                 // if VM Id is provided, attach the volume to the VM
                 if (vmId != null) {
                     try {
-                        attachVolumeToVM(vmId, volume.getId(), volume.getDeviceId(), false);
+                        attachVolumeToVM(vmId, volume.getId(), volume.getDeviceId(), false, false);
                     } catch (Exception ex) {
                         StringBuilder message = new StringBuilder("Volume: ");
                         message.append(volume.getUuid());
@@ -1182,7 +1190,7 @@ public VolumeVO createVolume(long volumeId, Long vmId, Long snapshotId, Long sto
                 VolumeVO finalVolume = volume;
                 logger.trace("Decrementing volume resource count for account {} as volume failed to create on the backend", () -> _accountMgr.getAccount(finalVolume.getAccountId()));
                 _resourceLimitMgr.decrementVolumeResourceCount(volume.getAccountId(), display,
-                        volume.getSize(), _diskOfferingDao.findByIdIncludingRemoved(volume.getDiskOfferingId()));
+                        volume.getSize(), _diskOfferingDao.findByIdIncludingRemoved(volume.getDiskOfferingId()), null);
             }
         }
     }
@@ -1737,7 +1745,7 @@ private VolumeVO orchestrateResizeVolume(long volumeId, long currentSize, long n
      * Otherwise, after the removal in the database, we will try to remove the volume from both primary and secondary storage.
      */
     public boolean deleteVolume(long volumeId, Account caller) throws ConcurrentOperationException {
-        Volume volume = destroyVolume(volumeId, caller, true, true);
+        Volume volume = destroyVolume(volumeId, caller, true, true, null);
         return (volume != null);
     }
 
@@ -1915,7 +1923,7 @@ public void validateDestroyVolume(Volume volume, Account caller, boolean expunge
 
     @Override
     @ActionEvent(eventType = EventTypes.EVENT_VOLUME_DESTROY, eventDescription = "destroying a volume")
-    public Volume destroyVolume(long volumeId, Account caller, boolean expunge, boolean forceExpunge) {
+    public Volume destroyVolume(long volumeId, Account caller, boolean expunge, boolean forceExpunge, Boolean enforceResourceLimitOnDisplayFalse) {
         VolumeVO volume = retrieveAndValidateVolume(volumeId, caller);
 
         validateDestroyVolume(volume, caller, expunge, forceExpunge);
@@ -1934,7 +1942,7 @@ public Volume destroyVolume(long volumeId, Account caller, boolean expunge, bool
                     return null;
                 }
                 _resourceLimitMgr.decrementVolumeResourceCount(volume.getAccountId(), volume.isDisplay(),
-                        volume.getSize(), _diskOfferingDao.findByIdIncludingRemoved(volume.getDiskOfferingId()));
+                        volume.getSize(), _diskOfferingDao.findByIdIncludingRemoved(volume.getDiskOfferingId()), enforceResourceLimitOnDisplayFalse);
                 return volume;
             }
             if (!deleteVolumeFromStorage(volume, caller)) {
@@ -2647,7 +2655,7 @@ private void validateVolumeResizeWithSize(VolumeVO volume, long currentSize, Lon
     @Override
     @ActionEvent(eventType = EventTypes.EVENT_VOLUME_ATTACH, eventDescription = "attaching volume", async = true)
     public Volume attachVolumeToVM(AttachVolumeCmd command) {
-        return attachVolumeToVM(command.getVirtualMachineId(), command.getId(), command.getDeviceId(), false);
+        return attachVolumeToVM(command.getVirtualMachineId(), command.getId(), command.getDeviceId(), false, false);
     }
 
     protected VolumeVO getVmExistingVolumeForVolumeAttach(UserVmVO vm, VolumeInfo volumeToAttach) {
@@ -2736,7 +2744,7 @@ protected VolumeInfo createVolumeOnPrimaryForAttachIfNeeded(final VolumeInfo vol
                 throw new InvalidParameterValueException("Cannot attach uploaded volume, this operation is unsupported on storage pool type " + destPrimaryStorage.getPoolType());
             }
             newVolumeOnPrimaryStorage = _volumeMgr.createVolumeOnPrimaryStorage(vm, volumeToAttach,
-                    vm.getHypervisorType(), destPrimaryStorage);
+                    vm.getHypervisorType(), destPrimaryStorage, null, null);
         } catch (NoTransitionException e) {
             logger.debug("Failed to create volume on primary storage", e);
             throw new CloudRuntimeException("Failed to create volume on primary storage", e);
@@ -2992,12 +3000,12 @@ private VolumeInfo performLightweightLockMigration(VolumeInfo volume, UserVmVO v
 
     @Override
     @ActionEvent(eventType = EventTypes.EVENT_VOLUME_ATTACH, eventDescription = "attaching volume", async = true)
-    public Volume attachVolumeToVM(Long vmId, Long volumeId, Long deviceId, Boolean allowAttachForSharedFS) {
+    public Volume attachVolumeToVM(Long vmId, Long volumeId, Long deviceId, Boolean allowAttachForSharedFS, boolean allowAttachOnRestoring) {
         Account caller = CallContext.current().getCallingAccount();
 
         VolumeInfo volumeToAttach = getAndCheckVolumeInfo(volumeId);
 
-        UserVmVO vm = getAndCheckUserVmVO(vmId, volumeToAttach);
+        UserVmVO vm = getAndCheckUserVmVO(vmId, volumeToAttach, allowAttachOnRestoring);
 
         if (!allowAttachForSharedFS && UserVmManager.SHAREDFSVM.equals(vm.getUserVmType())) {
             throw new InvalidParameterValueException("Can't attach a volume to a Shared FileSystem Instance");
@@ -3018,7 +3026,7 @@ public Volume attachVolumeToVM(Long vmId, Long volumeId, Long deviceId, Boolean
 
         checkForVMSnapshots(vmId, vm);
 
-        checkForBackups(vm, true);
+        validateIfVmHasBackups(vm, true);
 
         _accountMgr.checkAccess(caller, null, true, volumeToAttach, vm);
 
@@ -3045,7 +3053,7 @@ public Volume attachVolumeToVM(Long vmId, Long volumeId, Long deviceId, Boolean
         }
 
         Account owner = _accountDao.findById(volumeToAttach.getAccountId());
-        List<String> resourceLimitStorageTags = _resourceLimitMgr.getResourceLimitStorageTagsForResourceCountOperation(true, diskOffering);
+        List<String> resourceLimitStorageTags = _resourceLimitMgr.getResourceLimitStorageTagsForResourceCountOperation(true, diskOffering, null);
         Long requiredPrimaryStorageSpace = getRequiredPrimaryStorageSizeForVolumeAttach(resourceLimitStorageTags, volumeToAttach);
 
         try (CheckedReservation primaryStorageReservation = new CheckedReservation(owner, ResourceType.primary_storage, resourceLimitStorageTags, requiredPrimaryStorageSpace, reservationDao, _resourceLimitMgr)) {
@@ -3178,15 +3186,16 @@ private void checkDeviceId(Long deviceId, VolumeInfo volumeToAttach, UserVmVO vm
      *
      * @return the user vm vo object correcponding to the vmId to attach to
      */
-    @NotNull private UserVmVO getAndCheckUserVmVO(Long vmId, VolumeInfo volumeToAttach) {
+    @NotNull private UserVmVO getAndCheckUserVmVO(Long vmId, VolumeInfo volumeToAttach, boolean allowAttachOnRestoring) {
         UserVmVO vm = _userVmDao.findById(vmId);
         if (vm == null || vm.getType() != VirtualMachine.Type.User) {
             throw new InvalidParameterValueException("Please specify a valid User VM.");
         }
 
-        // Check that the VM is in the correct state
-        if (vm.getState() != State.Running && vm.getState() != State.Stopped) {
-            throw new InvalidParameterValueException("Please specify a VM that is either running or stopped.");
+        if (allowAttachOnRestoring) {
+            validateVmState(vm, State.Running, State.Stopped, State.Restoring);
+        } else {
+            validateVmState(vm, State.Running, State.Stopped);
         }
 
         // Check that the VM and the volume are in the same zone
@@ -3196,6 +3205,13 @@ private void checkDeviceId(Long deviceId, VolumeInfo volumeToAttach, UserVmVO vm
         return vm;
     }
 
+    private void validateVmState(UserVmVO vm, State... states) {
+        List<State> allowedStates = Arrays.asList(states);
+        if (!allowedStates.contains(vm.getState())) {
+            throw new InvalidParameterValueException(String.format("Please specify a VM that is on of the following states: %s.", allowedStates));
+        }
+    }
+
     /**
      * Check that the volume ID is valid
      * Check that the volume is a data volume
@@ -3225,9 +3241,11 @@ private void checkDeviceId(Long deviceId, VolumeInfo volumeToAttach, UserVmVO vm
         return volumeToAttach;
     }
 
-    protected void checkForBackups(UserVmVO vm, boolean attach) {
-        if ((vm.getBackupOfferingId() == null || CollectionUtils.isEmpty(vm.getBackupVolumeList())) || BooleanUtils.isTrue(BackupManager.BackupEnableAttachDetachVolumes.value())) {
-            return;
+    protected boolean validateIfVmHasBackups(UserVmVO vm, boolean attach) {
+        if (vm.getBackupOfferingId() == null || CollectionUtils.isEmpty(backupDao.listByVmId(vm.getDataCenterId(), vm.getId()))) {
+            return false;
+        } else if (BooleanUtils.isTrue(BackupManager.BackupEnableAttachDetachVolumes.value())) {
+            return true;
         }
         String errorMsg = String.format("Unable to detach volume, cannot detach volume from a VM that has backups. First remove the VM from the backup offering or "
                 + "set the global configuration '%s' to true.", BackupManager.BackupEnableAttachDetachVolumes.key());
@@ -3354,7 +3372,7 @@ private void updateResourceCount(Volume volume, Boolean displayVolume) {
         // Update only when the flag has changed.
         if (displayVolume != null && displayVolume != volume.isDisplayVolume()) {
             if (Boolean.FALSE.equals(displayVolume)) {
-                _resourceLimitMgr.decrementVolumeResourceCount(volume.getAccountId(), true, volume.getSize(), _diskOfferingDao.findById(volume.getDiskOfferingId()));
+                _resourceLimitMgr.decrementVolumeResourceCount(volume.getAccountId(), true, volume.getSize(), _diskOfferingDao.findById(volume.getDiskOfferingId()), null);
             } else {
                 _resourceLimitMgr.incrementVolumeResourceCount(volume.getAccountId(), true, volume.getSize(), _diskOfferingDao.findById(volume.getDiskOfferingId()));
             }
@@ -3450,7 +3468,10 @@ public Volume detachVolumeFromVM(DetachVolumeCmd cmmd) {
             throw new InvalidParameterValueException("Unable to detach volume, please specify an Instance that does not have Instance Snapshots");
         }
 
-        checkForBackups(vm, false);
+        boolean hasBackup = validateIfVmHasBackups(vm, false);
+        if (hasBackup) {
+            internalBackupService.prepareVolumeForDetach(volume, vm);
+        }
 
         AsyncJobExecutionContext asyncExecutionContext = AsyncJobExecutionContext.getCurrentExecutionContext();
         if (asyncExecutionContext != null) {
@@ -4450,6 +4471,12 @@ public Snapshot allocSnapshot(Long volumeId, Long policyId, String snapshotName,
             }
         }
 
+        VirtualMachine attachedVm = volume.getAttachedVM();
+        if (attachedVm != null && HypervisorType.KVM.equals(attachedVm.getHypervisorType()) && SnapshotManager.kvmIncrementalSnapshot.valueIn(_hostDao.findClusterIdByVolumeInfo(volume)) &&
+                backupManager.getBackupProvider(attachedVm.getDataCenterId()).getName().equals(BackupManagerImpl.KBOSS_BACKUP_PROVIDER) &&
+                CollectionUtils.isNotEmpty(backupDao.listByVmId(attachedVm.getDataCenterId(), attachedVm.getId()))) {
+            throw new CloudRuntimeException(String.format("VM [%s] has KBOSS backups, cannot take incremental snapshots of it.", attachedVm.getUuid()));
+        }
 
         return snapshotMgr.allocSnapshot(volumeId, policyId, snapshotName, locationType, false, zoneIds);
     }
@@ -4709,7 +4736,7 @@ protected void updateVolumeAccount(Account oldAccount, VolumeVO volume, Account
                 Volume.class.getName(), volume.getUuid(), volume.isDisplayVolume());
         DiskOfferingVO diskOfferingVO = _diskOfferingDao.findById(volume.getDiskOfferingId());
         _resourceLimitMgr.decrementVolumeResourceCount(oldAccount.getAccountId(), true, volume.getSize(),
-                diskOfferingVO);
+                diskOfferingVO, null);
 
         volume.setAccountId(newAccount.getAccountId());
         volume.setDomainId(newAccount.getDomainId());
@@ -5092,6 +5119,13 @@ private VolumeVO sendAttachVolumeCommand(UserVmVO vm, VolumeVO volumeToAttach, L
 
                     throw new CloudRuntimeException(e.getMessage());
                 }
+
+                // Reload volume from DB after grantAccess — managed storage drivers (e.g. ONTAP)
+                // may update the volume's path and iScsiName during grantAccess, so the local
+                // volumeToAttach object can be stale.
+                if (volumeToAttachStoragePool != null && DataStoreProvider.ONTAP_PLUGIN_NAME.equals(volumeToAttachStoragePool.getStorageProviderName())) {
+                    volumeToAttach = _volsDao.findById(volumeToAttach.getId());
+                }
             }
 
             if (sendCommand) {
diff --git a/server/src/main/java/com/cloud/user/AccountManagerImpl.java b/server/src/main/java/com/cloud/user/AccountManagerImpl.java
index 2a49680e8fd8..db9c1d1dafde 100644
--- a/server/src/main/java/com/cloud/user/AccountManagerImpl.java
+++ b/server/src/main/java/com/cloud/user/AccountManagerImpl.java
@@ -3964,7 +3964,7 @@ public Long finalizeAccountId(Long accountId, String accountName, Long domainId,
             if (getActiveAccountById(accountId) != null) {
                 return accountId;
             }
-            throw new InvalidParameterValueException(String.format("Unable to find account with the specified ID."));
+            throw new InvalidParameterValueException("Unable to find account with the specified ID.");
         }
 
         if (accountName == null && domainId == null) {
diff --git a/server/src/main/java/com/cloud/vm/UserVmManager.java b/server/src/main/java/com/cloud/vm/UserVmManager.java
index 543da444706b..f6eb0593be6c 100644
--- a/server/src/main/java/com/cloud/vm/UserVmManager.java
+++ b/server/src/main/java/com/cloud/vm/UserVmManager.java
@@ -115,10 +115,15 @@ public interface UserVmManager extends UserVmService {
             "true", "Defines whether a VM should be automatically migrated to a suitable host when the current host " +
                     "lacks sufficient compute capacity to live scale the instance. Defaults to true.", true, ConfigKey.Scope.Cluster);
 
+    ConfigKey<Boolean> EnforceResourceLimitOnValidationVm = new ConfigKey<Boolean>(
+            "Advanced", Boolean.class, "enforce.resource.limit.on.backup.validation.vm", "false", "If set to true, validation VMs will be accounted in the resource limit of the " +
+            "account/domain.", true, ConfigKey.Scope.Account);
+
     static final int MAX_USER_DATA_LENGTH_BYTES = 2048;
 
     public  static  final String CKS_NODE = "cksnode";
     public  static  final String SHAREDFSVM = "sharedfsvm";
+    String VALIDATION_VM = "validationvm";
 
     /**
      * @param hostId get all of the virtual machines that belong to one host.
@@ -158,13 +163,15 @@ public interface UserVmManager extends UserVmService {
 
     boolean expunge(UserVmVO vm);
 
-    Pair<UserVmVO, Map<VirtualMachineProfile.Param, Object>> startVirtualMachine(long vmId, Long hostId, Map<VirtualMachineProfile.Param, Object> additionalParams, String deploymentPlannerToUse)
+    Pair<UserVmVO, Map<VirtualMachineProfile.Param, Object>> startVirtualMachine(long vmId, Long hostId, Map<VirtualMachineProfile.Param, Object> additionalParams, String deploymentPlannerToUse, boolean quickRestore)
         throws ConcurrentOperationException, ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException;
 
-    Pair<UserVmVO, Map<VirtualMachineProfile.Param, Object>> startVirtualMachine(long vmId, Long podId, Long clusterId, Long hostId, Map<VirtualMachineProfile.Param, Object> additionalParams, String deploymentPlannerToUse)
+    Pair<UserVmVO, Map<VirtualMachineProfile.Param, Object>> startVirtualMachine(long vmId, Long podId, Long clusterId, Long hostId,
+            Map<VirtualMachineProfile.Param, Object> additionalParams, String deploymentPlannerToUse, boolean quickRestore)
             throws ConcurrentOperationException, ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException;
 
-    Pair<UserVmVO, Map<VirtualMachineProfile.Param, Object>> startVirtualMachine(long vmId, Long podId, Long clusterId, Long hostId, Map<VirtualMachineProfile.Param, Object> additionalParams, String deploymentPlannerToUse, boolean isExplicitHost)
+    Pair<UserVmVO, Map<VirtualMachineProfile.Param, Object>> startVirtualMachine(long vmId, Long podId, Long clusterId, Long hostId,
+            Map<VirtualMachineProfile.Param, Object> additionalParams, String deploymentPlannerToUse, boolean isExplicitHost, boolean quickRestore)
             throws ConcurrentOperationException, ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException;
 
     boolean upgradeVirtualMachine(Long id, Long serviceOfferingId, Map<String, String> customParameters) throws ResourceUnavailableException,
@@ -210,4 +217,6 @@ static Set<String> getStrictHostTags() {
      * @return true if the VM is part of a CKS cluster, false otherwise.
      */
     boolean isVMPartOfAnyCKSCluster(VMInstanceVO vm);
+
+    UserVm allocateVMForValidation(long backupId, HypervisorType hypervisor) throws InsufficientCapacityException, ResourceAllocationException, ResourceUnavailableException;
 }
diff --git a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
index d4e7e0ced2b4..b3bc69835ff5 100644
--- a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
+++ b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
@@ -66,6 +66,9 @@
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.ParserConfigurationException;
 
+import com.cloud.agent.api.StartCommand;
+import com.cloud.network.NetworkService;
+import com.cloud.vm.snapshot.dao.VMSnapshotDetailsDao;
 import org.apache.cloudstack.acl.ControlledEntity;
 import org.apache.cloudstack.acl.ControlledEntity.ACLType;
 import org.apache.cloudstack.acl.SecurityChecker.AccessType;
@@ -85,6 +88,7 @@
 import org.apache.cloudstack.api.command.admin.vm.DeployVMCmdByAdmin;
 import org.apache.cloudstack.api.command.admin.vm.ExpungeVMCmd;
 import org.apache.cloudstack.api.command.admin.vm.RecoverVMCmd;
+import org.apache.cloudstack.api.command.user.network.CreateNetworkCmd;
 import org.apache.cloudstack.api.command.user.vm.AddNicToVMCmd;
 import org.apache.cloudstack.api.command.user.vm.BaseDeployVMCmd;
 import org.apache.cloudstack.api.command.user.vm.CreateVMFromBackupCmd;
@@ -112,6 +116,7 @@
 import org.apache.cloudstack.backup.BackupManager;
 import org.apache.cloudstack.backup.BackupScheduleVO;
 import org.apache.cloudstack.backup.BackupVO;
+import org.apache.cloudstack.backup.InternalBackupService;
 import org.apache.cloudstack.backup.dao.BackupDao;
 import org.apache.cloudstack.backup.dao.BackupScheduleDao;
 import org.apache.cloudstack.schedule.ResourceScheduleManager;
@@ -276,7 +281,6 @@
 import com.cloud.kubernetes.cluster.KubernetesServiceHelper;
 import com.cloud.network.IpAddressManager;
 import com.cloud.network.Network;
-import com.cloud.network.NetworkService;
 import com.cloud.network.Network.GuestType;
 import com.cloud.network.Network.IpAddresses;
 import com.cloud.network.Network.Provider;
@@ -437,6 +441,8 @@ public class UserVmManagerImpl extends ManagerBase implements UserVmManager, Vir
     private static final int ACQUIRE_GLOBAL_LOCK_TIMEOUT_FOR_COOPERATION = 3;
 
     private static final long GiB_TO_BYTES = 1024 * 1024 * 1024;
+    private static final String BACKUP_VALIDATION_NETWORK = "BackupValidationNetwork";
+    private static final String DEFAULT_SHARED_NETWORK_OFFERING_WITH_NO_SERVICE = "DefaultSharedNetworkOfferingWithNoService";
 
 
     @Inject
@@ -556,6 +562,8 @@ public class UserVmManagerImpl extends ManagerBase implements UserVmManager, Vir
     @Inject
     private VMSnapshotDao _vmSnapshotDao;
     @Inject
+    private VMSnapshotDetailsDao vmSnapshotDetailsDao;
+    @Inject
     private VMSnapshotManager _vmSnapshotMgr;
     @Inject
     private AffinityGroupVMMapDao _affinityGroupVMMapDao;
@@ -618,6 +626,8 @@ public class UserVmManagerImpl extends ManagerBase implements UserVmManager, Vir
     @Inject
     private BackupManager backupManager;
     @Inject
+    private InternalBackupService internalBackupService;
+    @Inject
     private AnnotationDao annotationDao;
     @Inject
     private VmStatsDao vmStatsDao;
@@ -731,15 +741,17 @@ public List<? extends UserVm> getVirtualMachines(long hostId) {
         return _vmDao.listByHostId(hostId);
     }
 
-    protected void resourceCountIncrement(long accountId, Boolean displayVm, ServiceOffering serviceOffering, VirtualMachineTemplate template) {
+    protected void resourceCountIncrement(long accountId, Boolean displayVm, ServiceOffering serviceOffering, VirtualMachineTemplate template,
+            Boolean countDisplayFalseInResourceCount) {
         if (!VirtualMachineManager.ResourceCountRunningVMsonly.value()) {
-            _resourceLimitMgr.incrementVmResourceCount(accountId, displayVm, serviceOffering, template);
+            _resourceLimitMgr.incrementVmResourceCount(accountId, displayVm, serviceOffering, template, countDisplayFalseInResourceCount);
         }
     }
 
-    protected void resourceCountDecrement(long accountId, Boolean displayVm, ServiceOffering serviceOffering, VirtualMachineTemplate template) {
+    protected void resourceCountDecrement(long accountId, Boolean displayVm, ServiceOffering serviceOffering, VirtualMachineTemplate template,
+            Boolean enforceResourceLimitOnDisplayFalse) {
         if (!VirtualMachineManager.ResourceCountRunningVMsonly.value()) {
-            _resourceLimitMgr.decrementVmResourceCount(accountId, displayVm, serviceOffering, template);
+            _resourceLimitMgr.decrementVmResourceCount(accountId, displayVm, serviceOffering, template, enforceResourceLimitOnDisplayFalse);
         }
     }
 
@@ -1249,7 +1261,7 @@ private UserVm forceRebootVirtualMachine(UserVmVO vm, long hostId, boolean enter
                 if (enterSetup) {
                     params.put(VirtualMachineProfile.Param.BootIntoSetup, Boolean.TRUE);
                 }
-                return startVirtualMachine(vm.getId(), null, null, hostId, params, null, false).first();
+                return startVirtualMachine(vm.getId(), null, null, hostId, params, null, false, false).first();
             }
         } catch (CloudException e) {
             throw new CloudRuntimeException(String.format("Unable to reboot the VM: %s", vm), e);
@@ -2539,7 +2551,7 @@ public UserVm recoverVirtualMachine(RecoverVMCmd cmd) throws ResourceAllocationE
                     }
 
                     //Update Resource Count for the given account
-                    resourceCountIncrement(account.getId(), vm.isDisplayVm(), serviceOffering, template);
+                    resourceCountIncrement(account.getId(), vm.isDisplayVm(), serviceOffering, template, null);
 
                 } finally {
                     ReservationHelper.closeAll(reservations);
@@ -2863,7 +2875,7 @@ private void updateVmStateForFailedVmCreation(Long vmId, Long hostId) {
                 VMTemplateVO template = _templateDao.findByIdIncludingRemoved(vm.getTemplateId());
 
                 // Update Resource Count for the given account
-                resourceCountDecrement(vm.getAccountId(), vm.isDisplayVm(), offering, template);
+                resourceCountDecrement(vm.getAccountId(), vm.isDisplayVm(), offering, template, null);
             }
         }
     }
@@ -3194,9 +3206,9 @@ protected void updateDisplayVmFlag(Boolean isDisplayVm, Long id, UserVmVO vmInst
         ServiceOffering offering = serviceOfferingDao.findByIdIncludingRemoved(vmInstance.getId(), vmInstance.getServiceOfferingId());
         VMTemplateVO template = _templateDao.findByIdIncludingRemoved(vmInstance.getTemplateId());
         if (isDisplayVm) {
-            resourceCountIncrement(vmInstance.getAccountId(), true, offering, template);
+            resourceCountIncrement(vmInstance.getAccountId(), true, offering, template, null);
         } else {
-            resourceCountDecrement(vmInstance.getAccountId(), true, offering, template);
+            resourceCountDecrement(vmInstance.getAccountId(), true, offering, template, null);
         }
 
         // Usage
@@ -3558,7 +3570,7 @@ public UserVm startVirtualMachine(StartVMCmd cmd) throws ExecutionException, Con
             additonalParams.put(VirtualMachineProfile.Param.ConsiderLastHost, cmd.getConsiderLastHost().toString());
         }
 
-        return startVirtualMachine(cmd.getId(), cmd.getPodId(), cmd.getClusterId(), cmd.getHostId(), additonalParams, cmd.getDeploymentPlanner()).first();
+        return startVirtualMachine(cmd.getId(), cmd.getPodId(), cmd.getClusterId(), cmd.getHostId(), additonalParams, cmd.getDeploymentPlanner(), false).first();
     }
 
     @Override
@@ -3662,13 +3674,13 @@ protected void checkPluginsIfVmCanBeDestroyed(UserVm vm) {
 
     @Override
     @ActionEvent(eventType = EventTypes.EVENT_VM_DESTROY, eventDescription = "destroying Vm", async = true)
-    public UserVm destroyVm(DestroyVMCmd cmd) throws ResourceUnavailableException, ConcurrentOperationException {
+    public UserVm destroyVm(DestroyVMCmd cmd, boolean checkExpunge) throws ResourceUnavailableException, ConcurrentOperationException {
         CallContext ctx = CallContext.current();
         long vmId = cmd.getId();
         boolean expunge = cmd.getExpunge();
         boolean forced = cmd.isForced();
 
-        if (expunge) {
+        if (checkExpunge && expunge) {
             String jobParamsString = ((AsyncJobVO) cmd.getJob()).getCmdInfo();
             HashMap<String,String> jobParams = GsonHelper.getGson().fromJson(jobParamsString, jobParamsType);
             String apiKey = jobParams.get("apiKey");
@@ -4456,7 +4468,7 @@ private UserVm getCheckedUserVmResource(DataCenter zone, String hostName, String
         Map<String, String> userVmOVFPropertiesMap, boolean dynamicScalingEnabled, String vmType, VMTemplateVO template,
         HypervisorType hypervisorType, long accountId, ServiceOfferingVO offering, boolean isIso,
         Long rootDiskOfferingId, Long rootDiskKmsKeyId, long volumesSize, Volume volume, Snapshot snapshot) throws ResourceAllocationException {
-        if (!VirtualMachineManager.ResourceCountRunningVMsonly.value()) {
+        if (!VirtualMachineManager.ResourceCountRunningVMsonly.value() && !(VALIDATION_VM.equals(vmType) && !EnforceResourceLimitOnValidationVm.valueIn(accountId))) {
             List<String> resourceLimitHostTags = resourceLimitService.getResourceLimitHostTags(offering, template);
             try (CheckedReservation vmReservation = new CheckedReservation(owner, ResourceType.user_vm, resourceLimitHostTags, 1l, reservationDao, resourceLimitService);
                  CheckedReservation cpuReservation = new CheckedReservation(owner, ResourceType.cpu, resourceLimitHostTags, Long.valueOf(offering.getCpu()), reservationDao, resourceLimitService);
@@ -4482,7 +4494,13 @@ protected List<String> getResourceLimitStorageTags(long diskOfferingId) {
         return resourceLimitService.getResourceLimitStorageTags(diskOfferingVO);
     }
 
-    private void reserveStorageResourcesForVm(List<Reserver> checkedReservations, Account owner, Long diskOfferingId, Long diskSize, List<VmDiskInfo> dataDiskInfoList, Long rootDiskOfferingId, ServiceOfferingVO offering, Long rootDiskSize) throws ResourceAllocationException {
+    private void reserveStorageResourcesForVm(List<Reserver> checkedReservations, Account owner, Long diskOfferingId,
+                                              Long diskSize, List<VmDiskInfo> dataDiskInfoList, Long rootDiskOfferingId,
+                                              ServiceOfferingVO offering, Long rootDiskSize, String vmType) throws ResourceAllocationException {
+        if (VALIDATION_VM.equals(vmType) && !EnforceResourceLimitOnValidationVm.valueIn(owner.getAccountId())) {
+            return;
+        }
+
         List<String> rootResourceLimitStorageTags = getResourceLimitStorageTags(rootDiskOfferingId != null ? rootDiskOfferingId : offering.getDiskOfferingId());
         CheckedReservation rootVolumeReservation = new CheckedReservation(owner, ResourceType.volume, rootResourceLimitStorageTags, 1L, reservationDao, resourceLimitService);
         checkedReservations.add(rootVolumeReservation);
@@ -4526,7 +4544,7 @@ private UserVm getUncheckedUserVmResource(DataCenter zone, String hostName, Stri
 
 
         try {
-            reserveStorageResourcesForVm(checkedReservations, owner, diskOfferingId, diskSize, dataDiskInfoList, rootDiskOfferingId, offering, volumesSize);
+            reserveStorageResourcesForVm(checkedReservations, owner, diskOfferingId, diskSize, dataDiskInfoList, rootDiskOfferingId, offering, volumesSize, vmType);
 
             // verify security group ids
             if (securityGroupIdList != null) {
@@ -4703,19 +4721,7 @@ private UserVm getUncheckedUserVmResource(DataCenter zone, String hostName, Stri
                     }
 
                     profile.setDefaultNic(true);
-                    if (!_networkModel.areServicesSupportedInNetwork(network.getId(), new Service[]{Service.UserData})) {
-                        if ((userData != null) && (!userData.isEmpty())) {
-                            throw new InvalidParameterValueException(String.format("Unable to deploy VM as UserData is provided while deploying the VM, but there is no support for %s service in the default network %s/%s.", Service.UserData.getName(), network.getName(), network.getUuid()));
-                        }
-
-                        if ((sshPublicKeys != null) && (!sshPublicKeys.isEmpty())) {
-                            throw new InvalidParameterValueException(String.format("Unable to deploy VM as SSH keypair is provided while deploying the VM, but there is no support for %s service in the default network %s/%s", Service.UserData.getName(), network.getName(), network.getUuid()));
-                        }
-
-                        if (template.isEnablePassword()) {
-                            throw new InvalidParameterValueException(String.format("Unable to deploy VM as template %s is password enabled, but there is no support for %s service in the default network %s/%s", template, Service.UserData.getName(), network.getName(), network.getUuid()));
-                        }
-                    }
+                    validateUserdataSupport(userData, vmType, template, network, sshPublicKeys);
                 }
 
                 if (_networkModel.isSecurityGroupSupportedInNetwork(network)) {
@@ -4826,6 +4832,30 @@ private UserVm getUncheckedUserVmResource(DataCenter zone, String hostName, Stri
         }
     }
 
+    /**
+     * Validates that the network supports the necessary UserData-related features for the VM
+     * <br/>
+     * Validation VMs are not validated, these VMs should be in a no-service network regardless of the original VM's settings.
+     * */
+    private void validateUserdataSupport(String userData, String vmType, VMTemplateVO template, NetworkVO network, String sshPublicKeys) {
+        if (VALIDATION_VM.equals(vmType)) {
+            return;
+        }
+        if (!_networkModel.areServicesSupportedInNetwork(network.getId(), new Service[]{Service.UserData})) {
+            if ((userData != null) && (!userData.isEmpty())) {
+                throw new InvalidParameterValueException(String.format("Unable to deploy VM as UserData is provided while deploying the VM, but there is no support for %s service in the default network %s/%s.", Service.UserData.getName(), network.getName(), network.getUuid()));
+            }
+
+            if ((sshPublicKeys != null) && (!sshPublicKeys.isEmpty())) {
+                throw new InvalidParameterValueException(String.format("Unable to deploy VM as SSH keypair is provided while deploying the VM, but there is no support for %s service in the default network %s/%s", Service.UserData.getName(), network.getName(), network.getUuid()));
+            }
+
+            if (template.isEnablePassword()) {
+                throw new InvalidParameterValueException(String.format("Unable to deploy VM as template %s is password enabled, but there is no support for %s service in the default network %s/%s", template.getId(), Service.UserData.getName(), network.getName(), network.getUuid()));
+            }
+        }
+    }
+
     private void assignInstanceToGroup(String group, long id) {
         // Assign instance to the group
         try {
@@ -5145,7 +5175,8 @@ private UserVmVO commitUserVm(final boolean isImport, final DataCenter zone, fin
 
             try {
                 //Update Resource Count for the given account
-                resourceCountIncrement(accountId, isDisplayVm, offering, template);
+                boolean countDisplayFalseInResourceCount = VALIDATION_VM.equals(vm.getUserVmType()) && EnforceResourceLimitOnValidationVm.valueIn(accountId);
+                resourceCountIncrement(accountId, isDisplayVm, offering, template, countDisplayFalseInResourceCount);
             } catch (CloudRuntimeException cre) {
                 ArrayList<ExceptionProxyObject> epoList =  cre.getIdProxyList();
                 if (epoList == null || !epoList.stream().anyMatch( e -> e.getUuid().equals(vm.getUuid()))) {
@@ -5528,7 +5559,7 @@ private UserVm startVirtualMachine(long vmId, Long podId, Long clusterId, Long h
         Pair<UserVmVO, Map<VirtualMachineProfile.Param, Object>> vmParamPair = null;
 
         try {
-            vmParamPair = startVirtualMachine(vmId, podId, clusterId, hostId, additonalParams, deploymentPlannerToUse);
+            vmParamPair = startVirtualMachine(vmId, podId, clusterId, hostId, additonalParams, deploymentPlannerToUse, false);
             vm = vmParamPair.first();
 
             // At this point VM should be in "Running" state
@@ -5721,6 +5752,12 @@ public boolean finalizeDeployment(Commands cmds, VirtualMachineProfile profile,
     @Override
     public boolean finalizeCommandsOnStart(Commands cmds, VirtualMachineProfile profile) {
         UserVmVO vm = _vmDao.findById(profile.getId());
+
+        if (vm.getHypervisorType() == HypervisorType.KVM && VALIDATION_VM.equals(vm.getUserVmType())) {
+            StartCommand startCommand = cmds.getCommand(StartCommand.class);
+            startCommand.setSecondaryStorages(new ArrayList<>(internalBackupService.getSecondaryStorageUrls(vm)));
+        }
+
         List<VMSnapshotVO> vmSnapshots = _vmSnapshotDao.findByVm(vm.getId());
         RestoreVMSnapshotCommand command = _vmSnapshotMgr.createRestoreCommand(vm, vmSnapshots);
         if (command != null) {
@@ -5815,6 +5852,10 @@ public boolean finalizeStart(VirtualMachineProfile profile, long hostId, Command
             return false;
         }
 
+        if (UserVmManager.VALIDATION_VM.equals(vm.getUserVmType())) {
+            return true;
+        }
+
         Answer answer = cmds.getAnswer("restoreVMSnapshot");
         if (answer != null && answer instanceof RestoreVMSnapshotAnswer) {
             RestoreVMSnapshotAnswer restoreVMSnapshotAnswer = (RestoreVMSnapshotAnswer) answer;
@@ -5937,20 +5978,21 @@ public void finalizeStop(VirtualMachineProfile profile, Answer answer) {
 
     @Override
     public Pair<UserVmVO, Map<VirtualMachineProfile.Param, Object>> startVirtualMachine(long vmId, Long hostId, @NotNull Map<VirtualMachineProfile.Param, Object> additionalParams,
-            String deploymentPlannerToUse) throws ConcurrentOperationException, ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
-        return startVirtualMachine(vmId, null, null, hostId, additionalParams, deploymentPlannerToUse);
+            String deploymentPlannerToUse, boolean quickRestore) throws ConcurrentOperationException, ResourceUnavailableException, InsufficientCapacityException,
+            ResourceAllocationException {
+        return startVirtualMachine(vmId, null, null, hostId, additionalParams, deploymentPlannerToUse, quickRestore);
     }
 
     @Override
     public Pair<UserVmVO, Map<VirtualMachineProfile.Param, Object>> startVirtualMachine(long vmId, Long podId, Long clusterId, Long hostId,
-            @NotNull Map<VirtualMachineProfile.Param, Object> additionalParams, String deploymentPlannerToUse)
+            @NotNull Map<VirtualMachineProfile.Param, Object> additionalParams, String deploymentPlannerToUse, boolean quickRestore)
             throws ConcurrentOperationException, ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
-        return startVirtualMachine(vmId, podId, clusterId, hostId, additionalParams, deploymentPlannerToUse, true);
+        return startVirtualMachine(vmId, podId, clusterId, hostId, additionalParams, deploymentPlannerToUse, true, quickRestore);
     }
 
     private Pair<UserVmVO, Map<VirtualMachineProfile.Param, Object>> startVirtualMachineUnchecked(UserVmVO vm, VMTemplateVO template, Long podId,
             Long clusterId, Long hostId, @NotNull Map<VirtualMachineProfile.Param, Object> additionalParams, String deploymentPlannerToUse,
-            boolean isExplicitHost, boolean isRootAdmin) throws ResourceUnavailableException, InsufficientCapacityException {
+            boolean isExplicitHost, boolean isRootAdmin, boolean quickRestore) throws ResourceUnavailableException, InsufficientCapacityException {
 
         // check if vm is security group enabled
         if (_securityGroupMgr.isVmSecurityGroupEnabled(vm.getId()) && _securityGroupMgr.getSecurityGroupsForVm(vm.getId()).isEmpty()
@@ -5973,7 +6015,7 @@ private Pair<UserVmVO, Map<VirtualMachineProfile.Param, Object>> startVirtualMac
         // Default behaviour is invoked when host, cluster or pod are not specified
         Pod destinationPod = getDestinationPod(podId, isRootAdmin);
         Cluster destinationCluster = getDestinationCluster(clusterId, isRootAdmin);
-        HostVO destinationHost = getDestinationHost(hostId, isRootAdmin, isExplicitHost);
+        HostVO destinationHost = getDestinationHost(hostId, isRootAdmin, isExplicitHost, quickRestore);
         DataCenterDeployment plan = null;
         boolean deployOnGivenHost = false;
         if (destinationHost != null) {
@@ -6073,7 +6115,7 @@ private Pair<UserVmVO, Map<VirtualMachineProfile.Param, Object>> startVirtualMac
 
     @Override
     public Pair<UserVmVO, Map<VirtualMachineProfile.Param, Object>> startVirtualMachine(long vmId, Long podId, Long clusterId, Long hostId,
-            @NotNull Map<VirtualMachineProfile.Param, Object> additionalParams, String deploymentPlannerToUse, boolean isExplicitHost)
+            @NotNull Map<VirtualMachineProfile.Param, Object> additionalParams, String deploymentPlannerToUse, boolean isExplicitHost, boolean quickRestore)
             throws ConcurrentOperationException, ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
         // Input validation
         final Account callerAccount = CallContext.current().getCallingAccount();
@@ -6114,10 +6156,10 @@ public Pair<UserVmVO, Map<VirtualMachineProfile.Param, Object>> startVirtualMach
                  CheckedReservation cpuReservation = new CheckedReservation(owner, ResourceType.cpu, resourceLimitHostTags, Long.valueOf(offering.getCpu()), reservationDao, resourceLimitService);
                  CheckedReservation memReservation = new CheckedReservation(owner, ResourceType.memory, resourceLimitHostTags, Long.valueOf(offering.getRamSize()), reservationDao, resourceLimitService);
             ) {
-                return startVirtualMachineUnchecked(vm, template, podId, clusterId, hostId, additionalParams, deploymentPlannerToUse, isExplicitHost, isRootAdmin);
+                return startVirtualMachineUnchecked(vm, template, podId, clusterId, hostId, additionalParams, deploymentPlannerToUse, isExplicitHost, isRootAdmin, quickRestore);
             }
         } else {
-            return startVirtualMachineUnchecked(vm, template, podId, clusterId, hostId, additionalParams, deploymentPlannerToUse, isExplicitHost, isRootAdmin);
+            return startVirtualMachineUnchecked(vm, template, podId, clusterId, hostId, additionalParams, deploymentPlannerToUse, isExplicitHost, isRootAdmin, quickRestore);
         }
     }
 
@@ -6202,10 +6244,10 @@ private Cluster getDestinationCluster(Long clusterId, boolean isRootAdmin) {
         return destinationCluster;
     }
 
-    private HostVO getDestinationHost(Long hostId, boolean isRootAdmin, boolean isExplicitHost) {
+    private HostVO getDestinationHost(Long hostId, boolean isRootAdmin, boolean isExplicitHost, boolean quickRestore) {
         HostVO destinationHost = null;
         if (hostId != null) {
-            if (isExplicitHost && !isRootAdmin) {
+            if (isExplicitHost && !isRootAdmin && !quickRestore) {
                 throw new PermissionDeniedException(
                         "Parameter " + ApiConstants.HOST_ID + " can only be specified by a Root Admin, permission denied");
             }
@@ -6271,7 +6313,8 @@ public UserVm destroyVm(long vmId, boolean expunge) throws ResourceUnavailableEx
                     // Get serviceOffering and template for Virtual Machine
                     VMTemplateVO template = _templateDao.findByIdIncludingRemoved(vm.getTemplateId());
                     //Update Resource Count for the given account
-                    resourceCountDecrement(vm.getAccountId(), vm.isDisplayVm(), offering, template);
+                    resourceCountDecrement(vm.getAccountId(), vm.isDisplayVm(), offering, template,
+                            (VALIDATION_VM.equals(vm.getUserVmType()) && EnforceResourceLimitOnValidationVm.valueIn(owner.getAccountId())));
                 }
                 return _vmDao.findById(vmId);
             } else {
@@ -6707,12 +6750,14 @@ public UserVm createVirtualMachine(DeployVMCmd cmd) throws InsufficientCapacityE
             networkIds = new ArrayList<>(userVmNetworkMap.values());
         }
 
-        return createVirtualMachine(cmd, zone, owner, serviceOffering, template, cmd.getHypervisor(), diskOfferingId, cmd.getSize(), overrideDiskOfferingId, dataDiskInfoList, networkIds, cmd.getIpToNetworkMap(), volume, snapshot);
+        return createVirtualMachine(cmd, zone, owner, serviceOffering, template, cmd.getHypervisor(), diskOfferingId, cmd.getSize(), overrideDiskOfferingId, dataDiskInfoList,
+                networkIds, cmd.getIpToNetworkMap(), volume, snapshot);
     }
 
     private UserVm createVirtualMachine(BaseDeployVMCmd cmd, DataCenter zone, Account owner, ServiceOffering serviceOffering, VirtualMachineTemplate template,
                                         HypervisorType hypervisor, Long diskOfferingId, Long size, Long overrideDiskOfferingId, List<VmDiskInfo> dataDiskInfoList,
-                                        List<Long> networkIds, Map<Long, IpAddresses> ipToNetworkMap, Volume volume, Snapshot snapshot) throws InsufficientCapacityException, ResourceUnavailableException, ConcurrentOperationException, ResourceAllocationException {
+                                        List<Long> networkIds, Map<Long, IpAddresses> ipToNetworkMap, Volume volume, Snapshot snapshot) throws InsufficientCapacityException,
+                                         ResourceUnavailableException, ConcurrentOperationException, ResourceAllocationException {
 
         ServiceOfferingJoinVO svcOffering = serviceOfferingJoinDao.findById(serviceOffering.getId());
         boolean isLeaseFeatureEnabled = VMLeaseManager.InstanceLeaseEnabled.value();
@@ -6747,7 +6792,7 @@ private UserVm createVirtualMachine(BaseDeployVMCmd cmd, DataCenter zone, Accoun
         boolean isRootAdmin = _accountService.isRootAdmin(callerId);
 
         Long hostId = cmd.getHostId();
-        getDestinationHost(hostId, isRootAdmin, true);
+        getDestinationHost(hostId, isRootAdmin, true, false);
 
         String ipAddress = cmd.getIpAddress();
         String ip6Address = cmd.getIp6Address();
@@ -8383,12 +8428,12 @@ protected NetworkOfferingVO getOfferingWithRequiredAvailabilityForNetworkCreatio
     /**
      * Executes all ownership steps necessary to assign a VM to another user:
      * generating a destroy VM event ({@link EventTypes}),
-     * decrementing the old user resource count ({@link #resourceCountDecrement(long, Boolean, ServiceOffering, VirtualMachineTemplate)}),
+     * decrementing the old user resource count ({@link #resourceCountDecrement(long, Boolean, ServiceOffering, VirtualMachineTemplate, Boolean)}),
      * removing the VM from its instance group ({@link #removeInstanceFromInstanceGroup(long)}),
      * updating the VM owner to the new account ({@link #updateVmOwner(Account, UserVmVO, Long, Long)}),
      * updating the volumes to the new account ({@link #updateVolumesOwner(List, Account, Account, Long)}),
      * updating the network for the VM ({@link #updateVmNetwork(AssignVMCmd, Account, UserVmVO, Account, VirtualMachineTemplate)}),
-     * incrementing the new user resource count ({@link #resourceCountIncrement(long, Boolean, ServiceOffering, VirtualMachineTemplate)}),
+     * incrementing the new user resource count ({@link #resourceCountIncrement(long, Boolean, ServiceOffering, VirtualMachineTemplate, Boolean)}),
      * and generating a create VM event ({@link EventTypes}).
      * @param cmd The assignVMCmd.
      * @param caller The account calling the assignVMCmd.
@@ -8408,7 +8453,7 @@ protected void executeStepsToChangeOwnershipOfVm(AssignVMCmd cmd, Account caller
                 vm.getTemplateId(), vm.getHypervisorType().toString(), VirtualMachine.class.getName(), vm.getUuid(), vm.isDisplayVm());
 
         logger.trace("Decrementing old account [{}] resource count.", oldAccount);
-        resourceCountDecrement(oldAccount.getAccountId(), vm.isDisplayVm(), offering, template);
+        resourceCountDecrement(oldAccount.getAccountId(), vm.isDisplayVm(), offering, template, null);
 
         logger.trace("Removing VM [{}] from its instance group.", vm);
         removeInstanceFromInstanceGroup(vm.getId());
@@ -8429,7 +8474,7 @@ protected void executeStepsToChangeOwnershipOfVm(AssignVMCmd cmd, Account caller
 
         logger.trace(String.format("Incrementing new account [%s] resource count.", newAccount));
         if (!isResourceCountRunningVmsOnlyEnabled()) {
-            resourceCountIncrement(newAccountId, vm.isDisplayVm(), offering, template);
+            resourceCountIncrement(newAccountId, vm.isDisplayVm(), offering, template, null);
         }
 
         logger.trace(String.format("Generating create event for VM [%s].", vm));
@@ -8456,7 +8501,7 @@ protected void updateVolumesOwner(final List<VolumeVO> volumes, Account oldAccou
 
             logger.trace("Decrementing volume [{}] and primary storage resource count for the old account [{}].", volume, oldAccount);
             DiskOfferingVO diskOfferingVO = _diskOfferingDao.findById(volume.getDiskOfferingId());
-            _resourceLimitMgr.decrementVolumeResourceCount(oldAccount.getAccountId(), volume.isDisplay(), volume.getSize(), diskOfferingVO);
+            _resourceLimitMgr.decrementVolumeResourceCount(oldAccount.getAccountId(), volume.isDisplay(), volume.getSize(), diskOfferingVO, null);
 
             logger.trace("Setting the new account [{}] and domain [{}] for volume [{}].", newAccount, newAccount.getDomainId(), volume);
             volume.setAccountId(newAccountId);
@@ -9205,6 +9250,7 @@ public UserVm restoreVirtualMachine(final Account caller, final long vmId, final
         if (needRestart) {
             try {
                 _itMgr.stop(vm.getUuid());
+                vm.setState(State.Stopped);
             } catch (ResourceUnavailableException e) {
                 logger.debug("Stop vm {} failed", vm, e);
                 CloudRuntimeException ex = new CloudRuntimeException("Stop vm failed for specified vmId");
@@ -9280,6 +9326,7 @@ public Pair<UserVmVO, Volume> doInTransaction(final TransactionStatus status) th
                         newVol.getDiskOfferingId(), newVol.getTemplateId(), newVol.getSize(), Volume.class.getName(), newVol.getUuid(), vmId, newVol.isDisplay());
 
                 // Detach, destroy and create the usage event for the old root volume.
+                internalBackupService.prepareVolumeForDetach(root, vm);
                 _volsDao.detachVolume(root.getId());
                 destroyVolumeInContext(vm, Volume.State.Allocated.equals(root.getState()) || expunge, root);
 
@@ -9668,7 +9715,8 @@ public ConfigKey<?>[] getConfigKeys() {
                 VmIpFetchThreadPoolMax, VmIpFetchTaskWorkers, AllowDeployVmIfGivenHostFails, EnableAdditionalVmConfig, DisplayVMOVFProperties,
                 KvmAdditionalConfigAllowList, XenServerAdditionalConfigAllowList, VmwareAdditionalConfigAllowList, DestroyRootVolumeOnVmDestruction,
                 EnforceStrictResourceLimitHostTagCheck, StrictHostTags, AllowUserForceStopVm, VmDistinctHostNameScope,
-                VmwareAdditionalDetailsFromOvaEnabled, VmwareAllowedAdditionalDetailsFromOva, AllowDifferentHostTagsOfferingsForVmScale, AutoMigrateVmOnLiveScaleInsufficientCapacity};
+                VmwareAdditionalDetailsFromOvaEnabled, VmwareAllowedAdditionalDetailsFromOva, AllowDifferentHostTagsOfferingsForVmScale,
+                AutoMigrateVmOnLiveScaleInsufficientCapacity, EnforceResourceLimitOnValidationVm};
     }
 
     @Override
@@ -9785,7 +9833,8 @@ private void destroyVolumeInContext(UserVmVO vm, boolean expunge, VolumeVO volum
         volumeContext.setEventResourceType(ApiCommandResourceType.Volume);
         volumeContext.setEventResourceId(volume.getId());
         try {
-            Volume result = _volumeService.destroyVolume(volume.getId(), CallContext.current().getCallingAccount(), expunge, false);
+            Volume result = _volumeService.destroyVolume(volume.getId(), CallContext.current().getCallingAccount(), expunge, false,
+                    (VALIDATION_VM.equals(vm.getUserVmType()) && EnforceResourceLimitOnValidationVm.valueIn(volume.getAccountId())));
 
             if (result == null) {
                 logger.error("DestroyVM remove volume - failed to delete volume {} from instance {}", volume, vm);
@@ -10032,7 +10081,8 @@ public UserVm allocateVMFromBackup(CreateVMFromBackupCmd cmd) throws Insufficien
             ipToNetworkMap = backupManager.getIpToNetworkMapFromBackup(backup, cmd.getPreserveIp(), networkIds);
         }
 
-        UserVm vm = createVirtualMachine(cmd, targetZone, owner, serviceOffering, template, hypervisorType, diskOfferingId, size, overrideDiskOfferingId, dataDiskInfoList, networkIds, ipToNetworkMap, null, null);
+        UserVm vm = createVirtualMachine(cmd, targetZone, owner, serviceOffering, template, hypervisorType, diskOfferingId, size, overrideDiskOfferingId, dataDiskInfoList,
+                networkIds, ipToNetworkMap, null, null);
 
         String vmSettingsFromBackup = backup.getDetail(ApiConstants.VM_SETTINGS);
         if (vm != null && vmSettingsFromBackup != null) {
@@ -10063,7 +10113,7 @@ public UserVm restoreVMFromBackup(CreateVMFromBackupCmd cmd) throws ResourceUnav
 
         try {
             Pair<UserVmVO, Map<VirtualMachineProfile.Param, Object>> vmParamPair = null;
-            vmParamPair = startVirtualMachine(vmId, null, null, null, additonalParams, null);
+            vmParamPair = startVirtualMachine(vmId, null, null, null, additonalParams, null, false);
             vm = vmParamPair.first();
 
             Long isoId = vm.getIsoId();
@@ -10073,7 +10123,7 @@ public UserVm restoreVMFromBackup(CreateVMFromBackupCmd cmd) throws ResourceUnav
                 _vmDao.update(vm.getId(), vmVO);
             }
 
-            backupManager.restoreBackupToVM(cmd.getBackupId(), vmId);
+            backupManager.restoreBackupToVM(cmd.getBackupId(), vmId, cmd.getQuickRestore());
 
         } catch (CloudRuntimeException | ResourceUnavailableException | ResourceAllocationException | InsufficientCapacityException  e) {
             UserVmVO vmVO = _vmDao.findById(vmId);
@@ -10094,7 +10144,7 @@ public UserVm restoreVMFromBackup(CreateVMFromBackupCmd cmd) throws ResourceUnav
             vm = resetVMSSHKeyInternal(userVm, owner, sshKeyPairNames);
         }
 
-        if (cmd.getStartVm()) {
+        if (cmd.getStartVm() && !cmd.getQuickRestore()) {
             Long podId = null;
             Long clusterId = null;
             if (cmd instanceof CreateVMFromBackupCmdByAdmin) {
@@ -10158,7 +10208,7 @@ private void postProcessingUnmanageVM(UserVmVO vm) {
                     vm.getId(), vm.getHostName(), vm.getServiceOfferingId(), vm.getTemplateId(),
                     vm.getHypervisorType().toString(), VirtualMachine.class.getName(), vm.getUuid(), vm.isDisplayVm());
 
-            resourceCountDecrement(vm.getAccountId(), vm.isDisplayVm(), offering, template);
+            resourceCountDecrement(vm.getAccountId(), vm.isDisplayVm(), offering, template, null);
             resourceNotDecremented = false;
         }
         // VM destroy usage event
@@ -10166,7 +10216,7 @@ private void postProcessingUnmanageVM(UserVmVO vm) {
                 vm.getId(), vm.getHostName(), vm.getServiceOfferingId(), vm.getTemplateId(),
                 vm.getHypervisorType().toString(), VirtualMachine.class.getName(), vm.getUuid(), vm.isDisplayVm());
         if (resourceNotDecremented) {
-            resourceCountDecrement(vm.getAccountId(), vm.isDisplayVm(), offering, template);
+            resourceCountDecrement(vm.getAccountId(), vm.isDisplayVm(), offering, template, null);
         }
     }
 
@@ -10182,7 +10232,7 @@ private void postProcessingUnmanageVMVolumes(List<VolumeVO> volumes, UserVmVO vm
                         Volume.class.getName(), volume.getUuid(), volume.isDisplayVolume());
             }
             _resourceLimitMgr.decrementVolumeResourceCount(vm.getAccountId(), volume.isDisplayVolume(),
-                    volume.getSize(), _diskOfferingDao.findByIdIncludingRemoved(volume.getDiskOfferingId()));
+                    volume.getSize(), _diskOfferingDao.findByIdIncludingRemoved(volume.getDiskOfferingId()), null);
         }
     }
 
@@ -10290,4 +10340,111 @@ protected VMTemplateVO getBlankInstanceTemplate() {
         template = _templateDao.persist(template);
         return template;
     }
+
+    @Override
+    public UserVm allocateVMForValidation(long backupId, HypervisorType hypervisor) throws InsufficientCapacityException, ResourceAllocationException, ResourceUnavailableException {
+        BackupVO backup = backupDao.findById(backupId);
+        if (backup == null) {
+            throw new CloudRuntimeException(String.format("Backup [%s] was not found.", backupId));
+        }
+
+        DataCenter zone = _dcDao.findById(backup.getZoneId());
+        if (zone == null) {
+            throw new CloudRuntimeException(String.format("Unable to find zone [%s] of backup [%s].", backup.getZoneId(), backup.getUuid()));
+        }
+
+        backupManager.validateBackupForZone(backup.getZoneId());
+        backupDao.loadDetails(backup);
+
+        UserVmVO backupVm = _vmDao.findByIdIncludingRemoved(backup.getVmId());
+        HypervisorType hypervisorType = backupVm.getHypervisorType();
+
+        String serviceOfferingUuid = backup.getDetail(ApiConstants.SERVICE_OFFERING_ID);
+        if (serviceOfferingUuid == null) {
+            throw new CloudRuntimeException(String.format("Backup [%s] doesn't contain service offering UUID. Unable to validate it.", backup.getUuid()));
+        }
+        ServiceOffering serviceOffering = serviceOfferingDao.findByUuid(serviceOfferingUuid);
+        if (serviceOffering == null) {
+            throw new CloudRuntimeException(String.format("Unable to find service offering with the UUID stored in backup [%s]. Unable to validate the backup.", backup.getUuid()));
+        }
+
+        String templateUuid = backup.getDetail(ApiConstants.TEMPLATE_ID);
+        if (templateUuid == null) {
+            throw new CloudRuntimeException(String.format("Backup [%s] doesn't contain a template UUID. Unable to validate it.", backup.getUuid()));
+        }
+        VirtualMachineTemplate template = _templateDao.findByUuidIncludingRemoved(templateUuid);
+        if (template == null) {
+            throw new CloudRuntimeException(String.format("Unable to find template associated with the backup [%s]. Unable to validate it.", backup.getUuid()));
+        }
+
+        Map<String, String> details = new HashMap<>();
+
+        VmDiskInfo rootVmDiskInfoFromBackup = backupManager.getRootDiskInfoFromBackup(backup);
+        updateDetailsWithRootDiskAttributes(details, rootVmDiskInfoFromBackup);
+        Long size = rootVmDiskInfoFromBackup.getSize();
+        List<VmDiskInfo> dataDiskInfoList = backupManager.getDataDiskInfoListFromBackup(backup);
+
+        List<Long> networkIds = new ArrayList<Long>();
+        Network network = getValidationNetwork(zone.getId());
+        networkIds.add(network.getId());
+
+        Account owner = _accountService.getActiveAccountById(backup.getAccountId());
+        CreateVMFromBackupCmd cmd = new CreateVMFromBackupCmdByAdmin(hypervisor.name(), VALIDATION_VM);
+        UserVm vm = createVirtualMachine(cmd, zone, owner, serviceOffering, template, hypervisorType, null, size, null, dataDiskInfoList, networkIds, null, null, null);
+
+        String vmSettingsFromBackup = backup.getDetail(ApiConstants.VM_SETTINGS);
+        UserVmVO vmVO = null;
+        if (vm != null) {
+            vmVO = _vmDao.findById(vm.getId());
+            Map<String, String> vmDetails = new HashMap<>();
+            vmDetails.put(ApiConstants.BACKUP_ID, backup.getUuid());
+            vmVO.setDetails(vmDetails);
+        }
+        if (vmVO != null && vmSettingsFromBackup != null) {
+            Map<String, String> detailsFromBackup = vmInstanceDetailsDao.listDetailsKeyPairs(vm.getId());
+            vmVO.getDetails().putAll(detailsFromBackup);
+
+            Type type = new com.google.common.reflect.TypeToken<Map<String, String>>(){}.getType();
+            Map<String, String> vmDetailsFromBackup = new Gson().fromJson(vmSettingsFromBackup, type);
+            for (Entry<String, String> entry : vmDetailsFromBackup.entrySet()) {
+                if (!detailsFromBackup.containsKey(entry.getKey())) {
+                    vmVO.setDetail(entry.getKey(), entry.getValue());
+                }
+            }
+        }
+        if (vmVO != null) {
+            _vmDao.saveDetails(vmVO);
+        }
+
+        return vm;
+    }
+
+    private Network getValidationNetwork(long zoneId) {
+        NetworkVO networkVo = _networkDao.findByZoneIdAndAccountIdAndGuestTypeAndName(zoneId, Account.ACCOUNT_ID_SYSTEM, GuestType.Shared, BACKUP_VALIDATION_NETWORK);
+        AccountVO accountVO = _accountDao.findById(Account.ACCOUNT_ID_SYSTEM);
+
+        if (networkVo != null) {
+            return networkVo;
+        }
+
+        NetworkOfferingVO offeringVo = _networkOfferingDao.findByUniqueName(DEFAULT_SHARED_NETWORK_OFFERING_WITH_NO_SERVICE);
+
+        if (offeringVo == null) {
+            offeringVo = new NetworkOfferingVO(DEFAULT_SHARED_NETWORK_OFFERING_WITH_NO_SERVICE,
+                    "Default shared offering with no services.", TrafficType.Guest, false, false, null, null, true, Availability.Optional, null, GuestType.Shared, false, true,
+                    false, false, false, false);
+            offeringVo.setState(NetworkOffering.State.Enabled);
+            offeringVo = _networkOfferingDao.persistDefaultNetworkOffering(offeringVo);
+        }
+
+        try {
+            CreateNetworkCmd cmd = new CreateNetworkCmd(offeringVo.getId(), BACKUP_VALIDATION_NETWORK, "System network for validating backups", "192.168.0.1", "255.255.0.0",
+                    "192.168.0.2", "192.168.255.255", accountVO.getDomainId(), accountVO.getAccountName(), zoneId, ACLType.Domain.name(), true, false);
+            ComponentContext.inject(cmd);
+            return networkService.createGuestNetwork(cmd);
+        } catch (InsufficientCapacityException | ResourceAllocationException ex) {
+            logger.error("Failed to create network for backup validation.", ex);
+            throw new CloudRuntimeException(ex);
+        }
+    }
 }
diff --git a/server/src/main/java/org/apache/cloudstack/backup/BackupCompressionServiceJobController.java b/server/src/main/java/org/apache/cloudstack/backup/BackupCompressionServiceJobController.java
new file mode 100644
index 000000000000..ba17241aa3a6
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/backup/BackupCompressionServiceJobController.java
@@ -0,0 +1,241 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+package org.apache.cloudstack.backup;
+
+import com.cloud.dc.ClusterVO;
+import com.cloud.dc.DataCenterVO;
+import com.cloud.host.HostVO;
+import com.cloud.utils.DateUtil;
+import com.cloud.utils.Pair;
+import com.cloud.utils.UuidUtils;
+import com.cloud.utils.concurrency.NamedThreadFactory;
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.config.Configurable;
+import org.apache.logging.log4j.ThreadContext;
+
+import javax.inject.Inject;
+import javax.naming.ConfigurationException;
+import java.util.ArrayList;
+import java.util.Calendar;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.UUID;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.TimeUnit;
+import java.util.stream.Collectors;
+
+public class BackupCompressionServiceJobController extends InternalBackupServiceJobController implements Configurable {
+
+    private static final String LOCK = "compression_lock";
+    protected ConfigKey<Integer> backupCompressionMaxConcurrentOperationsPerHost = new ConfigKey<>("Advanced", Integer.class,
+            "backup.compression.max.concurrent.operations.per.host", "5", "Determines the maximum number of concurrent backup compressions per host. Values lower than 0 remove" +
+            " the limit, meaning that as many compressions as possible will be done at the same time.", true, ConfigKey.Scope.Cluster);
+
+    protected ConfigKey<Integer> backupCompressionMaxConcurrentOperations = new ConfigKey<>("Advanced", Integer.class,
+            "backup.compression.max.concurrent.operations", "10", "Determines the maximum number of concurrent backup compressions in the zone. Values lower than 1 remove" +
+            " the limit, meaning that as many compressions as possible will be done at the same time.", true, ConfigKey.Scope.Zone);
+
+    protected ConfigKey<Integer> backupCompressionMaxJobRetries = new ConfigKey<>("Advanced", Integer.class,
+            "backup.compression.max.job.retries", "2", "Determines the maximum number of retries for backup compression jobs. This includes both start compression jobs and " +
+            "finalize compression jobs.", true, ConfigKey.Scope.Cluster);
+
+    protected ConfigKey<Integer> backupCompressionRetryInterval = new ConfigKey<>("Advanced", Integer.class,
+            "backup.compression.retry.interval", "60", "Determines the minimum amount of time (in minutes) to retry a backup compression job. This includes both start " +
+            "compression jobs and finalize compression jobs.", true, ConfigKey.Scope.Cluster);
+
+    protected ConfigKey<Boolean> backupCompressionTaskEnabled = new ConfigKey<>("Advanced", Boolean.class, "backup.compression.task.enabled", "true", "Whether the backup " +
+            "compression task should be running or not. Please set this to false and wait for any compression jobs to finish before restarting the Management Server.", true,
+            ConfigKey.Scope.Account);
+
+    @Inject
+    private InternalBackupService internalBackupService;
+
+    private ExecutorService executor;
+
+    private ScheduledExecutorService scheduledExecutor;
+
+    @Override
+    public boolean configure(String name, Map<String, Object> params) throws ConfigurationException {
+        super.configure(name, params);
+
+        executor = Executors.newCachedThreadPool(new NamedThreadFactory("BackupCompressionTask"));
+        scheduledExecutor = Executors.newSingleThreadScheduledExecutor(new NamedThreadFactory("BackupCompressionScheduler"));
+        scheduledExecutor.scheduleAtFixedRate(this::run, 60, 60, TimeUnit.SECONDS);
+        this.controllerType = "compression";
+        return true;
+    }
+
+    /**
+     * For each zone, get the jobs that should be started and distribute them through the hosts.
+     * Will lock the backup compression table so that only one management server executes this task at a time.
+     * Catches all exceptions and only sends them to the log. If we throw an exception, the task will stop running until the server is restarted.
+     * */
+    @Override
+    protected void searchAndDispatchJobs() {
+        try {
+            List<DataCenterVO> zones = dataCenterDao.listEnabledZones();
+            if (!internalBackupServiceJobDao.lockInLockTable(LOCK, 300)) {
+                logger.warn("Unable to get lock for compression jobs.");
+                return;
+            }
+
+            rescheduleLostJobs();
+
+            if (!backupCompressionTaskEnabled.value()) {
+                logger.debug("Backup compression task is disabled. Not running.");
+                return;
+            }
+
+            for (DataCenterVO zone : zones) {
+                if (!isFrameworkEnabledForZone(zone)) {
+                    logger.debug("Backup framework is not enabled for zone [{}], will not run the backup compression task for this zone.", zone.getUuid());
+                    continue;
+                }
+                List<InternalBackupServiceJobVO> jobsToStart = internalBackupServiceJobDao.listWaitingJobsAndScheduledToBeforeNow(zone.getId(),
+                        InternalBackupServiceJobType.StartCompression, InternalBackupServiceJobType.FinalizeCompression);
+                jobsToStart = filterJobsOfDomainsAndAccountsWithDisabledCompressionTask(jobsToStart);
+                if (jobsToStart.isEmpty()) {
+                    continue;
+                }
+                logger.debug("Found [{}] compression jobs to submit.", jobsToStart.size());
+                Pair<HashMap<HostVO, Long>, Integer> hostToNumberOfExecutingJobsAndTotalExecutingJobs = getHostToNumberOfExecutingJobsAndTotalExecutingJobs(zone, InternalBackupServiceJobType.StartCompression);
+                List<Pair<HostVO, Long>> hostAndNumberOfJobsPairList = filterHostsWithTooManyJobs(hostToNumberOfExecutingJobsAndTotalExecutingJobs.first(),
+                        backupCompressionMaxConcurrentOperationsPerHost);
+                HashSet<Long> busyInstances = submitFinalizeJobsForExecution(jobsToStart, hostAndNumberOfJobsPairList, zone.getId());
+                busyInstances.addAll(internalBackupServiceJobDao.listExecutingJobsByZoneIdAndJobType(zone.getId(), InternalBackupServiceJobType.StartCompression).stream().
+                        map(InternalBackupServiceJobVO::getInstanceId).collect(Collectors.toSet()));
+
+                jobsToStart = thinJobsToStartList(zone, jobsToStart, hostToNumberOfExecutingJobsAndTotalExecutingJobs.second(), backupCompressionMaxConcurrentOperations);
+                submitQueuedJobsForExecution(jobsToStart, hostAndNumberOfJobsPairList, busyInstances, backupCompressionMaxConcurrentOperationsPerHost, zone.getId());
+            }
+
+            ThreadContext.pop();
+        } catch (Exception e) {
+            logger.error("Caught exception [{}] while trying to search and dispatch backup compression jobs.", e.getMessage(), e);
+        } finally {
+            internalBackupServiceJobDao.unlockFromLockTable(LOCK);
+        }
+    }
+
+    @Override
+    protected List<InternalBackupServiceJobVO> getLostJobs(ClusterVO clusterVO, Calendar date, List<HostVO> hostVOS) {
+        date.add(Calendar.SECOND, (int)Math.round(InternalBackupProvider.backupCompressionTimeout.valueIn(clusterVO.getId()) * -RESCHEDULE_TO_TIMEOUT_RATIO));
+        List<InternalBackupServiceJobVO> result = internalBackupServiceJobDao.listExecutingJobsByHostsAndStartTimeBeforeAndTypeIn(hostVOS.stream().map(HostVO::getId).toArray(),
+                date.getTime(), InternalBackupServiceJobType.StartCompression, InternalBackupServiceJobType.FinalizeCompression);
+        logger.info("Got [{}] lost backup compression jobs.", result.size());
+        if (result.isEmpty()) {
+            return result;
+        }
+        logger.debug("Lost backups compression jobs found: {}", result);
+        return result;
+    }
+
+    @Override
+    protected void submitQueuedJob(InternalBackupServiceJobVO job, long zoneId, String logId) {
+        executor.submit(() -> startBackupCompression(job, zoneId, logId));
+    }
+
+    /**
+     * Submit FinalizeCompression jobs, this should be called before submitStartJobsForExecution.
+     * */
+    protected HashSet<Long> submitFinalizeJobsForExecution(List<InternalBackupServiceJobVO> jobsToExecute, List<Pair<HostVO, Long>> hostAndNumberOfJobsPairList, long zoneId) {
+        List<InternalBackupServiceJobVO> submittedJobs = new ArrayList<>();
+        HashSet<Long> setOfInstancesWithExecutingCompressionJobs = new HashSet<>();
+        for (InternalBackupServiceJobVO job : jobsToExecute) {
+            if (job.getType() != InternalBackupServiceJobType.FinalizeCompression) {
+                continue;
+            }
+            submittedJobs.add(job);
+            String logId = UuidUtils.first(UUID.randomUUID().toString());
+            logger.debug("Dispatching backup compression job [{}{}] with logid:{} for backup [{}].", BACKUP_JOB, job.getId(), logId, job.getBackupId());
+
+            Pair<HostVO, Long> hostAndNumberOfJobs = hostAndNumberOfJobsPairList.get((int) (Math.random()*hostAndNumberOfJobsPairList.size()));
+            job.setHostId(hostAndNumberOfJobs.first().getId());
+            job.setStartTime(DateUtil.now());
+            internalBackupServiceJobDao.update(job);
+
+            setOfInstancesWithExecutingCompressionJobs.add(job.getInstanceId());
+            executor.submit(() -> finalizeBackupCompression(job, zoneId, logId));
+        }
+        jobsToExecute.removeAll(submittedJobs);
+        return setOfInstancesWithExecutingCompressionJobs;
+    }
+
+    private void startBackupCompression(InternalBackupServiceJobVO job, long zoneId, String logId) {
+        boolean result = false;
+        try {
+            ThreadContext.push(BACKUP_JOB + job.getId());
+            ThreadContext.put(LOGCONTEXTID, logId);
+            result = internalBackupService.startBackupCompression(job.getBackupId(), job.getHostId(), zoneId);
+        } catch (Exception e) {
+            logger.error("Caught exception [{}] while trying to compress backup [{}].", e.getMessage(), job.getBackupId(), e);
+        } finally {
+            processJobResult(job, result);
+            ThreadContext.clearAll();
+        }
+    }
+
+    private void finalizeBackupCompression(InternalBackupServiceJobVO job, long zoneId, String logId) {
+        boolean result = false;
+        try {
+            ThreadContext.push(BACKUP_JOB + job.getId());
+            ThreadContext.put(LOGCONTEXTID, logId);
+            result = internalBackupService.finalizeBackupCompression(job.getBackupId(), job.getHostId(), zoneId);
+        } catch (Exception e) {
+            logger.error("Caught exception [{}] while trying to finalize backup compression [{}].", e.getMessage(), job.getBackupId(), e);
+        } finally {
+            processJobResult(job, result);
+            ThreadContext.clearAll();
+        }
+    }
+
+    protected List<InternalBackupServiceJobVO> filterJobsOfDomainsAndAccountsWithDisabledCompressionTask(List<InternalBackupServiceJobVO> jobsToFilter) {
+        ArrayList<InternalBackupServiceJobVO> filteredJobs = new ArrayList<>();
+        for (InternalBackupServiceJobVO job : jobsToFilter) {
+            if (backupCompressionTaskEnabled.valueIn(job.getAccountId())) {
+                filteredJobs.add(job);
+            }
+        }
+        return filteredJobs;
+    }
+
+    @Override
+    protected int getMaxAttempts(InternalBackupServiceJobVO jobVo) {
+        HostVO hostVO = hostDao.findById(jobVo.getHostId());
+        return backupCompressionMaxJobRetries.valueIn(hostVO.getClusterId());
+    }
+
+    @Override
+    protected int getRetryInterval(InternalBackupServiceJobVO jobVo) {
+        HostVO hostVO = hostDao.findById(jobVo.getHostId());
+        return backupCompressionRetryInterval.valueIn(hostVO.getClusterId());
+    }
+
+    @Override
+    public String getConfigComponentName() {
+        return BackupCompressionServiceJobController.class.getSimpleName();
+    }
+
+    @Override
+    public ConfigKey<?>[] getConfigKeys() {
+        return new ConfigKey[] {backupCompressionMaxConcurrentOperationsPerHost, backupCompressionMaxJobRetries, backupCompressionRetryInterval, backupCompressionTaskEnabled, backupCompressionMaxConcurrentOperations};
+    }
+}
diff --git a/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java b/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
index f9c98cb141b6..58e435b6406d 100644
--- a/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
@@ -35,9 +35,17 @@
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
 
+import com.cloud.host.Host;
+import com.cloud.storage.VolumeApiService;
+import com.cloud.utils.exception.BackupProviderException;
+import com.cloud.utils.fsm.NoTransitionException;
+import com.cloud.vm.VirtualMachineManager;
 import javax.inject.Inject;
 import javax.naming.ConfigurationException;
 
+import com.cloud.vm.VmDiskInfo;
+import com.google.gson.GsonBuilder;
+import com.google.gson.reflect.TypeToken;
 import com.cloud.utils.DomainHelper;
 import com.cloud.utils.EnumUtils;
 import org.apache.cloudstack.api.ApiCommandResourceType;
@@ -55,6 +63,9 @@
 import org.apache.cloudstack.api.command.user.backup.CreateBackupScheduleCmd;
 import org.apache.cloudstack.api.command.user.backup.DeleteBackupCmd;
 import org.apache.cloudstack.api.command.user.backup.DeleteBackupScheduleCmd;
+import org.apache.cloudstack.api.command.user.backup.DownloadValidationScreenshotCmd;
+import org.apache.cloudstack.api.command.user.backup.FinishBackupChainCmd;
+import org.apache.cloudstack.api.command.user.backup.ListBackupServiceJobsCmd;
 import org.apache.cloudstack.api.command.user.backup.ListBackupOfferingsCmd;
 import org.apache.cloudstack.api.command.user.backup.ListBackupScheduleCmd;
 import org.apache.cloudstack.api.command.user.backup.ListBackupsCmd;
@@ -62,6 +73,7 @@
 import org.apache.cloudstack.api.command.user.backup.RestoreBackupCmd;
 import org.apache.cloudstack.api.command.user.backup.RestoreVolumeFromBackupAndAttachToVMCmd;
 import org.apache.cloudstack.api.command.user.backup.UpdateBackupScheduleCmd;
+import org.apache.cloudstack.api.command.user.backup.CreateBackupOfferingCmd;
 import org.apache.cloudstack.api.command.user.backup.repository.AddBackupRepositoryCmd;
 import org.apache.cloudstack.api.command.user.backup.repository.DeleteBackupRepositoryCmd;
 import org.apache.cloudstack.api.command.user.backup.repository.ListBackupRepositoriesCmd;
@@ -134,7 +146,6 @@
 import com.cloud.storage.ScopeType;
 import com.cloud.storage.Storage;
 import com.cloud.storage.Volume;
-import com.cloud.storage.VolumeApiService;
 import com.cloud.storage.VolumeVO;
 import com.cloud.storage.dao.DiskOfferingDao;
 import com.cloud.storage.dao.GuestOSDao;
@@ -166,18 +177,13 @@
 import com.cloud.utils.db.TransactionLegacy;
 import com.cloud.utils.db.TransactionStatus;
 import com.cloud.utils.exception.CloudRuntimeException;
-import com.cloud.utils.fsm.NoTransitionException;
 import com.cloud.vm.VMInstanceDetailVO;
 import com.cloud.vm.VMInstanceVO;
 import com.cloud.vm.VirtualMachine;
-import com.cloud.vm.VirtualMachineManager;
-import com.cloud.vm.VmDiskInfo;
 import com.cloud.vm.dao.UserVmDao;
 import com.cloud.vm.dao.VMInstanceDao;
 import com.cloud.vm.dao.VMInstanceDetailsDao;
 import com.google.gson.Gson;
-import com.google.gson.GsonBuilder;
-import com.google.gson.reflect.TypeToken;
 
 public class BackupManagerImpl extends ManagerBase implements BackupManager {
 
@@ -259,6 +265,12 @@ public class BackupManagerImpl extends ManagerBase implements BackupManager {
 
     private static final List<Backup.Status> INVALID_BACKUP_STATUS = List.of(Backup.Status.Expunged, Backup.Status.Removed);
 
+    public static final String KBOSS_BACKUP_PROVIDER = "kboss";
+
+    private static List<String> quiesceSupported = List.of("nas", KBOSS_BACKUP_PROVIDER);
+
+    private static List<String> providersThatIgnoreHostAndDatastore = List.of("nas", KBOSS_BACKUP_PROVIDER);
+
     public AsyncJobDispatcher getAsyncJobDispatcher() {
         return asyncJobDispatcher;
     }
@@ -341,6 +353,76 @@ public List<Long> getBackupOfferingDomains(Long offeringId) {
         return backupOfferingDetailsDao.findDomainIds(offeringId);
     }
 
+    @Override
+    public BackupOffering createBackupOffering(CreateBackupOfferingCmd cmd) {
+        validateBackupForZone(cmd.getZoneId());
+        if (backupOfferingDao.findByName(cmd.getName(), cmd.getZoneId()) != null) {
+            throw new CloudRuntimeException("A backup offering with the same name already exists in this zone");
+        }
+
+        if (CollectionUtils.isNotEmpty(cmd.getDomainIds())) {
+            for (final Long domainId: cmd.getDomainIds()) {
+                if (domainDao.findById(domainId) == null) {
+                    throw new InvalidParameterValueException("Please specify a valid domain ID");
+                }
+            }
+        }
+
+        List<Long> filteredDomainIds = cmd.getDomainIds() == null ? new ArrayList<>() : new ArrayList<>(cmd.getDomainIds());
+        if (filteredDomainIds.size() > 1) {
+            filteredDomainIds = domainHelper.filterChildSubDomains(filteredDomainIds);
+        }
+
+        final BackupProvider provider = getBackupProvider(cmd.getZoneId());
+        if (!KBOSS_BACKUP_PROVIDER.equals(provider.getName())) {
+            throw new InvalidParameterValueException("Only KBOSS supports this API currently.");
+        }
+
+        if (!provider.isValidProviderOffering(cmd.getZoneId(), null)) {
+            throw new CloudRuntimeException(String.format("Backup offering is not valid for provider [%s] in zone [%s]", provider, cmd.getZoneId()));
+        }
+
+        final BackupOfferingVO offering = new BackupOfferingVO(cmd.getZoneId(), provider.getName(), cmd.getName(), cmd.getDescription(), cmd.getUserDrivenBackups());
+
+        final BackupOfferingVO savedOffering = backupOfferingDao.persist(offering);
+        if (savedOffering == null) {
+            throw new CloudRuntimeException("Unable to create backup offering: " + cmd.getName());
+        }
+        List<BackupOfferingDetailsVO> detailsVOList = new ArrayList<>();
+        if (CollectionUtils.isNotEmpty(filteredDomainIds)) {
+            for (Long domainId : filteredDomainIds) {
+                detailsVOList.add(new BackupOfferingDetailsVO(savedOffering.getId(), ApiConstants.DOMAIN_ID, String.valueOf(domainId), false));
+            }
+        }
+        if (cmd.isCompress()) {
+            detailsVOList.add(new BackupOfferingDetailsVO(savedOffering.getId(), ApiConstants.COMPRESS, "true", true));
+        }
+        if (cmd.isValidate()) {
+            detailsVOList.add(new BackupOfferingDetailsVO(savedOffering.getId(), ApiConstants.VALIDATE, "true", true));
+        }
+        if (cmd.isAllowExtractFile()) {
+            detailsVOList.add(new BackupOfferingDetailsVO(savedOffering.getId(), ApiConstants.ALLOW_EXTRACT_FILE, "true", true));
+        }
+        if (cmd.isAllowQuickRestore()) {
+            detailsVOList.add(new BackupOfferingDetailsVO(savedOffering.getId(), ApiConstants.ALLOW_QUICK_RESTORE, "true", true));
+        }
+        if (cmd.getBackupChainSize() != null) {
+            detailsVOList.add(new BackupOfferingDetailsVO(savedOffering.getId(), ApiConstants.BACKUP_CHAIN_SIZE, cmd.getBackupChainSize().toString(), true));
+        }
+        if (cmd.getCompressionLibrary() != null) {
+            detailsVOList.add(new BackupOfferingDetailsVO(savedOffering.getId(), ApiConstants.COMPRESSION_LIBRARY, cmd.getCompressionLibrary().name(), true));
+        }
+        if (cmd.getValidationSteps() != null) {
+            detailsVOList.add(new BackupOfferingDetailsVO(savedOffering.getId(), ApiConstants.VALIDATION_STEPS, cmd.getValidationSteps(), true));
+        }
+
+        if (!detailsVOList.isEmpty()) {
+            backupOfferingDetailsDao.saveDetails(detailsVOList);
+        }
+        logger.debug("Successfully created backup offering [{}] mapped to backup provider offering [{}].",cmd.getName(), savedOffering.getUuid());
+        return savedOffering;
+    }
+
     @Override
     @ActionEvent(eventType = EventTypes.EVENT_VM_BACKUP_OFFERING_CLONE, eventDescription = "cloning backup offering")
     public BackupOffering cloneBackupOffering(final CloneBackupOfferingCmd cmd) {
@@ -388,28 +470,34 @@ public BackupOffering cloneBackupOffering(final CloneBackupOfferingCmd cmd) {
 
         List<Long> filteredDomainIds = cmd.getDomainIds() == null ? new ArrayList<>() : new ArrayList<>(cmd.getDomainIds());
         Collections.sort(filteredDomainIds);
-        updateBackupOfferingDomainDetail(savedOffering, filteredDomainIds);
+        updateBackupOfferingDetails(savedOffering, sourceOffering, filteredDomainIds);
 
         logger.debug("Successfully cloned backup offering '" + sourceOffering.getName() + "' (ID: " + cmd.getSourceOfferingId() + ") to '" + cmd.getName() + "' (ID: " + savedOffering.getId() + ")");
         return savedOffering;
     }
 
-    private void updateBackupOfferingDomainDetail(BackupOfferingVO savedOffering, List<Long> filteredDomainIds) {
+    private void updateBackupOfferingDetails(BackupOfferingVO savedOffering, BackupOfferingVO sourceOffering, List<Long> filteredDomainIds) {
         if (filteredDomainIds.size() > 1) {
             filteredDomainIds = domainHelper.filterChildSubDomains(filteredDomainIds);
         }
 
+        List<BackupOfferingDetailsVO> detailsVOList = new ArrayList<>();
         if (CollectionUtils.isNotEmpty(filteredDomainIds)) {
-            List<BackupOfferingDetailsVO> detailsVOList = new ArrayList<>();
             for (Long domainId : filteredDomainIds) {
                 if (domainDao.findById(domainId) == null) {
                     throw new InvalidParameterValueException("Please specify a valid domain id");
                 }
                 detailsVOList.add(new BackupOfferingDetailsVO(savedOffering.getId(), ApiConstants.DOMAIN_ID, String.valueOf(domainId), false));
             }
-            if (!detailsVOList.isEmpty()) {
-                backupOfferingDetailsDao.saveDetails(detailsVOList);
-            }
+        }
+
+        List<BackupOfferingDetailsVO> details = backupOfferingDetailsDao.listDetails(sourceOffering.getId());
+        details.removeIf(backupOfferingDetailsVO -> ApiConstants.DOMAIN_ID.equals(backupOfferingDetailsVO.getName()));
+        details.forEach(detail -> detail.setResourceId(savedOffering.getId()));
+        detailsVOList.addAll(details);
+
+        if (!detailsVOList.isEmpty()) {
+            backupOfferingDetailsDao.saveDetails(detailsVOList);
         }
     }
 
@@ -718,6 +806,7 @@ public BackupSchedule configureBackupSchedule(CreateBackupScheduleCmd cmd) {
         final DateUtil.IntervalType intervalType = cmd.getIntervalType();
         final String scheduleString = cmd.getSchedule();
         final TimeZone timeZone = TimeZone.getTimeZone(cmd.getTimezone());
+        boolean isolated = cmd.isIsolated();
 
         if (intervalType == null) {
             throw new CloudRuntimeException("Invalid interval type provided");
@@ -738,8 +827,12 @@ public BackupSchedule configureBackupSchedule(CreateBackupScheduleCmd cmd) {
 
         final int maxBackups = validateAndGetDefaultBackupRetentionIfRequired(cmd.getMaxBackups(), offering, vm);
 
-        if (!"nas".equals(offering.getProvider()) && cmd.getQuiesceVM() != null) {
-            throw new InvalidParameterValueException("Quiesce VM option is supported only for NAS backup provider");
+        if (isolated && !KBOSS_BACKUP_PROVIDER.equals(offering.getProvider())) {
+            throw new InvalidParameterValueException("Isolated backups are only supported by KBOSS backup provider.");
+        }
+
+        if (!quiesceSupported.contains(offering.getProvider()) && cmd.getQuiesceVM() != null) {
+            throw new InvalidParameterValueException("Quiesce VM option is supported only by NAS and KBOSS backup providers.");
         }
 
         final String timezoneId = timeZone.getID();
@@ -756,7 +849,8 @@ public BackupSchedule configureBackupSchedule(CreateBackupScheduleCmd cmd) {
 
         final BackupScheduleVO schedule = backupScheduleDao.findByVMAndIntervalType(vmId, intervalType);
         if (schedule == null) {
-            return backupScheduleDao.persist(new BackupScheduleVO(vmId, intervalType, scheduleString, timezoneId, nextDateTime, maxBackups, cmd.getQuiesceVM(), vm.getAccountId(), vm.getDomainId()));
+            return backupScheduleDao.persist(new BackupScheduleVO(vmId, intervalType, scheduleString, timezoneId, nextDateTime, maxBackups, cmd.getQuiesceVM(), vm.getAccountId(),
+                    vm.getDomainId(), isolated));
         }
 
         schedule.setScheduleType((short) intervalType.ordinal());
@@ -765,6 +859,7 @@ public BackupSchedule configureBackupSchedule(CreateBackupScheduleCmd cmd) {
         schedule.setScheduledTimestamp(nextDateTime);
         schedule.setMaxBackups(maxBackups);
         schedule.setQuiesceVM(cmd.getQuiesceVM());
+        schedule.setIsolated(isolated);
         backupScheduleDao.update(schedule.getId(), schedule);
         return backupScheduleDao.findById(schedule.getId());
     }
@@ -917,7 +1012,6 @@ protected boolean deleteAllVmBackupSchedules(long vmId) {
     public boolean createBackup(CreateBackupCmd cmd, Object job) throws ResourceAllocationException {
         Long vmId = cmd.getVmId();
         Account caller = CallContext.current().getCallingAccount();
-
         final VMInstanceVO vm = findVmById(vmId);
         validateBackupForZone(vm.getDataCenterId());
         accountManager.checkAccess(caller, null, true, vm);
@@ -940,8 +1034,8 @@ public boolean createBackup(CreateBackupCmd cmd, Object job) throws ResourceAllo
             throw new CloudRuntimeException("The assigned backup offering does not allow ad-hoc user backup");
         }
 
-        if (!"nas".equals(offering.getProvider()) && cmd.getQuiesceVM() != null) {
-            throw new InvalidParameterValueException("Quiesce VM option is supported only for NAS backup provider");
+        if (!quiesceSupported.contains(offering.getProvider()) && cmd.getQuiesceVM() != null) {
+            throw new InvalidParameterValueException("Quiesce VM option is supported only by NAS and KBOSS backup providers");
         }
 
         Long backupScheduleId = getBackupScheduleId(job);
@@ -973,7 +1067,7 @@ private void createCheckedBackup(CreateBackupCmd cmd, Account owner, boolean isS
              CheckedReservation backupStorageReservation = new CheckedReservation(owner,
                      Resource.ResourceType.backup_storage, backupSize, reservationDao, resourceLimitMgr)) {
 
-            Pair<Boolean, Backup> result = backupProvider.takeBackup(vm, cmd.getQuiesceVM());
+            Pair<Boolean, Backup> result = backupProvider.takeBackup(vm, cmd.getQuiesceVM(), cmd.isIsolated());
             if (!result.first()) {
                 throw new CloudRuntimeException("Failed to create Instance Backup");
             }
@@ -1137,6 +1231,9 @@ public Pair<List<Backup>, Integer> listBackups(final ListBackupsCmd cmd) {
         sb.and("name", sb.entity().getName(), SearchCriteria.Op.EQ);
         sb.and("zoneId", sb.entity().getZoneId(), SearchCriteria.Op.EQ);
         sb.and("backupOfferingId", sb.entity().getBackupOfferingId(), SearchCriteria.Op.EQ);
+        // Tombstoned chain backups (Status.Hidden) are never shown to users; they exist only so the
+        // incremental chain GC can sweep them once their last descendant is deleted.
+        sb.and("statusNeq", sb.entity().getStatus(), SearchCriteria.Op.NEQ);
         sb.and("backupStatus", sb.entity().getStatus(), SearchCriteria.Op.EQ);
 
         if (keyword != null) {
@@ -1149,6 +1246,7 @@ public Pair<List<Backup>, Integer> listBackups(final ListBackupsCmd cmd) {
 
         SearchCriteria<BackupVO> sc = sb.create();
         accountManager.buildACLSearchCriteria(sc, domainId, isRecursive, permittedAccounts, listProjectResourcesCriteria);
+        sc.setParameters("statusNeq", Backup.Status.Hidden);
 
         if (id != null) {
             sc.setParameters("id", id);
@@ -1183,14 +1281,14 @@ public Pair<List<Backup>, Integer> listBackups(final ListBackupsCmd cmd) {
     }
 
     public boolean importRestoredVM(long zoneId, long domainId, long accountId, long userId,
-                                    String vmInternalName, Hypervisor.HypervisorType hypervisorType, Backup backup) {
+                                    String vmInternalName, Hypervisor.HypervisorType hypervisorType, Backup backup, BackupOffering offering) {
         VirtualMachine vm = null;
         HypervisorGuru guru = hypervisorGuruManager.getGuru(hypervisorType);
         try {
-            vm = guru.importVirtualMachineFromBackup(zoneId, domainId, accountId, userId, vmInternalName, backup);
+            vm = guru.importVirtualMachineFromBackup(zoneId, domainId, accountId, userId, vmInternalName, backup, getBackupProvider(offering.getProvider()));
         } catch (final Exception e) {
             logger.error(String.format("Failed to import VM [vmInternalName: %s] from backup restoration [%s] with hypervisor [type: %s] due to: [%s].", vmInternalName,
-                    ReflectionToStringBuilderUtils.reflectOnlySelectedFields(backup, "id", "uuid", "vmId", "externalId", "backupType"), hypervisorType, e.getMessage()), e);
+                    ReflectionToStringBuilderUtils.reflectOnlySelectedFields(backup, "id", "uuid", "vmId", "externalId", "type"), hypervisorType, e.getMessage()), e);
             ActionEventUtils.onCompletedActionEvent(User.UID_SYSTEM, vm.getAccountId(), EventVO.LEVEL_ERROR, EventTypes.EVENT_VM_BACKUP_RESTORE,
                     String.format("Failed to import Instance %s from Backup %s with hypervisor [type: %s]", vmInternalName, backup.getUuid(), hypervisorType),
                     vm.getId(), ApiCommandResourceType.VirtualMachine.toString(),0);
@@ -1212,7 +1310,7 @@ public boolean importRestoredVM(long zoneId, long domainId, long accountId, long
 
     @Override
     @ActionEvent(eventType = EventTypes.EVENT_VM_BACKUP_RESTORE, eventDescription = "restoring Instance from Backup", async = true)
-    public boolean restoreBackup(final Long backupId) {
+    public boolean restoreBackup(final Long backupId, boolean quickRestore, Long hostId) {
         final BackupVO backup = backupDao.findById(backupId);
         if (backup == null) {
             throw new CloudRuntimeException("Backup " + backupId + " does not exist");
@@ -1226,38 +1324,62 @@ public boolean restoreBackup(final Long backupId) {
         if (vm == null || VirtualMachine.State.Expunging.equals(vm.getState())) {
             throw new CloudRuntimeException("The Instance from which the backup was taken could not be found.");
         }
-        accountManager.checkAccess(CallContext.current().getCallingAccount(), null, true, vm);
+
+        Account callerAccount = CallContext.current().getCallingAccount();
+        accountManager.checkAccess(callerAccount, null, true, vm);
+        validateHostIdParameter(hostId, callerAccount);
 
         if (vm.getRemoved() == null && !vm.getState().equals(VirtualMachine.State.Stopped) &&
                 !vm.getState().equals(VirtualMachine.State.Destroyed)) {
             throw new CloudRuntimeException("Existing Instance should be stopped before being restored from Backup");
         }
 
-        // This is done to handle historic backups if any with Veeam / Networker plugins
-        List<Backup.VolumeInfo> backupVolumes = CollectionUtils.isEmpty(backup.getBackedUpVolumes()) ?
-                vm.getBackupVolumeList() : backup.getBackedUpVolumes();
-        List<VolumeVO> vmVolumes = volumeDao.findByInstance(vm.getId());
-        if (vmVolumes.size() != backupVolumes.size()) {
-            throw new CloudRuntimeException("Unable to restore Instance with the current Backup as the Backup has different number of disks to the Instance");
-        }
-
-        BackupOffering offering = backupOfferingDao.findByIdIncludingRemoved(vm.getBackupOfferingId());
-        String errorMessage = "Failed to find backup offering of the VM backup.";
-        if (offering == null) {
-            logger.warn(errorMessage);
-        }
         logger.debug("Attempting to get backup offering from VM backup");
-        offering = backupOfferingDao.findByIdIncludingRemoved(backup.getBackupOfferingId());
+        BackupOffering offering = backupOfferingDao.findByIdIncludingRemoved(backup.getBackupOfferingId());
         if (offering == null) {
-            throw new CloudRuntimeException(errorMessage);
+            throw new CloudRuntimeException("Failed to find backup offering of the VM backup.");
         }
+        validateBackupVolumes(backup, vm, offering);
         String backupDetailsInMessage = ReflectionToStringBuilderUtils.reflectOnlySelectedFields(backup, "uuid", "externalId", "vmId", "name");
-        tryRestoreVM(backup, vm, offering, backupDetailsInMessage);
+        tryRestoreVM(backup, vm, offering, backupDetailsInMessage, quickRestore, hostId);
+
+        updateStates(vm, getBackupProvider(offering.getProvider()), quickRestore);
+
+        return importRestoredVM(vm.getDataCenterId(), vm.getDomainId(), vm.getAccountId(), vm.getUserId(),
+                vm.getInstanceName(), vm.getHypervisorType(), backup, offering);
+    }
+
+    private void validateHostIdParameter(Long hostId, Account callerAccount) {
+        if (hostId != null && !accountService.isRootAdmin(callerAccount.getId())) {
+            throw new PermissionDeniedException(String.format("Parameter %s can only be specified by a Root Admin", ApiConstants.HOST_ID));
+        }
+    }
+
+    /**
+     * Updates the VM and volume states.
+     * If using quick restore, the states should already be set (the VM should be running).
+     * Only KBOSS supports this parameter for now; will do nothing if the backup provider is KBOSS and quickRestore is true.
+     * */
+    private void updateStates(VMInstanceVO vm, BackupProvider backupProvider, boolean quickRestore) {
+        if (KBOSS_BACKUP_PROVIDER.equals(backupProvider.getName()) && quickRestore) {
+            return;
+        }
         updateVolumeState(vm, Volume.Event.RestoreSucceeded, Volume.State.Ready);
         updateVmState(vm, VirtualMachine.Event.RestoringSuccess, VirtualMachine.State.Stopped);
+    }
 
-        return importRestoredVM(vm.getDataCenterId(), vm.getDomainId(), vm.getAccountId(), vm.getUserId(),
-                vm.getInstanceName(), vm.getHypervisorType(), backup);
+    protected void validateBackupVolumes(BackupVO backup, VMInstanceVO vm, BackupOffering offering) {
+        BackupProvider backupProvider = getBackupProvider(offering.getProvider());
+        if (KBOSS_BACKUP_PROVIDER.equals(backupProvider.getName())) {
+            return;
+        }
+        // This is done to handle historic backups if any with Veeam / Networker plugins
+        List<Backup.VolumeInfo> backupVolumes = CollectionUtils.isEmpty(backup.getBackedUpVolumes()) ?
+                vm.getBackupVolumeList() : backup.getBackedUpVolumes();
+        List<VolumeVO> vmVolumes = volumeDao.findByInstance(vm.getId());
+        if (vmVolumes.size() != backupVolumes.size()) {
+            throw new CloudRuntimeException("Unable to restore Instance with the current Backup as the Backup has different number of disks to the Instance");
+        }
     }
 
     /**
@@ -1267,7 +1389,7 @@ public boolean restoreBackup(final Long backupId) {
      *
      * If restore fails, then update the VM state to {@link VirtualMachine.Event#RestoringFailed}, and its volumes to {@link Volume.Event#RestoreFailed} and throw an {@link CloudRuntimeException}.
      */
-    protected void tryRestoreVM(BackupVO backup, VMInstanceVO vm, BackupOffering offering, String backupDetailsInMessage) {
+    protected void tryRestoreVM(BackupVO backup, VMInstanceVO vm, BackupOffering offering, String backupDetailsInMessage, boolean quickRestore, Long hostId) {
         try {
             updateVmState(vm, VirtualMachine.Event.RestoringRequested, VirtualMachine.State.Restoring);
             updateVolumeState(vm, Volume.Event.RestoreRequested, Volume.State.Restoring);
@@ -1277,7 +1399,7 @@ protected void tryRestoreVM(BackupVO backup, VMInstanceVO vm, BackupOffering off
                     true, 0);
 
             final BackupProvider backupProvider = getBackupProvider(offering.getProvider());
-            if (!backupProvider.restoreVMFromBackup(vm, backup)) {
+            if (!backupProvider.restoreVMFromBackup(vm, backup, quickRestore, hostId)) {
                 ActionEventUtils.onCompletedActionEvent(User.UID_SYSTEM, vm.getAccountId(), EventVO.LEVEL_ERROR, EventTypes.EVENT_VM_BACKUP_RESTORE,
                         String.format("Failed to restore Instance %s from Backup %s", vm.getInstanceName(), backup.getUuid()),
                         vm.getId(), ApiCommandResourceType.VirtualMachine.toString(),0);
@@ -1289,6 +1411,9 @@ protected void tryRestoreVM(BackupVO backup, VMInstanceVO vm, BackupOffering off
             logger.error(String.format("Failed to restore backup [%s] due to: [%s].", backupDetailsInMessage, e.getMessage()), e);
             updateVolumeState(vm, Volume.Event.RestoreFailed, Volume.State.Ready);
             updateVmState(vm, VirtualMachine.Event.RestoringFailed, VirtualMachine.State.Stopped);
+            if (e instanceof BackupProviderException) {
+                throw e;
+            }
             throw new CloudRuntimeException(String.format("Error restoring Instance from Backup [%s].", backupDetailsInMessage));
         }
     }
@@ -1499,7 +1624,7 @@ public Boolean canCreateInstanceFromBackupAcrossZones(final Long backupId) {
     }
 
     @Override
-    public boolean restoreBackupToVM(final Long backupId, final Long vmId) throws CloudRuntimeException {
+    public boolean restoreBackupToVM(final Long backupId, final Long vmId, boolean quickRestore) throws CloudRuntimeException {
         final BackupVO backup = backupDao.findById(backupId);
         if (backup == null) {
             throw new CloudRuntimeException("Backup " + backupId + " does not exist");
@@ -1541,6 +1666,10 @@ public boolean restoreBackupToVM(final Long backupId, final Long vmId) throws Cl
             throw new CloudRuntimeException("Create instance from backup is not supported by the " + offering.getProvider() + " provider.");
         }
 
+        if (quickRestore && !backupProvider.getName().equals(KBOSS_BACKUP_PROVIDER)) {
+            throw new CloudRuntimeException("Quick restore is only supported by KBOSS.");
+        }
+
         String backupDetailsInMessage = ReflectionToStringBuilderUtils.reflectOnlySelectedFields(backup, "uuid", "externalId", "name");
         Pair<Boolean, String> result = null;
         Long eventId = null;
@@ -1554,12 +1683,12 @@ public boolean restoreBackupToVM(final Long backupId, final Long vmId) throws Cl
 
             String host = null;
             String dataStore = null;
-            if (!"nas".equals(offering.getProvider())) {
+            if (!providersThatIgnoreHostAndDatastore.contains(offering.getProvider())) {
                 Pair<HostVO, StoragePoolVO> restoreInfo = getRestoreVolumeHostAndDatastore(vm);
                 host = restoreInfo.first().getPrivateIpAddress();
                 dataStore = restoreInfo.second().getUuid();
             }
-            result = backupProvider.restoreBackupToVM(vm, backup, host, dataStore);
+            result = backupProvider.restoreBackupToVM(vm, backup, host, dataStore, quickRestore);
 
         } catch (Exception e) {
             logger.error(String.format("Failed to create Instance [%s] from backup [%s] due to: [%s]", vm.getInstanceName(), backupDetailsInMessage, e.getMessage()), e);
@@ -1574,8 +1703,7 @@ public boolean restoreBackupToVM(final Long backupId, final Long vmId) throws Cl
             throw new CloudRuntimeException(error_msg);
         }
 
-        updateVolumeState(vm, Volume.Event.RestoreSucceeded, Volume.State.Ready);
-        updateVmState(vm, VirtualMachine.Event.RestoringSuccess, VirtualMachine.State.Stopped);
+        updateStates(vm, backupProvider, quickRestore);
         ActionEventUtils.onCompletedActionEvent(User.UID_SYSTEM, vm.getAccountId(), EventVO.LEVEL_INFO, EventTypes.EVENT_VM_CREATE_FROM_BACKUP,
                 String.format("Successfully created Instance %s from backup %s", vm.getInstanceName(), backup.getUuid()),
                 vm.getId(), ApiCommandResourceType.VirtualMachine.toString(),eventId);
@@ -1584,7 +1712,8 @@ public boolean restoreBackupToVM(final Long backupId, final Long vmId) throws Cl
 
     @Override
     @ActionEvent(eventType = EventTypes.EVENT_VM_BACKUP_RESTORE_VOLUME_TO_VM, eventDescription = "restoring Volume from Backup to Instance", async = true)
-    public boolean restoreBackupVolumeAndAttachToVM(final String backedUpVolumeUuid, final Long backupId, final Long vmId) throws Exception {
+    public boolean restoreBackupVolumeAndAttachToVM(final String backedUpVolumeUuid, final Long backupId, final Long vmId, boolean isQuickRestore,
+            Long hostId) throws Exception {
         if (StringUtils.isEmpty(backedUpVolumeUuid)) {
             throw new CloudRuntimeException("Invalid volume ID passed");
         }
@@ -1598,10 +1727,12 @@ public boolean restoreBackupVolumeAndAttachToVM(final String backedUpVolumeUuid,
         validateBackupForZone(backup.getZoneId());
 
         final VMInstanceVO vm = findVmById(vmId);
-        accountManager.checkAccess(CallContext.current().getCallingAccount(), null, true, vm);
+        Account callerAccount = CallContext.current().getCallingAccount();
+        accountManager.checkAccess(callerAccount, null, true, vm);
+        validateHostIdParameter(hostId, callerAccount);
 
         if (vm.getBackupOfferingId() != null && !BackupEnableAttachDetachVolumes.value()) {
-            throw new CloudRuntimeException("The selected Instance has backups, cannot restore and attach Volume to the Instance.");
+            throw new CloudRuntimeException("The selected Instance is attached to a backup offering and, thus, it is not possible to restore and attach Volumes from backups to the Instance.");
         }
 
         if (backup.getZoneId() != vm.getDataCenterId()) {
@@ -1609,8 +1740,8 @@ public boolean restoreBackupVolumeAndAttachToVM(final String backedUpVolumeUuid,
         }
 
         List<Backup.VolumeInfo> volumeInfoList = backup.getBackedUpVolumes();
+        final VMInstanceVO vmFromBackup = vmInstanceDao.findByIdIncludingRemoved(backup.getVmId());
         if (volumeInfoList == null) {
-            final VMInstanceVO vmFromBackup = vmInstanceDao.findByIdIncludingRemoved(backup.getVmId());
             if (vmFromBackup == null) {
                 throw new CloudRuntimeException("Instance reference for the provided Instance backup not found");
             } else if (vmFromBackup == null || vmFromBackup.getBackupVolumeList() == null) {
@@ -1623,19 +1754,26 @@ public boolean restoreBackupVolumeAndAttachToVM(final String backedUpVolumeUuid,
             throw new CloudRuntimeException("Failed to find volume with Id " + backedUpVolumeUuid + " in the backed-up volumes metadata");
         }
 
-        accountManager.checkAccess(CallContext.current().getCallingAccount(), null, true, vm);
+        accountManager.checkAccess(CallContext.current().getCallingAccount(), null, true, vmFromBackup);
         final BackupOffering offering = backupOfferingDao.findByIdIncludingRemoved(backup.getBackupOfferingId());
         if (offering == null) {
             throw new CloudRuntimeException("Failed to find Instance Backup Offering");
         }
 
+        if (!StringUtils.equals(KBOSS_BACKUP_PROVIDER, offering.getProvider()) && !VirtualMachine.PowerState.PowerOff.equals(vm.getPowerState())) {
+            throw new CloudRuntimeException(String.format("VM [%s] needs to be powered off to restore the volume [%s].", vm.getUuid(), backedUpVolumeUuid));
+        }
+
         BackupProvider backupProvider = getBackupProvider(offering.getProvider());
-        VolumeVO backedUpVolume = volumeDao.findByUuid(backedUpVolumeUuid);
+        VolumeVO backedUpVolume = volumeDao.findByUuidIncludingRemoved(backedUpVolumeUuid);
         Pair<HostVO, StoragePoolVO> restoreInfo;
-        if (!"nas".equals(offering.getProvider()) || (backedUpVolume == null)) {
-            restoreInfo = getRestoreVolumeHostAndDatastore(vm);
-        } else {
+
+        if ("nas".equals(offering.getProvider()) && backedUpVolume != null) {
             restoreInfo = getRestoreVolumeHostAndDatastoreForNas(vm, backedUpVolume);
+        } else if (KBOSS_BACKUP_PROVIDER.equals(offering.getProvider())) {
+            restoreInfo = getRestoreVolumeHostAndDatastoreForKboss(vm, backedUpVolume, isQuickRestore, hostId);
+        } else {
+            restoreInfo = getRestoreVolumeHostAndDatastore(vm);
         }
 
         HostVO host = restoreInfo.first();
@@ -1649,21 +1787,21 @@ public boolean restoreBackupVolumeAndAttachToVM(final String backedUpVolumeUuid,
         String[] hostPossibleValues = {host.getPrivateIpAddress(), host.getName()};
         String[] datastoresPossibleValues = {datastore.getUuid(), datastore.getName()};
 
-        Pair<Boolean, String> result = restoreBackedUpVolume(backupVolumeInfo, backup, backupProvider, hostPossibleValues, datastoresPossibleValues, vm);
+        Pair<Boolean, String> result = restoreBackedUpVolume(backupVolumeInfo, backup, backupProvider, hostPossibleValues, datastoresPossibleValues, vm, isQuickRestore);
 
         if (BooleanUtils.isFalse(result.first())) {
             throw new CloudRuntimeException(String.format("Error restoring Volume [%s] of Instance [%s] to host [%s] using backup provider [%s] due to: [%s].",
                     backedUpVolumeUuid, vm.getUuid(), host.getUuid(), backupProvider.getName(), result.second()));
         }
         if (!attachVolumeToVM(vm.getDataCenterId(), result.second(), backupVolumeInfo,
-                            backedUpVolumeUuid, vm, datastore.getUuid(), backup)) {
+                            backedUpVolumeUuid, vm, datastore.getUuid(), backup, backupProvider)) {
             throw new CloudRuntimeException(String.format("Error attaching Volume [%s] to Instance [%s].", backedUpVolumeUuid, vm.getUuid()));
         }
         return true;
     }
 
     protected Pair<Boolean, String> restoreBackedUpVolume(final Backup.VolumeInfo backupVolumeInfo, final BackupVO backup,
-            BackupProvider backupProvider, String[] hostPossibleValues, String[] datastoresPossibleValues, VMInstanceVO vm) {
+            BackupProvider backupProvider, String[] hostPossibleValues, String[] datastoresPossibleValues, VMInstanceVO vm, boolean quickRestore) {
         Pair<Boolean, String> result = new  Pair<>(false, "");
         for (String hostData : hostPossibleValues) {
             for (String datastoreData : datastoresPossibleValues) {
@@ -1671,7 +1809,7 @@ protected Pair<Boolean, String> restoreBackedUpVolume(final Backup.VolumeInfo ba
                         backupVolumeInfo.getUuid(), hostData, datastoreData));
 
                 try {
-                    result = backupProvider.restoreBackedUpVolume(backup, backupVolumeInfo, hostData, datastoreData, new Pair<>(vm.getName(), vm.getState()));
+                    result = backupProvider.restoreBackedUpVolume(backup, backupVolumeInfo, hostData, datastoreData, new Pair<>(vm.getName(), vm.getState()), vm, quickRestore);
 
                     if (BooleanUtils.isTrue(result.first())) {
                         return result;
@@ -1679,6 +1817,12 @@ protected Pair<Boolean, String> restoreBackedUpVolume(final Backup.VolumeInfo ba
                 } catch (Exception e) {
                     logger.debug(String.format("Failed to restore volume [UUID: %s], using host [%s] and datastore [%s] due to: [%s].",
                             backupVolumeInfo.getUuid(), hostData, datastoreData, e.getMessage()), e);
+                    if (e instanceof BackupProviderException) {
+                        throw e;
+                    }
+                    if (KBOSS_BACKUP_PROVIDER.equals(backupProvider.getName())) {
+                        return result;
+                    }
                 }
             }
         }
@@ -1722,6 +1866,15 @@ private boolean deleteCheckedBackup(Boolean forced, BackupProvider backupProvide
                      reservationDao, resourceLimitMgr)) {
             boolean result = backupProvider.deleteBackup(backup, forced);
             if (result) {
+                // Chain-aware providers (e.g. NAS) physically remove several backups per call
+                // (leaf + swept delete-pending ancestors) and decrement resource count/usage and
+                // remove each DB row themselves, exactly once per removed backup. Decrementing or
+                // removing again here would double-handle and destroy delete-pending tombstones,
+                // so defer entirely to the provider for those.
+                if (backupProvider.handlesChainDeleteResourceAccounting()) {
+                    checkAndGenerateUsageForLastBackupDeletedAfterOfferingRemove(vm, backup);
+                    return true;
+                }
                 resourceLimitMgr.decrementResourceCount(backup.getAccountId(), Resource.ResourceType.backup);
                 resourceLimitMgr.decrementResourceCount(backup.getAccountId(), Resource.ResourceType.backup_storage, backupSize);
                 if (backupDao.remove(backup.getId())) {
@@ -1769,6 +1922,30 @@ private Pair<HostVO, StoragePoolVO> getRestoreVolumeHostAndDatastoreForNas(VMIns
         return new Pair<>(hostVO, storagePoolVO);
     }
 
+    private Pair<HostVO, StoragePoolVO> getRestoreVolumeHostAndDatastoreForKboss(VMInstanceVO vm, VolumeVO backedVolume, boolean quickRestore, Long hostId) {
+        StoragePoolVO storagePool = primaryDataStoreDao.findById(backedVolume.getPoolId());
+        if (vm.getHostId() != null) {
+            hostId = vm.getHostId();
+        } else if (hostId == null || !quickRestore) {
+            if (vm.getLastHostId() != null) {
+                hostId = vm.getLastHostId();
+            } else {
+                if (storagePool == null) {
+                    throw new InvalidParameterValueException(String.format("Storage pool of volume [%s] was not found.", backedVolume.getUuid()));
+                }
+                List<HostVO> listHost =
+                        hostDao.listAllUpAndEnabledNonHAHosts(Host.Type.Routing, storagePool.getClusterId(), storagePool.getPodId(), storagePool.getDataCenterId(), null);
+                return new Pair<>(listHost.stream().findFirst().orElseThrow(() -> new CloudRuntimeException(String.format("Unable to find a host to restore backup for VM " +
+                        "[%s].", vm.getUuid()))), null);
+            }
+        }
+        if (hostId == null) {
+            throw new InvalidParameterValueException(String.format("No host found to quick restore VM [%s]. Please check the logs.", vm.getUuid()));
+        }
+
+        return new Pair<>(hostDao.findById(hostId), storagePool);
+    }
+
     /**
      * Find a host from storage pool access
      */
@@ -1788,14 +1965,14 @@ private HostVO getFirstHostFromStoragePool(StoragePoolVO storagePoolVO) {
      * Attach volume to VM
      */
     private boolean attachVolumeToVM(Long zoneId, String restoredVolumeLocation, Backup.VolumeInfo backupVolumeInfo,
-                                     String volumeUuid, VMInstanceVO vm, String datastoreUuid, Backup backup) throws Exception {
+                                     String volumeUuid, VMInstanceVO vm, String datastoreUuid, Backup backup, BackupProvider backupProvider) throws Exception {
         HypervisorGuru guru = hypervisorGuruManager.getGuru(vm.getHypervisorType());
         backupVolumeInfo.setType(Volume.Type.DATADISK);
 
         logger.info("Attaching the restored Volume {} to Instance {}.", () -> ReflectionToStringBuilder.toString(backupVolumeInfo, ToStringStyle.JSON_STYLE), () -> vm);
         StoragePoolVO pool = primaryDataStoreDao.findByUuid(datastoreUuid);
         try {
-            return guru.attachRestoredVolumeToVirtualMachine(zoneId, restoredVolumeLocation, backupVolumeInfo, vm, pool.getId(), backup);
+            return guru.attachRestoredVolumeToVirtualMachine(zoneId, restoredVolumeLocation, backupVolumeInfo, vm, pool.getId(), backup, backupProvider);
         } catch (Exception e) {
             throw new CloudRuntimeException("Error attach restored Volume to Instance " + vm.getUuid() + " due to: " + e.getMessage());
         }
@@ -1842,6 +2019,7 @@ public BackupProvider getBackupProvider(final Long zoneId) {
         return getBackupProvider(name);
     }
 
+    @Override
     public BackupProvider getBackupProvider(final String name) {
        if (StringUtils.isEmpty(name)) {
            throw new CloudRuntimeException("Invalid backup provider name provided");
@@ -1887,6 +2065,10 @@ public List<Class<?>> getCommands() {
         cmdList.add(ListBackupRepositoriesCmd.class);
         cmdList.add(CreateVMFromBackupCmd.class);
         cmdList.add(CreateVMFromBackupCmdByAdmin.class);
+        cmdList.add(CreateBackupOfferingCmd.class);
+        cmdList.add(DownloadValidationScreenshotCmd.class);
+        cmdList.add(ListBackupServiceJobsCmd.class);
+        cmdList.add(FinishBackupChainCmd.class);
         return cmdList;
     }
 
@@ -2046,6 +2228,7 @@ public void scheduleBackups() {
                 if (quiesceVm != null) {
                     params.put(ApiConstants.QUIESCE_VM, "" + quiesceVm.toString());
                 }
+                params.put(ApiConstants.ISOLATED, String.valueOf(backupSchedule.isIsolated()));
                 params.put("ctxUserId", "1");
                 params.put("ctxAccountId", "" + vm.getAccountId());
                 params.put("ctxStartEventId", String.valueOf(eventId));
@@ -2441,6 +2624,15 @@ public BackupResponse createBackupResponse(Backup backup, Boolean listVmDetails)
         response.setProtectedSize(backup.getProtectedSize());
         response.setStatus(backup.getStatus());
         response.setIntervalType("MANUAL");
+        if (backup.getCompressionStatus() != null) {
+            response.setCompressionStatus(backup.getCompressionStatus());
+            if (backup.getUncompressedSize() != null && backup.getUncompressedSize() > 0) {
+                response.setUncompressedSize(backup.getUncompressedSize());
+            }
+        }
+        if (backup.getValidationStatus() != null) {
+            response.setValidationStatus(backup.getValidationStatus());
+        }
         if (backup.getBackupScheduleId() != null) {
             BackupScheduleVO scheduleVO = backupScheduleDao.findById(backup.getBackupScheduleId());
             if (scheduleVO != null) {
@@ -2494,9 +2686,14 @@ public CapacityVO getBackupStorageUsedStats(Long zoneId) {
         if (isDisabled(zoneId)) {
             return new CapacityVO(null, zoneId, null, null, 0L, 0L, Capacity.CAPACITY_TYPE_BACKUP_STORAGE);
         }
-        final BackupProvider backupProvider = getBackupProvider(zoneId);
-        Pair<Long, Long> backupUsage = backupProvider.getBackupStorageStats(zoneId);
-        return new CapacityVO(null, zoneId, null, null, backupUsage.first(), backupUsage.second(), Capacity.CAPACITY_TYPE_BACKUP_STORAGE);
+        try {
+            final BackupProvider backupProvider = getBackupProvider(zoneId);
+            Pair<Long, Long> backupUsage = backupProvider.getBackupStorageStats(zoneId);
+            return new CapacityVO(null, zoneId, null, null, backupUsage.first(), backupUsage.second(), Capacity.CAPACITY_TYPE_BACKUP_STORAGE);
+        } catch (CloudRuntimeException e) {
+            logger.warn("Backup provider not found for zone {}: {}", zoneId, e.getMessage());
+            return new CapacityVO(null, zoneId, null, null, 0L, 0L, Capacity.CAPACITY_TYPE_BACKUP_STORAGE);
+        }
     }
 
     @Override
diff --git a/server/src/main/java/org/apache/cloudstack/backup/BackupValidationServiceJobController.java b/server/src/main/java/org/apache/cloudstack/backup/BackupValidationServiceJobController.java
new file mode 100644
index 000000000000..c3594327a6d1
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/backup/BackupValidationServiceJobController.java
@@ -0,0 +1,217 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+package org.apache.cloudstack.backup;
+
+import com.cloud.dc.ClusterVO;
+import com.cloud.dc.DataCenterVO;
+import com.cloud.host.HostVO;
+import com.cloud.utils.Pair;
+import com.cloud.utils.concurrency.NamedThreadFactory;
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.config.Configurable;
+import org.apache.logging.log4j.ThreadContext;
+
+import javax.inject.Inject;
+import javax.naming.ConfigurationException;
+import java.util.ArrayList;
+import java.util.Calendar;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.ScheduledExecutorService;
+import java.util.concurrent.TimeUnit;
+import java.util.stream.Collectors;
+
+public class BackupValidationServiceJobController extends InternalBackupServiceJobController implements Configurable {
+
+    private static final String LOCK = "validation_lock";
+
+    protected ConfigKey<Integer> backupValidationMaxConcurrentOperationsPerHost = new ConfigKey<>("Advanced", Integer.class,
+            "backup.validation.max.concurrent.operations.per.host", "1", "Determines the maximum number of concurrent backup validations per host. Values lower than 0 remove" +
+            " the limit, meaning that as many validations as possible will be done at the same time.", true, ConfigKey.Scope.Cluster);
+
+    protected ConfigKey<Integer> backupValidationMaxConcurrentOperations = new ConfigKey<>("Advanced", Integer.class,
+            "backup.validation.max.concurrent.operations", "10", "Determines the maximum number of concurrent backup validations in the zone. Values lower than 1 remove" +
+            " the limit, meaning that as many validations as possible will be done at the same time.", true, ConfigKey.Scope.Zone);
+
+    protected ConfigKey<Integer> backupValidationInterval = new ConfigKey<>("Advanced", Integer.class,
+            "backup.validation.interval", "24", "Determines the period (in hours) between two backup validations for the same backup.", true, ConfigKey.Scope.Account);
+
+    protected ConfigKey<Integer> backupValidationMaxJobRetries = new ConfigKey<>("Advanced", Integer.class,
+            "backup.validation.max.job.retries", "2", "Determines the maximum number of retries for backup validation jobs. This includes both start validation jobs and " +
+            "finalize validation jobs.", true, ConfigKey.Scope.Account);
+
+    protected ConfigKey<Integer> backupValidationRetryInterval = new ConfigKey<>("Advanced", Integer.class,
+            "backup.validation.retry.interval", "60", "Determines the minimum amount of time (in minutes) to retry a backup validation job. This includes both start " +
+            "validation jobs and finalize validation jobs.", true, ConfigKey.Scope.Account);
+
+    protected ConfigKey<Boolean> backupValidationTaskEnabled = new ConfigKey<>("Advanced", Boolean.class, "backup.validation.task.enabled", "true", "Whether the backup " +
+            "validation task should be running or not. Please set this to false and wait for any validation jobs to finish before restarting the Management Server.", true,
+            ConfigKey.Scope.Account);
+
+    public static ConfigKey<Integer> backupValidationBootDefaultTimeout = new ConfigKey<>("Advanced", Integer.class, "backup.validation.boot.default.timeout", "240",
+            "Default timeout, in seconds, to wait for the validation VM to boot.", true, ConfigKey.Scope.Account);
+
+    public static ConfigKey<Integer> backupValidationScriptDefaultTimeout = new ConfigKey<>("Advanced", Integer.class, "backup.validation.script.default.timeout", "60",
+            "Default timeout, in seconds, to wait for the validation script to finish.", true, ConfigKey.Scope.Account);
+
+    public static ConfigKey<Integer> backupValidationScreenshotDefaultWait = new ConfigKey<>("Advanced", Integer.class, "backup.validation.screenshot.default.wait", "60",
+            "Default period to wait, in seconds, to wait before taking a screenshot of the validating VM.", true, ConfigKey.Scope.Account);
+
+    public static ConfigKey<Boolean> backupValidationEndChainOnFail = new ConfigKey<>("Advanced", Boolean.class, "backup.validation.end.chain.on.fail", "true",
+            "Whether to end the backup chain when the validation fails.", true, ConfigKey.Scope.Account);
+
+    private ExecutorService executor;
+
+    private ScheduledExecutorService scheduledExecutor;
+
+    @Inject
+    private InternalBackupService internalBackupService;
+
+    @Override
+    public boolean configure(String name, Map<String, Object> params) throws ConfigurationException {
+        super.configure(name, params);
+
+        executor = Executors.newCachedThreadPool(new NamedThreadFactory("BackupValidationTask"));
+        scheduledExecutor = Executors.newSingleThreadScheduledExecutor(new NamedThreadFactory("BackupValidationScheduler"));
+        scheduledExecutor.scheduleAtFixedRate(this::run, 60, 60, TimeUnit.SECONDS);
+        this.controllerType = "validation";
+        return true;
+    }
+
+    @Override
+    protected void searchAndDispatchJobs() {
+        try {
+            List<DataCenterVO> zones = dataCenterDao.listEnabledZones();
+            if (!internalBackupServiceJobDao.lockInLockTable(LOCK, 300)) {
+                logger.warn("Unable to get lock for validation jobs.");
+                return;
+            }
+
+            rescheduleLostJobs();
+
+            if (!backupValidationTaskEnabled.value()) {
+                logger.debug("Backup validation task is disabled. Not running.");
+                return;
+            }
+
+            for (DataCenterVO zone : zones) {
+                if (!isFrameworkEnabledForZone(zone)) {
+                    logger.debug("Backup framework is not enabled for zone [{}], will not run the backup validation task for this zone.", zone.getUuid());
+                    continue;
+                }
+                List<InternalBackupServiceJobVO> jobsToStart = internalBackupServiceJobDao.listWaitingJobsAndScheduledToBeforeNow(zone.getId(), InternalBackupServiceJobType.BackupValidation);
+                jobsToStart = filterJobsOfDomainsAndAccountsWithDisabledValidationTask(jobsToStart);
+                if (jobsToStart.isEmpty()) {
+                    continue;
+                }
+                logger.debug("Found [{}] validation jobs to submit.", jobsToStart.size());
+                Pair<HashMap<HostVO, Long>, Integer> hostToNumberOfExecutingJobsAndTotalExecutingJobs = getHostToNumberOfExecutingJobsAndTotalExecutingJobs(zone, InternalBackupServiceJobType.BackupValidation);
+                jobsToStart = thinJobsToStartList(zone, jobsToStart, hostToNumberOfExecutingJobsAndTotalExecutingJobs.second(), backupValidationMaxConcurrentOperations);
+
+                List<Pair<HostVO, Long>> hostAndNumberOfJobsPairList = filterHostsWithTooManyJobs(hostToNumberOfExecutingJobsAndTotalExecutingJobs.first(), backupValidationMaxConcurrentOperationsPerHost);
+                Set<Long> busyInstances = internalBackupServiceJobDao.listExecutingJobsByZoneIdAndJobType(zone.getId(), InternalBackupServiceJobType.BackupValidation)
+                                .stream().map(InternalBackupServiceJobVO::getInstanceId).collect(Collectors.toSet());
+
+                submitQueuedJobsForExecution(jobsToStart, hostAndNumberOfJobsPairList, busyInstances, backupValidationMaxConcurrentOperationsPerHost, zone.getId());
+            }
+
+            ThreadContext.pop();
+        } catch (Exception e) {
+            logger.error("Caught exception [{}] while trying to search and dispatch backup validation jobs.", e.getMessage(), e);
+        } finally {
+            internalBackupServiceJobDao.unlockFromLockTable(LOCK);
+        }
+    }
+
+    @Override
+    protected void submitQueuedJob(InternalBackupServiceJobVO job, long zoneId, String logId) {
+        executor.submit(() -> startBackupValidation(job, zoneId, logId));
+    }
+
+    @Override
+    protected List<InternalBackupServiceJobVO> getLostJobs(ClusterVO clusterVO, Calendar date, List<HostVO> hostVOS) {
+        date.add(Calendar.SECOND, (int)Math.round(InternalBackupProvider.backupValidationTimeout.valueIn(clusterVO.getId()) * -RESCHEDULE_TO_TIMEOUT_RATIO));
+        List<InternalBackupServiceJobVO> result = internalBackupServiceJobDao.listExecutingJobsByHostsAndStartTimeBeforeAndTypeIn(hostVOS.stream().map(HostVO::getId).toArray(),
+                date.getTime(), InternalBackupServiceJobType.BackupValidation);
+        logger.info("Got [{}] lost backup validation jobs.", result.size());
+        if (result.isEmpty()) {
+            return result;
+        }
+        logger.debug("Lost backups validation jobs found: {}", result);
+        return result;
+    }
+
+    private void startBackupValidation(InternalBackupServiceJobVO job, long zoneId, String logId) {
+        boolean result = false;
+        try {
+            ThreadContext.push(BACKUP_JOB + job.getId());
+            ThreadContext.put(LOGCONTEXTID, logId);
+            result = internalBackupService.validateBackup(job.getBackupId(), job.getHostId(), zoneId);
+            if (result) {
+                scheduleNextValidation(job);
+            }
+        } catch (Exception e) {
+            logger.error("Caught exception [{}] while trying to validate backup [{}].", e.getMessage(), job.getBackupId(), e);
+        } finally {
+            processJobResult(job, result);
+            ThreadContext.clearAll();
+        }
+    }
+
+    protected List<InternalBackupServiceJobVO> filterJobsOfDomainsAndAccountsWithDisabledValidationTask(List<InternalBackupServiceJobVO> jobsToFilter) {
+        ArrayList<InternalBackupServiceJobVO> filteredJobs = new ArrayList<>();
+        for (InternalBackupServiceJobVO job : jobsToFilter) {
+            if (backupValidationTaskEnabled.valueIn(job.getAccountId())) {
+                filteredJobs.add(job);
+            }
+        }
+        return filteredJobs;
+    }
+
+    private void scheduleNextValidation(InternalBackupServiceJobVO job) {
+        Calendar nextValidation = Calendar.getInstance();
+        nextValidation.add(Calendar.HOUR, backupValidationInterval.valueIn(job.getAccountId()));
+        internalBackupServiceJobDao.persist(new InternalBackupServiceJobVO(job.getBackupId(), job.getZoneId(), job.getInstanceId(), job.getAccountId(),
+                InternalBackupServiceJobType.BackupValidation, nextValidation.getTime()));
+    }
+
+    @Override
+    public String getConfigComponentName() {
+        return BackupValidationServiceJobController.class.getSimpleName();
+    }
+
+    @Override
+    protected int getMaxAttempts(InternalBackupServiceJobVO jobVo) {
+        return backupValidationMaxJobRetries.valueIn(jobVo.getAccountId());
+    }
+
+    @Override
+    protected int getRetryInterval(InternalBackupServiceJobVO jobVo) {
+        return backupValidationRetryInterval.valueIn(jobVo.getAccountId());
+    }
+
+    @Override
+    public ConfigKey<?>[] getConfigKeys() {
+        return new ConfigKey[] {backupValidationInterval, backupValidationTaskEnabled, backupValidationMaxConcurrentOperationsPerHost, backupValidationBootDefaultTimeout,
+                backupValidationScriptDefaultTimeout, backupValidationScreenshotDefaultWait, backupValidationEndChainOnFail, backupValidationMaxConcurrentOperations,
+                backupValidationMaxJobRetries, backupValidationRetryInterval};
+    }
+}
diff --git a/server/src/main/java/org/apache/cloudstack/backup/InternalBackupServiceImpl.java b/server/src/main/java/org/apache/cloudstack/backup/InternalBackupServiceImpl.java
new file mode 100644
index 000000000000..12088c76de3c
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/backup/InternalBackupServiceImpl.java
@@ -0,0 +1,365 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+import com.cloud.agent.api.to.DataTO;
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.storage.DataStoreRole;
+import com.cloud.storage.Storage;
+import com.cloud.storage.Upload;
+import com.cloud.storage.Volume;
+import com.cloud.storage.VolumeVO;
+import com.cloud.storage.dao.VolumeDao;
+import com.cloud.uservm.UserVm;
+import com.cloud.utils.Pair;
+import com.cloud.utils.ReflectionUse;
+import com.cloud.utils.component.ComponentLifecycleBase;
+import com.cloud.utils.db.Transaction;
+import com.cloud.utils.db.TransactionCallback;
+import com.cloud.utils.db.TransactionLegacy;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.VirtualMachineManager;
+import com.cloud.vm.VmWork;
+import com.cloud.vm.VmWorkDeleteBackup;
+import com.cloud.vm.VmWorkJobHandler;
+import com.cloud.vm.VmWorkJobHandlerProxy;
+import com.cloud.vm.VmWorkRestoreBackup;
+import com.cloud.vm.VmWorkRestoreVolumeBackupAndAttach;
+import com.cloud.vm.VmWorkTakeBackup;
+import com.cloud.vm.dao.UserVmDao;
+import com.cloud.vm.snapshot.VMSnapshot;
+import org.apache.cloudstack.api.response.ExtractResponse;
+import org.apache.cloudstack.backup.dao.BackupDao;
+import org.apache.cloudstack.backup.dao.BackupDetailsDao;
+import org.apache.cloudstack.backup.dao.InternalBackupJoinDao;
+import org.apache.cloudstack.backup.dao.InternalBackupStoragePoolDao;
+import org.apache.cloudstack.backup.to.BackupScreenshotObject;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreManager;
+import org.apache.cloudstack.framework.jobs.AsyncJobManager;
+import org.apache.cloudstack.jobs.JobInfo;
+import org.apache.cloudstack.storage.command.DeleteCommand;
+import org.apache.cloudstack.storage.command.RevertSnapshotCommand;
+import org.apache.cloudstack.storage.datastore.db.ImageStoreObjectDownloadDao;
+import org.apache.cloudstack.storage.datastore.db.ImageStoreObjectDownloadVO;
+import org.apache.cloudstack.storage.image.datastore.ImageStoreEntity;
+import org.apache.cloudstack.backup.to.BackupScreenshotTO;
+import org.apache.cloudstack.storage.to.VolumeObjectTO;
+import org.apache.commons.collections4.CollectionUtils;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import javax.inject.Inject;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Set;
+
+public class InternalBackupServiceImpl extends ComponentLifecycleBase implements InternalBackupService, VmWorkJobHandler {
+    protected Logger logger = LogManager.getLogger(getClass());
+
+    @Inject
+    private InternalBackupStoragePoolDao internalBackupStoragePoolDao;
+
+    @Inject
+    private BackupManager backupManager;
+    @Inject
+    private BackupDao backupDao;
+    @Inject
+    private AsyncJobManager jobManager;
+    @Inject
+    private UserVmDao userVmDao;
+    @Inject
+    private VirtualMachineManager virtualMachineManager;
+    @Inject
+    private VolumeDao volumeDao;
+    @Inject
+    private InternalBackupJoinDao internalBackupJoinDao;
+    @Inject
+    private BackupDetailsDao backupDetailDao;
+
+    @Inject
+    private ImageStoreObjectDownloadDao imageStoreObjectDownloadDao;
+
+    @Inject
+    private DataStoreManager dataStoreMgr;
+
+    private VmWorkJobHandlerProxy jobHandlerProxy = new VmWorkJobHandlerProxy(this);
+    private HashMap<String, InternalBackupProvider> internalBackupProviderMap = new HashMap<>();
+    private List<InternalBackupProvider> internalBackupProviders;
+
+    public void setInternalBackupProviders(final List<InternalBackupProvider> internalBackupProviders) {
+        this.internalBackupProviders = internalBackupProviders;
+    }
+
+    @Override
+    public boolean start() {
+        super.start();
+
+        if (internalBackupProviders != null) {
+            for (InternalBackupProvider internalBackupProvider : internalBackupProviders) {
+                internalBackupProviderMap.put(internalBackupProvider.getName().toLowerCase(), internalBackupProvider);
+            }
+        }
+        return true;
+    }
+
+    @Override
+    public void configureChainInfo(DataTO volumeTo, Command cmd) {
+        if (!(volumeTo instanceof VolumeObjectTO)) {
+            return;
+        }
+        VolumeObjectTO volumeObjectTO = (VolumeObjectTO) volumeTo;
+        InternalBackupStoragePoolVO backupDelta = internalBackupStoragePoolDao.findOneByVolumeId(volumeObjectTO.getVolumeId());
+        if (backupDelta == null) {
+            return;
+        }
+        volumeObjectTO.setChainInfo(backupDelta.getBackupDeltaParentPath());
+        if (cmd instanceof DeleteCommand) {
+            ((DeleteCommand) cmd).setDeleteChain(true);
+        }
+        if (cmd instanceof RevertSnapshotCommand) {
+            ((RevertSnapshotCommand) cmd).setDeleteChain(true);
+        }
+        logger.debug("Configured chain info for volume [{}]. Set it as [{}].", volumeObjectTO.getUuid(), volumeObjectTO.getChainInfo());
+    }
+
+    @Override
+    public void cleanupBackupMetadata(long volumeId) {
+        logger.debug("Cleaning up backup metadata for volume [{}].", volumeId);
+        InternalBackupStoragePoolVO delta = internalBackupStoragePoolDao.findOneByVolumeId(volumeId);
+        if (delta == null) {
+            return;
+        }
+        internalBackupStoragePoolDao.expungeByVolumeId(volumeId);
+        if (CollectionUtils.isNotEmpty(internalBackupStoragePoolDao.listByBackupId(delta.getBackupId()))) {
+            return;
+        }
+        InternalBackupJoinVO joinVO = internalBackupJoinDao.findById(delta.getBackupId());
+        logger.debug("Volume [{}] was the last volume with deltas in backup [{}]. Setting the backup as not current and not END_OF_CHAIN.", volumeId, joinVO.getUuid());
+        backupDetailDao.removeDetail(joinVO.getId(), BackupDetailsDao.CURRENT);
+        if (!joinVO.getEndOfChain()) {
+            backupDetailDao.persist(new BackupDetailVO(joinVO.getId(), BackupDetailsDao.END_OF_CHAIN, Boolean.TRUE.toString(), true));
+        }
+    }
+
+
+    @Override
+    public void prepareVolumeForDetach(Volume volume, VirtualMachine virtualMachine) {
+        if (isBackupFrameworkDisabled(virtualMachine)) {
+            return;
+        }
+
+        InternalBackupProvider internalBackupProvider = getInternalBackupProviderForZone(virtualMachine.getDataCenterId());
+        if (internalBackupProvider == null) {
+            return;
+        }
+        internalBackupProvider.prepareVolumeForDetach(volume, virtualMachine);
+    }
+
+    @Override
+    public void prepareVolumeForMigration(Volume volume) {
+        if (volume.getInstanceId() == null) {
+            return;
+        }
+        VirtualMachine virtualMachine = virtualMachineManager.findById(volume.getInstanceId());
+        if (isBackupFrameworkDisabled(virtualMachine)) {
+            return;
+        }
+        InternalBackupProvider internalBackupProvider = getInternalBackupProviderForZone(volume.getDataCenterId());
+        if (internalBackupProvider == null) {
+            return;
+        }
+        internalBackupProvider.prepareVolumeForMigration(volume, virtualMachine);
+    }
+
+    @Override
+    public void updateVolumeId(long oldVolumeId, long newVolumeId) {
+        VolumeVO volumeVO = volumeDao.findById(newVolumeId);
+        if (volumeVO.getInstanceId() == null) {
+            return;
+        }
+        VirtualMachine virtualMachine = virtualMachineManager.findById(volumeVO.getInstanceId());
+        if (isBackupFrameworkDisabled(virtualMachine)) {
+            return;
+        }
+
+        InternalBackupProvider internalBackupProvider = getInternalBackupProviderForZone(virtualMachine.getDataCenterId());
+        if (internalBackupProvider == null) {
+            return;
+        }
+        internalBackupProvider.updateVolumeId(virtualMachine, oldVolumeId, newVolumeId);
+    }
+
+    @Override
+    public void prepareVmForSnapshotRevert(VMSnapshot vmSnapshot) {
+        VirtualMachine virtualMachine = virtualMachineManager.findById(vmSnapshot.getVmId());
+        if (isBackupFrameworkDisabled(virtualMachine)) {
+            return;
+        }
+
+        InternalBackupProvider internalBackupProvider = getInternalBackupProviderForZone(virtualMachine.getDataCenterId());
+        if (internalBackupProvider == null) {
+            return;
+        }
+        internalBackupProvider.prepareVmForSnapshotRevert(vmSnapshot, virtualMachine);
+    }
+
+    /**
+     * Ask the backup provider to get the necessary secondary storages that must be mounted at VM start.
+     * <br/>
+     * Note: This is currently only used for Backup Validation VMs. As they are created with backing files that are on secondary storage.
+     * */
+    @Override
+    public Set<String> getSecondaryStorageUrls(UserVm userVm) {
+        InternalBackupProvider internalBackupProvider = getInternalBackupProviderForZone(userVm.getDataCenterId());
+        if (internalBackupProvider == null) {
+            return Set.of();
+        }
+        return internalBackupProvider.getSecondaryStorageUrls(userVm);
+    }
+
+    @Override
+    public boolean startBackupCompression(long backupId, long hostId, long zoneId) {
+        InternalBackupProvider internalBackupProvider = getInternalBackupProviderForZone(zoneId);
+        if (internalBackupProvider == null) {
+            return false;
+        }
+        return internalBackupProvider.startBackupCompression(backupId, hostId);
+    }
+
+    @Override
+    public boolean finalizeBackupCompression(long backupId, long hostId, long zoneId) {
+        InternalBackupProvider internalBackupProvider = getInternalBackupProviderForZone(zoneId);
+        if (internalBackupProvider == null) {
+            return false;
+        }
+        return internalBackupProvider.finalizeBackupCompression(backupId, hostId);
+    }
+
+    @Override
+    public boolean validateBackup(long backupId, long hostId, long zoneId) {
+        InternalBackupProvider internalBackupProvider = getInternalBackupProviderForZone(zoneId);
+        if (internalBackupProvider == null) {
+            return false;
+        }
+        return internalBackupProvider.validateBackup(backupId, hostId);
+    }
+
+    @Override
+    public ExtractResponse downloadScreenshot(long backupId) {
+        BackupDetailVO screenshotPathDetail = backupDetailDao.findDetail(backupId, BackupDetailsDao.SCREENSHOT_PATH);
+        ExtractResponse response = new ExtractResponse();
+        if (screenshotPathDetail == null) {
+            response.setState(Upload.Status.DOWNLOAD_URL_NOT_CREATED.toString());
+            return response;
+        }
+        BackupDetailVO imageStoreId = backupDetailDao.findDetail(backupId, BackupDetailsDao.IMAGE_STORE_ID);
+        ImageStoreEntity imageStore = (ImageStoreEntity) dataStoreMgr.getDataStore(Long.parseLong(imageStoreId.getValue()), DataStoreRole.Image);
+        String screenshotPath = screenshotPathDetail.getValue();
+        ImageStoreObjectDownloadVO imageStoreObj = imageStoreObjectDownloadDao.findByStoreIdAndPath(Long.parseLong(imageStoreId.getValue()), screenshotPath);
+
+        if (imageStoreObj == null) {
+            BackupScreenshotTO dataTo = new BackupScreenshotTO(imageStore.getTO(), Hypervisor.HypervisorType.KVM, screenshotPath);
+            BackupScreenshotObject objectTo = new BackupScreenshotObject(dataTo, imageStore);
+            String downloadUrl = imageStore.createEntityExtractUrl(screenshotPath, Storage.ImageFormat.PNG, objectTo);
+            imageStoreObj = imageStoreObjectDownloadDao.persist(new ImageStoreObjectDownloadVO(imageStore.getId(), screenshotPath, downloadUrl));
+        }
+
+        if (imageStoreObj != null) {
+            response.setUrl(imageStoreObj.getDownloadUrl());
+            response.setName(screenshotPath.substring(screenshotPath.lastIndexOf("/") + 1));
+            response.setState(Upload.Status.DOWNLOAD_URL_CREATED.toString());
+        } else {
+            response.setState(Upload.Status.DOWNLOAD_URL_NOT_CREATED.toString());
+        }
+        return response;
+    }
+
+    @Override
+    public boolean finishBackupChain(long vmId) {
+        VirtualMachine vm = virtualMachineManager.findById(vmId);
+        if (vm == null) {
+            throw new InvalidParameterValueException(String.format("Unable to find VM with ID [%s].", vmId));
+        }
+        InternalBackupProvider internalBackupProvider = getInternalBackupProviderForZone(vm.getDataCenterId());
+        if (internalBackupProvider == null) {
+            return false;
+        }
+        return internalBackupProvider.finishBackupChain(vm);
+    }
+
+    @Override
+    public Pair<JobInfo.Status, String> handleVmWorkJob(VmWork work) throws Exception {
+        return jobHandlerProxy.handleVmWorkJob(work);
+    }
+
+    @ReflectionUse
+    public Pair<JobInfo.Status, String> orchestrateTakeBackup(VmWorkTakeBackup work) {
+        BackupVO backupVO = backupDao.findById(work.getBackupId());
+        InternalBackupProvider internalBackupProvider = getInternalBackupProviderForZone(backupVO.getZoneId());
+        if (internalBackupProvider == null) {
+            return new Pair<>(JobInfo.Status.FAILED, jobManager.marshallResultObject(Boolean.FALSE));
+        }
+        return new Pair<>(JobInfo.Status.SUCCEEDED, jobManager.marshallResultObject(internalBackupProvider.orchestrateTakeBackup(backupVO, work.isQuiesceVm(), work.isIsolated())));
+    }
+
+    @ReflectionUse
+    public Pair<JobInfo.Status, String> orchestrateDeleteBackup(VmWorkDeleteBackup work) {
+        BackupVO backupVO = backupDao.findById(work.getBackupId());
+        InternalBackupProvider internalBackupProvider = getInternalBackupProviderForZone(backupVO.getZoneId());
+        if (internalBackupProvider == null) {
+            return new Pair<>(JobInfo.Status.FAILED, jobManager.marshallResultObject(Boolean.FALSE));
+        }
+        return new Pair<>(JobInfo.Status.SUCCEEDED, jobManager.marshallResultObject(internalBackupProvider.orchestrateDeleteBackup(backupVO, work.isForced())));
+    }
+
+    @ReflectionUse
+    public Pair<JobInfo.Status, String> orchestrateRestoreVMFromBackup(VmWorkRestoreBackup work) {
+        BackupVO backupVO = backupDao.findById(work.getBackupId());
+        InternalBackupProvider internalBackupProvider = getInternalBackupProviderForZone(backupVO.getZoneId());
+        if (internalBackupProvider == null) {
+            return new Pair<>(JobInfo.Status.FAILED, jobManager.marshallResultObject(Boolean.FALSE));
+        }
+        return new Pair<>(JobInfo.Status.SUCCEEDED, jobManager.marshallResultObject(internalBackupProvider.orchestrateRestoreVMFromBackup(backupVO,
+                userVmDao.findById(work.getVmId()), work.isQuickRestore(), work.getHostId(), true)));
+    }
+
+    @ReflectionUse
+    public Pair<JobInfo.Status, String> orchestrateRestoreBackupVolumeAndAttachToVM(VmWorkRestoreVolumeBackupAndAttach work) {
+        BackupVO backupVO = backupDao.findById(work.getBackupId());
+        InternalBackupProvider internalBackupProvider = getInternalBackupProviderForZone(backupVO.getZoneId());
+        if (internalBackupProvider == null) {
+            return new Pair<>(JobInfo.Status.FAILED, jobManager.marshallResultObject(Boolean.FALSE));
+        }
+        return new Pair<>(JobInfo.Status.SUCCEEDED, jobManager.marshallResultObject(internalBackupProvider.orchestrateRestoreBackedUpVolume(backupVO, userVmDao.findById(work.getVmId()),
+                work.getBackupVolumeInfo(), work.getHostIp(), work.isQuickRestore())));
+    }
+
+    protected InternalBackupProvider getInternalBackupProviderForZone(long zoneId) {
+        return Transaction.execute(TransactionLegacy.CLOUD_DB, (TransactionCallback<InternalBackupProvider>)status -> {
+            BackupProvider backupProvider = backupManager.getBackupProvider(zoneId);
+            return internalBackupProviderMap.get(backupProvider.getName());
+        });
+    }
+
+    protected boolean isBackupFrameworkDisabled(VirtualMachine virtualMachine) {
+        return !BackupManager.BackupFrameworkEnabled.valueIn(virtualMachine.getDataCenterId());
+    }
+}
diff --git a/server/src/main/java/org/apache/cloudstack/backup/InternalBackupServiceJobController.java b/server/src/main/java/org/apache/cloudstack/backup/InternalBackupServiceJobController.java
new file mode 100644
index 000000000000..6c55c078f572
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/backup/InternalBackupServiceJobController.java
@@ -0,0 +1,307 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+package org.apache.cloudstack.backup;
+
+import com.cloud.dc.ClusterVO;
+import com.cloud.dc.DataCenterVO;
+import com.cloud.dc.dao.ClusterDao;
+import com.cloud.dc.dao.DataCenterDao;
+import com.cloud.host.HostVO;
+import com.cloud.host.Status;
+import com.cloud.host.dao.HostDao;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.resource.ResourceState;
+import com.cloud.utils.DateUtil;
+import com.cloud.utils.Pair;
+import com.cloud.utils.UuidUtils;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.db.Transaction;
+import com.cloud.utils.db.TransactionCallbackNoReturn;
+import com.cloud.utils.db.TransactionLegacy;
+import com.cloud.utils.db.TransactionStatus;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.dao.VMInstanceDao;
+import org.apache.cloudstack.backup.dao.BackupDao;
+import org.apache.cloudstack.backup.dao.InternalBackupServiceJobDao;
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.jobs.AsyncJobManager;
+import org.apache.logging.log4j.ThreadContext;
+
+import javax.inject.Inject;
+import java.util.ArrayList;
+import java.util.Calendar;
+import java.util.Comparator;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Set;
+import java.util.UUID;
+
+/**
+ * Abstract class that implements most of the native backup services logic. Classes that implement this one should only implement service specific logic.
+ * */
+public abstract class InternalBackupServiceJobController extends ManagerBase {
+
+    protected static final String LOGCONTEXTID = "logcontextid";
+
+    @Inject
+    protected AsyncJobManager asyncJobManager;
+
+    @Inject
+    protected ClusterDao clusterDao;
+
+    @Inject
+    protected DataCenterDao dataCenterDao;
+
+    @Inject
+    protected HostDao hostDao;
+
+    @Inject
+    protected BackupDao backupDao;
+
+    @Inject
+    private VMInstanceDao instanceDao;
+
+    @Inject
+    protected InternalBackupServiceJobDao internalBackupServiceJobDao;
+
+    protected String controllerType = "abstract";
+
+    protected static final String BACKUP_JOB = "backup-service-job-";
+
+    protected static final double RESCHEDULE_TO_TIMEOUT_RATIO = 2.5;
+
+    protected void run() {
+        ThreadContext.put(LOGCONTEXTID, UuidUtils.first(UUID.randomUUID().toString()));
+        logger.debug("Searching for {} jobs to dispatch.", controllerType);
+
+        if (!asyncJobManager.isAsyncJobsEnabled()) {
+            logger.debug("A management shutdown has been triggered. Not running {} task.", controllerType);
+            return;
+        }
+
+        Transaction.execute(TransactionLegacy.CLOUD_DB, new TransactionCallbackNoReturn() {
+            @Override
+            public void doInTransactionWithoutResult(TransactionStatus status) {
+                searchAndDispatchJobs();
+            }
+        });
+    }
+
+    /**
+     * Reschedule jobs that seem to be stuck. This should run even if the native backup service task is disabled, so that stuck jobs get cleaned if necessary.
+     * */
+    protected void rescheduleLostJobs() {
+        for (DataCenterVO dataCenterVO : dataCenterDao.listAllZones()) {
+            logger.debug("Searching lost {} jobs to reschedule in zone [{}].", controllerType, dataCenterVO.getUuid());
+            for (ClusterVO clusterVO : clusterDao.listByDcHyType(dataCenterVO.getId(), Hypervisor.HypervisorType.KVM.toString())) {
+                List<HostVO> hostVOS = hostDao.findRoutingByClusterId(clusterVO.getId());
+                if (hostVOS.isEmpty()) {
+                    logger.debug("No hosts found in cluster [{}]. Cannot reschedule jobs for it.", clusterVO.getUuid());
+                    continue;
+                }
+                Calendar date = Calendar.getInstance();
+                List<InternalBackupServiceJobVO> lostJobs = getLostJobs(clusterVO, date, hostVOS);
+                if (lostJobs.isEmpty()) {
+                    logger.debug("Found no {} jobs to reschedule for cluster [{}].", controllerType, clusterVO.getUuid());
+                    continue;
+                }
+                logger.debug("Found [{}] {} jobs to reschedule for cluster [{}]. Processing them as failures and rescheduling them.", lostJobs.size(), controllerType,
+                        clusterVO.getUuid());
+                lostJobs.forEach(job -> processJobResult(job, false));
+            }
+        }
+    }
+
+    protected void processJobResult(InternalBackupServiceJobVO job, boolean result) {
+        job.setAttempts(job.getAttempts() + 1);
+        if (result) {
+            logger.debug("{} job [{}] finished with success. Removing it from queue.", controllerType, job);
+            job.setRemoved(DateUtil.now());
+            internalBackupServiceJobDao.update(job);
+            return;
+        }
+
+        BackupVO backupVO = backupDao.findByIdIncludingRemoved(job.getBackupId());
+        if (backupVO.getRemoved() != null) {
+            logger.debug("Backup [{}] is marked as removed. Will not reschedule the {} job for it.", backupVO, controllerType);
+            job.setRemoved(DateUtil.now());
+            internalBackupServiceJobDao.update(job);
+            return;
+        }
+
+        int maxAttempts = getMaxAttempts(job);
+        if (job.getAttempts() >= maxAttempts) {
+            logger.debug("{} job [{}] reached the maximum amount of attempts [{}]. Removing it from queue.", controllerType, job, maxAttempts);
+            job.setRemoved(DateUtil.now());
+            internalBackupServiceJobDao.update(job);
+            return;
+        }
+
+        Calendar calendar = Calendar.getInstance();
+        calendar.setTime(new Date());
+        calendar.add(Calendar.MINUTE, getRetryInterval(job));
+        job.setScheduledStartTime(calendar.getTime());
+        job.setStartTime(null);
+        job.setHostId(null);
+        logger.debug("{} job [{}] failed. Scheduling it to retry at [{}].", controllerType, job, job.getScheduledStartTime());
+        internalBackupServiceJobDao.update(job);
+    }
+
+    /**
+     * Goes through all the executing jobs for the zone and returns a map from up and enabled KVM hosts to the number of executing jobs.
+     */
+    protected Pair<HashMap<HostVO, Long>, Integer> getHostToNumberOfExecutingJobsAndTotalExecutingJobs(DataCenterVO zone, InternalBackupServiceJobType... jobTypes) {
+        List<HostVO> allKvmHostsForZone = hostDao.listAllRoutingHostsByZoneAndHypervisorType(zone.getId(), Hypervisor.HypervisorType.KVM);
+        HashMap<HostVO, Long> hostToNumberOfExecutingJobs = new HashMap<>();
+
+        for (HostVO host : allKvmHostsForZone) {
+            if (host.getStatus() == Status.Up && host.getResourceState() == ResourceState.Enabled) {
+                hostToNumberOfExecutingJobs.put(host, 0L);
+            }
+        }
+
+        List<InternalBackupServiceJobVO> executingJobs = internalBackupServiceJobDao.listExecutingJobsByZoneIdAndJobType(zone.getId(), jobTypes);
+        for (InternalBackupServiceJobVO executingJob : executingJobs) {
+            HostVO host = allKvmHostsForZone.stream().filter(hostVO -> hostVO.getId() == executingJob.getHostId()).findFirst().orElse(null);
+            if (host == null) {
+                logger.error("{} job [{}] is running in an unknown host. This job will be rescheduled in the future.", controllerType, executingJob);
+                continue;
+            } else if (host.getStatus() != Status.Up || host.getResourceState() != ResourceState.Enabled) {
+                logger.warn("{} job [{}] is running in host [{}], which is not up or not enabled. If possible, wait for the job to finish before restarting the Agent.",
+                        controllerType, executingJob, host);
+                continue;
+            }
+
+            hostToNumberOfExecutingJobs.computeIfPresent(host, (hostVO, numberOfJobs) -> numberOfJobs + 1);
+        }
+
+        return new Pair<>(hostToNumberOfExecutingJobs, executingJobs.size());
+    }
+
+    protected List<InternalBackupServiceJobVO> thinJobsToStartList(DataCenterVO zone, List<InternalBackupServiceJobVO> jobsToStart, Integer totalExecutingJobs,
+            ConfigKey<Integer> jobsPerZoneConfiguration) {
+        Integer maxConcurrentJobsInTheZone = jobsPerZoneConfiguration.valueIn(zone.getId());
+        if (maxConcurrentJobsInTheZone < 1) {
+            return jobsToStart;
+        }
+        logger.debug("Since [{}] is set to [{}]. We will only execute up to [{}] at the same time. We already have [{}] executing jobs.",
+                jobsPerZoneConfiguration.toString(), maxConcurrentJobsInTheZone, maxConcurrentJobsInTheZone, totalExecutingJobs);
+
+        if (maxConcurrentJobsInTheZone <= totalExecutingJobs) {
+            logger.debug("We are already executing the maximum amount of jobs in this zone, we will not execute any new jobs.");
+            return List.of();
+        }
+
+        int maxAllowedJobsToStart = maxConcurrentJobsInTheZone - totalExecutingJobs;
+        if (jobsToStart.size() > maxAllowedJobsToStart) {
+            return jobsToStart.subList(0, maxAllowedJobsToStart);
+        }
+        return jobsToStart;
+    }
+
+    protected List<Pair<HostVO, Long>> filterHostsWithTooManyJobs(HashMap<HostVO, Long> hostToNumberOfExecutingJobs, ConfigKey<Integer> jobsPerHostConfiguration) {
+        List<Pair<HostVO, Long>> hostAndNumberOfJobsPairList = new ArrayList<>();
+        for (HostVO host : hostToNumberOfExecutingJobs.keySet()) {
+            Long numberOfJobs = hostToNumberOfExecutingJobs.get(host);
+            hostDao.loadDetails(host);
+            Integer maxConcurrentJobsPerHost = getMaxConcurrentJobsPerHost(jobsPerHostConfiguration, host);
+            if (maxConcurrentJobsPerHost > 0 && numberOfJobs >= maxConcurrentJobsPerHost) {
+                logger.debug("Host [{}] is already executing the maximum number of concurrent {} jobs set in [{}]. Current number of jobs being executed is " +
+                        "[{}], the value for the configuration is [{}].", host, controllerType, jobsPerHostConfiguration.toString(), numberOfJobs, maxConcurrentJobsPerHost);
+                continue;
+            }
+            hostAndNumberOfJobsPairList.add(new Pair<>(host, numberOfJobs));
+        }
+        return hostAndNumberOfJobsPairList;
+    }
+
+    protected Integer getMaxConcurrentJobsPerHost(ConfigKey<Integer> jobsPerHostConfiguration, HostVO host) {
+        if (host.getDetail(jobsPerHostConfiguration.key()) != null) {
+            return Integer.valueOf(host.getDetail(jobsPerHostConfiguration.key()));
+        }
+        return jobsPerHostConfiguration.valueIn(host.getClusterId());
+    }
+
+    /**
+     * Submit StartCompression jobs, this should be called after submitFinalizeJobsForExecution.
+     * */
+    protected void submitQueuedJobsForExecution(List<InternalBackupServiceJobVO> jobsToExecute, List<Pair<HostVO, Long>> hostAndNumberOfJobsPairList,
+            Set<Long> busyInstances, ConfigKey<Integer> maxJobPerHostConfig, long zoneId) {
+        for (InternalBackupServiceJobVO job : jobsToExecute) {
+            if (hostAndNumberOfJobsPairList.isEmpty()) {
+                logger.debug("There are no more available hosts to send [{}] jobs. Will try to submit them later.", job.getType());
+                return;
+            }
+
+            if (busyInstances.contains(job.getInstanceId())) {
+                VirtualMachine vm = instanceDao.findByIdIncludingRemoved(job.getInstanceId());
+                logger.debug("Instance [{}] has another backup service job running, will not schedule a {} job for it now.", vm.getUuid(), controllerType);
+                continue;
+            }
+
+            String logId = UuidUtils.first(UUID.randomUUID().toString());
+            logger.debug("Dispatching backup {} job [{}{}] with logid:{} for backup [{}].", controllerType, BACKUP_JOB, job.getId(), logId, job.getBackupId());
+
+            Pair<HostVO, Long> hostAndNumberOfJobs;
+            hostAndNumberOfJobs = hostAndNumberOfJobsPairList.remove(0);
+            hostAndNumberOfJobs.second(hostAndNumberOfJobs.second()+1);
+            job.setHostId(hostAndNumberOfJobs.first().getId());
+            job.setStartTime(DateUtil.now());
+            internalBackupServiceJobDao.update(job);
+
+            submitQueuedJob(job, zoneId, logId);
+
+            Integer maxJobsPerHost = getMaxConcurrentJobsPerHost(maxJobPerHostConfig, hostAndNumberOfJobs.first());
+            if (hostAndNumberOfJobs.second() < maxJobsPerHost || maxJobsPerHost < 0) {
+                hostAndNumberOfJobsPairList.add(hostAndNumberOfJobs);
+                hostAndNumberOfJobsPairList.sort(Comparator.comparing(Pair::second));
+            }
+            busyInstances.add(job.getInstanceId());
+        }
+    }
+
+
+    protected Boolean isFrameworkEnabledForZone(DataCenterVO zone) {
+        return BackupManager.BackupFrameworkEnabled.valueIn(zone.getId());
+    }
+
+    protected abstract void submitQueuedJob(InternalBackupServiceJobVO job, long zoneId, String logId);
+
+    /**
+     * Implementing classes should override this if they want jobs to be tried more than once.
+     * */
+    protected int getMaxAttempts(InternalBackupServiceJobVO jobVo) {
+        return 1;
+    }
+
+    /**
+     * Implementing classes should override this if the jobs execute more than once. Otherwise, you can leave it as is.
+     * */
+    protected int getRetryInterval(InternalBackupServiceJobVO jobVo) {
+        return -1;
+    }
+
+    /**
+     * Implementing classes should override this so their lost jobs are caught and rescheduled, otherwise lost jobs will be left as is.
+     * */
+    protected List<InternalBackupServiceJobVO> getLostJobs(ClusterVO clusterVO, Calendar date, List<HostVO> hostVOS) {
+        return List.of();
+    }
+
+    protected abstract void searchAndDispatchJobs();
+}
diff --git a/server/src/main/java/org/apache/cloudstack/backup/to/BackupScreenshotObject.java b/server/src/main/java/org/apache/cloudstack/backup/to/BackupScreenshotObject.java
new file mode 100644
index 000000000000..c09685ec7877
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/backup/to/BackupScreenshotObject.java
@@ -0,0 +1,113 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// the License.  You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.backup.to;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.to.DataObjectType;
+import com.cloud.agent.api.to.DataTO;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataObject;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
+import org.apache.cloudstack.engine.subsystem.api.storage.ObjectInDataStoreStateMachine;
+import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;
+import java.util.UUID;
+
+public class BackupScreenshotObject implements DataObject {
+
+    private DataTO dataTO;
+    private DataStore dataStore;
+
+    public BackupScreenshotObject(DataTO dataTO, DataStore dataStore) {
+        this.dataTO = dataTO;
+        this.dataStore = dataStore;
+    }
+
+    @Override
+    public String toString() {
+        return String.format("BackupScreenshotObject %s", ReflectionToStringBuilderUtils.reflectOnlySelectedFields(this, "dataTO", "dataStore"));
+    }
+
+    @Override
+    public long getId() {
+        return 0;
+    }
+
+    @Override
+    public String getUri() {
+        return null;
+    }
+
+    @Override
+    public DataTO getTO() {
+        return dataTO;
+    }
+
+    @Override
+    public DataStore getDataStore() {
+        return dataStore;
+    }
+
+    @Override
+    public Long getSize() {
+        return null;
+    }
+
+    @Override
+    public long getPhysicalSize() {
+        return 0;
+    }
+
+    @Override
+    public DataObjectType getType() {
+        return dataTO.getObjectType();
+    }
+
+    @Override
+    public String getUuid() {
+        return null;
+    }
+
+    @Override
+    public boolean delete() {
+        return false;
+    }
+
+    @Override
+    public void processEvent(ObjectInDataStoreStateMachine.Event event) {
+    }
+
+    @Override
+    public void processEvent(ObjectInDataStoreStateMachine.Event event, Answer answer) {
+    }
+
+    @Override
+    public void incRefCount() {
+    }
+
+    @Override
+    public void decRefCount() {
+    }
+
+    @Override
+    public Long getRefCount() {
+        return null;
+    }
+
+    @Override
+    public String getName() {
+        return UUID.randomUUID().toString();
+    }
+}
diff --git a/server/src/main/java/org/apache/cloudstack/backup/to/BackupScreenshotTO.java b/server/src/main/java/org/apache/cloudstack/backup/to/BackupScreenshotTO.java
new file mode 100644
index 000000000000..7af4dbf7c246
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/backup/to/BackupScreenshotTO.java
@@ -0,0 +1,59 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// the License.  You may obtain a copy of the License at
+//
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.backup.to;
+
+import com.cloud.agent.api.to.DataObjectType;
+import com.cloud.agent.api.to.DataStoreTO;
+import com.cloud.agent.api.to.DataTO;
+import com.cloud.hypervisor.Hypervisor;
+
+public class BackupScreenshotTO implements DataTO {
+    private DataStoreTO dataStoreTO;
+    private Hypervisor.HypervisorType hypervisor;
+    private String path;
+
+    public BackupScreenshotTO(DataStoreTO dataStoreTO, Hypervisor.HypervisorType hypervisor, String path) {
+        this.dataStoreTO = dataStoreTO;
+        this.hypervisor = hypervisor;
+        this.path = path;
+    }
+
+    @Override
+    public DataObjectType getObjectType() {
+        return DataObjectType.ARCHIVE;
+    }
+
+    @Override
+    public DataStoreTO getDataStore() {
+        return dataStoreTO;
+    }
+
+    @Override
+    public Hypervisor.HypervisorType getHypervisorType() {
+        return hypervisor;
+    }
+
+    @Override
+    public String getPath() {
+        return path;
+    }
+
+    @Override
+    public long getId() {
+        return 0;
+    }
+}
diff --git a/server/src/main/java/org/apache/cloudstack/cluster/ClusterDrsServiceImpl.java b/server/src/main/java/org/apache/cloudstack/cluster/ClusterDrsServiceImpl.java
index 7e1011ff9314..62075aae596e 100644
--- a/server/src/main/java/org/apache/cloudstack/cluster/ClusterDrsServiceImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/cluster/ClusterDrsServiceImpl.java
@@ -51,11 +51,13 @@
 import com.cloud.utils.db.Transaction;
 import com.cloud.utils.db.TransactionCallback;
 import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.vm.VMInstanceDetailVO;
 import com.cloud.vm.VMInstanceVO;
 import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.VirtualMachineProfile;
 import com.cloud.vm.VirtualMachineProfileImpl;
 import com.cloud.vm.VmDetailConstants;
+import com.cloud.vm.dao.VMInstanceDetailsDao;
 import com.cloud.vm.dao.VMInstanceDao;
 import org.apache.cloudstack.api.ApiCommandResourceType;
 import org.apache.cloudstack.api.ApiConstants;
@@ -78,7 +80,6 @@
 import org.apache.cloudstack.jobs.JobInfo;
 import org.apache.cloudstack.managed.context.ManagedContextTimerTask;
 import org.apache.commons.collections.CollectionUtils;
-import org.apache.commons.collections.MapUtils;
 import org.apache.commons.lang3.time.DateUtils;
 
 import javax.inject.Inject;
@@ -134,6 +135,9 @@ public class ClusterDrsServiceImpl extends ManagerBase implements ClusterDrsServ
     @Inject
     ServiceOfferingDao serviceOfferingDao;
 
+    @Inject
+    VMInstanceDetailsDao vmInstanceDetailsDao;
+
     @Inject
     ManagementServer managementServer;
 
@@ -475,12 +479,16 @@ private Pair<Map<Long, List<? extends Host>>, Map<Long, Map<Host, Boolean>>> get
         Map<Long, List<? extends Host>> vmToCompatibleHostsCache = new HashMap<>();
         Map<Long, Map<Host, Boolean>> vmToStorageMotionCache = new HashMap<>();
 
+        List<Long> vmIds = vmList.stream().map(VirtualMachine::getId).collect(Collectors.toList());
+        Set<Long> skipDrsVmIds = vmInstanceDetailsDao.listDetailsForResourceIdsAndKey(vmIds, VmDetailConstants.SKIP_DRS)
+                .stream().filter(d -> "true".equalsIgnoreCase(d.getValue()))
+                .map(VMInstanceDetailVO::getResourceId)
+                .collect(Collectors.toSet());
+
         for (VirtualMachine vm : vmList) {
             // Skip ineligible VMs
-            if (vm.getType().isUsedBySystem() ||
-                vm.getState() != VirtualMachine.State.Running ||
-                (MapUtils.isNotEmpty(vm.getDetails()) &&
-                 "true".equalsIgnoreCase(vm.getDetails().get(VmDetailConstants.SKIP_DRS)))) {
+            if (shouldSkipVMForDRS(vm, skipDrsVmIds)) {
+                logger.debug("Skipping VM {} for DRS as it is ineligible.", vm);
                 continue;
             }
 
@@ -607,7 +615,7 @@ Pair<VirtualMachine, Host> getBestMigration(Cluster cluster, ClusterDrsAlgorithm
             ExcludeList excludes = vmToExcludesMap.get(vm.getId());
 
             ServiceOffering serviceOffering = vmIdServiceOfferingMap.get(vm.getId());
-            if (skipDrs(vm, compatibleHosts, serviceOffering)) {
+            if (CollectionUtils.isEmpty(compatibleHosts) || serviceOffering == null) {
                 continue;
             }
 
@@ -633,21 +641,11 @@ Pair<VirtualMachine, Host> getBestMigration(Cluster cluster, ClusterDrsAlgorithm
         return bestMigration;
     }
 
-    private boolean skipDrs(VirtualMachine vm, List<? extends Host> compatibleHosts, ServiceOffering serviceOffering) {
+    private boolean shouldSkipVMForDRS(VirtualMachine vm, Set<Long> skipDrsVmIds) {
         if (vm.getType().isUsedBySystem() || vm.getState() != VirtualMachine.State.Running) {
             return true;
         }
-        if (MapUtils.isNotEmpty(vm.getDetails()) &&
-            "true".equalsIgnoreCase(vm.getDetails().get(VmDetailConstants.SKIP_DRS))) {
-            return true;
-        }
-        if (CollectionUtils.isEmpty(compatibleHosts)) {
-            return true;
-        }
-        if (serviceOffering == null) {
-            return true;
-        }
-        return false;
+        return skipDrsVmIds.contains(vm.getId());
     }
 
     private Pair<double[], Map<Long, Integer>> getBaseMetricsArrayAndHostIdIndexMap(
diff --git a/server/src/main/java/org/apache/cloudstack/command/ReconcileCommandServiceImpl.java b/server/src/main/java/org/apache/cloudstack/command/ReconcileCommandServiceImpl.java
index 5edf05d1a5c0..535459dc110f 100644
--- a/server/src/main/java/org/apache/cloudstack/command/ReconcileCommandServiceImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/command/ReconcileCommandServiceImpl.java
@@ -1083,7 +1083,7 @@ private void updateVolumeAndDestroyOldVolume(VolumeVO sourceVolume, DataTO srcDa
             volumeDao.update(newVolume.getId(), newVolume);
 
             logger.debug(String.format("Deleting the dummy volume %s on pool %s", newVolume, destDataStore.getId()));
-            volumeApiService.destroyVolume(newVolume.getId(), accountManager.getAccount(Account.ACCOUNT_ID_SYSTEM), true, true);
+            volumeApiService.destroyVolume(newVolume.getId(), accountManager.getAccount(Account.ACCOUNT_ID_SYSTEM), true, true, null);
         }
     }
 
diff --git a/server/src/main/java/org/apache/cloudstack/network/RoutedIpv4ManagerImpl.java b/server/src/main/java/org/apache/cloudstack/network/RoutedIpv4ManagerImpl.java
index a03db4d4a241..213d8ee0087b 100644
--- a/server/src/main/java/org/apache/cloudstack/network/RoutedIpv4ManagerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/network/RoutedIpv4ManagerImpl.java
@@ -989,15 +989,15 @@ public boolean applyRoutingFirewallRule(long id) {
     @Override
     public boolean isVirtualRouterGateway(Network network) {
         return isRoutedNetwork(network)
-                && (networkServiceMapDao.canProviderSupportServiceInNetwork(network.getId(), Service.Gateway, Provider.VirtualRouter))
-                || networkServiceMapDao.canProviderSupportServiceInNetwork(network.getId(), Service.Gateway, Provider.VPCVirtualRouter);
+                && (networkServiceMapDao.canProviderSupportServiceInNetwork(network.getId(), Service.Gateway, Provider.VirtualRouter)
+                || networkServiceMapDao.canProviderSupportServiceInNetwork(network.getId(), Service.Gateway, Provider.VPCVirtualRouter));
     }
 
     @Override
     public boolean isVirtualRouterGateway(NetworkOffering networkOffering) {
         return NetworkOffering.NetworkMode.ROUTED.equals(networkOffering.getNetworkMode())
-                && networkOfferingServiceMapDao.canProviderSupportServiceInNetworkOffering(networkOffering.getId(), Service.Gateway, Provider.VirtualRouter)
-                || networkOfferingServiceMapDao.canProviderSupportServiceInNetworkOffering(networkOffering.getId(), Service.Gateway, Provider.VPCVirtualRouter);
+                && (networkOfferingServiceMapDao.canProviderSupportServiceInNetworkOffering(networkOffering.getId(), Service.Gateway, Provider.VirtualRouter)
+                || networkOfferingServiceMapDao.canProviderSupportServiceInNetworkOffering(networkOffering.getId(), Service.Gateway, Provider.VPCVirtualRouter));
     }
 
     @Override
diff --git a/server/src/main/java/org/apache/cloudstack/network/topology/BasicNetworkTopology.java b/server/src/main/java/org/apache/cloudstack/network/topology/BasicNetworkTopology.java
index a7000f702ec9..46a6886182b0 100644
--- a/server/src/main/java/org/apache/cloudstack/network/topology/BasicNetworkTopology.java
+++ b/server/src/main/java/org/apache/cloudstack/network/topology/BasicNetworkTopology.java
@@ -65,6 +65,7 @@
 import com.cloud.network.vpc.NetworkACLItem;
 import com.cloud.network.vpc.PrivateGateway;
 import com.cloud.network.vpc.StaticRouteProfile;
+import com.cloud.network.vpc.Vpc;
 import com.cloud.utils.exception.CloudRuntimeException;
 import com.cloud.vm.DomainRouterVO;
 import com.cloud.vm.NicProfile;
@@ -228,6 +229,26 @@ public boolean applyFirewallRules(final Network network, final List<? extends Fi
         return applyRules(network, router, typeString, isPodLevelException, podId, failWhenDisconnect, new RuleApplierWrapper<RuleApplier>(firewallRules));
     }
 
+    @Override
+    public boolean applyFirewallRulesInVPC(final Vpc vpc, final List<? extends FirewallRule> rules, final VirtualRouter router)
+            throws ResourceUnavailableException {
+        if (rules == null || rules.isEmpty()) {
+            logger.debug("No firewall rules to be applied for vpc {}", vpc);
+            return true;
+        }
+
+        logger.debug("APPLYING FIREWALL RULES");
+
+        final String typeString = "firewall rules";
+        final boolean isPodLevelException = false;
+        final boolean failWhenDisconnect = false;
+        final Long podId = null;
+
+        final FirewallRules firewallRules = new FirewallRules(vpc, rules);
+
+        return applyRulesInVPC(vpc, router, typeString, isPodLevelException, podId, failWhenDisconnect, new RuleApplierWrapper<RuleApplier>(firewallRules));
+    }
+
     @Override
     public boolean applyStaticNats(final Network network, final List<? extends StaticNat> rules, final VirtualRouter router) throws ResourceUnavailableException {
         if (rules == null || rules.isEmpty()) {
@@ -444,6 +465,102 @@ public boolean applyRules(final Network network, final VirtualRouter router, fin
         return result;
     }
 
+    @Override
+    public boolean applyRulesInVPC(final Vpc vpc, final VirtualRouter router, final String typeString, final boolean isPodLevelException, final Long podId,
+            final boolean failWhenDisconnect, final RuleApplierWrapper<RuleApplier> ruleApplierWrapper) throws ResourceUnavailableException {
+
+        if (vpc == null) {
+            throw new CloudRuntimeException("Unable to apply " + typeString + " because VPC is null");
+        }
+
+        if (router == null) {
+            logger.warn("Unable to apply {}, virtual router doesn't exist in vpc {}", typeString, vpc);
+            final Long dcId = vpc.getZoneId();
+            throw new ResourceUnavailableException("Unable to apply " + typeString, DataCenter.class, dcId);
+        }
+
+        final RuleApplier ruleApplier = ruleApplierWrapper.getRuleType();
+
+        final Long dcId = vpc.getZoneId();
+        final DataCenter dc = _dcDao.findById(dcId);
+        final boolean isZoneBasic = dc.getNetworkType() == NetworkType.Basic;
+
+        // isPodLevelException and podId is only used for basic zone
+        assert !(!isZoneBasic && isPodLevelException || isZoneBasic && isPodLevelException && podId == null);
+
+        final List<VirtualRouter> connectedRouters = new ArrayList<VirtualRouter>();
+        final List<VirtualRouter> disconnectedRouters = new ArrayList<VirtualRouter>();
+        boolean result = true;
+        final String msg = "Unable to apply " + typeString + " on disconnected router ";
+        if (router.getState() == State.Running) {
+            logger.debug("Applying {} in vpc {}", typeString, vpc);
+
+            if (router.isStopPending()) {
+                if (_hostDao.findById(router.getHostId()).getState() == Status.Up) {
+                    throw new ResourceUnavailableException("Unable to process due to the stop pending router " + router.getInstanceName()
+                            + " haven't been stopped after it's host coming back!", DataCenter.class, router.getDataCenterId());
+                }
+                logger.debug("Router {} is stop pending, so not sending apply {} commands to the backend", router, typeString);
+                return false;
+            }
+
+            try {
+                result = ruleApplier.accept(getVisitor(), router);
+                connectedRouters.add(router);
+            } catch (final AgentUnavailableException e) {
+                logger.warn("{}{}", msg, router, e);
+                disconnectedRouters.add(router);
+            }
+
+            // If rules fail to apply on one domR and not due to
+            // disconnection, no need to proceed with the rest
+            if (!result) {
+                if (isZoneBasic && isPodLevelException) {
+                    throw new ResourceUnavailableException("Unable to apply " + typeString + " on router ", Pod.class, podId);
+                }
+                throw new ResourceUnavailableException("Unable to apply " + typeString + " on router ", DataCenter.class, router.getDataCenterId());
+            }
+
+        } else if (router.getState() == State.Stopped || router.getState() == State.Stopping) {
+            logger.debug("Router {} is in {}, so not sending apply {} commands to the backend", router, router.getState(), typeString);
+        } else {
+            logger.warn("Unable to apply " + typeString + ", virtual router is not in the right state " + router.getState());
+            if (isZoneBasic && isPodLevelException) {
+                throw new ResourceUnavailableException("Unable to apply " + typeString + ", virtual router is not in the right state", Pod.class, podId);
+            }
+            throw new ResourceUnavailableException("Unable to apply " + typeString + ", virtual router is not in the right state", DataCenter.class, router.getDataCenterId());
+        }
+
+        if (!connectedRouters.isEmpty()) {
+            // Shouldn't we include this check inside the method?
+            if (!isZoneBasic && !disconnectedRouters.isEmpty()) {
+                // These disconnected redundant virtual routers are out of sync
+                // now, stop them for synchronization
+                for (final VirtualRouter virtualRouter : disconnectedRouters) {
+                    // If we have at least 1 disconnected redundant router, callhandleSingleWorkingRedundantRouter().
+                    if (virtualRouter.getIsRedundantRouter()) {
+                        _networkHelper.handleSingleWorkingRedundantRouter(connectedRouters, disconnectedRouters, msg);
+                        break;
+                    }
+                }
+            }
+        } else if (!disconnectedRouters.isEmpty()) {
+            if (logger.isDebugEnabled()) {
+                logger.debug("{}{}", msg, router);
+            }
+            if (isZoneBasic && isPodLevelException) {
+                throw new ResourceUnavailableException(msg, Pod.class, podId);
+            }
+            throw new ResourceUnavailableException(msg, DataCenter.class, disconnectedRouters.get(0).getDataCenterId());
+        }
+
+        result = true;
+        if (failWhenDisconnect) {
+            result = !connectedRouters.isEmpty();
+        }
+        return result;
+    }
+
     @Override
     public boolean removeDhcpEntry(Network network, NicProfile nic, VirtualMachineProfile profile, VirtualRouter virtualRouter) throws ResourceUnavailableException {
         logger.debug("REMOVING DHCP ENTRY RULE");
diff --git a/server/src/main/java/org/apache/cloudstack/network/topology/BasicNetworkVisitor.java b/server/src/main/java/org/apache/cloudstack/network/topology/BasicNetworkVisitor.java
index 8702a58ad69e..17a6d826bd17 100644
--- a/server/src/main/java/org/apache/cloudstack/network/topology/BasicNetworkVisitor.java
+++ b/server/src/main/java/org/apache/cloudstack/network/topology/BasicNetworkVisitor.java
@@ -145,7 +145,9 @@ public boolean visit(final FirewallRules firewall) throws ResourceUnavailableExc
 
         } else if (purpose == Purpose.Firewall) {
 
-            _commandSetupHelper.createApplyFirewallRulesCommands(rules, router, cmds, network.getId());
+            final Long guestNetworkId = network != null ? network.getId() : null;
+            final Long vpcId = network != null ? network.getVpcId() : router.getVpcId();
+            _commandSetupHelper.createApplyFirewallRulesCommands(rules, router, cmds, guestNetworkId, vpcId);
 
             return _networkGeneralHelper.sendCommandsToRouter(router, cmds);
 
diff --git a/server/src/main/java/org/apache/cloudstack/network/topology/NetworkTopology.java b/server/src/main/java/org/apache/cloudstack/network/topology/NetworkTopology.java
index 176584780fed..58b0acd33d24 100644
--- a/server/src/main/java/org/apache/cloudstack/network/topology/NetworkTopology.java
+++ b/server/src/main/java/org/apache/cloudstack/network/topology/NetworkTopology.java
@@ -35,6 +35,7 @@
 import com.cloud.network.vpc.NetworkACLItem;
 import com.cloud.network.vpc.PrivateGateway;
 import com.cloud.network.vpc.StaticRouteProfile;
+import com.cloud.network.vpc.Vpc;
 import com.cloud.vm.DomainRouterVO;
 import com.cloud.vm.NicProfile;
 import com.cloud.vm.VirtualMachineProfile;
@@ -72,6 +73,8 @@ boolean applyUserData(final Network network, final NicProfile nic, final Virtual
 
     boolean applyFirewallRules(final Network network, final List<? extends FirewallRule> rules, final VirtualRouter router) throws ResourceUnavailableException;
 
+    boolean applyFirewallRulesInVPC(final Vpc vpc, final List<? extends FirewallRule> rules, final VirtualRouter router) throws ResourceUnavailableException;
+
     boolean applyStaticNats(final Network network, final List<? extends StaticNat> rules, final VirtualRouter router) throws ResourceUnavailableException;
 
     boolean associatePublicIP(final Network network, final List<? extends PublicIpAddress> ipAddress, final VirtualRouter router) throws ResourceUnavailableException;
@@ -89,6 +92,9 @@ boolean saveUserDataToRouter(final Network network, final NicProfile nic, final
     boolean applyRules(final Network network, final VirtualRouter router, final String typeString, final boolean isPodLevelException, final Long podId,
             final boolean failWhenDisconnect, RuleApplierWrapper<RuleApplier> ruleApplier) throws ResourceUnavailableException;
 
+    boolean applyRulesInVPC(final Vpc vpc, final VirtualRouter router, final String typeString, final boolean isPodLevelException, final Long podId,
+            final boolean failWhenDisconnect, RuleApplierWrapper<RuleApplier> ruleApplier) throws ResourceUnavailableException;
+
     boolean removeDhcpEntry(final Network network, final NicProfile nic, final VirtualMachineProfile profile, final VirtualRouter virtualRouter) throws ResourceUnavailableException;
 
     boolean applyBgpPeers(final Network network, final List<? extends BgpPeer> bpgPeers, final VirtualRouter virtualRouter) throws ResourceUnavailableException;
diff --git a/server/src/main/java/org/apache/cloudstack/storage/heuristics/HeuristicRuleHelper.java b/server/src/main/java/org/apache/cloudstack/storage/heuristics/HeuristicRuleHelper.java
index 97c13f714474..1ae8c84eebdd 100644
--- a/server/src/main/java/org/apache/cloudstack/storage/heuristics/HeuristicRuleHelper.java
+++ b/server/src/main/java/org/apache/cloudstack/storage/heuristics/HeuristicRuleHelper.java
@@ -27,6 +27,8 @@
 import com.cloud.user.AccountVO;
 import com.cloud.user.dao.AccountDao;
 import com.cloud.utils.exception.CloudRuntimeException;
+import org.apache.cloudstack.backup.BackupVO;
+import org.apache.cloudstack.backup.dao.BackupOfferingDao;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreManager;
 import org.apache.cloudstack.engine.subsystem.api.storage.SnapshotInfo;
@@ -36,6 +38,7 @@
 import org.apache.cloudstack.storage.datastore.db.ImageStoreDao;
 import org.apache.cloudstack.storage.datastore.db.ImageStoreVO;
 import org.apache.cloudstack.storage.heuristics.presetvariables.Account;
+import org.apache.cloudstack.storage.heuristics.presetvariables.Backup;
 import org.apache.cloudstack.storage.heuristics.presetvariables.Domain;
 import org.apache.cloudstack.storage.heuristics.presetvariables.PresetVariables;
 import org.apache.cloudstack.storage.heuristics.presetvariables.SecondaryStorage;
@@ -78,6 +81,9 @@ public class HeuristicRuleHelper {
     @Inject
     private DataCenterDao zoneDao;
 
+    @Inject
+    private BackupOfferingDao backupOfferingDao;
+
     /**
      * Returns the {@link DataStore} object if the zone, specified by the ID, has an active heuristic rule for the given {@link HeuristicType}.
      * It returns null otherwise.
@@ -120,6 +126,10 @@ protected void buildPresetVariables(JsInterpreter jsInterpreter, HeuristicType h
                 presetVariables.setVolume(setVolumePresetVariable((com.cloud.storage.Volume) obj));
                 accountId = ((com.cloud.storage.Volume) obj).getAccountId();
                 break;
+            case BACKUP:
+                presetVariables.setBackup(setBackupPresetVariable((BackupVO) obj));
+                accountId = ((BackupVO) obj).getAccountId();
+                break;
         }
         presetVariables.setAccount(setAccountPresetVariable(accountId));
         presetVariables.setSecondaryStorages(setSecondaryStoragesVariable(zoneId));
@@ -154,6 +164,10 @@ protected void injectPresetVariables(JsInterpreter jsInterpreter, PresetVariable
             jsInterpreter.injectVariable("volume", presetVariables.getVolume());
         }
 
+        if (presetVariables.getBackup() != null) {
+            jsInterpreter.injectVariable("backup", presetVariables.getBackup());
+        }
+
         if (presetVariables.getAccount() != null) {
             jsInterpreter.injectVariable("account", presetVariables.getAccount());
         }
@@ -211,6 +225,16 @@ protected Snapshot setSnapshotPresetVariable(SnapshotInfo snapshotInfo) {
         return snapshot;
     }
 
+    protected Backup setBackupPresetVariable(BackupVO backupVO) {
+        Backup backup = new Backup();
+
+        backup.setName(backupVO.getName());
+        backup.setVirtualSize(backupVO.getProtectedSize());
+        backup.setOfferingUuid(backupOfferingDao.findById(backupVO.getBackupOfferingId()).getUuid());
+
+        return backup;
+    }
+
     protected Account setAccountPresetVariable(Long accountId) {
         if (accountId == null) {
             return null;
diff --git a/server/src/main/java/org/apache/cloudstack/storage/heuristics/presetvariables/Backup.java b/server/src/main/java/org/apache/cloudstack/storage/heuristics/presetvariables/Backup.java
new file mode 100644
index 000000000000..fd8909e3e786
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/storage/heuristics/presetvariables/Backup.java
@@ -0,0 +1,40 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.storage.heuristics.presetvariables;
+
+public class Backup extends GenericHeuristicPresetVariable {
+
+    private Long virtualSize;
+
+    private String offeringUuid;
+
+    public Long getVirtualSize() {
+        return virtualSize;
+    }
+
+    public void setVirtualSize(Long virtualSize) {
+        this.virtualSize = virtualSize;
+    }
+
+    public String getOfferingUuid() {
+        return offeringUuid;
+    }
+
+    public void setOfferingUuid(String offeringUuid) {
+        this.offeringUuid = offeringUuid;
+    }
+}
diff --git a/server/src/main/java/org/apache/cloudstack/storage/heuristics/presetvariables/PresetVariables.java b/server/src/main/java/org/apache/cloudstack/storage/heuristics/presetvariables/PresetVariables.java
index d04874953272..099c76b7ccb5 100644
--- a/server/src/main/java/org/apache/cloudstack/storage/heuristics/presetvariables/PresetVariables.java
+++ b/server/src/main/java/org/apache/cloudstack/storage/heuristics/presetvariables/PresetVariables.java
@@ -30,6 +30,8 @@ public class PresetVariables {
 
     private Volume volume;
 
+    private Backup backup;
+
     public List<SecondaryStorage> getSecondaryStorages() {
         return secondaryStorages;
     }
@@ -62,6 +64,14 @@ public void setVolume(Volume volume) {
         this.volume = volume;
     }
 
+    public Backup getBackup() {
+        return backup;
+    }
+
+    public void setBackup(Backup backup) {
+        this.backup = backup;
+    }
+
     public Account getAccount() {
         return account;
     }
diff --git a/server/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImpl.java b/server/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImpl.java
index 36905fb40ec9..840a1de45962 100644
--- a/server/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImpl.java
@@ -23,6 +23,7 @@
 import com.cloud.agent.api.CheckConvertInstanceCommand;
 import com.cloud.agent.api.CheckVolumeAnswer;
 import com.cloud.agent.api.CheckVolumeCommand;
+import com.cloud.agent.api.CleanupConvertedInstanceDisksCommand;
 import com.cloud.agent.api.ConvertInstanceAnswer;
 import com.cloud.agent.api.ConvertInstanceCommand;
 import com.cloud.agent.api.CopyRemoteVolumeAnswer;
@@ -1026,7 +1027,7 @@ private void publishVMUsageUpdateResourceCount(final UserVm userVm, ServiceOffer
             cleanupFailedImportVM(userVm);
             throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, String.format("VM import failed for unmanaged vm %s during publishing usage records", userVm.getInstanceName()));
         }
-        resourceLimitService.incrementVmResourceCount(userVm.getAccountId(), userVm.isDisplayVm(), serviceOfferingVO, templateVO);
+        resourceLimitService.incrementVmResourceCount(userVm.getAccountId(), userVm.isDisplayVm(), serviceOfferingVO, templateVO, null);
         // Save usage event and update resource count for user vm volumes
         List<VolumeVO> volumes = volumeDao.findByInstance(userVm.getId());
         for (VolumeVO volume : volumes) {
@@ -1717,13 +1718,14 @@ protected UserVm importUnmanagedInstanceFromVmwareToKvm(DataCenter zone, Cluster
             logger.debug("The host {}  is selected to execute the conversion of the " +
                     "instance {} from VMware to KVM ", convertHost, sourceVMName);
 
+            long importStartTime = System.currentTimeMillis();
+            importVMTask = importVmTasksManager.createImportVMTaskRecord(zone, owner, userId, displayName, vcenter, datacenterName, sourceVMName,
+                    convertHost, importHost);
+
             temporaryConvertLocation = selectInstanceConversionTemporaryLocation(
                     destinationCluster, convertHost, importHost, convertStoragePoolId, forceConvertToPool);
             List<StoragePoolVO> convertStoragePools = findInstanceConversionDestinationStoragePoolsInCluster(destinationCluster, serviceOffering, dataDiskOfferingMap, temporaryConvertLocation, forceConvertToPool);
 
-            long importStartTime = System.currentTimeMillis();
-            importVMTask = importVmTasksManager.createImportVMTaskRecord(zone, owner, userId, displayName, vcenter, datacenterName, sourceVMName,
-                    convertHost, importHost);
             importVmTasksManager.updateImportVMTaskStep(importVMTask, zone, owner, convertHost, importHost, null, CloningInstance);
 
             // sourceVMwareInstance could be a cloned instance from sourceVMName, of the sourceVMName itself if its powered off.
@@ -2214,31 +2216,56 @@ private UnmanagedInstanceTO convertAndImportToKVM(ConvertInstanceCommand convert
             throw new CloudRuntimeException(err);
         }
 
+        boolean cleanupConvertedDisks = false;
+        String convertedDisksPrefix = null;
         Answer importAnswer;
         try {
+            convertedDisksPrefix = ((ConvertInstanceAnswer)convertAnswer).getTemporaryConvertUuid();
             ImportConvertedInstanceCommand importCmd = new ImportConvertedInstanceCommand(
                     remoteInstanceTO, destinationStoragePools, temporaryConvertLocation,
-                    ((ConvertInstanceAnswer)convertAnswer).getTemporaryConvertUuid(), forceConvertToPool);
+                    convertedDisksPrefix, forceConvertToPool);
             importAnswer = agentManager.send(importHost.getId(), importCmd);
+
+            if (!importAnswer.getResult()) {
+                cleanupConvertedDisks = true;
+                String err = String.format(
+                        "The import process failed for instance %s from VMware to KVM on host %s: %s",
+                        sourceVM, importHost, importAnswer.getDetails());
+                logger.error(err);
+                throw new CloudRuntimeException(err);
+            }
         } catch (AgentUnavailableException | OperationTimedoutException e) {
+            cleanupConvertedDisks = true;
             String err = String.format(
                     "Could not send the import converted instance command to host %s due to: %s",
                     importHost, e.getMessage());
             logger.error(err, e);
             throw new CloudRuntimeException(err);
-        }
-
-        if (!importAnswer.getResult()) {
-            String err = String.format(
-                    "The import process failed for instance %s from VMware to KVM on host %s: %s",
-                    sourceVM, importHost, importAnswer.getDetails());
-            logger.error(err);
-            throw new CloudRuntimeException(err);
+        } finally {
+            if (cleanupConvertedDisks) {
+                cleanupConvertedDisks(sourceVM, convertHost, temporaryConvertLocation, convertedDisksPrefix);
+            }
         }
 
         return ((ImportConvertedInstanceAnswer) importAnswer).getConvertedInstance();
     }
 
+    private void cleanupConvertedDisks(String sourceVM, HostVO convertHost, DataStoreTO temporaryConvertLocation, String convertedDisksPrefix) {
+        logger.debug("Cleaning up the converted disks for the VM {} through the conversion host {}", sourceVM, convertHost.getName());
+        CleanupConvertedInstanceDisksCommand cleanupCommand =
+                new CleanupConvertedInstanceDisksCommand(temporaryConvertLocation, convertedDisksPrefix);
+        try {
+            Answer cleanupAnswer = agentManager.send(convertHost.getId(), cleanupCommand);
+            if (!cleanupAnswer.getResult()) {
+                logger.warn("Failed to cleanup the converted disks for the VM {} through " +
+                        "the conversion host {}: {}", sourceVM, convertHost.getName(), cleanupAnswer.getDetails());
+            }
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            logger.error("Error cleaning up converted disks for VM {} through the conversion host {}",
+                    sourceVM, convertHost.getName(), e);
+        }
+    }
+
     private List<StoragePoolVO> findInstanceConversionDestinationStoragePoolsInCluster(
             Cluster destinationCluster, ServiceOfferingVO serviceOffering,
             Map<String, Long> dataDiskOfferingMap,
@@ -2911,7 +2938,7 @@ private UserVm importKvmVirtualMachineFromDisk(final ImportSource importSource,
             }
 
             DiskOfferingVO diskOffering = diskOfferingDao.findById(serviceOffering.getDiskOfferingId());
-            List<String> resourceLimitStorageTags = resourceLimitService.getResourceLimitStorageTagsForResourceCountOperation(true, diskOffering);
+            List<String> resourceLimitStorageTags = resourceLimitService.getResourceLimitStorageTagsForResourceCountOperation(true, diskOffering, null);
             CheckedReservation volumeReservation = new CheckedReservation(owner, Resource.ResourceType.volume, resourceLimitStorageTags,
                     CollectionUtils.isNotEmpty(resourceLimitStorageTags) ? 1L : 0L, reservationDao, resourceLimitService);
             reservations.add(volumeReservation);
diff --git a/server/src/main/resources/META-INF/cloudstack/core/spring-server-core-managers-context.xml b/server/src/main/resources/META-INF/cloudstack/core/spring-server-core-managers-context.xml
index eef304226af2..c0bcba44c642 100644
--- a/server/src/main/resources/META-INF/cloudstack/core/spring-server-core-managers-context.xml
+++ b/server/src/main/resources/META-INF/cloudstack/core/spring-server-core-managers-context.xml
@@ -414,6 +414,11 @@
     <bean id="ExternalOrchestratorDetailDaoImpl" class="org.apache.cloudstack.hypervisor.external.provisioner.dao.ExternalOrchestratorDetailDaoImpl" />
     <bean id="ExtensionResourceMapDaoImpl" class="org.apache.cloudstack.hypervisor.external.provisioner.dao.ExtensionResourceMapDaoImpl" />
     <bean id="ExtensionResourceMapDetailsDaoImpl" class="org.apache.cloudstack.hypervisor.external.provisioner.dao.ExtensionResourceMapDetailsDaoImpl" />
+    <bean id="internalBackupServiceImpl" class="org.apache.cloudstack.backup.InternalBackupServiceImpl" >
+        <property name="internalBackupProviders" value="#{internalBackupProvidersRegistry.registered}" />
+    </bean>
+    <bean id="backupCompressionService" class="org.apache.cloudstack.backup.BackupCompressionServiceJobController" />
+    <bean id="backupValidationService" class="org.apache.cloudstack.backup.BackupValidationServiceJobController" />
 
     <bean id="dnsProviderManager" class="org.apache.cloudstack.dns.DnsProviderManagerImpl" >
         <property name="dnsProviders" value="#{dnsProvidersRegistry.registered}" />
diff --git a/server/src/main/resources/META-INF/cloudstack/server-network/spring-server-network-context.xml b/server/src/main/resources/META-INF/cloudstack/server-network/spring-server-network-context.xml
index 3df3a05182dd..97ed36e515c7 100644
--- a/server/src/main/resources/META-INF/cloudstack/server-network/spring-server-network-context.xml
+++ b/server/src/main/resources/META-INF/cloudstack/server-network/spring-server-network-context.xml
@@ -33,6 +33,9 @@
     <bean id="ExternalGuestNetworkGuru" class="com.cloud.network.guru.ExternalGuestNetworkGuru">
         <property name="name" value="ExternalGuestNetworkGuru" />
     </bean>
+    <bean id="NetworkExtensionGuestNetworkGuru" class="com.cloud.network.guru.NetworkExtensionGuestNetworkGuru">
+        <property name="name" value="NetworkExtensionGuestNetworkGuru" />
+    </bean>
     <bean id="PublicNetworkGuru" class="com.cloud.network.guru.PublicNetworkGuru">
         <property name="name" value="PublicNetworkGuru" />
     </bean>
diff --git a/server/src/test/java/com/cloud/network/IpAddressManagerTest.java b/server/src/test/java/com/cloud/network/IpAddressManagerTest.java
index cf3a886ce99f..d12419b66e0a 100644
--- a/server/src/test/java/com/cloud/network/IpAddressManagerTest.java
+++ b/server/src/test/java/com/cloud/network/IpAddressManagerTest.java
@@ -19,10 +19,13 @@
 
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyBoolean;
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.lenient;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
@@ -54,8 +57,13 @@
 import com.cloud.network.dao.IPAddressVO;
 import com.cloud.network.dao.NetworkDao;
 import com.cloud.network.dao.NetworkVO;
+import com.cloud.network.rules.FirewallRule;
 import com.cloud.network.rules.StaticNat;
 import com.cloud.network.rules.StaticNatImpl;
+import com.cloud.network.vpc.dao.VpcDao;
+import com.cloud.network.vpc.VpcVO;
+import com.cloud.network.vpc.VpcManager;
+import com.cloud.dc.dao.VlanDao;
 import com.cloud.offerings.NetworkOfferingVO;
 import com.cloud.offerings.dao.NetworkOfferingDao;
 import com.cloud.user.AccountVO;
@@ -105,6 +113,15 @@ public class IpAddressManagerTest {
     @Mock
     AccountManager accountManagerMock;
 
+    @Mock
+    VpcManager vpcMgr;
+
+    @Mock
+    VpcDao vpcDao;
+
+    @Mock
+    VlanDao vlanDao;
+
     final long dummyID = 1L;
 
     final String UUID = "uuid";
@@ -492,4 +509,135 @@ public void checkIfIpResourceCountShouldBeUpdatedTestIpIsAssociatedToVpcAndNotDe
 
         Assert.assertTrue(result);
     }
+
+
+    private FirewallRule makeRule(Long networkId, Long vpcId, FirewallRule.Purpose purpose,
+            FirewallRule.TrafficType trafficType) {
+        FirewallRule rule = mock(FirewallRule.class);
+        lenient().when(rule.getNetworkId()).thenReturn(networkId);
+        lenient().when(rule.getVpcId()).thenReturn(vpcId);
+        lenient().when(rule.getPurpose()).thenReturn(purpose);
+        lenient().when(rule.getTrafficType()).thenReturn(trafficType);
+        return rule;
+    }
+
+    /** Stub the two IP-association helper methods so they are no-ops. */
+    private void stubIpAssocHelpers() throws ResourceUnavailableException {
+        doReturn(false).when(ipAddressManager).checkIfIpAssocRequired(any(Network.class), anyBoolean(), any());
+    }
+
+    /**
+     * Test: Non-VPC rules still resolve via networkId (backward compatibility).
+     */
+    @Test
+    public void applyRulesNonVpcRuleStillWorksViaNetworkId() throws ResourceUnavailableException {
+        long networkId = 10L;
+        NetworkVO network = mock(NetworkVO.class);
+        when(network.getId()).thenReturn(networkId);
+        when(networkDao.findById(networkId)).thenReturn(network);
+
+        FirewallRule rule = makeRule(networkId, null, FirewallRule.Purpose.Firewall, FirewallRule.TrafficType.Ingress);
+        NetworkRuleApplier applier = mock(NetworkRuleApplier.class);
+
+        when(ipAddressDao.listByAssociatedNetwork(networkId, null)).thenReturn(new ArrayList<>());
+        stubIpAssocHelpers();
+
+        boolean result = ipAddressManager.applyRules(
+                Collections.singletonList(rule), FirewallRule.Purpose.Firewall, applier, false);
+
+        assertTrue(result);
+        verify(networkDao).findById(networkId);
+        verify(applier).applyRules(network, null, FirewallRule.Purpose.Firewall, Collections.singletonList(rule));
+    }
+
+    /**
+     * Test: VPC rule resolves network via VpcManager.getVpcNetworks()
+     * when networkId is null but vpcId is set.
+     */
+    @Test
+    public void applyRulesVpcRuleResolvesNetworkViaVpcManager() throws ResourceUnavailableException {
+        long vpcId = 20L;
+        VpcVO vpc = mock(VpcVO.class);
+        when(vpcDao.findById(vpcId)).thenReturn(vpc);
+
+        FirewallRule rule = makeRule(null, vpcId, FirewallRule.Purpose.Firewall, FirewallRule.TrafficType.Ingress);
+        NetworkRuleApplier applier = mock(NetworkRuleApplier.class);
+
+        stubIpAssocHelpers();
+
+        boolean result = ipAddressManager.applyRules(
+                Collections.singletonList(rule), FirewallRule.Purpose.Firewall, applier, false);
+
+        assertTrue(result);
+        verify(vpcDao).findById(vpcId);
+        verify(applier).applyRules(null, vpc, FirewallRule.Purpose.Firewall, Collections.singletonList(rule));
+    }
+
+
+    /**
+     * Test: For VPC egress firewall rules, IP collection should be skipped.
+     */
+    @Test
+    public void applyRulesVpcEgressFirewallRuleSkipsIpCollection() throws ResourceUnavailableException {
+        long vpcId = 20L;
+        VpcVO vpc = mock(VpcVO.class);
+        when(vpcDao.findById(vpcId)).thenReturn(vpc);
+
+        FirewallRule rule = makeRule(null, vpcId, FirewallRule.Purpose.Firewall, FirewallRule.TrafficType.Egress);
+        NetworkRuleApplier applier = mock(NetworkRuleApplier.class);
+
+        stubIpAssocHelpers();
+
+        boolean result = ipAddressManager.applyRules(
+                Collections.singletonList(rule), FirewallRule.Purpose.Firewall, applier, false);
+
+        assertTrue(result);
+        verify(ipAddressDao, never()).listByAssociatedVpc(anyLong(), any());
+        verify(applier).applyRules(null, vpc, FirewallRule.Purpose.Firewall, Collections.singletonList(rule));
+    }
+
+    /**
+     * Test: VPC ingress firewall rules collect public IPs from VPC (listByAssociatedVpc),
+     * NOT from network (listByAssociatedNetwork).
+     */
+    @Test
+    public void applyRulesVpcIngressRuleCollectsIpsFromVpcNotNetwork() throws ResourceUnavailableException {
+        long vpcId = 20L;
+        VpcVO vpc = mock(VpcVO.class);
+        when(vpcDao.findById(vpcId)).thenReturn(vpc);
+
+        stubIpAssocHelpers();
+
+        NetworkRuleApplier applier = mock(NetworkRuleApplier.class);
+        FirewallRule rule = makeRule(null, vpcId, FirewallRule.Purpose.Firewall, FirewallRule.TrafficType.Ingress);
+
+        ipAddressManager.applyRules(Collections.singletonList(rule), FirewallRule.Purpose.Firewall, applier, false);
+
+        verify(applier).applyRules(null, vpc, FirewallRule.Purpose.Firewall, Collections.singletonList(rule));
+        verify(ipAddressDao, never()).listByAssociatedVpc(vpcId, null);
+        verify(ipAddressDao, never()).listByAssociatedNetwork(anyLong(), any());
+    }
+
+    /**
+     * Test: Error handling respects continueOnError flag.
+     * When continueOnError=true, exceptions are caught and false is returned.
+     */
+    @Test
+    public void applyRulesVpcRuleErrorHandlingWithContinueOnErrorTrue() throws ResourceUnavailableException {
+        long vpcId = 20L;
+        VpcVO vpc = mock(VpcVO.class);
+        when(vpcDao.findById(vpcId)).thenReturn(vpc);
+
+        stubIpAssocHelpers();
+
+        NetworkRuleApplier applier = mock(NetworkRuleApplier.class);
+        when(applier.applyRules(any(), any(), any(), any())).thenThrow(new ResourceUnavailableException("test", Network.class, 0L));
+
+        FirewallRule rule = makeRule(null, vpcId, FirewallRule.Purpose.Firewall, FirewallRule.TrafficType.Ingress);
+
+        boolean result = ipAddressManager.applyRules(
+                Collections.singletonList(rule), FirewallRule.Purpose.Firewall, applier, true);
+
+        assertFalse(result);
+    }
 }
diff --git a/server/src/test/java/com/cloud/network/MockNetworkModelImpl.java b/server/src/test/java/com/cloud/network/MockNetworkModelImpl.java
index b5e081e043be..3f2f3b6e955e 100644
--- a/server/src/test/java/com/cloud/network/MockNetworkModelImpl.java
+++ b/server/src/test/java/com/cloud/network/MockNetworkModelImpl.java
@@ -400,6 +400,16 @@ public boolean canElementEnableIndividualServices(Provider provider) {
         return false;
     }
 
+    @Override
+    public boolean canElementEnableIndividualServicesByName(String providerName) {
+        return false;
+    }
+
+    @Override
+    public Provider resolveProvider(String providerName) {
+        return Provider.getProvider(providerName);
+    }
+
     /* (non-Javadoc)
      * @see com.cloud.network.NetworkModel#areServicesSupportedInNetwork(long, com.cloud.network.Network.Service[])
      */
diff --git a/server/src/test/java/com/cloud/network/NetworkModelImplTest.java b/server/src/test/java/com/cloud/network/NetworkModelImplTest.java
index b6f2ff65b9fa..7810662c617b 100644
--- a/server/src/test/java/com/cloud/network/NetworkModelImplTest.java
+++ b/server/src/test/java/com/cloud/network/NetworkModelImplTest.java
@@ -18,6 +18,9 @@
 
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.assertEquals;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.mock;
@@ -54,6 +57,9 @@
 import com.cloud.network.dao.NetworkServiceMapDao;
 import com.cloud.network.dao.NetworkServiceMapVO;
 import com.cloud.network.dao.NetworkVO;
+import com.cloud.network.dao.PhysicalNetworkDao;
+import com.cloud.network.dao.PhysicalNetworkServiceProviderDao;
+import com.cloud.network.dao.PhysicalNetworkServiceProviderVO;
 import com.cloud.network.element.NetworkElement;
 import com.cloud.network.element.VpcVirtualRouterElement;
 import com.cloud.network.vpc.VpcVO;
@@ -66,6 +72,9 @@
 import com.cloud.vm.Nic;
 import com.cloud.vm.NicProfile;
 import com.cloud.vm.VirtualMachine;
+import org.apache.cloudstack.extension.Extension;
+import org.apache.cloudstack.extension.ExtensionHelper;
+import org.apache.cloudstack.framework.extensions.network.NetworkExtensionElement;
 
 @RunWith(MockitoJUnitRunner.class)
 public class NetworkModelImplTest {
@@ -80,6 +89,17 @@ public class NetworkModelImplTest {
     private NetworkDao _networksDao;
     @Inject
     private NetworkOfferingServiceMapDao networkOfferingServiceMapDao;
+    @Mock
+    private ExtensionHelper extensionHelper;
+
+    @Mock
+    private NetworkExtensionElement networkExtensionElement;
+
+    @Mock
+    private PhysicalNetworkDao physicalNetworkDao;
+
+    @Mock
+    private PhysicalNetworkServiceProviderDao physicalNetworkServiceProviderDao;
 
     @Spy
     @InjectMocks
@@ -96,6 +116,11 @@ public void setUp() {
         networkModel._networkOfferingDao = networkOfferingDao;
         networkModel._ntwkSrvcDao = networkServiceMapDao;
         networkModel._ntwkOfferingSrvcDao = networkOfferingServiceMapDao;
+        networkModel.extensionHelper = extensionHelper;
+        networkModel.networkExtensionElement = networkExtensionElement;
+        networkModel._physicalNetworkDao = physicalNetworkDao;
+        networkModel._pNSPDao = physicalNetworkServiceProviderDao;
+        Mockito.lenient().when(extensionHelper.isNetworkExtensionProvider(Mockito.anyString())).thenReturn(false);
     }
 
     private void prepareMocks(boolean isIp6, Network network, DataCenter zone, VpcVO vpc,
@@ -242,8 +267,8 @@ public void testGetProviderToIpList() {
         networkOfferingVO.setForVpc(true);
         Network network = new NetworkVO();
         List<NetworkServiceMapVO> networkServiceMapVOs = new ArrayList<>();
-        networkServiceMapVOs.add(new NetworkServiceMapVO(15L, Network.Service.Firewall, Network.Provider.VPCVirtualRouter));
-        networkServiceMapVOs.add(new NetworkServiceMapVO(15L, Network.Service.SourceNat, Network.Provider.VPCVirtualRouter));
+        networkServiceMapVOs.add(new NetworkServiceMapVO(15L, Network.Service.Firewall.getName(), Network.Provider.VPCVirtualRouter.getName()));
+        networkServiceMapVOs.add(new NetworkServiceMapVO(15L, Network.Service.SourceNat.getName(), Network.Provider.VPCVirtualRouter.getName()));
         NetworkElement element = new VpcVirtualRouterElement();
 
         ReflectionTestUtils.setField(networkModel, "networkElements", List.of(element));
@@ -273,4 +298,158 @@ public void getNicProfile_validInputs_returnsNicProfile() {
 
         assertNotNull(result);
     }
+
+    // -----------------------------------------------------------------------
+    // Tests for getElementImplementingProvider with extension provider
+    // -----------------------------------------------------------------------
+
+    @Test
+    public void getElementImplementingProviderReturnsExtensionElementForExtensionProvider() {
+        String providerName = "my-ext-provider";
+        // Provider is not in the static map, so element would be null
+        ReflectionTestUtils.setField(networkModel, "networkElements", new ArrayList<>());
+        when(extensionHelper.isNetworkExtensionProvider(providerName)).thenReturn(true);
+        NetworkExtensionElement mockElement = mock(NetworkExtensionElement.class);
+        when(networkExtensionElement.withProviderName(providerName)).thenReturn(mockElement);
+
+        NetworkElement result = networkModel.getElementImplementingProvider(providerName);
+        // When the element is a NetworkExtensionElement (which is a NetworkElement), result should not be null
+        assertNotNull(result);
+    }
+
+    @Test
+    public void getElementImplementingProviderReturnsNullForUnknownNonExtensionProvider() {
+        String providerName = "unknown-provider";
+        ReflectionTestUtils.setField(networkModel, "networkElements", new ArrayList<>());
+        when(extensionHelper.isNetworkExtensionProvider(providerName)).thenReturn(false);
+
+        NetworkElement result = networkModel.getElementImplementingProvider(providerName);
+        assertNull(result);
+    }
+
+    // -----------------------------------------------------------------------
+    // Tests for resolveProvider
+    // -----------------------------------------------------------------------
+
+    @Test
+    public void resolveProviderReturnsKnownProvider() {
+        Network.Provider result = networkModel.resolveProvider(Network.Provider.VirtualRouter.getName());
+        assertNotNull(result);
+        assertEquals(Network.Provider.VirtualRouter, result);
+    }
+
+    @Test
+    public void resolveProviderReturnsTransientProviderForExtensionProvider() {
+        String extensionName = "my-ext-network-provider";
+        when(extensionHelper.isNetworkExtensionProvider(extensionName)).thenReturn(true);
+
+        Network.Provider result = networkModel.resolveProvider(extensionName);
+        assertNotNull(result);
+        assertEquals(extensionName, result.getName());
+    }
+
+    @Test
+    public void resolveProviderReturnsNullForUnknownNonExtensionProvider() {
+        String providerName = "totally-unknown";
+        when(extensionHelper.isNetworkExtensionProvider(providerName)).thenReturn(false);
+
+        Network.Provider result = networkModel.resolveProvider(providerName);
+        assertNull(result);
+    }
+
+    // -----------------------------------------------------------------------
+    // Tests for canElementEnableIndividualServicesByName
+    // -----------------------------------------------------------------------
+
+    @Test
+    public void canElementEnableIndividualServicesByNameReturnsFalseForNullProvider() {
+        assertFalse(networkModel.canElementEnableIndividualServicesByName(null));
+    }
+
+    @Test
+    public void canElementEnableIndividualServicesByNameReturnsFalseForUnknownProvider() {
+        when(extensionHelper.isNetworkExtensionProvider("unknown")).thenReturn(false);
+        assertFalse(networkModel.canElementEnableIndividualServicesByName("unknown"));
+    }
+
+    // -----------------------------------------------------------------------
+    // Tests for getExternalProviderCapabilities
+    // -----------------------------------------------------------------------
+
+    @Test
+    public void getExternalProviderCapabilitiesCallsExtensionHelper() {
+        Map<Network.Service, Map<Network.Capability, String>> caps = new HashMap<>();
+        when(extensionHelper.getNetworkCapabilitiesForProvider(10L, "my-ext")).thenReturn(caps);
+
+        Map<Network.Service, Map<Network.Capability, String>> result =
+                networkModel.getExternalProviderCapabilities(10L, "my-ext");
+        assertEquals(caps, result);
+    }
+
+    // -----------------------------------------------------------------------
+    // Tests for isServiceProvidedByNsp (via listSupportedNetworkServiceProviders)
+    // -----------------------------------------------------------------------
+
+    @Test
+    public void listSupportedNetworkServiceProvidersIncludesExtensionBackedProvidersWhenServiceIsSupported() {
+        PhysicalNetworkServiceProviderVO nsp = mock(PhysicalNetworkServiceProviderVO.class);
+        when(nsp.getProviderName()).thenReturn("my-ext");
+        when(nsp.isFirewallServiceProvided()).thenReturn(true);
+        when(physicalNetworkServiceProviderDao.listAll()).thenReturn(List.of(nsp));
+
+        Extension extension = mock(Extension.class);
+        when(extension.getName()).thenReturn("my-ext");
+        when(extensionHelper.listExtensionsByType(Extension.Type.NetworkOrchestrator)).thenReturn(List.of(extension));
+
+        when(extensionHelper.isNetworkExtensionProvider("my-ext")).thenReturn(true);
+
+        // networkElements is empty so no standard providers found
+        ReflectionTestUtils.setField(networkModel, "networkElements", new ArrayList<>());
+
+        NetworkExtensionElement mockElement = mock(NetworkExtensionElement.class);
+        Map<Network.Service, Map<Network.Capability, String>> capabilities = new HashMap<>();
+        capabilities.put(Network.Service.Firewall, new HashMap<>());
+        when(networkExtensionElement.withProviderName("my-ext")).thenReturn(mockElement);
+        when(mockElement.getCapabilities()).thenReturn(capabilities);
+
+        List<? extends Network.Provider> result =
+                networkModel.listSupportedNetworkServiceProviders(Network.Service.Firewall.getName());
+
+        boolean found = result.stream().anyMatch(p -> "my-ext".equalsIgnoreCase(p.getName()));
+        assertTrue("Extension-backed provider should be included", found);
+
+        Mockito.verify(physicalNetworkServiceProviderDao, Mockito.times(1)).listAll();
+        Mockito.verify(physicalNetworkServiceProviderDao, Mockito.never()).listBy(Mockito.anyLong());
+    }
+
+    @Test
+    public void listSupportedNetworkServiceProvidersExcludesExtensionBackedProvidersWhenServiceIsNotSupported() {
+        PhysicalNetworkServiceProviderVO nsp = mock(PhysicalNetworkServiceProviderVO.class);
+        when(nsp.getProviderName()).thenReturn("my-ext");
+        when(nsp.isFirewallServiceProvided()).thenReturn(true);
+        when(physicalNetworkServiceProviderDao.listAll()).thenReturn(List.of(nsp));
+
+        Extension extension = mock(Extension.class);
+        when(extension.getName()).thenReturn("my-ext");
+        when(extensionHelper.listExtensionsByType(Extension.Type.NetworkOrchestrator)).thenReturn(List.of(extension));
+
+        when(extensionHelper.isNetworkExtensionProvider("my-ext")).thenReturn(true);
+
+        // networkElements is empty so no standard providers found
+        ReflectionTestUtils.setField(networkModel, "networkElements", new ArrayList<>());
+
+        NetworkExtensionElement mockElement = mock(NetworkExtensionElement.class);
+        Map<Network.Service, Map<Network.Capability, String>> capabilities = new HashMap<>();
+        when(networkExtensionElement.withProviderName("my-ext")).thenReturn(mockElement);
+        when(mockElement.getCapabilities()).thenReturn(capabilities);
+
+        List<? extends Network.Provider> result =
+                networkModel.listSupportedNetworkServiceProviders(Network.Service.Firewall.getName());
+
+        boolean found = result.stream().anyMatch(p -> "my-ext".equalsIgnoreCase(p.getName()));
+        assertFalse("Extension-backed provider should NOT be included", found);
+
+        Mockito.verify(physicalNetworkServiceProviderDao, Mockito.times(1)).listAll();
+        Mockito.verify(physicalNetworkServiceProviderDao, Mockito.never()).listBy(Mockito.anyLong());
+    }
 }
diff --git a/server/src/test/java/com/cloud/network/as/AutoScaleManagerImplTest.java b/server/src/test/java/com/cloud/network/as/AutoScaleManagerImplTest.java
index 1660e1938386..a492d0bec21b 100644
--- a/server/src/test/java/com/cloud/network/as/AutoScaleManagerImplTest.java
+++ b/server/src/test/java/com/cloud/network/as/AutoScaleManagerImplTest.java
@@ -427,6 +427,8 @@ public void setUp() {
         when(conditionDao.findById(any())).thenReturn(conditionMock);
         when(conditionDao.persist(any(ConditionVO.class))).thenReturn(conditionMock);
 
+        when(networkModel.resolveProvider(counterProvider)).thenReturn(Network.Provider.VirtualRouter);
+
         when(accountManager.finalizeOwner(nullable(Account.class), nullable(String.class), nullable(Long.class), nullable(Long.class))).thenReturn(account);
         Mockito.doNothing().when(accountManager).checkAccess(Mockito.any(Account.class), Mockito.isNull(), Mockito.anyBoolean(), Mockito.any());
 
@@ -1514,13 +1516,14 @@ public void testDoScaleUp() throws ResourceUnavailableException, InsufficientCap
             when(loadBalancerVMMapMock.getInstanceId()).thenReturn(virtualMachineId + 1);
 
             when(loadBalancingRulesService.assignToLoadBalancer(anyLong(), any(), any(), any(), eq(true))).thenReturn(true);
-            Mockito.doReturn(new Pair<UserVmVO, Map<VirtualMachineProfile.Param, Object>>(userVmMock, null)).when(userVmMgr).startVirtualMachine(virtualMachineId, null, new HashMap<>(), null);
+            Mockito.doReturn(new Pair<UserVmVO, Map<VirtualMachineProfile.Param, Object>>(userVmMock, null)).when(userVmMgr).startVirtualMachine(virtualMachineId, null,
+                    new HashMap<>(), null, false);
 
             autoScaleManagerImplSpy.doScaleUp(vmGroupId, 1);
 
             Mockito.verify(autoScaleManagerImplSpy).createNewVM(asVmGroupMock);
             Mockito.verify(loadBalancingRulesService).assignToLoadBalancer(anyLong(), any(), any(), any(), eq(true));
-            Mockito.verify(userVmMgr).startVirtualMachine(virtualMachineId, null, new HashMap<>(), null);
+            Mockito.verify(userVmMgr).startVirtualMachine(virtualMachineId, null, new HashMap<>(), null, false);
         }
     }
 
diff --git a/server/src/test/java/com/cloud/network/element/ConfigDriveNetworkElementTest.java b/server/src/test/java/com/cloud/network/element/ConfigDriveNetworkElementTest.java
index 0aab5afce4a5..336f9990c12b 100644
--- a/server/src/test/java/com/cloud/network/element/ConfigDriveNetworkElementTest.java
+++ b/server/src/test/java/com/cloud/network/element/ConfigDriveNetworkElementTest.java
@@ -62,6 +62,8 @@
 import com.google.common.collect.Maps;
 import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.engine.orchestration.service.NetworkOrchestrationService;
+import org.apache.cloudstack.extension.ExtensionHelper;
+import org.springframework.test.util.ReflectionTestUtils;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreManager;
 import org.apache.cloudstack.engine.subsystem.api.storage.EndPoint;
@@ -151,6 +153,7 @@ public class ConfigDriveNetworkElementTest {
     @Mock private CallContext callContextMock;
     @Mock private DomainVO domainVO;
     @Mock private NetworkOrchestrationService _networkOrchestrationService;
+    @Mock private ExtensionHelper extensionHelper;
 
     @Spy @InjectMocks
     private ConfigDriveNetworkElement _configDrivesNetworkElement = new ConfigDriveNetworkElement();
@@ -202,6 +205,8 @@ public void setUp() throws NoSuchFieldException, IllegalAccessException {
         doReturn(_configDrivesNetworkElement.getProvider().getName()).when(_ntwkSrvcDao).getProviderForServiceInNetwork(NETWORK_ID, Network.Service.UserData);
 
         _networkModel.setNetworkElements(Arrays.asList(_configDrivesNetworkElement));
+        ReflectionTestUtils.setField(_networkModel, "extensionHelper", extensionHelper);
+        Mockito.lenient().when(extensionHelper.isNetworkExtensionProvider(Mockito.anyString())).thenReturn(false);
         _networkModel.start();
 
     }
diff --git a/server/src/test/java/com/cloud/network/element/VpcVirtualRouterElementTest.java b/server/src/test/java/com/cloud/network/element/VpcVirtualRouterElementTest.java
index 20ddb39d9432..a9928c487870 100644
--- a/server/src/test/java/com/cloud/network/element/VpcVirtualRouterElementTest.java
+++ b/server/src/test/java/com/cloud/network/element/VpcVirtualRouterElementTest.java
@@ -19,10 +19,13 @@
 import com.cloud.dc.DataCenterVO;
 import com.cloud.dc.dao.DataCenterDao;
 import com.cloud.exception.ResourceUnavailableException;
+import com.cloud.network.Network;
+import com.cloud.network.NetworkModel;
 import com.cloud.network.RemoteAccessVpn;
 import com.cloud.network.VpnUser;
 import com.cloud.network.router.VpcVirtualNetworkApplianceManagerImpl;
 import com.cloud.network.vpc.Vpc;
+import com.cloud.network.vpc.VpcManager;
 import com.cloud.network.vpc.dao.VpcDao;
 import com.cloud.utils.db.EntityManager;
 import com.cloud.vm.DomainRouterVO;
@@ -43,7 +46,9 @@
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
+import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
@@ -60,6 +65,12 @@ public class VpcVirtualRouterElementTest {
     @Mock
     EntityManager _entityMgr;
 
+    @Mock
+    NetworkModel _networkMdl;
+
+    @Mock
+    VpcManager _vpcMgr;
+
     @Mock
     NetworkTopologyContext networkTopologyContext;
 
@@ -188,4 +199,19 @@ public void testApplyVpnUsersException2() {
 
         verify(remoteAccessVpn, times(1)).getVpcId();
     }
+
+    @Test
+    public void testCanHandleFirewallUsesVpcCapability() {
+        final Network network = Mockito.mock(Network.class);
+
+        when(_networkMdl.getPhysicalNetworkId(network)).thenReturn(1L);
+        when(network.getId()).thenReturn(200L);
+        when(network.getVpcId()).thenReturn(100L);
+        when(_networkMdl.isProviderEnabledInPhysicalNetwork(1L, Network.Provider.VPCVirtualRouter.getName())).thenReturn(true);
+        when(_networkMdl.isProviderSupportServiceInNetwork(200L, Network.Service.Firewall, Network.Provider.VPCVirtualRouter)).thenReturn(true);
+
+        assertTrue(vpcVirtualRouterElement.canHandle(network, Network.Service.Firewall));
+        verify(_networkMdl).isProviderSupportServiceInNetwork(200L, Network.Service.Firewall, Network.Provider.VPCVirtualRouter);
+        verify(_vpcMgr, never()).isProviderSupportServiceInVpc(100L, Network.Service.Firewall, Network.Provider.VPCVirtualRouter);
+    }
 }
diff --git a/server/src/test/java/com/cloud/network/firewall/FirewallManagerImplTest.java b/server/src/test/java/com/cloud/network/firewall/FirewallManagerImplTest.java
new file mode 100644
index 000000000000..f1f653363a4a
--- /dev/null
+++ b/server/src/test/java/com/cloud/network/firewall/FirewallManagerImplTest.java
@@ -0,0 +1,178 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.network.firewall;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.Collections;
+import java.util.List;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import com.cloud.exception.ResourceUnavailableException;
+import com.cloud.network.Network;
+import com.cloud.network.NetworkModel;
+import com.cloud.network.dao.NetworkServiceMapDao;
+import com.cloud.network.element.FirewallServiceProvider;
+import com.cloud.network.element.NetworkElement;
+import com.cloud.network.element.PortForwardingServiceProvider;
+import com.cloud.network.rules.FirewallRule;
+import com.cloud.network.rules.PortForwardingRule;
+
+@RunWith(MockitoJUnitRunner.Silent.class)
+public class FirewallManagerImplTest {
+
+    interface MockFwElement extends NetworkElement, FirewallServiceProvider {}
+    interface MockPfElement extends NetworkElement, PortForwardingServiceProvider {}
+
+    @Spy
+    @InjectMocks
+    private FirewallManagerImpl firewallManager;
+
+    @Mock
+    private NetworkModel _networkModel;
+
+    @Mock
+    private NetworkServiceMapDao networkServiceMapDao;
+
+    @Before
+    public void setUp() {
+        ReflectionTestUtils.setField(firewallManager, "_firewallElements", Collections.emptyList());
+        ReflectionTestUtils.setField(firewallManager, "_pfElements", Collections.emptyList());
+        ReflectionTestUtils.setField(firewallManager, "_staticNatElements", Collections.emptyList());
+        ReflectionTestUtils.setField(firewallManager, "_networkAclElements", Collections.emptyList());
+    }
+
+    // -----------------------------------------------------------------------
+    // Tests for applyRules with extension-backed Firewall provider
+    // -----------------------------------------------------------------------
+
+    @Test
+    public void applyRulesFirewallHandledByExtensionProvider() throws ResourceUnavailableException {
+        Network network = mock(Network.class);
+        when(network.getId()).thenReturn(1L);
+
+        FirewallRule rule = mock(FirewallRule.class);
+        List<? extends FirewallRule> rules = List.of(rule);
+
+        // No standard firewall elements handle it
+        String extProviderName = "my-ext-fw-provider";
+        when(networkServiceMapDao.getProviderForServiceInNetwork(1L, Network.Service.Firewall))
+                .thenReturn(extProviderName);
+
+        // The element implementing the provider is both NetworkElement and FirewallServiceProvider
+        MockFwElement element = mock(MockFwElement.class);
+        when(element.applyFWRules(eq(network), any())).thenReturn(true);
+        when(_networkModel.getElementImplementingProvider(extProviderName)).thenReturn(element);
+
+        boolean result = firewallManager.applyRules(network, FirewallRule.Purpose.Firewall, rules);
+        assertTrue(result);
+        verify(element).applyFWRules(eq(network), any());
+    }
+
+    @Test
+    public void applyRulesFirewallReturnsFalseWhenNoExtensionProviderFound() throws ResourceUnavailableException {
+        Network network = mock(Network.class);
+        when(network.getId()).thenReturn(2L);
+
+        FirewallRule rule = mock(FirewallRule.class);
+        List<? extends FirewallRule> rules = List.of(rule);
+
+        // No standard provider and no extension provider found
+        when(networkServiceMapDao.getProviderForServiceInNetwork(2L, Network.Service.Firewall))
+                .thenReturn(null);
+
+        boolean result = firewallManager.applyRules(network, FirewallRule.Purpose.Firewall, rules);
+        assertFalse(result);
+        verify(_networkModel, never()).getElementImplementingProvider(any());
+    }
+
+    // -----------------------------------------------------------------------
+    // Tests for applyRules with extension-backed PortForwarding provider
+    // -----------------------------------------------------------------------
+
+    @Test
+    public void applyRulesPortForwardingHandledByExtensionProvider() throws ResourceUnavailableException {
+        Network network = mock(Network.class);
+        when(network.getId()).thenReturn(3L);
+
+        PortForwardingRule rule = mock(PortForwardingRule.class);
+        @SuppressWarnings("unchecked")
+        List<PortForwardingRule> rules = List.of(rule);
+
+        String extProviderName = "my-ext-pf-provider";
+        when(networkServiceMapDao.getProviderForServiceInNetwork(3L, Network.Service.PortForwarding))
+                .thenReturn(extProviderName);
+
+        MockPfElement element = mock(MockPfElement.class);
+        when(element.applyPFRules(eq(network), any())).thenReturn(true);
+        when(_networkModel.getElementImplementingProvider(extProviderName)).thenReturn(element);
+
+        boolean result = firewallManager.applyRules(network, FirewallRule.Purpose.PortForwarding, rules);
+        assertTrue(result);
+        verify(element).applyPFRules(eq(network), any());
+    }
+
+    @Test
+    public void applyRulesPortForwardingReturnsFalseWhenNoExtensionProviderFound() throws ResourceUnavailableException {
+        Network network = mock(Network.class);
+        when(network.getId()).thenReturn(4L);
+
+        PortForwardingRule rule = mock(PortForwardingRule.class);
+        List<? extends FirewallRule> rules = List.of(rule);
+
+        when(networkServiceMapDao.getProviderForServiceInNetwork(4L, Network.Service.PortForwarding))
+                .thenReturn(null);
+
+        boolean result = firewallManager.applyRules(network, FirewallRule.Purpose.PortForwarding, rules);
+        assertFalse(result);
+    }
+
+    // -----------------------------------------------------------------------
+    // Tests for StaticNat (handled by Firewall elements)
+    // -----------------------------------------------------------------------
+
+    @Test
+    public void applyRulesStaticNatReturnsFalseWhenNoProviderFound() throws ResourceUnavailableException {
+        Network network = mock(Network.class);
+        when(network.getId()).thenReturn(5L);
+
+        FirewallRule rule = mock(FirewallRule.class);
+        List<? extends FirewallRule> rules = List.of(rule);
+
+        when(networkServiceMapDao.getProviderForServiceInNetwork(5L, Network.Service.Firewall))
+                .thenReturn(null);
+
+        boolean result = firewallManager.applyRules(network, FirewallRule.Purpose.StaticNat, rules);
+        assertFalse(result);
+    }
+}
diff --git a/server/src/test/java/com/cloud/network/firewall/FirewallManagerTest.java b/server/src/test/java/com/cloud/network/firewall/FirewallManagerTest.java
index bacef85479a2..e35fb479ba69 100644
--- a/server/src/test/java/com/cloud/network/firewall/FirewallManagerTest.java
+++ b/server/src/test/java/com/cloud/network/firewall/FirewallManagerTest.java
@@ -17,27 +17,36 @@
 
 package com.cloud.network.firewall;
 
+import com.cloud.exception.InvalidParameterValueException;
 import com.cloud.exception.NetworkRuleConflictException;
 import com.cloud.exception.ResourceUnavailableException;
 import com.cloud.network.IpAddressManager;
 import com.cloud.network.Network;
+import com.cloud.network.Network.Capability;
+import com.cloud.network.Network.Service;
 import com.cloud.network.NetworkModel;
 import com.cloud.network.NetworkRuleApplier;
 import com.cloud.network.dao.FirewallRulesDao;
+import com.cloud.network.dao.IPAddressDao;
+import com.cloud.network.dao.IPAddressVO;
 import com.cloud.network.dao.NetworkDao;
 import com.cloud.network.dao.NetworkVO;
 import com.cloud.network.element.FirewallServiceProvider;
 import com.cloud.network.element.VirtualRouterElement;
 import com.cloud.network.element.VpcVirtualRouterElement;
 import com.cloud.network.rules.FirewallRule;
+import com.cloud.network.rules.FirewallRule.FirewallRuleType;
 import com.cloud.network.rules.FirewallRule.Purpose;
 import com.cloud.network.rules.FirewallRuleVO;
 import com.cloud.network.vpc.Vpc;
 import com.cloud.network.vpc.VpcManager;
+import com.cloud.user.Account;
 import com.cloud.user.AccountManager;
 import com.cloud.user.DomainManager;
 import com.cloud.utils.component.ComponentContext;
+import com.cloud.utils.exception.CloudRuntimeException;
 import org.apache.cloudstack.engine.orchestration.service.NetworkOrchestrationService;
+import org.apache.cloudstack.network.RoutedIpv4Manager;
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
@@ -53,12 +62,18 @@
 
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashMap;
 import java.util.List;
+import java.util.Map;
 
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyBoolean;
+import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
 import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
@@ -79,9 +94,13 @@ public class FirewallManagerTest {
     @Mock
     IpAddressManager _ipAddrMgr;
     @Mock
+    RoutedIpv4Manager routedIpv4Manager;
+    @Mock
     FirewallRulesDao _firewallDao;
     @Mock
     NetworkDao _networkDao;
+    @Mock
+    IPAddressDao _ipAddressDao;
 
     @Spy
     @InjectMocks
@@ -115,7 +134,7 @@ public void tearDown() throws Exception {
     }
 
     private FirewallRule createFirewallRule(int startPort, int endPort, Purpose purpose) {
-        return new FirewallRuleVO("xid", 1L, startPort, endPort, "TCP", 2, 3, 4, purpose, new ArrayList<>(),
+        return new FirewallRuleVO("xid", 1L, startPort, endPort, "TCP", 2L, 3, 4, purpose, new ArrayList<>(),
                 new ArrayList<>(), 5, 6, null, FirewallRule.TrafficType.Ingress);
     }
 
@@ -332,4 +351,376 @@ public void checkIfRulesHaveConflictingPortRangesTestBothRulesArePortForwardingA
 
         Assert.assertFalse(result);
     }
+
+    @Test
+    public void testValidateFirewallRuleVpcWithoutAssociatedNetworkUsesVpcCapabilities() {
+        final Account caller = Mockito.mock(Account.class);
+        final IPAddressVO ipAddress = Mockito.mock(IPAddressVO.class);
+        final NetworkVO network = Mockito.mock(NetworkVO.class);
+        final FirewallServiceProvider firewallServiceProvider = Mockito.mock(FirewallServiceProvider.class);
+        final Map<Capability, String> firewallCaps = new HashMap<>();
+        final Map<Service, Map<Capability, String>> capabilities = new HashMap<>();
+
+        firewallCaps.put(Capability.SupportedTrafficDirection, "ingress, egress");
+        firewallCaps.put(Capability.SupportedProtocols, "tcp,udp,icmp");
+        firewallCaps.put(Capability.SupportedEgressProtocols, "tcp,udp,icmp");
+        capabilities.put(Service.Firewall, firewallCaps);
+
+        when(ipAddress.getVpcId()).thenReturn(10L);
+        when(_networkModel.getNetwork(2L)).thenReturn(network);
+        when(network.getVpcId()).thenReturn(10L);
+        when(routedIpv4Manager.isVirtualRouterGateway(network)).thenReturn(false);
+        when(firewallServiceProvider.getProvider()).thenReturn(Network.Provider.VPCVirtualRouter);
+        when(firewallServiceProvider.getCapabilities()).thenReturn(capabilities);
+        when(_vpcMgr.isProviderSupportServiceInVpc(10L, Service.Firewall, Network.Provider.VPCVirtualRouter)).thenReturn(true);
+        _firewallMgr._firewallElements = List.of(firewallServiceProvider);
+
+        _firewallMgr.validateFirewallRule(caller, ipAddress, 80, 80, "tcp", Purpose.Firewall, FirewallRuleType.User, 2L, FirewallRule.TrafficType.Ingress);
+
+        verify(_networkModel, Mockito.never()).getNetworkServiceCapabilities(Mockito.anyLong(), Mockito.eq(Service.Firewall));
+    }
+
+    @Test
+    public void testIsVpcIpAddressReturnsTrueWhenVpcIdPresent() {
+        IPAddressVO ipAddress = Mockito.mock(IPAddressVO.class);
+        when(ipAddress.getVpcId()).thenReturn(5L);
+        Assert.assertTrue(_firewallMgr.isVpcIpAddress(ipAddress));
+    }
+
+    @Test
+    public void testIsVpcIpAddressReturnsFalseWhenVpcIdNull() {
+        IPAddressVO ipAddress = Mockito.mock(IPAddressVO.class);
+        when(ipAddress.getVpcId()).thenReturn(null);
+        Assert.assertFalse(_firewallMgr.isVpcIpAddress(ipAddress));
+    }
+
+    @Test
+    public void testValidateFirewallRuleForIsolatedIpReturnsNetworkId() {
+        IPAddressVO ipAddress = Mockito.mock(IPAddressVO.class);
+        when(ipAddress.getAssociatedWithNetworkId()).thenReturn(42L);
+        Long result = _firewallMgr.validateFirewallRuleForIsolatedIp(ipAddress);
+        Assert.assertEquals(Long.valueOf(42L), result);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testValidateFirewallRuleForIsolatedIpThrowsWhenNotAssociated() {
+        IPAddressVO ipAddress = Mockito.mock(IPAddressVO.class);
+        when(ipAddress.getAssociatedWithNetworkId()).thenReturn(null);
+        _firewallMgr.validateFirewallRuleForIsolatedIp(ipAddress);
+    }
+
+    @Test
+    public void testValidateFirewallRuleForVpcIpReturnsNetworkId() {
+        IPAddressVO ipAddress = Mockito.mock(IPAddressVO.class);
+        Long result = _firewallMgr.validateFirewallRuleForVpcIp(ipAddress, 99L);
+        Assert.assertEquals(Long.valueOf(99L), result);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testValidateFirewallRuleForVpcIpThrowsWhenNetworkIdNull() {
+        IPAddressVO ipAddress = Mockito.mock(IPAddressVO.class);
+        _firewallMgr.validateFirewallRuleForVpcIp(ipAddress, null);
+    }
+
+    @Test
+    public void testGetFirewallServiceCapabilitiesForNonVpcNetworkUsesNetworkModel() {
+        NetworkVO network = Mockito.mock(NetworkVO.class);
+        when(network.getId()).thenReturn(1L);
+        when(network.getVpcId()).thenReturn(null);
+        Map<Capability, String> caps = new HashMap<>();
+        caps.put(Capability.SupportedProtocols, "tcp,udp");
+        when(_networkModel.getNetworkServiceCapabilities(1L, Service.Firewall)).thenReturn(caps);
+
+        Map<Network.Capability, String> result = _firewallMgr.getFirewallServiceCapabilities(network);
+
+        Assert.assertEquals(caps, result);
+        verify(_networkModel, times(1)).getNetworkServiceCapabilities(1L, Service.Firewall);
+    }
+
+    @Test
+    public void testGetFirewallServiceCapabilitiesForVpcNetworkUsesVpcProvider() {
+        NetworkVO network = Mockito.mock(NetworkVO.class);
+        FirewallServiceProvider fwProvider = Mockito.mock(FirewallServiceProvider.class);
+        Map<Capability, String> firewallCaps = new HashMap<>();
+        firewallCaps.put(Capability.SupportedProtocols, "tcp,udp,icmp");
+        Map<Service, Map<Capability, String>> providerCapabilities = new HashMap<>();
+        providerCapabilities.put(Service.Firewall, firewallCaps);
+
+        when(network.getVpcId()).thenReturn(10L);
+        when(fwProvider.getProvider()).thenReturn(Network.Provider.VPCVirtualRouter);
+        when(fwProvider.getCapabilities()).thenReturn(providerCapabilities);
+        when(_vpcMgr.isProviderSupportServiceInVpc(10L, Service.Firewall, Network.Provider.VPCVirtualRouter)).thenReturn(true);
+        _firewallMgr._firewallElements = List.of(fwProvider);
+
+        Map<Network.Capability, String> result = _firewallMgr.getFirewallServiceCapabilities(network);
+
+        Assert.assertEquals(firewallCaps, result);
+        verify(_networkModel, never()).getNetworkServiceCapabilities(Mockito.anyLong(), Mockito.eq(Service.Firewall));
+    }
+
+    @Test
+    public void testGetFirewallServiceCapabilitiesForVpcNetworkFallsBackToNetworkModelWhenNoProvider() {
+        NetworkVO network = Mockito.mock(NetworkVO.class);
+        FirewallServiceProvider fwProvider = Mockito.mock(FirewallServiceProvider.class);
+        Map<Capability, String> fallbackCaps = new HashMap<>();
+
+        when(network.getId()).thenReturn(1L);
+        when(network.getVpcId()).thenReturn(10L);
+        when(fwProvider.getProvider()).thenReturn(Network.Provider.VPCVirtualRouter);
+        when(_vpcMgr.isProviderSupportServiceInVpc(10L, Service.Firewall, Network.Provider.VPCVirtualRouter)).thenReturn(false);
+        when(_networkModel.getNetworkServiceCapabilities(1L, Service.Firewall)).thenReturn(fallbackCaps);
+        _firewallMgr._firewallElements = List.of(fwProvider);
+
+        Map<Network.Capability, String> result = _firewallMgr.getFirewallServiceCapabilities(network);
+
+        Assert.assertEquals(fallbackCaps, result);
+        verify(_networkModel, times(1)).getNetworkServiceCapabilities(1L, Service.Firewall);
+    }
+
+    @Test
+    public void testGetFirewallServiceCapabilitiesForVpcReturnsCapabilitiesWhenProviderSupports() {
+        FirewallServiceProvider fwProvider = Mockito.mock(FirewallServiceProvider.class);
+        Map<Capability, String> firewallCaps = new HashMap<>();
+        firewallCaps.put(Capability.SupportedProtocols, "tcp,udp");
+        Map<Service, Map<Capability, String>> caps = new HashMap<>();
+        caps.put(Service.Firewall, firewallCaps);
+
+        when(fwProvider.getProvider()).thenReturn(Network.Provider.VPCVirtualRouter);
+        when(fwProvider.getCapabilities()).thenReturn(caps);
+        when(_vpcMgr.isProviderSupportServiceInVpc(10L, Service.Firewall, Network.Provider.VPCVirtualRouter)).thenReturn(true);
+        _firewallMgr._firewallElements = List.of(fwProvider);
+
+        Map<Network.Capability, String> result = _firewallMgr.getFirewallServiceCapabilitiesForVpc(10L);
+
+        Assert.assertNotNull(result);
+        Assert.assertEquals("tcp,udp", result.get(Capability.SupportedProtocols));
+    }
+
+    @Test
+    public void testGetFirewallServiceCapabilitiesForVpcReturnsNullWhenNoProviderSupports() {
+        FirewallServiceProvider fwProvider = Mockito.mock(FirewallServiceProvider.class);
+        when(fwProvider.getProvider()).thenReturn(Network.Provider.VPCVirtualRouter);
+        when(_vpcMgr.isProviderSupportServiceInVpc(10L, Service.Firewall, Network.Provider.VPCVirtualRouter)).thenReturn(false);
+        _firewallMgr._firewallElements = List.of(fwProvider);
+
+        Map<Network.Capability, String> result = _firewallMgr.getFirewallServiceCapabilitiesForVpc(10L);
+
+        Assert.assertNull(result);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testValidateFirewallRuleForVpcThrowsOnInvalidStartPort() {
+        Account caller = Mockito.mock(Account.class);
+        _firewallMgr.validateFirewallRuleForVpc(caller, null, -1, 80, "tcp", Purpose.Firewall, FirewallRuleType.User, 10L, FirewallRule.TrafficType.Ingress);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testValidateFirewallRuleForVpcThrowsOnInvalidEndPort() {
+        Account caller = Mockito.mock(Account.class);
+        _firewallMgr.validateFirewallRuleForVpc(caller, null, 80, 70000, "tcp", Purpose.Firewall, FirewallRuleType.User, 10L, FirewallRule.TrafficType.Ingress);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testValidateFirewallRuleForVpcThrowsWhenStartPortGreaterThanEndPort() {
+        Account caller = Mockito.mock(Account.class);
+        _firewallMgr.validateFirewallRuleForVpc(caller, null, 200, 100, "tcp", Purpose.Firewall, FirewallRuleType.User, 10L, FirewallRule.TrafficType.Ingress);
+    }
+
+    @Test
+    public void testValidateFirewallRuleForVpcSystemTypeWithNullIpReturnsEarly() {
+        // System rule type + null IP should return without further validation
+        Account caller = Mockito.mock(Account.class);
+        // Should not throw even though vpcId checks come after this
+        _firewallMgr.validateFirewallRuleForVpc(caller, null, 80, 80, "tcp", Purpose.Firewall, FirewallRuleType.System, 10L, FirewallRule.TrafficType.Ingress);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testValidateFirewallRuleForVpcThrowsWhenVpcIdNullAndNotSystemRule() {
+        Account caller = Mockito.mock(Account.class);
+        IPAddressVO ipAddress = Mockito.mock(IPAddressVO.class);
+        _firewallMgr.validateFirewallRuleForVpc(caller, ipAddress, 80, 80, "tcp", Purpose.Firewall, FirewallRuleType.User, null, FirewallRule.TrafficType.Ingress);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testValidateFirewallRuleForVpcThrowsWhenActiveVpcNotFound() {
+        Account caller = Mockito.mock(Account.class);
+        IPAddressVO ipAddress = Mockito.mock(IPAddressVO.class);
+        when(_vpcMgr.getActiveVpc(10L)).thenReturn(null);
+        _firewallMgr.validateFirewallRuleForVpc(caller, ipAddress, 80, 80, "tcp", Purpose.Firewall, FirewallRuleType.User, 10L, FirewallRule.TrafficType.Ingress);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testValidateFirewallRuleForVpcThrowsWhenFirewallServiceNotSupported() {
+        Account caller = Mockito.mock(Account.class);
+        IPAddressVO ipAddress = Mockito.mock(IPAddressVO.class);
+        Vpc vpc = Mockito.mock(Vpc.class);
+        when(_vpcMgr.getActiveVpc(10L)).thenReturn(vpc);
+        _firewallMgr._firewallElements = Collections.emptyList();
+
+        _firewallMgr.validateFirewallRuleForVpc(caller, ipAddress, 80, 80, "tcp", Purpose.Firewall, FirewallRuleType.User, 10L, FirewallRule.TrafficType.Ingress);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testValidateFirewallRuleForVpcThrowsOnUnsupportedProtocol() {
+        Account caller = Mockito.mock(Account.class);
+        IPAddressVO ipAddress = Mockito.mock(IPAddressVO.class);
+        Vpc vpc = Mockito.mock(Vpc.class);
+        FirewallServiceProvider fwProvider = Mockito.mock(FirewallServiceProvider.class);
+        Map<Capability, String> firewallCaps = new HashMap<>();
+        firewallCaps.put(Capability.SupportedProtocols, "tcp,udp");
+        firewallCaps.put(Capability.SupportedTrafficDirection, "ingress,egress");
+        Map<Service, Map<Capability, String>> caps = new HashMap<>();
+        caps.put(Service.Firewall, firewallCaps);
+
+        when(_vpcMgr.getActiveVpc(10L)).thenReturn(vpc);
+        when(fwProvider.getProvider()).thenReturn(Network.Provider.VPCVirtualRouter);
+        when(fwProvider.getCapabilities()).thenReturn(caps);
+        when(_vpcMgr.isProviderSupportServiceInVpc(10L, Service.Firewall, Network.Provider.VPCVirtualRouter)).thenReturn(true);
+        _firewallMgr._firewallElements = List.of(fwProvider);
+
+        _firewallMgr.validateFirewallRuleForVpc(caller, ipAddress, 80, 80, "gre", Purpose.Firewall, FirewallRuleType.User, 10L, FirewallRule.TrafficType.Ingress);
+    }
+
+    @Test
+    public void testValidateFirewallRuleForVpcSucceedsWithSupportedProtocolAndTrafficType() {
+        Account caller = Mockito.mock(Account.class);
+        IPAddressVO ipAddress = Mockito.mock(IPAddressVO.class);
+        Vpc vpc = Mockito.mock(Vpc.class);
+        FirewallServiceProvider fwProvider = Mockito.mock(FirewallServiceProvider.class);
+        Map<Capability, String> firewallCaps = new HashMap<>();
+        firewallCaps.put(Capability.SupportedProtocols, "tcp,udp,icmp");
+        firewallCaps.put(Capability.SupportedTrafficDirection, "ingress,egress");
+        Map<Service, Map<Capability, String>> caps = new HashMap<>();
+        caps.put(Service.Firewall, firewallCaps);
+
+        when(_vpcMgr.getActiveVpc(10L)).thenReturn(vpc);
+        when(fwProvider.getProvider()).thenReturn(Network.Provider.VPCVirtualRouter);
+        when(fwProvider.getCapabilities()).thenReturn(caps);
+        when(_vpcMgr.isProviderSupportServiceInVpc(10L, Service.Firewall, Network.Provider.VPCVirtualRouter)).thenReturn(true);
+        _firewallMgr._firewallElements = List.of(fwProvider);
+
+        // Should not throw
+        _firewallMgr.validateFirewallRuleForVpc(caller, ipAddress, 80, 80, "tcp", Purpose.Firewall, FirewallRuleType.User, 10L, FirewallRule.TrafficType.Ingress);
+
+        verify(_accountMgr, times(1)).checkAccess(caller, null, true, ipAddress);
+    }
+
+    @Test
+    public void testCreateFirewallRuleRoutesToVpcWhenVpcIdProvided() throws NetworkRuleConflictException {
+        Account caller = Mockito.mock(Account.class);
+        FirewallRule vpcRule = Mockito.mock(FirewallRule.class);
+
+        doReturn(vpcRule).when(_firewallMgr).createFirewallRuleForVpc(
+                Mockito.anyLong(), Mockito.eq(caller), Mockito.any(), Mockito.anyInt(), Mockito.anyInt(),
+                Mockito.anyString(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(),
+                Mockito.any(), Mockito.any(FirewallRuleType.class), Mockito.anyLong(),
+                Mockito.any(FirewallRule.TrafficType.class), Mockito.anyBoolean());
+
+        _firewallMgr.createFirewallRule(1L, caller, "xid", 80, 80, "tcp",
+                Collections.singletonList("0.0.0.0/0"), null, null, null, null,
+                FirewallRuleType.User, null, 10L, FirewallRule.TrafficType.Ingress, true);
+
+        verify(_firewallMgr, times(1)).createFirewallRuleForVpc(
+                Mockito.anyLong(), Mockito.eq(caller), Mockito.any(), Mockito.anyInt(), Mockito.anyInt(),
+                Mockito.anyString(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(),
+                Mockito.any(), Mockito.any(FirewallRuleType.class), Mockito.anyLong(),
+                Mockito.any(FirewallRule.TrafficType.class), Mockito.anyBoolean());
+
+        verify(_firewallMgr, never()).createFirewallRuleForNonVPC(
+                Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(),
+                Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(),
+                Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
+    }
+
+    @Test
+    public void testCreateFirewallRuleRoutesToNonVpcWhenVpcIdNull() throws NetworkRuleConflictException {
+        Account caller = Mockito.mock(Account.class);
+        FirewallRule nonVpcRule = Mockito.mock(FirewallRule.class);
+
+        doReturn(nonVpcRule).when(_firewallMgr).createFirewallRuleForNonVPC(
+                Mockito.any(), Mockito.eq(caller), Mockito.any(), Mockito.any(), Mockito.any(),
+                Mockito.anyString(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(),
+                Mockito.any(), Mockito.any(FirewallRuleType.class), Mockito.anyLong(),
+                Mockito.any(FirewallRule.TrafficType.class), Mockito.anyBoolean());
+
+        _firewallMgr.createFirewallRule(null, caller, "xid", 80, 80, "tcp",
+                Collections.singletonList("0.0.0.0/0"), null, null, null, null,
+                FirewallRuleType.User, 2L, null, FirewallRule.TrafficType.Ingress, true);
+
+        verify(_firewallMgr, times(1)).createFirewallRuleForNonVPC(
+                Mockito.any(), Mockito.eq(caller), Mockito.any(), Mockito.any(), Mockito.any(),
+                Mockito.anyString(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(),
+                Mockito.any(), Mockito.any(FirewallRuleType.class), Mockito.anyLong(),
+                Mockito.any(FirewallRule.TrafficType.class), Mockito.anyBoolean());
+
+        verify(_firewallMgr, never()).createFirewallRuleForVpc(
+                Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(),
+                Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(),
+                Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
+    }
+
+    @Test
+    public void testApplyRulesForVpcNetworkUsesVpcProviderCheck() throws ResourceUnavailableException {
+        FirewallManagerImpl firewallMgr = new FirewallManagerImpl();
+        firewallMgr._networkModel = _networkModel;
+        firewallMgr._vpcMgr = _vpcMgr;
+
+        Network network = Mockito.mock(Network.class);
+        FirewallServiceProvider fwProvider = Mockito.mock(FirewallServiceProvider.class);
+        List<FirewallRule> rules = new ArrayList<>();
+        FirewallRuleVO rule = new FirewallRuleVO("rule1", 1L, 80, 80, "tcp", 1L, 2, 3, Purpose.Firewall,
+                Collections.emptyList(), Collections.emptyList(), null, null, null, FirewallRule.TrafficType.Ingress);
+        rules.add(rule);
+
+        when(network.getVpcId()).thenReturn(10L);
+        when(fwProvider.getProvider()).thenReturn(Network.Provider.VPCVirtualRouter);
+        when(_vpcMgr.isProviderSupportServiceInVpc(10L, Service.Firewall, Network.Provider.VPCVirtualRouter)).thenReturn(true);
+        when(fwProvider.applyFWRules(Mockito.eq(network), Mockito.anyList())).thenReturn(true);
+        firewallMgr._firewallElements = List.of(fwProvider);
+
+        boolean result = firewallMgr.applyRules(network, Purpose.Firewall, rules);
+
+        Assert.assertTrue(result);
+        verify(_vpcMgr, times(1)).isProviderSupportServiceInVpc(10L, Service.Firewall, Network.Provider.VPCVirtualRouter);
+        verify(_networkModel, never()).isProviderSupportServiceInNetwork(Mockito.anyLong(), Mockito.eq(Service.Firewall), Mockito.any());
+    }
+
+    @Test
+    public void testApplyRulesForNonVpcNetworkUsesNetworkModelProviderCheck() throws ResourceUnavailableException {
+        FirewallManagerImpl firewallMgr = new FirewallManagerImpl();
+        firewallMgr._networkModel = _networkModel;
+        firewallMgr._vpcMgr = _vpcMgr;
+
+        Network network = Mockito.mock(Network.class);
+        FirewallServiceProvider fwProvider = Mockito.mock(FirewallServiceProvider.class);
+        List<FirewallRule> rules = new ArrayList<>();
+        FirewallRuleVO rule = new FirewallRuleVO("rule1", 1L, 80, 80, "tcp", 1L, 2, 3, Purpose.Firewall,
+                Collections.emptyList(), Collections.emptyList(), null, null, null, FirewallRule.TrafficType.Ingress);
+        rules.add(rule);
+
+        when(network.getId()).thenReturn(1L);
+        when(network.getVpcId()).thenReturn(null);
+        when(fwProvider.getProvider()).thenReturn(Network.Provider.VirtualRouter);
+        when(_networkModel.isProviderSupportServiceInNetwork(1L, Service.Firewall, Network.Provider.VirtualRouter)).thenReturn(true);
+        when(fwProvider.applyFWRules(Mockito.eq(network), Mockito.anyList())).thenReturn(true);
+        firewallMgr._firewallElements = List.of(fwProvider);
+
+        boolean result = firewallMgr.applyRules(network, Purpose.Firewall, rules);
+
+        Assert.assertTrue(result);
+        verify(_networkModel, times(1)).isProviderSupportServiceInNetwork(1L, Service.Firewall, Network.Provider.VirtualRouter);
+        verify(_vpcMgr, never()).isProviderSupportServiceInVpc(Mockito.anyLong(), Mockito.eq(Service.Firewall), Mockito.any());
+    }
+
+    @Test
+    public void testGetSourceIpForIngressRuleReturnsNullWhenIdIsNull() {
+        IPAddressVO result = _firewallMgr.getSourceIpForIngressRule(null);
+        Assert.assertNull(result);
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testGetSourceIpForIngressRuleReturnsNullWhenIpIsnotPresent() {
+        when(_ipAddressDao.findById(1L)).thenReturn(null);
+        _firewallMgr.getSourceIpForIngressRule(1L);
+    }
 }
diff --git a/server/src/test/java/com/cloud/network/guru/NetworkExtensionGuestNetworkGuruTest.java b/server/src/test/java/com/cloud/network/guru/NetworkExtensionGuestNetworkGuruTest.java
new file mode 100644
index 000000000000..a70b1a0eeb6d
--- /dev/null
+++ b/server/src/test/java/com/cloud/network/guru/NetworkExtensionGuestNetworkGuruTest.java
@@ -0,0 +1,110 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.network.guru;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import org.apache.cloudstack.extension.ExtensionHelper;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mock;
+import org.mockito.MockitoAnnotations;
+
+import com.cloud.dc.DataCenter.NetworkType;
+import com.cloud.network.Network;
+import com.cloud.network.Network.GuestType;
+import com.cloud.network.Networks.TrafficType;
+import com.cloud.network.dao.PhysicalNetworkVO;
+import com.cloud.offering.NetworkOffering;
+import com.cloud.offerings.dao.NetworkOfferingServiceMapDao;
+
+public class NetworkExtensionGuestNetworkGuruTest {
+
+    private final NetworkExtensionGuestNetworkGuru guru = new NetworkExtensionGuestNetworkGuru();
+
+    @Mock
+    private NetworkOffering offering;
+    @Mock
+    private PhysicalNetworkVO physicalNetwork;
+    @Mock
+    private NetworkOfferingServiceMapDao networkOfferingServiceMapDao;
+    @Mock
+    private ExtensionHelper extensionHelper;
+
+    private AutoCloseable closeable;
+
+    @Before
+    public void setup() {
+        closeable = MockitoAnnotations.openMocks(this);
+        guru.networkOfferingServiceMapDao = networkOfferingServiceMapDao;
+        guru.extensionHelper = extensionHelper;
+
+        when(offering.getId()).thenReturn(42L);
+        when(offering.getTrafficType()).thenReturn(TrafficType.Guest);
+        when(offering.getGuestType()).thenReturn(GuestType.Isolated);
+        when(offering.isSystemOnly()).thenReturn(false);
+        when(physicalNetwork.getId()).thenReturn(7L);
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        closeable.close();
+    }
+
+    @Test
+    public void canHandleWhenOfferingUsesStaticNetworkExtensionProvider() {
+        String provider = Network.Provider.NetworkExtension.getName();
+        when(networkOfferingServiceMapDao.getDistinctProviders(offering.getId())).thenReturn(List.of(provider));
+        when(extensionHelper.isNetworkExtensionProvider(provider)).thenReturn(true);
+        when(extensionHelper.usesNetworkExtensionIsolation(provider)).thenReturn(true);
+
+        assertTrue(guru.canHandle(offering, NetworkType.Advanced, physicalNetwork));
+    }
+
+    @Test
+    public void canHandleWhenOfferingUsesDynamicExtensionProvider() {
+        when(networkOfferingServiceMapDao.getDistinctProviders(offering.getId())).thenReturn(List.of("my-ext"));
+        when(extensionHelper.isNetworkExtensionProvider("my-ext")).thenReturn(true);
+        when(extensionHelper.usesNetworkExtensionIsolation("my-ext")).thenReturn(true);
+
+        assertTrue(guru.canHandle(offering, NetworkType.Advanced, physicalNetwork));
+    }
+
+    @Test
+    public void cannotHandleWhenIsolationMethodDetailIsNotExtension() {
+        when(networkOfferingServiceMapDao.getDistinctProviders(offering.getId())).thenReturn(List.of("my-ext"));
+        when(extensionHelper.isNetworkExtensionProvider("my-ext")).thenReturn(true);
+        when(extensionHelper.usesNetworkExtensionIsolation("my-ext")).thenReturn(false);
+
+        assertFalse(guru.canHandle(offering, NetworkType.Advanced, physicalNetwork));
+    }
+
+    @Test
+    public void cannotHandleWhenNoExtensionProvidersArePresent() {
+        when(networkOfferingServiceMapDao.getDistinctProviders(offering.getId()))
+                .thenReturn(List.of(Network.Provider.VirtualRouter.getName()));
+        when(extensionHelper.isNetworkExtensionProvider(Network.Provider.VirtualRouter.getName())).thenReturn(false);
+
+        assertFalse(guru.canHandle(offering, NetworkType.Advanced, physicalNetwork));
+    }
+
+}
diff --git a/server/src/test/java/com/cloud/network/router/CommandSetupHelperTest.java b/server/src/test/java/com/cloud/network/router/CommandSetupHelperTest.java
index bdd905841f92..34909e7e860f 100644
--- a/server/src/test/java/com/cloud/network/router/CommandSetupHelperTest.java
+++ b/server/src/test/java/com/cloud/network/router/CommandSetupHelperTest.java
@@ -46,6 +46,8 @@
 import com.cloud.vm.NicVO;
 import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.dao.NicDao;
+import org.apache.cloudstack.engine.orchestration.service.NetworkOrchestrationService;
+import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.network.BgpPeerVO;
 import org.apache.cloudstack.network.dao.BgpPeerDetailsDao;
 import org.junit.Assert;
@@ -271,4 +273,42 @@ public void testCreateBgpPeersCommandsForVpc() {
         Assert.assertTrue(cmd instanceof SetBgpPeersCommand);
         Assert.assertEquals(4, ((SetBgpPeersCommand) cmd).getBpgPeers().length);
     }
+
+    @Test
+    public void testDhcpLeaseTimeoutDefaultValue() {
+        // Test that the default value is 0 (infinite)
+        Integer defaultValue = NetworkOrchestrationService.DhcpLeaseTimeout.value();
+        Assert.assertEquals("Default DHCP lease timeout should be 0 (infinite)", 0, defaultValue.intValue());
+    }
+
+    @Test
+    public void testDhcpLeaseTimeoutAcceptsZero() {
+        // Test that 0 value is accepted (infinite lease)
+        ConfigKey<Integer> configKey = NetworkOrchestrationService.DhcpLeaseTimeout;
+        Assert.assertNotNull("ConfigKey should not be null", configKey);
+        Assert.assertEquals("ConfigKey default should be 0", "0", configKey.defaultValue());
+    }
+
+    @Test
+    public void testDhcpLeaseTimeoutAcceptsPositiveValues() {
+        // Test that positive values are accepted
+        ConfigKey<Integer> configKey = NetworkOrchestrationService.DhcpLeaseTimeout;
+        Assert.assertNotNull("ConfigKey should not be null", configKey);
+        // Verify the config key exists and has expected default
+        Assert.assertEquals("ConfigKey default should be 0", "0", configKey.defaultValue());
+    }
+
+    @Test
+    public void testDhcpLeaseTimeoutHasZoneScope() {
+        // Test that the ConfigKey has Zone scope
+        ConfigKey<Integer> configKey = NetworkOrchestrationService.DhcpLeaseTimeout;
+        Assert.assertTrue("ConfigKey should have Zone scope", configKey.getScopes().contains(ConfigKey.Scope.Zone));
+    }
+
+    @Test
+    public void testDhcpLeaseTimeoutIsDynamic() {
+        // Test that the ConfigKey is dynamic (can be updated at runtime)
+        ConfigKey<Integer> configKey = NetworkOrchestrationService.DhcpLeaseTimeout;
+        Assert.assertTrue("ConfigKey should be dynamic", configKey.isDynamic());
+    }
 }
diff --git a/server/src/test/java/com/cloud/network/router/DhcpLeaseTimeoutIntegrationTest.java b/server/src/test/java/com/cloud/network/router/DhcpLeaseTimeoutIntegrationTest.java
new file mode 100644
index 000000000000..198129ace6f8
--- /dev/null
+++ b/server/src/test/java/com/cloud/network/router/DhcpLeaseTimeoutIntegrationTest.java
@@ -0,0 +1,184 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.network.router;
+
+import com.cloud.agent.api.Command;
+import com.cloud.agent.api.routing.DhcpEntryCommand;
+import com.cloud.agent.manager.Commands;
+import com.cloud.dc.DataCenterVO;
+import com.cloud.dc.dao.DataCenterDao;
+import com.cloud.network.NetworkModel;
+import com.cloud.network.dao.NetworkDao;
+import com.cloud.network.dao.NetworkDetailsDao;
+import com.cloud.offerings.dao.NetworkOfferingDao;
+import com.cloud.offerings.dao.NetworkOfferingDetailsDao;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.NicVO;
+import com.cloud.vm.dao.NicDao;
+import org.apache.cloudstack.engine.orchestration.service.NetworkOrchestrationService;
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.Mockito.when;
+
+/**
+ * Integration tests for DHCP lease timeout functionality.
+ * Tests the end-to-end flow from ConfigKey through DhcpEntryCommand creation.
+ */
+@RunWith(MockitoJUnitRunner.class)
+public class DhcpLeaseTimeoutIntegrationTest {
+
+    @InjectMocks
+    protected CommandSetupHelper commandSetupHelper = new CommandSetupHelper();
+
+    @Mock
+    NicDao nicDao;
+    @Mock
+    NetworkDao networkDao;
+    @Mock
+    NetworkModel networkModel;
+    @Mock
+    NetworkOfferingDao networkOfferingDao;
+    @Mock
+    NetworkOfferingDetailsDao networkOfferingDetailsDao;
+    @Mock
+    NetworkDetailsDao networkDetailsDao;
+    @Mock
+    RouterControlHelper routerControlHelper;
+    @Mock
+    DataCenterDao dcDao;
+
+    private VirtualRouter mockRouter;
+    private UserVmVO mockVm;
+    private NicVO mockNic;
+    private DataCenterVO mockDc;
+
+    @Before
+    public void setUp() {
+        ReflectionTestUtils.setField(commandSetupHelper, "_nicDao", nicDao);
+        ReflectionTestUtils.setField(commandSetupHelper, "_networkDao", networkDao);
+        ReflectionTestUtils.setField(commandSetupHelper, "_networkModel", networkModel);
+        ReflectionTestUtils.setField(commandSetupHelper, "_networkOfferingDao", networkOfferingDao);
+        ReflectionTestUtils.setField(commandSetupHelper, "networkOfferingDetailsDao", networkOfferingDetailsDao);
+        ReflectionTestUtils.setField(commandSetupHelper, "networkDetailsDao", networkDetailsDao);
+        ReflectionTestUtils.setField(commandSetupHelper, "_routerControlHelper", routerControlHelper);
+        ReflectionTestUtils.setField(commandSetupHelper, "_dcDao", dcDao);
+
+        // Create common mocks
+        mockRouter = Mockito.mock(VirtualRouter.class);
+        mockVm = Mockito.mock(UserVmVO.class);
+        mockNic = Mockito.mock(NicVO.class);
+        mockDc = Mockito.mock(DataCenterVO.class);
+
+        // Setup default mock behaviors
+        when(mockRouter.getId()).thenReturn(100L);
+        when(mockRouter.getInstanceName()).thenReturn("r-100-VM");
+        when(mockRouter.getDataCenterId()).thenReturn(1L);
+
+        when(mockVm.getHostName()).thenReturn("test-vm");
+
+        when(mockNic.getMacAddress()).thenReturn("02:00:0a:0b:0c:0d");
+        when(mockNic.getIPv4Address()).thenReturn("10.1.1.10");
+        when(mockNic.getIPv6Address()).thenReturn(null);
+        when(mockNic.getNetworkId()).thenReturn(400L);
+        when(mockNic.isDefaultNic()).thenReturn(true);
+
+        when(dcDao.findById(anyLong())).thenReturn(mockDc);
+        when(mockDc.getNetworkType()).thenReturn(com.cloud.dc.DataCenter.NetworkType.Advanced);
+        when(routerControlHelper.getRouterControlIp(anyLong())).thenReturn("10.1.1.1");
+        when(routerControlHelper.getRouterIpInNetwork(anyLong(), anyLong())).thenReturn("10.1.1.1");
+        when(networkModel.getExecuteInSeqNtwkElmtCmd()).thenReturn(false);
+    }
+
+    @Test
+    public void testDhcpEntryCommandContainsLeaseTime() {
+        // Test that DhcpEntryCommand includes the lease time from ConfigKey
+        Commands cmds = new Commands(Command.OnError.Continue);
+        commandSetupHelper.createDhcpEntryCommand(mockRouter, mockVm, mockNic, false, cmds);
+
+        Assert.assertEquals("Should have one DHCP command", 1, cmds.size());
+        DhcpEntryCommand dhcpCmd = (DhcpEntryCommand) cmds.toCommands()[0];
+        Assert.assertNotNull("DHCP command should not be null", dhcpCmd);
+        Assert.assertNotNull("Lease time should not be null", dhcpCmd.getLeaseTime());
+
+        // Default value should be 0 (infinite)
+        Assert.assertEquals("Default lease time should be 0", Long.valueOf(0L), dhcpCmd.getLeaseTime());
+    }
+
+    @Test
+    public void testDhcpEntryCommandUsesZoneScopedValue() {
+        // Test that the command uses zone-scoped configuration
+        Long zoneId = mockRouter.getDataCenterId();
+        Integer expectedLeaseTime = NetworkOrchestrationService.DhcpLeaseTimeout.valueIn(zoneId);
+
+        Commands cmds = new Commands(Command.OnError.Continue);
+        commandSetupHelper.createDhcpEntryCommand(mockRouter, mockVm, mockNic, false, cmds);
+
+        DhcpEntryCommand dhcpCmd = (DhcpEntryCommand) cmds.toCommands()[0];
+        Assert.assertEquals("Lease time should match zone-scoped config",
+                expectedLeaseTime.longValue(), dhcpCmd.getLeaseTime().longValue());
+    }
+
+    @Test
+    public void testInfiniteLeaseWithZeroValue() {
+        // Test that 0 value represents infinite lease
+        ConfigKey<Integer> configKey = NetworkOrchestrationService.DhcpLeaseTimeout;
+        Assert.assertEquals("Default value should be 0 for infinite lease", "0", configKey.defaultValue());
+
+        Commands cmds = new Commands(Command.OnError.Continue);
+        commandSetupHelper.createDhcpEntryCommand(mockRouter, mockVm, mockNic, false, cmds);
+
+        DhcpEntryCommand dhcpCmd = (DhcpEntryCommand) cmds.toCommands()[0];
+        Assert.assertEquals("Lease time 0 represents infinite lease", Long.valueOf(0L), dhcpCmd.getLeaseTime());
+    }
+
+    @Test
+    public void testDhcpCommandForNonDefaultNic() {
+        // Test DHCP command creation for non-default NIC
+        when(mockNic.isDefaultNic()).thenReturn(false);
+
+        Commands cmds = new Commands(Command.OnError.Continue);
+        commandSetupHelper.createDhcpEntryCommand(mockRouter, mockVm, mockNic, false, cmds);
+
+        DhcpEntryCommand dhcpCmd = (DhcpEntryCommand) cmds.toCommands()[0];
+        Assert.assertNotNull("DHCP command should be created for non-default NIC", dhcpCmd);
+        Assert.assertNotNull("Lease time should be set even for non-default NIC", dhcpCmd.getLeaseTime());
+        Assert.assertFalse("Command should reflect non-default NIC", dhcpCmd.isDefault());
+    }
+
+    @Test
+    public void testDhcpCommandWithRemoveFlag() {
+        // Test DHCP command with remove flag set
+        Commands cmds = new Commands(Command.OnError.Continue);
+        commandSetupHelper.createDhcpEntryCommand(mockRouter, mockVm, mockNic, true, cmds);
+
+        DhcpEntryCommand dhcpCmd = (DhcpEntryCommand) cmds.toCommands()[0];
+        Assert.assertNotNull("DHCP command should be created even with remove flag", dhcpCmd);
+        Assert.assertTrue("Remove flag should be set", dhcpCmd.isRemove());
+        // Lease time should still be included even for removal
+        Assert.assertNotNull("Lease time should be present even for removal", dhcpCmd.getLeaseTime());
+    }
+}
diff --git a/server/src/test/java/com/cloud/network/vpc/NetworkACLManagerTest.java b/server/src/test/java/com/cloud/network/vpc/NetworkACLManagerTest.java
index 651d7cb6aef3..09d3ebd762da 100644
--- a/server/src/test/java/com/cloud/network/vpc/NetworkACLManagerTest.java
+++ b/server/src/test/java/com/cloud/network/vpc/NetworkACLManagerTest.java
@@ -68,7 +68,6 @@
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.ArgumentMatchers.nullable;
-import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 
 @RunWith(SpringJUnit4ClassRunner.class)
@@ -92,6 +91,8 @@ public class NetworkACLManagerTest extends TestCase {
     @Inject
     NetworkModel _networkModel;
     @Inject
+    NetworkServiceMapDao networkServiceMapDao;
+    @Inject
     List<NetworkACLServiceProvider> _networkAclElements;
     @Inject
     VpcService _vpcSvc;
@@ -169,8 +170,7 @@ public void driveTestApplyNetworkACL(final boolean result, final boolean applyNe
         final List<NetworkVO> networks = new ArrayList<>();
         networks.add(network);
 
-        NetworkServiceMapDao ntwkSrvcDao = mock(NetworkServiceMapDao.class);
-        when(ntwkSrvcDao.canProviderSupportServiceInNetwork(anyLong(), eq(Network.Service.NetworkACL), nullable(Network.Provider.class))).thenReturn(true);
+        when(networkServiceMapDao.canProviderSupportServiceInNetwork(anyLong(), eq(Network.Service.NetworkACL), nullable(Network.Provider.class))).thenReturn(true);
         Mockito.when(_networkDao.listByAclId(anyLong())).thenReturn(networks);
         Mockito.when(_networkDao.findById(anyLong())).thenReturn(network);
         Mockito.when(networkOfferingDao.isIpv6Supported(anyLong())).thenReturn(false);
@@ -277,6 +277,11 @@ public NetworkModel networkModel() {
             return Mockito.mock(NetworkModel.class);
         }
 
+        @Bean
+        public NetworkServiceMapDao networkServiceMapDao() {
+            return Mockito.mock(NetworkServiceMapDao.class);
+        }
+
         @Bean
         public VpcManager vpcManager() {
             return Mockito.mock(VpcManager.class);
diff --git a/server/src/test/java/com/cloud/network/vpc/VpcManagerImplTest.java b/server/src/test/java/com/cloud/network/vpc/VpcManagerImplTest.java
index 8b8259421cd0..2acad0c2b45d 100644
--- a/server/src/test/java/com/cloud/network/vpc/VpcManagerImplTest.java
+++ b/server/src/test/java/com/cloud/network/vpc/VpcManagerImplTest.java
@@ -43,6 +43,7 @@
 import com.cloud.network.dao.IPAddressVO;
 import com.cloud.network.dao.NetworkDao;
 import com.cloud.network.element.NetworkElement;
+import com.cloud.network.element.VpcProvider;
 import com.cloud.network.router.CommandSetupHelper;
 import com.cloud.network.router.NetworkHelper;
 import com.cloud.network.router.VirtualRouter;
@@ -72,6 +73,8 @@
 import org.apache.cloudstack.api.command.user.vpc.UpdateVPCCmd;
 import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.engine.orchestration.service.NetworkOrchestrationService;
+import org.apache.cloudstack.extension.Extension;
+import org.apache.cloudstack.extension.ExtensionHelper;
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.network.Ipv4GuestSubnetNetworkMap;
 import org.apache.cloudstack.network.RoutedIpv4Manager;
@@ -90,6 +93,7 @@
 import java.lang.reflect.Field;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
@@ -99,6 +103,7 @@
 
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyBoolean;
 import static org.mockito.ArgumentMatchers.anyInt;
@@ -247,14 +252,21 @@ private void overrideDefaultConfigValue(final ConfigKey configKey, final String
     @Test
     public void getVpcOffSvcProvidersMapForEmptyServiceTest() {
         long vpcOffId = 1L;
+        VpcOfferingServiceMapVO svcMap = mock(VpcOfferingServiceMapVO.class);
+        Mockito.when(svcMap.getService()).thenReturn(Service.SourceNat.getName());
+        Mockito.when(svcMap.getProvider()).thenReturn(Provider.VPCVirtualRouter.getName());
+        Mockito.when(networkModel.resolveProvider(Provider.VPCVirtualRouter.getName()))
+               .thenReturn(Provider.VPCVirtualRouter);
         List<VpcOfferingServiceMapVO> list = new ArrayList<VpcOfferingServiceMapVO>();
-        list.add(mock(VpcOfferingServiceMapVO.class));
+        list.add(svcMap);
         Mockito.when(manager._vpcOffSvcMapDao.listByVpcOffId(vpcOffId)).thenReturn(list);
 
         Map<Service, Set<Provider>> map = manager.getVpcOffSvcProvidersMap(vpcOffId);
 
         assertNotNull(map);
         assertEquals(map.size(), 1);
+        assertTrue(map.containsKey(Service.SourceNat));
+        assertTrue(map.get(Service.SourceNat).contains(Provider.VPCVirtualRouter));
     }
 
     protected Map<String, String> createFakeCapabilityInputMap() {
@@ -601,4 +613,49 @@ public void testIsNetworkOnVpcEnabledConserveModeVpcNetworkConserveMode() {
         Assert.assertTrue(manager.isNetworkOnVpcEnabledConserveMode(network));
     }
 
+    // -----------------------------------------------------------------------
+    // Tests for getVpcElements with extension-backed NetworkOrchestrator
+    // -----------------------------------------------------------------------
+
+    @Test
+    public void getVpcElementsIncludesExtensionBackedVpcProvider() {
+        manager.setVpcElements(null);
+
+        Mockito.when(networkModel.getElementImplementingProvider(Provider.VPCVirtualRouter.getName())).thenReturn(null);
+        Mockito.when(networkModel.getElementImplementingProvider(Provider.JuniperContrailVpcRouter.getName())).thenReturn(null);
+
+        Extension ext = mock(Extension.class);
+        Mockito.when(ext.getName()).thenReturn("my-vpc-ext");
+
+        ExtensionHelper extHelper = mock(ExtensionHelper.class);
+        Mockito.when(extHelper.listExtensionsByType(Extension.Type.NetworkOrchestrator))
+                .thenReturn(List.of(ext));
+        manager.extensionHelper = extHelper;
+
+        // The element for the extension also implements VpcProvider
+        VpcProvider vpcProviderElement = mock(VpcProvider.class);
+        Mockito.when(networkModel.getElementImplementingProvider("my-vpc-ext")).thenReturn((NetworkElement) vpcProviderElement);
+
+        List<VpcProvider> result = manager.getVpcElements();
+        Assert.assertNotNull(result);
+        Assert.assertTrue(result.contains(vpcProviderElement));
+    }
+
+    @Test
+    public void getVpcElementsReturnsEmptyListWhenNoStaticNorExtensionProviders() {
+        manager.setVpcElements(null);
+
+        Mockito.when(networkModel.getElementImplementingProvider(Provider.VPCVirtualRouter.getName())).thenReturn(null);
+        Mockito.when(networkModel.getElementImplementingProvider(Provider.JuniperContrailVpcRouter.getName())).thenReturn(null);
+
+        ExtensionHelper extHelper = mock(ExtensionHelper.class);
+        Mockito.when(extHelper.listExtensionsByType(Extension.Type.NetworkOrchestrator))
+                .thenReturn(Collections.emptyList());
+        manager.extensionHelper = extHelper;
+
+        List<VpcProvider> result = manager.getVpcElements();
+        Assert.assertNotNull(result);
+        Assert.assertTrue(result.isEmpty());
+    }
+
 }
diff --git a/server/src/test/java/com/cloud/resource/ResourceManagerImplTest.java b/server/src/test/java/com/cloud/resource/ResourceManagerImplTest.java
index 30a021591a5d..d644b036949a 100644
--- a/server/src/test/java/com/cloud/resource/ResourceManagerImplTest.java
+++ b/server/src/test/java/com/cloud/resource/ResourceManagerImplTest.java
@@ -1211,4 +1211,96 @@ public void executeUserRequestDefaultOverloadPassesFalseForDeleteHost() throws E
 
         Mockito.verify(resourceManager).doDeleteHost(hostId, false, false);
     }
+
+    @Test
+    public void testUpdateClusterStorageAccessGroupsWithEmptyHostsInCluster() {
+        Long clusterId = 1L;
+        List<String> newStorageAccessGroups = Arrays.asList("sag1", "sag2");
+
+        ClusterVO cluster = Mockito.mock(ClusterVO.class);
+        Mockito.when(cluster.getId()).thenReturn(clusterId);
+        Mockito.when(cluster.getStorageAccessGroups()).thenReturn("sag3,sag4"); // existing SAGs
+        Mockito.when(resourceManager.getCluster(clusterId)).thenReturn(cluster);
+        List<HostVO> emptyHostsList = new ArrayList<>();
+        Mockito.when(hostDao.findHypervisorHostInCluster(clusterId)).thenReturn(emptyHostsList);
+        Mockito.when(hostDao.findByClusterId(clusterId, Host.Type.Routing)).thenReturn(emptyHostsList);
+        List<Long> emptyHostIdsList = new ArrayList<>();
+        Mockito.doReturn(emptyHostIdsList).when(resourceManager)
+                .listOfHostIdsUsingTheStorageAccessGroups(Mockito.anyList(), eq(clusterId), eq(null), eq(null));
+        try {
+            resourceManager.updateClusterStorageAccessGroups(clusterId, newStorageAccessGroups);
+        } catch (CloudRuntimeException e) {
+            Assert.fail("updateClusterStorageAccessGroups should not throw CloudRuntimeException when cluster has no hosts. Error: " + e.getMessage());
+        }
+        Mockito.verify(resourceManager).checkIfAllHostsInUse(Mockito.anyList(), eq(clusterId), eq(null), eq(null));
+    }
+
+    @Test
+    public void testUpdateClusterStorageAccessGroupsWithEmptyHostsInZone() {
+        List<String> sagsToDelete = Arrays.asList("tag1", "tag2");
+        Long clusterId = null;
+        Long podId = null;
+        Long zoneId = 3L;
+
+        List<Long> emptyHostIdsList = new ArrayList<>();
+        Mockito.doReturn(emptyHostIdsList).when(resourceManager)
+                .listOfHostIdsUsingTheStorageAccessGroups(sagsToDelete, clusterId, podId, zoneId);
+        List<HostVO> emptyHostsInZone = new ArrayList<>();
+        Mockito.doReturn(emptyHostsInZone).when(hostDao).findByDataCenterId(zoneId);
+
+        try {
+            resourceManager.checkIfAllHostsInUse(sagsToDelete, clusterId, podId, zoneId);
+        } catch (CloudRuntimeException e) {
+            Assert.fail("checkIfAllHostsInUse should not throw CloudRuntimeException when zone has no hosts. Error: " + e.getMessage());
+        }
+        Mockito.verify(resourceManager).checkIfAllHostsInUse(Mockito.anyList(), eq(null), eq(null), eq(zoneId));
+    }
+
+    @Test
+    public void testUpdateClusterStorageAccessGroupsWithEmptyHostsInPod() {
+        List<String> sagsToDelete = Arrays.asList("tag1", "tag2");
+        Long clusterId = null;
+        Long podId = 2L;
+        Long zoneId = null;
+
+        List<Long> emptyHostIdsList = new ArrayList<>();
+        Mockito.doReturn(emptyHostIdsList).when(resourceManager)
+                .listOfHostIdsUsingTheStorageAccessGroups(sagsToDelete, clusterId, podId, zoneId);
+        List<HostVO> emptyHostsInPod = new ArrayList<>();
+        Mockito.doReturn(emptyHostsInPod).when(hostDao).findByPodId(podId, Host.Type.Routing);
+
+        try {
+            resourceManager.checkIfAllHostsInUse(sagsToDelete, clusterId, podId, zoneId);
+        } catch (CloudRuntimeException e) {
+            Assert.fail("checkIfAllHostsInUse should not throw CloudRuntimeException when pod has no hosts. Error: " + e.getMessage());
+        }
+        Mockito.verify(resourceManager).checkIfAllHostsInUse(Mockito.anyList(), eq(null), eq(podId), eq(null));
+    }
+
+    @Test
+    public void testCheckIfAllHostsInUseWithEmptyHostsInMultipleLevels() {
+        List<String> sagsToDelete = Arrays.asList("tag1", "tag2");
+        Long clusterId = 1L;
+        Long podId = 2L;
+        Long zoneId = 3L;
+
+        List<Long> emptyHostIdsList = new ArrayList<>();
+        Mockito.doReturn(emptyHostIdsList).when(resourceManager)
+                .listOfHostIdsUsingTheStorageAccessGroups(sagsToDelete, clusterId, podId, zoneId);
+        List<HostVO> emptyHostsInZone = new ArrayList<>();
+        List<HostVO> emptyHostsInCluster = new ArrayList<>();
+        List<HostVO> emptyHostsInPod = new ArrayList<>();
+        Mockito.doReturn(emptyHostsInZone).when(hostDao).findByDataCenterId(zoneId);
+        Mockito.doReturn(emptyHostsInCluster).when(hostDao).findByClusterId(clusterId, Host.Type.Routing);
+        Mockito.doReturn(emptyHostsInPod).when(hostDao).findByPodId(podId, Host.Type.Routing);
+
+        try {
+            resourceManager.checkIfAllHostsInUse(sagsToDelete, clusterId, podId, zoneId);
+        } catch (CloudRuntimeException e) {
+            Assert.fail("checkIfAllHostsInUse should not throw CloudRuntimeException when all levels have no hosts. Error: " + e.getMessage());
+        }
+        Mockito.verify(hostDao).findByDataCenterId(zoneId);
+        Mockito.verify(hostDao).findByClusterId(clusterId, Host.Type.Routing);
+        Mockito.verify(hostDao).findByPodId(podId, Host.Type.Routing);
+    }
 }
diff --git a/server/src/test/java/com/cloud/resourcelimit/ResourceLimitManagerImplTest.java b/server/src/test/java/com/cloud/resourcelimit/ResourceLimitManagerImplTest.java
index 18fa16e04a21..a4e0c953c0ee 100644
--- a/server/src/test/java/com/cloud/resourcelimit/ResourceLimitManagerImplTest.java
+++ b/server/src/test/java/com/cloud/resourcelimit/ResourceLimitManagerImplTest.java
@@ -952,7 +952,7 @@ public void testCheckVolumeResourceCount() throws ResourceAllocationException {
         String tag = "tag";
         long delta = 10L;
         Mockito.doReturn(new ArrayList<>()).when(resourceLimitManager)
-                .getResourceLimitStorageTagsForResourceCountOperation(Mockito.anyBoolean(), Mockito.any(DiskOffering.class));
+                .getResourceLimitStorageTagsForResourceCountOperation(Mockito.anyBoolean(), Mockito.any(DiskOffering.class), Mockito.any());
         resourceLimitManager.incrementVolumeResourceCount(1L, false, delta, Mockito.mock(DiskOffering.class));
         Mockito.verify(resourceLimitManager, Mockito.never()).checkResourceLimitWithTag(Mockito.any(Account.class),
                 Mockito.eq(Resource.ResourceType.volume), Mockito.anyString());
@@ -960,7 +960,7 @@ public void testCheckVolumeResourceCount() throws ResourceAllocationException {
                 Mockito.eq(Resource.ResourceType.primary_storage), Mockito.anyString(), Mockito.anyLong());
 
         Mockito.doReturn(List.of(tag)).when(resourceLimitManager)
-                .getResourceLimitStorageTagsForResourceCountOperation(Mockito.anyBoolean(), Mockito.any(DiskOffering.class));
+                .getResourceLimitStorageTagsForResourceCountOperation(Mockito.anyBoolean(), Mockito.any(DiskOffering.class), Mockito.any());
 
         try (MockedConstruction<CheckedReservation> mockCheckedReservation = Mockito.mockConstruction(CheckedReservation.class)) {
             resourceLimitManager.checkVolumeResourceLimit(account, false, delta, Mockito.mock(DiskOffering.class), reservations);
@@ -974,7 +974,7 @@ public void testIncrementVolumeResourceCount() {
         String tag = "tag";
         long delta = 10L;
         Mockito.doReturn(new ArrayList<>()).when(resourceLimitManager)
-                .getResourceLimitStorageTagsForResourceCountOperation(Mockito.anyBoolean(), Mockito.any(DiskOffering.class));
+                .getResourceLimitStorageTagsForResourceCountOperation(Mockito.anyBoolean(), Mockito.any(DiskOffering.class), Mockito.any());
         resourceLimitManager.incrementVolumeResourceCount(accountId, false, delta, Mockito.mock(DiskOffering.class));
         Mockito.verify(resourceLimitManager, Mockito.never()).incrementResourceCountWithTag(Mockito.anyLong(),
                 Mockito.eq(Resource.ResourceType.volume), Mockito.anyString());
@@ -982,7 +982,7 @@ public void testIncrementVolumeResourceCount() {
                 Mockito.eq(Resource.ResourceType.primary_storage), Mockito.anyString(), Mockito.anyLong());
 
         Mockito.doReturn(List.of(tag)).when(resourceLimitManager)
-                .getResourceLimitStorageTagsForResourceCountOperation(Mockito.anyBoolean(), Mockito.any(DiskOffering.class));
+                .getResourceLimitStorageTagsForResourceCountOperation(Mockito.anyBoolean(), Mockito.any(DiskOffering.class), Mockito.any());
         mockIncrementResourceCountWithTag();
         resourceLimitManager.incrementVolumeResourceCount(accountId, false, delta, Mockito.mock(DiskOffering.class));
         Mockito.verify(resourceLimitManager, Mockito.times(1)).incrementResourceCountWithTag(
@@ -997,17 +997,17 @@ public void testDecrementVolumeResourceCount() {
         String tag = "tag";
         long delta = 10L;
         Mockito.doReturn(new ArrayList<>()).when(resourceLimitManager)
-                .getResourceLimitStorageTagsForResourceCountOperation(Mockito.anyBoolean(), Mockito.any(DiskOffering.class));
-        resourceLimitManager.decrementVolumeResourceCount(accountId, false, delta, Mockito.mock(DiskOffering.class));
+                .getResourceLimitStorageTagsForResourceCountOperation(Mockito.anyBoolean(), Mockito.any(DiskOffering.class), Mockito.any());
+        resourceLimitManager.decrementVolumeResourceCount(accountId, false, delta, Mockito.mock(DiskOffering.class), null);
         Mockito.verify(resourceLimitManager, Mockito.never()).decrementResourceCountWithTag(Mockito.anyLong(),
                 Mockito.eq(Resource.ResourceType.volume), Mockito.anyString());
         Mockito.verify(resourceLimitManager, Mockito.never()).decrementResourceCountWithTag(Mockito.anyLong(),
                 Mockito.eq(Resource.ResourceType.primary_storage), Mockito.anyString(), Mockito.anyLong());
 
         Mockito.doReturn(List.of(tag)).when(resourceLimitManager)
-                .getResourceLimitStorageTagsForResourceCountOperation(Mockito.anyBoolean(), Mockito.any(DiskOffering.class));
+                .getResourceLimitStorageTagsForResourceCountOperation(Mockito.anyBoolean(), Mockito.any(DiskOffering.class), Mockito.any());
         mockDecrementResourceCountWithTag();
-        resourceLimitManager.decrementVolumeResourceCount(accountId, false, delta, Mockito.mock(DiskOffering.class));
+        resourceLimitManager.decrementVolumeResourceCount(accountId, false, delta, Mockito.mock(DiskOffering.class), null);
         Mockito.verify(resourceLimitManager, Mockito.times(1)).decrementResourceCountWithTag(
                 1L, Resource.ResourceType.volume, tag);
         Mockito.verify(resourceLimitManager, Mockito.times(1))
@@ -1020,13 +1020,13 @@ public void testIncrementVolumePrimaryStorageResourceCount() {
         String tag = "tag";
         long delta = 10L;
         Mockito.doReturn(new ArrayList<>()).when(resourceLimitManager)
-                .getResourceLimitStorageTagsForResourceCountOperation(Mockito.anyBoolean(), Mockito.any(DiskOffering.class));
+                .getResourceLimitStorageTagsForResourceCountOperation(Mockito.anyBoolean(), Mockito.any(DiskOffering.class), Mockito.any());
         resourceLimitManager.incrementVolumePrimaryStorageResourceCount(accountId, false, delta, Mockito.mock(DiskOffering.class));
         Mockito.verify(resourceLimitManager, Mockito.never()).incrementResourceCountWithTag(Mockito.anyLong(),
                 Mockito.eq(Resource.ResourceType.primary_storage), Mockito.anyString(), Mockito.anyLong());
 
         Mockito.doReturn(List.of(tag)).when(resourceLimitManager)
-                .getResourceLimitStorageTagsForResourceCountOperation(Mockito.anyBoolean(), Mockito.any(DiskOffering.class));
+                .getResourceLimitStorageTagsForResourceCountOperation(Mockito.anyBoolean(), Mockito.any(DiskOffering.class), Mockito.any());
         mockIncrementResourceCountWithTag();
         resourceLimitManager.incrementVolumePrimaryStorageResourceCount(accountId, false, delta, Mockito.mock(DiskOffering.class));
         Mockito.verify(resourceLimitManager, Mockito.times(1))
@@ -1039,13 +1039,13 @@ public void testDecrementVolumePrimaryStorageResourceCount() {
         String tag = "tag";
         long delta = 10L;
         Mockito.doReturn(new ArrayList<>()).when(resourceLimitManager)
-                .getResourceLimitStorageTagsForResourceCountOperation(Mockito.anyBoolean(), Mockito.any(DiskOffering.class));
+                .getResourceLimitStorageTagsForResourceCountOperation(Mockito.anyBoolean(), Mockito.any(DiskOffering.class), Mockito.any());
         resourceLimitManager.decrementVolumePrimaryStorageResourceCount(accountId, false, delta, Mockito.mock(DiskOffering.class));
         Mockito.verify(resourceLimitManager, Mockito.never()).decrementResourceCountWithTag(Mockito.anyLong(),
                 Mockito.eq(Resource.ResourceType.primary_storage), Mockito.anyString(), Mockito.anyLong());
 
         Mockito.doReturn(List.of(tag)).when(resourceLimitManager)
-                .getResourceLimitStorageTagsForResourceCountOperation(Mockito.anyBoolean(), Mockito.any(DiskOffering.class));
+                .getResourceLimitStorageTagsForResourceCountOperation(Mockito.anyBoolean(), Mockito.any(DiskOffering.class), Mockito.any());
         mockDecrementResourceCountWithTag();
         resourceLimitManager.decrementVolumePrimaryStorageResourceCount(accountId, false, delta, Mockito.mock(DiskOffering.class));
         Mockito.verify(resourceLimitManager, Mockito.times(1))
@@ -1058,9 +1058,9 @@ public void testIncrementVmResourceCount() {
         String tag = "tag";
         Mockito.doReturn(new ArrayList<>()).when(resourceLimitManager)
                 .getResourceLimitHostTagsForResourceCountOperation(Mockito.anyBoolean(),
-                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class));
+                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class), Mockito.any());
         resourceLimitManager.incrementVmResourceCount(accountId, false,
-                Mockito.mock(ServiceOffering.class), Mockito.mock(VirtualMachineTemplate.class));
+                Mockito.mock(ServiceOffering.class), Mockito.mock(VirtualMachineTemplate.class), null);
         Mockito.verify(resourceLimitManager, Mockito.never()).incrementResourceCountWithTag(Mockito.anyLong(),
                 Mockito.eq(Resource.ResourceType.user_vm), Mockito.anyString());
         Mockito.verify(resourceLimitManager, Mockito.never()).incrementResourceCountWithTag(Mockito.anyLong(),
@@ -1070,7 +1070,7 @@ public void testIncrementVmResourceCount() {
 
         Mockito.doReturn(List.of(tag)).when(resourceLimitManager)
                 .getResourceLimitHostTagsForResourceCountOperation(Mockito.anyBoolean(),
-                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class));
+                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class), Mockito.any());
         mockIncrementResourceCountWithTag();
         ServiceOffering offering = Mockito.mock(ServiceOffering.class);
         int cpu = 1;
@@ -1078,7 +1078,7 @@ public void testIncrementVmResourceCount() {
         int memory = 1024;
         Mockito.when(offering.getRamSize()).thenReturn(memory);
         resourceLimitManager.incrementVmResourceCount(accountId, false,
-                offering, Mockito.mock(VirtualMachineTemplate.class));
+                offering, Mockito.mock(VirtualMachineTemplate.class), null);
         Mockito.verify(resourceLimitManager, Mockito.times(1)).incrementResourceCountWithTag(
                 1L, Resource.ResourceType.user_vm, tag);
         Mockito.verify(resourceLimitManager, Mockito.times(1))
@@ -1093,9 +1093,9 @@ public void testDecrementVmResourceCount() {
         String tag = "tag";
         Mockito.doReturn(new ArrayList<>()).when(resourceLimitManager)
                 .getResourceLimitHostTagsForResourceCountOperation(Mockito.anyBoolean(),
-                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class));
+                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class), Mockito.any());
         resourceLimitManager.decrementVmResourceCount(accountId, false,
-                Mockito.mock(ServiceOffering.class), Mockito.mock(VirtualMachineTemplate.class));
+                Mockito.mock(ServiceOffering.class), Mockito.mock(VirtualMachineTemplate.class), null);
         Mockito.verify(resourceLimitManager, Mockito.never()).decrementResourceCountWithTag(Mockito.anyLong(),
                 Mockito.eq(Resource.ResourceType.user_vm), Mockito.anyString());
         Mockito.verify(resourceLimitManager, Mockito.never()).decrementResourceCountWithTag(Mockito.anyLong(),
@@ -1105,7 +1105,7 @@ public void testDecrementVmResourceCount() {
 
         Mockito.doReturn(List.of(tag)).when(resourceLimitManager)
                 .getResourceLimitHostTagsForResourceCountOperation(Mockito.anyBoolean(),
-                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class));
+                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class), Mockito.any());
         mockDecrementResourceCountWithTag();
         ServiceOffering offering = Mockito.mock(ServiceOffering.class);
         int cpu = 1;
@@ -1113,7 +1113,7 @@ public void testDecrementVmResourceCount() {
         int memory = 1024;
         Mockito.when(offering.getRamSize()).thenReturn(memory);
         resourceLimitManager.decrementVmResourceCount(accountId, false,
-                offering, Mockito.mock(VirtualMachineTemplate.class));
+                offering, Mockito.mock(VirtualMachineTemplate.class), null);
         Mockito.verify(resourceLimitManager, Mockito.times(1)).decrementResourceCountWithTag(
                 1L, Resource.ResourceType.user_vm, tag);
         Mockito.verify(resourceLimitManager, Mockito.times(1))
@@ -1128,7 +1128,7 @@ public void testIncrementVmCpuResourceCount() {
         String tag = "tag";
         Mockito.doReturn(new ArrayList<>()).when(resourceLimitManager)
                 .getResourceLimitHostTagsForResourceCountOperation(Mockito.anyBoolean(),
-                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class));
+                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class), Mockito.any());
         resourceLimitManager.incrementVmCpuResourceCount(accountId, false,
                 Mockito.mock(ServiceOffering.class), Mockito.mock(VirtualMachineTemplate.class), null);
         Mockito.verify(resourceLimitManager, Mockito.never()).incrementResourceCountWithTag(Mockito.anyLong(),
@@ -1136,7 +1136,7 @@ public void testIncrementVmCpuResourceCount() {
 
         Mockito.doReturn(List.of(tag)).when(resourceLimitManager)
                 .getResourceLimitHostTagsForResourceCountOperation(Mockito.anyBoolean(),
-                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class));
+                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class), Mockito.any());
         mockIncrementResourceCountWithTag();
         ServiceOffering offering = Mockito.mock(ServiceOffering.class);
         Long cpu = 2L;
@@ -1152,7 +1152,7 @@ public void testDecrementVmCpuResourceCount() {
         String tag = "tag";
         Mockito.doReturn(new ArrayList<>()).when(resourceLimitManager)
                 .getResourceLimitHostTagsForResourceCountOperation(Mockito.anyBoolean(),
-                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class));
+                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class), Mockito.any());
         resourceLimitManager.decrementVmCpuResourceCount(accountId, false,
                 Mockito.mock(ServiceOffering.class), Mockito.mock(VirtualMachineTemplate.class), null);
         Mockito.verify(resourceLimitManager, Mockito.never()).decrementResourceCountWithTag(Mockito.anyLong(),
@@ -1160,7 +1160,7 @@ public void testDecrementVmCpuResourceCount() {
 
         Mockito.doReturn(List.of(tag)).when(resourceLimitManager)
                 .getResourceLimitHostTagsForResourceCountOperation(Mockito.anyBoolean(),
-                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class));
+                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class), Mockito.any());
         mockDecrementResourceCountWithTag();
         ServiceOffering offering = Mockito.mock(ServiceOffering.class);
         int cpu = 1;
@@ -1177,7 +1177,7 @@ public void testIncrementVmMemoryResourceCount() {
         String tag = "tag";
         Mockito.doReturn(new ArrayList<>()).when(resourceLimitManager)
                 .getResourceLimitHostTagsForResourceCountOperation(Mockito.anyBoolean(),
-                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class));
+                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class), Mockito.any());
         resourceLimitManager.incrementVmMemoryResourceCount(accountId, false,
                 Mockito.mock(ServiceOffering.class), Mockito.mock(VirtualMachineTemplate.class), null);
         Mockito.verify(resourceLimitManager, Mockito.never()).incrementResourceCountWithTag(Mockito.anyLong(),
@@ -1185,7 +1185,7 @@ public void testIncrementVmMemoryResourceCount() {
 
         Mockito.doReturn(List.of(tag)).when(resourceLimitManager)
                 .getResourceLimitHostTagsForResourceCountOperation(Mockito.anyBoolean(),
-                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class));
+                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class), Mockito.any());
         mockIncrementResourceCountWithTag();
         ServiceOffering offering = Mockito.mock(ServiceOffering.class);
         long memory = 1024L;
@@ -1201,7 +1201,7 @@ public void testDecrementVmMemoryResourceCount() {
         String tag = "tag";
         Mockito.doReturn(new ArrayList<>()).when(resourceLimitManager)
                 .getResourceLimitHostTagsForResourceCountOperation(Mockito.anyBoolean(),
-                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class));
+                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class), Mockito.any());
         resourceLimitManager.decrementVmMemoryResourceCount(accountId, false,
                 Mockito.mock(ServiceOffering.class), Mockito.mock(VirtualMachineTemplate.class), null);
         Mockito.verify(resourceLimitManager, Mockito.never()).decrementResourceCountWithTag(Mockito.anyLong(),
@@ -1209,7 +1209,7 @@ public void testDecrementVmMemoryResourceCount() {
 
         Mockito.doReturn(List.of(tag)).when(resourceLimitManager)
                 .getResourceLimitHostTagsForResourceCountOperation(Mockito.anyBoolean(),
-                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class));
+                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class), Mockito.any());
         mockDecrementResourceCountWithTag();
         ServiceOffering offering = Mockito.mock(ServiceOffering.class);
         int memory = 1024;
@@ -1226,7 +1226,7 @@ public void testIncrementVmGpuResourceCount() {
         String tag = "tag";
         Mockito.doReturn(new ArrayList<>()).when(resourceLimitManager)
                 .getResourceLimitHostTagsForResourceCountOperation(Mockito.anyBoolean(),
-                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class));
+                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class), Mockito.any());
         resourceLimitManager.incrementVmGpuResourceCount(accountId, false,
                 Mockito.mock(ServiceOffering.class), Mockito.mock(VirtualMachineTemplate.class), null);
         Mockito.verify(resourceLimitManager, Mockito.never()).incrementResourceCountWithTag(Mockito.anyLong(),
@@ -1234,7 +1234,7 @@ public void testIncrementVmGpuResourceCount() {
 
         Mockito.doReturn(List.of(tag)).when(resourceLimitManager)
                 .getResourceLimitHostTagsForResourceCountOperation(Mockito.anyBoolean(),
-                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class));
+                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class), Mockito.any());
         mockIncrementResourceCountWithTag();
         ServiceOffering offering = Mockito.mock(ServiceOffering.class);
         Long gpuCount = 2L;
@@ -1251,7 +1251,7 @@ public void testDecrementVmGpuResourceCount() {
         String tag = "tag";
         Mockito.doReturn(new ArrayList<>()).when(resourceLimitManager)
                 .getResourceLimitHostTagsForResourceCountOperation(Mockito.anyBoolean(),
-                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class));
+                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class), Mockito.any());
         resourceLimitManager.decrementVmGpuResourceCount(accountId, false,
                 Mockito.mock(ServiceOffering.class), Mockito.mock(VirtualMachineTemplate.class), null);
         Mockito.verify(resourceLimitManager, Mockito.never()).decrementResourceCountWithTag(Mockito.anyLong(),
@@ -1259,7 +1259,7 @@ public void testDecrementVmGpuResourceCount() {
 
         Mockito.doReturn(List.of(tag)).when(resourceLimitManager)
                 .getResourceLimitHostTagsForResourceCountOperation(Mockito.anyBoolean(),
-                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class));
+                        Mockito.any(ServiceOffering.class), Mockito.any(VirtualMachineTemplate.class), Mockito.any());
         mockDecrementResourceCountWithTag();
         ServiceOffering offering = Mockito.mock(ServiceOffering.class);
         int gpuCount = 1;
diff --git a/server/src/test/java/com/cloud/server/ManagementServerImplTest.java b/server/src/test/java/com/cloud/server/ManagementServerImplTest.java
index e69f927b41e0..d2c12b6c99dd 100644
--- a/server/src/test/java/com/cloud/server/ManagementServerImplTest.java
+++ b/server/src/test/java/com/cloud/server/ManagementServerImplTest.java
@@ -23,10 +23,6 @@
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 
-import com.cloud.deploy.DataCenterDeployment;
-import com.cloud.deploy.DeploymentPlanner;
-import com.cloud.deploy.DeploymentPlanningManager;
-import com.cloud.vm.VirtualMachineProfile;
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
@@ -47,8 +43,10 @@
 import java.util.Arrays;
 import java.util.Collections;
 import java.util.List;
+import java.util.Map;
 
 import org.apache.cloudstack.annotation.dao.AnnotationDao;
+import org.apache.cloudstack.affinity.dao.AffinityGroupVMMapDao;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.BaseCmd;
 import org.apache.cloudstack.api.command.admin.config.ListCfgsByCmd;
@@ -63,6 +61,7 @@
 import org.apache.cloudstack.api.command.user.userdata.RegisterUserDataCmd;
 import org.apache.cloudstack.config.Configuration;
 import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreManager;
 import org.apache.cloudstack.engine.subsystem.api.storage.PrimaryDataStore;
 import org.apache.cloudstack.engine.subsystem.api.storage.PrimaryDataStoreDriver;
 import org.apache.cloudstack.framework.config.ConfigDepot;
@@ -73,24 +72,46 @@
 import org.apache.cloudstack.userdata.UserDataManager;
 
 import com.cloud.cpu.CPU;
+import com.cloud.dc.DataCenterVO;
 import com.cloud.dc.Vlan.VlanType;
+import com.cloud.dc.dao.DataCenterDao;
+import com.cloud.deploy.DataCenterDeployment;
+import com.cloud.deploy.DeploymentPlanner;
+import com.cloud.deploy.DeploymentPlanningManager;
 import com.cloud.domain.dao.DomainDao;
 import com.cloud.api.ApiDBUtils;
 import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.exception.PermissionDeniedException;
+import com.cloud.gpu.GPU;
+import com.cloud.gpu.VgpuProfileVO;
+import com.cloud.gpu.dao.VgpuProfileDao;
 import com.cloud.host.DetailVO;
 import com.cloud.host.Host;
+import com.cloud.host.Host.Type;
 import com.cloud.host.HostVO;
+import com.cloud.host.dao.HostDao;
 import com.cloud.host.dao.HostDetailsDao;
+import com.cloud.hypervisor.Hypervisor.HypervisorType;
+import com.cloud.hypervisor.dao.HypervisorCapabilitiesDao;
+import com.cloud.hypervisor.kvm.dpdk.DpdkHelper;
 import com.cloud.network.IpAddress;
 import com.cloud.network.IpAddressManagerImpl;
 import com.cloud.network.dao.IPAddressVO;
+import com.cloud.service.ServiceOfferingVO;
+import com.cloud.service.dao.ServiceOfferingDao;
+import com.cloud.service.dao.ServiceOfferingDetailsDao;
+import com.cloud.storage.DiskOfferingVO;
 import com.cloud.storage.GuestOSCategoryVO;
 import com.cloud.storage.GuestOSVO;
 import com.cloud.storage.GuestOsCategory;
 import com.cloud.storage.VMTemplateVO;
+import com.cloud.storage.Volume;
+import com.cloud.storage.VolumeVO;
+import com.cloud.storage.dao.DiskOfferingDao;
 import com.cloud.storage.dao.GuestOSCategoryDao;
 import com.cloud.storage.dao.GuestOSDao;
 import com.cloud.storage.dao.VMTemplateDao;
+import com.cloud.storage.dao.VolumeDao;
 import com.cloud.user.Account;
 import com.cloud.user.AccountManager;
 import com.cloud.user.SSHKeyPair;
@@ -101,14 +122,19 @@
 import com.cloud.user.dao.SSHKeyPairDao;
 import com.cloud.user.dao.UserDataDao;
 import com.cloud.utils.Pair;
+import com.cloud.utils.Ternary;
 import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
 import com.cloud.utils.exception.CloudRuntimeException;
 import com.cloud.vm.UserVmVO;
 import com.cloud.vm.VMInstanceDetailVO;
+import com.cloud.vm.VMInstanceVO;
 import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.VirtualMachineProfile;
+import com.cloud.vm.VirtualMachine.State;
 import com.cloud.vm.dao.UserVmDao;
+import com.cloud.vm.dao.VMInstanceDao;
 import com.cloud.vm.dao.VMInstanceDetailsDao;
 import com.cloud.agent.manager.allocator.HostAllocator;
 
@@ -160,6 +186,42 @@ public class ManagementServerImplTest {
     @Mock
     HostDetailsDao hostDetailsDao;
 
+    @Mock
+    VMInstanceDao vmInstanceDao;
+
+    @Mock
+    HostDao hostDao;
+
+    @Mock
+    ServiceOfferingDetailsDao serviceOfferingDetailsDao;
+
+    @Mock
+    VolumeDao volumeDao;
+
+    @Mock
+    ServiceOfferingDao offeringDao;
+
+    @Mock
+    DiskOfferingDao diskOfferingDao;
+
+    @Mock
+    HypervisorCapabilitiesDao hypervisorCapabilitiesDao;
+
+    @Mock
+    DataStoreManager dataStoreManager;
+
+    @Mock
+    DpdkHelper dpdkHelper;
+
+    @Mock
+    AffinityGroupVMMapDao affinityGroupVMMapDao;
+
+    @Mock
+    DeploymentPlanningManager dpMgr;
+
+    @Mock
+    DataCenterDao dcDao;
+
     @Mock
     ConfigurationDao configDao;
 
@@ -185,6 +247,12 @@ public class ManagementServerImplTest {
     @Mock
     HostAllocator hostAllocator;
 
+    @Mock
+    VgpuProfileDao vgpuProfileDao;
+
+    @Mock
+    VgpuProfileVO vgpuProfileVO;
+
     @Mock
     VirtualMachine virtualMachineMock;
 
@@ -200,9 +268,6 @@ public class ManagementServerImplTest {
     @Mock
     Host hostMock;
 
-    @Mock
-    DeploymentPlanningManager deploymentPlanningManagerMock;
-
     private AutoCloseable closeable;
     private MockedStatic<ApiDBUtils> apiDBUtilsMock;
 
@@ -224,7 +289,10 @@ public void setup() throws IllegalAccessException, NoSuchFieldException {
         apiDBUtilsMock = Mockito.mockStatic(ApiDBUtils.class);
         // Return empty list to avoid architecture filtering in most tests
         apiDBUtilsMock.when(() -> ApiDBUtils.listZoneClustersArchs(Mockito.anyLong()))
-            .thenReturn(new ArrayList<>());
+                .thenReturn(new ArrayList<>());
+
+        when(vgpuProfileDao.findById(any())).thenReturn(vgpuProfileVO);
+        when(vgpuProfileVO.getName()).thenReturn("test-vgpu-profile");
     }
 
     @After
@@ -243,7 +311,7 @@ private void overrideDefaultConfigValue(final ConfigKey configKey, final String
     }
 
     @Test(expected = InvalidParameterValueException.class)
-    public void testDuplicateRegistraitons(){
+    public void testDuplicateRegistrations() {
         String accountName = "account";
         String publicKeyString = "ssh-rsa very public";
         String publicKeyMaterial = spy.getPublicKeyFromKeyKeyMaterial(publicKeyString);
@@ -1091,4 +1159,1338 @@ public void getCapableSuitableHostsTestHostArchIsNotFilteredWhenNoSuitableHostsA
 
         apiDBUtilsMock.verify(() -> ApiDBUtils.listZoneClustersArchs(Mockito.anyLong()), Mockito.never());
     }
+
+    // ============= Tests for listHostsForMigrationOfVM =============
+
+    @Test(expected = PermissionDeniedException.class)
+    public void testListHostsForMigrationOfVMNonRootAdmin() {
+        mockRunningVM(1L, HypervisorType.KVM);
+        Account caller = Mockito.mock(Account.class);
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(accountManager.isRootAdmin(caller.getId())).thenReturn(false);
+
+        spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListHostsForMigrationOfVMNullVM() {
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(null);
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+
+        spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListHostsForMigrationOfVMNotRunning() {
+        VMInstanceVO vm = mockVM(1L, HypervisorType.KVM, State.Stopped);
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+
+        spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListHostsForMigrationOfVMUnsupportedHypervisor() {
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.BareMetal);
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+
+        spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListHostsForMigrationOfVMLxcUserVM() {
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.LXC);
+        Mockito.when(vm.getType()).thenReturn(VirtualMachine.Type.User);
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+
+        spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+    }
+
+    @Test
+    public void testListHostsForMigrationOfVMGpuEnabled() {
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.KVM);
+        long hostId = vm.getHostId();
+        HostVO srcHost = mockHost(hostId, 4L, 5L, 6L, HypervisorType.KVM);
+        Account caller = mockRootAdminAccount();
+
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        Mockito.doReturn(srcHost).when(hostDao).findById(hostId);
+
+        // Mock GPU detail
+        Mockito.when(serviceOfferingDetailsDao.findDetail(vm.getServiceOfferingId(), GPU.Keys.pciDevice.toString()))
+            .thenReturn(Mockito.mock(com.cloud.service.ServiceOfferingDetailsVO.class));
+
+        Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>> result =
+            spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+
+        Assert.assertNotNull(result);
+        Assert.assertEquals(0, result.first().first().size());
+        Assert.assertEquals(Integer.valueOf(0), result.first().second());
+        Assert.assertEquals(0, result.second().size());
+    }
+
+    @Test
+    public void testListHostsForMigrationOfVMWithSystemVM() {
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.VMware);
+        Mockito.when(vm.getType()).thenReturn(VirtualMachine.Type.ConsoleProxy);
+
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        Mockito.when(serviceOfferingDetailsDao.findDetail(vm.getServiceOfferingId(), GPU.Keys.pciDevice.toString()))
+            .thenReturn(null);
+
+        HostVO srcHost = mockHost(100L, 1L, 1L, 1L, HypervisorType.VMware);
+        Mockito.when(hostDao.findById(vm.getHostId())).thenReturn(srcHost);
+
+        // System VMs can use storage motion
+        Mockito.when(hypervisorCapabilitiesDao.isStorageMotionSupported(HypervisorType.VMware, null))
+            .thenReturn(true);
+
+        ServiceOfferingVO offering = Mockito.mock(ServiceOfferingVO.class);
+        Mockito.when(offeringDao.findById(vm.getId(), vm.getServiceOfferingId())).thenReturn(offering);
+
+        VolumeVO volume = mockVolume(1L, 1L);
+        Mockito.when(volumeDao.findCreatedByInstance(vm.getId())).thenReturn(List.of(volume));
+
+        DiskOfferingVO diskOffering = mockSharedDiskOffering(1L);
+        Mockito.when(diskOfferingDao.findById(volume.getDiskOfferingId())).thenReturn(diskOffering);
+
+        // Mock searchForServers with zone-wide scope (storage motion enabled)
+        HostVO host1 = mockHost(101L, 1L, 1L, 1L, HypervisorType.VMware);
+        HostVO host2 = mockHost(102L, 1L, 1L, 1L, HypervisorType.VMware);
+        List<HostVO> hosts = List.of(host1, host2);
+        Pair<List<HostVO>, Integer> hostsPair = new Pair<>(hosts, 2);
+        Mockito.doReturn(hostsPair).when(spy).searchForServers(
+            Mockito.anyLong(), Mockito.anyLong(), Mockito.isNull(), Mockito.any(Type.class),
+            Mockito.isNull(), Mockito.anyLong(), Mockito.anyLong(), Mockito.isNull(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.isNull(),
+            Mockito.any(HypervisorType.class), Mockito.isNull(), Mockito.anyLong());
+
+        setupMigrationMocks(vm, srcHost, hosts, volume, true);
+
+        // Verify this doesn't throw exception - system VMs should be migratable
+        Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>> result =
+            spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+
+        // Verify storage motion capability was checked
+        Mockito.verify(hypervisorCapabilitiesDao, Mockito.atLeastOnce()).isStorageMotionSupported(HypervisorType.VMware, null);
+
+        // Verify result structure and data
+        Assert.assertNotNull(result);
+        Assert.assertNotNull("All hosts list should not be null", result.first());
+        Assert.assertNotNull("Suitable hosts list should not be null", result.second());
+        Assert.assertNotNull("Storage motion map should not be null", result.third());
+
+        // Verify all hosts returned (from searchForServers)
+        Assert.assertEquals("Should return 2 total hosts", Integer.valueOf(2), result.first().second());
+        Assert.assertEquals("All hosts list should contain 2 hosts", 2, result.first().first().size());
+
+        // Verify suitable hosts (from host allocator)
+        Assert.assertEquals("Should return 2 suitable hosts", 2, result.second().size());
+        Assert.assertTrue("Suitable hosts should contain host1",
+            result.second().stream().anyMatch(h -> h.getId() == 101L));
+        Assert.assertTrue("Suitable hosts should contain host2",
+            result.second().stream().anyMatch(h -> h.getId() == 102L));
+    }
+
+    @Test
+    public void testListHostsForMigrationOfVMWithDomainRouter() {
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.KVM);
+        Mockito.when(vm.getType()).thenReturn(VirtualMachine.Type.DomainRouter);
+
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        Mockito.when(serviceOfferingDetailsDao.findDetail(vm.getServiceOfferingId(), GPU.Keys.pciDevice.toString()))
+            .thenReturn(null);
+
+        HostVO srcHost = mockHost(100L, 1L, 1L, 1L, HypervisorType.KVM);
+        Mockito.when(hostDao.findById(vm.getHostId())).thenReturn(srcHost);
+
+        Mockito.when(hypervisorCapabilitiesDao.isStorageMotionSupported(HypervisorType.KVM, ""))
+            .thenReturn(false);
+
+        ServiceOfferingVO offering = Mockito.mock(ServiceOfferingVO.class);
+        Mockito.when(offeringDao.findById(vm.getId(), vm.getServiceOfferingId())).thenReturn(offering);
+
+        VolumeVO volume = mockVolume(1L, 1L);
+        Mockito.when(volumeDao.findCreatedByInstance(vm.getId())).thenReturn(List.of(volume));
+
+        DiskOfferingVO diskOffering = mockSharedDiskOffering(1L);
+        Mockito.when(diskOfferingDao.findById(volume.getDiskOfferingId())).thenReturn(diskOffering);
+
+        // Mock searchForServers for cluster-scoped search
+        HostVO host1 = mockHost(101L, 1L, 1L, 1L, HypervisorType.KVM);
+        HostVO host2 = mockHost(102L, 1L, 1L, 1L, HypervisorType.KVM);
+        List<HostVO> hosts = List.of(host1, host2);
+        Pair<List<HostVO>, Integer> hostsPair = new Pair<>(hosts, 2);
+        Mockito.doReturn(hostsPair).when(spy).searchForServers(
+            Mockito.anyLong(), Mockito.anyLong(), Mockito.isNull(), Mockito.any(Type.class),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.anyLong(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.isNull(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.anyLong());
+
+        setupMigrationMocks(vm, srcHost, hosts, volume);
+
+        // Verify domain router can be migrated
+        Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>> result =
+            spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+
+        // Verify hypervisor capabilities were checked
+        Mockito.verify(hypervisorCapabilitiesDao, Mockito.atLeastOnce()).isStorageMotionSupported(HypervisorType.KVM, "");
+
+        // Verify result contains expected hosts
+        Assert.assertNotNull(result);
+        Assert.assertEquals("Should return 2 total hosts", Integer.valueOf(2), result.first().second());
+        Assert.assertEquals("Should return 2 suitable hosts", 2, result.second().size());
+        Assert.assertTrue("Result should contain host 101",
+            result.second().stream().anyMatch(h -> h.getId() == 101L));
+        Assert.assertTrue("Result should contain host 102",
+            result.second().stream().anyMatch(h -> h.getId() == 102L));
+    }
+
+    @Test
+    public void testListHostsForMigrationOfVMWithMultipleVolumes() {
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.KVM);
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        Mockito.when(serviceOfferingDetailsDao.findDetail(vm.getServiceOfferingId(), GPU.Keys.pciDevice.toString()))
+            .thenReturn(null);
+
+        HostVO srcHost = mockHost(100L, 1L, 1L, 1L, HypervisorType.KVM);
+        Mockito.when(hostDao.findById(vm.getHostId())).thenReturn(srcHost);
+
+        Mockito.when(hypervisorCapabilitiesDao.isStorageMotionSupported(HypervisorType.KVM, ""))
+            .thenReturn(false);
+
+        ServiceOfferingVO offering = Mockito.mock(ServiceOfferingVO.class);
+        Mockito.when(offeringDao.findById(vm.getId(), vm.getServiceOfferingId())).thenReturn(offering);
+
+        // Multiple volumes - root and data disk
+        VolumeVO rootVolume = mockVolume(1L, 1L);
+        VolumeVO dataVolume = mockVolume(2L, 1L);
+        Mockito.when(volumeDao.findCreatedByInstance(vm.getId())).thenReturn(List.of(rootVolume, dataVolume));
+
+        DiskOfferingVO sharedOffering = mockSharedDiskOffering(1L);
+        Mockito.when(diskOfferingDao.findById(1L)).thenReturn(sharedOffering);
+
+        // Mock searchForServers for cluster-scoped search
+        HostVO host1 = mockHost(101L, 1L, 1L, 1L, HypervisorType.KVM);
+        HostVO host2 = mockHost(102L, 1L, 1L, 1L, HypervisorType.KVM);
+        List<HostVO> hosts = List.of(host1, host2);
+        Pair<List<HostVO>, Integer> hostsPair = new Pair<>(hosts, 2);
+        Mockito.doReturn(hostsPair).when(spy).searchForServers(
+            Mockito.anyLong(), Mockito.anyLong(), Mockito.isNull(), Mockito.any(Type.class),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.anyLong(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.isNull(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.anyLong());
+
+        setupMigrationMocks(vm, srcHost, hosts, rootVolume);
+
+        // Verify multiple volumes are handled
+        Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>> result =
+            spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+
+        // Verify all volumes were checked
+        Mockito.verify(volumeDao).findCreatedByInstance(vm.getId());
+        Mockito.verify(diskOfferingDao, Mockito.times(2)).findById(1L);
+
+        // Verify result
+        Assert.assertNotNull(result);
+        Assert.assertEquals("Should return 2 total hosts", Integer.valueOf(2), result.first().second());
+        Assert.assertEquals("Should return 2 suitable hosts for migration", 2, result.second().size());
+        Assert.assertTrue("Suitable hosts should include host 101",
+            result.second().stream().anyMatch(h -> h.getId() == 101L));
+        Assert.assertTrue("Suitable hosts should include host 102",
+            result.second().stream().anyMatch(h -> h.getId() == 102L));
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListHostsForMigrationOfVMWithMixedStorage() {
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.XenServer);
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        Mockito.when(serviceOfferingDetailsDao.findDetail(vm.getServiceOfferingId(), GPU.Keys.pciDevice.toString()))
+            .thenReturn(null);
+
+        HostVO srcHost = mockHost(100L, 1L, 1L, 1L, HypervisorType.XenServer);
+        Mockito.when(hostDao.findById(vm.getHostId())).thenReturn(srcHost);
+
+        // No storage motion support
+        Mockito.when(hypervisorCapabilitiesDao.isStorageMotionSupported(HypervisorType.XenServer, null))
+            .thenReturn(false);
+
+        ServiceOfferingVO offering = Mockito.mock(ServiceOfferingVO.class);
+        Mockito.when(offeringDao.findById(vm.getId(), vm.getServiceOfferingId())).thenReturn(offering);
+
+        // Mixed storage - one shared, one local
+        VolumeVO sharedVolume = mockVolume(1L, 1L);
+        VolumeVO localVolume = mockVolume(2L, 2L);
+        Mockito.when(volumeDao.findCreatedByInstance(vm.getId())).thenReturn(List.of(sharedVolume, localVolume));
+
+        DiskOfferingVO sharedOffering = mockSharedDiskOffering(1L);
+        DiskOfferingVO localOffering = mockLocalDiskOffering(2L);
+        Mockito.when(diskOfferingDao.findById(sharedVolume.getDiskOfferingId())).thenReturn(sharedOffering);
+        Mockito.when(diskOfferingDao.findById(localVolume.getDiskOfferingId())).thenReturn(localOffering);
+
+        // Should throw exception because we have local storage without storage motion support
+        spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+    }
+
+    @Test
+    public void testListHostsForMigrationOfVMKVMWithNullHypervisorVersion() {
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.KVM);
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        Mockito.when(serviceOfferingDetailsDao.findDetail(vm.getServiceOfferingId(), GPU.Keys.pciDevice.toString()))
+            .thenReturn(null);
+
+        // KVM host with null hypervisor version
+        HostVO srcHost = mockHost(100L, 1L, 1L, 1L, HypervisorType.KVM);
+        Mockito.when(hostDao.findById(vm.getHostId())).thenReturn(srcHost);
+
+        // KVM null version should be treated as empty string
+        Mockito.when(hypervisorCapabilitiesDao.isStorageMotionSupported(HypervisorType.KVM, ""))
+            .thenReturn(true);
+
+        ServiceOfferingVO offering = Mockito.mock(ServiceOfferingVO.class);
+        Mockito.when(offeringDao.findById(vm.getId(), vm.getServiceOfferingId())).thenReturn(offering);
+
+        VolumeVO volume = mockVolume(1L, 1L);
+        Mockito.when(volumeDao.findCreatedByInstance(vm.getId())).thenReturn(List.of(volume));
+
+        DiskOfferingVO diskOffering = mockSharedDiskOffering(1L);
+        Mockito.when(diskOfferingDao.findById(volume.getDiskOfferingId())).thenReturn(diskOffering);
+
+        // Mock searchForServers with zone-wide scope (storage motion enabled)
+        HostVO host1 = mockHost(101L, 1L, 1L, 1L, HypervisorType.KVM);
+        HostVO host2 = mockHost(102L, 1L, 1L, 1L, HypervisorType.KVM);
+        List<HostVO> hosts = List.of(host1, host2);
+        Pair<List<HostVO>, Integer> hostsPair = new Pair<>(hosts, 2);
+        Mockito.doReturn(hostsPair).when(spy).searchForServers(
+            Mockito.anyLong(), Mockito.anyLong(), Mockito.isNull(), Mockito.any(Type.class),
+            Mockito.isNull(), Mockito.anyLong(), Mockito.isNull(), Mockito.isNull(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.isNull(),
+            Mockito.any(HypervisorType.class), Mockito.isNull(), Mockito.anyLong());
+
+        setupMigrationMocks(vm, srcHost, hosts, volume, true);
+
+        Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>> result =
+            spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+
+        // Verify KVM null version was converted to empty string
+        Mockito.verify(hypervisorCapabilitiesDao, Mockito.atLeastOnce()).isStorageMotionSupported(HypervisorType.KVM, "");
+
+        // Verify result data
+        Assert.assertNotNull(result);
+        Assert.assertEquals("Total hosts should be 2", Integer.valueOf(2), result.first().second());
+        Assert.assertEquals("Suitable hosts should be 2", 2, result.second().size());
+        Assert.assertTrue("Should contain host 101",
+            result.second().stream().anyMatch(h -> h.getId() == 101L));
+        Assert.assertTrue("Should contain host 102",
+            result.second().stream().anyMatch(h -> h.getId() == 102L));
+    }
+
+    @Test
+    public void testListHostsForMigrationOfVMNonUefiVm() {
+        // Test VM migration for non-UEFI VM (regular VM migration flow)
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.KVM);
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        Mockito.when(serviceOfferingDetailsDao.findDetail(vm.getServiceOfferingId(), GPU.Keys.pciDevice.toString()))
+            .thenReturn(null);
+
+        HostVO srcHost = mockHost(100L, 1L, 1L, 1L, HypervisorType.KVM);
+        Mockito.when(hostDao.findById(vm.getHostId())).thenReturn(srcHost);
+
+        Mockito.when(hypervisorCapabilitiesDao.isStorageMotionSupported(HypervisorType.KVM, ""))
+            .thenReturn(false);
+
+        ServiceOfferingVO offering = Mockito.mock(ServiceOfferingVO.class);
+        Mockito.when(offeringDao.findById(vm.getId(), vm.getServiceOfferingId())).thenReturn(offering);
+
+        VolumeVO volume = mockVolume(1L, 1L);
+        Mockito.when(volumeDao.findCreatedByInstance(vm.getId())).thenReturn(List.of(volume));
+
+        DiskOfferingVO diskOffering = mockSharedDiskOffering(1L);
+        Mockito.when(diskOfferingDao.findById(volume.getDiskOfferingId())).thenReturn(diskOffering);
+
+        // Mock searchForServers for cluster-scoped search
+        HostVO host1 = mockHost(101L, 1L, 1L, 1L, HypervisorType.KVM);
+        HostVO host2 = mockHost(102L, 1L, 1L, 1L, HypervisorType.KVM);
+        List<HostVO> hosts = List.of(host1, host2);
+        Pair<List<HostVO>, Integer> hostsPair = new Pair<>(hosts, 2);
+        Mockito.doReturn(hostsPair).when(spy).searchForServers(
+            Mockito.anyLong(), Mockito.anyLong(), Mockito.isNull(), Mockito.any(Type.class),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.anyLong(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.isNull(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.anyLong());
+
+        setupMigrationMocks(vm, srcHost, hosts, volume);
+
+        Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>> result =
+            spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+
+        // Verify hosts are returned for migration (non-UEFI VMs don't need UEFI-enabled hosts)
+        Assert.assertNotNull(result);
+        Assert.assertEquals("Should have 2 total hosts", Integer.valueOf(2), result.first().second());
+        Assert.assertEquals("Should have 2 suitable hosts", 2, result.second().size());
+        Assert.assertTrue("Should contain host 101",
+            result.second().stream().anyMatch(h -> h.getId() == 101L));
+        Assert.assertTrue("Should contain host 102",
+            result.second().stream().anyMatch(h -> h.getId() == 102L));
+    }
+
+    @Test
+    public void testListHostsForMigrationOfVMWithUefiVmClusterScope() {
+        // Test UEFI VM migration with cluster-scoped search (no storage motion)
+        // This exercises the code path where filteredHosts is NULL and allocateTo without list is called
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.KVM);
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        Mockito.when(serviceOfferingDetailsDao.findDetail(vm.getServiceOfferingId(), GPU.Keys.pciDevice.toString()))
+            .thenReturn(null);
+
+        HostVO srcHost = mockHost(100L, 1L, 1L, 1L, HypervisorType.KVM);
+        Mockito.when(hostDao.findById(vm.getHostId())).thenReturn(srcHost);
+
+        // No storage motion support - cluster-scoped search
+        Mockito.when(hypervisorCapabilitiesDao.isStorageMotionSupported(HypervisorType.KVM, ""))
+            .thenReturn(false);
+
+        ServiceOfferingVO offering = Mockito.mock(ServiceOfferingVO.class);
+        Mockito.when(offeringDao.findById(vm.getId(), vm.getServiceOfferingId())).thenReturn(offering);
+
+        VolumeVO volume = mockVolume(1L, 1L);
+        Mockito.when(volumeDao.findCreatedByInstance(vm.getId())).thenReturn(List.of(volume));
+
+        DiskOfferingVO diskOffering = mockSharedDiskOffering(1L);
+        Mockito.when(diskOfferingDao.findById(volume.getDiskOfferingId())).thenReturn(diskOffering);
+
+        // Mock searchForServers for cluster-scoped search
+        HostVO host1 = mockHost(101L, 1L, 1L, 1L, HypervisorType.KVM);
+        HostVO host2 = mockHost(102L, 1L, 1L, 1L, HypervisorType.KVM);
+        List<HostVO> hosts = List.of(host1, host2);
+        Pair<List<HostVO>, Integer> hostsPair = new Pair<>(hosts, 2);
+        Mockito.doReturn(hostsPair).when(spy).searchForServers(
+            Mockito.anyLong(), Mockito.anyLong(), Mockito.isNull(), Mockito.any(Type.class),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.anyLong(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.isNull(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.anyLong());
+
+        // Mock filterUefiHostsForMigration to return success with filtered hosts (only host1 is UEFI-compatible)
+        List<HostVO> uefiCompatibleHosts = List.of(host1);
+        Pair<Boolean, List<HostVO>> uefiFilterResult = new Pair<>(true, uefiCompatibleHosts);
+        Mockito.doReturn(uefiFilterResult).when(spy).filterUefiHostsForMigration(
+            Mockito.anyList(), Mockito.anyList(), Mockito.any());
+
+        // Setup other mocks
+        Mockito.when(dpdkHelper.isVMDpdkEnabled(vm.getId())).thenReturn(false);
+        Mockito.when(affinityGroupVMMapDao.countAffinityGroupsForVm(vm.getId())).thenReturn(0L);
+        DataCenterVO dc = Mockito.mock(DataCenterVO.class);
+        Mockito.when(dcDao.findById(srcHost.getDataCenterId())).thenReturn(dc);
+        Mockito.doNothing().when(dpMgr).checkForNonDedicatedResources(Mockito.any(), Mockito.any(), Mockito.any());
+        Mockito.doNothing().when(dpMgr).reorderHostsByPriority(Mockito.any(), Mockito.anyList());
+
+        // After UEFI filtering, filteredHosts is set to uefiCompatibleHosts (line 1582)
+        // So allocateTo WITH list parameter is called (line 1608) even in cluster scope
+        Mockito.when(hostAllocator.allocateTo(Mockito.any(), Mockito.any(), Mockito.any(),
+            Mockito.any(), Mockito.anyList(), Mockito.anyInt(), Mockito.anyBoolean()))
+            .thenReturn(new ArrayList<>(uefiCompatibleHosts));
+
+        Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>> result =
+            spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+
+        // Verify result structure
+        Assert.assertNotNull("Result should not be null", result);
+        Assert.assertEquals("Should return 2 total hosts", Integer.valueOf(2), result.first().second());
+        Assert.assertEquals("All hosts list should contain 2 hosts", 2, result.first().first().size());
+
+        // Verify only UEFI-compatible hosts are in suitable list
+        Assert.assertEquals("Should have 1 UEFI-compatible suitable host", 1, result.second().size());
+        Assert.assertTrue("Host 101 should be the only UEFI-compatible host",
+            result.second().stream().anyMatch(h -> h.getId() == 101L));
+        Assert.assertFalse("Host 102 should not be in suitable hosts (not UEFI-compatible)",
+            result.second().stream().anyMatch(h -> h.getId() == 102L));
+    }
+
+    @Test
+    public void testListHostsForMigrationOfVMWithUefiVmZoneWideScope() {
+        // Test UEFI VM migration with zone-wide search (storage motion enabled)
+        // This exercises the code path where filteredHosts IS populated and allocateTo WITH list is called
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.VMware);
+        Mockito.when(vm.getType()).thenReturn(VirtualMachine.Type.User);
+
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        Mockito.when(serviceOfferingDetailsDao.findDetail(vm.getServiceOfferingId(), GPU.Keys.pciDevice.toString()))
+            .thenReturn(null);
+
+        HostVO srcHost = mockHost(100L, 1L, 1L, 1L, HypervisorType.VMware);
+        Mockito.when(hostDao.findById(vm.getHostId())).thenReturn(srcHost);
+
+        // Storage motion supported - zone-wide search with filteredHosts
+        Mockito.when(hypervisorCapabilitiesDao.isStorageMotionSupported(HypervisorType.VMware, null))
+            .thenReturn(true);
+
+        ServiceOfferingVO offering = Mockito.mock(ServiceOfferingVO.class);
+        Mockito.when(offeringDao.findById(vm.getId(), vm.getServiceOfferingId())).thenReturn(offering);
+
+        VolumeVO volume = mockVolume(1L, 1L);
+        Mockito.when(volumeDao.findCreatedByInstance(vm.getId())).thenReturn(List.of(volume));
+
+        DiskOfferingVO diskOffering = mockSharedDiskOffering(1L);
+        Mockito.when(diskOfferingDao.findById(volume.getDiskOfferingId())).thenReturn(diskOffering);
+
+        // Mock searchForServers for zone-wide search (storage motion enabled)
+        HostVO host1 = mockHost(101L, 1L, 1L, 1L, HypervisorType.VMware);
+        HostVO host2 = mockHost(102L, 2L, 1L, 1L, HypervisorType.VMware); // Different cluster
+        List<HostVO> hosts = List.of(host1, host2);
+        Pair<List<HostVO>, Integer> hostsPair = new Pair<>(hosts, 2);
+        Mockito.doReturn(hostsPair).when(spy).searchForServers(
+            Mockito.anyLong(), Mockito.anyLong(), Mockito.isNull(), Mockito.any(Type.class),
+            Mockito.isNull(), Mockito.anyLong(), Mockito.isNull(), Mockito.isNull(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.isNull(),
+            Mockito.any(HypervisorType.class), Mockito.isNull(), Mockito.anyLong());
+
+        setupMigrationMocks(vm, srcHost, hosts, volume, true);
+
+        // Mock filterUefiHostsForMigration to return success with filtered hosts (only host1 is UEFI-compatible)
+        List<HostVO> uefiCompatibleHosts = List.of(host1);
+        Pair<Boolean, List<HostVO>> uefiFilterResult = new Pair<>(true, uefiCompatibleHosts);
+        Mockito.doReturn(uefiFilterResult).when(spy).filterUefiHostsForMigration(
+            Mockito.anyList(), Mockito.anyList(), Mockito.any());
+
+        // Override hostAllocator to return only UEFI-compatible hosts
+        // Uses allocateTo WITH list parameter (filteredHosts is populated in zone-wide search)
+        Mockito.when(hostAllocator.allocateTo(Mockito.any(), Mockito.any(), Mockito.any(),
+            Mockito.any(), Mockito.anyList(), Mockito.anyInt(), Mockito.anyBoolean()))
+            .thenReturn(new ArrayList<>(uefiCompatibleHosts));
+
+        Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>> result =
+            spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+
+        // Verify result structure
+        Assert.assertNotNull("Result should not be null", result);
+        Assert.assertEquals("Should return 2 total hosts", Integer.valueOf(2), result.first().second());
+        Assert.assertEquals("All hosts list should contain 2 hosts", 2, result.first().first().size());
+
+        // Verify only UEFI-compatible hosts are in suitable list
+        Assert.assertEquals("Should have 1 UEFI-compatible suitable host", 1, result.second().size());
+        Assert.assertTrue("Host 101 should be the only UEFI-compatible host",
+            result.second().stream().anyMatch(h -> h.getId() == 101L));
+        Assert.assertFalse("Host 102 should not be in suitable hosts (not UEFI-compatible)",
+            result.second().stream().anyMatch(h -> h.getId() == 102L));
+
+        // Verify storage motion map is populated
+        Assert.assertNotNull("Storage motion map should not be null", result.third());
+    }
+
+    @Test
+    public void testListHostsForMigrationOfVMUefiFilteringReturnsEmpty() {
+        // Test case where UEFI filtering results in no suitable hosts
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.KVM);
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        Mockito.when(serviceOfferingDetailsDao.findDetail(vm.getServiceOfferingId(), GPU.Keys.pciDevice.toString()))
+            .thenReturn(null);
+
+        HostVO srcHost = mockHost(100L, 1L, 1L, 1L, HypervisorType.KVM);
+        Mockito.when(hostDao.findById(vm.getHostId())).thenReturn(srcHost);
+
+        Mockito.when(hypervisorCapabilitiesDao.isStorageMotionSupported(HypervisorType.KVM, ""))
+            .thenReturn(false);
+
+        ServiceOfferingVO offering = Mockito.mock(ServiceOfferingVO.class);
+        Mockito.when(offeringDao.findById(vm.getId(), vm.getServiceOfferingId())).thenReturn(offering);
+
+        VolumeVO volume = mockVolume(1L, 1L);
+        Mockito.when(volumeDao.findCreatedByInstance(vm.getId())).thenReturn(List.of(volume));
+
+        DiskOfferingVO diskOffering = mockSharedDiskOffering(1L);
+        Mockito.when(diskOfferingDao.findById(volume.getDiskOfferingId())).thenReturn(diskOffering);
+
+        // Mock searchForServers for cluster-scoped search
+        HostVO host1 = mockHost(101L, 1L, 1L, 1L, HypervisorType.KVM);
+        HostVO host2 = mockHost(102L, 1L, 1L, 1L, HypervisorType.KVM);
+        List<HostVO> hosts = List.of(host1, host2);
+        Pair<List<HostVO>, Integer> hostsPair = new Pair<>(hosts, 2);
+        Mockito.doReturn(hostsPair).when(spy).searchForServers(
+            Mockito.anyLong(), Mockito.anyLong(), Mockito.isNull(), Mockito.any(Type.class),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.anyLong(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.isNull(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.anyLong());
+
+        // Mock filterUefiHostsForMigration FIRST to return false (no UEFI-enabled hosts found)
+        // This simulates the scenario where UEFI VM has no compatible hosts
+        Pair<Boolean, List<HostVO>> uefiFilterResult = new Pair<>(false, null);
+        Mockito.doReturn(uefiFilterResult).when(spy).filterUefiHostsForMigration(
+            Mockito.anyList(), Mockito.anyList(), Mockito.any());
+
+        // Note: No other mocks needed because when filterUefiHostsForMigration returns false,
+        // the method returns early and doesn't proceed to host allocation or other processing
+
+        Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>> result =
+            spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+
+        // Verify result structure
+        Assert.assertNotNull("Result should not be null", result);
+        Assert.assertNotNull("All hosts list should not be null", result.first());
+        Assert.assertNotNull("Suitable hosts list should not be null", result.second());
+        Assert.assertNotNull("Storage motion map should not be null", result.third());
+
+        // Verify all hosts are still returned (from searchForServers)
+        Assert.assertEquals("Should still return 2 total hosts", Integer.valueOf(2), result.first().second());
+        Assert.assertEquals("All hosts list should contain 2 hosts", 2, result.first().first().size());
+
+        // Verify suitable hosts list is empty due to UEFI filtering
+        Assert.assertEquals("Should have 0 suitable hosts after UEFI filtering", 0, result.second().size());
+
+        // Verify storage motion map is empty
+        Assert.assertTrue("Storage motion map should be empty when no suitable hosts", result.third().isEmpty());
+    }
+
+    @Test
+    public void testListHostsForMigrationOfVMStorageMotionCapabilityCheck() {
+        // Test User VM with VMware - should check storage motion for User VMs
+        VMInstanceVO userVm = mockRunningVM(1L, HypervisorType.VMware);
+        Mockito.when(userVm.getType()).thenReturn(VirtualMachine.Type.User);
+
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(userVm);
+        Mockito.when(serviceOfferingDetailsDao.findDetail(userVm.getServiceOfferingId(), GPU.Keys.pciDevice.toString()))
+            .thenReturn(null);
+
+        HostVO srcHost = mockHost(100L, 1L, 1L, 1L, HypervisorType.VMware);
+        Mockito.when(hostDao.findById(userVm.getHostId())).thenReturn(srcHost);
+
+        Mockito.when(hypervisorCapabilitiesDao.isStorageMotionSupported(HypervisorType.VMware, null))
+            .thenReturn(true);
+
+        ServiceOfferingVO offering = Mockito.mock(ServiceOfferingVO.class);
+        Mockito.when(offeringDao.findById(userVm.getId(), userVm.getServiceOfferingId())).thenReturn(offering);
+
+        VolumeVO volume = mockVolume(1L, 1L);
+        Mockito.when(volumeDao.findCreatedByInstance(userVm.getId())).thenReturn(List.of(volume));
+
+        DiskOfferingVO diskOffering = mockSharedDiskOffering(1L);
+        Mockito.when(diskOfferingDao.findById(volume.getDiskOfferingId())).thenReturn(diskOffering);
+
+        // Mock searchForServers with zone-wide scope (storage motion enabled)
+        HostVO host1 = mockHost(101L, 1L, 1L, 1L, HypervisorType.VMware);
+        HostVO host2 = mockHost(102L, 1L, 1L, 1L, HypervisorType.VMware);
+        List<HostVO> hosts = List.of(host1, host2);
+        Pair<List<HostVO>, Integer> hostsPair = new Pair<>(hosts, 2);
+        Mockito.doReturn(hostsPair).when(spy).searchForServers(
+            Mockito.anyLong(), Mockito.anyLong(), Mockito.isNull(), Mockito.any(Type.class),
+            Mockito.isNull(), Mockito.anyLong(), Mockito.isNull(), Mockito.isNull(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.isNull(),
+            Mockito.any(HypervisorType.class), Mockito.isNull(), Mockito.anyLong());
+
+        setupMigrationMocks(userVm, srcHost, hosts, volume, true);
+
+        Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>> result =
+            spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+
+        // Verify storage motion capability was checked for User VM
+        Mockito.verify(hypervisorCapabilitiesDao, Mockito.atLeastOnce()).isStorageMotionSupported(HypervisorType.VMware, null);
+
+        // Verify response data
+        Assert.assertNotNull(result);
+        Assert.assertEquals("Should return 2 total hosts", Integer.valueOf(2), result.first().second());
+        Assert.assertEquals("Should have 2 suitable hosts", 2, result.second().size());
+        Assert.assertTrue("Host 101 should be in suitable list",
+            result.second().stream().anyMatch(h -> h.getId() == 101L));
+        Assert.assertTrue("Host 102 should be in suitable list",
+            result.second().stream().anyMatch(h -> h.getId() == 102L));
+    }
+
+    @Test
+    public void testListHostsForMigrationOfVMWithAllSupportedHypervisors() {
+        // Test each supported hypervisor type
+        HypervisorType[] supportedTypes = {
+            HypervisorType.XenServer,
+            HypervisorType.VMware,
+            HypervisorType.KVM,
+            HypervisorType.Ovm,
+            HypervisorType.Hyperv,
+            HypervisorType.Ovm3
+        };
+
+        for (HypervisorType hypervisorType : supportedTypes) {
+            VMInstanceVO vm = mockRunningVM(1L, hypervisorType);
+            Account caller = mockRootAdminAccount();
+            Mockito.doReturn(caller).when(spy).getCaller();
+            Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+            Mockito.when(serviceOfferingDetailsDao.findDetail(vm.getServiceOfferingId(), GPU.Keys.pciDevice.toString()))
+                .thenReturn(null);
+
+            HostVO srcHost = mockHost(100L, 1L, 1L, 1L, hypervisorType);
+            Mockito.when(hostDao.findById(vm.getHostId())).thenReturn(srcHost);
+
+            String version = hypervisorType == HypervisorType.KVM ? "" : null;
+            Mockito.when(hypervisorCapabilitiesDao.isStorageMotionSupported(hypervisorType, version))
+                .thenReturn(false);
+
+            ServiceOfferingVO offering = Mockito.mock(ServiceOfferingVO.class);
+            Mockito.when(offeringDao.findById(vm.getId(), vm.getServiceOfferingId())).thenReturn(offering);
+
+            VolumeVO volume = mockVolume(1L, 1L);
+            Mockito.when(volumeDao.findCreatedByInstance(vm.getId())).thenReturn(List.of(volume));
+
+            DiskOfferingVO diskOffering = mockSharedDiskOffering(1L);
+            Mockito.when(diskOfferingDao.findById(volume.getDiskOfferingId())).thenReturn(diskOffering);
+
+            // Mock searchForServers for cluster-scoped search
+            HostVO host1 = mockHost(101L, 1L, 1L, 1L, hypervisorType);
+            HostVO host2 = mockHost(102L, 1L, 1L, 1L, hypervisorType);
+            List<HostVO> hosts = List.of(host1, host2);
+            Pair<List<HostVO>, Integer> hostsPair = new Pair<>(hosts, 2);
+            Mockito.doReturn(hostsPair).when(spy).searchForServers(
+                Mockito.anyLong(), Mockito.anyLong(), Mockito.isNull(), Mockito.any(Type.class),
+                Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.anyLong(),
+                Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.isNull(),
+                Mockito.isNull(), Mockito.isNull(), Mockito.anyLong());
+
+            setupMigrationMocks(vm, srcHost, hosts, volume);
+
+            Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>> result =
+                spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+
+            // Verify hypervisor is in supported hypervisors list
+            Mockito.verify(hypervisorCapabilitiesDao, Mockito.atLeastOnce()).isStorageMotionSupported(hypervisorType, version);
+
+            // Verify validation passed for this hypervisor
+            Assert.assertNotNull("Result should not be null for " + hypervisorType, result);
+            Assert.assertEquals("Should return 2 total hosts for " + hypervisorType,
+                Integer.valueOf(2), result.first().second());
+            Assert.assertEquals("Should have 2 suitable hosts for " + hypervisorType,
+                2, result.second().size());
+            Assert.assertTrue("Host 101 should be available for " + hypervisorType,
+                result.second().stream().anyMatch(h -> h.getId() == 101L));
+            Assert.assertTrue("Host 102 should be available for " + hypervisorType,
+                result.second().stream().anyMatch(h -> h.getId() == 102L));
+
+            // Reset mocks for next iteration
+            Mockito.reset(vmInstanceDao, hostDao, serviceOfferingDetailsDao, volumeDao,
+                diskOfferingDao, hypervisorCapabilitiesDao, offeringDao, dpdkHelper,
+                affinityGroupVMMapDao, dpMgr, dcDao, hostAllocator, dataStoreManager);
+            Mockito.reset(spy);
+        }
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListHostsForMigrationOfVMSourceHostNotFound() {
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.KVM);
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        Mockito.when(hostDao.findById(vm.getHostId())).thenReturn(null);
+
+        spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListHostsForMigrationOfVMLocalStorageNoStorageMotion() {
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.XenServer);
+        HostVO srcHost = mockHost(100L, 1L, 1L, 1L, HypervisorType.XenServer);
+        Account caller = mockRootAdminAccount();
+
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        Mockito.when(serviceOfferingDetailsDao.findDetail(vm.getServiceOfferingId(), GPU.Keys.pciDevice.toString()))
+            .thenReturn(null);
+        Mockito.when(hostDao.findById(vm.getHostId())).thenReturn(srcHost);
+
+        // Mock storage motion not supported
+        Mockito.when(hypervisorCapabilitiesDao.isStorageMotionSupported(HypervisorType.XenServer, null))
+            .thenReturn(false);
+
+        // Mock local storage usage
+        ServiceOfferingVO offering = Mockito.mock(ServiceOfferingVO.class);
+        Mockito.when(offeringDao.findById(vm.getId(), vm.getServiceOfferingId())).thenReturn(offering);
+
+        VolumeVO volume = mockVolume(1L, 1L);
+        Mockito.when(volumeDao.findCreatedByInstance(vm.getId())).thenReturn(List.of(volume));
+
+        DiskOfferingVO diskOffering = mockLocalDiskOffering(1L);
+        Mockito.when(diskOfferingDao.findById(volume.getDiskOfferingId())).thenReturn(diskOffering);
+
+        spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+    }
+
+    @Test
+    public void testListHostsForMigrationOfVMStorageMotionCheckForSystemVM() {
+        // Test that storage motion capability is checked for System VMs
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.VMware);
+        Mockito.when(vm.getType()).thenReturn(VirtualMachine.Type.ConsoleProxy);
+
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        Mockito.when(serviceOfferingDetailsDao.findDetail(vm.getServiceOfferingId(), GPU.Keys.pciDevice.toString()))
+            .thenReturn(null);
+
+        HostVO srcHost = mockHost(100L, 1L, 1L, 1L, HypervisorType.VMware);
+        Mockito.when(hostDao.findById(vm.getHostId())).thenReturn(srcHost);
+
+        // Storage motion supported for VMware
+        Mockito.when(hypervisorCapabilitiesDao.isStorageMotionSupported(HypervisorType.VMware, null))
+            .thenReturn(true);
+
+        ServiceOfferingVO offering = Mockito.mock(ServiceOfferingVO.class);
+        Mockito.when(offeringDao.findById(vm.getId(), vm.getServiceOfferingId())).thenReturn(offering);
+
+        VolumeVO volume = mockVolume(1L, 1L);
+        Mockito.when(volumeDao.findCreatedByInstance(vm.getId())).thenReturn(List.of(volume));
+
+        DiskOfferingVO diskOffering = mockSharedDiskOffering(1L);
+        Mockito.when(diskOfferingDao.findById(volume.getDiskOfferingId())).thenReturn(diskOffering);
+
+        // Mock searchForServers with zone-wide scope (storage motion enabled)
+        HostVO host1 = mockHost(101L, 1L, 1L, 1L, HypervisorType.VMware);
+        HostVO host2 = mockHost(102L, 1L, 1L, 1L, HypervisorType.VMware);
+        List<HostVO> hosts = List.of(host1, host2);
+        Pair<List<HostVO>, Integer> hostsPair = new Pair<>(hosts, 2);
+        Mockito.doReturn(hostsPair).when(spy).searchForServers(
+            Mockito.anyLong(), Mockito.anyLong(), Mockito.isNull(), Mockito.any(Type.class),
+            Mockito.isNull(), Mockito.anyLong(), Mockito.anyLong(), Mockito.isNull(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.isNull(),
+            Mockito.any(HypervisorType.class), Mockito.isNull(), Mockito.anyLong());
+
+        setupMigrationMocks(vm, srcHost, hosts, volume, true);
+
+        Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>> result =
+            spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+
+        // Verify that storage motion capability was checked for system VM (VMware is in hypervisorTypes list)
+        Mockito.verify(hypervisorCapabilitiesDao, Mockito.atLeastOnce()).isStorageMotionSupported(HypervisorType.VMware, null);
+
+        // Verify response structure
+        Assert.assertNotNull(result);
+        Assert.assertEquals("Should have 2 total hosts", Integer.valueOf(2), result.first().second());
+        Assert.assertTrue("Should have suitable hosts", result.second().size() > 0);
+    }
+
+    @Test
+    public void testListHostsForMigrationOfVMStorageMotionCheckForUserVM() {
+        // Test that storage motion capability is checked for User VMs
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.KVM);
+        Mockito.when(vm.getType()).thenReturn(VirtualMachine.Type.User);
+
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        Mockito.when(serviceOfferingDetailsDao.findDetail(vm.getServiceOfferingId(), GPU.Keys.pciDevice.toString()))
+            .thenReturn(null);
+
+        HostVO srcHost = mockHost(100L, 1L, 1L, 1L, HypervisorType.KVM);
+        Mockito.when(hostDao.findById(vm.getHostId())).thenReturn(srcHost);
+
+        // Storage motion supported for User VM with KVM
+        Mockito.when(hypervisorCapabilitiesDao.isStorageMotionSupported(HypervisorType.KVM, ""))
+            .thenReturn(true);
+
+        ServiceOfferingVO offering = Mockito.mock(ServiceOfferingVO.class);
+        Mockito.when(offeringDao.findById(vm.getId(), vm.getServiceOfferingId())).thenReturn(offering);
+
+        VolumeVO volume = mockVolume(1L, 1L);
+        Mockito.when(volumeDao.findCreatedByInstance(vm.getId())).thenReturn(List.of(volume));
+
+        DiskOfferingVO diskOffering = mockSharedDiskOffering(1L);
+        Mockito.when(diskOfferingDao.findById(volume.getDiskOfferingId())).thenReturn(diskOffering);
+
+        // Mock searchForServers with zone-wide scope (storage motion enabled)
+        HostVO host1 = mockHost(101L, 1L, 1L, 1L, HypervisorType.KVM);
+        HostVO host2 = mockHost(102L, 1L, 1L, 1L, HypervisorType.KVM);
+        List<HostVO> hosts = List.of(host1, host2);
+        Pair<List<HostVO>, Integer> hostsPair = new Pair<>(hosts, 2);
+        Mockito.doReturn(hostsPair).when(spy).searchForServers(
+            Mockito.anyLong(), Mockito.anyLong(), Mockito.isNull(), Mockito.any(Type.class),
+            Mockito.isNull(), Mockito.anyLong(), Mockito.isNull(), Mockito.isNull(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.isNull(),
+            Mockito.any(HypervisorType.class), Mockito.isNull(), Mockito.anyLong());
+
+        setupMigrationMocks(vm, srcHost, hosts, volume, true);
+
+        Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>> result =
+            spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+
+        // Verify User VM can migrate with storage (User VM type always checks)
+        Mockito.verify(hypervisorCapabilitiesDao, Mockito.atLeastOnce()).isStorageMotionSupported(HypervisorType.KVM, "");
+
+        // Verify response data
+        Assert.assertNotNull(result);
+        Assert.assertEquals("Should have 2 total hosts", Integer.valueOf(2), result.first().second());
+        Assert.assertTrue("Should have suitable hosts", result.second().size() > 0);
+    }
+
+    @Test
+    public void testListHostsForMigrationOfVMWithoutStorageMotionClusterScope() {
+        // When storage motion not supported, should search only in same cluster
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.XenServer);
+        Mockito.when(vm.getType()).thenReturn(VirtualMachine.Type.User);
+
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        Mockito.when(serviceOfferingDetailsDao.findDetail(vm.getServiceOfferingId(), GPU.Keys.pciDevice.toString()))
+            .thenReturn(null);
+
+        HostVO srcHost = mockHost(100L, 1L, 1L, 1L, HypervisorType.XenServer);
+        Mockito.when(hostDao.findById(vm.getHostId())).thenReturn(srcHost);
+
+        // No storage motion support
+        Mockito.when(hypervisorCapabilitiesDao.isStorageMotionSupported(HypervisorType.XenServer, null))
+            .thenReturn(false);
+
+        ServiceOfferingVO offering = Mockito.mock(ServiceOfferingVO.class);
+        Mockito.when(offeringDao.findById(vm.getId(), vm.getServiceOfferingId())).thenReturn(offering);
+
+        VolumeVO volume = mockVolume(1L, 1L);
+        Mockito.when(volumeDao.findCreatedByInstance(vm.getId())).thenReturn(List.of(volume));
+
+        DiskOfferingVO diskOffering = mockSharedDiskOffering(1L);
+        Mockito.when(diskOfferingDao.findById(volume.getDiskOfferingId())).thenReturn(diskOffering);
+
+        // Mock searchForServers - verify cluster scope is used
+        HostVO host1 = mockHost(101L, 1L, 1L, 1L, HypervisorType.XenServer);
+        HostVO host2 = mockHost(102L, 1L, 1L, 1L, HypervisorType.XenServer);
+        List<HostVO> hosts = List.of(host1, host2);
+        Pair<List<HostVO>, Integer> hostsPair = new Pair<>(hosts, 2);
+        Mockito.doReturn(hostsPair).when(spy).searchForServers(
+            Mockito.eq(0L), Mockito.eq(20L), Mockito.isNull(), Mockito.any(Type.class),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.eq(1L), // cluster=1L
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.isNull(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.eq(100L));
+
+        setupMigrationMocks(vm, srcHost, hosts, volume);
+
+        Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>> result =
+            spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+
+        // Verify XenServer without storage motion was checked
+        Mockito.verify(hypervisorCapabilitiesDao, Mockito.atLeastOnce()).isStorageMotionSupported(HypervisorType.XenServer, null);
+        // Verify cluster-scoped search was used (not zone-wide)
+        Mockito.verify(spy).searchForServers(
+            Mockito.eq(0L), Mockito.eq(20L), Mockito.isNull(), Mockito.any(Type.class),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.eq(1L),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.isNull(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.eq(100L));
+
+        // Verify response data
+        Assert.assertNotNull(result);
+        Assert.assertEquals("Should return 2 total hosts", Integer.valueOf(2), result.first().second());
+        Assert.assertEquals("Should have 2 suitable hosts", 2, result.second().size());
+        Assert.assertTrue("Should contain host 101",
+            result.second().stream().anyMatch(h -> h.getId() == 101L));
+        Assert.assertTrue("Should contain host 102",
+            result.second().stream().anyMatch(h -> h.getId() == 102L));
+    }
+
+    @Test
+    public void testListHostsForMigrationOfVMWithNoVolumes() {
+        // Edge case: VM with no volumes
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.KVM);
+
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        Mockito.when(serviceOfferingDetailsDao.findDetail(vm.getServiceOfferingId(), GPU.Keys.pciDevice.toString()))
+            .thenReturn(null);
+
+        HostVO srcHost = mockHost(100L, 1L, 1L, 1L, HypervisorType.KVM);
+        Mockito.when(hostDao.findById(vm.getHostId())).thenReturn(srcHost);
+
+        Mockito.when(hypervisorCapabilitiesDao.isStorageMotionSupported(HypervisorType.KVM, ""))
+            .thenReturn(false);
+
+        ServiceOfferingVO offering = Mockito.mock(ServiceOfferingVO.class);
+        Mockito.when(offeringDao.findById(vm.getId(), vm.getServiceOfferingId())).thenReturn(offering);
+
+        // No volumes
+        Mockito.when(volumeDao.findCreatedByInstance(vm.getId())).thenReturn(new ArrayList<>());
+
+        // Mock searchForServers for cluster-scoped search
+        HostVO host1 = mockHost(101L, 1L, 1L, 1L, HypervisorType.KVM);
+        HostVO host2 = mockHost(102L, 1L, 1L, 1L, HypervisorType.KVM);
+        List<HostVO> hosts = List.of(host1, host2);
+        Pair<List<HostVO>, Integer> hostsPair = new Pair<>(hosts, 2);
+        Mockito.doReturn(hostsPair).when(spy).searchForServers(
+            Mockito.anyLong(), Mockito.anyLong(), Mockito.isNull(), Mockito.any(Type.class),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.anyLong(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.isNull(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.anyLong());
+
+        // Set up mocks without volume since there are no volumes
+        Pair<Boolean, List<HostVO>> uefiResult = new Pair<>(true, hosts);
+        Mockito.doReturn(uefiResult).when(spy).filterUefiHostsForMigration(
+            Mockito.anyList(), Mockito.anyList(), Mockito.any());
+        Mockito.when(dpdkHelper.isVMDpdkEnabled(vm.getId())).thenReturn(false);
+        Mockito.when(affinityGroupVMMapDao.countAffinityGroupsForVm(vm.getId())).thenReturn(0L);
+        DataCenterVO dc = Mockito.mock(DataCenterVO.class);
+        Mockito.when(dcDao.findById(1L)).thenReturn(dc);
+        Mockito.doNothing().when(dpMgr).checkForNonDedicatedResources(Mockito.any(), Mockito.any(), Mockito.any());
+        Mockito.doNothing().when(dpMgr).reorderHostsByPriority(Mockito.any(), Mockito.anyList());
+
+        Mockito.when(hostAllocator.allocateTo(Mockito.any(), Mockito.any(), Mockito.any(),
+            Mockito.any(), Mockito.anyList(), Mockito.anyInt(), Mockito.anyBoolean()))
+            .thenReturn(new ArrayList<>(hosts));
+
+        Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>> result =
+            spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+
+        // Should still process without throwing exception for usesLocal check
+        Mockito.verify(volumeDao).findCreatedByInstance(vm.getId());
+
+        // Verify response
+        Assert.assertNotNull(result);
+        Assert.assertEquals("Should have 2 total hosts", Integer.valueOf(2), result.first().second());
+        Assert.assertEquals("Should have 2 suitable hosts even with no volumes", 2, result.second().size());
+        Assert.assertTrue("Storage motion map should be empty for VM with no volumes",
+            result.third().isEmpty());
+    }
+
+    @Test
+    public void testListHostsForMigrationOfVMOverloadedMethod() {
+        // Test the overloaded method that takes vmId instead of vm object
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.KVM);
+
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        Mockito.when(serviceOfferingDetailsDao.findDetail(vm.getServiceOfferingId(), GPU.Keys.pciDevice.toString()))
+            .thenReturn(null);
+
+        HostVO srcHost = mockHost(100L, 1L, 1L, 1L, HypervisorType.KVM);
+        Mockito.when(hostDao.findById(vm.getHostId())).thenReturn(srcHost);
+
+        Mockito.when(hypervisorCapabilitiesDao.isStorageMotionSupported(HypervisorType.KVM, ""))
+            .thenReturn(false);
+
+        ServiceOfferingVO offering = Mockito.mock(ServiceOfferingVO.class);
+        Mockito.when(offeringDao.findById(vm.getId(), vm.getServiceOfferingId())).thenReturn(offering);
+
+        VolumeVO volume = mockVolume(1L, 1L);
+        Mockito.when(volumeDao.findCreatedByInstance(vm.getId())).thenReturn(List.of(volume));
+
+        DiskOfferingVO diskOffering = mockSharedDiskOffering(1L);
+        Mockito.when(diskOfferingDao.findById(volume.getDiskOfferingId())).thenReturn(diskOffering);
+
+        // Mock searchForServers for cluster-scoped search with keyword
+        HostVO host1 = mockHost(101L, 1L, 1L, 1L, HypervisorType.KVM);
+        HostVO host2 = mockHost(102L, 1L, 1L, 1L, HypervisorType.KVM);
+        List<HostVO> hosts = List.of(host1, host2);
+        Pair<List<HostVO>, Integer> hostsPair = new Pair<>(hosts, 2);
+        Mockito.doReturn(hostsPair).when(spy).searchForServers(
+            Mockito.anyLong(), Mockito.anyLong(), Mockito.isNull(), Mockito.any(Type.class),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.anyLong(),
+            Mockito.isNull(), Mockito.eq("keyword-test"), Mockito.isNull(), Mockito.isNull(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.anyLong());
+
+        setupMigrationMocks(vm, srcHost, hosts, volume);
+
+        // Call overloaded method with vmId
+        Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>> result =
+            spy.listHostsForMigrationOfVM(1L, 0L, 20L, "keyword-test");
+
+        // Verify VM was fetched by ID
+        Mockito.verify(vmInstanceDao).findById(1L);
+
+        // Verify keyword was passed to searchForServers
+        Mockito.verify(spy).searchForServers(
+            Mockito.anyLong(), Mockito.anyLong(), Mockito.isNull(), Mockito.any(Type.class),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.anyLong(),
+            Mockito.isNull(), Mockito.eq("keyword-test"), Mockito.isNull(), Mockito.isNull(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.anyLong());
+
+        // Verify response data
+        Assert.assertNotNull(result);
+        Assert.assertEquals("Should have 2 hosts", Integer.valueOf(2), result.first().second());
+        Assert.assertEquals("Should have 2 suitable hosts", 2, result.second().size());
+    }
+
+    @Test
+    public void testListHostsForMigrationOfVMVmwareStorageMotionCheck() {
+        // VMware should check storage motion even for non-User VMs
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.VMware);
+        Mockito.when(vm.getType()).thenReturn(VirtualMachine.Type.DomainRouter);
+
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        Mockito.when(serviceOfferingDetailsDao.findDetail(vm.getServiceOfferingId(), GPU.Keys.pciDevice.toString()))
+                .thenReturn(null);
+
+        HostVO srcHost = mockHost(100L, 1L, 1L, 1L, HypervisorType.VMware);
+        Mockito.when(hostDao.findById(vm.getHostId())).thenReturn(srcHost);
+
+        // VMware with DomainRouter should still check storage motion
+        Mockito.when(hypervisorCapabilitiesDao.isStorageMotionSupported(HypervisorType.VMware, null))
+                .thenReturn(true);
+
+        ServiceOfferingVO offering = Mockito.mock(ServiceOfferingVO.class);
+        Mockito.when(offeringDao.findById(vm.getId(), vm.getServiceOfferingId())).thenReturn(offering);
+
+        VolumeVO volume = mockVolume(1L, 1L);
+        Mockito.when(volumeDao.findCreatedByInstance(vm.getId())).thenReturn(List.of(volume));
+
+        DiskOfferingVO diskOffering = mockSharedDiskOffering(1L);
+        Mockito.when(diskOfferingDao.findById(volume.getDiskOfferingId())).thenReturn(diskOffering);
+
+        // Mock searchForServers with zone-wide scope (storage motion enabled)
+        HostVO host1 = mockHost(101L, 1L, 1L, 1L, HypervisorType.VMware);
+        HostVO host2 = mockHost(102L, 1L, 1L, 1L, HypervisorType.VMware);
+        List<HostVO> hosts = List.of(host1, host2);
+        Pair<List<HostVO>, Integer> hostsPair = new Pair<>(hosts, 2);
+        Mockito.doReturn(hostsPair).when(spy).searchForServers(
+            Mockito.anyLong(), Mockito.anyLong(), Mockito.isNull(), Mockito.any(Type.class),
+            Mockito.isNull(), Mockito.anyLong(), Mockito.anyLong(), Mockito.isNull(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.isNull(),
+            Mockito.any(HypervisorType.class), Mockito.isNull(), Mockito.anyLong());
+
+        setupMigrationMocks(vm, srcHost, hosts, volume, true);
+
+        Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>> result =
+            spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+
+        // Verify VMware always checks storage motion (hypervisorTypes list includes VMware)
+        Mockito.verify(hypervisorCapabilitiesDao, Mockito.atLeastOnce()).isStorageMotionSupported(HypervisorType.VMware, null);
+
+        // Verify response
+        Assert.assertNotNull(result);
+        Assert.assertEquals("Should return 2 total hosts", Integer.valueOf(2), result.first().second());
+        Assert.assertEquals("Should have 2 suitable hosts", 2, result.second().size());
+        Assert.assertTrue("Host 101 should be in the list",
+            result.second().stream().anyMatch(h -> h.getId() == 101L));
+    }
+
+
+    @Test
+    public void testListHostsForMigrationOfVMWithNullKeyword() {
+        // Test with null keyword parameter
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.KVM);
+
+        Account caller = mockRootAdminAccount();
+        Mockito.doReturn(caller).when(spy).getCaller();
+        Mockito.when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        Mockito.when(serviceOfferingDetailsDao.findDetail(vm.getServiceOfferingId(), GPU.Keys.pciDevice.toString()))
+            .thenReturn(null);
+
+        HostVO srcHost = mockHost(100L, 1L, 1L, 1L, HypervisorType.KVM);
+        Mockito.when(hostDao.findById(vm.getHostId())).thenReturn(srcHost);
+
+        Mockito.when(hypervisorCapabilitiesDao.isStorageMotionSupported(HypervisorType.KVM, ""))
+            .thenReturn(false);
+
+        ServiceOfferingVO offering = Mockito.mock(ServiceOfferingVO.class);
+        Mockito.when(offeringDao.findById(vm.getId(), vm.getServiceOfferingId())).thenReturn(offering);
+
+        VolumeVO volume = mockVolume(1L, 1L);
+        Mockito.when(volumeDao.findCreatedByInstance(vm.getId())).thenReturn(List.of(volume));
+
+        DiskOfferingVO diskOffering = mockSharedDiskOffering(1L);
+        Mockito.when(diskOfferingDao.findById(volume.getDiskOfferingId())).thenReturn(diskOffering);
+
+        // Mock searchForServers for cluster-scoped search
+        HostVO host1 = mockHost(101L, 1L, 1L, 1L, HypervisorType.KVM);
+        HostVO host2 = mockHost(102L, 1L, 1L, 1L, HypervisorType.KVM);
+        List<HostVO> hosts = List.of(host1, host2);
+        Pair<List<HostVO>, Integer> hostsPair = new Pair<>(hosts, 2);
+        Mockito.doReturn(hostsPair).when(spy).searchForServers(
+            Mockito.anyLong(), Mockito.anyLong(), Mockito.isNull(), Mockito.any(Type.class),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.anyLong(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.isNull(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.anyLong());
+
+        setupMigrationMocks(vm, srcHost, hosts, volume);
+
+        Ternary<Pair<List<? extends Host>, Integer>, List<? extends Host>, Map<Host, Boolean>> result =
+            spy.listHostsForMigrationOfVM(1L, 0L, 20L, null);
+
+        // Verify null keyword is handled
+        Mockito.verify(vmInstanceDao).findById(1L);
+
+        // Verify searchForServers was called with null keyword
+        Mockito.verify(spy).searchForServers(
+            Mockito.anyLong(), Mockito.anyLong(), Mockito.isNull(), Mockito.any(Type.class),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.anyLong(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.isNull(), Mockito.isNull(),
+            Mockito.isNull(), Mockito.isNull(), Mockito.anyLong());
+
+        // Verify response data
+        Assert.assertNotNull(result);
+        Assert.assertEquals("Should return 2 total hosts", Integer.valueOf(2), result.first().second());
+        Assert.assertEquals("Should have 2 suitable hosts", 2, result.second().size());
+        Assert.assertTrue("Host 101 should be available",
+            result.second().stream().anyMatch(h -> h.getId() == 101L));
+        Assert.assertTrue("Host 102 should be available",
+            result.second().stream().anyMatch(h -> h.getId() == 102L));
+    }
+
+    // Note: Tests for success scenarios with complex flows (managed storage, zone-wide volumes,
+    // DPDK exclusion, affinity groups, architecture filtering) require full setup with mocking
+    // private methods like hasSuitablePoolsForVolume(), excludeNonDPDKEnabledHosts(), and
+    // filterUefiHostsForMigration() which are better suited for integration tests.
+
+    // ============= Helper methods for tests =============
+
+    /**
+     * Sets up common mocks for successful migration tests
+     * For storage motion tests, set forceStorageMotion=true to configure volume in same cluster
+     * (which avoids complex filtering logic for cross-cluster storage motion)
+     */
+    private void setupMigrationMocks(VMInstanceVO vm, HostVO srcHost,
+                                     List<HostVO> targetHosts, VolumeVO volume) {
+        setupMigrationMocks(vm, srcHost, targetHosts, volume, false);
+    }
+
+    private void setupMigrationMocks(VMInstanceVO vm, HostVO srcHost,
+                                     List<HostVO> targetHosts, VolumeVO volume,
+                                     boolean forceStorageMotion) {
+        // Mock dataStoreManager for volume pool lookup (lenient as not used in all paths)
+        // For storage motion tests, put volume in same cluster to avoid complex filtering
+        PrimaryDataStore primaryDataStore = Mockito.mock(PrimaryDataStore.class);
+        Mockito.when(dataStoreManager.getPrimaryDataStore(volume.getPoolId())).thenReturn(primaryDataStore);
+        // If not forceStorageMotion, volume is in same cluster (no storage motion needed)
+        // If forceStorageMotion, set volClusterId to null (zone-wide storage)
+        Mockito.when(primaryDataStore.getClusterId()).thenReturn(forceStorageMotion ? null : srcHost.getClusterId());
+
+        // Mock zoneWideVolumeRequiresStorageMotion for zone-wide volumes
+        if (forceStorageMotion) {
+            Mockito.doReturn(false).when(spy).zoneWideVolumeRequiresStorageMotion(
+                Mockito.any(), Mockito.any(), Mockito.any());
+        }
+
+        // Mock filterUefiHostsForMigration - must return hosts properly
+        Pair<Boolean, List<HostVO>> uefiResult = new Pair<>(true, new ArrayList<>(targetHosts));
+        Mockito.doReturn(uefiResult).when(spy).filterUefiHostsForMigration(
+            Mockito.anyList(), Mockito.anyList(), Mockito.any());
+
+        // Mock DPDK check
+        Mockito.when(dpdkHelper.isVMDpdkEnabled(vm.getId())).thenReturn(false);
+
+        // Mock affinity group count
+        Mockito.when(affinityGroupVMMapDao.countAffinityGroupsForVm(vm.getId())).thenReturn(0L);
+
+        // Mock datacenter
+        DataCenterVO dc = Mockito.mock(DataCenterVO.class);
+        Mockito.when(dcDao.findById(srcHost.getDataCenterId())).thenReturn(dc);
+
+        // Mock dedicated resources check
+        Mockito.doNothing().when(dpMgr).checkForNonDedicatedResources(
+            Mockito.any(), Mockito.any(), Mockito.any());
+
+        // Mock priority reordering
+        Mockito.doNothing().when(dpMgr).reorderHostsByPriority(Mockito.any(), Mockito.anyList());
+
+        // Mock host allocators - both signatures
+        // 1. Version with filteredHosts list (used when canMigrateWithStorage = true)
+        Mockito.when(hostAllocator.allocateTo(Mockito.any(), Mockito.any(), Mockito.any(),
+            Mockito.any(), Mockito.anyList(), Mockito.anyInt(), Mockito.anyBoolean()))
+            .thenReturn(new ArrayList<>(targetHosts));
+    }
+
+    private VMInstanceVO mockRunningVM(Long id, HypervisorType hypervisorType) {
+        return mockVM(id, hypervisorType, State.Running);
+    }
+
+    private VMInstanceVO mockVM(Long id, HypervisorType hypervisorType, State state) {
+        VMInstanceVO vm = Mockito.mock(VMInstanceVO.class);
+        when(vm.getId()).thenReturn(id);
+        when(vm.getState()).thenReturn(state);
+        when(vm.getHypervisorType()).thenReturn(hypervisorType);
+        when(vm.getHostId()).thenReturn(100L);
+        when(vm.getServiceOfferingId()).thenReturn(1L);
+        when(vm.getType()).thenReturn(VirtualMachine.Type.User);
+        when(vm.getUuid()).thenReturn("uuid-" + id);
+        when(vm.getDataCenterId()).thenReturn(1L);
+        return vm;
+    }
+
+    private Account mockRootAdminAccount() {
+        Account account = Mockito.mock(Account.class);
+        Mockito.when(account.getId()).thenReturn(1L);
+        Mockito.when(accountManager.isRootAdmin(1L)).thenReturn(true);
+        return account;
+    }
+
+    private HostVO mockHost(Long id, Long clusterId, Long podId, Long dcId, HypervisorType hypervisorType) {
+        HostVO host = new HostVO("guid-" + id);
+        ReflectionTestUtils.setField(host, "id", id);
+        ReflectionTestUtils.setField(host, "clusterId", clusterId);
+        ReflectionTestUtils.setField(host, "podId", podId);
+        ReflectionTestUtils.setField(host, "dataCenterId", dcId);
+        ReflectionTestUtils.setField(host, "hypervisorType", hypervisorType);
+        ReflectionTestUtils.setField(host, "type", Host.Type.Routing);
+        ReflectionTestUtils.setField(host, "hypervisorVersion", null);
+        return host;
+    }
+
+    private VolumeVO mockVolume(Long id, Long poolId) {
+        VolumeVO volume = Mockito.mock(VolumeVO.class);
+        when(volume.getId()).thenReturn(id);
+        when(volume.getPoolId()).thenReturn(poolId);
+        when(volume.getDiskOfferingId()).thenReturn(1L);
+        when(volume.getVolumeType()).thenReturn(Volume.Type.ROOT);
+        return volume;
+    }
+
+    private DiskOfferingVO mockLocalDiskOffering(Long id) {
+        DiskOfferingVO diskOffering = Mockito.mock(DiskOfferingVO.class);
+        Mockito.when(diskOffering.getId()).thenReturn(id);
+        Mockito.when(diskOffering.isUseLocalStorage()).thenReturn(true);
+        return diskOffering;
+    }
+
+    private DiskOfferingVO mockSharedDiskOffering(Long id) {
+        DiskOfferingVO diskOffering = Mockito.mock(DiskOfferingVO.class);
+        Mockito.when(diskOffering.getId()).thenReturn(id);
+        Mockito.when(diskOffering.isUseLocalStorage()).thenReturn(false);
+        return diskOffering;
+    }
+
+    @Test
+    public void createDeploymentPlanForMigrationListingTestAllocatesInAnyClusterWhenStorageMigrationIsSupported() {
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.KVM);
+        HostVO srcHost = mockHost(vm.getHostId(), 1L, 2L, 3L, HypervisorType.KVM);
+
+        Mockito.doReturn(true).when(spy).isStorageMigrationSupported(vm, srcHost);
+
+        DataCenterDeployment deploymentPlan = spy.createDeploymentPlanForMigrationListing(vm, srcHost);
+
+        Assert.assertEquals(3L, deploymentPlan.getDataCenterId());
+        Assert.assertEquals(2L, (long) deploymentPlan.getPodId());
+        Assert.assertNull(deploymentPlan.getClusterId());
+    }
+
+    @Test
+    public void createDeploymentPlanForMigrationListingTestAllocatesInSourceClusterWhenStorageMigrationIsNotSupported() {
+        VMInstanceVO vm = mockRunningVM(1L, HypervisorType.XenServer);
+        HostVO srcHost = mockHost(vm.getHostId(), 4L, 5L, 6L, HypervisorType.XenServer);
+
+        Mockito.doReturn(false).when(spy).isStorageMigrationSupported(vm, srcHost);
+
+        DataCenterDeployment deploymentPlan = spy.createDeploymentPlanForMigrationListing(vm, srcHost);
+
+        Assert.assertEquals(6L, deploymentPlan.getDataCenterId());
+        Assert.assertEquals(5L, (long) deploymentPlan.getPodId());
+        Assert.assertEquals(4L, (long) deploymentPlan.getClusterId());
+    }
 }
diff --git a/server/src/test/java/com/cloud/storage/VolumeApiServiceImplTest.java b/server/src/test/java/com/cloud/storage/VolumeApiServiceImplTest.java
index e2c89dae3cce..12258e2cc160 100644
--- a/server/src/test/java/com/cloud/storage/VolumeApiServiceImplTest.java
+++ b/server/src/test/java/com/cloud/storage/VolumeApiServiceImplTest.java
@@ -626,37 +626,37 @@ public void testDetachVolumeFromStoppedXenVm() throws NoSuchFieldException, Ille
     // Negative test - try to attach non-root non-datadisk volume
     @Test(expected = InvalidParameterValueException.class)
     public void attachIncorrectDiskType() throws NoSuchFieldException, IllegalAccessException {
-        volumeApiServiceImpl.attachVolumeToVM(1L, 5L, 0L, false);
+        volumeApiServiceImpl.attachVolumeToVM(1L, 5L, 0L, false, false);
     }
 
     // Negative test - attach root volume to running vm
     @Test(expected = InvalidParameterValueException.class)
     public void attachRootDiskToRunningVm() throws NoSuchFieldException, IllegalAccessException {
-        volumeApiServiceImpl.attachVolumeToVM(1L, 6L, 0L, false);
+        volumeApiServiceImpl.attachVolumeToVM(1L, 6L, 0L, false, false);
     }
 
     // Negative test - attach root volume to non-xen vm
     @Test(expected = InvalidParameterValueException.class)
     public void attachRootDiskToHyperVm() throws NoSuchFieldException, IllegalAccessException {
-        volumeApiServiceImpl.attachVolumeToVM(3L, 6L, 0L, false);
+        volumeApiServiceImpl.attachVolumeToVM(3L, 6L, 0L, false, false);
     }
 
     // Negative test - attach root volume from the managed data store
     @Test(expected = InvalidParameterValueException.class)
     public void attachRootDiskOfManagedDataStore() throws NoSuchFieldException, IllegalAccessException {
-        volumeApiServiceImpl.attachVolumeToVM(2L, 7L, 0L, false);
+        volumeApiServiceImpl.attachVolumeToVM(2L, 7L, 0L, false, false);
     }
 
     // Negative test - root volume can't be attached to the vm already having a root volume attached
     @Test(expected = InvalidParameterValueException.class)
     public void attachRootDiskToVmHavingRootDisk() throws NoSuchFieldException, IllegalAccessException {
-        volumeApiServiceImpl.attachVolumeToVM(4L, 6L, 0L, false);
+        volumeApiServiceImpl.attachVolumeToVM(4L, 6L, 0L, false, false);
     }
 
     // Negative test - root volume in uploaded state can't be attached
     @Test(expected = InvalidParameterValueException.class)
     public void attachRootInUploadedState() throws NoSuchFieldException, IllegalAccessException {
-        volumeApiServiceImpl.attachVolumeToVM(2L, 8L, 0L, false);
+        volumeApiServiceImpl.attachVolumeToVM(2L, 8L, 0L, false, false);
     }
 
     // Positive test - attach ROOT volume in correct state, to the vm not having root volume attached
@@ -664,7 +664,7 @@ public void attachRootInUploadedState() throws NoSuchFieldException, IllegalAcce
     public void attachRootVolumePositive() throws NoSuchFieldException, IllegalAccessException {
         thrown.expect(NullPointerException.class);
         try (MockedConstruction<CheckedReservation> mockCheckedReservation = Mockito.mockConstruction(CheckedReservation.class)) {
-            volumeApiServiceImpl.attachVolumeToVM(2L, 6L, 0L, false);
+            volumeApiServiceImpl.attachVolumeToVM(2L, 6L, 0L, false, false);
         }
     }
 
@@ -674,7 +674,7 @@ public void attachDiskWithEncryptEnabledOfferingonNonKVM() throws NoSuchFieldExc
         DiskOfferingVO diskOffering = Mockito.mock(DiskOfferingVO.class);
         when(diskOffering.getEncrypt()).thenReturn(true);
         when(_diskOfferingDao.findById(anyLong())).thenReturn(diskOffering);
-        volumeApiServiceImpl.attachVolumeToVM(2L, 10L, 1L, false);
+        volumeApiServiceImpl.attachVolumeToVM(2L, 10L, 1L, false, false);
     }
 
     // Positive test - attach data volume, to the vm on kvm hypervisor
@@ -685,7 +685,7 @@ public void attachDiskWithEncryptEnabledOfferingOnKVM() throws NoSuchFieldExcept
         when(diskOffering.getEncrypt()).thenReturn(true);
         when(_diskOfferingDao.findById(anyLong())).thenReturn(diskOffering);
         try (MockedConstruction<CheckedReservation> mockCheckedReservation = Mockito.mockConstruction(CheckedReservation.class)) {
-            volumeApiServiceImpl.attachVolumeToVM(4L, 10L, 1L, false);
+            volumeApiServiceImpl.attachVolumeToVM(4L, 10L, 1L, false, false);
         }
     }
 
@@ -790,7 +790,7 @@ public void testAttachVolumeToVMPerformsResourceReservation() throws NoSuchField
         when(zoneWithDisabledLocalStorage.isLocalStorageEnabled()).thenReturn(true);
         doReturn(volumeVoMock).when(volumeApiServiceImpl).getVolumeAttachJobResult(Mockito.any(), Mockito.any(), Mockito.any());
         try (MockedConstruction<CheckedReservation> mockCheckedReservation = Mockito.mockConstruction(CheckedReservation.class)) {
-            volumeApiServiceImpl.attachVolumeToVM(2L, 9L, null, false);
+            volumeApiServiceImpl.attachVolumeToVM(2L, 9L, null, false, false);
             Assert.assertEquals(1, mockCheckedReservation.constructed().size());
         }
     }
@@ -1044,7 +1044,7 @@ public void destroyVolumeIfPossibleTestVolumeStateReady() {
 
     private void verifyMocksForTestDestroyVolumeWhenVolumeIsNotInRightState() {
         Mockito.verify(volumeServiceMock, Mockito.times(0)).destroyVolume(volumeMockId);
-        Mockito.verify(resourceLimitServiceMock, Mockito.times(0)).decrementVolumeResourceCount(accountMockId, true, volumeSizeMock, newDiskOfferingMock);
+        Mockito.verify(resourceLimitServiceMock, Mockito.times(0)).decrementVolumeResourceCount(accountMockId, true, volumeSizeMock, newDiskOfferingMock, null);
     }
 
     private void configureMocksForTestDestroyVolumeWhenVolume() {
@@ -1052,7 +1052,7 @@ private void configureMocksForTestDestroyVolumeWhenVolume() {
         Mockito.lenient().doReturn(true).when(volumeVoMock).isDisplayVolume();
 
         Mockito.lenient().doNothing().when(volumeServiceMock).destroyVolume(volumeMockId);
-        Mockito.lenient().doNothing().when(resourceLimitServiceMock).decrementVolumeResourceCount(accountMockId, true, volumeSizeMock, newDiskOfferingMock);
+        Mockito.lenient().doNothing().when(resourceLimitServiceMock).decrementVolumeResourceCount(accountMockId, true, volumeSizeMock, newDiskOfferingMock, null);
     }
 
     @Test
@@ -1420,7 +1420,7 @@ public void validateIfVmHaveBackupsTestExceptionWhenTryToDetachVolumeFromVMWhich
         try {
             UserVmVO vm = Mockito.mock(UserVmVO.class);
             when(vm.getBackupOfferingId()).thenReturn(1l);
-            volumeApiServiceImpl.checkForBackups(vm, false);
+            volumeApiServiceImpl.validateIfVmHasBackups(vm, false);
         } catch (Exception e) {
             Assert.assertEquals("Unable to detach volume, cannot detach volume from a VM that has backups. First remove the VM from the backup offering or set the global configuration 'backup.enable.attach.detach.of.volumes' to true.", e.getMessage());
         }
@@ -1431,7 +1431,7 @@ public void validateIfVmHaveBackupsTestExceptionWhenTryToAttachVolumeFromVMWhich
         try {
             UserVmVO vm = Mockito.mock(UserVmVO.class);
             when(vm.getBackupOfferingId()).thenReturn(1l);
-            volumeApiServiceImpl.checkForBackups(vm, true);
+            volumeApiServiceImpl.validateIfVmHasBackups(vm, true);
         } catch (Exception e) {
             Assert.assertEquals("Unable to attach volume, please specify a VM that does not have any backups or set the global configuration 'backup.enable.attach.detach.of.volumes' to true.", e.getMessage());
         }
@@ -1441,7 +1441,7 @@ public void validateIfVmHaveBackupsTestExceptionWhenTryToAttachVolumeFromVMWhich
     public void validateIfVmHaveBackupsTestSuccessWhenVMDontHaveBackupOffering() {
         UserVmVO vm = Mockito.mock(UserVmVO.class);
         when(vm.getBackupOfferingId()).thenReturn(null);
-        volumeApiServiceImpl.checkForBackups(vm, true);
+        volumeApiServiceImpl.validateIfVmHasBackups(vm, true);
     }
 
     @Test
@@ -1600,7 +1600,7 @@ public void updateVolumeAccountTest() {
             usageEventUtilsMocked.verify(() -> UsageEventUtils.publishUsageEvent(EventTypes.EVENT_VOLUME_DELETE, volumeVoMock.getAccountId(), volumeVoMock.getDataCenterId(), volumeVoMock.getId(),
                     volumeVoMock.getName(), Volume.class.getName(), volumeVoMock.getUuid(), volumeVoMock.isDisplayVolume()));
 
-            Mockito.verify(resourceLimitServiceMock).decrementVolumeResourceCount(accountMock.getAccountId(), true, volumeVoMock.getSize(), newDiskOfferingMock);
+            Mockito.verify(resourceLimitServiceMock).decrementVolumeResourceCount(accountMock.getAccountId(), true, volumeVoMock.getSize(), newDiskOfferingMock, null);
 
             Mockito.verify(volumeVoMock).setAccountId(newAccountMock.getAccountId());
             Mockito.verify(volumeVoMock).setDomainId(newAccountMock.getDomainId());
@@ -2223,7 +2223,7 @@ public void testCreateVolumeOnSecondaryForAttachIfNeeded_ExistingVolumeDetermine
         Mockito.when(primaryDataStoreDaoMock.findById(1L)).thenReturn(destPrimaryStorage);
         VolumeInfo newVolumeOnPrimaryStorage = Mockito.mock(VolumeInfo.class);
         try {
-            Mockito.when(volumeOrchestrationService.createVolumeOnPrimaryStorage(vm, volumeToAttach, vm.getHypervisorType(), destPrimaryStorage))
+            Mockito.when(volumeOrchestrationService.createVolumeOnPrimaryStorage(vm, volumeToAttach, vm.getHypervisorType(), destPrimaryStorage, null, null))
                     .thenReturn(newVolumeOnPrimaryStorage);
         } catch (NoTransitionException nte) {
             Assert.fail(nte.getMessage());
@@ -2244,7 +2244,7 @@ public void testCreateVolumeOnPrimaryForAttachIfNeeded_UsesGetPoolForAttach() {
         VolumeInfo newVolumeOnPrimaryStorage = Mockito.mock(VolumeInfo.class);
         try {
             Mockito.when(volumeOrchestrationService.createVolumeOnPrimaryStorage(
-                    vm, volumeToAttach, vm.getHypervisorType(), destPrimaryStorage))
+                    vm, volumeToAttach, vm.getHypervisorType(), destPrimaryStorage, null, null))
                 .thenReturn(newVolumeOnPrimaryStorage);
         } catch (NoTransitionException nte) {
             Assert.fail(nte.getMessage());
@@ -2276,7 +2276,7 @@ public void testCreateVolumeOnSecondaryForAttachIfNeeded_CreateVolumeFails_Throw
         Mockito.doReturn(destPrimaryStorage).when(volumeApiServiceImpl)
                 .getSuitablePoolForAllocatedOrUploadedVolumeForAttach(volumeToAttach, vm);
         try {
-            Mockito.when(volumeOrchestrationService.createVolumeOnPrimaryStorage(vm, volumeToAttach, vm.getHypervisorType(), destPrimaryStorage))
+            Mockito.when(volumeOrchestrationService.createVolumeOnPrimaryStorage(vm, volumeToAttach, vm.getHypervisorType(), destPrimaryStorage, null, null))
                     .thenThrow(new NoTransitionException("Mocked exception"));
         } catch (NoTransitionException nte) {
             Assert.fail(nte.getMessage());
@@ -2312,7 +2312,7 @@ public void testCreateVolumeOnSecondaryForAttachIfNeeded_NoSuitablePool_ReturnsS
         Assert.assertSame(volumeToAttach, result);
         try {
             Mockito.verify(volumeOrchestrationService, Mockito.never()).createVolumeOnPrimaryStorage(Mockito.any(),
-                    Mockito.any(), Mockito.any(), Mockito.any());
+                    Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
         } catch (NoTransitionException e) {
             Assert.fail();
         }
diff --git a/server/src/test/java/com/cloud/template/TemplateManagerImplTest.java b/server/src/test/java/com/cloud/template/TemplateManagerImplTest.java
index 47099c371dce..6d8003914d36 100755
--- a/server/src/test/java/com/cloud/template/TemplateManagerImplTest.java
+++ b/server/src/test/java/com/cloud/template/TemplateManagerImplTest.java
@@ -90,6 +90,7 @@
 import org.apache.cloudstack.api.command.user.template.UpdateTemplateCmd;
 import org.apache.cloudstack.api.command.user.template.UpdateVnfTemplateCmd;
 import org.apache.cloudstack.api.command.user.userdata.LinkUserDataToTemplateCmd;
+import org.apache.cloudstack.backup.dao.BackupOfferingDao;
 import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.engine.orchestration.service.VolumeOrchestrationService;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
@@ -1233,6 +1234,10 @@ public SnapshotJoinDao snapshotJoinDao() {
             return Mockito.mock(SnapshotJoinDao.class);
         }
 
+        @Bean
+        public BackupOfferingDao backupOfferingDao() {
+            return Mockito.mock(BackupOfferingDao.class);
+        }
 
         public static class Library implements TypeFilter {
             @Override
diff --git a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
index f55124f0ad69..f70a3abd5871 100644
--- a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
+++ b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
@@ -65,10 +65,8 @@
 import org.apache.cloudstack.acl.SecurityChecker;
 import org.apache.cloudstack.api.ApiCommandResourceType;
 import org.apache.cloudstack.api.ApiConstants;
-import org.apache.cloudstack.api.BaseCmd;
 import org.apache.cloudstack.api.BaseCmd.HTTPMethod;
 import org.apache.cloudstack.api.command.admin.vm.AssignVMCmd;
-import org.apache.cloudstack.api.command.admin.vm.ExpungeVMCmd;
 import org.apache.cloudstack.api.command.user.vm.CreateVMFromBackupCmd;
 import org.apache.cloudstack.api.command.user.vm.DeployVMCmd;
 import org.apache.cloudstack.api.command.user.vm.DeployVnfApplianceCmd;
@@ -80,6 +78,7 @@
 import org.apache.cloudstack.api.command.user.vm.UpdateVmNicCmd;
 import org.apache.cloudstack.api.command.user.volume.ResizeVolumeCmd;
 import org.apache.cloudstack.backup.BackupManager;
+import org.apache.cloudstack.backup.BackupProvider;
 import org.apache.cloudstack.backup.BackupVO;
 import org.apache.cloudstack.backup.dao.BackupDao;
 import org.apache.cloudstack.backup.dao.BackupScheduleDao;
@@ -427,6 +426,9 @@ public class UserVmManagerImplTest {
     @Mock
     SSHKeyPairDao sshKeyPairDao;
 
+    @Mock
+    private BackupProvider backupProviderMock;
+
     @Mock
     private VMInstanceVO vmInstanceMock;
 
@@ -737,7 +739,7 @@ private void configureDoNothingForMethodsThatWeDoNotWantToTest() throws Resource
         Mockito.doNothing().when(userVmManagerImpl).updateVolumesOwner(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
         Mockito.doNothing().when(userVmManagerImpl).updateVmNetwork(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
 
-        Mockito.doNothing().when(userVmManagerImpl).resourceCountIncrement(Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.any());
+        Mockito.doNothing().when(userVmManagerImpl).resourceCountIncrement(Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
     }
 
     @Test
@@ -3148,7 +3150,7 @@ public void executeStepsToChangeOwnershipOfVmTestUpdateVmNetworkThrowsInsufficie
             Assert.assertThrows(CloudRuntimeException.class, () -> userVmManagerImpl.executeStepsToChangeOwnershipOfVm(assignVmCmdMock, callerAccount, accountMock, accountMock,
                     userVmVoMock, serviceOfferingVoMock, volumes, virtualMachineTemplateMock, 1L));
 
-            Mockito.verify(userVmManagerImpl).resourceCountDecrement(Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.any());
+            Mockito.verify(userVmManagerImpl).resourceCountDecrement(Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
             Mockito.verify(userVmManagerImpl).updateVmOwner(Mockito.any(), Mockito.any(), Mockito.anyLong(), Mockito.anyLong());
             Mockito.verify(userVmManagerImpl).updateVolumesOwner(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyLong());
         }
@@ -3171,7 +3173,7 @@ public void executeStepsToChangeOwnershipOfVmTestUpdateVmNetworkThrowsResourceAl
             Assert.assertThrows(CloudRuntimeException.class, () -> userVmManagerImpl.executeStepsToChangeOwnershipOfVm(assignVmCmdMock, callerAccount, accountMock, accountMock,
                     userVmVoMock, serviceOfferingVoMock, volumes, virtualMachineTemplateMock, 1L));
 
-            Mockito.verify(userVmManagerImpl).resourceCountDecrement(Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.any());
+            Mockito.verify(userVmManagerImpl).resourceCountDecrement(Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
             Mockito.verify(userVmManagerImpl).updateVmOwner(Mockito.any(), Mockito.any(), Mockito.anyLong(), Mockito.anyLong());
             Mockito.verify(userVmManagerImpl).updateVolumesOwner(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyLong());
         }
@@ -3193,11 +3195,11 @@ public void executeStepsToChangeOwnershipOfVmTestResourceCountRunningVmsOnlyEnab
             userVmManagerImpl.executeStepsToChangeOwnershipOfVm(assignVmCmdMock, callerAccount, accountMock, accountMock, userVmVoMock, serviceOfferingVoMock, volumes,
                     virtualMachineTemplateMock, 1L);
 
-            Mockito.verify(userVmManagerImpl).resourceCountDecrement(Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.any());
+            Mockito.verify(userVmManagerImpl).resourceCountDecrement(Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
             Mockito.verify(userVmManagerImpl).updateVmOwner(Mockito.any(), Mockito.any(), Mockito.anyLong(), Mockito.anyLong());
             Mockito.verify(userVmManagerImpl).updateVolumesOwner(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyLong());
             Mockito.verify(userVmManagerImpl).updateVmNetwork(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
-            Mockito.verify(userVmManagerImpl).resourceCountIncrement(Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.any());
+            Mockito.verify(userVmManagerImpl).resourceCountIncrement(Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
         }
     }
 
@@ -3216,11 +3218,11 @@ public void executeStepsToChangeOwnershipOfVmTestResourceCountRunningVmsOnlyEnab
             userVmManagerImpl.executeStepsToChangeOwnershipOfVm(assignVmCmdMock, callerAccount, accountMock, accountMock, userVmVoMock, serviceOfferingVoMock, volumes,
                     virtualMachineTemplateMock, 1L);
 
-            Mockito.verify(userVmManagerImpl).resourceCountDecrement(Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.any());
+            Mockito.verify(userVmManagerImpl).resourceCountDecrement(Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
             Mockito.verify(userVmManagerImpl).updateVmOwner(Mockito.any(), Mockito.any(), Mockito.anyLong(), Mockito.anyLong());
             Mockito.verify(userVmManagerImpl).updateVolumesOwner(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyLong());
             Mockito.verify(userVmManagerImpl).updateVmNetwork(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
-            Mockito.verify(userVmManagerImpl, Mockito.never()).resourceCountIncrement(Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.any());
+            Mockito.verify(userVmManagerImpl, Mockito.never()).resourceCountIncrement(Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
         }
     }
 
@@ -3626,12 +3628,12 @@ public void testRestoreVMFromBackup() throws ResourceUnavailableException, Insuf
         when(vm.getState()).thenReturn(VirtualMachine.State.Running);
         when(vm.getTemplateId()).thenReturn(templateId);
 
-        when(backupManager.restoreBackupToVM(backupId, vmId)).thenReturn(true);
+        when(backupManager.restoreBackupToVM(backupId, vmId, false)).thenReturn(true);
 
         Map<VirtualMachineProfile.Param, Object> params = new HashMap<>();
         Pair<UserVmVO, Map<VirtualMachineProfile.Param, Object>> vmPair = new Pair<>(vm, params);
-        doReturn(vmPair).when(userVmManagerImpl).startVirtualMachine(anyLong(), isNull(), isNull(), isNull(), anyMap(), isNull());
-        doReturn(vmPair).when(userVmManagerImpl).startVirtualMachine(anyLong(), isNull(), isNull(), anyLong(), anyMap(), isNull());
+        doReturn(vmPair).when(userVmManagerImpl).startVirtualMachine(anyLong(), isNull(), isNull(), isNull(), anyMap(), isNull(), anyBoolean());
+        doReturn(vmPair).when(userVmManagerImpl).startVirtualMachine(anyLong(), isNull(), isNull(), anyLong(), anyMap(), isNull(), anyBoolean());
         when(userVmDao.findById(vmId)).thenReturn(vm);
         when(templateDao.findByIdIncludingRemoved(templateId)).thenReturn(mock(VMTemplateVO.class));
 
@@ -3639,7 +3641,7 @@ public void testRestoreVMFromBackup() throws ResourceUnavailableException, Insuf
 
         assertNotNull(result);
         assertEquals(vm, result);
-        Mockito.verify(backupManager).restoreBackupToVM(backupId, vmId);
+        Mockito.verify(backupManager).restoreBackupToVM(backupId, vmId, false);
     }
 
     @Test
@@ -3652,10 +3654,7 @@ public void testDestroyVm() throws ResourceUnavailableException {
         ReflectionTestUtils.setField(userVmManagerImpl, "_uuidMgr", uuidMgr);
         CallContext callContext = mock(CallContext.class);
         Account callingAccount = mock(Account.class);
-        when(callingAccount.getId()).thenReturn(accountId);
         when(callContext.getCallingAccount()).thenReturn(callingAccount);
-        when(accountManager.isAdmin(callingAccount.getId())).thenReturn(true);
-        doNothing().when(accountManager).checkApiAccess(callingAccount, BaseCmd.getCommandNameByClass(ExpungeVMCmd.class), null);
         try (MockedStatic<CallContext> mockedCallContext = mockStatic(CallContext.class)) {
             mockedCallContext.when(CallContext::current).thenReturn(callContext);
             mockedCallContext.when(() -> CallContext.register(callContext, ApiCommandResourceType.Volume)).thenReturn(callContext);
@@ -3666,8 +3665,6 @@ public void testDestroyVm() throws ResourceUnavailableException {
             List<Long> volumeIds = List.of(volumeId);
             when(cmd.getVolumeIds()).thenReturn(volumeIds);
             AsyncJobVO asyncJobMock = mock(AsyncJobVO.class);
-            when(cmd.getJob()).thenReturn(asyncJobMock);
-            when(asyncJobMock.getCmdInfo()).thenReturn("{}");
 
             UserVmVO vm = mock(UserVmVO.class);
             when(vm.getId()).thenReturn(vmId);
@@ -3685,15 +3682,13 @@ public void testDestroyVm() throws ResourceUnavailableException {
             List<VolumeVO> dataVolumes = new ArrayList<>();
             when(volumeDaoMock.findByInstanceAndType(vmId, Volume.Type.DATADISK)).thenReturn(dataVolumes);
 
-            when(volumeApiService.destroyVolume(volumeId, CallContext.current().getCallingAccount(), expunge, false)).thenReturn(vol);
-
             doReturn(vm).when(userVmManagerImpl).stopVirtualMachine(anyLong(), anyBoolean());
             doReturn(vm).when(userVmManagerImpl).destroyVm(vmId, expunge);
             doReturn(true).when(userVmManagerImpl).expunge(vm);
 
             try (MockedStatic<UsageEventUtils> mockedUsageEventUtils = mockStatic(UsageEventUtils.class)) {
 
-                UserVm result = userVmManagerImpl.destroyVm(cmd);
+                UserVm result = userVmManagerImpl.destroyVm(cmd, false);
 
                 assertNotNull(result);
                 assertEquals(vm, result);
diff --git a/server/src/test/java/com/cloud/vpc/MockNetworkManagerImpl.java b/server/src/test/java/com/cloud/vpc/MockNetworkManagerImpl.java
index 99f0d7fe294a..1239dd23e7ec 100644
--- a/server/src/test/java/com/cloud/vpc/MockNetworkManagerImpl.java
+++ b/server/src/test/java/com/cloud/vpc/MockNetworkManagerImpl.java
@@ -585,6 +585,11 @@ public List<NetworkVO> setupNetwork(Account owner, NetworkOffering offering, Net
         return null;
     }
 
+    @Override
+    public boolean isIsolationMethodNetworkExtension(Long networkOfferingId) {
+        return false;
+    }
+
     /* (non-Javadoc)
      * @see com.cloud.network.NetworkManager#allocate(com.cloud.vm.VirtualMachineProfile, java.util.List)
      */
diff --git a/server/src/test/java/com/cloud/vpc/MockNetworkModelImpl.java b/server/src/test/java/com/cloud/vpc/MockNetworkModelImpl.java
index b9423daaeebb..83f3fda383c8 100644
--- a/server/src/test/java/com/cloud/vpc/MockNetworkModelImpl.java
+++ b/server/src/test/java/com/cloud/vpc/MockNetworkModelImpl.java
@@ -411,6 +411,15 @@ public boolean canElementEnableIndividualServices(Provider provider) {
         return false;
     }
 
+    @Override
+    public Provider resolveProvider(String providerName) {
+        return Provider.getProvider(providerName);
+    }
+    @Override
+    public boolean canElementEnableIndividualServicesByName(String providerName) {
+        return false;
+    }
+
     /* (non-Javadoc)
      * @see com.cloud.network.NetworkModel#areServicesSupportedInNetwork(long, com.cloud.network.Network.Service[])
      */
diff --git a/server/src/test/java/com/cloud/vpc/MockResourceLimitManagerImpl.java b/server/src/test/java/com/cloud/vpc/MockResourceLimitManagerImpl.java
index 9e0997df08cb..3aec187c29d4 100644
--- a/server/src/test/java/com/cloud/vpc/MockResourceLimitManagerImpl.java
+++ b/server/src/test/java/com/cloud/vpc/MockResourceLimitManagerImpl.java
@@ -279,7 +279,7 @@ public void checkVolumeResourceLimit(Account owner, Boolean display, Long size,
     }
 
     @Override
-    public List<String> getResourceLimitStorageTagsForResourceCountOperation(Boolean display, DiskOffering diskOffering) {
+    public List<String> getResourceLimitStorageTagsForResourceCountOperation(Boolean display, DiskOffering diskOffering, Boolean enforceResourceLimitOnDisplayFalse) {
         return null;
     }
 
@@ -301,7 +301,7 @@ public void incrementVolumeResourceCount(long accountId, Boolean display, Long s
     }
 
     @Override
-    public void decrementVolumeResourceCount(long accountId, Boolean display, Long size, DiskOffering diskOffering) {
+    public void decrementVolumeResourceCount(long accountId, Boolean display, Long size, DiskOffering diskOffering, Boolean countDisplayFalseInResourceCount) {
 
     }
 
@@ -340,12 +340,14 @@ public void checkVmResourceLimit(Account owner, Boolean display, ServiceOffering
     }
 
     @Override
-    public void incrementVmResourceCount(long accountId, Boolean display, ServiceOffering serviceOffering, VirtualMachineTemplate template) {
+    public void incrementVmResourceCount(long accountId, Boolean display, ServiceOffering serviceOffering, VirtualMachineTemplate template,
+            Boolean countDisplayFalseInResourceLimit) {
 
     }
 
     @Override
-    public void decrementVmResourceCount(long accountId, Boolean display, ServiceOffering serviceOffering, VirtualMachineTemplate template) {
+    public void decrementVmResourceCount(long accountId, Boolean display, ServiceOffering serviceOffering, VirtualMachineTemplate template,
+            Boolean countDisplayFalseInResourceCount) {
 
     }
 
diff --git a/server/src/test/java/com/cloud/vpc/dao/MockNetworkDaoImpl.java b/server/src/test/java/com/cloud/vpc/dao/MockNetworkDaoImpl.java
index ea822e7eec8b..0cf4a9951ba4 100644
--- a/server/src/test/java/com/cloud/vpc/dao/MockNetworkDaoImpl.java
+++ b/server/src/test/java/com/cloud/vpc/dao/MockNetworkDaoImpl.java
@@ -292,4 +292,9 @@ public List<NetworkVO> listByNetworkDomainsAndAccountIds(Set<String> uniqueNtwkD
     public List<NetworkVO> listByNetworkDomainsAndDomainIds(Set<String> uniqueNtwkDomains, Set<Long> domainIds) {
         return List.of();
     }
+
+    @Override
+    public NetworkVO findByZoneIdAndAccountIdAndGuestTypeAndName(long zoneId, long accountId, GuestType guestType, String name) {
+        return null;
+    }
 }
diff --git a/server/src/test/java/com/cloud/vpc/dao/MockVpcOfferingServiceMapDaoImpl.java b/server/src/test/java/com/cloud/vpc/dao/MockVpcOfferingServiceMapDaoImpl.java
index 27aba5c013cf..89f9591bf27e 100644
--- a/server/src/test/java/com/cloud/vpc/dao/MockVpcOfferingServiceMapDaoImpl.java
+++ b/server/src/test/java/com/cloud/vpc/dao/MockVpcOfferingServiceMapDaoImpl.java
@@ -73,6 +73,11 @@ public List<VpcOfferingServiceMapVO> listProvidersForServiceForVpcOffering(long
         return List.of();
     }
 
+    @Override
+    public List<Long> listOfferingIdsByServiceAndProvider(Service service, String provider) {
+        return List.of();
+    }
+
     @Override
     public VpcOfferingServiceMapVO persist(VpcOfferingServiceMapVO vo) {
         return vo;
diff --git a/server/src/test/java/org/apache/cloudstack/backup/BackupCompressionServiceJobControllerTest.java b/server/src/test/java/org/apache/cloudstack/backup/BackupCompressionServiceJobControllerTest.java
new file mode 100644
index 000000000000..9227a79904e6
--- /dev/null
+++ b/server/src/test/java/org/apache/cloudstack/backup/BackupCompressionServiceJobControllerTest.java
@@ -0,0 +1,528 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.backup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertSame;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyBoolean;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+
+import java.util.ArrayList;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Set;
+
+import org.apache.cloudstack.backup.dao.BackupDao;
+import org.apache.cloudstack.backup.dao.InternalBackupServiceJobDao;
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.dc.ClusterVO;
+import com.cloud.dc.DataCenterVO;
+import com.cloud.dc.dao.ClusterDao;
+import com.cloud.dc.dao.DataCenterDao;
+import com.cloud.host.HostVO;
+import com.cloud.host.Status;
+import com.cloud.host.dao.HostDao;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.resource.ResourceState;
+import com.cloud.utils.Pair;
+import com.cloud.vm.VMInstanceVO;
+import com.cloud.vm.dao.VMInstanceDao;
+
+@RunWith(MockitoJUnitRunner.class)
+public class BackupCompressionServiceJobControllerTest {
+
+    @Mock
+    private DataCenterDao dataCenterDaoMock;
+
+    @Mock
+    private DataCenterVO dataCenterVoMock;
+
+    @Mock
+    private ClusterDao clusterDaoMock;
+
+    @Mock
+    private ClusterVO clusterVoMock;
+
+    @Mock
+    private HostDao hostDaoMock;
+
+    @Mock
+    private HostVO hostVO;
+
+    @Mock
+    private InternalBackupServiceJobDao internalBackupServiceJobDaoMock;
+
+    @Mock
+    private InternalBackupServiceJobVO internalBackupServiceJobVoMock;
+
+    @Mock
+    private BackupDao backupDaoMock;
+
+    @Mock
+    private BackupVO backupVoMock;
+
+    @Mock
+    private VMInstanceDao vmInstanceDaoMock;
+
+    @Mock
+    private VMInstanceVO vmInstanceVoMock;
+
+    @Mock
+    private ConfigKey<Integer> maxConcurrentJobsConfigKey;
+
+    @Mock
+    private ConfigKey<Boolean> backupCompressionTaskEnabledMock;
+
+    @Spy
+    @InjectMocks
+    private BackupCompressionServiceJobController backupCompressionServiceJobControllerSpy;
+
+    long datacenterId = 1L;
+    long clusterId = 2L;
+    long hostId = 3L;
+    long jobId = 32L;
+    long backupId = 46L;
+    long instanceId = 100L;
+
+    @Test
+    public void rescheduleLostJobsTestNoHostsInCluster() {
+        doReturn(List.of(dataCenterVoMock)).when(dataCenterDaoMock).listAllZones();
+        doReturn(datacenterId).when(dataCenterVoMock).getId();
+        doReturn(List.of(clusterVoMock)).when(clusterDaoMock).listByDcHyType(datacenterId, Hypervisor.HypervisorType.KVM.toString());
+        doReturn(clusterId).when(clusterVoMock).getId();
+        doReturn(List.of()).when(hostDaoMock).findRoutingByClusterId(clusterId);
+
+        backupCompressionServiceJobControllerSpy.rescheduleLostJobs();
+
+        verify(backupCompressionServiceJobControllerSpy, never()).getLostJobs(any(), any(), any());
+    }
+
+    @Test
+    public void rescheduleLostJobsTestNoLostJobs() {
+        doReturn(List.of(dataCenterVoMock)).when(dataCenterDaoMock).listAllZones();
+        doReturn(datacenterId).when(dataCenterVoMock).getId();
+        doReturn(List.of(clusterVoMock)).when(clusterDaoMock).listByDcHyType(datacenterId, Hypervisor.HypervisorType.KVM.toString());
+        doReturn(clusterId).when(clusterVoMock).getId();
+        doReturn(List.of(hostVO)).when(hostDaoMock).findRoutingByClusterId(clusterId);
+        doReturn(List.of()).when(backupCompressionServiceJobControllerSpy).getLostJobs(any(), any(), any());
+
+        backupCompressionServiceJobControllerSpy.rescheduleLostJobs();
+
+        verify(backupCompressionServiceJobControllerSpy, never()).processJobResult(any(), anyBoolean());
+    }
+
+    @Test
+    public void rescheduleLostJobsTestProcessJob() {
+        doReturn(List.of(dataCenterVoMock)).when(dataCenterDaoMock).listAllZones();
+        doReturn(datacenterId).when(dataCenterVoMock).getId();
+        doReturn(List.of(clusterVoMock)).when(clusterDaoMock).listByDcHyType(datacenterId, Hypervisor.HypervisorType.KVM.toString());
+        doReturn(clusterId).when(clusterVoMock).getId();
+        doReturn(List.of(hostVO)).when(hostDaoMock).findRoutingByClusterId(clusterId);
+        doReturn(List.of(internalBackupServiceJobVoMock)).when(backupCompressionServiceJobControllerSpy).getLostJobs(eq(clusterVoMock), any(), any());
+        doNothing().when(backupCompressionServiceJobControllerSpy).processJobResult(any(), anyBoolean());
+
+        backupCompressionServiceJobControllerSpy.rescheduleLostJobs();
+
+        verify(backupCompressionServiceJobControllerSpy).processJobResult(any(), anyBoolean());
+    }
+
+    @Test
+    public void processJobResultTestSuccessfulJob() {
+        backupCompressionServiceJobControllerSpy.processJobResult(internalBackupServiceJobVoMock, true);
+
+        verify(internalBackupServiceJobDaoMock).update(internalBackupServiceJobVoMock);
+        verify(backupDaoMock, never()).findByIdIncludingRemoved(any());
+    }
+
+    @Test
+    public void processJobResultTestFailedJobAndRemovedBackup() {
+        doReturn(backupId).when(internalBackupServiceJobVoMock).getBackupId();
+        doReturn(backupVoMock).when(backupDaoMock).findByIdIncludingRemoved(backupId);
+        doReturn(new Date()).when(backupVoMock).getRemoved();
+
+        backupCompressionServiceJobControllerSpy.processJobResult(internalBackupServiceJobVoMock, false);
+
+        verify(backupDaoMock).findByIdIncludingRemoved(any());
+        verify(internalBackupServiceJobVoMock).setRemoved(any());
+        verify(internalBackupServiceJobDaoMock).update(internalBackupServiceJobVoMock);
+    }
+
+    @Test
+    public void processJobResultTestFailedJobAndReachedMaxAttempts() {
+        doReturn(backupId).when(internalBackupServiceJobVoMock).getBackupId();
+        doReturn(backupVoMock).when(backupDaoMock).findByIdIncludingRemoved(backupId);
+        doReturn(1).when(backupCompressionServiceJobControllerSpy).getMaxAttempts(internalBackupServiceJobVoMock);
+        doReturn(1).when(internalBackupServiceJobVoMock).getAttempts();
+
+        backupCompressionServiceJobControllerSpy.processJobResult(internalBackupServiceJobVoMock, false);
+
+        verify(backupDaoMock).findByIdIncludingRemoved(any());
+        verify(backupCompressionServiceJobControllerSpy).getMaxAttempts(internalBackupServiceJobVoMock);
+        verify(internalBackupServiceJobVoMock).setRemoved(any());
+        verify(internalBackupServiceJobDaoMock).update(internalBackupServiceJobVoMock);
+    }
+
+    @Test
+    public void processJobResultTestFailedJob() {
+        doReturn(backupId).when(internalBackupServiceJobVoMock).getBackupId();
+        doReturn(backupVoMock).when(backupDaoMock).findByIdIncludingRemoved(backupId);
+        doReturn(2).when(backupCompressionServiceJobControllerSpy).getMaxAttempts(internalBackupServiceJobVoMock);
+        doReturn(1).when(internalBackupServiceJobVoMock).getAttempts();
+        doReturn(60).when(backupCompressionServiceJobControllerSpy).getRetryInterval(internalBackupServiceJobVoMock);
+
+        backupCompressionServiceJobControllerSpy.processJobResult(internalBackupServiceJobVoMock, false);
+
+        verify(backupDaoMock).findByIdIncludingRemoved(any());
+        verify(backupCompressionServiceJobControllerSpy).getMaxAttempts(internalBackupServiceJobVoMock);
+        verify(internalBackupServiceJobVoMock, never()).setRemoved(any());
+        verify(internalBackupServiceJobVoMock).setScheduledStartTime(any());
+        verify(internalBackupServiceJobVoMock).setStartTime(null);
+        verify(internalBackupServiceJobVoMock).setHostId(null);
+        verify(internalBackupServiceJobDaoMock).update(internalBackupServiceJobVoMock);
+    }
+
+    @Test
+    public void getHostToNumberOfExecutingJobsAndTotalExecutingJobsTestNoExecutingJobsAndNoEligibleHosts() {
+        doReturn(datacenterId).when(dataCenterVoMock).getId();
+        doReturn(List.of(hostVO)).when(hostDaoMock).listAllRoutingHostsByZoneAndHypervisorType(datacenterId, Hypervisor.HypervisorType.KVM);
+        doReturn(Status.Down).when(hostVO).getStatus();
+        doReturn(List.of()).when(internalBackupServiceJobDaoMock).listExecutingJobsByZoneIdAndJobType(datacenterId);
+
+        Pair<HashMap<HostVO, Long>, Integer> result =
+                backupCompressionServiceJobControllerSpy.getHostToNumberOfExecutingJobsAndTotalExecutingJobs(dataCenterVoMock);
+
+        assertTrue(result.first().isEmpty());
+        assertEquals(Integer.valueOf(0), result.second());
+        verify(hostDaoMock).listAllRoutingHostsByZoneAndHypervisorType(datacenterId, Hypervisor.HypervisorType.KVM);
+        verify(internalBackupServiceJobDaoMock).listExecutingJobsByZoneIdAndJobType(datacenterId);
+    }
+
+    @Test
+    public void getHostToNumberOfExecutingJobsAndTotalExecutingJobsTestOneEligibleHostAndOneExecutingJob() {
+        doReturn(datacenterId).when(dataCenterVoMock).getId();
+        doReturn(hostId).when(hostVO).getId();
+        doReturn(Status.Up).when(hostVO).getStatus();
+        doReturn(ResourceState.Enabled).when(hostVO).getResourceState();
+        doReturn(List.of(hostVO)).when(hostDaoMock).listAllRoutingHostsByZoneAndHypervisorType(datacenterId, Hypervisor.HypervisorType.KVM);
+        doReturn(List.of(internalBackupServiceJobVoMock)).when(internalBackupServiceJobDaoMock).listExecutingJobsByZoneIdAndJobType(datacenterId);
+        doReturn(hostId).when(internalBackupServiceJobVoMock).getHostId();
+
+        Pair<HashMap<HostVO, Long>, Integer> result =
+                backupCompressionServiceJobControllerSpy.getHostToNumberOfExecutingJobsAndTotalExecutingJobs(dataCenterVoMock);
+
+        assertEquals(Integer.valueOf(1), result.second());
+        assertEquals(1, result.first().size());
+        assertTrue(result.first().containsKey(hostVO));
+        assertEquals(Long.valueOf(1L), result.first().get(hostVO));
+    }
+
+    @Test
+    public void getHostToNumberOfExecutingJobsAndTotalExecutingJobsTestEligibleHostButExecutingJobOnDisabledHostIsIgnored() {
+        doReturn(datacenterId).when(dataCenterVoMock).getId();
+        doReturn(hostId).when(hostVO).getId();
+        doReturn(Status.Down).when(hostVO).getStatus();
+        doReturn(List.of(hostVO)).when(hostDaoMock).listAllRoutingHostsByZoneAndHypervisorType(datacenterId, Hypervisor.HypervisorType.KVM);
+        doReturn(List.of(internalBackupServiceJobVoMock)).when(internalBackupServiceJobDaoMock).listExecutingJobsByZoneIdAndJobType(datacenterId);
+        doReturn(hostId).when(internalBackupServiceJobVoMock).getHostId();
+
+        Pair<HashMap<HostVO, Long>, Integer> result =
+                backupCompressionServiceJobControllerSpy.getHostToNumberOfExecutingJobsAndTotalExecutingJobs(dataCenterVoMock);
+
+        assertEquals(Integer.valueOf(1), result.second());
+        assertTrue(result.first().isEmpty());
+        assertFalse(result.first().containsKey(hostVO));
+    }
+
+    @Test
+    public void getHostToNumberOfExecutingJobsAndTotalExecutingJobsTestJobExecutingInUnknownHost() {
+        doReturn(datacenterId).when(dataCenterVoMock).getId();
+        doReturn(List.of()).when(hostDaoMock).listAllRoutingHostsByZoneAndHypervisorType(datacenterId, Hypervisor.HypervisorType.KVM);
+        doReturn(List.of(internalBackupServiceJobVoMock)).when(internalBackupServiceJobDaoMock).listExecutingJobsByZoneIdAndJobType(datacenterId);
+
+        Pair<HashMap<HostVO, Long>, Integer> result =
+                backupCompressionServiceJobControllerSpy.getHostToNumberOfExecutingJobsAndTotalExecutingJobs(dataCenterVoMock);
+
+        assertTrue(result.first().isEmpty());
+        assertEquals(Integer.valueOf(1), result.second());
+        verify(hostDaoMock).listAllRoutingHostsByZoneAndHypervisorType(datacenterId, Hypervisor.HypervisorType.KVM);
+        verify(internalBackupServiceJobDaoMock).listExecutingJobsByZoneIdAndJobType(datacenterId);
+    }
+
+    @Test
+    public void thinJobsToStartListTestUnlimitedConcurrentJobs() {
+        doReturn(datacenterId).when(dataCenterVoMock).getId();
+        doReturn(0).when(maxConcurrentJobsConfigKey).valueIn(datacenterId);
+        ArrayList<InternalBackupServiceJobVO> originalJobs = new ArrayList<>();
+        for (int i = 0; i < 10; i++) {
+            originalJobs.add(Mockito.mock(InternalBackupServiceJobVO.class));
+        }
+
+        List<InternalBackupServiceJobVO> result = backupCompressionServiceJobControllerSpy.thinJobsToStartList(dataCenterVoMock, new ArrayList<>(originalJobs), 0,
+                maxConcurrentJobsConfigKey);
+
+        assertEquals(originalJobs, result);
+    }
+
+    @Test
+    public void thinJobsToStartListTestTotalExecutingJobsBiggerThanMax() {
+        doReturn(datacenterId).when(dataCenterVoMock).getId();
+        doReturn(3).when(maxConcurrentJobsConfigKey).valueIn(datacenterId);
+        ArrayList<InternalBackupServiceJobVO> originalJobs = new ArrayList<>();
+        for (int i = 0; i < 7; i++) {
+            originalJobs.add(Mockito.mock(InternalBackupServiceJobVO.class));
+        }
+
+        List<InternalBackupServiceJobVO> result = backupCompressionServiceJobControllerSpy.thinJobsToStartList(dataCenterVoMock, new ArrayList<>(originalJobs), 3,
+                maxConcurrentJobsConfigKey);
+
+        assertEquals(List.of(), result);
+    }
+
+
+    @Test
+    public void thinJobsToStartListTestTotalExecutingJobsLowerThanMax() {
+        doReturn(datacenterId).when(dataCenterVoMock).getId();
+        doReturn(6).when(maxConcurrentJobsConfigKey).valueIn(datacenterId);
+        ArrayList<InternalBackupServiceJobVO> originalJobs = new ArrayList<>();
+        for (int i = 0; i < 7; i++) {
+            originalJobs.add(Mockito.mock(InternalBackupServiceJobVO.class));
+        }
+
+        List<InternalBackupServiceJobVO> result = backupCompressionServiceJobControllerSpy.thinJobsToStartList(dataCenterVoMock, new ArrayList<>(originalJobs), 3,
+                maxConcurrentJobsConfigKey);
+
+        assertEquals(originalJobs.subList(0, 3), result);
+    }
+
+    @Test
+    public void thinJobsToStartListTestNoCurrentExecutingJobsAndNewJobsLowerThanMax() {
+        doReturn(datacenterId).when(dataCenterVoMock).getId();
+        doReturn(6).when(maxConcurrentJobsConfigKey).valueIn(datacenterId);
+        ArrayList<InternalBackupServiceJobVO> originalJobs = new ArrayList<>();
+        for (int i = 0; i < 4; i++) {
+            originalJobs.add(Mockito.mock(InternalBackupServiceJobVO.class));
+        }
+
+        List<InternalBackupServiceJobVO> result = backupCompressionServiceJobControllerSpy.thinJobsToStartList(dataCenterVoMock, new ArrayList<>(originalJobs), 0,
+                maxConcurrentJobsConfigKey);
+
+        assertEquals(originalJobs, result);
+    }
+
+    @Test
+    public void filterHostsWithTooManyJobsTestUnlimitedCompressionPerHost() {
+        doReturn(0).when(backupCompressionServiceJobControllerSpy).getMaxConcurrentJobsPerHost(maxConcurrentJobsConfigKey, hostVO);
+
+        HashMap<HostVO, Long> hostToNumberOfExecutingJobs = new HashMap<>();
+        hostToNumberOfExecutingJobs.put(hostVO, 10L);
+
+        List<Pair<HostVO, Long>> result = backupCompressionServiceJobControllerSpy.filterHostsWithTooManyJobs(hostToNumberOfExecutingJobs, maxConcurrentJobsConfigKey);
+
+        assertEquals(List.of(new Pair<>(hostVO, 10L)), result);
+    }
+
+    @Test
+    public void filterHostsWithTooManyJobsTestLimitedCompressionPerHost() {
+        doReturn(4).when(backupCompressionServiceJobControllerSpy).getMaxConcurrentJobsPerHost(any(), any());
+
+
+        HashMap<HostVO, Long> hostToNumberOfExecutingJobs = new HashMap<>();
+        hostToNumberOfExecutingJobs.put(hostVO, 10L);
+        HostVO hostVO2 = Mockito.mock(HostVO.class);
+        hostToNumberOfExecutingJobs.put(hostVO2, 2L);
+
+        List<Pair<HostVO, Long>> result = backupCompressionServiceJobControllerSpy.filterHostsWithTooManyJobs(hostToNumberOfExecutingJobs, maxConcurrentJobsConfigKey);
+
+        assertEquals(List.of(new Pair<>(hostVO2, 2L)), result);
+    }
+
+    @Test
+    public void submitQueuedJobsForExecutionTestNoAvailableHostsReturnsEarly() {
+        List<InternalBackupServiceJobVO> jobsToExecute = List.of(internalBackupServiceJobVoMock);
+
+        backupCompressionServiceJobControllerSpy.submitQueuedJobsForExecution(jobsToExecute, List.of(), new HashSet<>(), maxConcurrentJobsConfigKey, datacenterId);
+
+        verify(internalBackupServiceJobVoMock, never()).setHostId(any());
+        verify(internalBackupServiceJobVoMock, never()).setStartTime(any());
+        verify(internalBackupServiceJobDaoMock, never()).update(any());
+    }
+
+    @Test
+    public void submitQueuedJobsForExecutionTestBusyInstanceIsSkipped() {
+        doReturn(instanceId).when(internalBackupServiceJobVoMock).getInstanceId();
+        doReturn(vmInstanceVoMock).when(vmInstanceDaoMock).findByIdIncludingRemoved(instanceId);
+
+        List<Pair<HostVO, Long>> hostAndNumberOfJobsPairList = List.of(new Pair<>(hostVO, 0L));
+        Set<Long> busyInstances = Set.of(instanceId);
+
+        backupCompressionServiceJobControllerSpy.submitQueuedJobsForExecution(List.of(internalBackupServiceJobVoMock), hostAndNumberOfJobsPairList, busyInstances,
+                maxConcurrentJobsConfigKey, datacenterId);
+
+        verify(internalBackupServiceJobVoMock, never()).setHostId(any());
+        verify(internalBackupServiceJobVoMock, never()).setStartTime(any());
+        verify(internalBackupServiceJobDaoMock, never()).update(any());
+        verify(backupCompressionServiceJobControllerSpy, never()).submitQueuedJob(any(), anyLong(), any());
+    }
+
+    @Test
+    public void submitQueuedJobsForExecutionTestSchedulesJobAndRequeuesHostWhenBelowLimit() {
+        doReturn(instanceId).when(internalBackupServiceJobVoMock).getInstanceId();
+        doReturn(jobId).when(internalBackupServiceJobVoMock).getId();
+        doReturn(backupId).when(internalBackupServiceJobVoMock).getBackupId();
+        doReturn(hostId).when(hostVO).getId();
+        doReturn(5).when(backupCompressionServiceJobControllerSpy).getMaxConcurrentJobsPerHost(maxConcurrentJobsConfigKey, hostVO);
+        doNothing().when(backupCompressionServiceJobControllerSpy).submitQueuedJob(any(), eq(datacenterId), any());
+
+        List<Pair<HostVO, Long>> hostAndNumberOfJobsPairList = new java.util.ArrayList<>();
+        hostAndNumberOfJobsPairList.add(new Pair<>(hostVO, 0L));
+        Set<Long> busyInstances = new HashSet<>();
+
+        backupCompressionServiceJobControllerSpy.submitQueuedJobsForExecution(List.of(internalBackupServiceJobVoMock), hostAndNumberOfJobsPairList, busyInstances,
+                maxConcurrentJobsConfigKey, datacenterId);
+
+        verify(internalBackupServiceJobVoMock).setHostId(hostId);
+        verify(internalBackupServiceJobVoMock).setStartTime(any());
+        verify(internalBackupServiceJobDaoMock).update(internalBackupServiceJobVoMock);
+        verify(backupCompressionServiceJobControllerSpy).submitQueuedJob(eq(internalBackupServiceJobVoMock), eq(datacenterId), any());
+        assertEquals(1, hostAndNumberOfJobsPairList.size());
+        assertSame(hostVO, hostAndNumberOfJobsPairList.get(0).first());
+        assertEquals(Long.valueOf(1L), hostAndNumberOfJobsPairList.get(0).second());
+        assertTrue(busyInstances.contains(instanceId));
+    }
+
+    @Test
+    public void submitQueuedJobsForExecutionTestDoesNotRequeueHostWhenLimitReached() {
+        doReturn(instanceId).when(internalBackupServiceJobVoMock).getInstanceId();
+        doReturn(jobId).when(internalBackupServiceJobVoMock).getId();
+        doReturn(backupId).when(internalBackupServiceJobVoMock).getBackupId();
+        doReturn(hostId).when(hostVO).getId();
+        doReturn(1).when(backupCompressionServiceJobControllerSpy).getMaxConcurrentJobsPerHost(maxConcurrentJobsConfigKey, hostVO);
+        doNothing().when(backupCompressionServiceJobControllerSpy).submitQueuedJob(any(), eq(datacenterId), any());
+
+        List<Pair<HostVO, Long>> hostAndNumberOfJobsPairList = new java.util.ArrayList<>();
+        hostAndNumberOfJobsPairList.add(new Pair<>(hostVO, 0L));
+        Set<Long> busyInstances = new HashSet<>();
+
+        backupCompressionServiceJobControllerSpy.submitQueuedJobsForExecution(List.of(internalBackupServiceJobVoMock), hostAndNumberOfJobsPairList, busyInstances,
+                maxConcurrentJobsConfigKey, datacenterId);
+
+        assertTrue(hostAndNumberOfJobsPairList.isEmpty());
+        assertTrue(busyInstances.contains(instanceId));
+    }
+
+    @Test
+    public void searchAndDispatchJobsTestLockFailureReturnsEarly() {
+        doReturn(List.of(dataCenterVoMock)).when(dataCenterDaoMock).listEnabledZones();
+        doReturn(false).when(internalBackupServiceJobDaoMock).lockInLockTable("compression_lock", 300);
+
+        backupCompressionServiceJobControllerSpy.searchAndDispatchJobs();
+
+        verify(internalBackupServiceJobDaoMock).unlockFromLockTable(any());
+        verify(backupCompressionServiceJobControllerSpy, never()).rescheduleLostJobs();
+        verify(internalBackupServiceJobDaoMock, never()).listWaitingJobsAndScheduledToBeforeNow(anyLong(), any());
+    }
+
+    @Test
+    public void searchAndDispatchJobsTestTaskDisabledReturnsAfterReschedule() {
+        doReturn(List.of(dataCenterVoMock)).when(dataCenterDaoMock).listEnabledZones();
+        doReturn(true).when(internalBackupServiceJobDaoMock).lockInLockTable("compression_lock", 300);
+        doNothing().when(backupCompressionServiceJobControllerSpy).rescheduleLostJobs();
+        doReturn(false).when(backupCompressionTaskEnabledMock).value();
+
+        backupCompressionServiceJobControllerSpy.searchAndDispatchJobs();
+
+        verify(backupCompressionServiceJobControllerSpy).rescheduleLostJobs();
+        verify(internalBackupServiceJobDaoMock, never()).listWaitingJobsAndScheduledToBeforeNow(anyLong(), any());
+        verify(internalBackupServiceJobDaoMock).unlockFromLockTable("compression_lock");
+    }
+
+    @Test
+    public void searchAndDispatchJobsTestZoneWithoutBackupFrameworkIsSkipped() {
+        doReturn(List.of(dataCenterVoMock)).when(dataCenterDaoMock).listEnabledZones();
+        doReturn(true).when(internalBackupServiceJobDaoMock).lockInLockTable("compression_lock", 300);
+        doNothing().when(backupCompressionServiceJobControllerSpy).rescheduleLostJobs();
+        doReturn(true).when(backupCompressionTaskEnabledMock).value();
+        doReturn(false).when(backupCompressionServiceJobControllerSpy).isFrameworkEnabledForZone(dataCenterVoMock);
+
+        backupCompressionServiceJobControllerSpy.searchAndDispatchJobs();
+
+        verify(internalBackupServiceJobDaoMock, never()).listWaitingJobsAndScheduledToBeforeNow(anyLong(), any());
+        verify(internalBackupServiceJobDaoMock).unlockFromLockTable("compression_lock");
+    }
+
+    @Test
+    public void searchAndDispatchJobsTestEmptyWaitingJobsSkipsDispatch() {
+        doReturn(List.of(dataCenterVoMock)).when(dataCenterDaoMock).listEnabledZones();
+        doReturn(true).when(internalBackupServiceJobDaoMock).lockInLockTable("compression_lock", 300);
+        doNothing().when(backupCompressionServiceJobControllerSpy).rescheduleLostJobs();
+        doReturn(true).when(backupCompressionTaskEnabledMock).value();
+        doReturn(datacenterId).when(dataCenterVoMock).getId();
+        doReturn(true).when(backupCompressionServiceJobControllerSpy).isFrameworkEnabledForZone(dataCenterVoMock);
+
+        backupCompressionServiceJobControllerSpy.searchAndDispatchJobs();
+
+        verify(backupCompressionServiceJobControllerSpy, never()).getHostToNumberOfExecutingJobsAndTotalExecutingJobs(any(), any());
+        verify(backupCompressionServiceJobControllerSpy, never()).submitQueuedJobsForExecution(any(), any(), any(), any(), anyLong());
+        verify(internalBackupServiceJobDaoMock).unlockFromLockTable("compression_lock");
+    }
+
+    @Test
+    public void searchAndDispatchJobsTestHappyPathDispatchesJobs() {
+        Pair<HashMap<HostVO, Long>, Integer> executingJobsPair = new Pair<>(new HashMap<>(), 0);
+
+        doReturn(List.of(dataCenterVoMock)).when(dataCenterDaoMock).listEnabledZones();
+        doReturn(true).when(internalBackupServiceJobDaoMock).lockInLockTable("compression_lock", 300);
+        doNothing().when(backupCompressionServiceJobControllerSpy).rescheduleLostJobs();
+        doReturn(true).when(backupCompressionTaskEnabledMock).value();
+        doReturn(datacenterId).when(dataCenterVoMock).getId();
+        doReturn(true).when(backupCompressionServiceJobControllerSpy).isFrameworkEnabledForZone(dataCenterVoMock);
+        doReturn(List.of(internalBackupServiceJobVoMock)).when(internalBackupServiceJobDaoMock).listWaitingJobsAndScheduledToBeforeNow(eq(datacenterId),
+                eq(InternalBackupServiceJobType.StartCompression), eq(InternalBackupServiceJobType.FinalizeCompression));
+        doReturn(List.of(internalBackupServiceJobVoMock)).when(backupCompressionServiceJobControllerSpy).filterJobsOfDomainsAndAccountsWithDisabledCompressionTask(any());
+        doReturn(executingJobsPair).when(backupCompressionServiceJobControllerSpy).getHostToNumberOfExecutingJobsAndTotalExecutingJobs(eq(dataCenterVoMock), any());
+        doReturn(List.of(new Pair<>(hostVO, 0L))).when(backupCompressionServiceJobControllerSpy).filterHostsWithTooManyJobs(any(), any());
+        doReturn(new HashSet<Long>()).when(backupCompressionServiceJobControllerSpy).submitFinalizeJobsForExecution(any(), any(), eq(datacenterId));
+        doReturn(List.of(internalBackupServiceJobVoMock)).when(backupCompressionServiceJobControllerSpy).thinJobsToStartList(eq(dataCenterVoMock), any(), anyInt(), any());
+        doNothing().when(backupCompressionServiceJobControllerSpy).submitQueuedJobsForExecution(any(), any(), any(), any(), eq(datacenterId));
+
+        backupCompressionServiceJobControllerSpy.searchAndDispatchJobs();
+
+
+        verify(backupCompressionServiceJobControllerSpy).submitQueuedJobsForExecution(any(), any(), any(), any(), eq(datacenterId));
+        verify(internalBackupServiceJobDaoMock).unlockFromLockTable("compression_lock");
+        verify(internalBackupServiceJobDaoMock).listExecutingJobsByZoneIdAndJobType(eq(datacenterId), eq(InternalBackupServiceJobType.StartCompression));
+    }
+}
diff --git a/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java b/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java
index d1817047499e..04bd03670079 100644
--- a/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java
+++ b/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java
@@ -48,6 +48,7 @@
 import org.apache.cloudstack.api.command.admin.backup.ImportBackupOfferingCmd;
 import org.apache.cloudstack.api.command.admin.backup.UpdateBackupOfferingCmd;
 import org.apache.cloudstack.api.command.user.backup.CreateBackupCmd;
+import org.apache.cloudstack.api.command.user.backup.CreateBackupOfferingCmd;
 import org.apache.cloudstack.api.command.user.backup.CreateBackupScheduleCmd;
 import org.apache.cloudstack.api.command.user.backup.DeleteBackupScheduleCmd;
 import org.apache.cloudstack.api.command.user.backup.ListBackupOfferingsCmd;
@@ -67,12 +68,14 @@
 import org.apache.cloudstack.reservation.dao.ReservationDao;
 import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.apache.commons.collections4.CollectionUtils;
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.mockito.ArgumentCaptor;
+import org.mockito.ArgumentMatchers;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.MockedStatic;
@@ -121,6 +124,7 @@
 import com.cloud.storage.dao.VolumeDao;
 import com.cloud.user.Account;
 import com.cloud.user.AccountManager;
+import com.cloud.user.AccountService;
 import com.cloud.user.AccountVO;
 import com.cloud.user.DomainManager;
 import com.cloud.user.ResourceLimitService;
@@ -267,6 +271,12 @@ public class BackupManagerTest {
     @Mock
     AsyncJobManager asyncJobManager;
 
+    @Mock
+    private AccountService accountServiceMock;
+
+    @Mock
+    private DomainVO domainVOMock;
+
     private Gson gson;
 
     private String[] hostPossibleValues = {"127.0.0.1", "hostname"};
@@ -433,15 +443,16 @@ public void restoreBackedUpVolumeTestHostIpAndDatastoreUuid() {
 
         doReturn(new Pair<Boolean, String>(Boolean.TRUE, "Success"))
             .when(backupProvider).restoreBackedUpVolume(any(Backup.class), any(Backup.VolumeInfo.class),
-                any(String.class), any(String.class), any(Pair.class));
+                any(String.class), any(String.class), any(Pair.class), any(), any(Boolean.class));
 
-        Pair<Boolean, String> restoreBackedUpVolume = backupManager.restoreBackedUpVolume(volumeInfo, backupVO, backupProvider, hostPossibleValues, datastoresPossibleValues, vm);
+        Pair<Boolean, String> restoreBackedUpVolume = backupManager.restoreBackedUpVolume(volumeInfo, backupVO, backupProvider, hostPossibleValues, datastoresPossibleValues, vm,
+                false);
 
         assertEquals(Boolean.TRUE, restoreBackedUpVolume.first());
         assertEquals("Success", restoreBackedUpVolume.second());
 
         verify(backupProvider, atLeastOnce()).restoreBackedUpVolume(any(Backup.class), any(Backup.VolumeInfo.class),
-            any(String.class), any(String.class), any(Pair.class));
+            any(String.class), any(String.class), any(Pair.class), any(), Mockito.anyBoolean());
     }
 
     @Test
@@ -460,15 +471,16 @@ public void restoreBackedUpVolumeTestHostIpAndDatastoreName() {
 
         doReturn(new Pair<Boolean, String>(Boolean.TRUE, "Success2"))
             .when(backupProvider).restoreBackedUpVolume(any(Backup.class), any(Backup.VolumeInfo.class),
-                any(String.class), any(String.class), any(Pair.class));
+                any(String.class), any(String.class), any(Pair.class), any(), any(Boolean.class));
 
-        Pair<Boolean, String> restoreBackedUpVolume = backupManager.restoreBackedUpVolume(volumeInfo, backupVO, backupProvider, hostPossibleValues, datastoresPossibleValues, vm);
+        Pair<Boolean, String> restoreBackedUpVolume = backupManager.restoreBackedUpVolume(volumeInfo, backupVO, backupProvider, hostPossibleValues, datastoresPossibleValues, vm,
+                false);
 
         assertEquals(Boolean.TRUE, restoreBackedUpVolume.first());
         assertEquals("Success2", restoreBackedUpVolume.second());
 
         verify(backupProvider, atLeastOnce()).restoreBackedUpVolume(any(Backup.class), any(Backup.VolumeInfo.class),
-            any(String.class), any(String.class), any(Pair.class));
+            any(String.class), any(String.class), any(Pair.class), any(), Mockito.anyBoolean());
     }
 
     @Test
@@ -487,15 +499,16 @@ public void restoreBackedUpVolumeTestHostNameAndDatastoreUuid() {
 
         doReturn(new Pair<Boolean, String>(Boolean.TRUE, "Success3"))
             .when(backupProvider).restoreBackedUpVolume(any(Backup.class), any(Backup.VolumeInfo.class),
-                any(String.class), any(String.class), any(Pair.class));
+                any(String.class), any(String.class), any(Pair.class), any(), any(Boolean.class));
 
-        Pair<Boolean, String> restoreBackedUpVolume = backupManager.restoreBackedUpVolume(volumeInfo, backupVO, backupProvider, hostPossibleValues, datastoresPossibleValues, vm);
+        Pair<Boolean, String> restoreBackedUpVolume = backupManager.restoreBackedUpVolume(volumeInfo, backupVO, backupProvider, hostPossibleValues, datastoresPossibleValues, vm,
+                false);
 
         assertEquals(Boolean.TRUE, restoreBackedUpVolume.first());
         assertEquals("Success3", restoreBackedUpVolume.second());
 
         verify(backupProvider, atLeastOnce()).restoreBackedUpVolume(any(Backup.class), any(Backup.VolumeInfo.class),
-            any(String.class), any(String.class), any(Pair.class));
+            any(String.class), any(String.class), any(Pair.class), any(), Mockito.anyBoolean());
     }
 
     @Test
@@ -514,15 +527,16 @@ public void restoreBackedUpVolumeTestHostAndDatastoreName() {
 
         doReturn(new Pair<Boolean, String>(Boolean.TRUE, "Success4"))
             .when(backupProvider).restoreBackedUpVolume(any(Backup.class), any(Backup.VolumeInfo.class),
-                any(String.class), any(String.class), any(Pair.class));
+                any(String.class), any(String.class), any(Pair.class), any(), any(Boolean.class));
 
-        Pair<Boolean, String> restoreBackedUpVolume = backupManager.restoreBackedUpVolume(volumeInfo, backupVO, backupProvider, hostPossibleValues, datastoresPossibleValues, vm);
+        Pair<Boolean, String> restoreBackedUpVolume = backupManager.restoreBackedUpVolume(volumeInfo, backupVO, backupProvider, hostPossibleValues, datastoresPossibleValues, vm,
+                false);
 
         assertEquals(Boolean.TRUE, restoreBackedUpVolume.first());
         assertEquals("Success4", restoreBackedUpVolume.second());
 
         verify(backupProvider, atLeastOnce()).restoreBackedUpVolume(any(Backup.class), any(Backup.VolumeInfo.class),
-            any(String.class), any(String.class), any(Pair.class));
+            any(String.class), any(String.class), any(Pair.class), any(), any(Boolean.class));
     }
 
     @Test
@@ -547,9 +561,9 @@ public void tryRestoreVMTestRestoreSucceeded() throws NoTransitionException {
             Mockito.when(vm.getId()).thenReturn(1L);
             Mockito.when(offering.getProvider()).thenReturn("veeam");
             Mockito.doReturn(backupProvider).when(backupManager).getBackupProvider("veeam");
-            Mockito.when(backupProvider.restoreVMFromBackup(vm, backup)).thenReturn(true);
+            Mockito.when(backupProvider.restoreVMFromBackup(vm, backup, false, null)).thenReturn(true);
 
-            backupManager.tryRestoreVM(backup, vm, offering, "Nothing to write here.");
+            backupManager.tryRestoreVM(backup, vm, offering, "Nothing to write here.", false, null);
         }
     }
 
@@ -577,9 +591,9 @@ public void tryRestoreVMTestRestoreFails() throws NoTransitionException {
             Mockito.when(vm.getId()).thenReturn(1L);
             Mockito.when(offering.getProvider()).thenReturn("veeam");
             Mockito.doReturn(backupProvider).when(backupManager).getBackupProvider("veeam");
-            Mockito.when(backupProvider.restoreVMFromBackup(vm, backup)).thenReturn(false);
+            Mockito.when(backupProvider.restoreVMFromBackup(vm, backup, false, null)).thenReturn(false);
             try {
-                backupManager.tryRestoreVM(backup, vm, offering, "Checking message error.");
+                backupManager.tryRestoreVM(backup, vm, offering, "Checking message error.", false, null);
                 fail("An exception is needed.");
             } catch (CloudRuntimeException e) {
                 assertEquals("Error restoring Instance from Backup [Checking message error.].", e.getMessage());
@@ -711,7 +725,7 @@ public void createBackupTestCreateScheduledBackup() throws ResourceAllocationExc
         when(backup.getId()).thenReturn(backupId);
         when(backup.getSize()).thenReturn(newBackupSize);
         when(backupProvider.getName()).thenReturn("testbackupprovider");
-        when(backupProvider.takeBackup(vmInstanceVOMock, null)).thenReturn(new Pair<>(true, backup));
+        when(backupProvider.takeBackup(vmInstanceVOMock, null, false)).thenReturn(new Pair<>(true, backup));
         Map<String, BackupProvider> backupProvidersMap = new HashMap<>();
         backupProvidersMap.put(backupProvider.getName().toLowerCase(), backupProvider);
         ReflectionTestUtils.setField(backupManager, "backupProvidersMap", backupProvidersMap);
@@ -1362,13 +1376,13 @@ public void testRestoreBackupToVM() throws NoTransitionException {
         when(rootVolume.getPoolId()).thenReturn(poolId);
         when(volumeDao.findIncludingRemovedByInstanceAndType(vmId, Volume.Type.ROOT)).thenReturn(List.of(rootVolume));
         when(primaryDataStoreDao.findById(poolId)).thenReturn(pool);
-        when(backupProvider.restoreBackupToVM(vm, backup, null, null)).thenReturn(new Pair<>(true, null));
+        when(backupProvider.restoreBackupToVM(vm, backup, null, null, false)).thenReturn(new Pair<>(true, null));
 
         try (MockedStatic<ActionEventUtils> utils = Mockito.mockStatic(ActionEventUtils.class)) {
-            boolean result = backupManager.restoreBackupToVM(backupId, vmId);
+            boolean result = backupManager.restoreBackupToVM(backupId, vmId, false);
 
             assertTrue(result);
-            verify(backupProvider, times(1)).restoreBackupToVM(vm, backup, null, null);
+            verify(backupProvider, times(1)).restoreBackupToVM(vm, backup, null, null, false);
             verify(virtualMachineManager, times(1)).stateTransitTo(vm, VirtualMachine.Event.RestoringRequested, hostId);
             verify(virtualMachineManager, times(1)).stateTransitTo(vm, VirtualMachine.Event.RestoringSuccess, hostId);
         } catch (CloudRuntimeException e) {
@@ -1418,13 +1432,13 @@ public void testRestoreBackupToVMException() throws NoTransitionException {
         when(rootVolume.getPoolId()).thenReturn(poolId);
         when(volumeDao.findIncludingRemovedByInstanceAndType(vmId, Volume.Type.ROOT)).thenReturn(List.of(rootVolume));
         when(primaryDataStoreDao.findById(poolId)).thenReturn(pool);
-        when(backupProvider.restoreBackupToVM(vm, backup, null, null)).thenReturn(new Pair<>(false, null));
+        when(backupProvider.restoreBackupToVM(vm, backup, null, null, false)).thenReturn(new Pair<>(false, null));
 
         try (MockedStatic<ActionEventUtils> utils = Mockito.mockStatic(ActionEventUtils.class)) {
             CloudRuntimeException exception = Assert.assertThrows(CloudRuntimeException.class,
-                    () -> backupManager.restoreBackupToVM(backupId, vmId));
+                    () -> backupManager.restoreBackupToVM(backupId, vmId, false));
 
-            verify(backupProvider, times(1)).restoreBackupToVM(vm, backup, null, null);
+            verify(backupProvider, times(1)).restoreBackupToVM(vm, backup, null, null, false);
             verify(virtualMachineManager, times(1)).stateTransitTo(vm, VirtualMachine.Event.RestoringRequested, hostId);
             verify(virtualMachineManager, times(1)).stateTransitTo(vm, VirtualMachine.Event.RestoringFailed, hostId);
         }
@@ -2105,7 +2119,6 @@ public void testRestoreBackupSuccess() throws NoTransitionException {
         when(vm.getHypervisorType()).thenReturn(hypervisorType);
         when(vm.getState()).thenReturn(VirtualMachine.State.Stopped);
         when(vm.getRemoved()).thenReturn(null);
-        when(vm.getBackupOfferingId()).thenReturn(offeringId);
 
         BackupOfferingVO offering = mock(BackupOfferingVO.class);
         when(offering.getProvider()).thenReturn("testbackupprovider");
@@ -2114,13 +2127,13 @@ public void testRestoreBackupSuccess() throws NoTransitionException {
         when(volumeDao.findByInstance(vmId)).thenReturn(Collections.singletonList(volume));
 
         BackupProvider backupProvider = mock(BackupProvider.class);
-        when(backupProvider.restoreVMFromBackup(vm, backup)).thenReturn(true);
+        when(backupProvider.restoreVMFromBackup(vm, backup, false, null)).thenReturn(true);
 
         when(backupDao.findById(backupId)).thenReturn(backup);
         when(vmInstanceDao.findByIdIncludingRemoved(vmId)).thenReturn(vm);
         when(backupOfferingDao.findByIdIncludingRemoved(offeringId)).thenReturn(offering);
         when(backupManager.getBackupProvider("testbackupprovider")).thenReturn(backupProvider);
-        doReturn(true).when(backupManager).importRestoredVM(zoneId, domainId, accountId, userId, vmInstanceName, hypervisorType, backup);
+        doReturn(true).when(backupManager).importRestoredVM(zoneId, domainId, accountId, userId, vmInstanceName, hypervisorType, backup, offering);
         doNothing().when(backupManager).validateBackupForZone(any());
         when(virtualMachineManager.stateTransitTo(any(), any(), any())).thenReturn(true);
 
@@ -2129,14 +2142,14 @@ public void testRestoreBackupSuccess() throws NoTransitionException {
                     Mockito.anyString(), Mockito.anyString(), Mockito.anyLong(), Mockito.anyString(),
                     Mockito.eq(true), Mockito.eq(0))).thenReturn(1L);
 
-            boolean result = backupManager.restoreBackup(backupId);
+            boolean result = backupManager.restoreBackup(backupId, false, null);
 
             assertTrue(result);
             verify(backupDao, times(1)).findById(backupId);
             verify(vmInstanceDao, times(1)).findByIdIncludingRemoved(vmId);
-            verify(backupOfferingDao, times(2)).findByIdIncludingRemoved(offeringId);
-            verify(backupProvider, times(1)).restoreVMFromBackup(vm, backup);
-            verify(backupManager, times(1)).importRestoredVM(zoneId, domainId, accountId, userId, vmInstanceName, hypervisorType, backup);
+            verify(backupOfferingDao, times(1)).findByIdIncludingRemoved(offeringId);
+            verify(backupProvider, times(1)).restoreVMFromBackup(vm, backup, false, null);
+            verify(backupManager, times(1)).importRestoredVM(zoneId, domainId, accountId, userId, vmInstanceName, hypervisorType, backup, offering);
         }
     }
 
@@ -2147,7 +2160,7 @@ public void testRestoreBackupBackupNotFound() {
         when(backupDao.findById(backupId)).thenReturn(null);
 
         CloudRuntimeException exception = Assert.assertThrows(CloudRuntimeException.class,
-                () -> backupManager.restoreBackup(backupId));
+                () -> backupManager.restoreBackup(backupId, false, null));
 
         assertEquals("Backup " + backupId + " does not exist", exception.getMessage());
         verify(backupDao, times(1)).findById(backupId);
@@ -2164,7 +2177,7 @@ public void testRestoreBackupBackupNotBackedUp() {
         when(backupDao.findById(backupId)).thenReturn(backup);
 
         CloudRuntimeException exception = Assert.assertThrows(CloudRuntimeException.class,
-                () -> backupManager.restoreBackup(backupId));
+                () -> backupManager.restoreBackup(backupId, false, null));
 
         assertEquals("Backup should be in BackedUp state", exception.getMessage());
         verify(backupDao, times(1)).findById(backupId);
@@ -2190,7 +2203,7 @@ public void testRestoreBackupVmExpunging() {
         doNothing().when(backupManager).validateBackupForZone(any());
 
         CloudRuntimeException exception = Assert.assertThrows(CloudRuntimeException.class,
-                () -> backupManager.restoreBackup(backupId));
+                () -> backupManager.restoreBackup(backupId, false, null));
 
         assertEquals("The Instance from which the backup was taken could not be found.", exception.getMessage());
         verify(backupDao, times(1)).findById(backupId);
@@ -2217,7 +2230,7 @@ public void testRestoreBackupVmNotStopped() {
         doNothing().when(backupManager).validateBackupForZone(any());
 
         CloudRuntimeException exception = Assert.assertThrows(CloudRuntimeException.class,
-                () -> backupManager.restoreBackup(backupId));
+                () -> backupManager.restoreBackup(backupId, false, null));
 
         assertEquals("Existing Instance should be stopped before being restored from Backup", exception.getMessage());
         verify(backupDao, times(1)).findById(backupId);
@@ -2248,13 +2261,15 @@ public void testRestoreBackupVolumeMismatch() {
         when(backupDao.findById(backupId)).thenReturn(backup);
         when(vmInstanceDao.findByIdIncludingRemoved(vmId)).thenReturn(vm);
         doNothing().when(backupManager).validateBackupForZone(any());
+        doReturn(new BackupOfferingVO()).when(backupOfferingDao).findByIdIncludingRemoved(Mockito.anyLong());
+        doReturn(backupProvider).when(backupManager).getBackupProvider(Mockito.nullable(String.class));
 
         try (MockedStatic<ActionEventUtils> utils = Mockito.mockStatic(ActionEventUtils.class)) {
             Mockito.when(ActionEventUtils.onStartedActionEvent(Mockito.anyLong(), Mockito.anyLong(),
                     Mockito.anyString(), Mockito.anyString(), Mockito.anyLong(), Mockito.anyString(),
                     Mockito.eq(true), Mockito.eq(0))).thenReturn(1L);
             CloudRuntimeException exception = Assert.assertThrows(CloudRuntimeException.class,
-                    () -> backupManager.restoreBackup(backupId));
+                    () -> backupManager.restoreBackup(backupId, false, null));
 
             assertEquals("Unable to restore Instance with the current Backup as the Backup has different number of disks to the Instance", exception.getMessage());
         }
@@ -2715,4 +2730,148 @@ public void testCloneBackupOfferingInheritsDomainIdsFromSource() {
         assertTrue(values.contains(String.valueOf(21L)));
         assertTrue(values.contains(String.valueOf(22L)));
     }
+
+    @Test (expected = CloudRuntimeException.class)
+    public void createBackupOfferingTestOfferingAlreadyExists() {
+        long zoneId = 1L;
+        String offeringName = "name";
+
+        doNothing().when(backupManager).validateBackupForZone(zoneId);
+        doReturn(backupOfferingVOMock).when(backupOfferingDao).findByName(offeringName, zoneId);
+        CreateBackupOfferingCmd cmd = Mockito.mock(CreateBackupOfferingCmd.class);
+        doReturn(zoneId).when(cmd).getZoneId();
+        doReturn(offeringName).when(cmd).getName();
+
+        backupManager.createBackupOffering(cmd);
+
+        verify(backupManager).validateBackupForZone(zoneId);
+    }
+
+    @Test (expected = InvalidParameterValueException.class)
+    public void createBackupOfferingTestInvalidDomainId() {
+        long zoneId = 1L;
+        String offeringName = "name";
+        long domainId = 3L;
+
+        doNothing().when(backupManager).validateBackupForZone(zoneId);
+        doReturn(null).when(backupOfferingDao).findByName(offeringName, zoneId);
+        CreateBackupOfferingCmd cmd = Mockito.mock(CreateBackupOfferingCmd.class);
+        doReturn(zoneId).when(cmd).getZoneId();
+        doReturn(offeringName).when(cmd).getName();
+        doReturn(List.of(domainId)).when(cmd).getDomainIds();
+        doReturn(null).when(domainDao).findById(domainId);
+
+        backupManager.createBackupOffering(cmd);
+
+        verify(backupManager).validateBackupForZone(zoneId);
+    }
+
+    @Test (expected = InvalidParameterValueException.class)
+    public void createBackupOfferingTestInvalidBackupProvider() {
+        long zoneId = 1L;
+        String offeringName = "name";
+
+        doNothing().when(backupManager).validateBackupForZone(zoneId);
+        doReturn(null).when(backupOfferingDao).findByName(offeringName, zoneId);
+        CreateBackupOfferingCmd cmd = Mockito.mock(CreateBackupOfferingCmd.class);
+        doReturn(zoneId).when(cmd).getZoneId();
+        doReturn(offeringName).when(cmd).getName();
+        doReturn(backupProvider).when(backupManager).getBackupProvider(zoneId);
+        doReturn("dummy").when(backupProvider).getName();
+
+        backupManager.createBackupOffering(cmd);
+
+        verify(backupManager).validateBackupForZone(zoneId);
+    }
+
+    @Test (expected = CloudRuntimeException.class)
+    public void createBackupOfferingTestInvalidProviderOffering() {
+        long zoneId = 1L;
+        String offeringName = "name";
+
+        doNothing().when(backupManager).validateBackupForZone(zoneId);
+        doReturn(null).when(backupOfferingDao).findByName(offeringName, zoneId);
+        CreateBackupOfferingCmd cmd = Mockito.mock(CreateBackupOfferingCmd.class);
+        doReturn(zoneId).when(cmd).getZoneId();
+        doReturn(offeringName).when(cmd).getName();
+        doReturn(backupProvider).when(backupManager).getBackupProvider(zoneId);
+        doReturn("kboss").when(backupProvider).getName();
+        doReturn(false).when(backupProvider).isValidProviderOffering(zoneId, null);
+
+        backupManager.createBackupOffering(cmd);
+
+        verify(backupManager).validateBackupForZone(zoneId);
+    }
+
+    @Test
+    public void createBackupOfferingTestAddsDetails() {
+        long zoneId = 1L;
+        String offeringName = "name";
+        long domainId = 3L;
+
+        doNothing().when(backupManager).validateBackupForZone(zoneId);
+        doReturn(null).when(backupOfferingDao).findByName(offeringName, zoneId);
+        CreateBackupOfferingCmd cmd = Mockito.mock(CreateBackupOfferingCmd.class);
+        doReturn(zoneId).when(cmd).getZoneId();
+        doReturn(List.of(domainId)).when(cmd).getDomainIds();
+        doReturn(domainVOMock).when(domainDao).findById(domainId);
+        doReturn(offeringName).when(cmd).getName();
+        doReturn(backupProvider).when(backupManager).getBackupProvider(zoneId);
+        doReturn(backupOfferingVOMock).when(backupOfferingDao).persist(any());
+        doReturn("kboss").when(backupProvider).getName();
+        doReturn(true).when(backupProvider).isValidProviderOffering(zoneId, null);
+        doReturn(true).when(cmd).isCompress();
+        doReturn(true).when(cmd).isValidate();
+        doReturn(true).when(cmd).isAllowExtractFile();
+        doReturn(true).when(cmd).isAllowQuickRestore();
+        doReturn(3).when(cmd).getBackupChainSize();
+        doReturn(Backup.CompressionLibrary.zlib).when(cmd).getCompressionLibrary();
+        doReturn("execute_command").when(cmd).getValidationSteps();
+
+        backupManager.createBackupOffering(cmd);
+
+        verify(backupManager).validateBackupForZone(zoneId);
+        verify(backupOfferingDao).persist(any());
+        ArrayList<String> detailsToBeSaved = new ArrayList<>(List.of(ApiConstants.DOMAIN_ID, ApiConstants.COMPRESS, ApiConstants.VALIDATE, ApiConstants.ALLOW_EXTRACT_FILE,
+                ApiConstants.ALLOW_QUICK_RESTORE, ApiConstants.BACKUP_CHAIN_SIZE, ApiConstants.COMPRESSION_LIBRARY, ApiConstants.VALIDATION_STEPS));
+        verify(backupOfferingDetailsDao).saveDetails(ArgumentMatchers.argThat( detailList -> {
+            if (CollectionUtils.isEmpty(detailList) || detailList.size() < 8) {
+                return false;
+            }
+            for (BackupOfferingDetailsVO detailsVO : detailList) {
+                detailsToBeSaved.removeIf(detailName -> detailsVO.getName().equals(detailName));
+            }
+
+            return detailsToBeSaved.isEmpty();
+        }));
+    }
+
+    @Test
+    public void createBackupOfferingTestAddsNoDetails() {
+        long zoneId = 1L;
+        String offeringName = "name";
+
+        doNothing().when(backupManager).validateBackupForZone(zoneId);
+        doReturn(null).when(backupOfferingDao).findByName(offeringName, zoneId);
+        CreateBackupOfferingCmd cmd = Mockito.mock(CreateBackupOfferingCmd.class);
+        doReturn(zoneId).when(cmd).getZoneId();
+        doReturn(offeringName).when(cmd).getName();
+        doReturn(backupProvider).when(backupManager).getBackupProvider(zoneId);
+        doReturn(backupOfferingVOMock).when(backupOfferingDao).persist(any());
+        doReturn("kboss").when(backupProvider).getName();
+        doReturn(true).when(backupProvider).isValidProviderOffering(zoneId, null);
+        doReturn(false).when(cmd).isCompress();
+        doReturn(false).when(cmd).isValidate();
+        doReturn(false).when(cmd).isAllowExtractFile();
+        doReturn(false).when(cmd).isAllowQuickRestore();
+        doReturn(null).when(cmd).getBackupChainSize();
+        doReturn(null).when(cmd).getCompressionLibrary();
+        doReturn(null).when(cmd).getValidationSteps();
+
+        backupManager.createBackupOffering(cmd);
+
+        verify(backupManager).validateBackupForZone(zoneId);
+        verify(backupOfferingDao).persist(any());
+        verify(backupOfferingDetailsDao, never()).saveDetails(any());
+    }
 }
diff --git a/server/src/test/java/org/apache/cloudstack/backup/BackupValidationServiceJobControllerTest.java b/server/src/test/java/org/apache/cloudstack/backup/BackupValidationServiceJobControllerTest.java
new file mode 100644
index 000000000000..cd3fe9a80953
--- /dev/null
+++ b/server/src/test/java/org/apache/cloudstack/backup/BackupValidationServiceJobControllerTest.java
@@ -0,0 +1,150 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.backup;
+
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+
+import java.util.HashMap;
+import java.util.List;
+
+import org.apache.cloudstack.backup.dao.InternalBackupServiceJobDao;
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.dc.DataCenterVO;
+import com.cloud.dc.dao.DataCenterDao;
+import com.cloud.host.HostVO;
+import com.cloud.utils.Pair;
+
+@RunWith(MockitoJUnitRunner.class)
+public class BackupValidationServiceJobControllerTest {
+
+    @Mock
+    private DataCenterDao dataCenterDaoMock;
+
+    @Mock
+    private DataCenterVO dataCenterVoMock;
+
+    @Mock
+    private HostVO hostVO;
+
+    @Mock
+    private InternalBackupServiceJobDao internalBackupServiceJobDaoMock;
+
+    @Mock
+    private InternalBackupServiceJobVO internalBackupServiceJobVoMock;
+
+    @Mock
+    private ConfigKey<Boolean> backupValidationTaskEnabledMock;
+
+    @Spy
+    @InjectMocks
+    private BackupValidationServiceJobController backupValidationServiceJobControllerSpy;
+
+    long datacenterId = 1L;
+
+    @Test
+    public void searchAndDispatchJobsTestLockFailureReturnsEarly() {
+        doReturn(List.of(dataCenterVoMock)).when(dataCenterDaoMock).listEnabledZones();
+        doReturn(false).when(internalBackupServiceJobDaoMock).lockInLockTable("validation_lock", 300);
+
+        backupValidationServiceJobControllerSpy.searchAndDispatchJobs();
+
+        verify(internalBackupServiceJobDaoMock).unlockFromLockTable(any());
+        verify(backupValidationServiceJobControllerSpy, never()).rescheduleLostJobs();
+        verify(internalBackupServiceJobDaoMock, never()).listWaitingJobsAndScheduledToBeforeNow(anyLong(), any());
+    }
+
+    @Test
+    public void searchAndDispatchJobsTestTaskDisabledReturnsAfterReschedule() {
+        doReturn(List.of(dataCenterVoMock)).when(dataCenterDaoMock).listEnabledZones();
+        doReturn(true).when(internalBackupServiceJobDaoMock).lockInLockTable("validation_lock", 300);
+        doNothing().when(backupValidationServiceJobControllerSpy).rescheduleLostJobs();
+        doReturn(false).when(backupValidationTaskEnabledMock).value();
+
+        backupValidationServiceJobControllerSpy.searchAndDispatchJobs();
+
+        verify(backupValidationServiceJobControllerSpy).rescheduleLostJobs();
+        verify(internalBackupServiceJobDaoMock, never()).listWaitingJobsAndScheduledToBeforeNow(anyLong(), any());
+        verify(internalBackupServiceJobDaoMock).unlockFromLockTable("validation_lock");
+    }
+
+    @Test
+    public void searchAndDispatchJobsTestZoneWithoutBackupFrameworkIsSkipped() {
+        doReturn(List.of(dataCenterVoMock)).when(dataCenterDaoMock).listEnabledZones();
+        doReturn(true).when(internalBackupServiceJobDaoMock).lockInLockTable("validation_lock", 300);
+        doNothing().when(backupValidationServiceJobControllerSpy).rescheduleLostJobs();
+        doReturn(true).when(backupValidationTaskEnabledMock).value();
+        doReturn(false).when(backupValidationServiceJobControllerSpy).isFrameworkEnabledForZone(dataCenterVoMock);
+
+        backupValidationServiceJobControllerSpy.searchAndDispatchJobs();
+
+        verify(internalBackupServiceJobDaoMock, never()).listWaitingJobsAndScheduledToBeforeNow(anyLong(), any());
+        verify(internalBackupServiceJobDaoMock).unlockFromLockTable("validation_lock");
+    }
+
+    @Test
+    public void searchAndDispatchJobsTestEmptyWaitingJobsSkipsDispatch() {
+        doReturn(List.of(dataCenterVoMock)).when(dataCenterDaoMock).listEnabledZones();
+        doReturn(true).when(internalBackupServiceJobDaoMock).lockInLockTable("validation_lock", 300);
+        doNothing().when(backupValidationServiceJobControllerSpy).rescheduleLostJobs();
+        doReturn(true).when(backupValidationTaskEnabledMock).value();
+        doReturn(datacenterId).when(dataCenterVoMock).getId();
+        doReturn(true).when(backupValidationServiceJobControllerSpy).isFrameworkEnabledForZone(dataCenterVoMock);
+
+        backupValidationServiceJobControllerSpy.searchAndDispatchJobs();
+
+        verify(backupValidationServiceJobControllerSpy, never()).getHostToNumberOfExecutingJobsAndTotalExecutingJobs(any(), any());
+        verify(backupValidationServiceJobControllerSpy, never()).submitQueuedJobsForExecution(any(), any(), any(), any(), anyLong());
+        verify(internalBackupServiceJobDaoMock).unlockFromLockTable("validation_lock");
+    }
+
+    @Test
+    public void searchAndDispatchJobsTestHappyPathDispatchesJobs() {
+        Pair<HashMap<HostVO, Long>, Integer> executingJobsPair = new Pair<>(new HashMap<>(), 0);
+
+        doReturn(List.of(dataCenterVoMock)).when(dataCenterDaoMock).listEnabledZones();
+        doReturn(true).when(internalBackupServiceJobDaoMock).lockInLockTable("validation_lock", 300);
+        doNothing().when(backupValidationServiceJobControllerSpy).rescheduleLostJobs();
+        doReturn(true).when(backupValidationTaskEnabledMock).value();
+        doReturn(datacenterId).when(dataCenterVoMock).getId();
+        doReturn(true).when(backupValidationServiceJobControllerSpy).isFrameworkEnabledForZone(dataCenterVoMock);
+        doReturn(List.of(internalBackupServiceJobVoMock)).when(backupValidationServiceJobControllerSpy).filterJobsOfDomainsAndAccountsWithDisabledValidationTask(any());
+        doReturn(executingJobsPair).when(backupValidationServiceJobControllerSpy).getHostToNumberOfExecutingJobsAndTotalExecutingJobs(eq(dataCenterVoMock), any());
+        doReturn(List.of(new Pair<>(hostVO, 0L))).when(backupValidationServiceJobControllerSpy).filterHostsWithTooManyJobs(any(), any());
+        doReturn(List.of(internalBackupServiceJobVoMock)).when(backupValidationServiceJobControllerSpy).thinJobsToStartList(eq(dataCenterVoMock), any(), anyInt(), any());
+        doNothing().when(backupValidationServiceJobControllerSpy).submitQueuedJobsForExecution(any(), any(), any(), any(), eq(datacenterId));
+
+        backupValidationServiceJobControllerSpy.searchAndDispatchJobs();
+
+
+        verify(backupValidationServiceJobControllerSpy).submitQueuedJobsForExecution(any(), any(), any(), any(), eq(datacenterId));
+        verify(internalBackupServiceJobDaoMock).unlockFromLockTable("validation_lock");
+    }
+}
diff --git a/server/src/test/java/org/apache/cloudstack/backup/InternalBackupServiceImplTest.java b/server/src/test/java/org/apache/cloudstack/backup/InternalBackupServiceImplTest.java
new file mode 100644
index 000000000000..008a590c3e5a
--- /dev/null
+++ b/server/src/test/java/org/apache/cloudstack/backup/InternalBackupServiceImplTest.java
@@ -0,0 +1,551 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.backup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.anyLong;
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.any;
+import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+
+import java.util.List;
+
+import org.apache.cloudstack.api.response.ExtractResponse;
+import org.apache.cloudstack.backup.dao.BackupDetailsDao;
+import org.apache.cloudstack.backup.dao.InternalBackupJoinDao;
+import org.apache.cloudstack.backup.dao.InternalBackupStoragePoolDao;
+import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreManager;
+import org.apache.cloudstack.storage.command.DeleteCommand;
+import org.apache.cloudstack.storage.command.RevertSnapshotCommand;
+import org.apache.cloudstack.storage.datastore.db.ImageStoreObjectDownloadDao;
+import org.apache.cloudstack.storage.datastore.db.ImageStoreObjectDownloadVO;
+import org.apache.cloudstack.storage.image.datastore.ImageStoreEntity;
+import org.apache.cloudstack.storage.to.SnapshotObjectTO;
+import org.apache.cloudstack.storage.to.VolumeObjectTO;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.Command;
+import com.cloud.agent.api.to.DataTO;
+import com.cloud.storage.DataStoreRole;
+import com.cloud.storage.Storage;
+import com.cloud.storage.Upload;
+import com.cloud.storage.Volume;
+import com.cloud.storage.VolumeVO;
+import com.cloud.storage.dao.VolumeDao;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.VirtualMachineManager;
+import com.cloud.vm.snapshot.VMSnapshot;
+
+@RunWith(MockitoJUnitRunner.class)
+public class InternalBackupServiceImplTest {
+
+    @Mock
+    private InternalBackupStoragePoolDao internalBackupStoragePoolDaoMock;
+
+    @Mock
+    private VolumeObjectTO volumeObjectToMock;
+
+    @Mock
+    private SnapshotObjectTO snapshotObjectToMock;
+
+    @Mock
+    private InternalBackupStoragePoolVO internalBackupStoragePoolVoMock;
+
+    @Mock
+    private InternalBackupJoinDao internalBackupJoinDaoMock;
+
+    @Mock
+    private BackupDetailsDao backupDetailDaoMock;
+
+    @Mock
+    private BackupDetailVO backupDetailVoMock;
+
+    @Mock
+    private BackupDetailVO backupDetailVoMock2;
+
+    @Mock
+    private InternalBackupJoinVO internalBackupJoinVoMock;
+
+    @Mock
+    private Volume volumeMock;
+
+    @Mock
+    private VolumeVO volumeVoMock;
+
+    @Mock
+    private VirtualMachine virtualMachineMock;
+
+    @Mock
+    private InternalBackupProvider internalBackupProviderMock;
+
+    @Mock
+    private VirtualMachineManager virtualMachineManagerMock;
+
+    @Mock
+    private VolumeDao volumeDaoMock;
+
+    @Mock
+    private ImageStoreObjectDownloadDao imageStoreObjectDownloadDaoMock;
+
+    @Mock
+    private DataStoreManager dataStoreMgrMock;
+
+    @Mock
+    private ImageStoreEntity imageStoreEntityMock;
+
+    @Mock
+    private ImageStoreObjectDownloadVO imageStoreObjectDownloadVoMock;
+
+    @Mock
+    private VMSnapshot vmSnapshotMock;
+
+    @Spy
+    @InjectMocks
+    private InternalBackupServiceImpl internalBackupServiceImplSpy;
+
+    private static final long IMAGE_STORE_ID = 7L;
+    private static final String SCREENSHOT_PATH = "/tmp/screenshot.png";
+    private static final long VOLUME_ID = 42L;
+    private static final long BACKUP_ID = 100L;
+    private static final long ZONE_ID = 1L;
+    private static final long OLD_VOLUME_ID = 5L;
+    private static final long NEW_VOLUME_ID = 6L;
+    private static final long INSTANCE_ID = 10L;
+
+    @Test
+    public void configureChainInfoTestNonVolumeObjectReturnsImmediately() {
+        DataTO dataToMock = mock(DataTO.class);
+        Command cmdMock = mock(Command.class);
+
+        internalBackupServiceImplSpy.configureChainInfo(dataToMock, cmdMock);
+
+        verify(internalBackupStoragePoolDaoMock, never()).findOneByVolumeId(anyLong());
+    }
+
+    @Test
+    public void configureChainInfoTestVolumeWithoutBackupDeltaReturnsImmediately() {
+        doReturn(VOLUME_ID).when(volumeObjectToMock).getVolumeId();
+        doReturn(null).when(internalBackupStoragePoolDaoMock).findOneByVolumeId(VOLUME_ID);
+
+        internalBackupServiceImplSpy.configureChainInfo(volumeObjectToMock, mock(Command.class));
+
+        verify(internalBackupStoragePoolDaoMock).findOneByVolumeId(VOLUME_ID);
+        verify(volumeObjectToMock, never()).setChainInfo(anyString());
+    }
+
+    @Test
+    public void configureChainInfoTestSetsChainInfoForGenericCommand() {
+        doReturn(VOLUME_ID).when(volumeObjectToMock).getVolumeId();
+        doReturn(internalBackupStoragePoolVoMock).when(internalBackupStoragePoolDaoMock).findOneByVolumeId(VOLUME_ID);
+        doReturn("/path/to/parent").when(internalBackupStoragePoolVoMock).getBackupDeltaParentPath();
+
+        Command cmdMock = mock(Command.class);
+
+        internalBackupServiceImplSpy.configureChainInfo(volumeObjectToMock, cmdMock);
+
+        verify(internalBackupStoragePoolDaoMock).findOneByVolumeId(VOLUME_ID);
+        verify(volumeObjectToMock).setChainInfo("/path/to/parent");
+    }
+
+    @Test
+    public void configureChainInfoTestSetsDeleteChainForDeleteCommand() {
+        doReturn(VOLUME_ID).when(volumeObjectToMock).getVolumeId();
+        doReturn(internalBackupStoragePoolVoMock).when(internalBackupStoragePoolDaoMock).findOneByVolumeId(VOLUME_ID);
+        doReturn("/path/to/parent").when(internalBackupStoragePoolVoMock).getBackupDeltaParentPath();
+
+        DeleteCommand deleteCommand = new DeleteCommand(volumeObjectToMock);
+
+        internalBackupServiceImplSpy.configureChainInfo(volumeObjectToMock, deleteCommand);
+
+        verify(volumeObjectToMock).setChainInfo("/path/to/parent");
+        assertTrue(deleteCommand.isDeleteChain());
+    }
+
+    @Test
+    public void configureChainInfoTestSetsDeleteChainForRevertSnapshotCommand() {
+        doReturn(VOLUME_ID).when(volumeObjectToMock).getVolumeId();
+        doReturn(internalBackupStoragePoolVoMock).when(internalBackupStoragePoolDaoMock).findOneByVolumeId(VOLUME_ID);
+        doReturn("/path/to/parent").when(internalBackupStoragePoolVoMock).getBackupDeltaParentPath();
+
+        RevertSnapshotCommand revertSnapshotCommand = new RevertSnapshotCommand(snapshotObjectToMock, snapshotObjectToMock);
+
+        internalBackupServiceImplSpy.configureChainInfo(volumeObjectToMock, revertSnapshotCommand);
+
+        verify(volumeObjectToMock).setChainInfo("/path/to/parent");
+        assertTrue(revertSnapshotCommand.isDeleteChain());
+    }
+
+    @Test
+    public void cleanupBackupMetadataTestNoDeltaReturnsImmediately() {
+        doReturn(null).when(internalBackupStoragePoolDaoMock).findOneByVolumeId(VOLUME_ID);
+
+        internalBackupServiceImplSpy.cleanupBackupMetadata(VOLUME_ID);
+
+        verify(internalBackupStoragePoolDaoMock).findOneByVolumeId(VOLUME_ID);
+        verify(internalBackupStoragePoolDaoMock, never()).expungeByVolumeId(VOLUME_ID);
+        verify(internalBackupJoinDaoMock, never()).findById(anyLong());
+    }
+
+    @Test
+    public void cleanupBackupMetadataTestDeltaExistsButOtherDeltasRemainReturnsImmediately() {
+        doReturn(BACKUP_ID).when(internalBackupStoragePoolVoMock).getBackupId();
+        doReturn(internalBackupStoragePoolVoMock).when(internalBackupStoragePoolDaoMock).findOneByVolumeId(VOLUME_ID);
+        doReturn(List.of(internalBackupStoragePoolVoMock, mock(InternalBackupStoragePoolVO.class)))
+                .when(internalBackupStoragePoolDaoMock).listByBackupId(BACKUP_ID);
+
+        internalBackupServiceImplSpy.cleanupBackupMetadata(VOLUME_ID);
+
+        verify(internalBackupStoragePoolDaoMock).findOneByVolumeId(VOLUME_ID);
+        verify(internalBackupStoragePoolDaoMock).expungeByVolumeId(VOLUME_ID);
+        verify(internalBackupStoragePoolDaoMock).listByBackupId(BACKUP_ID);
+        verify(internalBackupJoinDaoMock, never()).findById(anyLong());
+    }
+
+    @Test
+    public void cleanupBackupMetadataTestLastDeltaAndEndOfChainTrue() {
+        doReturn(BACKUP_ID).when(internalBackupStoragePoolVoMock).getBackupId();
+        doReturn(internalBackupStoragePoolVoMock).when(internalBackupStoragePoolDaoMock).findOneByVolumeId(VOLUME_ID);
+        doReturn(List.of()).when(internalBackupStoragePoolDaoMock).listByBackupId(BACKUP_ID);
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(BACKUP_ID);
+        doReturn(BACKUP_ID).when(internalBackupJoinVoMock).getId();
+        doReturn(true).when(internalBackupJoinVoMock).getEndOfChain();
+
+        internalBackupServiceImplSpy.cleanupBackupMetadata(VOLUME_ID);
+
+        verify(internalBackupStoragePoolDaoMock).findOneByVolumeId(VOLUME_ID);
+        verify(internalBackupStoragePoolDaoMock).expungeByVolumeId(VOLUME_ID);
+        verify(internalBackupStoragePoolDaoMock).listByBackupId(BACKUP_ID);
+        verify(internalBackupJoinDaoMock).findById(BACKUP_ID);
+        verify(backupDetailDaoMock).removeDetail(BACKUP_ID, BackupDetailsDao.CURRENT);
+        verify(backupDetailDaoMock, never()).persist(any());
+    }
+
+    @Test
+    public void cleanupBackupMetadataTestLastDeltaAndEndOfChainFalse() {
+        doReturn(BACKUP_ID).when(internalBackupStoragePoolVoMock).getBackupId();
+        doReturn(internalBackupStoragePoolVoMock).when(internalBackupStoragePoolDaoMock).findOneByVolumeId(VOLUME_ID);
+        doReturn(List.of()).when(internalBackupStoragePoolDaoMock).listByBackupId(BACKUP_ID);
+        doReturn(internalBackupJoinVoMock).when(internalBackupJoinDaoMock).findById(BACKUP_ID);
+        doReturn(BACKUP_ID).when(internalBackupJoinVoMock).getId();
+        doReturn(false).when(internalBackupJoinVoMock).getEndOfChain();
+
+        internalBackupServiceImplSpy.cleanupBackupMetadata(VOLUME_ID);
+
+        verify(internalBackupStoragePoolDaoMock).findOneByVolumeId(VOLUME_ID);
+        verify(internalBackupStoragePoolDaoMock).expungeByVolumeId(VOLUME_ID);
+        verify(internalBackupStoragePoolDaoMock).listByBackupId(BACKUP_ID);
+        verify(internalBackupJoinDaoMock).findById(BACKUP_ID);
+        verify(backupDetailDaoMock).removeDetail(BACKUP_ID, BackupDetailsDao.CURRENT);
+        verify(backupDetailDaoMock).persist(any(BackupDetailVO.class));
+    }
+
+    @Test
+    public void prepareVolumeForDetachTestBackupFrameworkDisabledReturnsImmediately() {
+        doReturn(true).when(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+
+        internalBackupServiceImplSpy.prepareVolumeForDetach(volumeMock, virtualMachineMock);
+
+        verify(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+        verify(internalBackupServiceImplSpy, never()).getInternalBackupProviderForZone(anyLong());
+    }
+
+    @Test
+    public void prepareVolumeForDetachTestProviderIsNullReturnsImmediately() {
+        doReturn(false).when(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+        doReturn(ZONE_ID).when(virtualMachineMock).getDataCenterId();
+        doReturn(null).when(internalBackupServiceImplSpy).getInternalBackupProviderForZone(ZONE_ID);
+
+        internalBackupServiceImplSpy.prepareVolumeForDetach(volumeMock, virtualMachineMock);
+
+        verify(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+        verify(internalBackupServiceImplSpy).getInternalBackupProviderForZone(ZONE_ID);
+        verify(internalBackupProviderMock, never()).prepareVolumeForDetach(any(), any());
+    }
+
+    @Test
+    public void prepareVolumeForDetachTestProviderCallsPrepareVolumeForDetach() {
+        doReturn(false).when(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+        doReturn(ZONE_ID).when(virtualMachineMock).getDataCenterId();
+        doReturn(internalBackupProviderMock).when(internalBackupServiceImplSpy).getInternalBackupProviderForZone(ZONE_ID);
+        doNothing().when(internalBackupProviderMock).prepareVolumeForDetach(volumeMock, virtualMachineMock);
+
+        internalBackupServiceImplSpy.prepareVolumeForDetach(volumeMock, virtualMachineMock);
+
+        verify(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+        verify(internalBackupServiceImplSpy).getInternalBackupProviderForZone(ZONE_ID);
+        verify(internalBackupProviderMock).prepareVolumeForDetach(volumeMock, virtualMachineMock);
+    }
+
+    @Test
+    public void prepareVolumeForMigrationTestVolumeInstanceIdIsNullReturnsImmediately() {
+        doReturn(null).when(volumeMock).getInstanceId();
+
+        internalBackupServiceImplSpy.prepareVolumeForMigration(volumeMock);
+
+        verify(volumeMock).getInstanceId();
+        verify(virtualMachineManagerMock, never()).findById(anyLong());
+    }
+
+    @Test
+    public void prepareVolumeForMigrationTestBackupFrameworkDisabledReturnsImmediately() {
+        doReturn(INSTANCE_ID).when(volumeMock).getInstanceId();
+        doReturn(virtualMachineMock).when(virtualMachineManagerMock).findById(INSTANCE_ID);
+        doReturn(true).when(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+
+        internalBackupServiceImplSpy.prepareVolumeForMigration(volumeMock);
+
+        verify(virtualMachineManagerMock).findById(INSTANCE_ID);
+        verify(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+        verify(internalBackupServiceImplSpy, never()).getInternalBackupProviderForZone(anyLong());
+    }
+
+    @Test
+    public void prepareVolumeForMigrationTestProviderIsNullReturnsImmediately() {
+        doReturn(INSTANCE_ID).when(volumeMock).getInstanceId();
+        doReturn(virtualMachineMock).when(virtualMachineManagerMock).findById(INSTANCE_ID);
+        doReturn(false).when(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+        doReturn(ZONE_ID).when(volumeMock).getDataCenterId();
+        doReturn(null).when(internalBackupServiceImplSpy).getInternalBackupProviderForZone(ZONE_ID);
+
+        internalBackupServiceImplSpy.prepareVolumeForMigration(volumeMock);
+
+        verify(virtualMachineManagerMock).findById(INSTANCE_ID);
+        verify(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+        verify(internalBackupServiceImplSpy).getInternalBackupProviderForZone(ZONE_ID);
+        verify(internalBackupProviderMock, never()).prepareVolumeForMigration(any(), any());
+    }
+
+    @Test
+    public void prepareVolumeForMigrationTestProviderCallsPrepareVolumeForMigration() {
+        doReturn(INSTANCE_ID).when(volumeMock).getInstanceId();
+        doReturn(virtualMachineMock).when(virtualMachineManagerMock).findById(INSTANCE_ID);
+        doReturn(false).when(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+        doReturn(ZONE_ID).when(volumeMock).getDataCenterId();
+        doReturn(internalBackupProviderMock).when(internalBackupServiceImplSpy).getInternalBackupProviderForZone(ZONE_ID);
+        doNothing().when(internalBackupProviderMock).prepareVolumeForMigration(volumeMock, virtualMachineMock);
+
+        internalBackupServiceImplSpy.prepareVolumeForMigration(volumeMock);
+
+        verify(virtualMachineManagerMock).findById(INSTANCE_ID);
+        verify(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+        verify(internalBackupServiceImplSpy).getInternalBackupProviderForZone(ZONE_ID);
+        verify(internalBackupProviderMock).prepareVolumeForMigration(volumeMock, virtualMachineMock);
+    }
+
+    @Test
+    public void updateVolumeIdTestVolumeInstanceIdIsNullReturnsImmediately() {
+        doReturn(volumeVoMock).when(volumeDaoMock).findById(NEW_VOLUME_ID);
+        doReturn(null).when(volumeVoMock).getInstanceId();
+
+        internalBackupServiceImplSpy.updateVolumeId(OLD_VOLUME_ID, NEW_VOLUME_ID);
+
+        verify(volumeDaoMock).findById(NEW_VOLUME_ID);
+        verify(volumeVoMock).getInstanceId();
+        verify(virtualMachineManagerMock, never()).findById(anyLong());
+    }
+
+    @Test
+    public void updateVolumeIdTestBackupFrameworkDisabledReturnsImmediately() {
+        doReturn(volumeVoMock).when(volumeDaoMock).findById(NEW_VOLUME_ID);
+        doReturn(INSTANCE_ID).when(volumeVoMock).getInstanceId();
+        doReturn(virtualMachineMock).when(virtualMachineManagerMock).findById(INSTANCE_ID);
+        doReturn(true).when(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+
+        internalBackupServiceImplSpy.updateVolumeId(OLD_VOLUME_ID, NEW_VOLUME_ID);
+
+        verify(volumeDaoMock).findById(NEW_VOLUME_ID);
+        verify(virtualMachineManagerMock).findById(INSTANCE_ID);
+        verify(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+        verify(internalBackupServiceImplSpy, never()).getInternalBackupProviderForZone(anyLong());
+    }
+
+    @Test
+    public void updateVolumeIdTestProviderIsNullReturnsImmediately() {
+        doReturn(volumeVoMock).when(volumeDaoMock).findById(NEW_VOLUME_ID);
+        doReturn(INSTANCE_ID).when(volumeVoMock).getInstanceId();
+        doReturn(virtualMachineMock).when(virtualMachineManagerMock).findById(INSTANCE_ID);
+        doReturn(false).when(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+        doReturn(ZONE_ID).when(virtualMachineMock).getDataCenterId();
+        doReturn(null).when(internalBackupServiceImplSpy).getInternalBackupProviderForZone(ZONE_ID);
+
+        internalBackupServiceImplSpy.updateVolumeId(OLD_VOLUME_ID, NEW_VOLUME_ID);
+
+        verify(volumeDaoMock).findById(NEW_VOLUME_ID);
+        verify(virtualMachineManagerMock).findById(INSTANCE_ID);
+        verify(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+        verify(internalBackupServiceImplSpy).getInternalBackupProviderForZone(ZONE_ID);
+        verify(internalBackupProviderMock, never()).updateVolumeId(any(), anyLong(), anyLong());
+    }
+
+    @Test
+    public void updateVolumeIdTestProviderCallsUpdateVolumeId() {
+        doReturn(volumeVoMock).when(volumeDaoMock).findById(NEW_VOLUME_ID);
+        doReturn(INSTANCE_ID).when(volumeVoMock).getInstanceId();
+        doReturn(virtualMachineMock).when(virtualMachineManagerMock).findById(INSTANCE_ID);
+        doReturn(false).when(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+        doReturn(ZONE_ID).when(virtualMachineMock).getDataCenterId();
+        doReturn(internalBackupProviderMock).when(internalBackupServiceImplSpy).getInternalBackupProviderForZone(ZONE_ID);
+        doNothing().when(internalBackupProviderMock).updateVolumeId(virtualMachineMock, OLD_VOLUME_ID, NEW_VOLUME_ID);
+
+        internalBackupServiceImplSpy.updateVolumeId(OLD_VOLUME_ID, NEW_VOLUME_ID);
+
+        verify(volumeDaoMock).findById(NEW_VOLUME_ID);
+        verify(virtualMachineManagerMock).findById(INSTANCE_ID);
+        verify(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+        verify(internalBackupServiceImplSpy).getInternalBackupProviderForZone(ZONE_ID);
+        verify(internalBackupProviderMock).updateVolumeId(virtualMachineMock, OLD_VOLUME_ID, NEW_VOLUME_ID);
+    }
+
+    @Test
+    public void downloadScreenshotTestScreenshotPathDetailMissingReturnsNotCreated() {
+        doReturn(null).when(backupDetailDaoMock).findDetail(BACKUP_ID, BackupDetailsDao.SCREENSHOT_PATH);
+
+        ExtractResponse result = internalBackupServiceImplSpy.downloadScreenshot(BACKUP_ID);
+
+        verify(backupDetailDaoMock).findDetail(BACKUP_ID, BackupDetailsDao.SCREENSHOT_PATH);
+        assertEquals(Upload.Status.DOWNLOAD_URL_NOT_CREATED.toString(), result.getState());
+    }
+
+    @Test
+    public void downloadScreenshotTestImageStoreObjectExistsReturnsCreatedResponse() {
+        doReturn(backupDetailVoMock).when(backupDetailDaoMock).findDetail(BACKUP_ID, BackupDetailsDao.SCREENSHOT_PATH);
+        doReturn(backupDetailVoMock2).when(backupDetailDaoMock).findDetail(BACKUP_ID, BackupDetailsDao.IMAGE_STORE_ID);
+        doReturn(String.valueOf(IMAGE_STORE_ID)).when(backupDetailVoMock2).getValue();
+        doReturn(SCREENSHOT_PATH).when(backupDetailVoMock).getValue();
+        doReturn(imageStoreEntityMock).when(dataStoreMgrMock).getDataStore(IMAGE_STORE_ID, DataStoreRole.Image);
+        doReturn(imageStoreObjectDownloadVoMock).when(imageStoreObjectDownloadDaoMock)
+                .findByStoreIdAndPath(IMAGE_STORE_ID, SCREENSHOT_PATH);
+        doReturn("http://download/url").when(imageStoreObjectDownloadVoMock).getDownloadUrl();
+
+        ExtractResponse result = internalBackupServiceImplSpy.downloadScreenshot(BACKUP_ID);
+
+        verify(backupDetailDaoMock).findDetail(BACKUP_ID, BackupDetailsDao.SCREENSHOT_PATH);
+        verify(backupDetailDaoMock).findDetail(BACKUP_ID, BackupDetailsDao.IMAGE_STORE_ID);
+        verify(imageStoreObjectDownloadDaoMock).findByStoreIdAndPath(IMAGE_STORE_ID, SCREENSHOT_PATH);
+        verify(imageStoreObjectDownloadDaoMock, never()).persist(any());
+        assertEquals("http://download/url", result.getUrl());
+        assertEquals("screenshot.png", result.getName());
+        assertEquals(Upload.Status.DOWNLOAD_URL_CREATED.toString(), result.getState());
+    }
+
+    @Test
+    public void downloadScreenshotTestImageStoreObjectMissingButPersistSucceedsReturnsCreatedResponse() {
+        doReturn(backupDetailVoMock).when(backupDetailDaoMock).findDetail(BACKUP_ID, BackupDetailsDao.SCREENSHOT_PATH);
+        doReturn(backupDetailVoMock2).when(backupDetailDaoMock).findDetail(BACKUP_ID, BackupDetailsDao.IMAGE_STORE_ID);
+        doReturn(String.valueOf(IMAGE_STORE_ID)).when(backupDetailVoMock2).getValue();
+        doReturn(SCREENSHOT_PATH).when(backupDetailVoMock).getValue();
+        doReturn(imageStoreEntityMock).when(dataStoreMgrMock).getDataStore(IMAGE_STORE_ID, DataStoreRole.Image);
+        doReturn(null).when(imageStoreObjectDownloadDaoMock).findByStoreIdAndPath(IMAGE_STORE_ID, SCREENSHOT_PATH);
+        doReturn(123L).when(imageStoreEntityMock).getId();
+        doReturn(imageStoreObjectDownloadVoMock).when(imageStoreObjectDownloadDaoMock).persist(any(ImageStoreObjectDownloadVO.class));
+        doReturn("http://download/url").when(imageStoreObjectDownloadVoMock).getDownloadUrl();
+
+        ExtractResponse result = internalBackupServiceImplSpy.downloadScreenshot(BACKUP_ID);
+
+        verify(backupDetailDaoMock).findDetail(BACKUP_ID, BackupDetailsDao.SCREENSHOT_PATH);
+        verify(backupDetailDaoMock).findDetail(BACKUP_ID, BackupDetailsDao.IMAGE_STORE_ID);
+        verify(imageStoreObjectDownloadDaoMock).findByStoreIdAndPath(IMAGE_STORE_ID, SCREENSHOT_PATH);
+        verify(imageStoreEntityMock).createEntityExtractUrl(eq(SCREENSHOT_PATH), eq(Storage.ImageFormat.PNG), any());
+        verify(imageStoreObjectDownloadDaoMock).persist(any(ImageStoreObjectDownloadVO.class));
+        assertEquals("http://download/url", result.getUrl());
+        assertEquals("screenshot.png", result.getName());
+        assertEquals(Upload.Status.DOWNLOAD_URL_CREATED.toString(), result.getState());
+    }
+
+    @Test
+    public void downloadScreenshotTestImageStoreObjectMissingAndPersistReturnsNullReturnsNotCreated() {
+        doReturn(backupDetailVoMock).when(backupDetailDaoMock).findDetail(BACKUP_ID, BackupDetailsDao.SCREENSHOT_PATH);
+        doReturn(backupDetailVoMock2).when(backupDetailDaoMock).findDetail(BACKUP_ID, BackupDetailsDao.IMAGE_STORE_ID);
+        doReturn(String.valueOf(IMAGE_STORE_ID)).when(backupDetailVoMock2).getValue();
+        doReturn(SCREENSHOT_PATH).when(backupDetailVoMock).getValue();
+        doReturn(imageStoreEntityMock).when(dataStoreMgrMock).getDataStore(IMAGE_STORE_ID, DataStoreRole.Image);
+        doReturn(null).when(imageStoreObjectDownloadDaoMock).findByStoreIdAndPath(IMAGE_STORE_ID, SCREENSHOT_PATH);
+        doReturn(123L).when(imageStoreEntityMock).getId();
+        doReturn(null).when(imageStoreObjectDownloadDaoMock).persist(any(ImageStoreObjectDownloadVO.class));
+
+        ExtractResponse result = internalBackupServiceImplSpy.downloadScreenshot(BACKUP_ID);
+
+        verify(backupDetailDaoMock).findDetail(BACKUP_ID, BackupDetailsDao.SCREENSHOT_PATH);
+        verify(backupDetailDaoMock).findDetail(BACKUP_ID, BackupDetailsDao.IMAGE_STORE_ID);
+        verify(imageStoreObjectDownloadDaoMock).findByStoreIdAndPath(IMAGE_STORE_ID, SCREENSHOT_PATH);
+        verify(imageStoreEntityMock).createEntityExtractUrl(eq(SCREENSHOT_PATH), eq(Storage.ImageFormat.PNG), any());
+        verify(imageStoreObjectDownloadDaoMock).persist(any(ImageStoreObjectDownloadVO.class));
+        org.junit.Assert.assertNull(result.getUrl());
+        org.junit.Assert.assertNull(result.getName());
+        org.junit.Assert.assertEquals(Upload.Status.DOWNLOAD_URL_NOT_CREATED.toString(), result.getState());
+    }
+
+    @Test
+    public void prepareVmForSnapshotRevertTestBackupFrameworkDisabledReturnsImmediately() {
+        doReturn(INSTANCE_ID).when(vmSnapshotMock).getVmId();
+        doReturn(virtualMachineMock).when(virtualMachineManagerMock).findById(INSTANCE_ID);
+        doReturn(true).when(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+
+        internalBackupServiceImplSpy.prepareVmForSnapshotRevert(vmSnapshotMock);
+
+        verify(vmSnapshotMock).getVmId();
+        verify(virtualMachineManagerMock).findById(INSTANCE_ID);
+        verify(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+        verify(internalBackupServiceImplSpy, never()).getInternalBackupProviderForZone(anyLong());
+    }
+
+    @Test
+    public void prepareVmForSnapshotRevertTestProviderIsNullReturnsImmediately() {
+        doReturn(INSTANCE_ID).when(vmSnapshotMock).getVmId();
+        doReturn(virtualMachineMock).when(virtualMachineManagerMock).findById(INSTANCE_ID);
+        doReturn(false).when(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+        doReturn(ZONE_ID).when(virtualMachineMock).getDataCenterId();
+        doReturn(null).when(internalBackupServiceImplSpy).getInternalBackupProviderForZone(ZONE_ID);
+
+        internalBackupServiceImplSpy.prepareVmForSnapshotRevert(vmSnapshotMock);
+
+        verify(vmSnapshotMock).getVmId();
+        verify(virtualMachineManagerMock).findById(INSTANCE_ID);
+        verify(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+        verify(internalBackupServiceImplSpy).getInternalBackupProviderForZone(ZONE_ID);
+        verify(internalBackupProviderMock, never()).prepareVmForSnapshotRevert(any(), any());
+    }
+
+    @Test
+    public void prepareVmForSnapshotRevertTestProviderCallsPrepareVmForSnapshotRevert() {
+        doReturn(INSTANCE_ID).when(vmSnapshotMock).getVmId();
+        doReturn(virtualMachineMock).when(virtualMachineManagerMock).findById(INSTANCE_ID);
+        doReturn(false).when(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+        doReturn(ZONE_ID).when(virtualMachineMock).getDataCenterId();
+        doReturn(internalBackupProviderMock).when(internalBackupServiceImplSpy).getInternalBackupProviderForZone(ZONE_ID);
+        doNothing().when(internalBackupProviderMock).prepareVmForSnapshotRevert(vmSnapshotMock, virtualMachineMock);
+
+        internalBackupServiceImplSpy.prepareVmForSnapshotRevert(vmSnapshotMock);
+
+        verify(vmSnapshotMock).getVmId();
+        verify(virtualMachineManagerMock).findById(INSTANCE_ID);
+        verify(internalBackupServiceImplSpy).isBackupFrameworkDisabled(virtualMachineMock);
+        verify(internalBackupServiceImplSpy).getInternalBackupProviderForZone(ZONE_ID);
+        verify(internalBackupProviderMock).prepareVmForSnapshotRevert(vmSnapshotMock, virtualMachineMock);
+    }
+}
diff --git a/server/src/test/java/org/apache/cloudstack/cluster/ClusterDrsServiceImplTest.java b/server/src/test/java/org/apache/cloudstack/cluster/ClusterDrsServiceImplTest.java
index 98b18c663051..6390b29097b5 100644
--- a/server/src/test/java/org/apache/cloudstack/cluster/ClusterDrsServiceImplTest.java
+++ b/server/src/test/java/org/apache/cloudstack/cluster/ClusterDrsServiceImplTest.java
@@ -40,9 +40,11 @@
 import com.cloud.utils.Ternary;
 import com.cloud.utils.db.GlobalLock;
 import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.vm.VMInstanceDetailVO;
 import com.cloud.vm.VMInstanceVO;
 import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.VmDetailConstants;
+import com.cloud.vm.dao.VMInstanceDetailsDao;
 import com.cloud.vm.dao.VMInstanceDao;
 import org.apache.cloudstack.affinity.dao.AffinityGroupVMMapDao;
 import org.apache.cloudstack.api.command.admin.cluster.GenerateClusterDrsPlanCmd;
@@ -121,6 +123,9 @@ public class ClusterDrsServiceImplTest {
     @Mock
     private AffinityGroupVMMapDao affinityGroupVMMapDao;
 
+    @Mock
+    private VMInstanceDetailsDao vmInstanceDetailsDao;
+
     @Spy
     @InjectMocks
     private ClusterDrsServiceImpl clusterDrsService = new ClusterDrsServiceImpl();
@@ -294,6 +299,8 @@ public void testGetDrsPlanWithSystemVMs() throws ConfigurationException {
 
         List<Ternary<VirtualMachine, Host, Host>> result = clusterDrsService.getDrsPlan(cluster, 5);
         assertEquals(0, result.size());
+        Mockito.verify(managementServer, Mockito.never()).listHostsForMigrationOfVM(
+                Mockito.eq(systemVm), Mockito.anyLong(), Mockito.anyLong(), Mockito.any(), Mockito.anyList());
     }
 
     @Test
@@ -334,6 +341,8 @@ public void testGetDrsPlanWithNonRunningVMs() throws ConfigurationException {
 
         List<Ternary<VirtualMachine, Host, Host>> result = clusterDrsService.getDrsPlan(cluster, 5);
         assertEquals(0, result.size());
+        Mockito.verify(managementServer, Mockito.never()).listHostsForMigrationOfVM(
+                Mockito.eq(stoppedVm), Mockito.anyLong(), Mockito.anyLong(), Mockito.any(), Mockito.anyList());
     }
 
     @Test
@@ -350,9 +359,6 @@ public void testGetDrsPlanWithSkipDrsFlag() throws ConfigurationException {
         Mockito.when(skippedVm.getHostId()).thenReturn(1L);
         Mockito.when(skippedVm.getType()).thenReturn(VirtualMachine.Type.User);
         Mockito.when(skippedVm.getState()).thenReturn(VirtualMachine.State.Running);
-        Map<String, String> details = new HashMap<>();
-        details.put(VmDetailConstants.SKIP_DRS, "true");
-        Mockito.when(skippedVm.getDetails()).thenReturn(details);
 
         List<HostVO> hostList = new ArrayList<>();
         hostList.add(host1);
@@ -370,6 +376,11 @@ public void testGetDrsPlanWithSkipDrsFlag() throws ConfigurationException {
         Mockito.when(hostJoin1.getMemReservedCapacity()).thenReturn(0L);
         Mockito.when(hostJoin1.getTotalMemory()).thenReturn(8192L);
 
+        // Return the SKIP_DRS detail for skippedVm so the flag is actually honoured
+        VMInstanceDetailVO skipDrsDetail = new VMInstanceDetailVO(1L, VmDetailConstants.SKIP_DRS, "true", true);
+        Mockito.when(vmInstanceDetailsDao.listDetailsForResourceIdsAndKey(Mockito.anyList(),
+                Mockito.eq(VmDetailConstants.SKIP_DRS))).thenReturn(List.of(skipDrsDetail));
+
         Mockito.when(hostDao.findByClusterId(1L)).thenReturn(hostList);
         Mockito.when(vmInstanceDao.listByClusterId(1L)).thenReturn(vmList);
         Mockito.when(balancedAlgorithm.needsDrs(Mockito.any(), Mockito.anyList(), Mockito.anyList())).thenReturn(true);
@@ -377,6 +388,9 @@ public void testGetDrsPlanWithSkipDrsFlag() throws ConfigurationException {
 
         List<Ternary<VirtualMachine, Host, Host>> result = clusterDrsService.getDrsPlan(cluster, 5);
         assertEquals(0, result.size());
+        // Verify the VM was skipped before any host-compatibility lookup was attempted
+        Mockito.verify(managementServer, Mockito.never()).listHostsForMigrationOfVM(
+                Mockito.eq(skippedVm), Mockito.anyLong(), Mockito.anyLong(), Mockito.any(), Mockito.anyList());
     }
 
     @Test
@@ -393,7 +407,6 @@ public void testGetDrsPlanWithNoCompatibleHosts() throws ConfigurationException
         Mockito.when(vm1.getHostId()).thenReturn(1L);
         Mockito.when(vm1.getType()).thenReturn(VirtualMachine.Type.User);
         Mockito.when(vm1.getState()).thenReturn(VirtualMachine.State.Running);
-        Mockito.when(vm1.getDetails()).thenReturn(Collections.emptyMap());
 
         List<HostVO> hostList = new ArrayList<>();
         hostList.add(host1);
@@ -418,6 +431,10 @@ public void testGetDrsPlanWithNoCompatibleHosts() throws ConfigurationException
         Mockito.when(balancedAlgorithm.needsDrs(Mockito.any(), Mockito.anyList(), Mockito.anyList())).thenReturn(true);
         Mockito.when(serviceOfferingDao.findByIdIncludingRemoved(Mockito.anyLong(), Mockito.anyLong())).thenReturn(serviceOffering);
         Mockito.when(hostJoinDao.searchByIds(Mockito.any())).thenReturn(List.of(hostJoin1));
+        // Return a Ternary with an empty suitable-hosts list to exercise the "no compatible hosts" path
+        Mockito.when(managementServer.listHostsForMigrationOfVM(Mockito.eq(vm1), Mockito.anyLong(),
+                Mockito.anyLong(), Mockito.any(), Mockito.anyList()))
+                .thenReturn(new Ternary<>(new Pair<>(Collections.emptyList(), 0), Collections.emptyList(), Collections.emptyMap()));
 
         List<Ternary<VirtualMachine, Host, Host>> result = clusterDrsService.getDrsPlan(cluster, 5);
         assertEquals(0, result.size());
@@ -438,7 +455,6 @@ public void testGetDrsPlanWithExceptionInCompatibilityCheck() throws Configurati
         Mockito.when(vm1.getHostId()).thenReturn(1L);
         Mockito.when(vm1.getType()).thenReturn(VirtualMachine.Type.User);
         Mockito.when(vm1.getState()).thenReturn(VirtualMachine.State.Running);
-        Mockito.when(vm1.getDetails()).thenReturn(Collections.emptyMap());
 
         List<HostVO> hostList = new ArrayList<>();
         hostList.add(host1);
@@ -463,6 +479,10 @@ public void testGetDrsPlanWithExceptionInCompatibilityCheck() throws Configurati
         Mockito.when(balancedAlgorithm.needsDrs(Mockito.any(), Mockito.anyList(), Mockito.anyList())).thenReturn(true);
         Mockito.when(serviceOfferingDao.findByIdIncludingRemoved(Mockito.anyLong(), Mockito.anyLong())).thenReturn(serviceOffering);
         Mockito.when(hostJoinDao.searchByIds(Mockito.any())).thenReturn(List.of(hostJoin1));
+        // Throw an explicit exception so the catch-and-log path is exercised intentionally
+        Mockito.when(managementServer.listHostsForMigrationOfVM(Mockito.eq(vm1), Mockito.anyLong(),
+                Mockito.anyLong(), Mockito.any(), Mockito.anyList()))
+                .thenThrow(new RuntimeException("Simulated host compatibility check failure"));
 
         List<Ternary<VirtualMachine, Host, Host>> result = clusterDrsService.getDrsPlan(cluster, 5);
         assertEquals(0, result.size());
@@ -484,7 +504,6 @@ public void testGetDrsPlanWithNoBestMigration() throws ConfigurationException {
         Mockito.when(vm1.getHostId()).thenReturn(1L);
         Mockito.when(vm1.getType()).thenReturn(VirtualMachine.Type.User);
         Mockito.when(vm1.getState()).thenReturn(VirtualMachine.State.Running);
-        Mockito.when(vm1.getDetails()).thenReturn(Collections.emptyMap());
 
         List<HostVO> hostList = new ArrayList<>();
         hostList.add(host1);
@@ -539,14 +558,12 @@ public void testGetDrsPlanWithMultipleIterations() throws ConfigurationException
         Mockito.when(vm1.getHostId()).thenReturn(1L);
         Mockito.when(vm1.getType()).thenReturn(VirtualMachine.Type.User);
         Mockito.when(vm1.getState()).thenReturn(VirtualMachine.State.Running);
-        Mockito.when(vm1.getDetails()).thenReturn(Collections.emptyMap());
 
         VMInstanceVO vm2 = Mockito.mock(VMInstanceVO.class);
         Mockito.when(vm2.getId()).thenReturn(2L);
         Mockito.when(vm2.getHostId()).thenReturn(1L);
         Mockito.when(vm2.getType()).thenReturn(VirtualMachine.Type.User);
         Mockito.when(vm2.getState()).thenReturn(VirtualMachine.State.Running);
-        Mockito.when(vm2.getDetails()).thenReturn(Collections.emptyMap());
 
         List<HostVO> hostList = new ArrayList<>();
         hostList.add(host1);
@@ -617,7 +634,6 @@ public void testGetDrsPlanWithMigrationToOriginalHost() throws ConfigurationExce
         Mockito.when(vm1.getHostId()).thenReturn(1L);
         Mockito.when(vm1.getType()).thenReturn(VirtualMachine.Type.User);
         Mockito.when(vm1.getState()).thenReturn(VirtualMachine.State.Running);
-        Mockito.when(vm1.getDetails()).thenReturn(Collections.emptyMap());
 
         List<HostVO> hostList = new ArrayList<>();
         hostList.add(host1);
@@ -786,15 +802,9 @@ public void testGetBestMigration() throws ConfigurationException {
 
         VMInstanceVO vm1 = Mockito.mock(VMInstanceVO.class);
         Mockito.when(vm1.getId()).thenReturn(1L);
-        Mockito.when(vm1.getType()).thenReturn(VirtualMachine.Type.User);
-        Mockito.when(vm1.getState()).thenReturn(VirtualMachine.State.Running);
-        Mockito.when(vm1.getDetails()).thenReturn(Collections.emptyMap());
 
         VMInstanceVO vm2 = Mockito.mock(VMInstanceVO.class);
         Mockito.when(vm2.getId()).thenReturn(2L);
-        Mockito.when(vm2.getType()).thenReturn(VirtualMachine.Type.User);
-        Mockito.when(vm2.getState()).thenReturn(VirtualMachine.State.Running);
-        Mockito.when(vm2.getDetails()).thenReturn(Collections.emptyMap());
 
         List<VirtualMachine> vmList = new ArrayList<>();
         vmList.add(vm1);
@@ -865,15 +875,9 @@ public void testGetBestMigrationDifferentCluster() throws ConfigurationException
 
         VMInstanceVO vm1 = Mockito.mock(VMInstanceVO.class);
         Mockito.when(vm1.getId()).thenReturn(1L);
-        Mockito.when(vm1.getType()).thenReturn(VirtualMachine.Type.User);
-        Mockito.when(vm1.getState()).thenReturn(VirtualMachine.State.Running);
-        Mockito.when(vm1.getDetails()).thenReturn(Collections.emptyMap());
 
         VMInstanceVO vm2 = Mockito.mock(VMInstanceVO.class);
         Mockito.when(vm2.getId()).thenReturn(2L);
-        Mockito.when(vm2.getType()).thenReturn(VirtualMachine.Type.User);
-        Mockito.when(vm2.getState()).thenReturn(VirtualMachine.State.Running);
-        Mockito.when(vm2.getDetails()).thenReturn(Collections.emptyMap());
 
         List<VirtualMachine> vmList = new ArrayList<>();
         vmList.add(vm1);
diff --git a/server/src/test/java/org/apache/cloudstack/storage/heuristics/HeuristicRuleHelperTest.java b/server/src/test/java/org/apache/cloudstack/storage/heuristics/HeuristicRuleHelperTest.java
index 032e947fdce7..ece7e69f3f76 100644
--- a/server/src/test/java/org/apache/cloudstack/storage/heuristics/HeuristicRuleHelperTest.java
+++ b/server/src/test/java/org/apache/cloudstack/storage/heuristics/HeuristicRuleHelperTest.java
@@ -21,6 +21,7 @@
 import com.cloud.storage.VMTemplateVO;
 import com.cloud.storage.VolumeVO;
 import com.cloud.utils.exception.CloudRuntimeException;
+import org.apache.cloudstack.backup.BackupVO;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStore;
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreManager;
 import org.apache.cloudstack.engine.subsystem.api.storage.SnapshotInfo;
@@ -58,6 +59,9 @@ public class HeuristicRuleHelperTest {
     @Mock
     VolumeVO volumeVOMock;
 
+    @Mock
+    BackupVO backupVOMock;
+
     @Mock
     DataStoreManager dataStoreManagerMock;
 
@@ -165,6 +169,21 @@ public void buildPresetVariablesTestWithSnapshotHeuristicTypeShouldSetVolumeAndS
         Mockito.verify(heuristicRuleHelperSpy, Mockito.times(1)).injectPresetVariables(Mockito.isNull(), Mockito.any(PresetVariables.class));
     }
 
+    @Test
+    public void buildPresetVariablesTestWithBackupHeuristicTypeShouldSetBackupAndSecondaryStorageAndAccountPresetVariables() {
+        Mockito.doNothing().when(heuristicRuleHelperSpy).injectPresetVariables(Mockito.isNull(), Mockito.any(PresetVariables.class));
+        Mockito.doReturn(null).when(heuristicRuleHelperSpy).setBackupPresetVariable(Mockito.any(BackupVO.class));
+        Mockito.doReturn(null).when(heuristicRuleHelperSpy).setSecondaryStoragesVariable(Mockito.anyLong());
+        Mockito.doReturn(null).when(heuristicRuleHelperSpy).setAccountPresetVariable(Mockito.anyLong());
+
+        heuristicRuleHelperSpy.buildPresetVariables(null, HeuristicType.BACKUP, 1L, backupVOMock);
+
+        Mockito.verify(heuristicRuleHelperSpy, Mockito.times(1)).setBackupPresetVariable(Mockito.any(BackupVO.class));
+        Mockito.verify(heuristicRuleHelperSpy, Mockito.times(1)).setSecondaryStoragesVariable(Mockito.anyLong());
+        Mockito.verify(heuristicRuleHelperSpy, Mockito.times(1)).setAccountPresetVariable(Mockito.anyLong());
+        Mockito.verify(heuristicRuleHelperSpy, Mockito.times(1)).injectPresetVariables(Mockito.isNull(), Mockito.any(PresetVariables.class));
+    }
+
     @Test
     public void interpretHeuristicRuleTestHeuristicRuleDoesNotReturnAStringShouldThrowCloudRuntimeException() {
         String heuristicRule = "1";
diff --git a/services/secondary-storage/server/src/main/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResource.java b/services/secondary-storage/server/src/main/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResource.java
index 3c3f1f5747b8..4345ff24e3c5 100644
--- a/services/secondary-storage/server/src/main/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResource.java
+++ b/services/secondary-storage/server/src/main/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResource.java
@@ -57,6 +57,7 @@
 
 import org.apache.cloudstack.framework.security.keystore.KeystoreManager;
 import org.apache.cloudstack.storage.NfsMountManagerImpl.PathParser;
+import org.apache.cloudstack.storage.command.BackupDeleteAnswer;
 import org.apache.cloudstack.storage.command.CopyCmdAnswer;
 import org.apache.cloudstack.storage.command.CopyCommand;
 import org.apache.cloudstack.storage.command.DeleteCommand;
@@ -78,6 +79,7 @@
 import org.apache.cloudstack.storage.template.UploadEntity;
 import org.apache.cloudstack.storage.template.UploadManager;
 import org.apache.cloudstack.storage.template.UploadManagerImpl;
+import org.apache.cloudstack.storage.to.BackupDeltaTO;
 import org.apache.cloudstack.storage.to.SnapshotObjectTO;
 import org.apache.cloudstack.storage.to.TemplateObjectTO;
 import org.apache.cloudstack.storage.to.VolumeObjectTO;
@@ -2142,6 +2144,74 @@ protected Answer deleteSnapshot(final DeleteCommand cmd) {
 
     }
 
+    protected Answer deleteBackup(DeleteCommand cmd) {
+        BackupDeltaTO deltaTo = (BackupDeltaTO) cmd.getData();
+        NfsTO nfs = (NfsTO)deltaTo.getDataStore();
+        String parent = getRootDir(nfs.getUrl(), _nfsVersion);
+        if (!parent.endsWith(File.separator)) {
+            parent += File.separator;
+        }
+        String backupRelativePath = deltaTo.getPath();
+        if (backupRelativePath.startsWith(File.separator)) {
+            backupRelativePath = backupRelativePath.substring(1);
+        }
+
+        String fullDeltaPath = parent + backupRelativePath;
+        File deltaFile = new File(fullDeltaPath);
+        logger.debug("Deleting backup at [{}].", fullDeltaPath);
+        String deltaDeleteResult = deleteLocalFile(fullDeltaPath);
+
+        String details;
+        if (deltaDeleteResult != null) {
+            details = String.format("Failed to delete backup delta [%s] with result [%s]. ", fullDeltaPath, deltaDeleteResult);
+            logger.warn(details);
+            return new BackupDeleteAnswer(cmd, false, details);
+        }
+
+        String screenshotRelativePath = deltaTo.getScreenshotPath();
+        BackupDeleteAnswer answer = deleteScreenshot(cmd, screenshotRelativePath, parent);
+        if (answer != null) {
+            return answer;
+        }
+
+        File deltaDir = deltaFile.getParentFile();
+        if (!deleteEmptyDirectory(deltaDir)) {
+            details = String.format("Unable to delete directory [%s] at path [%s].", deltaDir.getName(), deltaDir.getPath());
+            logger.debug(details);
+            return new BackupDeleteAnswer(cmd, false, details);
+        }
+
+        return new Answer(cmd, true, null);
+    }
+
+    protected BackupDeleteAnswer deleteScreenshot(DeleteCommand cmd, String screenshotRelativePath, String parent) {
+        if (screenshotRelativePath == null) {
+            return null;
+        }
+        if (screenshotRelativePath.startsWith(File.separator)) {
+            screenshotRelativePath = screenshotRelativePath.substring(1);
+        }
+        String fullScreenshotPath = parent + screenshotRelativePath;
+        logger.debug("Deleting screenshot at [{}].", fullScreenshotPath);
+        String screenshotDeleteResult = deleteLocalFile(fullScreenshotPath);
+        if (screenshotDeleteResult != null) {
+            String details = String.format("Failed to delete backup validation screenshot [%s] with result [%s]. ", fullScreenshotPath, screenshotDeleteResult);
+            logger.warn(details);
+            return new BackupDeleteAnswer(cmd, false, details);
+        }
+        return null;
+    }
+
+    protected boolean deleteEmptyDirectory(File dir) {
+        if (dir == null || !dir.isDirectory()) {
+            return true;
+        }
+        if (dir.list().length > 0) {
+            return true;
+        }
+        return dir.delete();
+    }
+
     private String deleteCheckpointIfExists(DataTO obj, String parent) {
         SnapshotObjectTO snapshotObjectTO = (SnapshotObjectTO) obj;
         String checkpointPath = snapshotObjectTO.getCheckpointPath();
@@ -2333,7 +2403,7 @@ private Answer execute(SecStorageVMSetupCommand cmd) {
 
     }
 
-    private String deleteLocalFile(String fullPath) {
+    protected String deleteLocalFile(String fullPath) {
         Script command = new Script("/bin/bash", logger);
         command.add("-c");
         command.add("rm -rf " + fullPath);
@@ -2468,6 +2538,8 @@ protected Answer execute(final DeleteCommand cmd) {
             return deleteVolume(cmd);
         case SNAPSHOT:
             return deleteSnapshot(cmd);
+        case BACKUP:
+            return deleteBackup(cmd);
         }
         return Answer.createUnsupportedCommandAnswer(cmd);
     }
diff --git a/services/secondary-storage/server/src/test/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResourceTest.java b/services/secondary-storage/server/src/test/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResourceTest.java
index 5917e1287639..4ed6001d3b7e 100644
--- a/services/secondary-storage/server/src/test/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResourceTest.java
+++ b/services/secondary-storage/server/src/test/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResourceTest.java
@@ -18,9 +18,15 @@
  */
 package org.apache.cloudstack.storage.resource;
 
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.doThrow;
 import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
 
 import java.io.File;
 import java.nio.file.Files;
@@ -30,9 +36,13 @@
 import java.util.Map;
 import java.util.stream.Stream;
 
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.to.NfsTO;
+import org.apache.cloudstack.storage.command.BackupDeleteAnswer;
 import org.apache.cloudstack.storage.command.DeleteCommand;
 import org.apache.cloudstack.storage.command.QuerySnapshotZoneCopyAnswer;
 import org.apache.cloudstack.storage.command.QuerySnapshotZoneCopyCommand;
+import org.apache.cloudstack.storage.to.BackupDeltaTO;
 import org.apache.cloudstack.storage.to.SnapshotObjectTO;
 import org.apache.cloudstack.storage.to.TemplateObjectTO;
 import org.apache.logging.log4j.Logger;
@@ -76,6 +86,15 @@ public class NfsSecondaryStorageResourceTest {
     @Mock
     private Logger loggerMock;
 
+    @Mock
+    private DeleteCommand deleteCommandMock;
+
+    @Mock
+    private BackupDeltaTO backupDeltaTOMock;
+
+    @Mock
+    private NfsTO nfsMock;
+
     @Test
     public void testSwiftWriteMetadataFile() throws Exception {
         String metaFileName = "test_metadata_file";
@@ -87,7 +106,7 @@ public void testSwiftWriteMetadataFile() throws Exception {
 
             File metaFile = resource.swiftWriteMetadataFile(metaFileName, uniqueName, filename, size, virtualSize);
 
-            Assert.assertTrue(metaFile.exists());
+            assertTrue(metaFile.exists());
             Assert.assertEquals(metaFileName, metaFile.getName());
 
             String expectedContent = "uniquename=" + uniqueName + "\n" +
@@ -114,7 +133,7 @@ public void testCleanupStagingNfs() throws Exception{
 
         spyResource.cleanupStagingNfs(mockTemplate);
 
-        Mockito.verify(loggerMock, times(1)).debug("Failed to clean up staging area:", exception);
+        verify(loggerMock, times(1)).debug("Failed to clean up staging area:", exception);
 
     }
 
@@ -164,8 +183,8 @@ public void testExecuteQuerySnapshotZoneCopyCommand() {
     }
 
     private void prepareForValidatePostUploadRequestSignatureTests(MockedStatic<EncryptionUtil> encryptionUtilMock) {
-        Mockito.doReturn(PROTOCOL).when(resource).getUploadProtocol();
-        Mockito.doReturn(PSK).when(resource).getPostUploadPSK();
+        doReturn(PROTOCOL).when(resource).getUploadProtocol();
+        doReturn(PSK).when(resource).getPostUploadPSK();
         encryptionUtilMock.when(() -> EncryptionUtil.generateSignature(Mockito.anyString(), Mockito.anyString())).thenReturn(COMPUTED_SIGNATURE);
         String fullUrl = String.format("%s://%s/upload/%s", PROTOCOL, HOSTNAME, UUID);
         String data = String.format("%s%s%s", METADATA, fullUrl, TIMEOUT);
@@ -176,7 +195,7 @@ private void prepareForValidatePostUploadRequestSignatureTests(MockedStatic<Encr
     public void validatePostUploadRequestSignatureTestThrowExceptionWhenProtocolDiffers() {
         try (MockedStatic<EncryptionUtil> encryptionUtilMock = Mockito.mockStatic(EncryptionUtil.class)) {
             prepareForValidatePostUploadRequestSignatureTests(encryptionUtilMock);
-            Mockito.doReturn(NetUtils.HTTPS_PROTO).when(resource).getUploadProtocol();
+            doReturn(NetUtils.HTTPS_PROTO).when(resource).getUploadProtocol();
 
             resource.validatePostUploadRequestSignature(EXPECTED_SIGNATURE, HOSTNAME, UUID, METADATA, TIMEOUT);
         }
@@ -229,7 +248,7 @@ public void validatePostUploadRequestSignatureTestSuccessWhenDataIsTheSame() {
 
     @Test
     public void getUploadProtocolTestReturnHttpsWhenUseHttpsToUploadIsTrue() {
-        Mockito.doReturn(true).when(resource).useHttpsToUpload();
+        doReturn(true).when(resource).useHttpsToUpload();
 
         String result = resource.getUploadProtocol();
 
@@ -238,7 +257,7 @@ public void getUploadProtocolTestReturnHttpsWhenUseHttpsToUploadIsTrue() {
 
     @Test
     public void getUploadProtocolTestReturnHttpWhenUseHttpsToUploadIsFalse() {
-        Mockito.doReturn(false).when(resource).useHttpsToUpload();
+        doReturn(false).when(resource).useHttpsToUpload();
 
         String result = resource.getUploadProtocol();
 
@@ -281,8 +300,111 @@ public void configureStorageNetworkDoesNotSetStorageNetworkWhenNotInSystemVMAndS
         Map<String, Object> params = new HashMap<>();
         resource._inSystemVM = false;
         resource.configureStorageNetwork(params);
-        Assert.assertNull(ReflectionTestUtils.getField(resource, "_storageIp"));
-        Assert.assertNull(ReflectionTestUtils.getField(resource, "_storageNetmask"));
-        Assert.assertNull(ReflectionTestUtils.getField(resource, "_storageGateway"));
+        assertNull(ReflectionTestUtils.getField(resource, "_storageIp"));
+        assertNull(ReflectionTestUtils.getField(resource, "_storageNetmask"));
+        assertNull(ReflectionTestUtils.getField(resource, "_storageGateway"));
+    }
+
+
+    @Test
+    public void deleteBackupTestSuccess() {
+        doReturn(backupDeltaTOMock).when(deleteCommandMock).getData();
+        doReturn(nfsMock).when(backupDeltaTOMock).getDataStore();
+        doReturn("asd").when(nfsMock).getUrl();
+
+        doReturn("fds").when(resource).getRootDir(any(), any());
+        doReturn("path/to/delta").when(backupDeltaTOMock).getPath();
+        doReturn(null).when(resource).deleteLocalFile(any());
+        doReturn(null).when(resource).deleteScreenshot(any(), any(), any());
+
+        Answer answer = resource.deleteBackup(deleteCommandMock);
+
+        assertTrue(answer.getResult());
+    }
+
+    @Test
+    public void deleteBackupTestDeleteDeltaFails() {
+        doReturn(backupDeltaTOMock).when(deleteCommandMock).getData();
+        doReturn(nfsMock).when(backupDeltaTOMock).getDataStore();
+        doReturn("asd").when(nfsMock).getUrl();
+
+        doReturn("fds").when(resource).getRootDir(any(), any());
+        doReturn("path/to/delta").when(backupDeltaTOMock).getPath();
+        doReturn("error").when(resource).deleteLocalFile(any());
+
+        Answer answer = resource.deleteBackup(deleteCommandMock);
+
+        assertFalse(answer.getResult());
+    }
+
+    @Test
+    public void deleteBackupTestScreenshotFailure() {
+        doReturn(backupDeltaTOMock).when(deleteCommandMock).getData();
+        doReturn(nfsMock).when(backupDeltaTOMock).getDataStore();
+        doReturn("asd").when(nfsMock).getUrl();
+
+        doReturn("fds").when(resource).getRootDir(any(), any());
+        doReturn("path/to/delta").when(backupDeltaTOMock).getPath();
+        doReturn(null).when(resource).deleteLocalFile(any());
+
+        BackupDeleteAnswer failureAnswer = new BackupDeleteAnswer(deleteCommandMock, false, "fail");
+        doReturn(failureAnswer).when(resource).deleteScreenshot(any(), any(), any());
+
+        Answer answer = resource.deleteBackup(deleteCommandMock);
+
+        assertFalse(answer.getResult());
+    }
+
+    @Test
+    public void deleteBackupTestDirectoryDeletionFails() {
+        doReturn(backupDeltaTOMock).when(deleteCommandMock).getData();
+        doReturn(nfsMock).when(backupDeltaTOMock).getDataStore();
+        doReturn("asd").when(nfsMock).getUrl();
+
+        doReturn("fds").when(resource).getRootDir(any(), any());
+        doReturn("path/to/delta").when(backupDeltaTOMock).getPath();
+        doReturn(null).when(resource).deleteLocalFile(any());
+        doReturn(null).when(resource).deleteScreenshot(any(), any(), any());
+        doReturn(false).when(resource).deleteEmptyDirectory(any());
+
+        Answer answer = resource.deleteBackup(deleteCommandMock);
+
+        assertFalse(answer.getResult());
+    }
+
+    @Test
+    public void deleteScreenshotTestNullPath() {
+        BackupDeleteAnswer answer = resource.deleteScreenshot(deleteCommandMock, null, "/root/");
+
+        assertNull(answer);
+    }
+
+    @Test
+    public void deleteScreenshotTestSuccess() {
+        doReturn(null).when(resource).deleteLocalFile(any());
+
+        BackupDeleteAnswer answer = resource.deleteScreenshot(deleteCommandMock, "path/to/file", "/root/");
+
+        assertNull(answer);
+    }
+
+    @Test
+    public void deleteScreenshotTestFailure() {
+        doReturn("error").when(resource).deleteLocalFile(any());
+        doReturn(backupDeltaTOMock).when(deleteCommandMock).getData();
+
+        BackupDeleteAnswer answer = resource.deleteScreenshot(deleteCommandMock, "path/to/file", "/root/");
+
+        assertNotNull(answer);
+        assertFalse(answer.getResult());
+    }
+
+    @Test
+    public void deleteScreenshotTestPathStartsWithSeparator() {
+        doReturn(null).when(resource).deleteLocalFile(any());
+
+        resource.deleteScreenshot(deleteCommandMock, File.separator + "path/to/file", "/root/");
+
+        verify(resource).deleteLocalFile("/root/" + "path/to/file");
     }
 }
diff --git a/systemvm/debian/opt/cloud/bin/configure.py b/systemvm/debian/opt/cloud/bin/configure.py
index bf48be66694c..77b56779d5b8 100755
--- a/systemvm/debian/opt/cloud/bin/configure.py
+++ b/systemvm/debian/opt/cloud/bin/configure.py
@@ -703,14 +703,139 @@ def process(self):
             self.add_routing_rules()
             return
 
+        desired_firewall_ips = set()
+        fw_chains_created = set()
+        if self.config.is_vpc() and self.config.is_vpc_firewall_enabled():
+            desired_firewall_ips = self._get_desired_vpc_firewall_ips()
+            # Pre-create FIREWALL chains for ALL public IPs that have any active rule
+            # (static NAT, port forwarding, LB, or explicit firewall rule) so that the
+            # default DROP is always in place even before any explicit firewall rule exists.
+            self._ensure_vpc_firewall_chains(desired_firewall_ips, fw_chains_created)
+
         for item in self.dbag:
             if item == "id":
                 continue
-            if self.config.is_vpc():
+            if self.config.is_vpc() and not ("purpose" in self.dbag[item] and self.dbag[item]["purpose"] == "Firewall"):
                 self.AclDevice(self.dbag[item], self.config).create()
             else:
+                if self.config.is_vpc() and self.dbag[item].get("purpose") == "Firewall" and not self.config.is_vpc_firewall_enabled():
+                    continue
+                # Chain skeleton is already ensured by the pre-creation pass above;
+                # _ensure_vpc_firewall_chains is idempotent (skips IPs in fw_chains_created).
+                if self.config.is_vpc() and self.config.is_vpc_firewall_enabled() and self.dbag[item].get("purpose") == "Firewall":
+                    src_ip = self.dbag[item].get("src_ip")
+                    self._ensure_vpc_firewall_chains([src_ip], fw_chains_created)
                 self.AclIP(self.dbag[item], self.config).create()
 
+        if self.config.is_vpc() and self.config.is_vpc_firewall_enabled():
+            self._cleanup_removed_vpc_firewall_chains(desired_firewall_ips)
+
+    def _get_desired_vpc_firewall_ips(self):
+        """
+        Collect the full set of public IPs that should have a FIREWALL mangle chain
+        in a VPC with firewall capability. This includes IPs from explicit firewall
+        rules, forwarding/static-NAT rules, and load-balancer rules.
+        """
+        if not self.config.is_vpc():
+            return set()
+
+        ips = set()
+        ips.update(self._get_firewall_rule_ips())
+        ips.update(self._get_forwarding_rule_ips())
+        ips.update(self._get_loadbalancer_ips())
+        return ips
+
+    def _get_firewall_rule_ips(self):
+        """Return public IPs that have explicit firewall rules in this data bag."""
+        ips = set()
+        for item in self.dbag:
+            if item == "id":
+                continue
+            rule = self.dbag[item]
+            if rule.get("purpose") == "Firewall":
+                src_ip = rule.get("src_ip")
+                if src_ip:
+                    ips.add(src_ip)
+        return ips
+
+    def _get_forwarding_rule_ips(self):
+        """
+        Return public IPs from the forwardingrules bag (static NAT and port forwarding).
+        That bag is keyed by public IP, so each key (other than 'id') is a public IP.
+        """
+        ips = set()
+        try:
+            fwd_bag = CsDataBag("forwardingrules", self.config)
+            for public_ip in fwd_bag.get_bag():
+                if public_ip == "id":
+                    continue
+                ips.add(public_ip)
+        except Exception as e:
+            logging.debug("Could not load forwardingrules for VPC firewall chain collection: %s", e)
+        return ips
+
+    def _get_loadbalancer_ips(self):
+        """
+        Return public IPs from the loadbalancer bag.
+        add_rules entries are formatted as 'ip:port', so the IP is the first segment.
+        """
+        ips = set()
+        try:
+            lb_bag = CsDataBag("loadbalancer", self.config)
+            lb_data = lb_bag.get_bag()
+            if "config" in lb_data and lb_data["config"]:
+                for rule_str in lb_data["config"][0].get("add_rules", []):
+                    ip = rule_str.split(":")[0]
+                    if ip:
+                        ips.add(ip)
+        except Exception as e:
+            logging.debug("Could not load loadbalancer for VPC firewall chain collection: %s", e)
+        return ips
+
+    def _ensure_vpc_firewall_chains(self, source_ips, fw_chains_created):
+        fw = self.config.get_fw()
+        for src_ip in source_ips:
+            if not src_ip or src_ip in fw_chains_created:
+                continue
+            fw.append(["mangle", "front",
+                       "-A PREROUTING -d %s/32 -j FIREWALL_%s" % (src_ip, src_ip)])
+            fw.append(["mangle", "front",
+                       "-A FIREWALL_%s -m state --state RELATED,ESTABLISHED -j RETURN" % src_ip])
+            fw.append(["mangle", "",
+                       "-A FIREWALL_%s -j DROP" % src_ip])
+            fw_chains_created.add(src_ip)
+
+    def _cleanup_removed_vpc_firewall_chains(self, desired_firewall_ips):
+        try:
+            mangle_save = CsHelper.execute("iptables-save -t mangle")
+            existing_firewall_ips = []
+            for line in mangle_save:
+                if line.startswith(":FIREWALL_"):
+                    chain = line.split(" ")[0][1:]
+                    existing_firewall_ips.append(chain.replace("FIREWALL_", "", 1))
+
+            for src_ip in existing_firewall_ips:
+                if src_ip in desired_firewall_ips:
+                    continue
+                self._delete_vpc_firewall_chain(src_ip)
+        except Exception as e:
+            logging.debug("Failed VPC firewall chain cleanup: %s", e)
+
+    def _delete_vpc_firewall_chain(self, src_ip):
+        chain = "FIREWALL_%s" % src_ip
+        try:
+            prerouting_rules = CsHelper.execute("iptables -t mangle -S PREROUTING")
+            for rule in prerouting_rules:
+                if ("-d %s/32" % src_ip) in rule and ("-j %s" % chain) in rule:
+                    delete_rule = rule.replace("-A PREROUTING", "-D PREROUTING", 1)
+                    CsHelper.execute2("iptables -t mangle %s" % delete_rule, False)
+
+            CsHelper.execute2("iptables -t mangle -F %s" % chain, False)
+            CsHelper.execute2("iptables -t mangle -X %s" % chain, False)
+            logging.info("Deleted VPC firewall chain %s as last firewall rule was removed", chain)
+        except Exception as e:
+            logging.debug("Failed deleting VPC firewall chain %s: %s", chain, e)
+
 class CsIpv6Firewall(CsDataBag):
     """
         Deal with IPv6 Firewall
diff --git a/systemvm/debian/opt/cloud/bin/cs/CsAddress.py b/systemvm/debian/opt/cloud/bin/cs/CsAddress.py
index 37ca8979edc7..fe95808f7d32 100755
--- a/systemvm/debian/opt/cloud/bin/cs/CsAddress.py
+++ b/systemvm/debian/opt/cloud/bin/cs/CsAddress.py
@@ -680,6 +680,7 @@ def fw_vpcrouter(self):
         self.fw.append(["filter", "", "-P INPUT DROP"])
         self.fw.append(["filter", "", "-P FORWARD DROP"])
 
+
     def fw_router_routing(self):
         if self.config.is_vpc() or not self.config.is_routed():
             return
diff --git a/systemvm/debian/opt/cloud/bin/cs/CsConfig.py b/systemvm/debian/opt/cloud/bin/cs/CsConfig.py
index 549b08f75fc6..5218e8111161 100755
--- a/systemvm/debian/opt/cloud/bin/cs/CsConfig.py
+++ b/systemvm/debian/opt/cloud/bin/cs/CsConfig.py
@@ -155,3 +155,6 @@ def get_egress_table(self):
 
     def has_public_network(self):
         return self.cmdline().idata().get('has_public_network', 'true') == 'true'
+
+    def is_vpc_firewall_enabled(self):
+        return self.cmdline().idata().get('vpc_firewall_enabled', 'false') == 'true'
diff --git a/systemvm/debian/opt/cloud/bin/cs/CsDhcp.py b/systemvm/debian/opt/cloud/bin/cs/CsDhcp.py
index a2309067289d..4840b5ed724c 100755
--- a/systemvm/debian/opt/cloud/bin/cs/CsDhcp.py
+++ b/systemvm/debian/opt/cloud/bin/cs/CsDhcp.py
@@ -199,12 +199,14 @@ def write_hosts(self):
 
     def add(self, entry):
         self.add_host(entry['ipv4_address'], entry['host_name'])
-        # Lease time set to "infinite" since we properly control all DHCP/DNS config via CloudStack.
+        # Lease time is configurable via CloudStack global config dhcp.lease.timeout
+        # 0 = infinite (default), otherwise the value represents seconds
         # Infinite time helps avoid some edge cases which could cause DHCPNAK being sent to VMs since
         # (RHEL) system lose routes when they receive DHCPNAK.
         # When VM is expunged, its active lease and DHCP/DNS config is properly removed from related files in VR,
         # so the infinite duration of lease does not cause any issues or garbage.
-        lease = 'infinite'
+        lease_time = entry.get('lease_time', 0)
+        lease = 'infinite' if lease_time == 0 else str(lease_time)
 
         if entry['default_entry']:
             self.dhcp_hosts.add("%s,%s,%s,%s" % (entry['mac_address'],
diff --git a/systemvm/debian/opt/cloud/bin/edithosts.sh b/systemvm/debian/opt/cloud/bin/edithosts.sh
index 6f66331c88e3..976f009c2b12 100755
--- a/systemvm/debian/opt/cloud/bin/edithosts.sh
+++ b/systemvm/debian/opt/cloud/bin/edithosts.sh
@@ -21,7 +21,7 @@
 # edithosts.sh -- edit the dhcphosts file on the routing domain
 
 usage() {
-  printf "Usage: %s: -m <MAC address> -4 <IPv4 address> -6 <IPv6 address> -h <hostname> -d <default router> -n <name server address> -s <Routes> -u <DUID> [-N]\n" $(basename $0) >&2
+  printf "Usage: %s: -m <MAC address> -4 <IPv4 address> -6 <IPv6 address> -h <hostname> -d <default router> -n <name server address> -s <Routes> -u <DUID> -l <lease time> [-N]\n" $(basename $0) >&2
 }
 
 mac=
@@ -33,8 +33,9 @@ dns=
 routes=
 duid=
 nondefault=
+lease_time=infinite
 
-while getopts 'm:4:h:d:n:s:6:u:N' OPTION
+while getopts 'm:4:h:d:n:s:6:u:l:N' OPTION
 do
   case $OPTION in
   m)    mac="$OPTARG"
@@ -53,6 +54,8 @@ do
         ;;
   s)    routes="$OPTARG"
         ;;
+  l)    lease_time="$OPTARG"
+        ;;
   N)    nondefault=1
         ;;
   ?)    usage
@@ -124,17 +127,21 @@ fi
 sed -i  /$host,/d $DHCP_HOSTS
 
 #put in the new entry
+# If lease_time is 0, use 'infinite', otherwise use the value
+if [ "$lease_time" = "0" ]; then
+  lease_time=infinite
+fi
 if [ $ipv4 ]
 then
-  echo "$mac,$ipv4,$host,infinite" >>$DHCP_HOSTS
+  echo "$mac,$ipv4,$host,$lease_time" >>$DHCP_HOSTS
 fi
 if [ $ipv6 ]
 then
   if [ $nondefault ]
   then
-    echo "id:$duid,set:nondefault6,[$ipv6],$host,infinite" >>$DHCP_HOSTS
+    echo "id:$duid,set:nondefault6,[$ipv6],$host,$lease_time" >>$DHCP_HOSTS
   else
-    echo "id:$duid,[$ipv6],$host,infinite" >>$DHCP_HOSTS
+    echo "id:$duid,[$ipv6],$host,$lease_time" >>$DHCP_HOSTS
   fi
 fi
 
diff --git a/test/integration/component/test_vpc_offerings.py b/test/integration/component/test_vpc_offerings.py
index 25206cfe1569..a47bc119a88c 100644
--- a/test/integration/component/test_vpc_offerings.py
+++ b/test/integration/component/test_vpc_offerings.py
@@ -868,10 +868,10 @@ def test_06_vpc_off_invalid_services(self):
 
         # Validate the following
         # 1. Creating VPC Offering with services NOT supported by VPC
-        #    like Firewall should not be allowed
+        #    like SecurityGroup should not be allowed
 
-        self.logger.debug("Creating a VPC offering with Firewall")
-        self.services["vpc_offering"]["supportedservices"] = 'Dhcp,Dns,PortForwarding,Firewall,Vpn,SourceNat,Lb,UserData,StaticNat'
+        self.logger.debug("Creating a VPC offering with SecurityGroup")
+        self.services["vpc_offering"]["supportedservices"] = 'Dhcp,Dns,PortForwarding,SecurityGroup,Vpn,SourceNat,Lb,UserData,StaticNat'
 
         with self.assertRaises(Exception):
             VpcOffering.create(
diff --git a/test/integration/plugins/linstor/README.md b/test/integration/plugins/linstor/README.md
index 4505d1b7d57c..4971c9506b5b 100644
--- a/test/integration/plugins/linstor/README.md
+++ b/test/integration/plugins/linstor/README.md
@@ -48,3 +48,21 @@ nosetests --with-marvin --marvin-config=<marvin-cfg-file> <cloudstack-dir>/test/
 ```
 
 You can also run these tests out of the box with PyDev or PyCharm or whatever.
+
+## Encrypted snapshot tests
+
+`test_linstor_encrypted_snapshots.py` covers the encrypted-volume snapshot round trip
+(create encrypted root disk -> snapshot -> revert / create-volume-from-snapshot) and that the
+backed-up qcow2 on secondary storage is itself LUKS encrypted.
+
+Extra prerequisites:
+
+* At least one KVM host with volume-encryption support (`host.encryptionsupported == true`, i.e.
+  cryptsetup/qemu LUKS available). Tests self-skip if none is found.
+* The Linstor resource group used (`acs-basic`) must be able to add a LUKS layer to its volumes.
+* `lin.backup.snapshots` must be enabled (default) so snapshots are backed up to secondary storage;
+  the test sets it. With it disabled the qcow2 path is not exercised.
+
+```
+nosetests --with-marvin --marvin-config=<marvin-cfg-file> <cloudstack-dir>/test/integration/plugins/linstor/test_linstor_encrypted_snapshots.py --zone=<zone> --hypervisor=kvm
+```
diff --git a/test/integration/plugins/linstor/test_linstor_encrypted_snapshots.py b/test/integration/plugins/linstor/test_linstor_encrypted_snapshots.py
new file mode 100644
index 000000000000..5f440309bb34
--- /dev/null
+++ b/test/integration/plugins/linstor/test_linstor_encrypted_snapshots.py
@@ -0,0 +1,444 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+import json
+import logging
+import os
+import random
+import socket
+import time
+
+# All tests inherit from cloudstackTestCase
+from marvin.cloudstackTestCase import cloudstackTestCase
+
+# Import Integration Libraries
+from marvin.cloudstackAPI import createVolume
+from marvin.cloudstackException import CloudstackAPIException
+from marvin.lib.base import Account, Configurations, Host, ServiceOffering, \
+    Snapshot, StoragePool, User, VirtualMachine, Volume
+from marvin.lib.common import get_domain, get_template, get_zone, list_hosts, list_virtual_machines, list_volumes
+from marvin.lib.utils import cleanup_resources
+from marvin.sshClient import SshClient
+from nose.plugins.attrib import attr
+
+# Prerequisites:
+#  Only one zone / pod / cluster
+#  Only KVM hypervisor (Linstor only supports KVM)
+#  At least one KVM host with volume-encryption support (host.encryptionsupported == True),
+#    i.e. cryptsetup/qemu with LUKS available on the host.
+#  One Linstor storage pool whose resource-group can add a LUKS layer (encrypted volumes).
+#  'lin.backup.snapshots' enabled (default true) so snapshots are backed up to secondary storage
+#    as qcow2 -- that is the path these tests are meant to exercise. With it disabled, snapshots
+#    stay on primary as Linstor system snapshots and a different (rollback) code path is used.
+#
+# What this exercises (the encrypted-snapshot round trip):
+#  * backup:  decrypted DRBD device  -> LUKS-encrypted qcow2 on secondary
+#  * revert:  encrypted qcow2        -> decrypted, written to the DRBD device (Linstor re-encrypts)
+#  * create:  encrypted qcow2        -> new volume via createVolumeFromSnapshot (KVMStorageProcessor)
+#
+# Note on verification: Linstor encrypts inside the DRBD stack (LUKS layer), so the libvirt domain
+# XML does NOT carry <encryption format='luks'> like hypervisor-based encryption does. Correctness
+# is therefore verified by a data round trip (write marker -> snapshot -> change -> restore -> read),
+# and encryption-at-rest is verified by inspecting the backed-up qcow2 with 'qemu-img info'.
+
+MARKER_PATH = "/root/cs_enc_marker.txt"
+
+
+class TestData:
+    account = "account"
+    computeOffering = "computeoffering"
+    diskName = "diskname"
+    domainId = "domainId"
+    hypervisor = "hypervisor"
+    provider = "provider"
+    scope = "scope"
+    storageTag = "linstor"
+    tags = "tags"
+    user = "user"
+    virtualMachine = "virtualmachine"
+    zoneId = "zoneId"
+
+    def __init__(self, linstor_controller_url):
+        self.testdata = {
+            TestData.account: {
+                "email": "test-enc@test.com",
+                "firstname": "John",
+                "lastname": "Doe",
+                "username": "test-enc",
+                "password": "test"
+            },
+            TestData.user: {
+                "email": "user-enc@test.com",
+                "firstname": "Jane",
+                "lastname": "Doe",
+                "username": "test-enc-user",
+                "password": "password"
+            },
+            "primarystorage": {
+                "name": "LinstorEncPool-%d" % random.randint(0, 100000),
+                TestData.scope: "ZONE",
+                "url": linstor_controller_url,
+                TestData.provider: "Linstor",
+                TestData.tags: TestData.storageTag,
+                TestData.hypervisor: "KVM",
+                "details": {
+                    "resourceGroup": "acs-basic"
+                }
+            },
+            TestData.virtualMachine: {
+                "name": "TestEncVM",
+                "displayname": "Test Encrypted VM"
+            },
+            # encryptroot=True is passed as a create kwarg, not in this dict
+            TestData.computeOffering: {
+                "name": "Linstor_Compute_Encrypted",
+                "displaytext": "Linstor_Compute_Encrypted",
+                "cpunumber": 1,
+                "cpuspeed": 500,
+                "memory": 512,
+                "storagetype": "shared",
+                TestData.tags: TestData.storageTag
+            },
+            TestData.diskName: "restored-from-enc-snap",
+            TestData.zoneId: 1,
+            TestData.domainId: 1,
+        }
+
+
+class ServiceReady:
+    @classmethod
+    def ready(cls, hostname, port):
+        try:
+            s = socket.create_connection((hostname, port), timeout=1)
+            s.close()
+            return True
+        except (ConnectionRefusedError, socket.timeout, OSError):
+            return False
+
+    @classmethod
+    def wait(cls, hostname, port, wait_interval=5, timeout=120, service_name='ssh'):
+        starttime = int(round(time.time() * 1000))
+        while not cls.ready(hostname, port):
+            if starttime + timeout * 1000 < int(round(time.time() * 1000)):
+                raise RuntimeError("{s} {h} cannot be reached.".format(s=service_name, h=hostname))
+            time.sleep(wait_interval)
+        return True
+
+    @classmethod
+    def wait_ssh_ready(cls, hostname, wait_interval=2, timeout=120):
+        return cls.wait(hostname, 22, wait_interval, timeout, "ssh")
+
+
+class TestLinstorEncryptedSnapshots(cloudstackTestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        testclient = super(TestLinstorEncryptedSnapshots, cls).getClsTestClient()
+
+        cls.apiClient = testclient.getApiClient()
+        cls.dbConnection = testclient.getDbConnection()
+
+        cls._cleanup = []
+        cls.skip_reason = None
+
+        # Linstor is KVM-only, so the hypervisor type is not probed via getHypervisorInfo() (which is
+        # only populated when nosetests is invoked with --hypervisor). Instead we require an actual KVM
+        # host that supports volume encryption below.
+
+        # The first host runs the Linstor controller (per the Linstor test prerequisites).
+        first_host = list_hosts(cls.apiClient)[0]
+        cls.testdata = TestData(first_host.ipaddress).testdata
+
+        cls.zone = get_zone(cls.apiClient, zone_id=cls.testdata[TestData.zoneId])
+        cls.domain = get_domain(cls.apiClient, cls.testdata[TestData.domainId])
+        cls.template = get_template(cls.apiClient, cls.zone.id, hypervisor="KVM")
+
+        # Host SSH credentials, only needed by test_03 to inspect the backed-up qcow2 on secondary
+        # storage. A full marvin config carries these under zones->pods->clusters->hosts, but a
+        # lightweight config may omit them; in that case fall back to HOST_SSH_USER / HOST_SSH_PASSWORD
+        # env vars. Never fail class setup over this - the other tests don't need host SSH.
+        cls.hostConfig = None
+        try:
+            cls.hostConfig = cls.config.__dict__["zones"][0].__dict__["pods"][0].__dict__["clusters"][0] \
+                .__dict__["hosts"][0].__dict__
+        except (KeyError, IndexError, AttributeError, TypeError):
+            host_user = os.environ.get("HOST_SSH_USER")
+            host_pass = os.environ.get("HOST_SSH_PASSWORD")
+            if host_user and host_pass:
+                cls.hostConfig = {"username": host_user, "password": host_pass}
+
+        if not cls._encryption_capable_host_exists():
+            cls.skip_reason = "No KVM host with volume-encryption support found"
+            return
+
+        # Ensure snapshots are backed up to secondary storage (the path under test).
+        Configurations.update(cls.apiClient, name="lin.backup.snapshots", value="true")
+
+        primarystorage = cls.testdata["primarystorage"]
+        # Registering the pool makes the management server call the Linstor controller (to read the
+        # resource-group capacity). If the controller enforces authentication, that call needs an API
+        # token, supplied as the 'lin.auth.apitoken' add-pool detail. Provide it via LINSTOR_API_TOKEN
+        # so it is never hard-coded; leave it unset for an unauthenticated controller.
+        api_token = os.environ.get("LINSTOR_API_TOKEN")
+        if api_token:
+            primarystorage["details"]["lin.auth.apitoken"] = api_token
+
+        try:
+            cls.primary_storage = StoragePool.create(
+                cls.apiClient,
+                primarystorage,
+                scope=primarystorage[TestData.scope],
+                zoneid=cls.zone.id,
+                provider=primarystorage[TestData.provider],
+                tags=primarystorage[TestData.tags],
+                hypervisor=primarystorage[TestData.hypervisor]
+            )
+        except Exception as e:
+            cls.skip_reason = (
+                "Could not register the Linstor primary storage pool (%s). If the Linstor controller "
+                "requires authentication, set the LINSTOR_API_TOKEN env var to a valid controller API "
+                "token before running these tests." % e)
+            return
+
+        # Compute offering with encrypted root, pinned to the Linstor pool via the storage tag.
+        cls.compute_offering_encrypted = ServiceOffering.create(
+            cls.apiClient,
+            cls.testdata[TestData.computeOffering],
+            encryptroot=True
+        )
+
+        cls.account = Account.create(cls.apiClient, cls.testdata[TestData.account], admin=1)
+        cls.user = User.create(
+            cls.apiClient, cls.testdata[TestData.user],
+            account=cls.account.name, domainid=cls.domain.id)
+
+        cls._cleanup = [
+            cls.compute_offering_encrypted,
+            cls.user,
+            cls.account,
+        ]
+
+    @classmethod
+    def tearDownClass(cls):
+        try:
+            cleanup_resources(cls.apiClient, cls._cleanup)
+            if getattr(cls, "primary_storage", None) is not None:
+                cls.primary_storage.delete(cls.apiClient)
+        except Exception as e:
+            logging.debug("Exception in tearDownClass: %s" % e)
+
+    def setUp(self):
+        if self.skip_reason:
+            self.skipTest(self.skip_reason)
+        self.cleanup = []
+
+    def tearDown(self):
+        cleanup_resources(self.apiClient, self.cleanup)
+
+    # --------------------------------------------------------------------- #
+    # Tests
+    # --------------------------------------------------------------------- #
+
+    @attr(tags=['basic'], required_hardware=True)
+    def test_01_revert_encrypted_root_snapshot(self):
+        """Snapshot an encrypted root volume, change it, revert, and verify the data and boot."""
+        vm = self._deploy_encrypted_vm("TestEncVM-revert")
+
+        # 1. write a marker into the encrypted root volume
+        self._write_marker(vm, "linstor-encrypted-v1")
+
+        # 2. snapshot the (stopped) root volume -> encrypted qcow2 on secondary
+        vm.stop(self.apiClient)
+        snapshot = self._snapshot_root_volume(vm)
+
+        # 3. change the data so a successful revert is detectable
+        self._start_vm(vm)
+        self._write_marker(vm, "linstor-encrypted-v2-CHANGED")
+
+        # 4. revert the volume to the snapshot (requires the VM stopped)
+        vm.stop(self.apiClient)
+        Volume.revertToSnapshot(self.apiClient, snapshot.id)
+
+        # 5. the VM must boot again and the original data must be back
+        self._start_vm(vm)
+        restored = self._read_marker(vm)
+        self.assertEqual(
+            "linstor-encrypted-v1", restored,
+            "Reverted encrypted root volume has wrong content (got %r) - decryption/round-trip broken" % restored
+        )
+
+    @attr(tags=['basic'], required_hardware=True)
+    def test_02_create_volume_from_encrypted_snapshot_is_rejected(self):
+        """Creating a new volume from an encrypted volume's snapshot must be rejected by CloudStack.
+
+        CloudStack core (VolumeApiServiceImpl) unconditionally blocks this for any encrypted source
+        volume ("Cannot create new volumes from encrypted volume snapshots"), so the request must never
+        reach the storage layer. This is a guard test: if the limitation is ever lifted, decryption
+        support for the create-from-snapshot path (KVMStorageProcessor / LinstorStorageAdaptor) must be
+        added and this test updated accordingly.
+        """
+        vm = self._deploy_encrypted_vm("TestEncVM-create")
+
+        self._write_marker(vm, "linstor-encrypted-create-src")
+        vm.stop(self.apiClient)
+        snapshot = self._snapshot_root_volume(vm)
+
+        cmd = createVolume.createVolumeCmd()
+        cmd.name = "%s-%d" % (self.testdata[TestData.diskName], random.randint(0, 100000))
+        cmd.zoneid = self.zone.id
+        cmd.account = self.account.name
+        cmd.domainid = self.domain.id
+        cmd.snapshotid = snapshot.id
+
+        try:
+            self.apiClient.createVolume(cmd)
+            self.fail("Creating a volume from an encrypted volume snapshot should have been rejected")
+        except CloudstackAPIException as e:
+            self.assertIn(
+                "encrypted volume snapshots", str(e),
+                "Unexpected error creating volume from encrypted snapshot: %s" % e
+            )
+
+    @attr(tags=['basic'], required_hardware=True)
+    def test_03_backed_up_snapshot_qcow2_is_encrypted(self):
+        """The qcow2 written to secondary storage for an encrypted volume must itself be LUKS encrypted."""
+        if not self.hostConfig:
+            self.skipTest("No host SSH credentials available (set HOST_SSH_USER/HOST_SSH_PASSWORD or "
+                          "provide them in the marvin config) - cannot inspect the secondary-storage qcow2")
+        vm = self._deploy_encrypted_vm("TestEncVM-atrest")
+        self._write_marker(vm, "linstor-encrypted-atrest")
+        vm.stop(self.apiClient)
+        snapshot = self._snapshot_root_volume(vm)
+
+        info = self._qemu_img_info_of_backed_up_snapshot(snapshot)
+        if info is None:
+            self.skipTest("Could not locate the backed-up snapshot on secondary storage to inspect it")
+
+        encrypted = bool(info.get("encrypted")) or "encrypt" in json.dumps(info.get("format-specific", {}))
+        self.assertTrue(
+            encrypted,
+            "Backed-up snapshot qcow2 is NOT encrypted at rest: %s" % json.dumps(info)
+        )
+
+    # --------------------------------------------------------------------- #
+    # Helpers
+    # --------------------------------------------------------------------- #
+
+    def _deploy_encrypted_vm(self, name):
+        vm = VirtualMachine.create(
+            self.apiClient,
+            {"name": name, "displayname": name},
+            accountid=self.account.name,
+            zoneid=self.zone.id,
+            serviceofferingid=self.compute_offering_encrypted.id,
+            templateid=self.template.id,
+            domainid=self.domain.id,
+            startvm=False,
+            mode='basic',
+        )
+        self.cleanup.insert(0, vm)
+        self._start_vm(vm)
+        return vm
+
+    def _snapshot_root_volume(self, vm):
+        root = list_volumes(self.apiClient, virtualmachineid=vm.id, type="ROOT", listall=True)[0]
+        snapshot = Snapshot.create(
+            self.apiClient,
+            volume_id=root.id,
+            account=self.account.name,
+            domainid=self.domain.id,
+        )
+        self.assertIsNotNone(snapshot, "Could not create snapshot of encrypted root volume")
+        self.cleanup.insert(0, snapshot)
+        return snapshot
+
+    def _vm_ssh(self, vm):
+        # The VM is deployed stopped, so its instance has no ssh_ip yet; the IP may also change across
+        # stop/start cycles. Always pass the current address from a fresh lookup.
+        ipaddress = self._get_vm(vm.id).ipaddress
+        return vm.get_ssh_client(ipaddress=ipaddress, reconnect=True, retries=5)
+
+    def _write_marker(self, vm, content):
+        ssh = self._vm_ssh(vm)
+        ssh.execute("echo '%s' > %s" % (content, MARKER_PATH))
+        ssh.execute("sync")
+
+    def _read_marker(self, vm):
+        ssh = self._vm_ssh(vm)
+        result = ssh.execute("cat %s" % MARKER_PATH)
+        return result[0].strip() if result else None
+
+    @classmethod
+    def _encryption_capable_host_exists(cls):
+        hosts = Host.list(cls.apiClient, zoneid=cls.zone.id, type='Routing', hypervisor='KVM', state='Up')
+        return any(getattr(h, "encryptionsupported", False) for h in (hosts or []))
+
+    @classmethod
+    def _get_vm(cls, vm_id):
+        return list_virtual_machines(cls.apiClient, id=vm_id)[0]
+
+    @classmethod
+    def _start_vm(cls, vm):
+        vm_for_check = cls._get_vm(vm.id)
+        if vm_for_check.state == VirtualMachine.STOPPED:
+            vm.start(cls.apiClient)
+            vm_for_check = cls._get_vm(vm.id)
+        ServiceReady.wait_ssh_ready(vm_for_check.ipaddress)
+        return vm_for_check
+
+    def _host_ssh(self):
+        host = list_hosts(self.apiClient, type='Routing', hypervisor='KVM', state='Up')[0]
+        return SshClient(
+            host=host.ipaddress, port=22,
+            user=self.hostConfig['username'], passwd=self.hostConfig['password'])
+
+    def _qemu_img_info_of_backed_up_snapshot(self, snapshot):
+        """Self-mount the secondary NFS export on a host and run 'qemu-img info' on the snapshot file."""
+        # The backed-up snapshot's physical path on secondary storage isn't exposed via the API, so we
+        # read it from the DB. The DB may be unreachable from where the tests run (e.g. MariaDB bound to
+        # localhost on the management server); in that case return None so the test skips.
+        try:
+            rows = self.dbConnection.execute(
+                "SELECT ss.install_path "
+                "FROM snapshot_store_ref ss JOIN snapshots s ON s.id = ss.snapshot_id "
+                "WHERE s.uuid = '%s' AND ss.store_role = 'Image'" % snapshot.id)
+            store = self.dbConnection.execute(
+                "SELECT url FROM image_store WHERE role = 'Image' AND removed IS NULL LIMIT 1")
+        except Exception as e:
+            logging.debug("DB lookup for snapshot install path failed: %s" % e)
+            return None
+
+        if not rows or not rows[0][0] or not store or not store[0][0]:
+            return None
+        install_path = rows[0][0]
+        url = store[0][0]  # e.g. nfs://<server>/<export-path>
+        if not url.startswith("nfs://"):
+            return None
+        server, export = url[len("nfs://"):].split("/", 1)
+
+        ssh = self._host_ssh()
+        mount_point = "/tmp/cs_sectest_%d" % random.randint(0, 100000)
+        try:
+            ssh.execute("mkdir -p %s" % mount_point)
+            ssh.execute("mount -t nfs -o ro %s:/%s %s" % (server, export, mount_point))
+            out = ssh.execute("qemu-img info --output=json %s/%s" % (mount_point, install_path))
+            return json.loads("".join(out)) if out else None
+        except Exception as e:
+            logging.debug("qemu-img info on secondary failed: %s" % e)
+            return None
+        finally:
+            ssh.execute("umount %s 2>/dev/null; rmdir %s 2>/dev/null" % (mount_point, mount_point))
diff --git a/test/integration/smoke/test_backup_recovery_kboss.py b/test/integration/smoke/test_backup_recovery_kboss.py
new file mode 100644
index 000000000000..10d823da195c
--- /dev/null
+++ b/test/integration/smoke/test_backup_recovery_kboss.py
@@ -0,0 +1,336 @@
+#!/usr/bin/env python
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+from marvin.cloudstackTestCase import cloudstackTestCase
+from marvin.lib import utils
+from marvin.lib.base import (Account, ServiceOffering, DiskOffering, VirtualMachine, BackupOffering,
+                             Backup, Configurations, Volume, StoragePool)
+from marvin.lib.common import (get_domain, get_zone, get_template)
+from nose.plugins.attrib import attr
+from marvin.codes import FAILED
+import time
+import tempfile
+import urllib.parse
+import urllib.request
+import os
+
+class TestKBOSSBackupAndRecovery(cloudstackTestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        # Setup
+
+        cls.testClient = super(TestKBOSSBackupAndRecovery, cls).getClsTestClient()
+        cls.api_client = cls.testClient.getApiClient()
+        print(cls.api_client)
+        cls.services = cls.testClient.getParsedTestDataConfig()
+        cls.zone = get_zone(cls.api_client, cls.testClient.getZoneForTests())
+        cls.services["mode"] = cls.zone.networktype
+        cls.hypervisor = cls.testClient.getHypervisorInfo()
+        cls.domain = get_domain(cls.api_client)
+        cls.template = get_template(cls.api_client, cls.zone.id, cls.services["ostype"])
+        if cls.template == FAILED:
+            assert False, "get_template() failed to return template with description %s" % cls.services["ostype"]
+        cls.services["small"]["zoneid"] = cls.zone.id
+        cls.services["small"]["template"] = cls.template.id
+        cls._cleanup = []
+
+        if cls.hypervisor.lower() != 'kvm':
+            cls.skipTest(cls, reason="Test can be run only on KVM hypervisor")
+
+        cls.storage_pool = StoragePool.list(cls.api_client)[0]
+        if cls.storage_pool.type.lower() != 'networkfilesystem':
+            cls.skipTest(cls, reason="Test can be run only if the primary storage is of type NFS")
+
+        # Check backup configuration values, set them to enable the kboss provider
+        backup_enabled_cfg = Configurations.list(cls.api_client, name='backup.framework.enabled')
+        backup_provider_cfg = Configurations.list(cls.api_client, name='backup.framework.provider.plugin')
+        cls.backup_enabled = backup_enabled_cfg[0].value
+        cls.backup_provider = backup_provider_cfg[0].value
+
+        if cls.backup_enabled == "false":
+            cls.skipTest(cls, reason="Test can be run only if the config backup.framework.enabled is true")
+        if cls.backup_provider != "kboss":
+            Configurations.update(cls.api_client, 'backup.framework.provider.plugin', value='kboss')
+
+        cls.account = Account.create(cls.api_client, cls.services["account"], domainid=cls.domain.id)
+
+        cls._cleanup = [cls.account]
+
+        cls.basic_backup_offering = BackupOffering.createOffering(cls.api_client, utils.random_gen(), utils.random_gen(), cls.zone.id)
+        cls._cleanup.append(cls.basic_backup_offering)
+        cls.compress_backup_offering = BackupOffering.createOffering(cls.api_client, utils.random_gen(), utils.random_gen(), cls.zone.id, compress=True)
+        cls._cleanup.append(cls.compress_backup_offering)
+        cls.validate_backup_offering = BackupOffering.createOffering(cls.api_client, utils.random_gen(), utils.random_gen(), cls.zone.id, validate=True,
+                                                                     validationsteps="screenshot")
+        cls._cleanup.append(cls.validate_backup_offering)
+
+        cls.offering = ServiceOffering.create(cls.api_client,cls.services["service_offerings"]["small"])
+        cls.diskoffering = DiskOffering.create(cls.api_client, cls.services["disk_offering"])
+        cls._cleanup.extend([cls.offering, cls.diskoffering])
+        cls.vm = VirtualMachine.create(cls.api_client, cls.services["small"], accountid=cls.account.name,
+                                       domainid=cls.account.domainid, serviceofferingid=cls.offering.id,
+                                       diskofferingid=cls.diskoffering.id, mode=cls.services["mode"])
+
+
+    @classmethod
+    def tearDownClass(cls):
+        try:
+            # Cleanup resources used
+            utils.cleanup_resources(cls.api_client, cls._cleanup)
+
+            if cls.backup_provider != "kboss":
+                Configurations.update(cls.api_client, 'backup.framework.provider.plugin', value=cls.backup_provider)
+        except Exception as e:
+            raise Exception("Warning: Exception during cleanup : %s" % e)
+
+    def setUp(self):
+        if self.hypervisor.lower() != 'kvm':
+            raise self.skipTest("Skipping test cases which must only run for Simulator")
+        self.cleanup = []
+
+    def tearDown(self):
+        try:
+            utils.cleanup_resources(self.api_client, self.cleanup)
+        except Exception as e:
+            raise Exception("Warning: Exception during cleanup : %s" % e)
+
+    def waitForCompression(self, vm):
+        def checkBackupCompression():
+            backups = Backup.list(self.api_client, vm.id)
+            if isinstance(backups, list) and len(backups) != 0 and backups[0].compressionstatus == "Compressed":
+                return True, None
+            return False, None
+
+        res, _ = utils.wait_until(10, 60, checkBackupCompression)
+        if not res:
+            self.fail("Failed to wait for backup compression of VM %s" % vm.id)
+
+    def waitForValidation(self, vm):
+        def checkBackupValidation():
+            backups = Backup.list(self.api_client, vm.id)
+            if isinstance(backups, list) and len(backups) != 0 and backups[0].validationstatus == "Valid":
+                return True, None
+            return False, None
+
+        res, _ = utils.wait_until(10, 60, checkBackupValidation)
+        if not res:
+            self.fail("Failed to wait for backup compression of VM %s" % vm.id)
+
+    def download_screenshot(self, backupid):
+        extract_ss = Backup.downloadValidationScreenshot(self.api_client, backupid)
+
+        try:
+            formatted_url = urllib.parse.unquote_plus(extract_ss.url)
+            self.debug("Attempting to download screenshot at url %s" % formatted_url)
+            response = urllib.request.urlopen(formatted_url)
+            self.debug("response from screenshot url %s" % response.getcode())
+            fd, path = tempfile.mkstemp()
+            self.debug("Saving screenshot %s to path %s" % (backupid, path))
+            os.close(fd)
+            with open(path, 'wb') as fd:
+                fd.write(response.read())
+            self.debug("Saved screenshot successfully")
+        except Exception:
+            self.fail(
+                "Extract screenshot of backup Failed with invalid URL %s (backup id: %s)" \
+                % (extract_ss.url, backupid)
+            )
+
+    @attr(tags=["advanced", "backup"], required_hardware="true")
+    def test_vm_backup_lifecycle(self):
+        """
+        Test VM backup lifecycle
+        """
+
+        # Verify there are no backups for the VM
+        backups = Backup.list(self.api_client, self.vm.id)
+        self.assertEqual(backups, None, "There should not exist any backup for the VM")
+
+        # Assign VM to offering and create ad-hoc backup
+        self.basic_backup_offering.assignOffering(self.api_client, self.vm.id)
+        Backup.create(self.api_client, self.vm.id)
+
+        # Verify backup is created for the VM
+        backups = Backup.list(self.api_client, self.vm.id)
+        self.assertEqual(len(backups), 1, "There should exist only one backup for the VM")
+        backup = backups[0]
+
+        # Delete backup
+        Backup.delete(self.api_client, backup.id)
+
+        # Verify backup is deleted
+        backups = Backup.list(self.api_client, self.vm.id)
+        self.assertEqual(backups, None, "There should not exist any backup for the VM")
+
+        # Remove VM from offering
+        self.basic_backup_offering.removeOffering(self.api_client, self.vm.id)
+
+    @attr(tags=["advanced", "backup"], required_hardware="true")
+    def test_vm_backup_lifecycle_with_compression(self):
+        """
+        Test VM backup lifecycle with compression
+        """
+
+        compression_enabled = Configurations.list(self.api_client, name='backup.compression.task.enabled')
+        if compression_enabled[0].value == "false":
+            self.skipTest("Skipping test due to backup compression task is disabled.")
+
+        # Verify there are no backups for the VM
+        backups = Backup.list(self.api_client, self.vm.id)
+        self.assertEqual(backups, None, "There should not exist any backup for the VM")
+
+        # Assign VM to offering and create ad-hoc backup
+        self.compress_backup_offering.assignOffering(self.api_client, self.vm.id)
+        Backup.create(self.api_client, self.vm.id)
+
+        # Verify backup is created for the VM
+        backups = Backup.list(self.api_client, self.vm.id)
+        self.assertEqual(len(backups), 1, "There should exist only one backup for the VM")
+        backup = backups[0]
+
+        self.waitForCompression(self.vm)
+
+        # Delete backup
+        Backup.delete(self.api_client, backup.id)
+
+        # Verify backup is deleted
+        backups = Backup.list(self.api_client, self.vm.id)
+        self.assertEqual(backups, None, "There should not exist any backup for the VM")
+
+        # Remove VM from offering
+        self.compress_backup_offering.removeOffering(self.api_client, self.vm.id)
+
+    @attr(tags=["advanced", "backup"], required_hardware="true")
+    def test_vm_backup_lifecycle_with_validation(self):
+        """
+        Test VM backup lifecycle with validation
+        """
+
+        validation_enabled = Configurations.list(self.api_client, name='backup.validation.task.enabled')
+        if validation_enabled[0].value == "false":
+            self.skipTest("Skipping test due to backup compression task is disabled.")
+
+        # Verify there are no backups for the VM
+        backups = Backup.list(self.api_client, self.vm.id)
+        self.assertEqual(backups, None, "There should not exist any backup for the VM")
+
+        # Assign VM to offering and create ad-hoc backup
+        self.validate_backup_offering.assignOffering(self.api_client, self.vm.id)
+        Backup.create(self.api_client, self.vm.id)
+
+        # Verify backup is created for the VM
+        backups = Backup.list(self.api_client, self.vm.id)
+        self.assertEqual(len(backups), 1, "There should exist only one backup for the VM")
+        backup = backups[0]
+
+        # Verify validation is performed
+        self.waitForValidation(self.vm)
+        self.download_screenshot(backup.id)
+
+        # Delete backup
+        Backup.delete(self.api_client, backup.id)
+
+        # Verify backup is deleted
+        backups = Backup.list(self.api_client, self.vm.id)
+        self.assertEqual(backups, None, "There should not exist any backup for the VM")
+
+        # Remove VM from offering
+        self.validate_backup_offering.removeOffering(self.api_client, self.vm.id)
+
+    @attr(tags=["advanced", "backup"], required_hardware="true")
+    def test_vm_backup_create_vm_from_backup(self):
+        """
+        Test creating a new VM from a backup
+        """
+        self.basic_backup_offering.assignOffering(self.api_client, self.vm.id)
+
+        # Create a file and take backup
+        try:
+            ssh_client_vm = self.vm.get_ssh_client(reconnect=True)
+            ssh_client_vm.execute("touch test_backup_and_recovery.txt")
+        except Exception as err:
+            self.fail("SSH failed for Virtual machine: %s due to %s" % (self.vm.ipaddress, err))
+
+        time.sleep(5)
+
+        Backup.create(self.api_client, self.vm.id, "backup1")
+        Backup.create(self.api_client, self.vm.id, "backup2")
+
+        # Verify backup is created for the VM
+        backups = Backup.list(self.api_client, self.vm.id)
+        self.assertEqual(len(backups), 2, "There should exist two backups for the VM")
+
+        # Remove VM from offering
+        self.basic_backup_offering.removeOffering(self.api_client, self.vm.id)
+
+        # Verify no. of backups after removing the backup offering
+        backups = Backup.list(self.api_client, self.vm.id)
+        self.assertEqual(len(backups), 2, "There should exist two backups for the VM")
+
+        # Create a new VM from first backup
+        new_vm_name = "vm-from-backup1-" + str(int(time.time()))
+        new_vm = Backup.createVMFromBackup(
+            self.api_client,
+            self.services["small"],
+            mode=self.services["mode"],
+            backupid=backups[0].id,
+            vmname=new_vm_name,
+            accountname=self.account.name,
+            domainid=self.account.domainid,
+            zoneid=self.zone.id,
+            networkids=None,
+            templateid=None
+        )
+        self.cleanup.append(new_vm)
+
+        # Verify the new VM was created successfully
+        self.assertIsNotNone(new_vm, "Failed to create VM from backup")
+        self.assertEqual(new_vm.name, new_vm_name, "VM name does not match the requested name")
+
+        # Verify the new VM is running
+        self.assertEqual(new_vm.state, "Running", "New VM should be in Running state")
+
+        # Verify the new VM has the correct service offering
+        self.assertEqual(new_vm.serviceofferingid, self.offering.id,
+                         "New VM should have the correct service offering")
+
+        # Verify the new VM has the correct zone
+        self.assertEqual(new_vm.zoneid, self.zone.id, "New VM should be in the correct zone")
+
+        # Verify the new VM has the correct number of volumes (ROOT + DATADISK)
+        volumes = Volume.list(
+            self.api_client,
+            virtualmachineid=new_vm.id,
+            listall=True
+        )
+        self.assertTrue(isinstance(volumes, list), "List volumes should return a valid list")
+        self.assertEqual(2, len(volumes), "The new VM should have 2 volumes (ROOT + DATADISK)")
+
+        # Verify that the file is present in the Instance created from backup
+        try:
+            ssh_client_new_vm = new_vm.get_ssh_client(reconnect=True)
+            result = ssh_client_new_vm.execute("ls test_backup_and_recovery.txt")
+            self.assertEqual(result[0], "test_backup_and_recovery.txt",
+                             "Instance created from Backup should have the same file as the backup.")
+        except Exception as err:
+            self.fail("SSH failed for Virtual machine: %s due to %s" % (self.vm.ipaddress, err))
+
+        # Delete backups
+        Backup.delete(self.api_client, backups[0].id)
+        Backup.delete(self.api_client, backups[1].id)
diff --git a/test/integration/smoke/test_backup_recovery_nas.py b/test/integration/smoke/test_backup_recovery_nas.py
index 409a08acc9f0..41aa82bd0857 100644
--- a/test/integration/smoke/test_backup_recovery_nas.py
+++ b/test/integration/smoke/test_backup_recovery_nas.py
@@ -56,13 +56,17 @@ def setUpClass(cls):
         # Check backup configuration values, set them to enable the nas provider
         backup_enabled_cfg = Configurations.list(cls.api_client, name='backup.framework.enabled')
         backup_provider_cfg = Configurations.list(cls.api_client, name='backup.framework.provider.plugin')
+        incremental_backup_enabled_cfg = Configurations.list(cls.api_client, name='nas.backup.incremental.enabled')
         cls.backup_enabled = backup_enabled_cfg[0].value
         cls.backup_provider = backup_provider_cfg[0].value
+        cls.incremental_backup_enabled = incremental_backup_enabled_cfg[0].value
 
         if cls.backup_enabled == "false":
             cls.skipTest(cls, reason="Test can be run only if the config backup.framework.enabled is true")
         if cls.backup_provider != "nas":
             Configurations.update(cls.api_client, 'backup.framework.provider.plugin', value='nas')
+        if cls.incremental_backup_enabled == "false":
+            Configurations.update(cls.api_client, 'nas.backup.incremental.enabled', value='true')
 
         cls.account = Account.create(cls.api_client, cls.services["account"], domainid=cls.domain.id)
 
@@ -94,6 +98,8 @@ def tearDownClass(cls):
 
             if cls.backup_provider != "nas":
                 Configurations.update(cls.api_client, 'backup.framework.provider.plugin', value=cls.backup_provider)
+            if cls.incremental_backup_enabled == "false":
+                Configurations.update(cls.api_client, 'nas.backup.incremental.enabled', value="false")
         except Exception as e:
             raise Exception("Warning: Exception during cleanup : %s" % e)
 
@@ -265,3 +271,326 @@ def test_vm_backup_create_vm_from_backup_in_another_zone(self):
         self.assertEqual(backup_repository.crosszoneinstancecreation, True, "Cross-Zone Instance Creation could not be enabled on the backup repository")
 
         self.vm_backup_create_vm_from_backup_int(template.id, [network.id])
+
+    # ------------------------------------------------------------------
+    # Incremental backup tests (RFC #12899 / PR #13074)
+    # ------------------------------------------------------------------
+    # These tests exercise the incremental NAS backup chain semantics:
+    # full -> incN cadence, restore-from-incremental, delete-middle chain
+    # repair, refuse-delete-full-with-children, and stopped-VM fallback.
+    #
+    # All tests set nas.backup.full.every to a small value (3) so a chain
+    # forms quickly without needing many backup iterations. The original
+    # zone value (whatever the test environment has configured) is captured
+    # before the test runs and restored verbatim in finally, so we don't
+    # leak config changes across tests on shared environments.
+
+    def _set_full_every(self, value):
+        Configurations.update(self.apiclient, name='nas.backup.full.every',
+                              value=str(value), zoneid=self.zone.id)
+
+    def _get_full_every(self):
+        """Read the current zone-scoped (or global fallback) value of nas.backup.full.every."""
+        configs = Configurations.list(self.apiclient, name='nas.backup.full.every',
+                                      zoneid=self.zone.id)
+        if configs and len(configs) > 0 and configs[0].value is not None:
+            return configs[0].value
+        # Fall back to global default — Configurations.list returns the global value
+        # when no zone override exists. Defensive fallback to '10' (the framework default).
+        return '10'
+
+    def _backup_type(self, backup):
+        # Backup objects expose `type`; for chained backups it's "INCREMENTAL", else "FULL".
+        return getattr(backup, 'type', 'FULL') or 'FULL'
+
+    @attr(tags=["advanced", "backup"], required_hardware="true")
+    def test_incremental_chain_cadence(self):
+        """
+        With nas.backup.full.every=3, the sequence of backups should be
+        FULL, INCREMENTAL, INCREMENTAL, FULL, INCREMENTAL, ...
+        """
+        self.backup_offering.assignOffering(self.apiclient, self.vm.id)
+        original_full_every = self._get_full_every()
+        self._set_full_every(3)
+        try:
+            ssh_client_vm = self.vm.get_ssh_client(reconnect=True)
+            ssh_client_vm.execute("touch /root/incremental_marker_1.txt")
+
+            created = []
+            for i in range(5):
+                Backup.create(self.apiclient, self.vm.id, "inc_chain_%d" % i)
+                # write a small change so each incremental has something to capture
+                ssh_client_vm.execute("dd if=/dev/urandom of=/root/delta_%d bs=64k count=4 2>/dev/null" % i)
+                time.sleep(2)
+                created = Backup.list(self.apiclient, self.vm.id)
+
+            self.assertEqual(len(created), 5, "Expected 5 backups after 5 Backup.create calls")
+            # Sort oldest-first by date
+            created.sort(key=lambda b: b.created)
+
+            expected = ['FULL', 'INCREMENTAL', 'INCREMENTAL', 'FULL', 'INCREMENTAL']
+            actual = [self._backup_type(b).upper() for b in created]
+            self.assertEqual(actual, expected,
+                "With nas.backup.full.every=3, chain pattern should be %s but was %s" % (expected, actual))
+
+            # Cleanup all backups (newest first to satisfy chain rules without forced=true)
+            for b in reversed(created):
+                Backup.delete(self.apiclient, b.id)
+        finally:
+            self._set_full_every(original_full_every)
+            self.backup_offering.removeOffering(self.apiclient, self.vm.id)
+
+    @attr(tags=["advanced", "backup"], required_hardware="true")
+    def test_incremental_after_vm_restart(self):
+        """
+        Regression for the parent-checkpoint recreation bug (PR #13074): an incremental
+        backup taken AFTER the VM has been restarted must still succeed and restore
+        correctly.
+
+        A VM (re)start rebuilds the libvirt domain XML and wipes libvirt's checkpoint
+        registry, while the dirty bitmap persists on the qcow2. The agent must then
+        re-register the parent checkpoint with `checkpoint-create --redefine` (from the
+        saved checkpoint XML) rather than a fresh create — a fresh create fails with
+        "Bitmap already exists", and qemu-img cannot drop the bitmap on a running disk.
+
+        How this was reproduced manually on a libvirt 10.0.0 host, and what this test
+        automates:
+            FULL + marker1  ->  stop/start the VM (wipes the checkpoint registry)
+            ->  INCREMENTAL + marker2  ->  restore the tip  ->  both markers present.
+        """
+        self.backup_offering.assignOffering(self.apiclient, self.vm.id)
+        original_full_every = self._get_full_every()
+        # High cadence so the post-restart backup is INCREMENTAL, not a periodic FULL.
+        self._set_full_every(100)
+        backups = []
+        try:
+            ssh_client_vm = self.vm.get_ssh_client(reconnect=True)
+            ssh_client_vm.execute("echo restart-test-1 > /root/restart_marker_1.txt; sync")
+
+            # 1) FULL anchor
+            Backup.create(self.apiclient, self.vm.id, "restart_full")
+            time.sleep(2)
+
+            # 2) Restart the VM — wipes libvirt's checkpoint registry (the bug trigger).
+            self.vm.stop(self.apiclient)
+            self.vm.start(self.apiclient)
+            ssh_client_vm = self.vm.get_ssh_client(reconnect=True)
+            ssh_client_vm.execute("echo restart-test-2 > /root/restart_marker_2.txt; sync")
+
+            # 3) INCREMENTAL after the restart — the previously-broken path.
+            Backup.create(self.apiclient, self.vm.id, "restart_incr")
+            time.sleep(2)
+
+            backups = Backup.list(self.apiclient, self.vm.id)
+            self.assertEqual(len(backups), 2,
+                "Expected FULL + INCREMENTAL after restart, got %d" % len(backups))
+            backups.sort(key=lambda b: b.created)
+            self.assertEqual(self._backup_type(backups[0]).upper(), 'FULL',
+                "First backup should be FULL")
+            self.assertEqual(self._backup_type(backups[1]).upper(), 'INCREMENTAL',
+                "Backup taken after the VM restart must be INCREMENTAL, not silently a FULL")
+
+            # 4) Restore the tip (incremental) and verify BOTH markers survived the chain
+            #    across the restart — i.e. the post-restart incremental really captured data.
+            new_vm_name = "vm-restart-restore-" + str(int(time.time()))
+            new_vm = Backup.createVMFromBackup(
+                self.apiclient,
+                self.services["small"],
+                mode=self.services["mode"],
+                backupid=backups[1].id,
+                vmname=new_vm_name,
+                accountname=self.account.name,
+                domainid=self.account.domainid,
+                zoneid=self.zone.id
+            )
+            self.cleanup.append(new_vm)
+            self.assertIsNotNone(new_vm, "Failed to create VM from the post-restart incremental backup")
+            self.assertEqual(new_vm.state, "Running", "Restored VM should be Running")
+
+            ssh_new = new_vm.get_ssh_client(reconnect=True)
+            r1 = "".join(ssh_new.execute("cat /root/restart_marker_1.txt"))
+            r2 = "".join(ssh_new.execute("cat /root/restart_marker_2.txt"))
+            self.assertIn("restart-test-1", r1,
+                "Marker written before the restart is missing from the restore")
+            self.assertIn("restart-test-2", r2,
+                "Marker written after the restart (captured by the post-restart incremental) "
+                "is missing from the restore")
+        finally:
+            for b in reversed(backups):
+                try:
+                    Backup.delete(self.apiclient, b.id)
+                except Exception:
+                    pass
+            self._set_full_every(original_full_every)
+            self.backup_offering.removeOffering(self.apiclient, self.vm.id)
+
+    @attr(tags=["advanced", "backup"], required_hardware="true")
+    def test_restore_from_incremental(self):
+        """
+        Take FULL + 2 INCREMENTAL backups, each with a marker file. Restore from the
+        latest incremental and verify all three markers are present (chain flatten).
+        """
+        self.backup_offering.assignOffering(self.apiclient, self.vm.id)
+        original_full_every = self._get_full_every()
+        self._set_full_every(5)
+        try:
+            ssh_client_vm = self.vm.get_ssh_client(reconnect=True)
+            ssh_client_vm.execute("touch /root/marker_full.txt")
+            Backup.create(self.apiclient, self.vm.id, "rfi_full")
+            time.sleep(3)
+
+            ssh_client_vm.execute("touch /root/marker_inc1.txt")
+            Backup.create(self.apiclient, self.vm.id, "rfi_inc1")
+            time.sleep(3)
+
+            ssh_client_vm.execute("touch /root/marker_inc2.txt")
+            Backup.create(self.apiclient, self.vm.id, "rfi_inc2")
+            time.sleep(3)
+
+            backups = Backup.list(self.apiclient, self.vm.id)
+            backups.sort(key=lambda b: b.created)
+            self.assertEqual(len(backups), 3)
+            self.assertEqual(self._backup_type(backups[0]).upper(), 'FULL')
+            self.assertEqual(self._backup_type(backups[2]).upper(), 'INCREMENTAL')
+
+            new_vm_name = "vm-from-inc-" + str(int(time.time()))
+            new_vm = Backup.createVMFromBackup(self.apiclient, self.services["small"],
+                mode=self.services["mode"], backupid=backups[2].id, vmname=new_vm_name,
+                accountname=self.account.name, domainid=self.account.domainid,
+                zoneid=self.zone.id)
+            self.cleanup.append(new_vm)
+
+            ssh_new = new_vm.get_ssh_client(reconnect=True)
+            for marker in ("marker_full.txt", "marker_inc1.txt", "marker_inc2.txt"):
+                result = ssh_new.execute("ls /root/%s" % marker)
+                self.assertIn(marker, result[0],
+                    "Restored VM should have %s (chain flattened correctly)" % marker)
+
+            for b in reversed(backups):
+                Backup.delete(self.apiclient, b.id)
+        finally:
+            self._set_full_every(original_full_every)
+            self.backup_offering.removeOffering(self.apiclient, self.vm.id)
+
+    @attr(tags=["advanced", "backup"], required_hardware="true")
+    def test_delete_middle_incremental_repairs_chain(self):
+        """
+        Delete a MIDDLE incremental from a FULL -> INC1 -> INC2 chain.
+        The chain repair should rebase INC2 onto FULL, and the final restore
+        should still produce a working VM with all expected blocks.
+        """
+        self.backup_offering.assignOffering(self.apiclient, self.vm.id)
+        original_full_every = self._get_full_every()
+        self._set_full_every(5)
+        try:
+            ssh_client_vm = self.vm.get_ssh_client(reconnect=True)
+            ssh_client_vm.execute("touch /root/dmi_full.txt")
+            Backup.create(self.apiclient, self.vm.id, "dmi_full")
+            time.sleep(3)
+            ssh_client_vm.execute("touch /root/dmi_inc1.txt")
+            Backup.create(self.apiclient, self.vm.id, "dmi_inc1")
+            time.sleep(3)
+            ssh_client_vm.execute("touch /root/dmi_inc2.txt")
+            Backup.create(self.apiclient, self.vm.id, "dmi_inc2")
+            time.sleep(3)
+
+            backups = Backup.list(self.apiclient, self.vm.id)
+            backups.sort(key=lambda b: b.created)
+            full, inc1, inc2 = backups[0], backups[1], backups[2]
+
+            # Delete the middle incremental — should succeed via chain repair (no force needed)
+            Backup.delete(self.apiclient, inc1.id)
+            remaining = Backup.list(self.apiclient, self.vm.id)
+            self.assertEqual(len(remaining), 2, "After deleting middle inc, two backups should remain")
+
+            # Restore from the remaining tail (formerly inc2) — must still produce a usable VM
+            new_vm_name = "vm-after-mid-del-" + str(int(time.time()))
+            new_vm = Backup.createVMFromBackup(self.apiclient, self.services["small"],
+                mode=self.services["mode"], backupid=inc2.id, vmname=new_vm_name,
+                accountname=self.account.name, domainid=self.account.domainid,
+                zoneid=self.zone.id)
+            self.cleanup.append(new_vm)
+            ssh_new = new_vm.get_ssh_client(reconnect=True)
+            # Both the FULL marker and (importantly) the deleted-INC1 marker should still
+            # be present, because the rebase merged INC1's blocks into INC2.
+            for marker in ("dmi_full.txt", "dmi_inc1.txt", "dmi_inc2.txt"):
+                result = ssh_new.execute("ls /root/%s" % marker)
+                self.assertIn(marker, result[0],
+                    "After mid-incremental delete and rebase, %s should still be restorable" % marker)
+
+            Backup.delete(self.apiclient, inc2.id)
+            Backup.delete(self.apiclient, full.id)
+        finally:
+            self._set_full_every(original_full_every)
+            self.backup_offering.removeOffering(self.apiclient, self.vm.id)
+
+    @attr(tags=["advanced", "backup"], required_hardware="true")
+    def test_delete_full_with_children_is_deferred(self):
+        """
+        Deleting a FULL that has surviving incrementals succeeds but is deferred: the
+        FULL is hidden from the backup list while its child survives, and it is
+        physically swept once the last descendant is deleted.
+        """
+        self.backup_offering.assignOffering(self.apiclient, self.vm.id)
+        original_full_every = self._get_full_every()
+        self._set_full_every(5)
+        try:
+            Backup.create(self.apiclient, self.vm.id, "rdc_full")
+            time.sleep(3)
+            Backup.create(self.apiclient, self.vm.id, "rdc_inc")
+            time.sleep(3)
+
+            backups = Backup.list(self.apiclient, self.vm.id)
+            backups.sort(key=lambda b: b.created)
+            full, inc = backups[0], backups[1]
+
+            # Non-forced delete of the FULL is accepted but deferred: the FULL is
+            # tombstoned (Hidden) and disappears from the list, the child survives.
+            Backup.delete(self.apiclient, full.id)
+            remaining = Backup.list(self.apiclient, self.vm.id)
+            self.assertEqual(len(remaining), 1,
+                "Deleting a FULL with children should hide the FULL and keep the child")
+            self.assertEqual(remaining[0].id, inc.id,
+                "The surviving backup should be the incremental child")
+
+            # Deleting the last descendant sweeps the delete-pending FULL with it.
+            Backup.delete(self.apiclient, inc.id)
+            remaining = Backup.list(self.apiclient, self.vm.id)
+            self.assertIsNone(remaining, "Deleting the leaf should sweep the hidden FULL, removing the chain")
+        finally:
+            self._set_full_every(original_full_every)
+            self.backup_offering.removeOffering(self.apiclient, self.vm.id)
+
+    @attr(tags=["advanced", "backup"], required_hardware="true")
+    def test_stopped_vm_falls_back_to_full(self):
+        """
+        When a backup is requested while the VM is stopped, even if the chain cadence
+        would call for an incremental, the agent must fall back to a full and start a
+        new chain. The incrementalFallback flag should be reflected in backup.type=FULL.
+        """
+        self.backup_offering.assignOffering(self.apiclient, self.vm.id)
+        original_full_every = self._get_full_every()
+        self._set_full_every(2)  # next backup after the first should be incremental
+        try:
+            Backup.create(self.apiclient, self.vm.id, "svf_first")
+            time.sleep(3)
+
+            # Stop the VM and trigger another backup — should fall back to FULL
+            self.vm.stop(self.apiclient)
+            time.sleep(5)
+            Backup.create(self.apiclient, self.vm.id, "svf_second")
+            time.sleep(3)
+
+            backups = Backup.list(self.apiclient, self.vm.id)
+            backups.sort(key=lambda b: b.created)
+            self.assertEqual(len(backups), 2)
+            self.assertEqual(self._backup_type(backups[0]).upper(), 'FULL')
+            self.assertEqual(self._backup_type(backups[1]).upper(), 'FULL',
+                "Stopped-VM backup must be a FULL even when cadence would have asked for an INCREMENTAL")
+
+            self.vm.start(self.apiclient)
+            for b in reversed(backups):
+                Backup.delete(self.apiclient, b.id)
+        finally:
+            self._set_full_every(original_full_every)
+            self.backup_offering.removeOffering(self.apiclient, self.vm.id)
diff --git a/test/integration/smoke/test_network_extension_namespace.py b/test/integration/smoke/test_network_extension_namespace.py
new file mode 100644
index 000000000000..5452cd4ac9d0
--- /dev/null
+++ b/test/integration/smoke/test_network_extension_namespace.py
@@ -0,0 +1,3308 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+"""Support module for the NetworkExtension smoke tests.
+
+**Do not run this file directly.**  Tests are discovered and executed through
+``test_network_extension_namespace.py``, which exposes the test class under a
+discoverable name.
+
+This module provides:
+  * Module-level constants (script names, URLs, capabilities JSON).
+  * Helper functions (_download_script, _ensure_scripts_downloaded, etc.).
+  * Deployer classes (MgmtServerDeployer, KvmHostDeployer).
+  * Base test class ``_TestNetworkExtensionNamespace`` (underscore = not
+    collected directly by nose/Marvin).
+
+Renamed from ``test_network_extension_provider.py``.  The canonical test file
+is ``test_network_extension_namespace.py``.
+"""
+import json
+import logging
+import os
+import random
+import shutil
+import stat
+import subprocess
+import tempfile
+import time
+import urllib.parse
+
+from marvin.cloudstackTestCase import cloudstackTestCase
+from marvin.cloudstackAPI import (listPhysicalNetworks,
+                                  listTrafficTypes,
+                                  listManagementServers,
+                                  listNetworkServiceProviders,
+                                  updateNetworkServiceProvider,
+                                  deleteNetworkServiceProvider,
+                                  createFirewallRule,
+                                  deleteFirewallRule,
+                                  listPublicIpAddresses,
+                                  createGuestNetworkIpv6Prefix,
+                                  listGuestNetworkIpv6Prefixes,
+                                  deleteGuestNetworkIpv6Prefix)
+from marvin.lib.base import (Account,
+                             Configurations,
+                             Extension,
+                             ExtensionCustomAction,
+                             Host,
+                             LoadBalancerRule,
+                             Network,
+                             NetworkACL,
+                             NetworkACLList,
+                             NetworkOffering,
+                             NATRule,
+                             NIC,
+                             PublicIPAddress,
+                             PublicIpRange,
+                             ServiceOffering,
+                             SSHKeyPair,
+                             StaticNATRule,
+                             Template,
+                             VirtualMachine,
+                             VPC,
+                             VpcOffering)
+from marvin.lib.common import (get_domain, get_zone, get_template)
+from marvin.lib.utils import cleanup_resources, random_gen
+from marvin.sshClient import SshClient
+from nose.plugins.attrib import attr
+
+_multiprocess_shared_ = True
+
+# The file names of the scripts to deploy on the management server and KVM hosts.
+SCRIPT_FILENAME       = 'network-namespace-wrapper.sh'
+ENTRY_POINT_FILENAME  = 'network-namespace.sh'
+
+# Remote URLs to download the scripts from
+_GITHUB_BASE = (
+    'https://raw.githubusercontent.com/apache/cloudstack-extensions'
+    '/refs/heads/network-namespace/Network-Namespace/'
+)
+WRAPPER_SCRIPT_URL     = _GITHUB_BASE + SCRIPT_FILENAME
+ENTRY_POINT_SCRIPT_URL = _GITHUB_BASE + ENTRY_POINT_FILENAME
+
+# Local cache paths (downloaded once, reused across test methods)
+_THIS_DIR = os.path.dirname(os.path.abspath(__file__))
+_SCRIPT_CACHE_DIR = os.path.join(tempfile.gettempdir(), 'cs-extnet-script-cache')
+WRAPPER_SCRIPT_LOCAL     = os.path.join(_SCRIPT_CACHE_DIR, SCRIPT_FILENAME)
+ENTRY_POINT_SCRIPT_LOCAL = os.path.join(_SCRIPT_CACHE_DIR, ENTRY_POINT_FILENAME)
+
+# Network services — comma-separated list of all services this extension supports.
+# Tests select a subset when creating NetworkOfferings.
+NETWORK_SERVICES = (
+    "Dhcp,Dns,UserData,"
+    "SourceNat,StaticNat,PortForwarding,Firewall,Lb,NetworkACL,CustomAction"
+)
+
+# Per-service capabilities JSON object (no "services" wrapper).
+NETWORK_SERVICE_CAPABILITIES_JSON = json.dumps({
+    "Lb": {
+        "SupportedLBAlgorithms": "roundrobin,leastconn,source",
+        "SupportedLBIsolation": "dedicated",
+        "SupportedProtocols": "tcp,udp,tcp-proxy",
+        "SupportedStickinessMethods": "lbcookie,appsession",
+        "LbSchemes": "Public",
+        "SslTermination": "false",
+        "VmAutoScaling": "false"
+    },
+    "Firewall": {
+        "TrafficStatistics": "per public ip",
+        "SupportedProtocols": "tcp,udp,icmp",
+        "SupportedEgressProtocols": "tcp,udp,icmp,all",
+        "SupportedTrafficDirection": "ingress,egress",
+        "MultipleIps": "true"
+    },
+    "Dns": {
+        "AllowDnsSuffixModification": "true",
+        "ExternalDns": "true"
+    },
+    "Dhcp": {
+        "DhcpAccrossMultipleSubnets": "true"
+    },
+    "Gateway": {
+        "RedundantRouter": "false"
+    },
+    "SourceNat": {
+        "SupportedSourceNatTypes": "peraccount",
+        "RedundantRouter": "false"
+    },
+    "StaticNat": {
+        "Supported": "true"
+    },
+    "PortForwarding": {
+        "SupportedProtocols": "tcp,udp"
+    },
+    "UserData": {
+        "Supported": "true"
+    },
+    "NetworkACL": {
+        "SupportedProtocols": "tcp,udp,icmp"
+    },
+    "CustomAction": {
+        "Supported": "true"
+    }
+})
+
+ISOLATED_NETWORK_SERVICES = (
+    "Dhcp,Dns,UserData,"
+    "SourceNat,StaticNat,PortForwarding,Firewall,Lb,CustomAction"
+)
+
+VPC_NETWORK_SERVICES = (
+    "Dhcp,Dns,UserData,"
+    "SourceNat,StaticNat,PortForwarding,Lb,NetworkACL,CustomAction"
+)
+
+# ---------------------------------------------------------------------------
+# Script download helpers
+# ---------------------------------------------------------------------------
+
+def _download_script(url, dest_path):
+    """Download *url* to *dest_path* via curl or wget and make it executable."""
+    os.makedirs(os.path.dirname(dest_path), exist_ok=True)
+    log = logging.getLogger('cs-extnet')
+    log.info("Downloading %s -> %s", url, dest_path)
+    for cmd in (['curl', '-fsSL', url, '-o', dest_path],
+                ['wget', '-q',    url, '-O', dest_path]):
+        if subprocess.run(cmd, check=False).returncode == 0:
+            os.chmod(dest_path, stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP |
+                     stat.S_IROTH | stat.S_IXOTH)
+            return dest_path
+    raise RuntimeError("Failed to download %s with curl and wget" % url)
+
+
+def _ensure_scripts_downloaded():
+    """Download both scripts from GitHub if not already cached.
+
+    If GitHub is unreachable the function falls back to the corresponding
+    scripts in the local source tree so that tests can run offline:
+      * wrapper      → extensions/network-namespace/network-namespace-wrapper.sh
+      * entry point  → extensions/network-namespace/network-namespace.sh
+
+    Returns (wrapper_path, entry_point_path).
+    """
+    _src_root = os.path.normpath(
+        os.path.join(os.path.dirname(os.path.abspath(__file__)),
+                     '..', '..', '..'))
+
+    try:
+        _download_script(WRAPPER_SCRIPT_URL, WRAPPER_SCRIPT_LOCAL)
+    except Exception:
+        # Offline fallback: deploy the source-tree implementation.
+        _local_impl = os.path.join(
+            _src_root, 'extensions', 'network-namespace',
+            'network-namespace-wrapper.sh')
+        if os.path.exists(_local_impl):
+            os.makedirs(os.path.dirname(WRAPPER_SCRIPT_LOCAL),
+                        exist_ok=True)
+            shutil.copy2(_local_impl, WRAPPER_SCRIPT_LOCAL)
+            os.chmod(WRAPPER_SCRIPT_LOCAL,
+                     stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP |
+                     stat.S_IROTH | stat.S_IXOTH)
+            logging.getLogger('cs-extnet').info(
+                "Offline fallback: using local %s as %s",
+                _local_impl, WRAPPER_SCRIPT_LOCAL)
+        else:
+            raise
+
+    try:
+        _download_script(ENTRY_POINT_SCRIPT_URL, ENTRY_POINT_SCRIPT_LOCAL)
+    except Exception:
+        _local_ep = os.path.join(
+            _src_root, 'extensions', 'network-namespace',
+            'network-namespace.sh')
+        if os.path.exists(_local_ep):
+            os.makedirs(os.path.dirname(ENTRY_POINT_SCRIPT_LOCAL),
+                        exist_ok=True)
+            shutil.copy2(_local_ep, ENTRY_POINT_SCRIPT_LOCAL)
+            os.chmod(ENTRY_POINT_SCRIPT_LOCAL,
+                     stat.S_IRWXU | stat.S_IRGRP | stat.S_IXGRP |
+                     stat.S_IROTH | stat.S_IXOTH)
+            logging.getLogger('cs-extnet').info(
+                "Offline fallback: using local %s as %s",
+                _local_ep, ENTRY_POINT_SCRIPT_LOCAL)
+        else:
+            raise
+
+    return WRAPPER_SCRIPT_LOCAL, ENTRY_POINT_SCRIPT_LOCAL
+
+
+# ---------------------------------------------------------------------------
+# KVM host discovery helpers (from Marvin config)
+# ---------------------------------------------------------------------------
+
+def _get_kvm_hosts_from_config(config):
+    """Return list of host dicts for all KVM hosts in the Marvin config.
+
+    Each entry: {"ip": .., "username": .., "password": ..}
+    """
+    hosts = []
+    try:
+        for zone in config.__dict__.get("zones", []):
+            for pod in zone.__dict__.get("pods", []):
+                for cluster in pod.__dict__.get("clusters", []):
+                    for h in cluster.__dict__.get("hosts", []):
+                        if hasattr(h, '__dict__'):
+                            h = h.__dict__
+                        url = h.get("url", "")
+                        if not url.startswith('http://') and not url.startswith('https://'):
+                            url = 'http://' + url
+                        parsed = urllib.parse.urlparse(url)
+                        ip = parsed.hostname or ''
+                        if not ip:
+                            continue
+                        hosts.append({
+                            "ip":       ip,
+                            "username": h.get("username", "root"),
+                            "password": h.get("password", ""),
+                        })
+    except Exception as e:
+        logging.getLogger('cs-extnet').warning(
+            "Could not read KVM hosts from config: %s", e)
+    return hosts
+
+
+# ---------------------------------------------------------------------------
+# SSH helper
+# ---------------------------------------------------------------------------
+
+def _ssh_copy_file(host_ip, host_port, username, password, local_path, remote_path):
+    """Transfer *local_path* to *remote_path* on *host_ip* via SshClient."""
+    ssh = SshClient(host_ip, int(host_port), username, password)
+    ssh.execute("mkdir -p '%s'" % os.path.dirname(remote_path))
+    # Use SFTP upload to avoid very large shell arguments for script content.
+    ssh.scp(local_path, remote_path)
+    ssh.execute("chmod 755 '%s'" % remote_path)
+
+
+# ---------------------------------------------------------------------------
+# MgmtServerDeployer  – deploys network-namespace.sh to the management server
+# ---------------------------------------------------------------------------
+
+class MgmtServerDeployer:
+    """Copies network-namespace.sh to the management server via SSH."""
+
+    def __init__(self, mgt_details, logger=None):
+        self.ip     = mgt_details.get("mgtSvrIp", "localhost")
+        self.port   = 22
+        self.user   = mgt_details.get("user", "root")
+        self.passwd = mgt_details.get("passwd", "")
+        self.logger = logger or logging.getLogger('MgmtServerDeployer')
+
+    def copy_file(self, local_path, remote_path, mode='0755'):
+        _ssh_copy_file(self.ip, self.port, self.user, self.passwd,
+                       local_path, remote_path)
+        self.logger.info("Copied %s -> %s on mgmt %s",
+                         local_path, remote_path, self.ip)
+
+    def remove_file(self, remote_path):
+        try:
+            SshClient(self.ip, self.port, self.user, self.passwd).execute(
+                "rm -f '%s'" % remote_path)
+        except Exception as e:
+            self.logger.warning("Could not remove %s: %s", remote_path, e)
+
+
+# ---------------------------------------------------------------------------
+# KvmHostDeployer  – deploys network-namespace-wrapper.sh to KVM hosts
+# ---------------------------------------------------------------------------
+
+class KvmHostDeployer:
+    """Copies the KVM wrapper script to all KVM hosts via SSH.
+
+    *dest_path* is the absolute path on each KVM host where the wrapper
+    script is installed.  This path differs from the management-server
+    entry-point path:
+      management server: /usr/share/cloudstack-management/extensions/<name>/<name>.sh
+      KVM host (wrapper): /etc/cloudstack/extensions/<name>/<name>-wrapper.sh
+    """
+
+    def __init__(self, config_hosts=None, logger=None, dest_path=None):
+        self.config_hosts    = config_hosts or []
+        self.logger          = logger or logging.getLogger('KvmHostDeployer')
+        self._deployed_hosts = []
+        self._dest_path      = dest_path
+
+    def deploy(self):
+        """Deploy wrapper to all configured hosts. Returns list of deployed IPs."""
+        wrapper_path, _ = _ensure_scripts_downloaded()
+        self._deployed_hosts = []
+        if not self.config_hosts:
+            self.logger.warning("No KVM hosts configured — wrapper not deployed")
+            return []
+        for h in self.config_hosts:
+            ip       = h.get('ip', '')
+            username = h.get('username', 'root')
+            password = h.get('password', '')
+            if not ip:
+                continue
+            self.logger.info("Deploying wrapper to KVM host %s at %s",
+                             ip, self._dest_path)
+            try:
+                _ssh_copy_file(ip, 22, username, password,
+                               wrapper_path, self._dest_path)
+                self.logger.info("Deployed wrapper to %s at %s",
+                                 ip, self._dest_path)
+                self._deployed_hosts.append(ip)
+            except Exception as e:
+                self.logger.warning("Failed deploying to %s: %s", ip, e)
+        return self._deployed_hosts
+
+    def host_ips_csv(self):
+        """Return comma-separated IP list of all configured hosts."""
+        return ','.join(h.get('ip', '') for h in self.config_hosts if h.get('ip'))
+
+    def remove_file(self, remote_path):
+        """Remove wrapper script from all deployed KVM hosts."""
+        if not self._deployed_hosts:
+            self.logger.debug("No KVM hosts deployed — skipping remove_file")
+            return
+        for h in self.config_hosts:
+            ip       = h.get('ip', '')
+            username = h.get('username', 'root')
+            password = h.get('password', '')
+            if not ip or ip not in self._deployed_hosts:
+                continue
+            try:
+                SshClient(ip, 22, username, password).execute(
+                    "rm -f '%s'" % remote_path)
+                self.logger.info("Removed %s from KVM host %s", remote_path, ip)
+            except Exception as e:
+                self.logger.warning("Could not remove %s from %s: %s",
+                                   remote_path, ip, e)
+
+
+# ---------------------------------------------------------------------------
+# Test class
+# ---------------------------------------------------------------------------
+
+class TestNetworkExtensionNamespace(cloudstackTestCase):
+    """Smoke tests for the NetworkExtension plugin.
+
+    Not discovered directly — exposed as ``TestNetworkExtensionNamespace``
+    through ``test_network_extension_namespace.py``.
+
+    Covers:
+      test_01 — NSP state transitions (Disabled/Enabled/Disabled)
+      test_02 — network.services / network.service.capabilities details stored correctly
+      test_03 — extension enable/disable and delete restriction
+      test_04 — DHCP/DNS/UserData: cloud-init VM on a shared network reaches Running state
+      test_05 — full isolated lifecycle: static NAT, PF, LB, restart
+                (all with SSH connectivity verification via keypair)
+      test_06 — VPC multi-tier + VPC restart with SSH verification
+      test_07 — VPC Network ACL testing with multiple tiers and traffic rules
+      test_08 — custom-action smoke for Policy-Based Routing (PBR) actions on isolated network
+      test_09 — VPC source NAT IP update without VPC restart
+      test_10 — custom-action smoke for Policy-Based Routing (PBR) actions on VPC tier network
+      test_11 — IPv6 dualstack isolated network: namespace IPv6 address + radvd
+    """
+
+    @staticmethod
+    def _custom_action_details(resp):
+        """Extract best-effort details text from runCustomAction response."""
+        if resp is None:
+            return ""
+        result = getattr(resp, 'result', None)
+        if isinstance(result, dict):
+            return result.get('details', '') or ''
+        if hasattr(result, '__dict__'):
+            return getattr(result, 'details', '') or ''
+        return ''
+
+    def _run_custom_action_logged(self, action, resourceid, parameters=None):
+        """Run a custom action and log the request/response for smoke debugging."""
+        action_name = getattr(action, 'name', None) or getattr(action, 'customactionname', None) or str(action)
+        action_id = getattr(action, 'id', None)
+        self.logger.info(
+            "runCustomAction command: action=%s id=%s resourceid=%s parameters=%s",
+            action_name,
+            action_id,
+            resourceid,
+            parameters if parameters is not None else []
+        )
+        if parameters is None:
+            out = action.run(self.apiclient, resourceid=resourceid)
+        else:
+            out = action.run(self.apiclient, resourceid=resourceid, parameters=parameters)
+        result = getattr(out, 'result', None)
+        message = ''
+        if isinstance(result, dict):
+            message = result.get('message', '') or ''
+        elif hasattr(result, '__dict__'):
+            message = getattr(result, 'message', '') or ''
+        self.logger.info(
+            "runCustomAction output: action=%s success=%s message=%s details=%s raw=%s",
+            action_name,
+            getattr(out, 'success', None),
+            message,
+            self._custom_action_details(out),
+            out
+        )
+        return out
+
+    @classmethod
+    def setUpClass(cls):
+        testClient = super(TestNetworkExtensionNamespace, cls).getClsTestClient()
+        cls.apiclient     = testClient.getApiClient()
+        cls.services      = testClient.getParsedTestDataConfig()
+        cls.zone          = get_zone(cls.apiclient, testClient.getZoneForTests())
+        cls.domain        = get_domain(cls.apiclient)
+        cls.mgtSvrDetails = cls.config.__dict__["mgtSvr"][0].__dict__
+        # All management servers — entry-point script is deployed to every one.
+        cls.all_mgt_svr_details = [
+            mgt.__dict__ if hasattr(mgt, '__dict__') else mgt
+            for mgt in cls.config.__dict__.get("mgtSvr", [])
+        ] or [cls.mgtSvrDetails]
+        cls.hv            = testClient.getHypervisorInfo()
+        cls._cleanup      = []
+        cls.tmp_files     = []
+        cls.keypair       = None
+
+        cls.logger = logging.getLogger("TestNetworkExtensionNamespace")
+        cls.stream_handler = logging.StreamHandler()
+        cls.logger.setLevel(logging.DEBUG)
+        cls.logger.addHandler(cls.stream_handler)
+
+        cls.logger.info("Management servers (from config): %s",
+                         [m.get("mgtSvrIp", "?") for m in cls.all_mgt_svr_details])
+
+        # Supplement / override management server list via listManagementServers API.
+        # All mgmt servers are assumed to share the same SSH credentials as the
+        # first entry in the Marvin config (mgtSvr[0]).
+        try:
+            ms_cmd = listManagementServers.listManagementServersCmd()
+            api_mgmt_servers = cls.apiclient.listManagementServers(ms_cmd)
+            if api_mgmt_servers:
+                base_creds = dict(cls.mgtSvrDetails)
+                api_mgt_details = []
+                for ms in api_mgmt_servers:
+                    ip = (getattr(ms, 'ipaddress', None)
+                          or getattr(ms, 'ip', None)
+                          or getattr(ms, 'hostname', None))
+                    if ip:
+                        entry = dict(base_creds)
+                        entry['mgtSvrIp'] = ip
+                        api_mgt_details.append(entry)
+                if api_mgt_details:
+                    cls.all_mgt_svr_details = api_mgt_details
+                    cls.logger.info(
+                        "Management servers (from listManagementServers API): %s",
+                        [d.get('mgtSvrIp') for d in api_mgt_details])
+        except Exception as _ms_err:
+            cls.logger.warning(
+                "Could not retrieve management servers via listManagementServers "
+                "API (%s); using config-provided list", _ms_err)
+
+        # KVM host credentials from Marvin config
+        cls.kvm_host_configs = _get_kvm_hosts_from_config(cls.config)
+        cls.logger.info("KVM hosts from config: %s",
+                        [h['ip'] for h in cls.kvm_host_configs if h.get('ip')])
+
+        # ---- Cloud-init template (Ubuntu 22.04) ----
+        # Used for hardware tests that verify actual SSH connectivity.
+        # Falls back to the default test template when the cloud-init entry
+        # is absent from the services config (e.g. on simulator).
+        try:
+            tpl_data = (cls.services
+                        .get("test_templates_cloud_init", {})
+                        .get(cls.hv.lower()))
+            if tpl_data:
+                cls.logger.info("Registering cloud-init template for %s", cls.hv)
+                tpl = Template.register(
+                    cls.apiclient,
+                    tpl_data,
+                    zoneid=cls.zone.id,
+                    hypervisor=cls.hv,
+                )
+                tpl.download(cls.apiclient)
+                cls._cleanup.append(tpl)
+                cls.template = tpl
+                cls.logger.info("Cloud-init template registered: %s", tpl.id)
+            else:
+                cls.logger.info("No cloud-init template for %s; using default",
+                                cls.hv)
+                cls.template = get_template(cls.apiclient, cls.zone.id, cls.hv)
+        except Exception as e:
+            cls.logger.warning("Cloud-init template registration failed: %s; "
+                               "falling back to default", e)
+            cls.template = get_template(cls.apiclient, cls.zone.id, cls.hv)
+
+        # ---- Download wrapper scripts from GitHub ----
+        try:
+            _ensure_scripts_downloaded()
+            cls.logger.info("Scripts cached: %s  %s",
+                            WRAPPER_SCRIPT_LOCAL, ENTRY_POINT_SCRIPT_LOCAL)
+        except Exception as e:
+            cls.logger.warning("Could not download scripts from GitHub: %s", e)
+
+    @classmethod
+    def tearDownClass(cls):
+        super(TestNetworkExtensionNamespace, cls).tearDownClass()
+        for tmp_file in cls.tmp_files:
+            try:
+                os.remove(tmp_file)
+            except Exception:
+                pass
+
+    def setUp(self):
+        self.cleanup           = []
+        self.provider_id       = None
+        self.physical_network  = None
+        self.extension         = None
+        self.extension_path    = None
+        self.mgmt_deployer     = None
+        self._mgmt_script_path = None
+        self._all_mgmt_deployers = []
+        self.kvm_deployer      = None
+        self._ssh_private_key_file = None
+
+    def tearDown(self):
+        #self._safe_teardown()
+        try:
+            cleanup_resources(self.apiclient, self.cleanup)
+        except Exception as e:
+            self.logger.warning("cleanup_resources error: %s", e)
+
+    # ------------------------------------------------------------------
+    # CloudStack API helpers
+    # ------------------------------------------------------------------
+
+    def _get_physical_network(self):
+        """Return the physical network with Guest traffic type in the test zone."""
+        cmd = listPhysicalNetworks.listPhysicalNetworksCmd()
+        cmd.zoneid = self.zone.id
+        pns = self.apiclient.listPhysicalNetworks(cmd)
+        self.assertIsInstance(pns, list)
+        self.assertGreater(len(pns), 0)
+
+        for pn in pns:
+            tt_cmd = listTrafficTypes.listTrafficTypesCmd()
+            tt_cmd.physicalnetworkid = pn.id
+            traffic_types = self.apiclient.listTrafficTypes(tt_cmd)
+            if traffic_types:
+                for tt in traffic_types:
+                    if getattr(tt, 'traffictype', '').lower() == 'guest':
+                        self.logger.info(
+                            "Selected physical network with Guest traffic: "
+                            "%s (%s)", pn.name, pn.id)
+                        return pn
+
+        self.logger.info("No physical network with Guest traffic found; "
+                         "using first: %s (%s)", pns[0].name, pns[0].id)
+        return pns[0]
+
+    def _find_provider(self, phys_net_id, name):
+        cmd = listNetworkServiceProviders.listNetworkServiceProvidersCmd()
+        cmd.physicalnetworkid = phys_net_id
+        cmd.name = name
+        providers = self.apiclient.listNetworkServiceProviders(cmd)
+        return providers[0] if isinstance(providers, list) and providers else None
+
+    def _update_provider_state(self, provider_id, state):
+        cmd = updateNetworkServiceProvider.updateNetworkServiceProviderCmd()
+        cmd.id    = provider_id
+        cmd.state = state
+        return self.apiclient.updateNetworkServiceProvider(cmd)
+
+    def _delete_provider(self, provider_id):
+        cmd = deleteNetworkServiceProvider.deleteNetworkServiceProviderCmd()
+        cmd.id = provider_id
+        self.apiclient.deleteNetworkServiceProvider(cmd)
+
+    # ------------------------------------------------------------------
+    # Script deployment helpers
+    # ------------------------------------------------------------------
+
+    def _deploy_scripts(self):
+        """Deploy scripts to all management servers and all KVM hosts.
+
+        The entry-point (network-namespace.sh) is deployed to every management
+        server at ``self.extension_path`` (the path CloudStack assigned to the
+        extension, e.g.
+        ``/usr/share/cloudstack-management/extensions/<name>/<name>.sh``).
+
+        The KVM wrapper (network-namespace-wrapper.sh) is deployed to each KVM
+        host at a *different* path derived from the extension name:
+        ``/etc/cloudstack/extensions/<name>/<name>-wrapper.sh``
+
+        The entry-point script uses the same derivation at runtime (see
+        DEFAULT_SCRIPT_PATH in network-namespace.sh) so that it always calls
+        the correct wrapper on the remote KVM host.
+        """
+        wrapper_src, entry_point_src = _ensure_scripts_downloaded()
+
+        self._mgmt_script_path = (self.extension_path or "").strip().rstrip('/')
+
+        # Deploy entry-point to ALL management servers.
+        # all_mgt_svr_details is collected once in setUpClass from
+        # cls.config.__dict__["mgtSvr"] so every server in a HA pair is covered.
+        self._all_mgmt_deployers = []
+        for mgt_details in self.all_mgt_svr_details:
+            deployer = MgmtServerDeployer(mgt_details, logger=self.logger)
+            deployer.copy_file(entry_point_src, self._mgmt_script_path)
+            self.logger.info("Entry-point deployed to mgmt %s at %s",
+                             mgt_details.get("mgtSvrIp", "?"),
+                             self._mgmt_script_path)
+            self._all_mgmt_deployers.append(deployer)
+
+        # Keep mgmt_deployer pointing at the primary server for backward-compat
+        self.mgmt_deployer = (self._all_mgmt_deployers[0]
+                              if self._all_mgmt_deployers
+                              else MgmtServerDeployer(self.mgtSvrDetails,
+                                                      logger=self.logger))
+
+        # Derive the wrapper destination path on KVM hosts from the extension path:
+        #   mgmt:  .../extensions/<name>/<name>.sh
+        #   kvm:   /etc/cloudstack/extensions/<name>/<name>-wrapper.sh
+        ext_dir_name   = os.path.basename(os.path.dirname(self._mgmt_script_path))
+        script_basename = os.path.splitext(
+            os.path.basename(self._mgmt_script_path))[0]
+        kvm_wrapper_path = "/etc/cloudstack/extensions/%s/%s-wrapper.sh" % (
+            ext_dir_name, script_basename)
+
+        self.kvm_deployer = KvmHostDeployer(
+            config_hosts=self.kvm_host_configs,
+            logger=self.logger,
+            dest_path=kvm_wrapper_path,
+        )
+        deployed = self.kvm_deployer.deploy()
+        self.logger.info(
+            "KVM wrapper deployed to %d host(s) at %s: %s",
+            len(deployed), kvm_wrapper_path, deployed)
+
+    def _cleanup_mgmt_script(self):
+        if self._mgmt_script_path:
+            all_deployers = getattr(self, '_all_mgmt_deployers', None) or []
+            if all_deployers:
+                for deployer in all_deployers:
+                    deployer.remove_file(self._mgmt_script_path)
+            elif self.mgmt_deployer:
+                self.mgmt_deployer.remove_file(self._mgmt_script_path)
+            self._mgmt_script_path = None
+
+    def _cleanup_kvm_script(self):
+        """Remove KVM wrapper script from all deployed KVM hosts."""
+        if self.kvm_deployer and self.kvm_deployer._dest_path:
+            self.kvm_deployer.remove_file(self.kvm_deployer._dest_path)
+
+    # ------------------------------------------------------------------
+    # Teardown helper
+    # ------------------------------------------------------------------
+
+    def _safe_teardown(self):
+        """Best-effort cleanup of extension/NSP/scripts."""
+        if self.extension and self.physical_network:
+            try:
+                self.extension.unregister(self.apiclient,
+                                          self.physical_network.id,
+                                          'PhysicalNetwork')
+            except Exception:
+                pass
+        if self.provider_id:
+            for fn in (lambda: self._update_provider_state(self.provider_id, 'Disabled'),
+                       lambda: self._delete_provider(self.provider_id)):
+                try:
+                    fn()
+                except Exception:
+                    pass
+            self.provider_id = None
+        if self.extension:
+            try:
+                self.extension.delete(self.apiclient,
+                                      unregisterresources=False,
+                                      removeactions=False)
+            except Exception:
+                pass
+            self.extension = None
+        self._cleanup_mgmt_script()
+        self._cleanup_kvm_script()
+
+    # ------------------------------------------------------------------
+    # SSH helpers (provider-agnostic — no KVM namespace checks)
+    # ------------------------------------------------------------------
+
+    def _verify_vm_ssh_access(self, ip, port=22, timeout=30, retries=10):
+        """Return True if SSH to *ip*:*port* succeeds using the active keypair.
+
+        The VM is expected to run Ubuntu 22.04 (cloud-init) with username
+        ``ubuntu``.  Returns False if no keypair is available or if the
+        connection fails.
+        """
+        key_file = self._ssh_private_key_file
+        if not key_file and self.keypair:
+            key_file = getattr(self.keypair, 'private_key_file', None)
+
+        if not key_file:
+            self.logger.warning("No SSH keypair available; returning False")
+            return False
+        try:
+            ssh = SshClient(
+                ip, int(port), "ubuntu", None,
+                keyPairFiles=key_file,
+                timeout=timeout,
+                retries=retries,
+            )
+            out = ssh.execute("echo EXTNET_SSH_OK")
+            return any("EXTNET_SSH_OK" in line for line in out)
+        except Exception as e:
+            self.logger.warning("SSH to %s:%s failed: %s", ip, port, e)
+            return False
+
+    def _assert_vm_ssh_accessible(self, ip, port=22, msg=None):
+        """Assert that SSH to *ip*:*port* succeeds."""
+        result = self._verify_vm_ssh_access(ip, port)
+        self.assertTrue(
+            result,
+            msg or "SSH to %s:%s should be accessible" % (ip, port))
+
+    def _assert_vm_ssh_not_accessible(self, ip, port=22, msg=None):
+        """Assert that SSH to *ip*:*port* fails (uses short timeout)."""
+        result = self._verify_vm_ssh_access(ip, port, timeout=5, retries=1)
+        self.assertFalse(
+            result,
+            msg or "SSH to %s:%s should NOT be accessible" % (ip, port))
+
+    def _create_firewall_rule_for_ssh(self, ipaddressid):
+        """Create an ingress TCP/22 firewall rule on *ipaddressid*.
+
+        Returns the created rule ID.
+        """
+        cmd = createFirewallRule.createFirewallRuleCmd()
+        cmd.ipaddressid = ipaddressid
+        cmd.protocol    = 'TCP'
+        cmd.startport   = 22
+        cmd.endport     = 22
+        cmd.cidrlist    = ['0.0.0.0/0']
+        rule = self.apiclient.createFirewallRule(cmd)
+        self.assertIsNotNone(rule, "createFirewallRule returned None")
+        self.logger.info("FW rule (TCP/22) created: id=%s on ipaddressid=%s",
+                         rule.id, ipaddressid)
+        return rule.id
+
+    def _delete_firewall_rule(self, fw_rule_id):
+        """Delete a firewall rule by ID (best-effort, warns on failure)."""
+        if not fw_rule_id:
+            return
+        cmd = deleteFirewallRule.deleteFirewallRuleCmd()
+        cmd.id = fw_rule_id
+        try:
+            self.apiclient.deleteFirewallRule(cmd)
+            self.logger.info("FW rule %s deleted", fw_rule_id)
+        except Exception as e:
+            self.logger.warning("Could not delete FW rule %s: %s", fw_rule_id, e)
+
+    def _get_source_nat_ip(self, network_id):
+        """Return the source NAT public IP object for *network_id*, or None."""
+        cmd = listPublicIpAddresses.listPublicIpAddressesCmd()
+        cmd.networkid   = network_id
+        cmd.issourcenat = True
+        try:
+            result = self.apiclient.listPublicIpAddresses(cmd)
+            if isinstance(result, list) and result:
+                return result[0]
+        except Exception as e:
+            self.logger.warning("_get_source_nat_ip(%s): %s", network_id, e)
+        return None
+
+    def _list_vpc_public_ips(self, vpc_id):
+        """Return all public IP objects associated with *vpc_id*."""
+        cmd = listPublicIpAddresses.listPublicIpAddressesCmd()
+        cmd.vpcid = vpc_id
+        cmd.listall = True
+        try:
+            result = self.apiclient.listPublicIpAddresses(cmd)
+            if isinstance(result, list):
+                return result
+        except Exception as e:
+            self.logger.warning("_list_vpc_public_ips(%s): %s", vpc_id, e)
+        return []
+
+    def _wait_for_vpc_source_nat_ip(self, vpc_id, expected_ip=None,
+                                    retries=24, interval=5):
+        """Wait until one source-NAT IP exists for the VPC (and optionally matches expected_ip)."""
+        for _ in range(retries):
+            ips = self._list_vpc_public_ips(vpc_id)
+            src = [ip for ip in ips if getattr(ip, 'issourcenat', False)]
+            if len(src) == 1:
+                current_ip = getattr(src[0], 'ipaddress', None)
+                if expected_ip is None or current_ip == expected_ip:
+                    return src[0]
+            time.sleep(interval)
+        return None
+
+    # ------------------------------------------------------------------
+    # KVM host prerequisite check (test_04 / test_05 / test_06)
+    # ------------------------------------------------------------------
+
+    def _check_kvm_host_prerequisites(self, tools=None):
+        """Verify that each configured KVM host has the required tools installed.
+
+        Checks for the presence of every tool in *tools* (default:
+        ``['arping', 'dnsmasq', 'haproxy']``) on each host in
+        ``self.kvm_host_configs`` via SSH.  The test is skipped (via
+        ``skipTest``) if any tool is absent from any reachable host.
+
+        Hosts that cannot be reached over SSH are logged as warnings and
+        excluded from the check — the connectivity failure will surface
+        naturally when the test later tries to deploy scripts.
+        """
+        if tools is None:
+            tools = ['arping', 'dnsmasq', 'haproxy']
+        if not self.kvm_host_configs:
+            self.skipTest("No KVM hosts configured — skipping prerequisite check")
+
+        missing_per_host = {}
+        for h in self.kvm_host_configs:
+            ip = h.get('ip', '')
+            if not ip:
+                continue
+            username = h.get('username', 'root')
+            password = h.get('password', '')
+            try:
+                ssh = SshClient(ip, 22, username, password)
+                missing_tools = []
+                for tool in tools:
+                    # Try both `command -v` (bash built-in) and `which`
+                    out = ssh.execute(
+                        "command -v {t} 2>/dev/null || which {t} 2>/dev/null"
+                        " || echo MISSING_{t}".format(t=tool))
+                    found = any(
+                        line.strip() and 'MISSING_' + tool not in line
+                        for line in out
+                    )
+                    if not found:
+                        missing_tools.append(tool)
+                if missing_tools:
+                    missing_per_host[ip] = missing_tools
+                    self.logger.warning(
+                        "KVM host %s is missing prerequisite(s): %s",
+                        ip, ', '.join(missing_tools))
+                else:
+                    self.logger.info(
+                        "KVM host %s: all prerequisites present (%s)",
+                        ip, ', '.join(tools))
+            except Exception as e:
+                self.logger.warning(
+                    "Could not check prerequisites on KVM host %s: %s", ip, e)
+
+        if missing_per_host:
+            detail = "; ".join(
+                "%s missing %s" % (ip, ', '.join(t))
+                for ip, t in missing_per_host.items()
+            )
+            self.skipTest(
+                "Skipping test — required tools not installed on KVM host(s): "
+                + detail)
+
+    # ------------------------------------------------------------------
+    # Extension + NSP + offering setup helper (shared by tests 04-06)
+    # ------------------------------------------------------------------
+
+    def _setup_extension_nsp_offering(self, ext_name_prefix,
+                                      supported_services=None,
+                                      guestiptype="Isolated",
+                                      for_vpc=False):
+        """Create extension, deploy scripts, register to physical network,
+        enable NSP, and optionally create a NetworkOffering.
+
+        *supported_services* is a comma-separated list of CloudStack service names.
+
+        *guestiptype* controls the guest IP type for the NetworkOffering:
+        ``"Isolated"`` (default) or ``"Shared"``.
+
+        *for_vpc* — when ``True`` the NetworkOffering creation step is skipped.
+        VPC tests create their own VPC tier offering in the test body after this
+        helper returns, so creating a generic isolated offering here would be
+        wasteful and misleading.  ``(None, ext_name)`` is returned in that case.
+
+        Sets ``self.physical_network``, ``self.extension``,
+        ``self.extension_path``, ``self.provider_id``,
+        ``self.kvm_deployer``, ``self.mgmt_deployer``.
+
+        Returns ``(nw_offering, ext_name)``.  *nw_offering* is ``None`` when
+        *for_vpc* is ``True``.  Skips when no KVM hosts are available.
+        """
+        _svc = supported_services
+        self.physical_network = self._get_physical_network()
+
+        ext_name = "%s-%s" % (ext_name_prefix, random_gen())
+        self.extension = Extension.create(
+            self.apiclient,
+            name=ext_name,
+            type='NetworkOrchestrator',
+            details=[
+                {"network.services": NETWORK_SERVICES},
+                {"network.service.capabilities": NETWORK_SERVICE_CAPABILITIES_JSON},
+            ]
+        )
+        self.assertIsNotNone(self.extension)
+        self.assertEqual('Enabled', self.extension.state)
+
+        ext_list = Extension.list(self.apiclient, id=self.extension.id)
+        self.assertTrue(ext_list and len(ext_list) > 0)
+        self.extension_path = ext_list[0].path
+        self.assertIsNotNone(self.extension_path)
+        self.logger.info("Extension '%s' created, path=%s",
+                         ext_name, self.extension_path)
+
+        # Deploy scripts
+        self._deploy_scripts()
+        kvm_hosts_csv = self.kvm_deployer.host_ips_csv()
+        if not kvm_hosts_csv:
+            self.skipTest("No KVM hosts available — skipping")
+
+        # Register extension to physical network
+        register_details = [
+            {"hosts": kvm_hosts_csv},
+            {"username": self.kvm_host_configs[0].get('username', 'root')},
+            {"password": self.kvm_host_configs[0].get('password', '')},
+        ]
+
+        self.extension.register(
+            self.apiclient,
+            self.physical_network.id,
+            'PhysicalNetwork',
+            details=register_details
+        )
+        self.logger.info("Extension registered, hosts=%s", kvm_hosts_csv)
+
+        # Enable NSP
+        provider = self._find_provider(self.physical_network.id, ext_name)
+        self.assertIsNotNone(provider,
+                             "NSP '%s' not found after registration" % ext_name)
+        self.provider_id = provider.id
+        if provider.state != 'Enabled':
+            self._update_provider_state(provider.id, 'Enabled')
+        self.assertEqual('Enabled',
+                         self._find_provider(self.physical_network.id,
+                                             ext_name).state)
+        self.logger.info("NSP '%s' enabled", ext_name)
+
+        # Create NetworkOffering — skipped for VPC tests because the caller
+        # creates a VPC tier offering separately after this helper returns.
+        if for_vpc:
+            self.logger.info(
+                "for_vpc=True: skipping isolated NetworkOffering creation "
+                "(VPC tier offering will be created in the test body)")
+            return None, ext_name
+
+        _provider_map = {s.strip(): ext_name for s in _svc.split(',')}
+        offering_params = {
+            "name":              "ExtNet-Offering-%s" % random_gen(),
+            "displaytext":       "ExtNet test offering",
+            "guestiptype":       guestiptype,
+            "traffictype":       "GUEST",
+            "supportedservices": _svc,
+            "serviceProviderList": _provider_map,
+        }
+        if guestiptype == "Shared":
+            # CloudStack requires shared guest offerings to explicitly allow
+            # caller-specified IP ranges.
+            offering_params["specifyIpRanges"] = True
+            offering_params["specifyVlan"] = True
+        if guestiptype == "Isolated" and "SourceNat" in _svc:
+            offering_params["serviceCapabilityList"] = {
+                "SourceNat": {"SupportedSourceNatTypes": "peraccount"},
+            }
+        nw_offering = NetworkOffering.create(self.apiclient, offering_params)
+        self.cleanup.append(nw_offering)
+        nw_offering.update(self.apiclient, state='Enabled')
+        self.logger.info("NetworkOffering '%s' enabled (services: %s)",
+                         nw_offering.name, _svc)
+
+        return nw_offering, ext_name
+
+    def _create_account_keypair(self, account, name_suffix=""):
+        """Create an SSH keypair scoped to *account* and save private key file."""
+        try:
+            kp_name = "extnet-%s-%s" % (name_suffix or random_gen(), random_gen())
+            kp = SSHKeyPair.create(
+                self.apiclient,
+                name=kp_name,
+                account=account.name,
+                domainid=account.domainid,
+            )
+
+            pkfile = os.path.join(tempfile.gettempdir(), kp.name)
+            with open(pkfile, "w+") as fh:
+                fh.write(kp.privatekey)
+            os.chmod(pkfile, 0o400)
+
+            self.tmp_files.append(pkfile)
+            kp.private_key_file = pkfile
+            self._ssh_private_key_file = pkfile
+            self.logger.info("Account keypair '%s' written to %s", kp.name, pkfile)
+            return kp
+        except Exception as e:
+            self.logger.warning("Could not create account keypair: %s", e)
+            return None
+
+    def _create_account_network_vm(self, nw_offering, name_suffix="",
+                                   network_params=None):
+        """Create an account, an isolated network, and deploy a cloud-init VM.
+
+        The VM is deployed with an account-scoped SSH keypair so that SSH
+        access can be tested directly.  Username is ``ubuntu``.
+
+        Returns ``(account, network, vm)``.
+        """
+        suffix = name_suffix or random_gen()
+
+        account = Account.create(
+            self.apiclient,
+            self.services["account"],
+            admin=True,
+            domainid=self.domain.id
+        )
+        self.cleanup.append(account)
+
+        net_params = {
+            "name":        "extnet-net-%s" % suffix,
+            "displaytext": "ExtNet test network %s" % suffix,
+        }
+        if network_params:
+            net_params.update(network_params)
+
+        network = Network.create(
+            self.apiclient,
+            net_params,
+            accountid=account.name,
+            domainid=account.domainid,
+            networkofferingid=nw_offering.id,
+            zoneid=self.zone.id
+        )
+        self.cleanup.insert(0, network)
+        self.assertIsNotNone(network)
+        self.logger.info("Network created: %s (%s)", network.name, network.id)
+
+        svc_offering = ServiceOffering.list(self.apiclient, issystem=False)[0]
+
+        vm_cfg = {
+            "displayname": "extnet-vm-%s" % suffix,
+            "name":        "extnet-vm-%s" % suffix,
+            "zoneid":      self.zone.id,
+        }
+        vm_kwargs = dict(
+            accountid=account.name,
+            domainid=account.domainid,
+            serviceofferingid=svc_offering.id,
+            templateid=self.template.id,
+            networkids=[network.id],
+        )
+        account_keypair = self._create_account_keypair(account, suffix)
+        if account_keypair:
+            vm_kwargs["keypair"] = account_keypair.name
+
+        vm = VirtualMachine.create(self.apiclient, vm_cfg, **vm_kwargs)
+        self.cleanup.insert(0, vm)
+        self.assertIsNotNone(vm)
+        self.logger.info("VM deployed: %s (%s)", vm.name, vm.id)
+
+        return account, network, vm
+
+    def _teardown_extension(self):
+        """Ordered teardown: disable NSP → delete provider → unregister
+        extension → delete extension → remove mgmt script."""
+        self._update_provider_state(self.provider_id, 'Disabled')
+        self._delete_provider(self.provider_id)
+        self.provider_id = None
+
+        self.extension.unregister(self.apiclient,
+                                  self.physical_network.id, 'PhysicalNetwork')
+        self.extension.delete(self.apiclient,
+                              unregisterresources=False, removeactions=False)
+        self.extension        = None
+        self.physical_network = None
+        self._cleanup_mgmt_script()
+        self._cleanup_kvm_script()
+
+    # ------------------------------------------------------------------
+    # Tests — API-only (no KVM / no SSH)
+    # ------------------------------------------------------------------
+
+    @attr(tags=["advanced", "smoke"], required_hardware="false")
+    def test_01_provider_state_transitions(self):
+        """NSP state machine: Disabled → Enabled → Disabled → Deleted."""
+        pn = self._get_physical_network()
+        self.physical_network = pn
+
+        ext_name = "extnet-nsp-" + random_gen()
+        self.extension = Extension.create(
+            self.apiclient,
+            name=ext_name,
+            type='NetworkOrchestrator',
+            details=[
+                {"network.services": NETWORK_SERVICES},
+                {"network.service.capabilities": NETWORK_SERVICE_CAPABILITIES_JSON},
+            ]
+        )
+        self.extension.register(self.apiclient, pn.id, 'PhysicalNetwork')
+
+        provider = self._find_provider(pn.id, ext_name)
+        self.assertIsNotNone(provider)
+        self.provider_id = provider.id
+
+        # Normalise to Disabled first
+        if provider.state == 'Enabled':
+            self._update_provider_state(provider.id, 'Disabled')
+        self.assertEqual('Disabled', self._find_provider(pn.id, ext_name).state)
+
+        self._update_provider_state(provider.id, 'Enabled')
+        self.assertEqual('Enabled', self._find_provider(pn.id, ext_name).state)
+        self.logger.info("NSP enabled OK")
+
+        self._update_provider_state(provider.id, 'Disabled')
+        self.assertEqual('Disabled', self._find_provider(pn.id, ext_name).state)
+        self.logger.info("NSP disabled OK")
+
+        self._teardown_extension()
+        self.logger.info("test_01 PASSED")
+
+    @attr(tags=["advanced", "smoke"], required_hardware="false")
+    def test_02_extension_capabilities_detail(self):
+        """Verify network.services and network.service.capabilities details are stored and retrievable via API."""
+        svc_caps_json = json.dumps({
+            "SourceNat": {"SupportedSourceNatTypes": "peraccount"}
+        })
+        ext = Extension.create(
+            self.apiclient,
+            name="extnet-caps-" + random_gen(),
+            type='NetworkOrchestrator',
+            details=[
+                {"network.services": "SourceNat"},
+                {"network.service.capabilities": svc_caps_json},
+            ]
+        )
+        self.cleanup.append(ext)
+        ext_list = Extension.list(self.apiclient, id=ext.id)
+        self.assertTrue(ext_list and len(ext_list) > 0)
+        ext_obj = ext_list[0]
+        if hasattr(ext_obj, 'details') and ext_obj.details:
+            d = (ext_obj.details.__dict__
+                 if not isinstance(ext_obj.details, dict)
+                 else ext_obj.details)
+            self.assertIn("network.services", d)
+            self.assertIn("SourceNat", d["network.services"].split(","))
+            self.assertIn("network.service.capabilities", d)
+            stored_caps = json.loads(d["network.service.capabilities"])
+            self.assertIn("SourceNat", stored_caps)
+        self.logger.info("test_02 PASSED")
+
+    @attr(tags=["advanced", "smoke"], required_hardware="false")
+    def test_03_extension_enable_disable_and_delete_restriction(self):
+        """Extension enable/disable; deletion blocked while registered."""
+        pn = self._get_physical_network()
+        self.physical_network = pn
+
+        ext_name = "extnet-lifecycle-" + random_gen()
+        self.extension = Extension.create(
+            self.apiclient,
+            name=ext_name,
+            type='NetworkOrchestrator',
+            details=[
+                {"network.services": NETWORK_SERVICES},
+                {"network.service.capabilities": NETWORK_SERVICE_CAPABILITIES_JSON},
+            ]
+        )
+        self.assertIsNotNone(self.extension)
+        self.assertEqual('Enabled', self.extension.state,
+                         "Extension should be Enabled by default")
+
+        self.extension.update(self.apiclient, state='Disabled')
+        ext_list = Extension.list(self.apiclient, id=self.extension.id)
+        self.assertEqual('Disabled', ext_list[0].state)
+        self.logger.info("Extension disabled OK")
+
+        self.extension.update(self.apiclient, state='Enabled')
+        ext_list = Extension.list(self.apiclient, id=self.extension.id)
+        self.assertEqual('Enabled', ext_list[0].state)
+        self.logger.info("Extension re-enabled OK")
+
+        self.extension.register(self.apiclient, pn.id, 'PhysicalNetwork')
+        self.logger.info("Extension registered to physical network %s", pn.id)
+
+        # Deletion while registered must fail
+        try:
+            self.extension.delete(self.apiclient,
+                                  unregisterresources=False, removeactions=False)
+            self.fail("Expected error when deleting extension while registered")
+        except Exception as e:
+            self.logger.info("Expected error when deleting while registered: %s",
+                             e)
+
+        self.extension.unregister(self.apiclient, pn.id, 'PhysicalNetwork')
+        self.extension.delete(self.apiclient,
+                              unregisterresources=False, removeactions=False)
+        self.extension        = None
+        self.physical_network = None
+        self.logger.info("test_03 PASSED")
+
+    # ------------------------------------------------------------------
+    # Tests — hardware required
+    # ------------------------------------------------------------------
+
+    @attr(tags=["advanced", "smoke"], required_hardware="true")
+    def test_04_dhcp_dns_userdata(self):
+        """DHCP / DNS / UserData: cloud-init VM on a shared network reaches Running state.
+
+        Creates a shared network with the extension providing Dhcp, Dns,
+        and UserData services.  Deploys a VM with the cloud-init template.
+        Verifies the VM reaches Running state, which implies it received a
+        DHCP address from the extension.  No SSH verification is performed.
+
+        Steps:
+          1. Set up extension + NSP + offering (Dhcp, Dns, UserData) with
+             guestiptype=Shared.
+          2. Create account + shared network + cloud-init VM.
+          3. Assert VM state == Running.
+          4. Teardown.
+        """
+        self._check_kvm_host_prerequisites(['arping', 'dnsmasq', 'haproxy'])
+        svc = "Dhcp,Dns,UserData"
+        nw_offering, _ext_name = self._setup_extension_nsp_offering(
+            "extnet-dhcp", supported_services=svc, guestiptype="Shared")
+
+        # Shared offerings with specifyIpRanges=True require explicit range.
+        third_octet = random.randint(32, 220)
+        shared_params = {
+            "gateway": "172.31.%d.1" % third_octet,
+            "netmask": "255.255.255.0",
+            "startip": "172.31.%d.10" % third_octet,
+            "endip": "172.31.%d.200" % third_octet,
+            "vlan": "vlan://%d" % (3000 + third_octet),
+        }
+
+        account, network, vm = self._create_account_network_vm(
+            nw_offering, name_suffix="dhcp", network_params=shared_params)
+
+        # Verify VM is in Running state — DHCP must have worked
+        self.assertEqual(
+            'Running', vm.state,
+            "VM should be in Running state after deploy (implies DHCP worked)")
+        self.logger.info("VM %s is Running — DHCP/DNS/UserData path exercised",
+                         vm.name)
+
+        # Cleanup
+        vm.delete(self.apiclient, expunge=True)
+        self.cleanup = [o for o in self.cleanup if o != vm]
+        network.delete(self.apiclient)
+        self.cleanup = [o for o in self.cleanup if o != network]
+        self._teardown_extension()
+        self.logger.info("test_04 PASSED")
+
+    @attr(tags=["advanced", "smoke"], required_hardware="true")
+    def test_05_isolated_network_full_lifecycle(self):
+        """Full isolated-network lifecycle with SSH connectivity verification.
+
+        Uses a single cloud-init VM (Ubuntu 22.04, SSH keypair, username
+        ``ubuntu``) throughout.
+
+        Sub-tests in order
+        ------------------
+        A. Static NAT
+             allocate IP → enable static NAT → assert SSH blocked (no FW rule)
+             → create FW rule (TCP/22) → assert SSH works
+             → remove FW rule → assert SSH blocked (static NAT still active)
+             → re-add FW rule → assert SSH works
+             → disable static NAT → assert SSH fails
+        B. Port forwarding (22→22)
+             allocate IP → create PF rule → create FW rule (TCP/22)
+             → assert SSH works → delete PF rule → assert SSH fails
+        C. Load balancer (haproxy, round-robin TCP/22)
+             allocate IP → create LB rule → assign VM → create FW rule
+             → assert SSH works → remove VM from LB → delete LB rule
+        D. Network restart
+             allocate IP → create PF rule → create FW rule
+             → assert SSH works (baseline)
+             → restartNetwork(cleanup=True)
+             → assert SSH works (namespace rebuilt, rules reapplied)
+        """
+        self._check_kvm_host_prerequisites(['arping', 'dnsmasq', 'haproxy'])
+        # ---- Setup ----
+        svc = ISOLATED_NETWORK_SERVICES
+        nw_offering, _ext_name = self._setup_extension_nsp_offering(
+            "extnet-isolated", supported_services=svc)
+        account, network, vm = self._create_account_network_vm(
+            nw_offering, name_suffix="iso")
+
+        # ==============================================================
+        # A. Static NAT
+        #
+        # StaticNATRule.enable() does NOT auto-create a firewall rule, so we
+        # must create one explicitly.  StaticNATRule.disable() internally
+        # calls revokeFirewallRulesForIp(), which cascade-deletes our rule,
+        # so no explicit _delete_firewall_rule() is needed afterwards.
+        # ==============================================================
+        self.logger.info("--- Sub-test A: Static NAT ---")
+        snat_ip_obj = PublicIPAddress.create(
+            self.apiclient,
+            accountid=account.name,
+            zoneid=self.zone.id,
+            domainid=account.domainid,
+            networkid=network.id
+        )
+        snat_ip    = snat_ip_obj.ipaddress.ipaddress
+        snat_ip_id = snat_ip_obj.ipaddress.id
+
+        StaticNATRule.enable(self.apiclient,
+                             ipaddressid=snat_ip_id,
+                             virtualmachineid=vm.id,
+                             networkid=network.id)
+        self.logger.info("Static NAT enabled on %s", snat_ip)
+        self._assert_vm_ssh_not_accessible(
+            snat_ip, 22,
+            "SSH via %s:22 should fail before firewall rule is created" % snat_ip)
+
+        # Explicit FW rule required — static NAT does not auto-create one
+        snat_fw_rule_id = self._create_firewall_rule_for_ssh(snat_ip_id)
+        self._assert_vm_ssh_accessible(
+            snat_ip, 22,
+            "SSH via static NAT %s:22 should succeed" % snat_ip)
+        self.logger.info("Verified: SSH works via static NAT %s", snat_ip)
+
+        # Remove the FW rule while static NAT is still active — VM must be blocked
+        self._delete_firewall_rule(snat_fw_rule_id)
+        self._assert_vm_ssh_not_accessible(
+            snat_ip, 22,
+            "SSH via %s:22 should fail after firewall rule removed (static NAT still active)"
+            % snat_ip)
+        self.logger.info("Verified: SSH blocked after FW rule removed (static NAT active)")
+
+        # Re-add the FW rule — VM must be reachable again
+        self._create_firewall_rule_for_ssh(snat_ip_id)
+        self._assert_vm_ssh_accessible(
+            snat_ip, 22,
+            "SSH via %s:22 should succeed after firewall rule re-added" % snat_ip)
+        self.logger.info("Verified: SSH restored after FW rule re-added")
+
+        # disable() cascades revokeFirewallRulesForIp() — deletes the FW rule
+        StaticNATRule.disable(self.apiclient, ipaddressid=snat_ip_id)
+        self.logger.info("Static NAT disabled on %s", snat_ip)
+        self._assert_vm_ssh_not_accessible(
+            snat_ip, 22,
+            "SSH via %s:22 should fail after static NAT disabled" % snat_ip)
+        self.logger.info("Verified: SSH fails after static NAT disabled")
+        snat_ip_obj.delete(self.apiclient)
+
+        # ==============================================================
+        # B. Port forwarding
+        #
+        # NATRule.create() passes openFirewall=True (default for non-VPC),
+        # so CloudStack automatically creates a TCP/22 FW rule with
+        # relatedRuleId=pf_rule.id.  pf_rule.delete() cascade-removes it.
+        # Do NOT call _create_firewall_rule_for_ssh() — that would conflict
+        # with the auto-created rule.
+        # ==============================================================
+        self.logger.info("--- Sub-test B: Port forwarding ---")
+        pf_ip_obj = PublicIPAddress.create(
+            self.apiclient,
+            accountid=account.name,
+            zoneid=self.zone.id,
+            domainid=account.domainid,
+            networkid=network.id
+        )
+        pf_ip    = pf_ip_obj.ipaddress.ipaddress
+        pf_ip_id = pf_ip_obj.ipaddress.id
+
+        pf_rule = NATRule.create(
+            self.apiclient, vm,
+            {"privateport": 22, "publicport": 22, "protocol": "TCP"},
+            ipaddressid=pf_ip_id,
+            networkid=network.id
+        )
+        self.assertIsNotNone(pf_rule)
+        self.logger.info("PF rule created: %s:22 → VM:22 (FW rule auto-created)",
+                         pf_ip)
+
+        self._assert_vm_ssh_accessible(
+            pf_ip, 22,
+            "SSH via PF %s:22 should succeed" % pf_ip)
+        self.logger.info("Verified: SSH works via port forwarding %s", pf_ip)
+
+        # delete() cascades revokeRelatedFirewallRule() — removes auto FW rule
+        pf_rule.delete(self.apiclient)
+        self.logger.info("PF rule deleted on %s", pf_ip)
+        self._assert_vm_ssh_not_accessible(
+            pf_ip, 22,
+            "SSH via %s:22 should fail after PF rule deleted" % pf_ip)
+        self.logger.info("Verified: SSH fails after PF rule deleted")
+        pf_ip_obj.delete(self.apiclient)
+
+        # ==============================================================
+        # C. Load balancer (haproxy)
+        #
+        # LoadBalancerRule.create() also uses openFirewall=True by default,
+        # auto-creating a TCP/22 FW rule.  lb_rule.delete() cascades it.
+        # ==============================================================
+        self.logger.info("--- Sub-test C: Load balancer ---")
+        lb_ip_obj = PublicIPAddress.create(
+            self.apiclient,
+            accountid=account.name,
+            zoneid=self.zone.id,
+            domainid=account.domainid,
+            networkid=network.id
+        )
+        lb_ip    = lb_ip_obj.ipaddress.ipaddress
+        lb_ip_id = lb_ip_obj.ipaddress.id
+
+        lb_rule = LoadBalancerRule.create(
+            self.apiclient,
+            {"name":        "lb-ssh-%s" % random_gen(),
+             "alg":         "roundrobin",
+             "privateport": 22,
+             "publicport":  22},
+            ipaddressid=lb_ip_id,
+            accountid=account.name,
+            networkid=network.id,
+            domainid=account.domainid
+        )
+        self.assertIsNotNone(lb_rule)
+        lb_rule.assign(self.apiclient, vms=[vm])
+        self.logger.info("LB rule created, VM assigned: %s:22 (FW rule auto-created)",
+                         lb_ip)
+
+        self._assert_vm_ssh_accessible(
+            lb_ip, 22,
+            "SSH via LB %s:22 should succeed (haproxy required on KVM hosts)"
+            % lb_ip)
+        self.logger.info("Verified: SSH works via haproxy LB %s", lb_ip)
+
+        lb_rule.remove(self.apiclient, vms=[vm])
+        lb_rule.delete(self.apiclient)
+        lb_ip_obj.delete(self.apiclient)
+        self.logger.info("LB rule deleted")
+
+        # ==============================================================
+        # D. Network restart (cleanup=True)
+        #
+        # NATRule.create() auto-creates the TCP/22 FW rule.
+        # After network restart both the PF rule and the FW rule must be
+        # re-applied by the extension, so SSH should work again.
+        # ==============================================================
+        self.logger.info("--- Sub-test D: Network restart ---")
+        rst_ip_obj = PublicIPAddress.create(
+            self.apiclient,
+            accountid=account.name,
+            zoneid=self.zone.id,
+            domainid=account.domainid,
+            networkid=network.id
+        )
+        rst_ip    = rst_ip_obj.ipaddress.ipaddress
+        rst_ip_id = rst_ip_obj.ipaddress.id
+
+        rst_pf = NATRule.create(
+            self.apiclient, vm,
+            {"privateport": 22, "publicport": 22, "protocol": "TCP"},
+            ipaddressid=rst_ip_id,
+            networkid=network.id
+        )
+        self._assert_vm_ssh_accessible(
+            rst_ip, 22,
+            "SSH via %s:22 should work before restart" % rst_ip)
+        self.logger.info("Baseline SSH verified before restart")
+
+        self.logger.info("Restarting network %s (cleanup=True) ...", network.id)
+        network.restart(self.apiclient, cleanup=True)
+        self.logger.info("Network restart completed")
+
+        self._assert_vm_ssh_accessible(
+            rst_ip, 22,
+            "SSH via %s:22 should work after network restart" % rst_ip)
+        self.logger.info("Verified: SSH restored after restart")
+
+        rst_pf.delete(self.apiclient)
+        rst_ip_obj.delete(self.apiclient)
+
+        # ---- Final cleanup ----
+        vm.delete(self.apiclient, expunge=True)
+        self.cleanup = [o for o in self.cleanup if o != vm]
+        network.delete(self.apiclient)
+        self.cleanup = [o for o in self.cleanup if o != network]
+        self._teardown_extension()
+        self.logger.info("test_05 PASSED")
+
+    @attr(tags=["advanced", "smoke"], required_hardware="true")
+    def test_06_vpc_multi_tier_and_restart(self):
+        """VPC multi-tier + VPC restart with SSH connectivity verification.
+
+        Creates two VPC tier networks backed by the extension, deploys a
+        VM in each tier, and verifies SSH access independently.
+
+        Sub-tests in order
+        ------------------
+        A. Baseline connectivity (before VPC restart)
+             tier-1 PF :22 → VM1          — assert SSH works
+             tier-2 LB :22 → VM2          — assert SSH works
+             tier-1 static NAT :22 → VM1  — enable, create FW rule,
+                                            assert SSH works
+        B. VPC restart (cleanup=True)
+             assert SSH still works via tier-1 PF, tier-2 LB, and
+             tier-1 static NAT after the namespace is rebuilt
+        C. Static NAT teardown (after VPC restart)
+             disable static NAT → assert SSH fails → delete IP
+        D. Partial delete
+             delete tier-1 VM + network → assert tier-2 VM still accessible
+        E. Final delete
+             delete tier-2 VM + network, VPC, teardown extension
+
+        The VPC tier network offering uses ``useVpc=on`` as required by
+        CloudStack for VPC-associated tier networks.
+        """
+        self._check_kvm_host_prerequisites(['arping', 'dnsmasq', 'haproxy'])
+        # ---- Setup: extension + NSP only (no isolated offering for VPC tests) ----
+        _nw_offering, ext_name = self._setup_extension_nsp_offering(
+            "extnet-vpc", for_vpc=True)
+
+        # ---- VPC tier network offering (useVpc=on) ----
+        vpc_tier_svc = VPC_NETWORK_SERVICES
+        _tier_prov   = {s.strip(): ext_name for s in vpc_tier_svc.split(',')}
+        vpc_tier_offering = NetworkOffering.create(self.apiclient, {
+            "name":              "ExtNet-VPCTier-%s" % random_gen(),
+            "displaytext":       "ExtNet VPC tier offering",
+            "guestiptype":       "Isolated",
+            "traffictype":       "GUEST",
+            "availability":      "Optional",
+            "useVpc":            "on",
+            "supportedservices": vpc_tier_svc,
+            "serviceProviderList": _tier_prov,
+            "serviceCapabilityList": {
+                "SourceNat": {"SupportedSourceNatTypes": "peraccount"},
+            },
+        })
+        self.cleanup.append(vpc_tier_offering)
+        vpc_tier_offering.update(self.apiclient, state='Enabled')
+        self.logger.info("VPC tier offering '%s' enabled", vpc_tier_offering.name)
+
+        # ---- VPC offering ----
+        vpc_svc  = VPC_NETWORK_SERVICES
+        _vpc_prov = {s.strip(): ext_name for s in vpc_svc.split(',')}
+        vpc_offering = VpcOffering.create(self.apiclient, {
+            "name":              "ExtNet-VPC-%s" % random_gen(),
+            "displaytext":       "ExtNet VPC offering",
+            "supportedservices": vpc_svc,
+            "serviceProviderList": _vpc_prov,
+        })
+        self.cleanup.append(vpc_offering)
+        vpc_offering.update(self.apiclient, state='Enabled')
+        self.logger.info("VPC offering '%s' enabled", vpc_offering.name)
+
+        # ---- Account ----
+        suffix  = random_gen()
+        account = Account.create(
+            self.apiclient,
+            self.services["account"],
+            admin=True,
+            domainid=self.domain.id
+        )
+        self.cleanup.append(account)
+        account_keypair = self._create_account_keypair(account, suffix)
+
+        # ---- VPC ----
+        vpc = VPC.create(
+            self.apiclient,
+            {"name":        "extnet-vpc-%s" % suffix,
+             "displaytext": "ExtNet VPC %s" % suffix,
+             "cidr":        "10.1.0.0/16"},
+            vpcofferingid=vpc_offering.id,
+            zoneid=self.zone.id,
+            account=account.name,
+            domainid=account.domainid
+        )
+        self.cleanup.insert(0, vpc)
+        self.logger.info("VPC created: %s (%s)", vpc.name, vpc.id)
+
+        # ---- Tier 1 ----
+        tier1 = Network.create(
+            self.apiclient,
+            {"name":        "tier1-%s" % suffix,
+             "displaytext": "Tier 1 %s" % suffix},
+            accountid=account.name,
+            domainid=account.domainid,
+            networkofferingid=vpc_tier_offering.id,
+            zoneid=self.zone.id,
+            vpcid=vpc.id,
+            gateway="10.1.1.1",
+            netmask="255.255.255.0"
+        )
+        self.cleanup.insert(0, tier1)
+        self.logger.info("Tier 1 created: %s (%s)", tier1.name, tier1.id)
+
+        # ---- Tier 2 ----
+        tier2 = Network.create(
+            self.apiclient,
+            {"name":        "tier2-%s" % suffix,
+             "displaytext": "Tier 2 %s" % suffix},
+            accountid=account.name,
+            domainid=account.domainid,
+            networkofferingid=vpc_tier_offering.id,
+            zoneid=self.zone.id,
+            vpcid=vpc.id,
+            gateway="10.1.2.1",
+            netmask="255.255.255.0"
+        )
+        self.cleanup.insert(0, tier2)
+        self.logger.info("Tier 2 created: %s (%s)", tier2.name, tier2.id)
+
+        svc_offering = ServiceOffering.list(self.apiclient, issystem=False)[0]
+
+        # ---- VM in tier 1 ----
+        vm1_cfg = {"displayname": "vm1-%s" % suffix,
+                   "name":        "vm1-%s" % suffix,
+                   "zoneid":      self.zone.id}
+        vm1_kw  = dict(accountid=account.name,
+                       domainid=account.domainid,
+                       serviceofferingid=svc_offering.id,
+                       templateid=self.template.id,
+                       networkids=[tier1.id])
+        if account_keypair:
+            vm1_kw["keypair"] = account_keypair.name
+        vm1 = VirtualMachine.create(self.apiclient, vm1_cfg, **vm1_kw)
+        self.cleanup.insert(0, vm1)
+        self.logger.info("VM1 deployed in tier 1: %s (%s)", vm1.name, vm1.id)
+
+        # ---- VM in tier 2 ----
+        vm2_cfg = {"displayname": "vm2-%s" % suffix,
+                   "name":        "vm2-%s" % suffix,
+                   "zoneid":      self.zone.id}
+        vm2_kw  = dict(accountid=account.name,
+                       domainid=account.domainid,
+                       serviceofferingid=svc_offering.id,
+                       templateid=self.template.id,
+                       networkids=[tier2.id])
+        if account_keypair:
+            vm2_kw["keypair"] = account_keypair.name
+        vm2 = VirtualMachine.create(self.apiclient, vm2_cfg, **vm2_kw)
+        self.cleanup.insert(0, vm2)
+        self.logger.info("VM2 deployed in tier 2: %s (%s)", vm2.name, vm2.id)
+
+        # ---- Tier 1: PF rule ----
+        pf_ip1 = PublicIPAddress.create(
+            self.apiclient,
+            accountid=account.name,
+            zoneid=self.zone.id,
+            domainid=account.domainid,
+            networkid=tier1.id,
+            vpcid=vpc.id
+        )
+        pf_rule1 = NATRule.create(
+            self.apiclient, vm1,
+            {"privateport": 22, "publicport": 22, "protocol": "TCP"},
+            ipaddressid=pf_ip1.ipaddress.id,
+            networkid=tier1.id
+        )
+        tier1_pf_ip = pf_ip1.ipaddress.ipaddress
+        self.logger.info("Tier 1 PF: %s:22 → VM1:22", tier1_pf_ip)
+
+        # ---- Tier 2: LB rule ----
+        lb_ip2 = PublicIPAddress.create(
+            self.apiclient,
+            accountid=account.name,
+            zoneid=self.zone.id,
+            domainid=account.domainid,
+            networkid=tier2.id,
+            vpcid=vpc.id
+        )
+        lb_rule2 = LoadBalancerRule.create(
+            self.apiclient,
+            {"name":        "vpc-lb-ssh-%s" % random_gen(),
+             "alg":         "roundrobin",
+             "privateport": 22,
+             "publicport":  22},
+            ipaddressid=lb_ip2.ipaddress.id,
+            accountid=account.name,
+            networkid=tier2.id,
+            domainid=account.domainid
+        )
+        self.assertIsNotNone(lb_rule2)
+        lb_rule2.assign(self.apiclient, vms=[vm2])
+        tier2_lb_ip = lb_ip2.ipaddress.ipaddress
+        self.logger.info("Tier 2 LB: %s:22 → VM2:22", tier2_lb_ip)
+
+        # ---- Tier 1: Static NAT (allocated BEFORE restart) ----
+        snat_ip1_obj = PublicIPAddress.create(
+            self.apiclient,
+            accountid=account.name,
+            zoneid=self.zone.id,
+            domainid=account.domainid,
+            networkid=tier1.id,
+            vpcid=vpc.id
+        )
+        snat_ip1    = snat_ip1_obj.ipaddress.ipaddress
+        snat_ip1_id = snat_ip1_obj.ipaddress.id
+        StaticNATRule.enable(
+            self.apiclient,
+            ipaddressid=snat_ip1_id,
+            virtualmachineid=vm1.id,
+            networkid=tier1.id
+        )
+        self.logger.info("Static NAT enabled on tier-1: %s → VM1", snat_ip1)
+
+        # ==============================================================
+        # A. Baseline connectivity — BEFORE VPC restart
+        # ==============================================================
+        self.logger.info("--- Sub-test A: Baseline connectivity (before restart) ---")
+
+        self._assert_vm_ssh_accessible(
+            tier1_pf_ip, 22,
+            "SSH to tier-1 VM via PF (%s) should succeed before restart"
+            % tier1_pf_ip)
+        self.logger.info("Verified: SSH to tier-1 VM works via PF (before restart)")
+
+        self._assert_vm_ssh_accessible(
+            tier2_lb_ip, 22,
+            "SSH to tier-2 VM via LB (%s) should succeed before restart"
+            % tier2_lb_ip)
+        self.logger.info("Verified: SSH to tier-2 VM works via LB (before restart)")
+
+        self._assert_vm_ssh_accessible(
+            snat_ip1, 22,
+            "SSH to tier-1 VM via static NAT (%s) should succeed before restart"
+            % snat_ip1)
+        self.logger.info("Verified: SSH to tier-1 VM works via static NAT (before restart)")
+
+        # ==============================================================
+        # B. VPC restart (cleanup=True)
+        #    Re-verify all three access methods after the namespace is rebuilt.
+        # ==============================================================
+        self.logger.info("--- Sub-test B: VPC restart (cleanup=True) ---")
+        self.logger.info("Restarting VPC %s (cleanup=True) ...", vpc.id)
+        vpc.restart(self.apiclient, cleanup=True)
+        self.logger.info("VPC restart completed")
+
+        self._assert_vm_ssh_accessible(
+            tier1_pf_ip, 22,
+            "SSH to tier-1 VM via PF must work after VPC restart")
+        self.logger.info("Verified: SSH to tier-1 VM works via PF (after restart)")
+
+        self._assert_vm_ssh_accessible(
+            tier2_lb_ip, 22,
+            "SSH to tier-2 VM via LB must work after VPC restart")
+        self.logger.info("Verified: SSH to tier-2 VM works via LB (after restart)")
+
+        self._assert_vm_ssh_accessible(
+            snat_ip1, 22,
+            "SSH to tier-1 VM via static NAT must work after VPC restart")
+        self.logger.info("Verified: SSH to tier-1 VM works via static NAT (after restart)")
+
+        # ==============================================================
+        # C. Disable static NAT (after VPC restart)
+        # ==============================================================
+        self.logger.info("--- Sub-test C: Disable static NAT (after restart) ---")
+        StaticNATRule.disable(self.apiclient, ipaddressid=snat_ip1_id)
+        self.logger.info("Static NAT disabled on tier-1 %s", snat_ip1)
+        self._assert_vm_ssh_not_accessible(
+            snat_ip1, 22,
+            "SSH via tier-1 %s:22 should fail after static NAT disabled" % snat_ip1)
+        self.logger.info("Verified: SSH fails after static NAT disabled")
+        snat_ip1_obj.delete(self.apiclient)
+
+        # ==============================================================
+        # D. Partial delete: tier-1 — tier-2 must remain accessible
+        # ==============================================================
+        self.logger.info("--- Sub-test D: Delete tier-1, verify tier-2 intact ---")
+        pf_rule1.delete(self.apiclient)
+        pf_ip1.delete(self.apiclient)
+        vm1.delete(self.apiclient, expunge=True)
+        self.cleanup = [o for o in self.cleanup if o != vm1]
+        tier1.delete(self.apiclient)
+        self.cleanup = [o for o in self.cleanup if o != tier1]
+        self.logger.info("Tier 1 VM + network deleted")
+
+        # Tier 2 must remain accessible — cmd_destroy() on tier-1 must not
+        # delete tier-2's public veth (fixed via .tier ownership tracking).
+        self._assert_vm_ssh_accessible(
+            tier2_lb_ip, 22,
+            "SSH to tier-2 VM via LB must still work after tier-1 deleted")
+        self.logger.info("Verified: tier-2 VM still accessible via LB after tier-1 deleted")
+
+        # ==============================================================
+        # E. Final delete: tier-2, VPC
+        # ==============================================================
+        lb_rule2.remove(self.apiclient, vms=[vm2])
+        lb_rule2.delete(self.apiclient)
+        lb_ip2.delete(self.apiclient)
+        vm2.delete(self.apiclient, expunge=True)
+        self.cleanup = [o for o in self.cleanup if o != vm2]
+        tier2.delete(self.apiclient)
+        self.cleanup = [o for o in self.cleanup if o != tier2]
+        self.logger.info("Tier 2 VM + network deleted")
+
+        vpc.delete(self.apiclient)
+        self.cleanup = [o for o in self.cleanup if o != vpc]
+
+        self._teardown_extension()
+        self.logger.info("test_06 PASSED")
+
+    @attr(tags=["advanced", "smoke"], required_hardware="true")
+    def test_07_vpc_network_acl(self):
+        """VPC Network ACL testing with multiple tiers and traffic rules.
+
+        Creates two VPC tiers with distinct network ACL lists and verifies that
+        ACL rules are correctly applied:
+          - Inbound rules from public network (via port forwarding)
+          - Egress rules between VPC tiers (via ping)
+
+        Sub-tests in order
+        ------------------
+        A. Setup: Create two tiers with different ACL lists
+              tier1 (acl1): Allow ICMP from anywhere, Deny SSH
+              tier2 (acl2): Allow ICMP and SSH from anywhere
+        B. Deploy VMs and verify ACLs block SSH to tier1, allow ICMP to both tiers
+        C. Test inter-tier ICMP communication between VMs
+        D. Verify SSH only works on tier2 (where ACL permits it)
+        E. Cleanup
+
+        The test uses ICMP (ping) to verify inter-tier connectivity and SSH
+        attempts to verify ACL rules are enforced on ingress traffic.
+        """
+        self._check_kvm_host_prerequisites(['arping', 'dnsmasq', 'haproxy'])
+
+        # ---- Setup: extension + NSP (supporting NetworkACL) ----
+        _nw_offering, ext_name = self._setup_extension_nsp_offering(
+            "extnet-acl", for_vpc=True)
+
+        # ---- VPC tier network offering (useVpc=on, with NetworkACL support) ----
+        vpc_tier_svc = VPC_NETWORK_SERVICES
+        _tier_prov   = {s.strip(): ext_name for s in vpc_tier_svc.split(',')}
+        vpc_tier_offering = NetworkOffering.create(self.apiclient, {
+            "name":              "ExtNet-VPCTier-ACL-%s" % random_gen(),
+            "displaytext":       "ExtNet VPC tier offering with ACL",
+            "guestiptype":       "Isolated",
+            "traffictype":       "GUEST",
+            "availability":      "Optional",
+            "useVpc":            "on",
+            "supportedservices": vpc_tier_svc,
+            "serviceProviderList": _tier_prov,
+            "serviceCapabilityList": {
+                "SourceNat": {"SupportedSourceNatTypes": "peraccount"},
+            },
+        })
+        self.cleanup.append(vpc_tier_offering)
+        vpc_tier_offering.update(self.apiclient, state='Enabled')
+        self.logger.info("VPC tier offering '%s' enabled", vpc_tier_offering.name)
+
+        # ---- VPC offering ----
+        vpc_svc  = VPC_NETWORK_SERVICES
+        _vpc_prov = {s.strip(): ext_name for s in vpc_svc.split(',')}
+        vpc_offering = VpcOffering.create(self.apiclient, {
+            "name":              "ExtNet-VPC-ACL-%s" % random_gen(),
+            "displaytext":       "ExtNet VPC offering with ACL",
+            "supportedservices": vpc_svc,
+            "serviceProviderList": _vpc_prov,
+        })
+        self.cleanup.append(vpc_offering)
+        vpc_offering.update(self.apiclient, state='Enabled')
+        self.logger.info("VPC offering '%s' enabled", vpc_offering.name)
+
+        # ---- Account ----
+        suffix  = random_gen()
+        account = Account.create(
+            self.apiclient,
+            self.services["account"],
+            admin=True,
+            domainid=self.domain.id
+        )
+        self.cleanup.append(account)
+        account_keypair = self._create_account_keypair(account, suffix)
+
+        # ---- VPC ----
+        vpc = VPC.create(
+            self.apiclient,
+            {"name":        "extnet-vpc-acl-%s" % suffix,
+             "displaytext": "ExtNet VPC ACL %s" % suffix,
+             "cidr":        "10.2.0.0/16"},
+            vpcofferingid=vpc_offering.id,
+            zoneid=self.zone.id,
+            account=account.name,
+            domainid=account.domainid
+        )
+        self.cleanup.insert(0, vpc)
+        self.logger.info("VPC created: %s (%s)", vpc.name, vpc.id)
+
+        # ---- Network ACL Lists ----
+        # ACL1: Restrict to ICMP only (deny SSH)
+        acl1 = NetworkACLList.create(
+            self.apiclient,
+            {"name": "acl1-icmp-only-%s" % suffix,
+             "description": "ACL1 for tier1 - ICMP only"},
+            vpcid=vpc.id
+        )
+        self.cleanup.insert(0, acl1)
+        self.logger.info("ACL1 created: %s (ICMP only)", acl1.id)
+
+        # ACL2: Allow ICMP and SSH
+        acl2 = NetworkACLList.create(
+            self.apiclient,
+            {"name": "acl2-icmp-ssh-%s" % suffix,
+             "description": "ACL2 for tier2 - ICMP and SSH allowed"},
+            vpcid=vpc.id
+        )
+        self.cleanup.insert(0, acl2)
+        self.logger.info("ACL2 created: %s (ICMP and SSH)", acl2.id)
+
+        # ---- Tier 1 with ACL1 (ICMP only) ----
+        tier1 = Network.create(
+            self.apiclient,
+            {"name":        "tier1-acl-%s" % suffix,
+             "displaytext": "Tier 1 ACL %s" % suffix},
+            accountid=account.name,
+            domainid=account.domainid,
+            networkofferingid=vpc_tier_offering.id,
+            zoneid=self.zone.id,
+            vpcid=vpc.id,
+            gateway="10.2.1.1",
+            netmask="255.255.255.0"
+        )
+        self.cleanup.insert(0, tier1)
+        self.logger.info("Tier 1 created: %s (%s)", tier1.name, tier1.id)
+
+        # ---- Tier 2 with ACL2 (ICMP + SSH) ----
+        tier2 = Network.create(
+            self.apiclient,
+            {"name":        "tier2-acl-%s" % suffix,
+             "displaytext": "Tier 2 ACL %s" % suffix},
+            accountid=account.name,
+            domainid=account.domainid,
+            networkofferingid=vpc_tier_offering.id,
+            zoneid=self.zone.id,
+            vpcid=vpc.id,
+            gateway="10.2.2.1",
+            netmask="255.255.255.0"
+        )
+        self.cleanup.insert(0, tier2)
+        self.logger.info("Tier 2 created: %s (%s)", tier2.name, tier2.id)
+
+        svc_offering = ServiceOffering.list(self.apiclient, issystem=False)[0]
+
+        # ---- VM in tier 1 ----
+        vm1_cfg = {"displayname": "vm1-acl-%s" % suffix,
+                   "name":        "vm1-acl-%s" % suffix,
+                   "zoneid":      self.zone.id}
+        vm1_kw  = dict(accountid=account.name,
+                       domainid=account.domainid,
+                       serviceofferingid=svc_offering.id,
+                       templateid=self.template.id,
+                       networkids=[tier1.id])
+        if account_keypair:
+            vm1_kw["keypair"] = account_keypair.name
+        vm1 = VirtualMachine.create(self.apiclient, vm1_cfg, **vm1_kw)
+        self.cleanup.insert(0, vm1)
+        self.logger.info("VM1 deployed in tier 1: %s (%s)", vm1.name, vm1.id)
+
+        # ---- VM in tier 2 ----
+        vm2_cfg = {"displayname": "vm2-acl-%s" % suffix,
+                   "name":        "vm2-acl-%s" % suffix,
+                   "zoneid":      self.zone.id}
+        vm2_kw  = dict(accountid=account.name,
+                       domainid=account.domainid,
+                       serviceofferingid=svc_offering.id,
+                       templateid=self.template.id,
+                       networkids=[tier2.id])
+        if account_keypair:
+            vm2_kw["keypair"] = account_keypair.name
+        vm2 = VirtualMachine.create(self.apiclient, vm2_cfg, **vm2_kw)
+        self.cleanup.insert(0, vm2)
+        self.logger.info("VM2 deployed in tier 2: %s (%s)", vm2.name, vm2.id)
+
+        # Get VM IPs for later use
+        vm1_networks = VirtualMachine.list(self.apiclient, id=vm1.id)[0].nic
+        vm1_ip = None
+        for nic in vm1_networks:
+            if nic.networkid == tier1.id:
+                vm1_ip = nic.ipaddress
+        self.assertIsNotNone(vm1_ip, "VM1 should have IP in tier1")
+        self.logger.info("VM1 IP in tier1: %s", vm1_ip)
+
+        vm2_networks = VirtualMachine.list(self.apiclient, id=vm2.id)[0].nic
+        vm2_ip = None
+        for nic in vm2_networks:
+            if nic.networkid == tier2.id:
+                vm2_ip = nic.ipaddress
+        self.assertIsNotNone(vm2_ip, "VM2 should have IP in tier2")
+        self.logger.info("VM2 IP in tier2: %s", vm2_ip)
+
+        # ==============================================================
+        # A. Setup ACL rules
+        # ==============================================================
+        self.logger.info("--- Sub-test A: Setting up ACL rules ---")
+
+        # ACL1 rules: ICMP allowed, SSH denied (ingress), ICMP allowed (egress)
+        # Rule numbers must be unique per ACL list (across ingress+egress).
+        # Ingress rule: Allow ICMP
+        NetworkACL.create(
+            self.apiclient,
+            {"protocol": "ICMP", "icmptype": -1, "icmpcode": -1,
+             "traffictype": "Ingress", "aclid": acl1.id,
+             "cidrlist": ["0.0.0.0/0"], "action": "Allow", "number": 10},
+            networkid=tier1.id
+        )
+        self.logger.info("ACL1 Ingress rule: ICMP Allow")
+
+        # Ingress rule: Deny SSH
+        NetworkACL.create(
+            self.apiclient,
+            {"protocol": "TCP", "startport": 22, "endport": 22,
+             "traffictype": "Ingress", "aclid": acl1.id,
+             "cidrlist": ["0.0.0.0/0"], "action": "Deny", "number": 20},
+            networkid=tier1.id
+        )
+        self.logger.info("ACL1 Ingress rule: SSH Deny")
+
+        # Egress rule: Allow all
+        NetworkACL.create(
+            self.apiclient,
+            {"protocol": "All", "traffictype": "Egress", "aclid": acl1.id,
+             "cidrlist": ["0.0.0.0/0"], "action": "Allow", "number": 30},
+            networkid=tier1.id
+        )
+        self.logger.info("ACL1 Egress rule: All Allow")
+
+        # ACL2 rules: ICMP and SSH allowed (ingress), All allowed (egress)
+        # Ingress rule: Allow ICMP
+        NetworkACL.create(
+            self.apiclient,
+            {"protocol": "ICMP", "icmptype": -1, "icmpcode": -1,
+             "traffictype": "Ingress", "aclid": acl2.id,
+             "cidrlist": ["0.0.0.0/0"], "action": "Allow", "number": 10},
+            networkid=tier2.id
+        )
+        self.logger.info("ACL2 Ingress rule: ICMP Allow")
+
+        # Ingress rule: Allow SSH
+        NetworkACL.create(
+            self.apiclient,
+            {"protocol": "TCP", "startport": 22, "endport": 22,
+             "traffictype": "Ingress", "aclid": acl2.id,
+             "cidrlist": ["0.0.0.0/0"], "action": "Allow", "number": 20},
+            networkid=tier2.id
+        )
+        self.logger.info("ACL2 Ingress rule: SSH Allow")
+
+        # Egress rule: Allow all
+        NetworkACL.create(
+            self.apiclient,
+            {"protocol": "All", "traffictype": "Egress", "aclid": acl2.id,
+             "cidrlist": ["0.0.0.0/0"], "action": "Allow", "number": 30},
+            networkid=tier2.id
+        )
+        self.logger.info("ACL2 Egress rule: All Allow")
+
+        # Apply the ACL lists to the tier networks
+        tier1.replaceACLList(self.apiclient, acl1.id)
+        self.logger.info("Applied ACL1 (deny SSH) to tier1")
+        tier2.replaceACLList(self.apiclient, acl2.id)
+        self.logger.info("Applied ACL2 (allow SSH) to tier2")
+
+        # ==============================================================
+        # B. Test Public IP access with ACL enforcement (via PF)
+        # ==============================================================
+        self.logger.info("--- Sub-test B: Test public IP access with ACLs ---")
+
+        # Create public IP and PF for tier1 (should block SSH due to ACL1)
+        ip1 = PublicIPAddress.create(
+            self.apiclient,
+            accountid=account.name,
+            zoneid=self.zone.id,
+            domainid=account.domainid,
+            networkid=tier1.id,
+            vpcid=vpc.id
+        )
+        tier1_public_ip = ip1.ipaddress.ipaddress
+        self.logger.info("Tier1 public IP allocated: %s", tier1_public_ip)
+
+        pf_rule1 = NATRule.create(
+            self.apiclient, vm1,
+            {"privateport": 22, "publicport": 22, "protocol": "TCP"},
+            ipaddressid=ip1.ipaddress.id,
+            networkid=tier1.id,
+            vpcid=vpc.id
+        )
+        self.assertIsNotNone(pf_rule1)
+        self.logger.info("Tier1 PF rule created: %s:22 → VM1:22", tier1_public_ip)
+
+        # SSH to tier1 should fail due to ACL denying SSH
+        self._assert_vm_ssh_not_accessible(
+            tier1_public_ip, 22,
+            "SSH to tier1 %s should FAIL (ACL denies SSH)" % tier1_public_ip)
+        self.logger.info("Verified: SSH to tier1 correctly blocked by ACL")
+
+        # Create public IP and PF for tier2 (should allow SSH due to ACL2)
+        ip2 = PublicIPAddress.create(
+            self.apiclient,
+            accountid=account.name,
+            zoneid=self.zone.id,
+            domainid=account.domainid,
+            networkid=tier2.id,
+            vpcid=vpc.id
+        )
+        tier2_public_ip = ip2.ipaddress.ipaddress
+        self.logger.info("Tier2 public IP allocated: %s", tier2_public_ip)
+
+        pf_rule2 = NATRule.create(
+            self.apiclient, vm2,
+            {"privateport": 22, "publicport": 22, "protocol": "TCP"},
+            ipaddressid=ip2.ipaddress.id,
+            networkid=tier2.id,
+            vpcid=vpc.id
+        )
+        self.assertIsNotNone(pf_rule2)
+        self.logger.info("Tier2 PF rule created: %s:22 → VM2:22", tier2_public_ip)
+
+        # SSH to tier2 should succeed due to ACL allowing SSH
+        self._assert_vm_ssh_accessible(
+            tier2_public_ip, 22,
+            "SSH to tier2 %s should succeed (ACL allows SSH)" % tier2_public_ip)
+        self.logger.info("Verified: SSH to tier2 correctly allowed by ACL")
+
+        # ==============================================================
+        # C. Test inter-tier ICMP communication
+        # ==============================================================
+        self.logger.info("--- Sub-test C: Test inter-tier ICMP (ping) ---")
+
+        # From VM2 (tier2), ping VM1 (tier1) — should succeed (both allow ICMP egress)
+        # This tests that the ACL egress rules work and inter-tier routing is OK
+        try:
+            ssh_vm2 = SshClient(
+                tier2_public_ip, 22, "ubuntu", None,
+                keyPairFiles=self._ssh_private_key_file,
+                timeout=30, retries=10
+            )
+            out = ssh_vm2.execute("ping -c 3 %s 2>&1 | tail -5" % vm1_ip)
+            ping_result = "\n".join(out)
+            # Check if ping succeeded (look for "3 packets transmitted" or similar)
+            if "transmitted" in ping_result.lower():
+                self.logger.info("Ping from VM2 to VM1 output:\n%s", ping_result)
+                if "0 received" not in ping_result.lower():
+                    self.logger.info("Verified: Inter-tier ping succeeded (ICMP egress rule allows it)")
+                else:
+                    self.logger.warning("Ping packets were transmitted but all lost")
+            else:
+                self.logger.warning("Could not determine ping result from: %s", ping_result)
+        except Exception as e:
+            self.logger.warning("Could not execute ping test: %s", e)
+
+        # ==============================================================
+        # D. Additional SSH verification
+        # ==============================================================
+        self.logger.info("--- Sub-test D: Additional SSH verification ---")
+
+        # Re-verify tier2 SSH works after ACL rules are fully active
+        self._assert_vm_ssh_accessible(
+            tier2_public_ip, 22,
+            "SSH to tier2 should still work (ACL permits SSH)")
+        self.logger.info("Verified: SSH to tier2 confirmed working")
+
+        # ==============================================================
+        # E. Cleanup
+        # ==============================================================
+        self.logger.info("--- Sub-test E: Cleanup ---")
+        pf_rule1.delete(self.apiclient)
+        ip1.delete(self.apiclient)
+        pf_rule2.delete(self.apiclient)
+        ip2.delete(self.apiclient)
+
+        vm1.delete(self.apiclient, expunge=True)
+        self.cleanup = [o for o in self.cleanup if o != vm1]
+        vm2.delete(self.apiclient, expunge=True)
+        self.cleanup = [o for o in self.cleanup if o != vm2]
+        tier1.delete(self.apiclient)
+        self.cleanup = [o for o in self.cleanup if o != tier1]
+        tier2.delete(self.apiclient)
+        self.cleanup = [o for o in self.cleanup if o != tier2]
+
+        vpc.delete(self.apiclient)
+        self.cleanup = [o for o in self.cleanup if o != vpc and o != acl1 and o != acl2]
+
+        self._teardown_extension()
+        self.logger.info("test_07 PASSED")
+
+    @attr(tags=["advanced", "smoke"], required_hardware="true")
+    def test_08_custom_action_policy_based_routing(self):
+        """Custom-action smoke test for PBR lifecycle helpers.
+
+        Verifies that network custom actions can create/list/delete:
+          - routing tables
+          - routes per table
+          - policy rules
+        """
+        self._check_kvm_host_prerequisites(['ip', 'arping', 'dnsmasq', 'haproxy'])
+
+        svc = ISOLATED_NETWORK_SERVICES
+        nw_offering, _ext_name = self._setup_extension_nsp_offering(
+            "extnet-pbr", supported_services=svc)
+        _account, network, vm = self._create_account_network_vm(
+            nw_offering, name_suffix="pbr")
+
+        # Use a unique table name to avoid collisions with stale test state.
+        table_name = "app-%s" % random.randint(100, 999)
+        route_cidr = "172.30.%d.0/24" % random.randint(1, 200)
+
+        actions = []
+        try:
+            def _mk_action(name, parameters = []):
+                a = ExtensionCustomAction.create(
+                    self.apiclient,
+                    extensionid=self.extension.id,
+                    enabled=True,
+                    name=name,
+                    description="PBR smoke: %s" % name,
+                    resourcetype='Network',
+                    parameters=parameters
+                )
+                actions.append(a)
+                return a
+
+            act_create_table = _mk_action("pbr-create-table", parameters=[
+                {"name": "table-id", "type": "STRING", "required": True},
+                {"name": "table-name", "type": "STRING", "required": True},
+            ])
+            act_delete_table = _mk_action("pbr-delete-table", parameters=[
+                {"name": "table-name", "type": "STRING", "required": True},
+            ])
+            act_list_tables  = _mk_action("pbr-list-tables")
+            act_add_route    = _mk_action("pbr-add-route", parameters=[
+                {"name": "table", "type": "STRING", "required": True},
+                {"name": "route", "type": "STRING", "required": True},
+            ])
+            act_delete_route = _mk_action("pbr-delete-route", parameters=[
+                {"name": "table", "type": "STRING", "required": True},
+                {"name": "route", "type": "STRING", "required": True},
+            ])
+            act_list_routes  = _mk_action("pbr-list-routes", parameters=[
+                {"name": "table", "type": "STRING", "required": False},
+            ])
+            act_add_rule     = _mk_action("pbr-add-rule", parameters=[
+                {"name": "table", "type": "STRING", "required": True},
+                {"name": "rule", "type": "STRING", "required": True},
+            ])
+            act_delete_rule  = _mk_action("pbr-delete-rule", parameters=[
+                {"name": "table", "type": "STRING", "required": True},
+                {"name": "rule", "type": "STRING", "required": True},
+            ])
+            act_list_rules   = _mk_action("pbr-list-rules", parameters=[
+                {"name": "table", "type": "STRING", "required": False},
+            ])
+
+            # 1) Create and list routing table
+            out = self._run_custom_action_logged(
+                act_create_table,
+                resourceid=network.id,
+                parameters=[{"table-id": "100", "table-name": table_name}],
+            )
+            self.assertTrue(getattr(out, 'success', False), "pbr-create-table should succeed")
+
+            out = self._run_custom_action_logged(act_list_tables, resourceid=network.id)
+            self.assertTrue(getattr(out, 'success', False), "pbr-list-tables should succeed")
+            self.assertIn(table_name, self._custom_action_details(out))
+
+            # 2) Add and list route in table
+            out = self._run_custom_action_logged(
+                act_add_route,
+                resourceid=network.id,
+                parameters=[{"table": table_name, "route": "blackhole %s" % route_cidr}],
+            )
+            self.assertTrue(getattr(out, 'success', False), "pbr-add-route should succeed")
+
+            out = self._run_custom_action_logged(
+                act_list_routes,
+                resourceid=network.id,
+                parameters=[{"table": table_name}],
+            )
+            self.assertTrue(getattr(out, 'success', False), "pbr-list-routes should succeed")
+            self.assertIn(route_cidr, self._custom_action_details(out))
+
+            # 3) Add and list policy rule
+            out = self._run_custom_action_logged(
+                act_add_rule,
+                resourceid=network.id,
+                parameters=[{"table": table_name, "rule": "to %s" % route_cidr}],
+            )
+            self.assertTrue(getattr(out, 'success', False), "pbr-add-rule should succeed")
+
+            out = self._run_custom_action_logged(
+                act_list_rules,
+                resourceid=network.id,
+                parameters=[{"table": table_name}],
+            )
+            self.assertTrue(getattr(out, 'success', False), "pbr-list-rules should succeed")
+            self.assertIn(table_name, self._custom_action_details(out))
+
+            # 4) Delete policy rule, route, and table
+            out = self._run_custom_action_logged(
+                act_delete_rule,
+                resourceid=network.id,
+                parameters=[{"table": table_name, "rule": "to %s" % route_cidr}],
+            )
+            self.assertTrue(getattr(out, 'success', False), "pbr-delete-rule should succeed")
+
+            out = self._run_custom_action_logged(
+                act_delete_route,
+                resourceid=network.id,
+                parameters=[{"table": table_name, "route": "blackhole %s" % route_cidr}],
+            )
+            self.assertTrue(getattr(out, 'success', False), "pbr-delete-route should succeed")
+
+            out = self._run_custom_action_logged(
+                act_delete_table,
+                resourceid=network.id,
+                parameters=[{"table-name": table_name}],
+            )
+            self.assertTrue(getattr(out, 'success', False), "pbr-delete-table should succeed")
+
+            self.logger.info("test_08 PASSED")
+        finally:
+            for action in actions:
+                try:
+                    action.delete(self.apiclient)
+                except Exception:
+                    pass
+            try:
+                vm.delete(self.apiclient, expunge=True)
+                self.cleanup = [o for o in self.cleanup if o != vm]
+            except Exception:
+                pass
+            try:
+                network.delete(self.apiclient)
+                self.cleanup = [o for o in self.cleanup if o != network]
+            except Exception:
+                pass
+            try:
+                self._teardown_extension()
+            except Exception:
+                pass
+
+    @attr(tags=["advanced", "smoke"], required_hardware="true")
+    def test_09_vpc_source_nat_ip_update(self):
+        """Update VPC source NAT IP and verify old/new source NAT flags flip correctly."""
+        self._check_kvm_host_prerequisites(['arping'])
+
+        svc  = VPC_NETWORK_SERVICES
+        _nw_offering, ext_name = self._setup_extension_nsp_offering(
+            "extnet-vpc-snat-update", for_vpc=True)
+
+        suffix = random_gen()
+        account = None
+        vpc = None
+        tier = None
+        vm = None
+        ip1 = None
+        ip2 = None
+        pf_rule = None
+        lb_rule = None
+        static_nat_enabled = False
+        try:
+            # VPC tier network offering (useVpc=on)
+            _tier_prov = {s.strip(): ext_name for s in svc.split(',')}
+            vpc_tier_offering = NetworkOffering.create(self.apiclient, {
+                "name":              "ExtNet-VPCTier-SNAT-%s" % random_gen(),
+                "displaytext":       "ExtNet VPC tier offering for source NAT update",
+                "guestiptype":       "Isolated",
+                "traffictype":       "GUEST",
+                "availability":      "Optional",
+                "useVpc":            "on",
+                "supportedservices": svc,
+                "serviceProviderList": _tier_prov,
+                "serviceCapabilityList": {
+                    "SourceNat": {"SupportedSourceNatTypes": "peraccount"},
+                },
+            })
+            self.cleanup.append(vpc_tier_offering)
+            vpc_tier_offering.update(self.apiclient, state='Enabled')
+            self.logger.info("VPC tier offering '%s' enabled", vpc_tier_offering.name)
+
+            # VPC offering
+            _vpc_prov = {s.strip(): ext_name for s in svc.split(',')}
+            vpc_offering = VpcOffering.create(self.apiclient, {
+                "name":              "ExtNet-VPC-SNAT-%s" % random_gen(),
+                "displaytext":       "ExtNet VPC offering for source NAT update",
+                "supportedservices": svc,
+                "serviceProviderList": _vpc_prov,
+            })
+            self.cleanup.append(vpc_offering)
+            vpc_offering.update(self.apiclient, state='Enabled')
+            self.logger.info("VPC offering '%s' enabled", vpc_offering.name)
+
+            account = Account.create(
+                self.apiclient,
+                self.services["account"],
+                admin=True,
+                domainid=self.domain.id
+            )
+            self.cleanup.append(account)
+            account_keypair = self._create_account_keypair(account, suffix)
+
+            vpc = VPC.create(
+                self.apiclient,
+                {"name":        "extnet-vpc-snat-%s" % suffix,
+                 "displaytext": "ExtNet VPC SNAT %s" % suffix,
+                 "cidr":        "10.3.0.0/16"},
+                vpcofferingid=vpc_offering.id,
+                zoneid=self.zone.id,
+                account=account.name,
+                domainid=account.domainid
+            )
+            self.cleanup.insert(0, vpc)
+            self.logger.info("VPC created: %s (%s)", vpc.name, vpc.id)
+
+            tier = Network.create(
+                self.apiclient,
+                {"name":        "tier-snat-%s" % suffix,
+                 "displaytext": "Tier SNAT %s" % suffix},
+                accountid=account.name,
+                domainid=account.domainid,
+                networkofferingid=vpc_tier_offering.id,
+                zoneid=self.zone.id,
+                vpcid=vpc.id,
+                gateway="10.3.1.1",
+                netmask="255.255.255.0"
+            )
+            self.cleanup.insert(0, tier)
+
+            # Create a vm instance in the tier, so that the vpc and tier are implemented on the backend and have their source NAT IPs allocated.
+            svc_offering = ServiceOffering.list(self.apiclient, issystem=False)[0]
+            vm_cfg = {"displayname": "vm-snat-%s" % suffix,
+                      "name":        "vm-snat-%s" % suffix,
+                      "zoneid":      self.zone.id}
+            vm_kw  = dict(accountid=account.name,
+                          domainid=account.domainid,
+                          serviceofferingid=svc_offering.id,
+                          templateid=self.template.id,
+                          networkids=[tier.id])
+            if account_keypair:
+                vm_kw["keypair"] = account_keypair.name
+            vm = VirtualMachine.create(self.apiclient, vm_cfg, **vm_kw)
+            self.cleanup.insert(0, vm)
+
+            # Wait for the VPC's auto-assigned source NAT IP (CloudStack assigns
+            # one automatically when the VPC is first used; it is NOT necessarily
+            # the first manually-allocated IP).
+            src_before = self._wait_for_vpc_source_nat_ip(vpc.id)
+            self.assertIsNotNone(src_before,
+                                 "A source NAT IP should already exist for the VPC")
+            src_before_addr = getattr(src_before, 'ipaddress', None)
+            self.logger.info("Initial source NAT IP: %s", src_before_addr)
+
+            # Allocate ip1 and ip2 as candidates for the updated source NAT.
+            ip1 = PublicIPAddress.create(
+                self.apiclient,
+                accountid=account.name,
+                zoneid=self.zone.id,
+                domainid=account.domainid,
+                networkid=tier.id,
+                vpcid=vpc.id
+            )
+            ip1_addr = ip1.ipaddress.ipaddress
+
+            ip2 = PublicIPAddress.create(
+                self.apiclient,
+                accountid=account.name,
+                zoneid=self.zone.id,
+                domainid=account.domainid,
+                networkid=tier.id,
+                vpcid=vpc.id
+            )
+            ip2_addr = ip2.ipaddress.ipaddress
+
+            # Use ip1 for static NAT (SSH/22) and verify ingress connectivity.
+            StaticNATRule.enable(
+                self.apiclient,
+                ip1.ipaddress.id,
+                vm.id,
+                networkid=tier.id
+            )
+            static_nat_enabled = True
+
+            # Use ip2 for both PF and LB on different public ports.
+            pf_port = 2222
+            lb_port = 2223
+            pf_rule = NATRule.create(
+                self.apiclient,
+                vm,
+                {"privateport": 22, "publicport": pf_port, "protocol": "TCP"},
+                ipaddressid=ip2.ipaddress.id,
+                networkid=tier.id,
+                vpcid=vpc.id
+            )
+            self.assertIsNotNone(pf_rule, "Port forwarding rule should be created on ip2")
+
+            lb_rule = LoadBalancerRule.create(
+                self.apiclient,
+                {
+                    "name": "lb-ssh-%s" % suffix,
+                    "alg": "roundrobin",
+                    "privateport": 22,
+                    "publicport": lb_port,
+                    "protocol": "TCP",
+                },
+                ipaddressid=ip2.ipaddress.id,
+                accountid=account.name,
+                domainid=account.domainid,
+                networkid=tier.id,
+                vpcid=vpc.id
+            )
+            self.assertIsNotNone(lb_rule, "Load balancer rule should be created on ip2")
+            lb_rule.assign(self.apiclient, [vm])
+
+            # Validate all inbound paths before source NAT migration.
+            self._assert_vm_ssh_accessible(
+                ip1_addr, 22,
+                "Static NAT SSH on ip1 should work before source NAT update")
+            self._assert_vm_ssh_accessible(
+                ip2_addr, pf_port,
+                "Port forwarding SSH on ip2 should work before source NAT update")
+            self._assert_vm_ssh_accessible(
+                ip2_addr, lb_port,
+                "Load balancer SSH on ip2 should work before source NAT update")
+
+            ip3 = PublicIPAddress.create(
+                self.apiclient,
+                accountid=account.name,
+                zoneid=self.zone.id,
+                domainid=account.domainid,
+                networkid=tier.id,
+                vpcid=vpc.id
+            )
+            ip3_addr = ip3.ipaddress.ipaddress
+
+            self.logger.info("Updating VPC source NAT IP to %s", ip3_addr)
+            update_resp = vpc.update(self.apiclient, sourcenatipaddress=ip3_addr)
+            self.assertIsNotNone(update_resp,
+                                 "updateVPC should return a response")
+
+            src_after = self._wait_for_vpc_source_nat_ip(vpc.id, expected_ip=ip3_addr)
+            self.assertIsNotNone(src_after,
+                                 "Updated source NAT IP should be %s" % ip3_addr)
+
+            all_vpc_ips = self._list_vpc_public_ips(vpc.id)
+            self.assertEqual(len(all_vpc_ips), 4,
+                                    "VPC should have four public IPs")
+
+            by_addr = {getattr(x, 'ipaddress', None): x for x in all_vpc_ips}
+            self.assertIn(src_before_addr, by_addr,
+                          "Original source NAT IP must remain allocated to VPC")
+            self.assertIn(ip1_addr, by_addr, "Static NAT IP must remain allocated to VPC")
+            self.assertIn(ip2_addr, by_addr, "New source NAT IP must remain allocated to VPC")
+
+            src_ips = [x for x in all_vpc_ips if getattr(x, 'issourcenat', False)]
+            self.assertEqual(1, len(src_ips),
+                             "Exactly one VPC public IP must be marked source NAT")
+            self.assertEqual(ip3_addr, getattr(src_ips[0], 'ipaddress', None),
+                             "Source NAT IP should switch to the requested IP")
+            self.assertFalse(getattr(by_addr[src_before_addr], 'issourcenat', False),
+                             "Original source NAT IP must be unset after update")
+            self.assertTrue(getattr(by_addr[ip3_addr], 'issourcenat', False),
+                            "Requested source NAT IP must be marked source NAT")
+
+            # Validate all inbound paths still work after source NAT migration.
+            self._assert_vm_ssh_accessible(
+                ip1_addr, 22,
+                "Static NAT SSH on ip1 should work after source NAT update")
+            self._assert_vm_ssh_accessible(
+                ip2_addr, pf_port,
+                "Port forwarding SSH on ip2 should work after source NAT update")
+            self._assert_vm_ssh_accessible(
+                ip2_addr, lb_port,
+                "Load balancer SSH on ip2 should work after source NAT update")
+
+            self.logger.info("test_09 PASSED")
+        finally:
+            try:
+                if lb_rule and vm:
+                    lb_rule.remove(self.apiclient, [vm])
+            except Exception:
+                pass
+            try:
+                if lb_rule:
+                    lb_rule.delete(self.apiclient)
+            except Exception:
+                pass
+            try:
+                if pf_rule:
+                    pf_rule.delete(self.apiclient)
+            except Exception:
+                pass
+            try:
+                if static_nat_enabled and ip1:
+                    StaticNATRule.disable(self.apiclient, ip1.ipaddress.id)
+            except Exception:
+                pass
+            try:
+                if ip1:
+                    ip1.delete(self.apiclient)
+            except Exception:
+                pass
+            try:
+                if ip2:
+                    ip2.delete(self.apiclient)
+            except Exception:
+                pass
+            try:
+                if vm:
+                    vm.delete(self.apiclient, expunge=True)
+                    self.cleanup = [o for o in self.cleanup if o != vm]
+            except Exception:
+                pass
+            try:
+                if tier:
+                    tier.delete(self.apiclient)
+                    self.cleanup = [o for o in self.cleanup if o != tier]
+            except Exception:
+                pass
+            try:
+                if vpc:
+                    vpc.delete(self.apiclient)
+                    self.cleanup = [o for o in self.cleanup if o != vpc]
+            except Exception:
+                pass
+            try:
+                self._teardown_extension()
+            except Exception:
+                pass
+
+    @attr(tags=["advanced", "smoke"], required_hardware="true")
+    def test_10_vpc_custom_action_policy_based_routing(self):
+        """Custom-action smoke test for PBR lifecycle helpers on a VPC.
+
+        Same as test_08 but exercised against a VPC instead of
+        an isolated network.  Verifies that network custom actions work
+        correctly in a VPC context:
+          - routing tables
+          - routes per table
+          - policy rules
+        """
+        self._check_kvm_host_prerequisites(['ip', 'arping', 'dnsmasq', 'haproxy'])
+
+        svc  = VPC_NETWORK_SERVICES
+        _nw_offering, ext_name = self._setup_extension_nsp_offering(
+            "extnet-vpc-pbr", for_vpc=True)
+
+        # ---- VPC tier network offering (useVpc=on) ----
+        _tier_prov = {s.strip(): ext_name for s in svc.split(',')}
+        vpc_tier_offering = NetworkOffering.create(self.apiclient, {
+            "name":              "ExtNet-VPCTier-PBR-%s" % random_gen(),
+            "displaytext":       "ExtNet VPC tier offering for PBR",
+            "guestiptype":       "Isolated",
+            "traffictype":       "GUEST",
+            "availability":      "Optional",
+            "useVpc":            "on",
+            "supportedservices": svc,
+            "serviceProviderList": _tier_prov,
+            "serviceCapabilityList": {
+                "SourceNat": {"SupportedSourceNatTypes": "peraccount"},
+            },
+        })
+        self.cleanup.append(vpc_tier_offering)
+        vpc_tier_offering.update(self.apiclient, state='Enabled')
+
+        # ---- VPC offering ----
+        _vpc_prov = {s.strip(): ext_name for s in svc.split(',')}
+        vpc_offering = VpcOffering.create(self.apiclient, {
+            "name":              "ExtNet-VPC-PBR-%s" % random_gen(),
+            "displaytext":       "ExtNet VPC offering for PBR",
+            "supportedservices": svc,
+            "serviceProviderList": _vpc_prov,
+        })
+        self.cleanup.append(vpc_offering)
+        vpc_offering.update(self.apiclient, state='Enabled')
+
+        suffix = random_gen()
+        account = Account.create(
+            self.apiclient,
+            self.services["account"],
+            admin=True,
+            domainid=self.domain.id
+        )
+        self.cleanup.append(account)
+
+        vpc = VPC.create(
+            self.apiclient,
+            {"name":        "extnet-vpc-pbr-%s" % suffix,
+             "displaytext": "ExtNet VPC PBR %s" % suffix,
+             "cidr":        "10.1.0.0/16"},
+            vpcofferingid=vpc_offering.id,
+            zoneid=self.zone.id,
+            account=account.name,
+            domainid=account.domainid
+        )
+        self.cleanup.insert(0, vpc)
+
+        tier = Network.create(
+            self.apiclient,
+            {"name":        "tier-pbr-%s" % suffix,
+             "displaytext": "Tier PBR %s" % suffix},
+            accountid=account.name,
+            domainid=account.domainid,
+            networkofferingid=vpc_tier_offering.id,
+            zoneid=self.zone.id,
+            vpcid=vpc.id,
+            gateway="10.1.1.1",
+            netmask="255.255.255.0"
+        )
+        self.cleanup.insert(0, tier)
+
+        svc_offering = ServiceOffering.list(self.apiclient, issystem=False)[0]
+        vm = VirtualMachine.create(
+            self.apiclient,
+            {"displayname": "vm-pbr-%s" % suffix,
+             "name":        "vm-pbr-%s" % suffix,
+             "zoneid":      self.zone.id},
+            accountid=account.name,
+            domainid=account.domainid,
+            serviceofferingid=svc_offering.id,
+            templateid=self.template.id,
+            networkids=[tier.id]
+        )
+        self.cleanup.insert(0, vm)
+
+        table_name = "app-%s" % random.randint(100, 999)
+        route_cidr = "172.30.%d.0/24" % random.randint(1, 200)
+
+        actions = []
+        try:
+            def _mk_action(name, parameters=[]):
+                a = ExtensionCustomAction.create(
+                    self.apiclient,
+                    extensionid=self.extension.id,
+                    enabled=True,
+                    name=name,
+                    description="VPC PBR smoke: %s" % name,
+                    resourcetype='Vpc',
+                    parameters=parameters
+                )
+                actions.append(a)
+                return a
+
+            act_create_table = _mk_action("pbr-create-table", parameters=[
+                {"name": "table-id", "type": "STRING", "required": True},
+                {"name": "table-name", "type": "STRING", "required": True},
+            ])
+            act_delete_table = _mk_action("pbr-delete-table", parameters=[
+                {"name": "table-name", "type": "STRING", "required": True},
+            ])
+            act_list_tables  = _mk_action("pbr-list-tables")
+            act_add_route    = _mk_action("pbr-add-route", parameters=[
+                {"name": "table", "type": "STRING", "required": True},
+                {"name": "route", "type": "STRING", "required": True},
+            ])
+            act_delete_route = _mk_action("pbr-delete-route", parameters=[
+                {"name": "table", "type": "STRING", "required": True},
+                {"name": "route", "type": "STRING", "required": True},
+            ])
+            act_list_routes  = _mk_action("pbr-list-routes", parameters=[
+                {"name": "table", "type": "STRING", "required": False},
+            ])
+            act_add_rule     = _mk_action("pbr-add-rule", parameters=[
+                {"name": "table", "type": "STRING", "required": True},
+                {"name": "rule", "type": "STRING", "required": True},
+            ])
+            act_delete_rule  = _mk_action("pbr-delete-rule", parameters=[
+                {"name": "table", "type": "STRING", "required": True},
+                {"name": "rule", "type": "STRING", "required": True},
+            ])
+            act_list_rules   = _mk_action("pbr-list-rules", parameters=[
+                {"name": "table", "type": "STRING", "required": False},
+            ])
+
+            # 1) Create and list routing table
+            out = self._run_custom_action_logged(
+                act_create_table,
+                resourceid=vpc.id,
+                parameters=[{"table-id": "100", "table-name": table_name}],
+            )
+            self.assertTrue(getattr(out, 'success', False), "pbr-create-table should succeed")
+
+            out = self._run_custom_action_logged(act_list_tables, resourceid=vpc.id)
+            self.assertTrue(getattr(out, 'success', False), "pbr-list-tables should succeed")
+            self.assertIn(table_name, self._custom_action_details(out))
+
+            # 2) Add and list route in table
+            out = self._run_custom_action_logged(
+                act_add_route,
+                resourceid=vpc.id,
+                parameters=[{"table": table_name, "route": "blackhole %s" % route_cidr}],
+            )
+            self.assertTrue(getattr(out, 'success', False), "pbr-add-route should succeed")
+
+            out = self._run_custom_action_logged(
+                act_list_routes,
+                resourceid=vpc.id,
+                parameters=[{"table": table_name}],
+            )
+            self.assertTrue(getattr(out, 'success', False), "pbr-list-routes should succeed")
+            self.assertIn(route_cidr, self._custom_action_details(out))
+
+            # 3) Add and list policy rule
+            out = self._run_custom_action_logged(
+                act_add_rule,
+                resourceid=vpc.id,
+                parameters=[{"table": table_name, "rule": "to %s" % route_cidr}],
+            )
+            self.assertTrue(getattr(out, 'success', False), "pbr-add-rule should succeed")
+
+            out = self._run_custom_action_logged(
+                act_list_rules,
+                resourceid=vpc.id,
+                parameters=[{"table": table_name}],
+            )
+            self.assertTrue(getattr(out, 'success', False), "pbr-list-rules should succeed")
+            self.assertIn(table_name, self._custom_action_details(out))
+
+            # 4) Delete policy rule, route, and table
+            out = self._run_custom_action_logged(
+                act_delete_rule,
+                resourceid=vpc.id,
+                parameters=[{"table": table_name, "rule": "to %s" % route_cidr}],
+            )
+            self.assertTrue(getattr(out, 'success', False), "pbr-delete-rule should succeed")
+
+            out = self._run_custom_action_logged(
+                act_delete_route,
+                resourceid=vpc.id,
+                parameters=[{"table": table_name, "route": "blackhole %s" % route_cidr}],
+            )
+            self.assertTrue(getattr(out, 'success', False), "pbr-delete-route should succeed")
+
+            out = self._run_custom_action_logged(
+                act_delete_table,
+                resourceid=vpc.id,
+                parameters=[{"table-name": table_name}],
+            )
+            self.assertTrue(getattr(out, 'success', False), "pbr-delete-table should succeed")
+
+            self.logger.info("test_10 PASSED")
+        finally:
+            for action in actions:
+                try:
+                    action.delete(self.apiclient)
+                except Exception:
+                    pass
+            try:
+                vm.delete(self.apiclient, expunge=True)
+                self.cleanup = [o for o in self.cleanup if o != vm]
+            except Exception:
+                pass
+            try:
+                tier.delete(self.apiclient)
+                self.cleanup = [o for o in self.cleanup if o != tier]
+            except Exception:
+                pass
+            try:
+                vpc.delete(self.apiclient)
+                self.cleanup = [o for o in self.cleanup if o != vpc]
+            except Exception:
+                pass
+            try:
+                self._teardown_extension()
+            except Exception:
+                pass
+
+    # ------------------------------------------------------------------
+    # IPv6 helper: ensure a guest IPv6 prefix exists for the zone
+    # ------------------------------------------------------------------
+
+    def _ensure_guest_ipv6_prefix(self):
+        """Return an existing or newly created guest IPv6 prefix for the zone.
+
+        Uses ``services["guestip6prefix"]["prefix"]`` when available; falls
+        back to ``fd17:ac56:1234:1000::/52``.  Returns ``(prefix_obj, created)``
+        where *created* is True when this call created the prefix (the caller
+        is responsible for deleting it on teardown).
+        """
+        cmd = listGuestNetworkIpv6Prefixes.listGuestNetworkIpv6PrefixesCmd()
+        cmd.zoneid = self.zone.id
+        existing = self.apiclient.listGuestNetworkIpv6Prefixes(cmd)
+        if isinstance(existing, list) and existing:
+            self.logger.info("Found existing guest IPv6 prefix: %s",
+                             existing[0].prefix)
+            return existing[0], False
+
+        prefix_str = (self.services
+                      .get("guestip6prefix", {})
+                      .get("prefix", "fd17:ac56:1234:1000::/52"))
+        cmd = createGuestNetworkIpv6Prefix.createGuestNetworkIpv6PrefixCmd()
+        cmd.zoneid = self.zone.id
+        cmd.prefix = prefix_str
+        prefix_obj = self.apiclient.createGuestNetworkIpv6Prefix(cmd)
+        self.logger.info("Created guest IPv6 prefix: %s", prefix_str)
+        return prefix_obj, True
+
+    # ------------------------------------------------------------------
+    # IPv6 helper: ensure a public IPv6 IP range exists with a VLAN
+    # ------------------------------------------------------------------
+
+    def _ensure_public_ipv6_range(self):
+        """Return an existing or newly created public IPv6 IP range for the zone.
+
+        CloudStack requires a public IP range that has both IPv4 and IPv6
+        entries sharing the same VLAN for dualstack isolated networks to work.
+        This helper:
+          1. Returns immediately if an existing range already has ``ip6cidr``
+             and ``ip6gateway`` set.
+          2. Otherwise extracts the VLAN from the first IPv4 public range and
+             creates a new IPv6 range using ``services["publicip6range"]``.
+
+        Returns ``(range_obj, created)`` where *created* is True when this call
+        created the range (the caller is responsible for deleting it on
+        teardown).
+        """
+        ip_ranges = PublicIpRange.list(self.apiclient, zoneid=self.zone.id)
+        ipv4_range_vlan = None
+        if isinstance(ip_ranges, list):
+            for ip_range in ip_ranges:
+                if getattr(ip_range, 'ip6cidr', None) and \
+                        getattr(ip_range, 'ip6gateway', None):
+                    self.logger.info(
+                        "Found existing public IPv6 range: cidr=%s",
+                        ip_range.ip6cidr)
+                    return ip_range, False
+                if getattr(ip_range, 'netmask', None) and \
+                        getattr(ip_range, 'gateway', None):
+                    vlan = getattr(ip_range, 'vlan', None) or ''
+                    if ipv4_range_vlan is None and vlan.startswith("vlan://"):
+                        vlan_id = vlan.replace("vlan://", "")
+                        if vlan_id == "untagged":
+                            ipv4_range_vlan = None
+                        else:
+                            try:
+                                ipv4_range_vlan = int(vlan_id)
+                            except ValueError:
+                                ipv4_range_vlan = None
+
+        ip6range_services = dict(self.services.get("publicip6range", {}))
+        ip6range_services["zoneid"] = self.zone.id
+        ip6range_services["vlan"]   = ipv4_range_vlan
+        ip6range_obj = PublicIpRange.create(self.apiclient, ip6range_services)
+        self.logger.info(
+            "Created public IPv6 range: cidr=%s vlan=%s",
+            ip6range_services.get("ip6cidr"), ipv4_range_vlan)
+        return ip6range_obj, True
+
+    # ------------------------------------------------------------------
+    # Test 11: IPv6 dualstack isolated network
+    # ------------------------------------------------------------------
+
+    @attr(tags=["advanced", "smoke"], required_hardware="true")
+    def test_11_ipv6_dualstack_isolated_network(self):
+        """IPv6 dualstack isolated network: namespace address and radvd.
+
+        Creates an isolated network with ``internetprotocol=dualstack`` backed
+        by the network-namespace extension and verifies end-to-end IPv6
+        provisioning:
+
+        A. API attribute verification
+             network receives ``ip6cidr`` and ``ip6gateway``
+             VM NIC receives ``ip6address`` (EUI-64 via SLAAC)
+        B. KVM namespace verification
+             IPv6 gateway address is present on the guest veth inside the
+             namespace
+             radvd is running inside the namespace with a valid config
+             (``AdvSendAdvert on``, ``AdvAutonomous on``, correct prefix)
+
+        Prerequisites
+        -------------
+        * KVM hosts reachable and have ``dnsmasq``, ``arping``, ``radvd``
+          installed.
+        * Zone has (or can have) a guest IPv6 prefix configured.
+        * Global setting ``ipv6.offering.enabled`` can be set to ``true``.
+        """
+        self._check_kvm_host_prerequisites(['arping', 'dnsmasq', 'radvd'])
+
+        # ---- Preserve and enable ipv6.offering.enabled ----
+        initial_ipv6_cfg = None
+        try:
+            cfg_list = Configurations.list(self.apiclient,
+                                           name="ipv6.offering.enabled")
+            if cfg_list:
+                initial_ipv6_cfg = cfg_list[0].value
+            Configurations.update(self.apiclient, "ipv6.offering.enabled",
+                                  "true")
+            self.logger.info("ipv6.offering.enabled set to true "
+                             "(was: %s)", initial_ipv6_cfg)
+        except Exception as e:
+            self.skipTest("Cannot enable ipv6.offering.enabled: %s" % e)
+
+        # ---- Ensure a guest IPv6 prefix exists ----
+        ip6prefix_obj     = None
+        ip6prefix_created = False
+        try:
+            ip6prefix_obj, ip6prefix_created = self._ensure_guest_ipv6_prefix()
+        except Exception as e:
+            if initial_ipv6_cfg is not None:
+                try:
+                    Configurations.update(self.apiclient,
+                                          "ipv6.offering.enabled",
+                                          initial_ipv6_cfg)
+                except Exception:
+                    pass
+            self.skipTest("Cannot set up guest IPv6 prefix: %s" % e)
+
+        # ---- Ensure a public IPv6 range exists (same VLAN as IPv4) ----
+        ip6pubrange_obj     = None
+        ip6pubrange_created = False
+        try:
+            ip6pubrange_obj, ip6pubrange_created = \
+                self._ensure_public_ipv6_range()
+        except Exception as e:
+            if initial_ipv6_cfg is not None:
+                try:
+                    Configurations.update(self.apiclient,
+                                          "ipv6.offering.enabled",
+                                          initial_ipv6_cfg)
+                except Exception:
+                    pass
+            if ip6prefix_created and ip6prefix_obj:
+                try:
+                    del_cmd = (deleteGuestNetworkIpv6Prefix
+                               .deleteGuestNetworkIpv6PrefixCmd())
+                    del_cmd.id = ip6prefix_obj.id
+                    self.apiclient.deleteGuestNetworkIpv6Prefix(del_cmd)
+                except Exception:
+                    pass
+            self.skipTest("Cannot set up public IPv6 range: %s" % e)
+
+        svc = ISOLATED_NETWORK_SERVICES
+
+        try:
+            # ---- Extension + NSP (no offering here; we create a dualstack one) ----
+            _, ext_name = self._setup_extension_nsp_offering(
+                "extnet-ip6iso", supported_services=svc, for_vpc=True)
+
+            # ---- Dualstack network offering ----
+            _provider_map = {s.strip(): ext_name for s in svc.split(',')}
+            ds_offering_params = {
+                "name":              "ExtNet-IP6-Offering-%s" % random_gen(),
+                "displaytext":       "ExtNet IPv6 dualstack offering",
+                "guestiptype":       "Isolated",
+                "traffictype":       "GUEST",
+                "internetprotocol":  "dualstack",
+                "supportedservices": svc,
+                "serviceProviderList": _provider_map,
+                "serviceCapabilityList": {
+                    "SourceNat": {"SupportedSourceNatTypes": "peraccount"},
+                },
+            }
+            nw_offering = NetworkOffering.create(self.apiclient, ds_offering_params)
+            self.cleanup.append(nw_offering)
+            nw_offering.update(self.apiclient, state='Enabled')
+            self.logger.info("Dualstack offering '%s' enabled", nw_offering.name)
+
+            # ---- Account + network + VM ----
+            account, network, vm = self._create_account_network_vm(
+                nw_offering, name_suffix="ip6iso")
+
+            # ==========================================================
+            # A. API: verify network and VM NIC get IPv6 attributes
+            # ==========================================================
+            self.logger.info("--- Sub-test A: API IPv6 attribute verification ---")
+
+            nw_list = Network.list(self.apiclient, id=network.id, listall=True)
+            self.assertIsInstance(nw_list, list,
+                "Network.list returned no list")
+            self.assertGreater(len(nw_list), 0, "Network not found after creation")
+            nw = nw_list[0]
+
+            self.assertIsNotNone(nw.ip6cidr,
+                "Network %s should have ip6cidr (dualstack offering)" % network.id)
+            self.assertIsNotNone(nw.ip6gateway,
+                "Network %s should have ip6gateway (dualstack offering)" % network.id)
+            ip6cidr    = nw.ip6cidr
+            ip6gateway = nw.ip6gateway
+            self.logger.info("Network IPv6: gateway=%s cidr=%s",
+                             ip6gateway, ip6cidr)
+
+            nics = NIC.list(self.apiclient,
+                            virtualmachineid=vm.id,
+                            networkid=network.id)
+            self.assertIsInstance(nics, list, "NIC.list returned no list")
+            self.assertGreater(len(nics), 0, "VM NIC not found")
+            vm_ip6 = getattr(nics[0], 'ip6address', None)
+            self.assertIsNotNone(vm_ip6,
+                "VM NIC should have ip6address (SLAAC) after deploy")
+            self.logger.info("VM NIC IPv6: %s", vm_ip6)
+            self.logger.info("Sub-test A PASSED")
+
+            # ==========================================================
+            # B. KVM namespace: IPv6 address on veth + radvd running
+            # ==========================================================
+            self.logger.info("--- Sub-test B: KVM namespace IPv6 verification ---")
+
+            # The network namespace lives on the KVM host chosen by
+            # ensure-network-device, which is NOT necessarily the same host that
+            # runs the VM.  Search every configured KVM host for the ip6-gateway
+            # state file written by config-dhcp-subnet.
+            self.assertTrue(self.kvm_host_configs,
+                "No KVM hosts configured — cannot verify namespace state")
+
+            prefix_size = ip6cidr.split('/')[-1]
+
+            kvm_ssh      = None
+            kvm_host_ip  = None
+            found_path   = None
+            discover_cmd = (
+                "for f in /var/lib/cloudstack/*/network-*/ip6-gateway; do "
+                "[ -f \"$f\" ] && grep -qF '%(gw)s' \"$f\" "
+                "&& echo \"$f\" && break; done" % {"gw": ip6gateway}
+            )
+            for h in self.kvm_host_configs:
+                h_ip  = h.get('ip', '')
+                h_user = h.get('username', 'root')
+                h_pass = h.get('password', '')
+                if not h_ip:
+                    continue
+                try:
+                    ssh = SshClient(h_ip, 22, h_user, h_pass)
+                    out = ssh.execute(discover_cmd)
+                    fp  = next((l.strip() for l in out if l.strip()), None)
+                    if fp:
+                        kvm_ssh     = ssh
+                        kvm_host_ip = h_ip
+                        found_path  = fp
+                        self.logger.info(
+                            "Found ip6-gateway state on KVM host %s: %s",
+                            h_ip, fp)
+                        break
+                except Exception as e:
+                    self.logger.warning(
+                        "Could not search KVM host %s: %s", h_ip, e)
+
+            self.assertIsNotNone(
+                found_path,
+                "No ip6-gateway state file containing %s found on any "
+                "configured KVM host (searched: %s)"
+                % (ip6gateway,
+                   ", ".join(h.get('ip', '?')
+                             for h in self.kvm_host_configs)))
+
+            state_dir      = found_path.rsplit('/ip6-gateway', 1)[0]
+            ns_id          = state_dir.split('/')[-1].replace('network-', '')
+            ns_name        = "cs-net-" + ns_id
+            radvd_conf_path = "%s/radvd/radvd.conf" % state_dir
+            radvd_pid_path  = "%s/radvd/radvd.pid"  % state_dir
+            self.logger.info("Discovered state_dir=%s  namespace=%s",
+                             state_dir, ns_name)
+
+            # B1. Namespace exists
+            ns_out  = kvm_ssh.execute(
+                "ip netns list 2>/dev/null | grep -c '^%s' || echo 0" % ns_name)
+            self.assertTrue(
+                any(line.strip() not in ('', '0') for line in ns_out),
+                "Namespace '%s' not found on KVM host %s" % (ns_name, kvm_host_ip))
+            self.logger.info("B1 PASSED: namespace '%s' exists", ns_name)
+
+            # B2. IPv6 gateway address is present on the guest veth
+            ip6_out = kvm_ssh.execute(
+                "ip netns exec '%s' ip -6 addr show 2>/dev/null"
+                " | grep '%s' || true" % (ns_name, ip6gateway))
+            self.assertTrue(
+                any(ip6gateway in line for line in ip6_out),
+                "IPv6 gateway %s not found on any interface in namespace '%s'"
+                % (ip6gateway, ns_name))
+            self.logger.info("B2 PASSED: IPv6 gateway %s present in namespace",
+                             ip6gateway)
+
+            # B3. radvd.conf exists and is non-empty
+            conf_check = kvm_ssh.execute(
+                "test -s '%s' && echo RADVD_CONF_OK"
+                " || echo RADVD_CONF_MISSING" % radvd_conf_path)
+            self.assertTrue(
+                any("RADVD_CONF_OK" in line for line in conf_check),
+                "radvd.conf not found or empty at %s" % radvd_conf_path)
+            self.logger.info("B3 PASSED: radvd.conf present at %s",
+                             radvd_conf_path)
+
+            # B4. radvd.conf has correct directives and prefix size
+            conf_lines = kvm_ssh.execute("cat '%s' 2>/dev/null" % radvd_conf_path)
+            conf_text  = "\n".join(conf_lines)
+            self.assertIn("AdvSendAdvert on", conf_text,
+                "radvd.conf missing 'AdvSendAdvert on'")
+            self.assertIn("AdvAutonomous on", conf_text,
+                "radvd.conf missing 'AdvAutonomous on'")
+            self.assertIn("/" + prefix_size, conf_text,
+                "radvd.conf missing prefix size '/%s'" % prefix_size)
+            self.logger.info(
+                "B4 PASSED: radvd.conf directives correct "
+                "(AdvSendAdvert on, AdvAutonomous on, /%s)", prefix_size)
+
+            # B5. radvd process is running inside the namespace
+            radvd_run = kvm_ssh.execute(
+                "pid=$(cat '%(pid)s' 2>/dev/null) && [ -n \"$pid\" ] && "
+                "ip netns exec '%(ns)s' ls /proc/$pid/status >/dev/null 2>&1 && "
+                "echo RADVD_RUNNING || echo RADVD_STOPPED"
+                % {"pid": radvd_pid_path, "ns": ns_name})
+            self.assertTrue(
+                any("RADVD_RUNNING" in line for line in radvd_run),
+                "radvd not running inside namespace '%s' (pid file: %s)"
+                % (ns_name, radvd_pid_path))
+            self.logger.info("B5 PASSED: radvd is running inside namespace '%s'",
+                             ns_name)
+
+            self.logger.info(
+                "Sub-test B PASSED: ns=%s gw=%s radvd=running",
+                ns_name, ip6gateway)
+
+        finally:
+            # Restore ipv6.offering.enabled
+            if initial_ipv6_cfg is not None:
+                try:
+                    Configurations.update(self.apiclient,
+                                          "ipv6.offering.enabled",
+                                          initial_ipv6_cfg)
+                    self.logger.info("Restored ipv6.offering.enabled to %s",
+                                     initial_ipv6_cfg)
+                except Exception as e:
+                    self.logger.warning(
+                        "Could not restore ipv6.offering.enabled: %s", e)
+
+            # Remove public IPv6 range if this test created it
+            if ip6pubrange_created and ip6pubrange_obj:
+                try:
+                    ip6pubrange_obj.delete(self.apiclient)
+                    self.logger.info("Deleted public IPv6 range %s",
+                                     getattr(ip6pubrange_obj, 'ip6cidr', ''))
+                except Exception as e:
+                    self.logger.warning(
+                        "Could not delete public IPv6 range: %s", e)
+
+            # Remove IPv6 prefix if this test created it
+            if ip6prefix_created and ip6prefix_obj:
+                try:
+                    del_cmd = (deleteGuestNetworkIpv6Prefix
+                               .deleteGuestNetworkIpv6PrefixCmd())
+                    del_cmd.id = ip6prefix_obj.id
+                    self.apiclient.deleteGuestNetworkIpv6Prefix(del_cmd)
+                    self.logger.info("Deleted guest IPv6 prefix %s",
+                                     ip6prefix_obj.prefix)
+                except Exception as e:
+                    self.logger.warning(
+                        "Could not delete guest IPv6 prefix: %s", e)
+
+        # ---- Explicit ordered cleanup ----
+        try:
+            vm.delete(self.apiclient, expunge=True)
+            self.cleanup = [o for o in self.cleanup if o != vm]
+        except Exception:
+            pass
+        try:
+            network.delete(self.apiclient)
+            self.cleanup = [o for o in self.cleanup if o != network]
+        except Exception:
+            pass
+        try:
+            self._teardown_extension()
+        except Exception:
+            pass
+
+        self.logger.info("test_11 PASSED")
diff --git a/test/integration/smoke/test_public_ip_range.py b/test/integration/smoke/test_public_ip_range.py
index 997716caaaf4..fb9fe2494d57 100644
--- a/test/integration/smoke/test_public_ip_range.py
+++ b/test/integration/smoke/test_public_ip_range.py
@@ -145,10 +145,10 @@ def test_dedicate_public_ip_range_for_system_vms(self):
         # 7. Delete the Public IP range
 
         services = {
-            "gateway":"192.168.99.1",
+            "gateway":"10.1.99.1",
             "netmask":"255.255.255.0",
-            "startip":"192.168.99.2",
-            "endip":"192.168.99.200",
+            "startip":"10.1.99.2",
+            "endip":"10.1.99.200",
             "forvirtualnetwork":self.services["forvirtualnetwork"],
             "zoneid":self.services["zoneid"],
             "vlan":self.services["vlan"]
@@ -344,10 +344,10 @@ def test_dedicate_public_ip_range_for_system_vms_01_ssvm(self):
             self.skipTest("An existing IP range defined for system vms, aborting test")
 
         services = {
-            "gateway":"192.168.100.1",
+            "gateway":"10.1.100.1",
             "netmask":"255.255.255.0",
-            "startip":"192.168.100.2",
-            "endip":"192.168.100.200",
+            "startip":"10.1.100.2",
+            "endip":"10.1.100.200",
             "forvirtualnetwork":self.services["forvirtualnetwork"],
             "zoneid":self.services["zoneid"],
             "vlan":self.services["vlan"]
@@ -372,10 +372,10 @@ def test_dedicate_public_ip_range_for_system_vms_02_cpvm(self):
             self.skipTest("An existing IP range defined for system vms, aborting test")
 
         services = {
-            "gateway":"192.168.200.1",
+            "gateway":"10.1.200.1",
             "netmask":"255.255.255.0",
-            "startip":"192.168.200.2",
-            "endip":"192.168.200.200",
+            "startip":"10.1.200.2",
+            "endip":"10.1.200.200",
             "forvirtualnetwork":self.services["forvirtualnetwork"],
             "zoneid":self.services["zoneid"],
             "vlan":self.services["vlan"]
diff --git a/test/integration/smoke/test_vpc_firewall_rules.py b/test/integration/smoke/test_vpc_firewall_rules.py
new file mode 100644
index 000000000000..6aae5f13fbcd
--- /dev/null
+++ b/test/integration/smoke/test_vpc_firewall_rules.py
@@ -0,0 +1,187 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""Smoke tests for firewall rules on VPC public IPs."""
+
+from nose.plugins.attrib import attr
+
+from marvin.cloudstackTestCase import cloudstackTestCase
+from marvin.lib.base import Account, FireWallRule, Network, NetworkOffering, PublicIPAddress, VPC, VpcOffering
+from marvin.lib.common import get_domain, get_zone, list_publicIP
+from marvin.lib.utils import cleanup_resources, wait_until
+
+
+class TestVpcFirewallRules(cloudstackTestCase):
+
+    @classmethod
+    def setUpClass(cls):
+        cls.testClient = super(TestVpcFirewallRules, cls).getClsTestClient()
+        cls.apiclient = cls.testClient.getApiClient()
+        cls.services = cls.testClient.getParsedTestDataConfig()
+        cls.zone = get_zone(cls.apiclient, cls.testClient.getZoneForTests())
+        cls.domain = get_domain(cls.apiclient)
+        cls._cleanup = []
+
+        cls.account = Account.create(
+            cls.apiclient,
+            cls.services["account"],
+            domainid=cls.domain.id
+        )
+        cls._cleanup.append(cls.account)
+
+        cls.services["vpc_offering"]["supportedservices"] = (
+            "Vpn,Dhcp,Dns,SourceNat,Lb,UserData,StaticNat,"
+            "NetworkACL,PortForwarding,Firewall"
+        )
+        cls.services["vpc_offering"]["serviceProviderList"] = {
+            "Vpn": "VpcVirtualRouter",
+            "Dhcp": "VpcVirtualRouter",
+            "Dns": "VpcVirtualRouter",
+            "SourceNat": "VpcVirtualRouter",
+            "Lb": "VpcVirtualRouter",
+            "UserData": "VpcVirtualRouter",
+            "StaticNat": "VpcVirtualRouter",
+            "NetworkACL": "VpcVirtualRouter",
+            "PortForwarding": "VpcVirtualRouter",
+            "Firewall": "VpcVirtualRouter"
+        }
+
+        cls.vpc_offering = VpcOffering.create(
+            cls.apiclient,
+            cls.services["vpc_offering"]
+        )
+        cls.vpc_offering.update(cls.apiclient, state="Enabled")
+        cls._cleanup.append(cls.vpc_offering)
+
+        network_offering = NetworkOffering.list(
+            cls.apiclient,
+            name="DefaultIsolatedNetworkOfferingForVpcNetworks"
+        )
+        cls.assertTrue(
+            network_offering is not None and len(network_offering) > 0,
+            "No VPC tier network offering found"
+        )
+        cls.network_offering = network_offering[0]
+        cls.services["vpc"]["cidr"] = "10.20.30.0/24"
+        cls.vpc = VPC.create(
+            cls.apiclient,
+            cls.services["vpc"],
+            vpcofferingid=cls.vpc_offering.id,
+            zoneid=cls.zone.id,
+            account=cls.account.name,
+            domainid=cls.account.domainid
+        )
+
+        cls.tier = Network.create(
+            cls.apiclient,
+            services={
+                "name": "vpc-fw-tier",
+                "displaytext": "vpc-fw-tier"
+            },
+            accountid=cls.account.name,
+            domainid=cls.account.domainid,
+            networkofferingid=cls.network_offering.id,
+            zoneid=cls.zone.id,
+            vpcid=cls.vpc.id,
+            gateway="10.20.30.1",
+            netmask="255.255.255.0"
+        )
+
+    @classmethod
+    def tearDownClass(cls):
+        try:
+            cleanup_resources(cls.apiclient, cls._cleanup)
+        except Exception as e:
+            raise Exception("Warning: Exception during cleanup: %s" % e)
+
+    def setUp(self):
+        self.apiclient = self.testClient.getApiClient()
+        self.cleanup = []
+
+    def tearDown(self):
+        cleanup_resources(self.apiclient, self.cleanup)
+
+    def _wait_for_firewall_rule(self, rule_id):
+        rules = FireWallRule.list(self.apiclient, id=rule_id, listall=True)
+        if rules and len(rules) == 1:
+            return True, rules[0]
+        return False, None
+
+    @attr(tags=["advanced", "advancedns", "smoke"], required_hardware="false")
+    def test_01_create_firewall_rule_on_vpc_public_ip(self):
+        """Verify firewall rule can be created and listed on a dedicated VPC public IP."""
+        public_ip = PublicIPAddress.create(
+            self.apiclient,
+            zoneid=self.zone.id,
+            accountid=self.account.name,
+            domainid=self.account.domainid,
+            vpcid=self.vpc.id
+        )
+        self.cleanup.append(public_ip)
+
+        firewall_rule = FireWallRule.create(
+            self.apiclient,
+            ipaddressid=public_ip.ipaddress.id,
+            protocol="tcp",
+            cidrlist=["0.0.0.0/0"],
+            startport=19090,
+            endport=19090,
+            vpcid=self.vpc.id
+        )
+        self.cleanup.insert(0, firewall_rule)
+
+        result, listed_rule = wait_until(2, 10, self._wait_for_firewall_rule, firewall_rule.id)
+        self.assertTrue(result, "Firewall rule was not listed for the VPC public IP")
+        self.assertEqual(listed_rule.id, firewall_rule.id)
+        self.assertEqual(listed_rule.ipaddressid, public_ip.ipaddress.id)
+        self.assertEqual(listed_rule.vpcid, self.vpc.id)
+        self.assertEqual(listed_rule.protocol.lower(), "tcp")
+        self.assertEqual(int(listed_rule.startport), 19090)
+        self.assertEqual(int(listed_rule.endport), 19090)
+
+    @attr(tags=["advanced", "advancedns", "smoke"], required_hardware="false")
+    def test_02_create_firewall_rule_on_vpc_source_nat_ip(self):
+        """Verify firewall rule can be created and listed on the VPC source NAT IP."""
+        source_nat_ips = list_publicIP(
+            self.apiclient,
+            vpcid=self.vpc.id,
+            listall=True,
+            issourcenat=True
+        )
+        self.assertTrue(source_nat_ips is not None and len(source_nat_ips) > 0,
+                        "No source NAT IP found for the VPC")
+        source_nat_ip = source_nat_ips[0]
+
+        firewall_rule = FireWallRule.create(
+            self.apiclient,
+            ipaddressid=source_nat_ip.id,
+            protocol="tcp",
+            cidrlist=["0.0.0.0/0"],
+            startport=19443,
+            endport=19443,
+            vpcid=self.vpc.id
+        )
+        self.cleanup.append(firewall_rule)
+
+        result, listed_rule = wait_until(2, 10, self._wait_for_firewall_rule, firewall_rule.id)
+        self.assertTrue(result, "Firewall rule was not listed for the VPC source NAT IP")
+        self.assertEqual(listed_rule.id, firewall_rule.id)
+        self.assertEqual(listed_rule.ipaddressid, source_nat_ip.id)
+        self.assertEqual(listed_rule.vpcid, self.vpc.id)
+        self.assertEqual(listed_rule.protocol.lower(), "tcp")
+        self.assertEqual(int(listed_rule.startport), 19443)
+        self.assertEqual(int(listed_rule.endport), 19443)
diff --git a/tools/apidoc/gen_toc.py b/tools/apidoc/gen_toc.py
index d703769eb1c1..c99328fff9ff 100644
--- a/tools/apidoc/gen_toc.py
+++ b/tools/apidoc/gen_toc.py
@@ -282,7 +282,8 @@
     'CustomAction' : 'Extension',
     'CustomActions' : 'Extension',
     'ImportVmTask': 'Import VM Task',
-    'Dns': 'DNS'
+    'Dns': 'DNS',
+    'downloadValidationScreenshot': 'Backup and Recovery'
 }
 
 
diff --git a/tools/docker/Dockerfile b/tools/docker/Dockerfile
index dcadfb3fead6..9728f92515e4 100644
--- a/tools/docker/Dockerfile
+++ b/tools/docker/Dockerfile
@@ -17,7 +17,7 @@
 #
 # CloudStack-simulator build
 
-FROM ubuntu:22.04
+FROM ubuntu:24.04
 
 LABEL Vendor="Apache.org" License="ApacheV2" Version="4.23.0.0-SNAPSHOT" Author="Apache CloudStack <dev@cloudstack.apache.org>"
 
@@ -34,7 +34,8 @@ RUN apt-get -y update && apt-get install -y \
     ipmitool \
     iproute2 \
     maven \
-    openjdk-11-jdk \
+    openjdk-17-jre-headless \
+    openjdk-17-jdk \
     python3-dev \
     python-is-python3 \
     python3-setuptools \
@@ -61,12 +62,10 @@ RUN find /var/lib/mysql -type f -exec touch {} \; && \
     mysql -e "ALTER USER 'root'@'localhost' IDENTIFIED WITH caching_sha2_password by ''" --connect-expired-password; \
     mvn -Pdeveloper -pl developer -Ddeploydb; \
     mvn -Pdeveloper -pl developer -Ddeploydb-simulator; \
-    MARVIN_FILE=`find /root/tools/marvin/dist/ -name "Marvin*.tar.gz"`; \
-    rm -rf /usr/bin/x86_64-linux-gnu-gcc && \
-    ln -s /usr/bin/gcc-10 /usr/bin/x86_64-linux-gnu-gcc; \
-    pip3 install $MARVIN_FILE
+    MARVIN_FILE=`find /root/tools/marvin/dist/ -name "[mM]arvin*.tar.gz"`; \
+    pip3 install $MARVIN_FILE --break-system-packages
 
-RUN curl -sL https://deb.nodesource.com/setup_14.x | sudo -E bash -; \
+RUN curl -sL https://deb.nodesource.com/setup_24.x | sudo -E bash -; \
     apt-get install -y nodejs; \
     cd ui && npm rebuild node-sass && npm install
 
diff --git a/tools/docker/supervisord.conf b/tools/docker/supervisord.conf
index 1c14578c4cf3..4fe0b49546be 100644
--- a/tools/docker/supervisord.conf
+++ b/tools/docker/supervisord.conf
@@ -8,6 +8,7 @@ autorestart=true
 user=root
 
 [program:cloudstack]
+environment=MAVEN_OPTS="--add-opens=java.base/java.lang=ALL-UNNAMED --add-exports=java.base/sun.security.x509=ALL-UNNAMED"
 command=/bin/bash -c "mvn -pl client jetty:run -Dsimulator -Dorg.eclipse.jetty.annotations.maxWait=120"
 directory=/root
 stdout_logfile=/dev/stdout
@@ -16,6 +17,7 @@ redirect_stderr=true
 user=root
 
 [program:cloudstack-ui]
+environment=NODE_OPTIONS="--openssl-legacy-provider"
 command=/bin/bash -c "npm run serve"
 directory=/root/ui
 stdout_logfile=/dev/stdout
diff --git a/tools/marvin/marvin/lib/base.py b/tools/marvin/marvin/lib/base.py
index 82155fe27e76..e7fa2f763db5 100755
--- a/tools/marvin/marvin/lib/base.py
+++ b/tools/marvin/marvin/lib/base.py
@@ -6219,6 +6219,29 @@ def removeOffering(self, apiclient, vmid, forced=True):
         cmd.forced = forced
         return (apiclient.removeVirtualMachineFromBackupOffering(cmd))
 
+    @classmethod
+    def createOffering(cls, api_client, description, name, zoneid, allowquickrestore=False, compress=False, validate=False, validationsteps=None, allowuserdrivenbackups=True,
+                       compressionlibrary='zlib'):
+        """Create a backup offering"""
+
+        cmd = createBackupOffering.createBackupOfferingCmd()
+        cmd.description = description
+        cmd.name = name
+        cmd.zoneid = zoneid
+        cmd.allowuserdrivenbackups = allowuserdrivenbackups
+
+        if allowquickrestore:
+            cmd.allowquickrestore = allowquickrestore
+        if compress:
+            cmd.compress = compress
+            cmd.compressionlibrary = compressionlibrary
+        if validate:
+            cmd.validate = validate
+        if validationsteps:
+            cmd.validationsteps = validationsteps
+
+        return BackupOffering(api_client.createBackupOffering(cmd).__dict__)
+
 
 class Backup:
 
@@ -6293,6 +6316,14 @@ def createVMFromBackup(cls, apiclient, services, mode, backupid, accountname, do
         VirtualMachine.program_ssh_access(apiclient, services, mode, cmd.networkids, virtual_machine)
         return virtual_machine
 
+    @classmethod
+    def downloadValidationScreenshot(self, apiclient, backupid):
+        """Download Validation Screenshot"""
+
+        cmd = downloadValidationScreenshot.downloadValidationScreenshotCmd()
+        cmd.backupid = backupid
+        return (apiclient.downloadValidationScreenshot(cmd))
+
 class BackupSchedule:
 
     def __init__(self, items):
diff --git a/tools/marvin/setup.py b/tools/marvin/setup.py
index e126622930bb..8360d00e5326 100644
--- a/tools/marvin/setup.py
+++ b/tools/marvin/setup.py
@@ -46,7 +46,7 @@
                 "marvin.sandbox.basic"],
       license="LICENSE.txt",
       install_requires=[
-          "mysql-connector-python <= 8.4.0",
+          "mysql-connector-python >= 8.4.0",
           "requests >= 2.2.1",
           "paramiko >= 1.13.0",
           "nose >= 1.3.3",
@@ -57,7 +57,7 @@
           "ipmisim >= 0.7",
           "pytz",
           "retries",
-          "PyCrypt",
+          "pycryptodome",
           "kubernetes",
           "urllib3",
           "setuptools >= 40.3.0"
diff --git a/ui/jest.config.js b/ui/jest.config.js
index eb5f3f4db1b8..f67823eb9900 100644
--- a/ui/jest.config.js
+++ b/ui/jest.config.js
@@ -42,7 +42,7 @@ module.exports = {
     '**/tests/unit/**/*.spec.(js|jsx|ts|tsx)|**/__tests__/*.(js|jsx|ts|tsx)'
   ],
   transformIgnorePatterns: [
-    '<rootDir>/node_modules/(?!ant-design-vue|vue|@babel/runtime|lodash-es|@ant-design|@vue-js-cron)'
+    '<rootDir>/node_modules/(?!ant-design-vue|vue|@babel/runtime|lodash-es|@ant-design|@vue-js-cron|prism)'
   ],
   collectCoverage: true,
   collectCoverageFrom: [
diff --git a/ui/package-lock.json b/ui/package-lock.json
index c9f90b6552a4..8592158204b8 100644
--- a/ui/package-lock.json
+++ b/ui/package-lock.json
@@ -1,6 +1,6 @@
 {
   "name": "cloudstack-ui",
-  "version": "4.19.0",
+  "version": "4.22.0",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
@@ -114,8 +114,7 @@
       "version": "0.5.4",
       "resolved": "https://registry.npmjs.org/@apollographql/apollo-tools/-/apollo-tools-0.5.4.tgz",
       "integrity": "sha512-shM3q7rUbNyXVVRkQJQseXv6bnYM3BUma/eZhwXR4xsuM+bqWnJKvW7SAfRjP7LuSCocrexa5AXhjjawNHrIlw==",
-      "dev": true,
-      "requires": {}
+      "dev": true
     },
     "@apollographql/graphql-playground-html": {
       "version": "1.6.27",
@@ -445,11 +444,15 @@
         "@babel/types": "^7.18.6"
       }
     },
+    "@babel/helper-string-parser": {
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.29.7.tgz",
+      "integrity": "sha512-Pb5ijPrZ89GDH8223L4UP8i6QApWxs04RbPQJTeWDV0/keR2E36MeKnyr6LYmUUvqRRI+Iv87SuF1W6ErINzYw=="
+    },
     "@babel/helper-validator-identifier": {
-      "version": "7.18.6",
-      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.18.6.tgz",
-      "integrity": "sha512-MmetCkz9ej86nJQV+sFCxoGGrUbU3q02kgLciwkrt9QqEB7cP39oKEY0PakknEO0Gu20SskMRi+AYZ3b1TpN9g==",
-      "dev": true
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.29.7.tgz",
+      "integrity": "sha512-qehxGkRj55h/ff8EMaJ+cYhyaKlHIxqYDn682wQD7RNp9UujOQsHog2uS0r2vzr4pW+sXf90NeeayjcNaX3fFg=="
     },
     "@babel/helper-validator-option": {
       "version": "7.18.6",
@@ -544,9 +547,12 @@
       }
     },
     "@babel/parser": {
-      "version": "7.18.6",
-      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.18.6.tgz",
-      "integrity": "sha512-uQVSa9jJUe/G/304lXspfWVpKpK4euFLgGiMQFOCpM/bgcAdeoHwi/OQz23O9GK2osz26ZiXRRV9aV+Yl1O8tw=="
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.29.7.tgz",
+      "integrity": "sha512-hnORnjP/1P/zFEndoeX+n+t1RwWRJiJpM/jO7FW32Kn9r5+sJB2JWOdYo4L6k78j15eCwY3Gm/7364B1EMwtNg==",
+      "requires": {
+        "@babel/types": "^7.29.7"
+      }
     },
     "@babel/plugin-bugfix-safari-id-destructuring-collision-in-function-expression": {
       "version": "7.18.6",
@@ -1489,13 +1495,12 @@
       }
     },
     "@babel/types": {
-      "version": "7.18.7",
-      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.18.7.tgz",
-      "integrity": "sha512-QG3yxTcTIBoAcQmkCs+wAPYZhu7Dk9rXKacINfNbdJDNERTbLQbHGyVG8q/YGMPeCJRIhSY0+fTc5+xuh6WPSQ==",
-      "dev": true,
+      "version": "7.29.7",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.29.7.tgz",
+      "integrity": "sha512-4zBIxpPzowiZpusoFkyGVwakdRJUyuH5PxQ/PrqghfdFWWasvnCdPfQXHrenDai+gyLARulZjZowCOj6fjT4pA==",
       "requires": {
-        "@babel/helper-validator-identifier": "^7.18.6",
-        "to-fast-properties": "^2.0.0"
+        "@babel/helper-string-parser": "^7.29.7",
+        "@babel/helper-validator-identifier": "^7.29.7"
       }
     },
     "@ctrl/tinycolor": {
@@ -1535,8 +1540,7 @@
     "@fortawesome/vue-fontawesome": {
       "version": "3.0.6",
       "resolved": "https://registry.npmjs.org/@fortawesome/vue-fontawesome/-/vue-fontawesome-3.0.6.tgz",
-      "integrity": "sha512-akrL7lTroyNpPkoHtvK2UpsMzJr6jXdHaQ0YdcwqDsB8jdwlpNHZYijpOUd9KJsARr+VB3WXY4EyObepqJ4ytQ==",
-      "requires": {}
+      "integrity": "sha512-akrL7lTroyNpPkoHtvK2UpsMzJr6jXdHaQ0YdcwqDsB8jdwlpNHZYijpOUd9KJsARr+VB3WXY4EyObepqJ4ytQ=="
     },
     "@gar/promisify": {
       "version": "1.1.3",
@@ -1593,6 +1597,182 @@
         "postcss": "^7.0.0"
       }
     },
+    "@isaacs/cliui": {
+      "version": "8.0.2",
+      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz",
+      "integrity": "sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==",
+      "dev": true,
+      "requires": {
+        "string-width": "^5.1.2",
+        "string-width-cjs": "npm:string-width@^4.2.0",
+        "strip-ansi": "^7.0.1",
+        "strip-ansi-cjs": "npm:strip-ansi@^6.0.1",
+        "wrap-ansi": "^8.1.0",
+        "wrap-ansi-cjs": "npm:wrap-ansi@^7.0.0"
+      },
+      "dependencies": {
+        "ansi-regex": {
+          "version": "6.2.2",
+          "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-6.2.2.tgz",
+          "integrity": "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg==",
+          "dev": true
+        },
+        "ansi-styles": {
+          "version": "6.2.3",
+          "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-6.2.3.tgz",
+          "integrity": "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg==",
+          "dev": true
+        },
+        "emoji-regex": {
+          "version": "9.2.2",
+          "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-9.2.2.tgz",
+          "integrity": "sha512-L18DaJsXSUk2+42pv8mLs5jJT2hqFkFE4j21wOmgbUqsZ2hL72NsUU785g9RXgo3s0ZNgVl42TiHp3ZtOv/Vyg==",
+          "dev": true
+        },
+        "is-fullwidth-code-point": {
+          "version": "3.0.0",
+          "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+          "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+          "dev": true
+        },
+        "string-width": {
+          "version": "5.1.2",
+          "resolved": "https://registry.npmjs.org/string-width/-/string-width-5.1.2.tgz",
+          "integrity": "sha512-HnLOCR3vjcY8beoNLtcjZ5/nxn2afmME6lhrDrebokqMap+XbeW8n9TXpPDOqdGK5qcI3oT0GKTW6wC7EMiVqA==",
+          "dev": true,
+          "requires": {
+            "eastasianwidth": "^0.2.0",
+            "emoji-regex": "^9.2.2",
+            "strip-ansi": "^7.0.1"
+          }
+        },
+        "string-width-cjs": {
+          "version": "npm:string-width@4.2.3",
+          "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+          "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+          "dev": true,
+          "requires": {
+            "emoji-regex": "^8.0.0",
+            "is-fullwidth-code-point": "^3.0.0",
+            "strip-ansi": "^6.0.1"
+          },
+          "dependencies": {
+            "ansi-regex": {
+              "version": "5.0.1",
+              "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+              "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+              "dev": true
+            },
+            "emoji-regex": {
+              "version": "8.0.0",
+              "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+              "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+              "dev": true
+            },
+            "strip-ansi": {
+              "version": "6.0.1",
+              "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+              "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+              "dev": true,
+              "requires": {
+                "ansi-regex": "^5.0.1"
+              }
+            }
+          }
+        },
+        "strip-ansi": {
+          "version": "7.2.0",
+          "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-7.2.0.tgz",
+          "integrity": "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w==",
+          "dev": true,
+          "requires": {
+            "ansi-regex": "^6.2.2"
+          }
+        },
+        "strip-ansi-cjs": {
+          "version": "npm:strip-ansi@6.0.1",
+          "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+          "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+          "dev": true,
+          "requires": {
+            "ansi-regex": "^5.0.1"
+          },
+          "dependencies": {
+            "ansi-regex": {
+              "version": "5.0.1",
+              "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+              "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+              "dev": true
+            }
+          }
+        },
+        "wrap-ansi": {
+          "version": "8.1.0",
+          "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-8.1.0.tgz",
+          "integrity": "sha512-si7QWI6zUMq56bESFvagtmzMdGOtoxfR+Sez11Mobfc7tm+VkUckk9bW2UeffTGVUbOksxmSw0AA2gs8g71NCQ==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^6.1.0",
+            "string-width": "^5.0.1",
+            "strip-ansi": "^7.0.1"
+          }
+        },
+        "wrap-ansi-cjs": {
+          "version": "npm:wrap-ansi@7.0.0",
+          "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+          "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+          "dev": true,
+          "requires": {
+            "ansi-styles": "^4.0.0",
+            "string-width": "^4.1.0",
+            "strip-ansi": "^6.0.0"
+          },
+          "dependencies": {
+            "ansi-regex": {
+              "version": "5.0.1",
+              "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+              "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+              "dev": true
+            },
+            "ansi-styles": {
+              "version": "4.3.0",
+              "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+              "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+              "dev": true,
+              "requires": {
+                "color-convert": "^2.0.1"
+              }
+            },
+            "emoji-regex": {
+              "version": "8.0.0",
+              "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+              "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+              "dev": true
+            },
+            "string-width": {
+              "version": "4.2.3",
+              "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+              "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+              "dev": true,
+              "requires": {
+                "emoji-regex": "^8.0.0",
+                "is-fullwidth-code-point": "^3.0.0",
+                "strip-ansi": "^6.0.1"
+              }
+            },
+            "strip-ansi": {
+              "version": "6.0.1",
+              "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+              "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+              "dev": true,
+              "requires": {
+                "ansi-regex": "^5.0.1"
+              }
+            }
+          }
+        }
+      }
+    },
     "@istanbuljs/load-nyc-config": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/@istanbuljs/load-nyc-config/-/load-nyc-config-1.1.0.tgz",
@@ -2186,6 +2366,64 @@
         "fastq": "^1.6.0"
       }
     },
+    "@npmcli/agent": {
+      "version": "2.2.2",
+      "resolved": "https://registry.npmjs.org/@npmcli/agent/-/agent-2.2.2.tgz",
+      "integrity": "sha512-OrcNPXdpSl9UX7qPVRWbmWMCSXrcDa2M9DvrbOTj7ao1S4PlqVFYv9/yLKMkrJKZ/V5A/kDBC690or307i26Og==",
+      "dev": true,
+      "requires": {
+        "agent-base": "^7.1.0",
+        "http-proxy-agent": "^7.0.0",
+        "https-proxy-agent": "^7.0.1",
+        "lru-cache": "^10.0.1",
+        "socks-proxy-agent": "^8.0.3"
+      },
+      "dependencies": {
+        "agent-base": {
+          "version": "7.1.4",
+          "resolved": "https://registry.npmjs.org/agent-base/-/agent-base-7.1.4.tgz",
+          "integrity": "sha512-MnA+YT8fwfJPgBx3m60MNqakm30XOkyIoH1y6huTQvC0PwZG7ki8NacLBcrPbNoo8vEZy7Jpuk7+jMO+CUovTQ==",
+          "dev": true
+        },
+        "http-proxy-agent": {
+          "version": "7.0.2",
+          "resolved": "https://registry.npmjs.org/http-proxy-agent/-/http-proxy-agent-7.0.2.tgz",
+          "integrity": "sha512-T1gkAiYYDWYx3V5Bmyu7HcfcvL7mUrTWiM6yOfa3PIphViJ/gFPbvidQ+veqSOHci/PxBcDabeUNCzpOODJZig==",
+          "dev": true,
+          "requires": {
+            "agent-base": "^7.1.0",
+            "debug": "^4.3.4"
+          }
+        },
+        "https-proxy-agent": {
+          "version": "7.0.6",
+          "resolved": "https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-7.0.6.tgz",
+          "integrity": "sha512-vK9P5/iUfdl95AI+JVyUuIcVtd4ofvtrOr3HNtM2yxC9bnMbEdp3x01OhQNnjb8IJYi38VlTE3mBXwcfvywuSw==",
+          "dev": true,
+          "requires": {
+            "agent-base": "^7.1.2",
+            "debug": "4"
+          }
+        },
+        "lru-cache": {
+          "version": "10.4.3",
+          "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+          "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+          "dev": true
+        },
+        "socks-proxy-agent": {
+          "version": "8.0.5",
+          "resolved": "https://registry.npmjs.org/socks-proxy-agent/-/socks-proxy-agent-8.0.5.tgz",
+          "integrity": "sha512-HehCEsotFqbPW9sJ8WVYB6UbmIMv7kUUORIF2Nncq4VQvBfNBLibW9YZR5dlYCSUhwcD628pRllm7n+E+YTzJw==",
+          "dev": true,
+          "requires": {
+            "agent-base": "^7.1.2",
+            "debug": "^4.3.4",
+            "socks": "^2.8.3"
+          }
+        }
+      }
+    },
     "@npmcli/fs": {
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-1.1.1.tgz",
@@ -2250,8 +2488,34 @@
         "@npmcli/promise-spawn": "^1.3.2",
         "node-gyp": "^7.1.0",
         "read-package-json-fast": "^2.0.1"
+      },
+      "dependencies": {
+        "node-gyp": {
+          "version": "7.1.2",
+          "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-7.1.2.tgz",
+          "integrity": "sha512-CbpcIo7C3eMu3dL1c3d0xw449fHIGALIJsRP4DDPHpyiW8vcriNY7ubh9TE4zEKfSxscY7PjeFnshE7h75ynjQ==",
+          "requires": {
+            "env-paths": "^2.2.0",
+            "glob": "^7.1.4",
+            "graceful-fs": "^4.2.3",
+            "nopt": "^5.0.0",
+            "npmlog": "^4.1.2",
+            "request": "^2.88.2",
+            "rimraf": "^3.0.2",
+            "semver": "^7.3.2",
+            "tar": "^6.0.2",
+            "which": "^2.0.2"
+          }
+        }
       }
     },
+    "@pkgjs/parseargs": {
+      "version": "0.11.0",
+      "resolved": "https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz",
+      "integrity": "sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==",
+      "dev": true,
+      "optional": true
+    },
     "@protobufjs/aspromise": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/@protobufjs/aspromise/-/aspromise-1.1.2.tgz",
@@ -3366,8 +3630,7 @@
       "version": "4.5.19",
       "resolved": "https://registry.npmjs.org/@vue/cli-plugin-vuex/-/cli-plugin-vuex-4.5.19.tgz",
       "integrity": "sha512-DUmfdkG3pCdkP7Iznd87RfE9Qm42mgp2hcrNcYQYSru1W1gX2dG/JcW8bxmeGSa06lsxi9LEIc/QD1yPajSCZw==",
-      "dev": true,
-      "requires": {}
+      "dev": true
     },
     "@vue/cli-service": {
       "version": "4.5.19",
@@ -3878,8 +4141,7 @@
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/@vue/preload-webpack-plugin/-/preload-webpack-plugin-1.1.2.tgz",
       "integrity": "sha512-LIZMuJk38pk9U9Ur4YzHjlIyMuxPlACdBIHH9/nGYVTsaGKOSnSuELiE8vS9wa+dJpIYspYUOqk+L1Q4pgHQHQ==",
-      "dev": true,
-      "requires": {}
+      "dev": true
     },
     "@vue/reactivity": {
       "version": "3.2.37",
@@ -3938,8 +4200,7 @@
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/@vue/test-utils/-/test-utils-2.0.0.tgz",
       "integrity": "sha512-zL5kygNq7hONrO1CzaUGprEAklAX+pH8J1MPMCU3Rd2xtSYkZ+PmKU3oEDRg8VAGdL5lNJHzDgrud5amFPtirw==",
-      "dev": true,
-      "requires": {}
+      "dev": true
     },
     "@vue/web-component-wrapper": {
       "version": "1.3.0",
@@ -3951,6 +4212,7 @@
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/@webassemblyjs/ast/-/ast-1.9.0.tgz",
       "integrity": "sha512-C6wW5L+b7ogSDVqymbkkvuW9kruN//YisMED04xzeBBqjHa2FYnmvOlS6Xj68xWQRgWvI9cIglsjFowH/RJyEA==",
+      "dev": true,
       "requires": {
         "@webassemblyjs/helper-module-context": "1.9.0",
         "@webassemblyjs/helper-wasm-bytecode": "1.9.0",
@@ -3960,22 +4222,26 @@
     "@webassemblyjs/floating-point-hex-parser": {
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/@webassemblyjs/floating-point-hex-parser/-/floating-point-hex-parser-1.9.0.tgz",
-      "integrity": "sha512-TG5qcFsS8QB4g4MhrxK5TqfdNe7Ey/7YL/xN+36rRjl/BlGE/NcBvJcqsRgCP6Z92mRE+7N50pRIi8SmKUbcQA=="
+      "integrity": "sha512-TG5qcFsS8QB4g4MhrxK5TqfdNe7Ey/7YL/xN+36rRjl/BlGE/NcBvJcqsRgCP6Z92mRE+7N50pRIi8SmKUbcQA==",
+      "dev": true
     },
     "@webassemblyjs/helper-api-error": {
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-api-error/-/helper-api-error-1.9.0.tgz",
-      "integrity": "sha512-NcMLjoFMXpsASZFxJ5h2HZRcEhDkvnNFOAKneP5RbKRzaWJN36NC4jqQHKwStIhGXu5mUWlUUk7ygdtrO8lbmw=="
+      "integrity": "sha512-NcMLjoFMXpsASZFxJ5h2HZRcEhDkvnNFOAKneP5RbKRzaWJN36NC4jqQHKwStIhGXu5mUWlUUk7ygdtrO8lbmw==",
+      "dev": true
     },
     "@webassemblyjs/helper-buffer": {
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-buffer/-/helper-buffer-1.9.0.tgz",
-      "integrity": "sha512-qZol43oqhq6yBPx7YM3m9Bv7WMV9Eevj6kMi6InKOuZxhw+q9hOkvq5e/PpKSiLfyetpaBnogSbNCfBwyB00CA=="
+      "integrity": "sha512-qZol43oqhq6yBPx7YM3m9Bv7WMV9Eevj6kMi6InKOuZxhw+q9hOkvq5e/PpKSiLfyetpaBnogSbNCfBwyB00CA==",
+      "dev": true
     },
     "@webassemblyjs/helper-code-frame": {
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-code-frame/-/helper-code-frame-1.9.0.tgz",
       "integrity": "sha512-ERCYdJBkD9Vu4vtjUYe8LZruWuNIToYq/ME22igL+2vj2dQ2OOujIZr3MEFvfEaqKoVqpsFKAGsRdBSBjrIvZA==",
+      "dev": true,
       "requires": {
         "@webassemblyjs/wast-printer": "1.9.0"
       }
@@ -3983,12 +4249,14 @@
     "@webassemblyjs/helper-fsm": {
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-fsm/-/helper-fsm-1.9.0.tgz",
-      "integrity": "sha512-OPRowhGbshCb5PxJ8LocpdX9Kl0uB4XsAjl6jH/dWKlk/mzsANvhwbiULsaiqT5GZGT9qinTICdj6PLuM5gslw=="
+      "integrity": "sha512-OPRowhGbshCb5PxJ8LocpdX9Kl0uB4XsAjl6jH/dWKlk/mzsANvhwbiULsaiqT5GZGT9qinTICdj6PLuM5gslw==",
+      "dev": true
     },
     "@webassemblyjs/helper-module-context": {
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-module-context/-/helper-module-context-1.9.0.tgz",
       "integrity": "sha512-MJCW8iGC08tMk2enck1aPW+BE5Cw8/7ph/VGZxwyvGbJwjktKkDK7vy7gAmMDx88D7mhDTCNKAW5tED+gZ0W8g==",
+      "dev": true,
       "requires": {
         "@webassemblyjs/ast": "1.9.0"
       }
@@ -3996,12 +4264,14 @@
     "@webassemblyjs/helper-wasm-bytecode": {
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-bytecode/-/helper-wasm-bytecode-1.9.0.tgz",
-      "integrity": "sha512-R7FStIzyNcd7xKxCZH5lE0Bqy+hGTwS3LJjuv1ZVxd9O7eHCedSdrId/hMOd20I+v8wDXEn+bjfKDLzTepoaUw=="
+      "integrity": "sha512-R7FStIzyNcd7xKxCZH5lE0Bqy+hGTwS3LJjuv1ZVxd9O7eHCedSdrId/hMOd20I+v8wDXEn+bjfKDLzTepoaUw==",
+      "dev": true
     },
     "@webassemblyjs/helper-wasm-section": {
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/@webassemblyjs/helper-wasm-section/-/helper-wasm-section-1.9.0.tgz",
       "integrity": "sha512-XnMB8l3ek4tvrKUUku+IVaXNHz2YsJyOOmz+MMkZvh8h1uSJpSen6vYnw3IoQ7WwEuAhL8Efjms1ZWjqh2agvw==",
+      "dev": true,
       "requires": {
         "@webassemblyjs/ast": "1.9.0",
         "@webassemblyjs/helper-buffer": "1.9.0",
@@ -4013,6 +4283,7 @@
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/@webassemblyjs/ieee754/-/ieee754-1.9.0.tgz",
       "integrity": "sha512-dcX8JuYU/gvymzIHc9DgxTzUUTLexWwt8uCTWP3otys596io0L5aW02Gb1RjYpx2+0Jus1h4ZFqjla7umFniTg==",
+      "dev": true,
       "requires": {
         "@xtuc/ieee754": "^1.2.0"
       }
@@ -4021,6 +4292,7 @@
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/@webassemblyjs/leb128/-/leb128-1.9.0.tgz",
       "integrity": "sha512-ENVzM5VwV1ojs9jam6vPys97B/S65YQtv/aanqnU7D8aSoHFX8GyhGg0CMfyKNIHBuAVjy3tlzd5QMMINa7wpw==",
+      "dev": true,
       "requires": {
         "@xtuc/long": "4.2.2"
       }
@@ -4028,12 +4300,14 @@
     "@webassemblyjs/utf8": {
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/@webassemblyjs/utf8/-/utf8-1.9.0.tgz",
-      "integrity": "sha512-GZbQlWtopBTP0u7cHrEx+73yZKrQoBMpwkGEIqlacljhXCkVM1kMQge/Mf+csMJAjEdSwhOyLAS0AoR3AG5P8w=="
+      "integrity": "sha512-GZbQlWtopBTP0u7cHrEx+73yZKrQoBMpwkGEIqlacljhXCkVM1kMQge/Mf+csMJAjEdSwhOyLAS0AoR3AG5P8w==",
+      "dev": true
     },
     "@webassemblyjs/wasm-edit": {
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-edit/-/wasm-edit-1.9.0.tgz",
       "integrity": "sha512-FgHzBm80uwz5M8WKnMTn6j/sVbqilPdQXTWraSjBwFXSYGirpkSWE2R9Qvz9tNiTKQvoKILpCuTjBKzOIm0nxw==",
+      "dev": true,
       "requires": {
         "@webassemblyjs/ast": "1.9.0",
         "@webassemblyjs/helper-buffer": "1.9.0",
@@ -4049,6 +4323,7 @@
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-gen/-/wasm-gen-1.9.0.tgz",
       "integrity": "sha512-cPE3o44YzOOHvlsb4+E9qSqjc9Qf9Na1OO/BHFy4OI91XDE14MjFN4lTMezzaIWdPqHnsTodGGNP+iRSYfGkjA==",
+      "dev": true,
       "requires": {
         "@webassemblyjs/ast": "1.9.0",
         "@webassemblyjs/helper-wasm-bytecode": "1.9.0",
@@ -4061,6 +4336,7 @@
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-opt/-/wasm-opt-1.9.0.tgz",
       "integrity": "sha512-Qkjgm6Anhm+OMbIL0iokO7meajkzQD71ioelnfPEj6r4eOFuqm4YC3VBPqXjFyyNwowzbMD+hizmprP/Fwkl2A==",
+      "dev": true,
       "requires": {
         "@webassemblyjs/ast": "1.9.0",
         "@webassemblyjs/helper-buffer": "1.9.0",
@@ -4072,6 +4348,7 @@
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/@webassemblyjs/wasm-parser/-/wasm-parser-1.9.0.tgz",
       "integrity": "sha512-9+wkMowR2AmdSWQzsPEjFU7njh8HTO5MqO8vjwEHuM+AMHioNqSBONRdr0NQQ3dVQrzp0s8lTcYqzUdb7YgELA==",
+      "dev": true,
       "requires": {
         "@webassemblyjs/ast": "1.9.0",
         "@webassemblyjs/helper-api-error": "1.9.0",
@@ -4085,6 +4362,7 @@
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/@webassemblyjs/wast-parser/-/wast-parser-1.9.0.tgz",
       "integrity": "sha512-qsqSAP3QQ3LyZjNC/0jBJ/ToSxfYJ8kYyuiGvtn/8MK89VrNEfwj7BPQzJVHi0jGTRK2dGdJ5PRqhtjzoww+bw==",
+      "dev": true,
       "requires": {
         "@webassemblyjs/ast": "1.9.0",
         "@webassemblyjs/floating-point-hex-parser": "1.9.0",
@@ -4098,6 +4376,7 @@
       "version": "1.9.0",
       "resolved": "https://registry.npmjs.org/@webassemblyjs/wast-printer/-/wast-printer-1.9.0.tgz",
       "integrity": "sha512-2J0nE95rHXHyQ24cWjMKJ1tqB/ds8z/cyeOZxJhcb+rW+SQASVjuznUSmdz5GpVJTzU8JkhYut0D3siFDD6wsA==",
+      "dev": true,
       "requires": {
         "@webassemblyjs/ast": "1.9.0",
         "@webassemblyjs/wast-parser": "1.9.0",
@@ -4116,12 +4395,14 @@
     "@xtuc/ieee754": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/@xtuc/ieee754/-/ieee754-1.2.0.tgz",
-      "integrity": "sha512-DX8nKgqcGwsc0eJSqYt5lwP4DH5FlHnmuWWBRy7X0NcaGR0ZtuyeESgMwTYVEtxmsNGY+qit4QYT/MIYTOTPeA=="
+      "integrity": "sha512-DX8nKgqcGwsc0eJSqYt5lwP4DH5FlHnmuWWBRy7X0NcaGR0ZtuyeESgMwTYVEtxmsNGY+qit4QYT/MIYTOTPeA==",
+      "dev": true
     },
     "@xtuc/long": {
       "version": "4.2.2",
       "resolved": "https://registry.npmjs.org/@xtuc/long/-/long-4.2.2.tgz",
-      "integrity": "sha512-NuHqBY1PB/D8xU6s/thBgOAiAP7HOYDQ32+BFZILJ8ivkUkAHQnWfn6WhL79Owj1qmUnoN/YPhktdIoucipkAQ=="
+      "integrity": "sha512-NuHqBY1PB/D8xU6s/thBgOAiAP7HOYDQ32+BFZILJ8ivkUkAHQnWfn6WhL79Owj1qmUnoN/YPhktdIoucipkAQ==",
+      "dev": true
     },
     "@zxing/text-encoding": {
       "version": "0.9.0",
@@ -4153,7 +4434,8 @@
     "acorn": {
       "version": "6.4.2",
       "resolved": "https://registry.npmjs.org/acorn/-/acorn-6.4.2.tgz",
-      "integrity": "sha512-XtGIhXwF8YM8bJhGxG5kXgjkEuNGLTkoYqVE+KMR+aspr4KGYmKYg7yUe3KghyQ9yheNwLnjmzh/7+gfDBmHCQ=="
+      "integrity": "sha512-XtGIhXwF8YM8bJhGxG5kXgjkEuNGLTkoYqVE+KMR+aspr4KGYmKYg7yUe3KghyQ9yheNwLnjmzh/7+gfDBmHCQ==",
+      "dev": true
     },
     "acorn-globals": {
       "version": "4.3.4",
@@ -4169,8 +4451,7 @@
       "version": "5.3.2",
       "resolved": "https://registry.npmjs.org/acorn-jsx/-/acorn-jsx-5.3.2.tgz",
       "integrity": "sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==",
-      "dev": true,
-      "requires": {}
+      "dev": true
     },
     "acorn-walk": {
       "version": "6.2.0",
@@ -4226,13 +4507,13 @@
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/ajv-errors/-/ajv-errors-1.0.1.tgz",
       "integrity": "sha512-DCRfO/4nQ+89p/RK43i8Ezd41EqdGIU4ld7nGF8OQ14oc/we5rEntLCUa7+jrn3nn83BosfwZA0wb4pon2o8iQ==",
-      "requires": {}
+      "dev": true
     },
     "ajv-keywords": {
       "version": "3.5.2",
       "resolved": "https://registry.npmjs.org/ajv-keywords/-/ajv-keywords-3.5.2.tgz",
       "integrity": "sha512-5p6WTN0DdTGVQk6VjcEju19IgaHudalcfabD7yhDGeA6bcQnmL+CpveLJq/3hvfwd1aof6L386Ougkx6RfyMIQ==",
-      "requires": {}
+      "dev": true
     },
     "alphanum-sort": {
       "version": "1.0.2",
@@ -4399,14 +4680,14 @@
       "resolved": "https://registry.npmjs.org/antd-theme-generator/-/antd-theme-generator-1.2.11.tgz",
       "integrity": "sha512-7A3lXyLb7eD7MXK7aSgZZ4DxQEdhZwyKhzIm70orUZPQJ8N8TWhZphyOWSGCe8yUqGQhi8PcpM2pLmTriZyKBw==",
       "requires": {
-        "glob": "*",
-        "hash.js": "*",
-        "less": "*",
+        "glob": "^7.1.3",
+        "hash.js": "^1.1.5",
+        "less": "^3.9.0",
         "less-bundle-promise": "^1.0.11",
-        "less-plugin-npm-import": "*",
-        "postcss": "*",
+        "less-plugin-npm-import": "^2.1.0",
+        "postcss": "^6.0.21",
         "postcss-less": "^3.1.4",
-        "strip-css-comments": "*"
+        "strip-css-comments": "^4.1.0"
       },
       "dependencies": {
         "ansi-styles": {
@@ -5129,8 +5410,7 @@
       "version": "2.5.0",
       "resolved": "https://registry.npmjs.org/apollo-server-errors/-/apollo-server-errors-2.5.0.tgz",
       "integrity": "sha512-lO5oTjgiC3vlVg2RKr3RiXIIQ5pGXBFxYGGUkKDhTud3jMIhs+gel8L8zsEjKaKxkjHhCQAA/bcEfYiKkGQIvA==",
-      "dev": true,
-      "requires": {}
+      "dev": true
     },
     "apollo-server-express": {
       "version": "2.25.4",
@@ -5247,17 +5527,20 @@
     "arr-diff": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/arr-diff/-/arr-diff-4.0.0.tgz",
-      "integrity": "sha512-YVIQ82gZPGBebQV/a8dar4AitzCQs0jjXwMPZllpXMaGjXPYVUawSxQrRsjhjupyVxEvbHgUmIhKVlND+j02kA=="
+      "integrity": "sha512-YVIQ82gZPGBebQV/a8dar4AitzCQs0jjXwMPZllpXMaGjXPYVUawSxQrRsjhjupyVxEvbHgUmIhKVlND+j02kA==",
+      "dev": true
     },
     "arr-flatten": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/arr-flatten/-/arr-flatten-1.1.0.tgz",
-      "integrity": "sha512-L3hKV5R/p5o81R7O02IGnwpDmkp6E982XhtbuwSe3O4qOtMMMtodicASA1Cny2U+aCXcNpml+m4dPsvsJ3jatg=="
+      "integrity": "sha512-L3hKV5R/p5o81R7O02IGnwpDmkp6E982XhtbuwSe3O4qOtMMMtodicASA1Cny2U+aCXcNpml+m4dPsvsJ3jatg==",
+      "dev": true
     },
     "arr-union": {
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/arr-union/-/arr-union-3.1.0.tgz",
-      "integrity": "sha512-sKpyeERZ02v1FeCZT8lrfJq5u6goHCtpTAzPwJYe7c8SPFOboNjNg1vz2L4VTn9T4PQxEx13TbXLmYUcS6Ug7Q=="
+      "integrity": "sha512-sKpyeERZ02v1FeCZT8lrfJq5u6goHCtpTAzPwJYe7c8SPFOboNjNg1vz2L4VTn9T4PQxEx13TbXLmYUcS6Ug7Q==",
+      "dev": true
     },
     "array-equal": {
       "version": "1.0.0",
@@ -5313,7 +5596,8 @@
     "array-unique": {
       "version": "0.3.2",
       "resolved": "https://registry.npmjs.org/array-unique/-/array-unique-0.3.2.tgz",
-      "integrity": "sha512-SleRWjh9JUud2wH1hPs9rZBZ33H6T9HOiL0uwGnGx9FpE6wKGyfWugmbkEOIs6qWrZhg0LWeLziLrEwQJhs5mQ=="
+      "integrity": "sha512-SleRWjh9JUud2wH1hPs9rZBZ33H6T9HOiL0uwGnGx9FpE6wKGyfWugmbkEOIs6qWrZhg0LWeLziLrEwQJhs5mQ==",
+      "dev": true
     },
     "array.prototype.flat": {
       "version": "1.3.0",
@@ -5376,6 +5660,7 @@
       "version": "1.5.0",
       "resolved": "https://registry.npmjs.org/assert/-/assert-1.5.0.tgz",
       "integrity": "sha512-EDsgawzwoun2CZkCgtxJbv392v4nbk9XDD06zI+kQYoBM/3RBWLlEyJARDOmhAAosBjWACEkKL6S+lIZtcAubA==",
+      "dev": true,
       "requires": {
         "object-assign": "^4.1.1",
         "util": "0.10.3"
@@ -5384,12 +5669,14 @@
         "inherits": {
           "version": "2.0.1",
           "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.1.tgz",
-          "integrity": "sha512-8nWq2nLTAwd02jTqJExUYFSD/fKq6VH9Y/oG2accc/kdI0V98Bag8d5a4gi3XHz73rDWa2PvTtvcWYquKqSENA=="
+          "integrity": "sha512-8nWq2nLTAwd02jTqJExUYFSD/fKq6VH9Y/oG2accc/kdI0V98Bag8d5a4gi3XHz73rDWa2PvTtvcWYquKqSENA==",
+          "dev": true
         },
         "util": {
           "version": "0.10.3",
           "resolved": "https://registry.npmjs.org/util/-/util-0.10.3.tgz",
           "integrity": "sha512-5KiHfsmkqacuKjkRkdV7SsfDJ2EGiPsK92s2MhNSY0craxjTdKTtqKsJaCWp4LW33ZZ0OPUv1WO/TFvNQRiQxQ==",
+          "dev": true,
           "requires": {
             "inherits": "2.0.1"
           }
@@ -5404,7 +5691,8 @@
     "assign-symbols": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/assign-symbols/-/assign-symbols-1.0.0.tgz",
-      "integrity": "sha512-Q+JC7Whu8HhmTdBph/Tq59IoRtoy6KAm5zzPv00WdujX82lbAL8K7WVjne7vdCsAmbF4AYaDOPyO3k0kl8qIrw=="
+      "integrity": "sha512-Q+JC7Whu8HhmTdBph/Tq59IoRtoy6KAm5zzPv00WdujX82lbAL8K7WVjne7vdCsAmbF4AYaDOPyO3k0kl8qIrw==",
+      "dev": true
     },
     "ast-types": {
       "version": "0.13.3",
@@ -5469,7 +5757,8 @@
     "atob": {
       "version": "2.1.2",
       "resolved": "https://registry.npmjs.org/atob/-/atob-2.1.2.tgz",
-      "integrity": "sha512-Wm6ukoaOGJi/73p/cl2GvLjTI5JM1k/O14isD73YML8StrH/7/lRFgmg8nICZgD3bZZvjwCGxtMOD3wWNAu8cg=="
+      "integrity": "sha512-Wm6ukoaOGJi/73p/cl2GvLjTI5JM1k/O14isD73YML8StrH/7/lRFgmg8nICZgD3bZZvjwCGxtMOD3wWNAu8cg==",
+      "dev": true
     },
     "autoprefixer": {
       "version": "9.8.8",
@@ -5557,8 +5846,7 @@
       "version": "7.0.0-bridge.0",
       "resolved": "https://registry.npmjs.org/babel-core/-/babel-core-7.0.0-bridge.0.tgz",
       "integrity": "sha512-poPX9mZH/5CSanm50Q+1toVci6pv5KSRv/5TWCwtzQS5XEwn40BcCrgIeMFWP9CKKIniKXNxoIOnOq4VVlGXhg==",
-      "dev": true,
-      "requires": {}
+      "dev": true
     },
     "babel-eslint": {
       "version": "10.1.0",
@@ -6167,6 +6455,7 @@
       "version": "0.11.2",
       "resolved": "https://registry.npmjs.org/base/-/base-0.11.2.tgz",
       "integrity": "sha512-5T6P4xPgpp0YDFvSWwEZ4NoE3aM4QBQXDzmVbraCkFj8zHM+mba8SyqB5DbZWyR7mYHo6Y7BdQo3MoA4m0TeQg==",
+      "dev": true,
       "requires": {
         "cache-base": "^1.0.1",
         "class-utils": "^0.3.5",
@@ -6181,6 +6470,7 @@
           "version": "1.0.0",
           "resolved": "https://registry.npmjs.org/define-property/-/define-property-1.0.0.tgz",
           "integrity": "sha512-cZTYKFWspt9jZsMscWo8sc/5lbPC9Q0N5nBLgb+Yd915iL3udB1uFgS3B8YCx66UVHq018DAVFoee7x+gxggeA==",
+          "dev": true,
           "requires": {
             "is-descriptor": "^1.0.0"
           }
@@ -6189,6 +6479,7 @@
           "version": "1.0.0",
           "resolved": "https://registry.npmjs.org/is-accessor-descriptor/-/is-accessor-descriptor-1.0.0.tgz",
           "integrity": "sha512-m5hnHTkcVsPfqx3AKlyttIPb7J+XykHvJP2B9bZDjlhLIoEq4XoK64Vg7boZlVWYK6LUY94dYPEE7Lh0ZkZKcQ==",
+          "dev": true,
           "requires": {
             "kind-of": "^6.0.0"
           }
@@ -6197,6 +6488,7 @@
           "version": "1.0.0",
           "resolved": "https://registry.npmjs.org/is-data-descriptor/-/is-data-descriptor-1.0.0.tgz",
           "integrity": "sha512-jbRXy1FmtAoCjQkVmIVYwuuqDFUbaOeDjmed1tOGPrsMhtJA4rD9tkgA0F1qJ3gRFRXcHYVkdeaP50Q5rE/jLQ==",
+          "dev": true,
           "requires": {
             "kind-of": "^6.0.0"
           }
@@ -6205,6 +6497,7 @@
           "version": "1.0.2",
           "resolved": "https://registry.npmjs.org/is-descriptor/-/is-descriptor-1.0.2.tgz",
           "integrity": "sha512-2eis5WqQGV7peooDyLmNEPUrps9+SXX5c9pL3xEB+4e9HnGuDa7mB7kHxHw4CbqS9k1T2hOH3miL8n8WtiYVtg==",
+          "dev": true,
           "requires": {
             "is-accessor-descriptor": "^1.0.0",
             "is-data-descriptor": "^1.0.0",
@@ -6216,7 +6509,8 @@
     "base64-js": {
       "version": "1.5.1",
       "resolved": "https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz",
-      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA=="
+      "integrity": "sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==",
+      "dev": true
     },
     "batch": {
       "version": "0.6.1",
@@ -6297,7 +6591,8 @@
     "bluebird": {
       "version": "3.7.2",
       "resolved": "https://registry.npmjs.org/bluebird/-/bluebird-3.7.2.tgz",
-      "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg=="
+      "integrity": "sha512-XpNj6GDQzdfW+r2Wnn7xiSAd7TM3jzkxGXBGTtWKuSXv1xUV+azxAm8jdWZN06QTQk+2N2XB9jRDkvbmQmcRtg==",
+      "dev": true
     },
     "bn.js": {
       "version": "5.2.1",
@@ -6479,6 +6774,7 @@
       "version": "2.3.2",
       "resolved": "https://registry.npmjs.org/braces/-/braces-2.3.2.tgz",
       "integrity": "sha512-aNdbnj9P8PjdXU4ybaWLK2IF3jc/EoDYbC7AazW6to3TRsfXxscC9UXOB5iDiEQrkyIbWp2SLQda4+QAa7nc3w==",
+      "dev": true,
       "requires": {
         "arr-flatten": "^1.1.0",
         "array-unique": "^0.3.2",
@@ -6496,6 +6792,7 @@
           "version": "2.0.1",
           "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
           "integrity": "sha512-zCnTtlxNoAiDc3gqY2aYAWFx7XWWiasuF2K8Me5WbN8otHKTUKBwjPtNpRs/rbUZm7KxWAaNj7P1a/p52GbVug==",
+          "dev": true,
           "requires": {
             "is-extendable": "^0.1.0"
           }
@@ -6615,6 +6912,7 @@
       "version": "0.2.0",
       "resolved": "https://registry.npmjs.org/browserify-zlib/-/browserify-zlib-0.2.0.tgz",
       "integrity": "sha512-Z942RysHXmJrhqk88FmKBVq/v5tqmSkDz7p54G/MGyjMnCFFnC79XWNbg+Vta8W6Wb2qtSZTSxIGkJrRpCFEiA==",
+      "dev": true,
       "requires": {
         "pako": "~1.0.5"
       }
@@ -6689,7 +6987,8 @@
     "buffer-from": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
-      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ=="
+      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
+      "dev": true
     },
     "buffer-indexof": {
       "version": "1.1.1",
@@ -6711,7 +7010,8 @@
     "builtin-status-codes": {
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/builtin-status-codes/-/builtin-status-codes-3.0.0.tgz",
-      "integrity": "sha512-HpGFw18DgFWlncDfjTa2rcQ4W88O1mC8e8yZ2AvQY5KDaktSTwo+KRf6nHK6FRI5FyRyb/5T6+TSxfP7QyGsmQ=="
+      "integrity": "sha512-HpGFw18DgFWlncDfjTa2rcQ4W88O1mC8e8yZ2AvQY5KDaktSTwo+KRf6nHK6FRI5FyRyb/5T6+TSxfP7QyGsmQ==",
+      "dev": true
     },
     "builtins": {
       "version": "1.0.3",
@@ -6762,6 +7062,7 @@
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/cache-base/-/cache-base-1.0.1.tgz",
       "integrity": "sha512-AKcdTnFSWATd5/GCPRxr2ChwIJ85CeyrEyjRHlKxQ56d4XJMGym0uAiKn0xbLOGOl3+yRpOTi484dVCEc5AUzQ==",
+      "dev": true,
       "requires": {
         "collection-visit": "^1.0.0",
         "component-emitter": "^1.2.1",
@@ -7008,8 +7309,7 @@
     "chartjs-adapter-moment": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/chartjs-adapter-moment/-/chartjs-adapter-moment-1.0.0.tgz",
-      "integrity": "sha512-PqlerEvQcc5hZLQ/NQWgBxgVQ4TRdvkW3c/t+SUEQSj78ia3hgLkf2VZ2yGJtltNbEEFyYGm+cA6XXevodYvWA==",
-      "requires": {}
+      "integrity": "sha512-PqlerEvQcc5hZLQ/NQWgBxgVQ4TRdvkW3c/t+SUEQSj78ia3hgLkf2VZ2yGJtltNbEEFyYGm+cA6XXevodYvWA=="
     },
     "check-types": {
       "version": "8.0.3",
@@ -7085,7 +7385,8 @@
     "chrome-trace-event": {
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/chrome-trace-event/-/chrome-trace-event-1.0.3.tgz",
-      "integrity": "sha512-p3KULyQg4S7NIHixdwbGX+nFHkoBiA4YQmyWtjb8XngSKV124nJmRysgAeujbUVb15vh+RvFUfCPqU7rXk+hZg=="
+      "integrity": "sha512-p3KULyQg4S7NIHixdwbGX+nFHkoBiA4YQmyWtjb8XngSKV124nJmRysgAeujbUVb15vh+RvFUfCPqU7rXk+hZg==",
+      "dev": true
     },
     "ci-info": {
       "version": "2.0.0",
@@ -7110,6 +7411,7 @@
       "version": "0.3.6",
       "resolved": "https://registry.npmjs.org/class-utils/-/class-utils-0.3.6.tgz",
       "integrity": "sha512-qOhPa/Fj7s6TY8H8esGu5QNpMMQxz79h+urzrNYN6mn+9BnxlDGf5QZ+XeCDsxSjPqsSR56XOZOJmpeurnLMeg==",
+      "dev": true,
       "requires": {
         "arr-union": "^3.1.0",
         "define-property": "^0.2.5",
@@ -7121,6 +7423,7 @@
           "version": "0.2.5",
           "resolved": "https://registry.npmjs.org/define-property/-/define-property-0.2.5.tgz",
           "integrity": "sha512-Rr7ADjQZenceVOAKop6ALkkRAmH1A4Gx9hV/7ZujPUN2rkATqFO0JZLZInbAjpZYoJ1gUx8MRMQVkYemcbMSTA==",
+          "dev": true,
           "requires": {
             "is-descriptor": "^0.1.0"
           }
@@ -7414,6 +7717,7 @@
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/collection-visit/-/collection-visit-1.0.0.tgz",
       "integrity": "sha512-lNkKvzEeMBBjUGHZ+q6z9pSJla0KWAQPvtzhEV9+iGyQYG+pBpl7xKDhxoNSOZH2hhv0v5k0y2yAM4o4SjoSkw==",
+      "dev": true,
       "requires": {
         "map-visit": "^1.0.0",
         "object-visit": "^1.0.0"
@@ -7490,12 +7794,14 @@
     "commondir": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/commondir/-/commondir-1.0.1.tgz",
-      "integrity": "sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg=="
+      "integrity": "sha512-W9pAhw0ja1Edb5GVdIF1mjZw/ASI0AlShXM83UUGe2DVr5TdAPEA1OA8m/g8zWp9x6On7gqufY+FatDbC3MDQg==",
+      "dev": true
     },
     "component-emitter": {
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/component-emitter/-/component-emitter-1.3.0.tgz",
-      "integrity": "sha512-Rd3se6QB+sO1TwqZjscQrurpEPIfO0/yYnSin6Q/rD3mOutHvUrCAhJub3r90uNb+SESBuE0QYoB90YdfatsRg=="
+      "integrity": "sha512-Rd3se6QB+sO1TwqZjscQrurpEPIfO0/yYnSin6Q/rD3mOutHvUrCAhJub3r90uNb+SESBuE0QYoB90YdfatsRg==",
+      "dev": true
     },
     "compressible": {
       "version": "2.0.18",
@@ -7558,6 +7864,7 @@
       "version": "1.6.2",
       "resolved": "https://registry.npmjs.org/concat-stream/-/concat-stream-1.6.2.tgz",
       "integrity": "sha512-27HBghJxjiZtIk3Ycvn/4kbJk/1uZuJFfuPEns6LaEvpvG1f0hTea8lilrouyo9mVc2GWdcEZ8OLoGmSADlrCw==",
+      "dev": true,
       "requires": {
         "buffer-from": "^1.0.0",
         "inherits": "^2.0.3",
@@ -7628,7 +7935,8 @@
     "console-browserify": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/console-browserify/-/console-browserify-1.2.0.tgz",
-      "integrity": "sha512-ZMkYO/LkF17QvCPqM0gxw8yUzigAOZOSWSHg91FH6orS7vcEj5dVZTidN2fQ14yBSdg97RqhSNwLUXInd52OTA=="
+      "integrity": "sha512-ZMkYO/LkF17QvCPqM0gxw8yUzigAOZOSWSHg91FH6orS7vcEj5dVZTidN2fQ14yBSdg97RqhSNwLUXInd52OTA==",
+      "dev": true
     },
     "console-control-strings": {
       "version": "1.1.0",
@@ -7647,7 +7955,8 @@
     "constants-browserify": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/constants-browserify/-/constants-browserify-1.0.0.tgz",
-      "integrity": "sha512-xFxOwqIzR/e1k1gLiWEophSCMqXcwVHIH7akf7b/vxcUeGunlj3hvZaaqxwHsTgn+IndtkQJgSztIDWeumWJDQ=="
+      "integrity": "sha512-xFxOwqIzR/e1k1gLiWEophSCMqXcwVHIH7akf7b/vxcUeGunlj3hvZaaqxwHsTgn+IndtkQJgSztIDWeumWJDQ==",
+      "dev": true
     },
     "content-disposition": {
       "version": "0.5.4",
@@ -7706,6 +8015,7 @@
       "version": "1.0.5",
       "resolved": "https://registry.npmjs.org/copy-concurrently/-/copy-concurrently-1.0.5.tgz",
       "integrity": "sha512-f2domd9fsVDFtaFcbaRZuYXwtdmnzqbADSwhSWYxYB/Q8zsdUUFMXVRwXGDMWmbEzAn1kdRrtI1T/KTFOL4X2A==",
+      "dev": true,
       "requires": {
         "aproba": "^1.1.1",
         "fs-write-stream-atomic": "^1.0.8",
@@ -7719,6 +8029,7 @@
           "version": "0.5.6",
           "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
           "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
+          "dev": true,
           "requires": {
             "minimist": "^1.2.6"
           }
@@ -7727,6 +8038,7 @@
           "version": "2.7.1",
           "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-2.7.1.tgz",
           "integrity": "sha512-uWjbaKIK3T1OSVptzX7Nl6PvQ3qAGtKEtVRjRuazjfL3Bx5eI409VZSqgND+4UNnmzLVdPj9FqFJNPqBZFve4w==",
+          "dev": true,
           "requires": {
             "glob": "^7.1.3"
           }
@@ -7736,7 +8048,8 @@
     "copy-descriptor": {
       "version": "0.1.1",
       "resolved": "https://registry.npmjs.org/copy-descriptor/-/copy-descriptor-0.1.1.tgz",
-      "integrity": "sha512-XgZ0pFcakEUlbwQEVNg3+QAis1FyTL3Qel9FYy8pSkQqoG3PNoT0bOCQtOXcOkur21r2Eq2kI+IE+gsmAEVlYw=="
+      "integrity": "sha512-XgZ0pFcakEUlbwQEVNg3+QAis1FyTL3Qel9FYy8pSkQqoG3PNoT0bOCQtOXcOkur21r2Eq2kI+IE+gsmAEVlYw==",
+      "dev": true
     },
     "copy-to-clipboard": {
       "version": "3.3.1",
@@ -8339,7 +8652,8 @@
     "cyclist": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/cyclist/-/cyclist-1.0.1.tgz",
-      "integrity": "sha512-NJGVKPS81XejHcLhaLJS7plab0fK3slPh11mESeeDq2W4ZI5kUKK/LRRdVDvjJseojbPB7ZwjnyOybg3Igea/A=="
+      "integrity": "sha512-NJGVKPS81XejHcLhaLJS7plab0fK3slPh11mESeeDq2W4ZI5kUKK/LRRdVDvjJseojbPB7ZwjnyOybg3Igea/A==",
+      "dev": true
     },
     "dashdash": {
       "version": "1.14.1",
@@ -8428,7 +8742,8 @@
     "decode-uri-component": {
       "version": "0.2.0",
       "resolved": "https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz",
-      "integrity": "sha512-hjf+xovcEn31w/EUYdTXQh/8smFL/dzYjohQGEIgjyNavaJfBY2p5F527Bo1VPATxv0VYTUC2bOcXvqFwk78Og=="
+      "integrity": "sha512-hjf+xovcEn31w/EUYdTXQh/8smFL/dzYjohQGEIgjyNavaJfBY2p5F527Bo1VPATxv0VYTUC2bOcXvqFwk78Og==",
+      "dev": true
     },
     "decompress": {
       "version": "4.2.1",
@@ -8739,6 +9054,7 @@
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/define-property/-/define-property-2.0.2.tgz",
       "integrity": "sha512-jwK2UV4cnPpbcG7+VRARKTZPUWowwXA8bzH5NP6ud0oeAxyYPuGZUAC7hMugpCdz4BeSZl2Dl9k66CHJ/46ZYQ==",
+      "dev": true,
       "requires": {
         "is-descriptor": "^1.0.2",
         "isobject": "^3.0.1"
@@ -8748,6 +9064,7 @@
           "version": "1.0.0",
           "resolved": "https://registry.npmjs.org/is-accessor-descriptor/-/is-accessor-descriptor-1.0.0.tgz",
           "integrity": "sha512-m5hnHTkcVsPfqx3AKlyttIPb7J+XykHvJP2B9bZDjlhLIoEq4XoK64Vg7boZlVWYK6LUY94dYPEE7Lh0ZkZKcQ==",
+          "dev": true,
           "requires": {
             "kind-of": "^6.0.0"
           }
@@ -8756,6 +9073,7 @@
           "version": "1.0.0",
           "resolved": "https://registry.npmjs.org/is-data-descriptor/-/is-data-descriptor-1.0.0.tgz",
           "integrity": "sha512-jbRXy1FmtAoCjQkVmIVYwuuqDFUbaOeDjmed1tOGPrsMhtJA4rD9tkgA0F1qJ3gRFRXcHYVkdeaP50Q5rE/jLQ==",
+          "dev": true,
           "requires": {
             "kind-of": "^6.0.0"
           }
@@ -8764,6 +9082,7 @@
           "version": "1.0.2",
           "resolved": "https://registry.npmjs.org/is-descriptor/-/is-descriptor-1.0.2.tgz",
           "integrity": "sha512-2eis5WqQGV7peooDyLmNEPUrps9+SXX5c9pL3xEB+4e9HnGuDa7mB7kHxHw4CbqS9k1T2hOH3miL8n8WtiYVtg==",
+          "dev": true,
           "requires": {
             "is-accessor-descriptor": "^1.0.0",
             "is-data-descriptor": "^1.0.0",
@@ -8999,7 +9318,8 @@
     "domain-browser": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/domain-browser/-/domain-browser-1.2.0.tgz",
-      "integrity": "sha512-jnjyiM6eRyZl2H+W8Q/zLMA481hzi0eszAaBUzIVnmYVDBbnLxVNnfu1HgEBvCbL+71FrxMl3E6lpKH7Ge3OXA=="
+      "integrity": "sha512-jnjyiM6eRyZl2H+W8Q/zLMA481hzi0eszAaBUzIVnmYVDBbnLxVNnfu1HgEBvCbL+71FrxMl3E6lpKH7Ge3OXA==",
+      "dev": true
     },
     "domelementtype": {
       "version": "1.3.1",
@@ -9247,6 +9567,7 @@
       "version": "3.7.1",
       "resolved": "https://registry.npmjs.org/duplexify/-/duplexify-3.7.1.tgz",
       "integrity": "sha512-07z8uv2wMyS51kKhD1KsdXJg5WQ6t93RneqRxUHnskXVtlYYkLqM0gqStQZ3pj073g687jPCHrqNfCzawLYh5g==",
+      "dev": true,
       "requires": {
         "end-of-stream": "^1.0.0",
         "inherits": "^2.0.1",
@@ -9254,6 +9575,12 @@
         "stream-shift": "^1.0.0"
       }
     },
+    "eastasianwidth": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/eastasianwidth/-/eastasianwidth-0.2.0.tgz",
+      "integrity": "sha512-I88TYZWc9XiYHRQ4/3c5rjjfgkjhLyW2luGIheGERbNQ6OY7yTybanSpDXZa8y7VUP9YmDcYa+eyq4ca7iLqWA==",
+      "dev": true
+    },
     "easy-stack": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/easy-stack/-/easy-stack-1.0.1.tgz",
@@ -9387,6 +9714,7 @@
       "version": "4.5.0",
       "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-4.5.0.tgz",
       "integrity": "sha512-Nv9m36S/vxpsI+Hc4/ZGRs0n9mXqSWGGq49zxb/cJfPAQMbUtttJAlNPS4AQzaBdw/pKskw5bMbekT/Y7W/Wlg==",
+      "dev": true,
       "requires": {
         "graceful-fs": "^4.1.2",
         "memory-fs": "^0.5.0",
@@ -9397,6 +9725,7 @@
           "version": "0.5.0",
           "resolved": "https://registry.npmjs.org/memory-fs/-/memory-fs-0.5.0.tgz",
           "integrity": "sha512-jA0rdU5KoQMC0e6ppoNRtpp6vjFq6+NY7r8hywnC7V+1Xj/MtHwGIbB1QaK/dunyjWteJzmkpd7ooeWg10T7GA==",
+          "dev": true,
           "requires": {
             "errno": "^0.1.3",
             "readable-stream": "^2.0.1"
@@ -9435,6 +9764,7 @@
       "version": "0.1.8",
       "resolved": "https://registry.npmjs.org/errno/-/errno-0.1.8.tgz",
       "integrity": "sha512-dJ6oBr5SQ1VSd9qkk7ByRgb/1SH4JZjCHSW/mr63/QcXO9zLVxvJ6Oy13nio03rxpSnVDDjFor75SjVeZWPW/A==",
+      "dev": true,
       "requires": {
         "prr": "~1.0.1"
       }
@@ -9735,8 +10065,7 @@
       "version": "14.1.1",
       "resolved": "https://registry.npmjs.org/eslint-config-standard/-/eslint-config-standard-14.1.1.tgz",
       "integrity": "sha512-Z9B+VR+JIXRxz21udPTL9HpFMyoMUEeX1G251EQ6e05WD9aPVtVBn09XUmZ259wCMlCDmYDSZG62Hhm+ZTJcUg==",
-      "dev": true,
-      "requires": {}
+      "dev": true
     },
     "eslint-import-resolver-node": {
       "version": "0.3.6",
@@ -10102,8 +10431,7 @@
       "version": "4.1.0",
       "resolved": "https://registry.npmjs.org/eslint-plugin-standard/-/eslint-plugin-standard-4.1.0.tgz",
       "integrity": "sha512-ZL7+QRixjTR6/528YNGyDotyffm5OQst/sGxKDwGb9Uqs4In5Egi4+jbobhqJoyoCM6/7v/1A5fhQ7ScMtDjaQ==",
-      "dev": true,
-      "requires": {}
+      "dev": true
     },
     "eslint-plugin-vue": {
       "version": "7.20.0",
@@ -10138,6 +10466,7 @@
       "version": "4.0.3",
       "resolved": "https://registry.npmjs.org/eslint-scope/-/eslint-scope-4.0.3.tgz",
       "integrity": "sha512-p7VutNr1O/QrxysMo3E45FjYDTeXBy0iTltPFNSqKAIfjDSXC+4dj+qfyuD8bfAXrW/y6lW3O76VaYNPKfpKrg==",
+      "dev": true,
       "requires": {
         "esrecurse": "^4.1.0",
         "estraverse": "^4.1.1"
@@ -10203,6 +10532,7 @@
       "version": "4.3.0",
       "resolved": "https://registry.npmjs.org/esrecurse/-/esrecurse-4.3.0.tgz",
       "integrity": "sha512-KmfKL3b6G+RXvP8N1vr3Tq1kL/oCFgn2NYXEtqP8/L3pKapUA4G8cFVaoF3SU323CD4XypR/ffioHmkti6/Tag==",
+      "dev": true,
       "requires": {
         "estraverse": "^5.2.0"
       },
@@ -10210,14 +10540,16 @@
         "estraverse": {
           "version": "5.3.0",
           "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-5.3.0.tgz",
-          "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA=="
+          "integrity": "sha512-MMdARuVEQziNTeJD8DgMqmhwR11BRQ/cBP+pLtYdSTnf3MIO8fFeiINEbX36ZdNlfU/7A9f3gUw49B3oQsvwBA==",
+          "dev": true
         }
       }
     },
     "estraverse": {
       "version": "4.3.0",
       "resolved": "https://registry.npmjs.org/estraverse/-/estraverse-4.3.0.tgz",
-      "integrity": "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw=="
+      "integrity": "sha512-39nnKffWz8xN1BU/2c79n9nB9HDzo0niYUqx6xyqUnyoAnQyyWpOTdZEeiCch8BBu515t4wp9ZmgVfVhn9EBpw==",
+      "dev": true
     },
     "estree-walker": {
       "version": "2.0.2",
@@ -10251,7 +10583,8 @@
     "events": {
       "version": "3.3.0",
       "resolved": "https://registry.npmjs.org/events/-/events-3.3.0.tgz",
-      "integrity": "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q=="
+      "integrity": "sha512-mQw+2fkQbALzQ7V0MY0IqdnXNOeTtP4r0lN9z7AAawCXgqea7bDii20AYrIBrFd/Hx0M2Ocz6S111CaFkUcb0Q==",
+      "dev": true
     },
     "eventsource": {
       "version": "2.0.2",
@@ -10302,6 +10635,7 @@
       "version": "2.1.4",
       "resolved": "https://registry.npmjs.org/expand-brackets/-/expand-brackets-2.1.4.tgz",
       "integrity": "sha512-w/ozOKR9Obk3qoWeY/WDi6MFta9AoMR+zud60mdnbniMcBxRuFJyDt2LdX/14A1UABeqk+Uk+LDfUpvoGKppZA==",
+      "dev": true,
       "requires": {
         "debug": "^2.3.3",
         "define-property": "^0.2.5",
@@ -10316,6 +10650,7 @@
           "version": "2.6.9",
           "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
           "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+          "dev": true,
           "requires": {
             "ms": "2.0.0"
           }
@@ -10324,6 +10659,7 @@
           "version": "0.2.5",
           "resolved": "https://registry.npmjs.org/define-property/-/define-property-0.2.5.tgz",
           "integrity": "sha512-Rr7ADjQZenceVOAKop6ALkkRAmH1A4Gx9hV/7ZujPUN2rkATqFO0JZLZInbAjpZYoJ1gUx8MRMQVkYemcbMSTA==",
+          "dev": true,
           "requires": {
             "is-descriptor": "^0.1.0"
           }
@@ -10332,6 +10668,7 @@
           "version": "2.0.1",
           "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
           "integrity": "sha512-zCnTtlxNoAiDc3gqY2aYAWFx7XWWiasuF2K8Me5WbN8otHKTUKBwjPtNpRs/rbUZm7KxWAaNj7P1a/p52GbVug==",
+          "dev": true,
           "requires": {
             "is-extendable": "^0.1.0"
           }
@@ -10339,7 +10676,8 @@
         "ms": {
           "version": "2.0.0",
           "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-          "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
+          "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+          "dev": true
         }
       }
     },
@@ -10392,6 +10730,12 @@
         }
       }
     },
+    "exponential-backoff": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/exponential-backoff/-/exponential-backoff-3.1.3.tgz",
+      "integrity": "sha512-ZgEeZXj30q+I0EN+CbSSpIyPaJ5HVQD18Z1m+u1FXbAeT94mr1zw50q4q6jiiC447Nl/YTcIYSAftiGqetwXCA==",
+      "dev": true
+    },
     "express": {
       "version": "4.18.1",
       "resolved": "https://registry.npmjs.org/express/-/express-4.18.1.tgz",
@@ -10522,6 +10866,7 @@
       "version": "3.0.2",
       "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-3.0.2.tgz",
       "integrity": "sha512-BwY5b5Ql4+qZoefgMj2NUmx+tehVTH/Kf4k1ZEtOHNFcm2wSxMRo992l6X3TIgni2eZVTZ85xMOjF31fwZAj6Q==",
+      "dev": true,
       "requires": {
         "assign-symbols": "^1.0.0",
         "is-extendable": "^1.0.1"
@@ -10531,6 +10876,7 @@
           "version": "1.0.1",
           "resolved": "https://registry.npmjs.org/is-extendable/-/is-extendable-1.0.1.tgz",
           "integrity": "sha512-arnXMxT1hhoKo9k1LZdmlNyJdDDfy2v0fXjFlmok4+i8ul/6WlbVge9bhM74OpNPQPMGUToDtz+KXa1PneJxOA==",
+          "dev": true,
           "requires": {
             "is-plain-object": "^2.0.4"
           }
@@ -10539,6 +10885,7 @@
           "version": "2.0.4",
           "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-2.0.4.tgz",
           "integrity": "sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og==",
+          "dev": true,
           "requires": {
             "isobject": "^3.0.1"
           }
@@ -10571,6 +10918,7 @@
       "version": "2.0.4",
       "resolved": "https://registry.npmjs.org/extglob/-/extglob-2.0.4.tgz",
       "integrity": "sha512-Nmb6QXkELsuBr24CJSkilo6UHHgbekK5UiZgfE6UHD3Eb27YC6oD+bhcT+tJ6cl8dmsgdQxnWlcry8ksBIBLpw==",
+      "dev": true,
       "requires": {
         "array-unique": "^0.3.2",
         "define-property": "^1.0.0",
@@ -10586,6 +10934,7 @@
           "version": "1.0.0",
           "resolved": "https://registry.npmjs.org/define-property/-/define-property-1.0.0.tgz",
           "integrity": "sha512-cZTYKFWspt9jZsMscWo8sc/5lbPC9Q0N5nBLgb+Yd915iL3udB1uFgS3B8YCx66UVHq018DAVFoee7x+gxggeA==",
+          "dev": true,
           "requires": {
             "is-descriptor": "^1.0.0"
           }
@@ -10594,6 +10943,7 @@
           "version": "2.0.1",
           "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
           "integrity": "sha512-zCnTtlxNoAiDc3gqY2aYAWFx7XWWiasuF2K8Me5WbN8otHKTUKBwjPtNpRs/rbUZm7KxWAaNj7P1a/p52GbVug==",
+          "dev": true,
           "requires": {
             "is-extendable": "^0.1.0"
           }
@@ -10602,6 +10952,7 @@
           "version": "1.0.0",
           "resolved": "https://registry.npmjs.org/is-accessor-descriptor/-/is-accessor-descriptor-1.0.0.tgz",
           "integrity": "sha512-m5hnHTkcVsPfqx3AKlyttIPb7J+XykHvJP2B9bZDjlhLIoEq4XoK64Vg7boZlVWYK6LUY94dYPEE7Lh0ZkZKcQ==",
+          "dev": true,
           "requires": {
             "kind-of": "^6.0.0"
           }
@@ -10610,6 +10961,7 @@
           "version": "1.0.0",
           "resolved": "https://registry.npmjs.org/is-data-descriptor/-/is-data-descriptor-1.0.0.tgz",
           "integrity": "sha512-jbRXy1FmtAoCjQkVmIVYwuuqDFUbaOeDjmed1tOGPrsMhtJA4rD9tkgA0F1qJ3gRFRXcHYVkdeaP50Q5rE/jLQ==",
+          "dev": true,
           "requires": {
             "kind-of": "^6.0.0"
           }
@@ -10618,6 +10970,7 @@
           "version": "1.0.2",
           "resolved": "https://registry.npmjs.org/is-descriptor/-/is-descriptor-1.0.2.tgz",
           "integrity": "sha512-2eis5WqQGV7peooDyLmNEPUrps9+SXX5c9pL3xEB+4e9HnGuDa7mB7kHxHw4CbqS9k1T2hOH3miL8n8WtiYVtg==",
+          "dev": true,
           "requires": {
             "is-accessor-descriptor": "^1.0.0",
             "is-data-descriptor": "^1.0.0",
@@ -10808,6 +11161,7 @@
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-4.0.0.tgz",
       "integrity": "sha512-VcpLTWqWDiTerugjj8e3+esbg+skS3M9e54UuR3iCeIDMXCLTsAH8hTSzDQU/X6/6t3eYkOKoZSef2PlU6U1XQ==",
+      "dev": true,
       "requires": {
         "extend-shallow": "^2.0.1",
         "is-number": "^3.0.0",
@@ -10819,6 +11173,7 @@
           "version": "2.0.1",
           "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
           "integrity": "sha512-zCnTtlxNoAiDc3gqY2aYAWFx7XWWiasuF2K8Me5WbN8otHKTUKBwjPtNpRs/rbUZm7KxWAaNj7P1a/p52GbVug==",
+          "dev": true,
           "requires": {
             "is-extendable": "^0.1.0"
           }
@@ -10896,6 +11251,7 @@
       "version": "2.1.0",
       "resolved": "https://registry.npmjs.org/find-cache-dir/-/find-cache-dir-2.1.0.tgz",
       "integrity": "sha512-Tq6PixE0w/VMFfCgbONnkiQIVol/JJL7nRMi20fqzA4NRs9AfeqMGeRdPi3wIhYkxjeBaWh2rxwapn5Tu3IqOQ==",
+      "dev": true,
       "requires": {
         "commondir": "^1.0.1",
         "make-dir": "^2.0.0",
@@ -10906,6 +11262,7 @@
           "version": "2.1.0",
           "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-2.1.0.tgz",
           "integrity": "sha512-LS9X+dc8KLxXCb8dni79fLIIUA5VyZoyjSMCwTluaXA0o27cCK0bhXkpgw+sTXVpPy/lSO57ilRixqk0vDmtRA==",
+          "dev": true,
           "requires": {
             "pify": "^4.0.1",
             "semver": "^5.6.0"
@@ -10914,12 +11271,14 @@
         "pify": {
           "version": "4.0.1",
           "resolved": "https://registry.npmjs.org/pify/-/pify-4.0.1.tgz",
-          "integrity": "sha512-uB80kBFb/tfd68bVleG9T5GGsGPjJrLAUpR5PZIrhBnIaRTQRjqdJSsIKkOP6OAIFbj7GOrcudc5pNjZ+geV2g=="
+          "integrity": "sha512-uB80kBFb/tfd68bVleG9T5GGsGPjJrLAUpR5PZIrhBnIaRTQRjqdJSsIKkOP6OAIFbj7GOrcudc5pNjZ+geV2g==",
+          "dev": true
         },
         "semver": {
           "version": "5.7.1",
           "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz",
-          "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ=="
+          "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==",
+          "dev": true
         }
       }
     },
@@ -10990,6 +11349,7 @@
       "version": "1.1.1",
       "resolved": "https://registry.npmjs.org/flush-write-stream/-/flush-write-stream-1.1.1.tgz",
       "integrity": "sha512-3Z4XhFZ3992uIq0XOqb9AreonueSYphE6oYbpt5+3u06JWklbsPkNv3ZKkP9Bz/r+1MWCaMoSQ28P85+1Yc77w==",
+      "dev": true,
       "requires": {
         "inherits": "^2.0.3",
         "readable-stream": "^2.3.6"
@@ -11011,7 +11371,58 @@
     "for-in": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/for-in/-/for-in-1.0.2.tgz",
-      "integrity": "sha512-7EwmXrOjyL+ChxMhmG5lnW9MPt1aIeZEwKhQzoBUdTV0N3zuwWDZYVJatDvZ2OyzPUvdIAZDsCetk3coyMfcnQ=="
+      "integrity": "sha512-7EwmXrOjyL+ChxMhmG5lnW9MPt1aIeZEwKhQzoBUdTV0N3zuwWDZYVJatDvZ2OyzPUvdIAZDsCetk3coyMfcnQ==",
+      "dev": true
+    },
+    "foreground-child": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
+      "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
+      "dev": true,
+      "requires": {
+        "cross-spawn": "^7.0.6",
+        "signal-exit": "^4.0.1"
+      },
+      "dependencies": {
+        "cross-spawn": {
+          "version": "7.0.6",
+          "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+          "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
+          "dev": true,
+          "requires": {
+            "path-key": "^3.1.0",
+            "shebang-command": "^2.0.0",
+            "which": "^2.0.1"
+          }
+        },
+        "path-key": {
+          "version": "3.1.1",
+          "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+          "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+          "dev": true
+        },
+        "shebang-command": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+          "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+          "dev": true,
+          "requires": {
+            "shebang-regex": "^3.0.0"
+          }
+        },
+        "shebang-regex": {
+          "version": "3.0.0",
+          "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+          "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+          "dev": true
+        },
+        "signal-exit": {
+          "version": "4.1.0",
+          "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
+          "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
+          "dev": true
+        }
+      }
     },
     "forever-agent": {
       "version": "0.6.1",
@@ -11038,6 +11449,7 @@
       "version": "0.2.1",
       "resolved": "https://registry.npmjs.org/fragment-cache/-/fragment-cache-0.2.1.tgz",
       "integrity": "sha512-GMBAbW9antB8iZRHLoGw0b3HANt57diZYFO/HL1JGIC1MjKrdmhxvrJbupnVvpys0zsz7yBApXdQyfepKly2kA==",
+      "dev": true,
       "requires": {
         "map-cache": "^0.2.2"
       }
@@ -11052,6 +11464,7 @@
       "version": "2.3.0",
       "resolved": "https://registry.npmjs.org/from2/-/from2-2.3.0.tgz",
       "integrity": "sha512-OMcX/4IC/uqEPVgGeyfN22LJk6AZrMkRZHxcHBMBvHScDGgwTm2GT2Wkgtocyd3JfZffjj2kYUDXXII0Fk9W0g==",
+      "dev": true,
       "requires": {
         "inherits": "^2.0.1",
         "readable-stream": "^2.0.0"
@@ -11098,6 +11511,7 @@
       "version": "1.0.10",
       "resolved": "https://registry.npmjs.org/fs-write-stream-atomic/-/fs-write-stream-atomic-1.0.10.tgz",
       "integrity": "sha512-gehEzmPn2nAwr39eay+x3X34Ra+M2QlVUTLhkXPjWdeO8RF9kszk116avgBJM3ZyNHgHXBNx+VmPaFC36k0PzA==",
+      "dev": true,
       "requires": {
         "graceful-fs": "^4.1.2",
         "iferr": "^0.1.5",
@@ -11245,7 +11659,8 @@
     "get-value": {
       "version": "2.0.6",
       "resolved": "https://registry.npmjs.org/get-value/-/get-value-2.0.6.tgz",
-      "integrity": "sha512-Ln0UQDlxH1BapMu3GPtf7CuYNwRZf2gwCuPqbyG6pB8WfmFpzqcy4xtAaAMUhnNqjMKTiCPZG2oMT3YSx8U2NA=="
+      "integrity": "sha512-Ln0UQDlxH1BapMu3GPtf7CuYNwRZf2gwCuPqbyG6pB8WfmFpzqcy4xtAaAMUhnNqjMKTiCPZG2oMT3YSx8U2NA==",
+      "dev": true
     },
     "getpass": {
       "version": "0.1.7",
@@ -11489,8 +11904,7 @@
       "version": "0.3.2",
       "resolved": "https://registry.npmjs.org/graphql-type-json/-/graphql-type-json-0.3.2.tgz",
       "integrity": "sha512-J+vjof74oMlCWXSvt0DOf2APEdZOCdubEvGDUAlqH//VBYcOYsGgRW7Xzorr44LvkjiuvecWc8fChxuZZbChtg==",
-      "dev": true,
-      "requires": {}
+      "dev": true
     },
     "growly": {
       "version": "1.3.0",
@@ -11614,6 +12028,7 @@
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/has-value/-/has-value-1.0.0.tgz",
       "integrity": "sha512-IBXk4GTsLYdQ7Rvt+GRBrFSVEkmuOUy4re0Xjd9kJSUQpnTrWR4/y9RpfexN9vkAPMFuQoeWKwqzPozRTlasGw==",
+      "dev": true,
       "requires": {
         "get-value": "^2.0.6",
         "has-values": "^1.0.0",
@@ -11624,6 +12039,7 @@
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/has-values/-/has-values-1.0.0.tgz",
       "integrity": "sha512-ODYZC64uqzmtfGMEAX/FvZiRyWLpAC3vYnNunURUnkGVTS+mI0smVsWaPydRBsE3g+ok7h960jChO8mFcWlHaQ==",
+      "dev": true,
       "requires": {
         "is-number": "^3.0.0",
         "kind-of": "^4.0.0"
@@ -11633,6 +12049,7 @@
           "version": "4.0.0",
           "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-4.0.0.tgz",
           "integrity": "sha512-24XsCxmEbRwEDbz/qz3stgin8TTzZ1ESR56OMCN0ujYg+vRutNSiOj9bHH9u85DKgXguraugV5sFuvbD4FW/hw==",
+          "dev": true,
           "requires": {
             "is-buffer": "^1.1.5"
           }
@@ -11910,9 +12327,9 @@
       }
     },
     "http-cache-semantics": {
-      "version": "4.1.0",
-      "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.1.0.tgz",
-      "integrity": "sha512-carPklcUh7ROWRK7Cv27RPtdhYhUsela/ue5/jKzjegVvXDqM2ILE9Q2BGn9JZJh1g87cp56su/FgQSzcWS8cQ=="
+      "version": "4.2.0",
+      "resolved": "https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.2.0.tgz",
+      "integrity": "sha512-dTxcvPXqPvXBQpq5dUr6mEMJX4oIEFv6bwom3FDwKRDsuIjjJGANqhBuoAn9c1RQJIdAKav33ED65E2ys+87QQ=="
     },
     "http-deceiver": {
       "version": "1.2.7",
@@ -12045,7 +12462,8 @@
     "https-browserify": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/https-browserify/-/https-browserify-1.0.0.tgz",
-      "integrity": "sha512-J+FkSdyD+0mA0N+81tMotaRMfSL9SGi+xpD3T6YApKsc3bGSXJlfXri3VyFOeYkfLRQisDk1W+jIFFKBeUBbBg=="
+      "integrity": "sha512-J+FkSdyD+0mA0N+81tMotaRMfSL9SGi+xpD3T6YApKsc3bGSXJlfXri3VyFOeYkfLRQisDk1W+jIFFKBeUBbBg==",
+      "dev": true
     },
     "https-proxy-agent": {
       "version": "5.0.1",
@@ -12091,12 +12509,14 @@
     "ieee754": {
       "version": "1.2.1",
       "resolved": "https://registry.npmjs.org/ieee754/-/ieee754-1.2.1.tgz",
-      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA=="
+      "integrity": "sha512-dcyqhDvX1C46lXZcVqCpK+FtMRQVdIMN6/Df5js2zouUsqG7I6sFxitIC+7KYK29KdXOLHdu9zL4sFnoVQnqaA==",
+      "dev": true
     },
     "iferr": {
       "version": "0.1.5",
       "resolved": "https://registry.npmjs.org/iferr/-/iferr-0.1.5.tgz",
-      "integrity": "sha512-DUNFN5j7Tln0D+TxzloUjKB+CtVu6myn0JEFak6dG18mNt9YkQ6lzGCdafwofISZ1lLF3xRHJ98VKy9ynkcFaA=="
+      "integrity": "sha512-DUNFN5j7Tln0D+TxzloUjKB+CtVu6myn0JEFak6dG18mNt9YkQ6lzGCdafwofISZ1lLF3xRHJ98VKy9ynkcFaA==",
+      "dev": true
     },
     "ignore": {
       "version": "4.0.6",
@@ -12377,7 +12797,13 @@
     "ip": {
       "version": "1.1.8",
       "resolved": "https://registry.npmjs.org/ip/-/ip-1.1.8.tgz",
-      "integrity": "sha512-PuExPYUiu6qMBQb4l06ecm6T6ujzhmh+MeJcW9wa89PoAz5pvd4zPgN5WJV104mb6S2T1AwNIAaB70JNrLQWhg=="
+      "integrity": "sha512-PuExPYUiu6qMBQb4l06ecm6T6ujzhmh+MeJcW9wa89PoAz5pvd4zPgN5WJV104mb6S2T1AwNIAaB70JNrLQWhg==",
+      "dev": true
+    },
+    "ip-address": {
+      "version": "10.2.0",
+      "resolved": "https://registry.npmjs.org/ip-address/-/ip-address-10.2.0.tgz",
+      "integrity": "sha512-/+S6j4E9AHvW9SWMSEY9Xfy66O5PWvVEJ08O0y5JGyEKQpojb0K0GKpz/v5HJ/G0vi3D2sjGK78119oXZeE0qA=="
     },
     "ip-regex": {
       "version": "2.1.0",
@@ -12401,6 +12827,7 @@
       "version": "0.1.6",
       "resolved": "https://registry.npmjs.org/is-accessor-descriptor/-/is-accessor-descriptor-0.1.6.tgz",
       "integrity": "sha512-e1BM1qnDbMRG3ll2U9dSK0UMHuWOs3pY3AtcFsmvwPtKL3MML/Q86i+GilLfvqEs4GW+ExB91tQ3Ig9noDIZ+A==",
+      "dev": true,
       "requires": {
         "kind-of": "^3.0.2"
       },
@@ -12409,6 +12836,7 @@
           "version": "3.2.2",
           "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
           "integrity": "sha512-NOW9QQXMoZGg/oqnVNoNTTIFEIid1627WCffUBJEdMxYApq7mNE7CpzucIPc+ZQg25Phej7IJSmX3hO+oblOtQ==",
+          "dev": true,
           "requires": {
             "is-buffer": "^1.1.5"
           }
@@ -12503,6 +12931,7 @@
       "version": "0.1.4",
       "resolved": "https://registry.npmjs.org/is-data-descriptor/-/is-data-descriptor-0.1.4.tgz",
       "integrity": "sha512-+w9D5ulSoBNlmw9OHn3U2v51SyoCd0he+bB3xMl62oijhrspxowjU+AIcDY0N3iEJbUEkB15IlMASQsxYigvXg==",
+      "dev": true,
       "requires": {
         "kind-of": "^3.0.2"
       },
@@ -12511,6 +12940,7 @@
           "version": "3.2.2",
           "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
           "integrity": "sha512-NOW9QQXMoZGg/oqnVNoNTTIFEIid1627WCffUBJEdMxYApq7mNE7CpzucIPc+ZQg25Phej7IJSmX3hO+oblOtQ==",
+          "dev": true,
           "requires": {
             "is-buffer": "^1.1.5"
           }
@@ -12530,6 +12960,7 @@
       "version": "0.1.6",
       "resolved": "https://registry.npmjs.org/is-descriptor/-/is-descriptor-0.1.6.tgz",
       "integrity": "sha512-avDYr0SB3DwO9zsMov0gKCESFYqCnE4hq/4z3TdUlukEy5t9C0YRq7HLrsN52NAcqXKaepeCD0n+B0arnVG3Hg==",
+      "dev": true,
       "requires": {
         "is-accessor-descriptor": "^0.1.6",
         "is-data-descriptor": "^0.1.4",
@@ -12539,7 +12970,8 @@
         "kind-of": {
           "version": "5.1.0",
           "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-5.1.0.tgz",
-          "integrity": "sha512-NGEErnH6F2vUuXDh+OlbcKW7/wOcfdRHaZ7VWtqCztfHri/++YKmP51OdWeGPuqCOba6kk2OTe5d02VmTB80Pw=="
+          "integrity": "sha512-NGEErnH6F2vUuXDh+OlbcKW7/wOcfdRHaZ7VWtqCztfHri/++YKmP51OdWeGPuqCOba6kk2OTe5d02VmTB80Pw==",
+          "dev": true
         }
       }
     },
@@ -12558,7 +12990,8 @@
     "is-extendable": {
       "version": "0.1.1",
       "resolved": "https://registry.npmjs.org/is-extendable/-/is-extendable-0.1.1.tgz",
-      "integrity": "sha512-5BMULNob1vgFX6EjQw5izWDxrecWK9AM72rugNr0TFldMOi0fj6Jk+zeKIt0xGj4cEfQIJth4w3OKWOJ4f+AFw=="
+      "integrity": "sha512-5BMULNob1vgFX6EjQw5izWDxrecWK9AM72rugNr0TFldMOi0fj6Jk+zeKIt0xGj4cEfQIJth4w3OKWOJ4f+AFw==",
+      "dev": true
     },
     "is-extglob": {
       "version": "2.1.1",
@@ -12632,6 +13065,7 @@
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/is-number/-/is-number-3.0.0.tgz",
       "integrity": "sha512-4cboCqIpliH+mAvFNegjZQ4kgKc3ZUhQVr3HvWbSh5q3WH2v82ct+T2Y1hdU5Gdtorx/cLifQjqCbL7bpznLTg==",
+      "dev": true,
       "requires": {
         "kind-of": "^3.0.2"
       },
@@ -12640,6 +13074,7 @@
           "version": "3.2.2",
           "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
           "integrity": "sha512-NOW9QQXMoZGg/oqnVNoNTTIFEIid1627WCffUBJEdMxYApq7mNE7CpzucIPc+ZQg25Phej7IJSmX3hO+oblOtQ==",
+          "dev": true,
           "requires": {
             "is-buffer": "^1.1.5"
           }
@@ -12812,12 +13247,14 @@
     "is-windows": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/is-windows/-/is-windows-1.0.2.tgz",
-      "integrity": "sha512-eXK1UInq2bPmjyX6e3VHIzMLobc4J94i4AWn+Hpq3OU5KkrRC96OAcR3PRJ/pGu6m8TRnBHP9dkXQVsT/COVIA=="
+      "integrity": "sha512-eXK1UInq2bPmjyX6e3VHIzMLobc4J94i4AWn+Hpq3OU5KkrRC96OAcR3PRJ/pGu6m8TRnBHP9dkXQVsT/COVIA==",
+      "dev": true
     },
     "is-wsl": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/is-wsl/-/is-wsl-1.1.0.tgz",
-      "integrity": "sha512-gfygJYZ2gLTDlmbWMI0CE2MwnFzSN/2SZfkMlItC4K/JBlsWVDB0bO6XhqcY13YXE7iMcAJnzTCJjPiTeJJ0Mw=="
+      "integrity": "sha512-gfygJYZ2gLTDlmbWMI0CE2MwnFzSN/2SZfkMlItC4K/JBlsWVDB0bO6XhqcY13YXE7iMcAJnzTCJjPiTeJJ0Mw==",
+      "dev": true
     },
     "is-yarn-global": {
       "version": "0.3.0",
@@ -12843,7 +13280,8 @@
     "isobject": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/isobject/-/isobject-3.0.1.tgz",
-      "integrity": "sha512-WhB9zCku7EGTj/HQQRz5aUQEUeoQZH2bWcltRErOpymJ4boYE6wL9Tbr23krRPSZ+C5zqNSrSw+Cc7sZZ4b7vg=="
+      "integrity": "sha512-WhB9zCku7EGTj/HQQRz5aUQEUeoQZH2bWcltRErOpymJ4boYE6wL9Tbr23krRPSZ+C5zqNSrSw+Cc7sZZ4b7vg==",
+      "dev": true
     },
     "isstream": {
       "version": "0.1.2",
@@ -13000,6 +13438,16 @@
       "integrity": "sha512-QZ9qOMdF+QLHxy1QIpUHUU1D5pS2CG2P69LF6L6CPjPYA/XMOmKV3PZpawHoAjHNyB0swdVTRxdYT4tbBbxqwg==",
       "dev": true
     },
+    "jackspeak": {
+      "version": "3.4.3",
+      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-3.4.3.tgz",
+      "integrity": "sha512-OGlZQpz2yfahA/Rd1Y8Cd9SIEsqvXkLVoSw/cgwhnhFMDbsQFeZYoJJ7bIZBS9BcamUW96asq/npPWugM+RQBw==",
+      "dev": true,
+      "requires": {
+        "@isaacs/cliui": "^8.0.2",
+        "@pkgjs/parseargs": "^0.11.0"
+      }
+    },
     "javascript-stringify": {
       "version": "1.6.0",
       "resolved": "https://registry.npmjs.org/javascript-stringify/-/javascript-stringify-1.6.0.tgz",
@@ -13908,8 +14356,7 @@
       "version": "1.2.2",
       "resolved": "https://registry.npmjs.org/jest-pnp-resolver/-/jest-pnp-resolver-1.2.2.tgz",
       "integrity": "sha512-olV41bKSMm8BdnuMsewT4jqlZ8+3TCARAXjZGT9jcoSnrfUnRCqnMoF9XEeoWjbzObpqF9dRhHQj0Xb9QdF6/w==",
-      "dev": true,
-      "requires": {}
+      "dev": true
     },
     "jest-regex-util": {
       "version": "24.9.0",
@@ -14954,7 +15401,8 @@
     "json-parse-better-errors": {
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/json-parse-better-errors/-/json-parse-better-errors-1.0.2.tgz",
-      "integrity": "sha512-mrqyZKfX5EhL7hvqcV6WG1yYjnjeuYDzDhhcAAUrq8Po85NBQBJP+ZDUT75qZQ98IkUoBqdkExkukOU7Ts2wrw=="
+      "integrity": "sha512-mrqyZKfX5EhL7hvqcV6WG1yYjnjeuYDzDhhcAAUrq8Po85NBQBJP+ZDUT75qZQ98IkUoBqdkExkukOU7Ts2wrw==",
+      "dev": true
     },
     "json-parse-even-better-errors": {
       "version": "2.3.1",
@@ -15050,7 +15498,8 @@
     "kind-of": {
       "version": "6.0.3",
       "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-6.0.3.tgz",
-      "integrity": "sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw=="
+      "integrity": "sha512-dcS1ul+9tmeD95T+x28/ehLgd9mENa3LsvDTtzm3vyBEO7RPptvAD+t44WVXaUjTBRcrpFeFlC8WCruUR456hw==",
+      "dev": true
     },
     "kleur": {
       "version": "3.0.3",
@@ -15343,7 +15792,8 @@
     "loader-runner": {
       "version": "2.4.0",
       "resolved": "https://registry.npmjs.org/loader-runner/-/loader-runner-2.4.0.tgz",
-      "integrity": "sha512-Jsmr89RcXGIwivFY21FcRrisYZfvLMTWx5kOLc+JTxtpBOG6xML0vzbc6SEQG2FO9/4Fc3wW4LVcB5DmGflaRw=="
+      "integrity": "sha512-Jsmr89RcXGIwivFY21FcRrisYZfvLMTWx5kOLc+JTxtpBOG6xML0vzbc6SEQG2FO9/4Fc3wW4LVcB5DmGflaRw==",
+      "dev": true
     },
     "loader-utils": {
       "version": "2.0.2",
@@ -15610,12 +16060,14 @@
     "map-cache": {
       "version": "0.2.2",
       "resolved": "https://registry.npmjs.org/map-cache/-/map-cache-0.2.2.tgz",
-      "integrity": "sha512-8y/eV9QQZCiyn1SprXSrCmqJN0yNRATe+PO8ztwqrvrbdRLA3eYJF0yaR0YayLWkMbsQSKWS9N2gPcGEc4UsZg=="
+      "integrity": "sha512-8y/eV9QQZCiyn1SprXSrCmqJN0yNRATe+PO8ztwqrvrbdRLA3eYJF0yaR0YayLWkMbsQSKWS9N2gPcGEc4UsZg==",
+      "dev": true
     },
     "map-visit": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/map-visit/-/map-visit-1.0.0.tgz",
       "integrity": "sha512-4y7uGv8bd2WdM9vpQsiQNo41Ln1NvhvDRuVt0k2JZQ+ezN2uaQes7lZeZ+QQUHOLQAtDaBJ+7wCbi+ab/KFs+w==",
+      "dev": true,
       "requires": {
         "object-visit": "^1.0.0"
       }
@@ -15656,6 +16108,7 @@
       "version": "0.4.1",
       "resolved": "https://registry.npmjs.org/memory-fs/-/memory-fs-0.4.1.tgz",
       "integrity": "sha512-cda4JKCxReDXFXRqOHPQscuIYg1PvxbE2S2GP45rnwfEK+vZaXC8C1OFvdHIbgw0DLzowXGVoxLaAmlgRy14GQ==",
+      "dev": true,
       "requires": {
         "errno": "^0.1.3",
         "readable-stream": "^2.0.1"
@@ -15704,6 +16157,7 @@
       "version": "3.1.10",
       "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-3.1.10.tgz",
       "integrity": "sha512-MWikgl9n9M3w+bpsY3He8L+w9eF9338xRl8IAO5viDizwSzziFEyUzo2xrrloB64ADbTf8uA8vRqqttDTOmccg==",
+      "dev": true,
       "requires": {
         "arr-diff": "^4.0.0",
         "array-unique": "^0.3.2",
@@ -16019,6 +16473,7 @@
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/mississippi/-/mississippi-3.0.0.tgz",
       "integrity": "sha512-x471SsVjUtBRtcvd4BzKE9kFC+/2TeWgKCgw0bZcw1b9l2X3QX5vCWgF+KaZaYm87Ss//rHnWryupDrgLvmSkA==",
+      "dev": true,
       "requires": {
         "concat-stream": "^1.5.0",
         "duplexify": "^3.4.2",
@@ -16041,6 +16496,7 @@
       "version": "1.3.2",
       "resolved": "https://registry.npmjs.org/mixin-deep/-/mixin-deep-1.3.2.tgz",
       "integrity": "sha512-WRoDn//mXBiJ1H40rqa3vH0toePwSsGb45iInWlTySa+Uu4k3tYUSxa2v1KqAiLtvlrSzaExqS1gtk96A9zvEA==",
+      "dev": true,
       "requires": {
         "for-in": "^1.0.2",
         "is-extendable": "^1.0.1"
@@ -16050,6 +16506,7 @@
           "version": "1.0.1",
           "resolved": "https://registry.npmjs.org/is-extendable/-/is-extendable-1.0.1.tgz",
           "integrity": "sha512-arnXMxT1hhoKo9k1LZdmlNyJdDDfy2v0fXjFlmok4+i8ul/6WlbVge9bhM74OpNPQPMGUToDtz+KXa1PneJxOA==",
+          "dev": true,
           "requires": {
             "is-plain-object": "^2.0.4"
           }
@@ -16058,6 +16515,7 @@
           "version": "2.0.4",
           "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-2.0.4.tgz",
           "integrity": "sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og==",
+          "dev": true,
           "requires": {
             "isobject": "^3.0.1"
           }
@@ -16093,6 +16551,7 @@
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/move-concurrently/-/move-concurrently-1.0.1.tgz",
       "integrity": "sha512-hdrFxZOycD/g6A6SoI2bB5NA/5NEqD0569+S47WZhPvm46sD50ZHdYaFmnua5lndde9rCHGjmfK7Z8BuCt/PcQ==",
+      "dev": true,
       "requires": {
         "aproba": "^1.1.1",
         "copy-concurrently": "^1.0.0",
@@ -16106,6 +16565,7 @@
           "version": "0.5.6",
           "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
           "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
+          "dev": true,
           "requires": {
             "minimist": "^1.2.6"
           }
@@ -16114,6 +16574,7 @@
           "version": "2.7.1",
           "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-2.7.1.tgz",
           "integrity": "sha512-uWjbaKIK3T1OSVptzX7Nl6PvQ3qAGtKEtVRjRuazjfL3Bx5eI409VZSqgND+4UNnmzLVdPj9FqFJNPqBZFve4w==",
+          "dev": true,
           "requires": {
             "glob": "^7.1.3"
           }
@@ -16164,21 +16625,21 @@
       }
     },
     "nan": {
-      "version": "2.16.0",
-      "resolved": "https://registry.npmjs.org/nan/-/nan-2.16.0.tgz",
-      "integrity": "sha512-UdAqHyFngu7TfQKsCBgAA6pWDkT8MAO7d0jyOecVhN5354xbLqdn8mV9Tat9gepAupm0bt2DbeaSC8vS52MuFA==",
-      "dev": true,
-      "optional": true
+      "version": "2.18.0",
+      "resolved": "https://registry.npmjs.org/nan/-/nan-2.18.0.tgz",
+      "integrity": "sha512-W7tfG7vMOGtD30sHoZSSc/JVYiyDPEyQVso/Zz+/uQd0B0L46gtC+pHha5FFMRpil6fm/AoEcRWyOVi4+E/f8w==",
+      "dev": true
     },
     "nanoid": {
-      "version": "3.3.4",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.4.tgz",
-      "integrity": "sha512-MqBkQh/OHTS2egovRtLk45wEyNXwF+cokD+1YPf9u5VfJiRdAiRwB2froX5Co9Rh20xs4siNPm8naNotSD6RBw=="
+      "version": "3.3.12",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.12.tgz",
+      "integrity": "sha512-ZB9RH/39qpq5Vu6Y+NmUaFhQR6pp+M2Xt76XBnEwDaGcVAqhlvxrl3B2bKS5D3NH3QR76v3aSrKaF/Kiy7lEtQ=="
     },
     "nanomatch": {
       "version": "1.2.13",
       "resolved": "https://registry.npmjs.org/nanomatch/-/nanomatch-1.2.13.tgz",
       "integrity": "sha512-fpoe2T0RbHwBTBUOftAfBPaDEi06ufaUai0mE6Yn1kacc3SnTErfb/h+X94VXzI64rKFHYImXSvdwGGCmwOqCA==",
+      "dev": true,
       "requires": {
         "arr-diff": "^4.0.0",
         "array-unique": "^0.3.2",
@@ -16254,7 +16715,8 @@
     "neo-async": {
       "version": "2.6.2",
       "resolved": "https://registry.npmjs.org/neo-async/-/neo-async-2.6.2.tgz",
-      "integrity": "sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw=="
+      "integrity": "sha512-Yd3UES5mWCSqR+qNT93S3UoYUkqAZ9lLg8a7g9rimsWmYGK8cVToA4/sF3RrshdyV3sAGMXVUmpMYOw+dLpOuw==",
+      "dev": true
     },
     "nested-error-stacks": {
       "version": "2.0.1",
@@ -16358,20 +16820,211 @@
       "dev": true
     },
     "node-gyp": {
-      "version": "7.1.2",
-      "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-7.1.2.tgz",
-      "integrity": "sha512-CbpcIo7C3eMu3dL1c3d0xw449fHIGALIJsRP4DDPHpyiW8vcriNY7ubh9TE4zEKfSxscY7PjeFnshE7h75ynjQ==",
+      "version": "10.0.1",
+      "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-10.0.1.tgz",
+      "integrity": "sha512-gg3/bHehQfZivQVfqIyy8wTdSymF9yTyP4CJifK73imyNMU8AIGQE2pUa7dNWfmMeG9cDVF2eehiRMv0LC1iAg==",
+      "dev": true,
       "requires": {
         "env-paths": "^2.2.0",
-        "glob": "^7.1.4",
-        "graceful-fs": "^4.2.3",
-        "nopt": "^5.0.0",
-        "npmlog": "^4.1.2",
-        "request": "^2.88.2",
-        "rimraf": "^3.0.2",
-        "semver": "^7.3.2",
-        "tar": "^6.0.2",
-        "which": "^2.0.2"
+        "exponential-backoff": "^3.1.1",
+        "glob": "^10.3.10",
+        "graceful-fs": "^4.2.6",
+        "make-fetch-happen": "^13.0.0",
+        "nopt": "^7.0.0",
+        "proc-log": "^3.0.0",
+        "semver": "^7.3.5",
+        "tar": "^6.1.2",
+        "which": "^4.0.0"
+      },
+      "dependencies": {
+        "@npmcli/fs": {
+          "version": "3.1.1",
+          "resolved": "https://registry.npmjs.org/@npmcli/fs/-/fs-3.1.1.tgz",
+          "integrity": "sha512-q9CRWjpHCMIh5sVyefoD1cA7PkvILqCZsnSOEUUivORLjxCO/Irmue2DprETiNgEqktDBZaM1Bi+jrarx1XdCg==",
+          "dev": true,
+          "requires": {
+            "semver": "^7.3.5"
+          }
+        },
+        "abbrev": {
+          "version": "2.0.0",
+          "resolved": "https://registry.npmjs.org/abbrev/-/abbrev-2.0.0.tgz",
+          "integrity": "sha512-6/mh1E2u2YgEsCHdY0Yx5oW+61gZU+1vXaoiHHrpKeuRNNgFvS+/jrwHiQhB5apAf5oB7UB7E19ol2R2LKH8hQ==",
+          "dev": true
+        },
+        "brace-expansion": {
+          "version": "2.1.1",
+          "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz",
+          "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==",
+          "dev": true,
+          "requires": {
+            "balanced-match": "^1.0.0"
+          }
+        },
+        "cacache": {
+          "version": "18.0.4",
+          "resolved": "https://registry.npmjs.org/cacache/-/cacache-18.0.4.tgz",
+          "integrity": "sha512-B+L5iIa9mgcjLbliir2th36yEwPftrzteHYujzsx3dFP/31GCHcIeS8f5MGd80odLOjaOvSpU3EEAmRQptkxLQ==",
+          "dev": true,
+          "requires": {
+            "@npmcli/fs": "^3.1.0",
+            "fs-minipass": "^3.0.0",
+            "glob": "^10.2.2",
+            "lru-cache": "^10.0.1",
+            "minipass": "^7.0.3",
+            "minipass-collect": "^2.0.1",
+            "minipass-flush": "^1.0.5",
+            "minipass-pipeline": "^1.2.4",
+            "p-map": "^4.0.0",
+            "ssri": "^10.0.0",
+            "tar": "^6.1.11",
+            "unique-filename": "^3.0.0"
+          }
+        },
+        "fs-minipass": {
+          "version": "3.0.3",
+          "resolved": "https://registry.npmjs.org/fs-minipass/-/fs-minipass-3.0.3.tgz",
+          "integrity": "sha512-XUBA9XClHbnJWSfBzjkm6RvPsyg3sryZt06BEQoXcF7EK/xpGaQYJgQKDJSUH5SGZ76Y7pFx1QBnXz09rU5Fbw==",
+          "dev": true,
+          "requires": {
+            "minipass": "^7.0.3"
+          }
+        },
+        "glob": {
+          "version": "10.5.0",
+          "resolved": "https://registry.npmjs.org/glob/-/glob-10.5.0.tgz",
+          "integrity": "sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg==",
+          "dev": true,
+          "requires": {
+            "foreground-child": "^3.1.0",
+            "jackspeak": "^3.1.2",
+            "minimatch": "^9.0.4",
+            "minipass": "^7.1.2",
+            "package-json-from-dist": "^1.0.0",
+            "path-scurry": "^1.11.1"
+          }
+        },
+        "isexe": {
+          "version": "3.1.5",
+          "resolved": "https://registry.npmjs.org/isexe/-/isexe-3.1.5.tgz",
+          "integrity": "sha512-6B3tLtFqtQS4ekarvLVMZ+X+VlvQekbe4taUkf/rhVO3d/h0M2rfARm/pXLcPEsjjMsFgrFgSrhQIxcSVrBz8w==",
+          "dev": true
+        },
+        "lru-cache": {
+          "version": "10.4.3",
+          "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+          "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+          "dev": true
+        },
+        "make-fetch-happen": {
+          "version": "13.0.1",
+          "resolved": "https://registry.npmjs.org/make-fetch-happen/-/make-fetch-happen-13.0.1.tgz",
+          "integrity": "sha512-cKTUFc/rbKUd/9meOvgrpJ2WrNzymt6jfRDdwg5UCnVzv9dTpEj9JS5m3wtziXVCjluIXyL8pcaukYqezIzZQA==",
+          "dev": true,
+          "requires": {
+            "@npmcli/agent": "^2.0.0",
+            "cacache": "^18.0.0",
+            "http-cache-semantics": "^4.1.1",
+            "is-lambda": "^1.0.1",
+            "minipass": "^7.0.2",
+            "minipass-fetch": "^3.0.0",
+            "minipass-flush": "^1.0.5",
+            "minipass-pipeline": "^1.2.4",
+            "negotiator": "^0.6.3",
+            "proc-log": "^4.2.0",
+            "promise-retry": "^2.0.1",
+            "ssri": "^10.0.0"
+          },
+          "dependencies": {
+            "proc-log": {
+              "version": "4.2.0",
+              "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-4.2.0.tgz",
+              "integrity": "sha512-g8+OnU/L2v+wyiVK+D5fA34J7EH8jZ8DDlvwhRCMxmMj7UCBvxiO1mGeN+36JXIKF4zevU4kRBd8lVgG9vLelA==",
+              "dev": true
+            }
+          }
+        },
+        "minimatch": {
+          "version": "9.0.9",
+          "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+          "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
+          "dev": true,
+          "requires": {
+            "brace-expansion": "^2.0.2"
+          }
+        },
+        "minipass": {
+          "version": "7.1.3",
+          "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+          "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+          "dev": true
+        },
+        "minipass-collect": {
+          "version": "2.0.1",
+          "resolved": "https://registry.npmjs.org/minipass-collect/-/minipass-collect-2.0.1.tgz",
+          "integrity": "sha512-D7V8PO9oaz7PWGLbCACuI1qEOsq7UKfLotx/C0Aet43fCUB/wfQ7DYeq2oR/svFJGYDHPr38SHATeaj/ZoKHKw==",
+          "dev": true,
+          "requires": {
+            "minipass": "^7.0.3"
+          }
+        },
+        "minipass-fetch": {
+          "version": "3.0.5",
+          "resolved": "https://registry.npmjs.org/minipass-fetch/-/minipass-fetch-3.0.5.tgz",
+          "integrity": "sha512-2N8elDQAtSnFV0Dk7gt15KHsS0Fyz6CbYZ360h0WTYV1Ty46li3rAXVOQj1THMNLdmrD9Vt5pBPtWtVkpwGBqg==",
+          "dev": true,
+          "requires": {
+            "encoding": "^0.1.13",
+            "minipass": "^7.0.3",
+            "minipass-sized": "^1.0.3",
+            "minizlib": "^2.1.2"
+          }
+        },
+        "nopt": {
+          "version": "7.2.1",
+          "resolved": "https://registry.npmjs.org/nopt/-/nopt-7.2.1.tgz",
+          "integrity": "sha512-taM24ViiimT/XntxbPyJQzCG+p4EKOpgD3mxFwW38mGjVUrfERQOeY4EDHjdnptttfHuHQXFx+lTP08Q+mLa/w==",
+          "dev": true,
+          "requires": {
+            "abbrev": "^2.0.0"
+          }
+        },
+        "ssri": {
+          "version": "10.0.6",
+          "resolved": "https://registry.npmjs.org/ssri/-/ssri-10.0.6.tgz",
+          "integrity": "sha512-MGrFH9Z4NP9Iyhqn16sDtBpRRNJ0Y2hNa6D65h736fVSaPCHr4DM4sWUNvVaSuC+0OBGhwsrydQwmgfg5LncqQ==",
+          "dev": true,
+          "requires": {
+            "minipass": "^7.0.3"
+          }
+        },
+        "unique-filename": {
+          "version": "3.0.0",
+          "resolved": "https://registry.npmjs.org/unique-filename/-/unique-filename-3.0.0.tgz",
+          "integrity": "sha512-afXhuC55wkAmZ0P18QsVE6kp8JaxrEokN2HGIoIVv2ijHQd419H0+6EigAFcIzXeMIkcIkNBpB3L/DXB3cTS/g==",
+          "dev": true,
+          "requires": {
+            "unique-slug": "^4.0.0"
+          }
+        },
+        "unique-slug": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/unique-slug/-/unique-slug-4.0.0.tgz",
+          "integrity": "sha512-WrcA6AyEfqDX5bWige/4NQfPZMtASNVxdmWR76WESYQVAACSgWcR6e9i0mofqqBxYFtL4oAxPIptY73/0YE1DQ==",
+          "dev": true,
+          "requires": {
+            "imurmurhash": "^0.1.4"
+          }
+        },
+        "which": {
+          "version": "4.0.0",
+          "resolved": "https://registry.npmjs.org/which/-/which-4.0.0.tgz",
+          "integrity": "sha512-GlaYyEb07DPxYCKhKzplCWBJtvxZcZMrL+4UkrTSJHHPyZU4mYYTv3qaOe77H7EODLSSopAUFAc6W8U4yqvscg==",
+          "dev": true,
+          "requires": {
+            "isexe": "^3.1.1"
+          }
+        }
       }
     },
     "node-int64": {
@@ -16384,6 +17037,7 @@
       "version": "2.2.1",
       "resolved": "https://registry.npmjs.org/node-libs-browser/-/node-libs-browser-2.2.1.tgz",
       "integrity": "sha512-h/zcD8H9kaDZ9ALUWwlBUDo6TKF8a7qBSCSEGfjTVIYeqsioSKaAX+BN7NgiMGp6iSIXZ3PxgCu8KS3b71YK5Q==",
+      "dev": true,
       "requires": {
         "assert": "^1.1.1",
         "browserify-zlib": "^0.2.0",
@@ -16414,6 +17068,7 @@
           "version": "4.9.2",
           "resolved": "https://registry.npmjs.org/buffer/-/buffer-4.9.2.tgz",
           "integrity": "sha512-xq+q3SRMOxGivLhBNaUdC64hDTQwejJ+H0T/NB1XMtTVEwNTrfFF3gAxiyW0Bu/xWEGhjVKgUcMhCrUy2+uCWg==",
+          "dev": true,
           "requires": {
             "base64-js": "^1.0.2",
             "ieee754": "^1.1.4",
@@ -16423,7 +17078,8 @@
         "punycode": {
           "version": "1.4.1",
           "resolved": "https://registry.npmjs.org/punycode/-/punycode-1.4.1.tgz",
-          "integrity": "sha512-jmYNElW7yvO7TV33CjSmvSiE2yco3bV2czu/OzDKdMNVZQWfxCblURLhf+47syQRBntjfLdd/H0egrzIG+oaFQ=="
+          "integrity": "sha512-jmYNElW7yvO7TV33CjSmvSiE2yco3bV2czu/OzDKdMNVZQWfxCblURLhf+47syQRBntjfLdd/H0egrzIG+oaFQ==",
+          "dev": true
         }
       }
     },
@@ -16694,6 +17350,7 @@
       "version": "0.1.0",
       "resolved": "https://registry.npmjs.org/object-copy/-/object-copy-0.1.0.tgz",
       "integrity": "sha512-79LYn6VAb63zgtmAteVOWo9Vdj71ZVBy3Pbse+VqxDpEP83XuujMrGqHIwAXJ5I/aM0zU7dIyIAhifVTPrNItQ==",
+      "dev": true,
       "requires": {
         "copy-descriptor": "^0.1.0",
         "define-property": "^0.2.5",
@@ -16704,6 +17361,7 @@
           "version": "0.2.5",
           "resolved": "https://registry.npmjs.org/define-property/-/define-property-0.2.5.tgz",
           "integrity": "sha512-Rr7ADjQZenceVOAKop6ALkkRAmH1A4Gx9hV/7ZujPUN2rkATqFO0JZLZInbAjpZYoJ1gUx8MRMQVkYemcbMSTA==",
+          "dev": true,
           "requires": {
             "is-descriptor": "^0.1.0"
           }
@@ -16712,6 +17370,7 @@
           "version": "3.2.2",
           "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
           "integrity": "sha512-NOW9QQXMoZGg/oqnVNoNTTIFEIid1627WCffUBJEdMxYApq7mNE7CpzucIPc+ZQg25Phej7IJSmX3hO+oblOtQ==",
+          "dev": true,
           "requires": {
             "is-buffer": "^1.1.5"
           }
@@ -16756,6 +17415,7 @@
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/object-visit/-/object-visit-1.0.1.tgz",
       "integrity": "sha512-GBaMwwAVK9qbQN3Scdo0OyvgPW7l3lnaVMj84uTOZlswkX0KpF6fyDBJhtTthf7pymztoN36/KEr1DyhF96zEA==",
+      "dev": true,
       "requires": {
         "isobject": "^3.0.0"
       }
@@ -16788,6 +17448,7 @@
       "version": "1.3.0",
       "resolved": "https://registry.npmjs.org/object.pick/-/object.pick-1.3.0.tgz",
       "integrity": "sha512-tqa/UMy/CCoYmj+H5qc07qvSL9dqcs/WZENZ1JbtWBlATP+iVOe778gE6MSijnyCnORzDuX6hU+LA4SZ09YjFQ==",
+      "dev": true,
       "requires": {
         "isobject": "^3.0.1"
       }
@@ -16963,7 +17624,8 @@
     "os-browserify": {
       "version": "0.3.0",
       "resolved": "https://registry.npmjs.org/os-browserify/-/os-browserify-0.3.0.tgz",
-      "integrity": "sha512-gjcpUc3clBf9+210TRaDWbf+rZZZEshZ+DlXMRCeAjp0xhTrnQsKHypIy1J3d5hKdUzj69t708EHtU8P6bUn0A=="
+      "integrity": "sha512-gjcpUc3clBf9+210TRaDWbf+rZZZEshZ+DlXMRCeAjp0xhTrnQsKHypIy1J3d5hKdUzj69t708EHtU8P6bUn0A==",
+      "dev": true
     },
     "os-tmpdir": {
       "version": "1.0.2",
@@ -17077,6 +17739,12 @@
         }
       }
     },
+    "package-json-from-dist": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
+      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
+      "dev": true
+    },
     "pacote": {
       "version": "11.3.5",
       "resolved": "https://registry.npmjs.org/pacote/-/pacote-11.3.5.tgz",
@@ -17106,12 +17774,14 @@
     "pako": {
       "version": "1.0.11",
       "resolved": "https://registry.npmjs.org/pako/-/pako-1.0.11.tgz",
-      "integrity": "sha512-4hLB8Py4zZce5s4yd9XzopqwVv/yGNhV1Bl8NTmCq1763HeK2+EwVTv+leGeL13Dnh2wfbqowVPXCIO0z4taYw=="
+      "integrity": "sha512-4hLB8Py4zZce5s4yd9XzopqwVv/yGNhV1Bl8NTmCq1763HeK2+EwVTv+leGeL13Dnh2wfbqowVPXCIO0z4taYw==",
+      "dev": true
     },
     "parallel-transform": {
       "version": "1.2.0",
       "resolved": "https://registry.npmjs.org/parallel-transform/-/parallel-transform-1.2.0.tgz",
       "integrity": "sha512-P2vSmIu38uIlvdcU7fDkyrxj33gTUy/ABO5ZUbGowxNCopBq/OoD42bP4UmMrJoPyk4Uqf0mu3mtWBhHCZD8yg==",
+      "dev": true,
       "requires": {
         "cyclist": "^1.0.1",
         "inherits": "^2.0.3",
@@ -17209,12 +17879,14 @@
     "pascalcase": {
       "version": "0.1.1",
       "resolved": "https://registry.npmjs.org/pascalcase/-/pascalcase-0.1.1.tgz",
-      "integrity": "sha512-XHXfu/yOQRy9vYOtUDVMN60OEJjW013GoObG1o+xwQTpB9eYJX/BjXMsdW13ZDPruFhYYn0AG22w0xgQMwl3Nw=="
+      "integrity": "sha512-XHXfu/yOQRy9vYOtUDVMN60OEJjW013GoObG1o+xwQTpB9eYJX/BjXMsdW13ZDPruFhYYn0AG22w0xgQMwl3Nw==",
+      "dev": true
     },
     "path-browserify": {
       "version": "0.0.1",
       "resolved": "https://registry.npmjs.org/path-browserify/-/path-browserify-0.0.1.tgz",
-      "integrity": "sha512-BapA40NHICOS+USX9SN4tyhq+A2RrN/Ws5F0Z5aMHDp98Fl86lX8Oti8B7uN93L4Ifv4fHOEA+pQw87gmMO/lQ=="
+      "integrity": "sha512-BapA40NHICOS+USX9SN4tyhq+A2RrN/Ws5F0Z5aMHDp98Fl86lX8Oti8B7uN93L4Ifv4fHOEA+pQw87gmMO/lQ==",
+      "dev": true
     },
     "path-dirname": {
       "version": "1.0.2",
@@ -17249,6 +17921,30 @@
       "resolved": "https://registry.npmjs.org/path-parse/-/path-parse-1.0.7.tgz",
       "integrity": "sha512-LDJzPVEEEPR+y48z93A0Ed0yXb8pAByGWo/k5YYdYgpY2/2EsOsksJrq7lOHxryrVOn1ejG6oAp8ahvOIQD8sw=="
     },
+    "path-scurry": {
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-1.11.1.tgz",
+      "integrity": "sha512-Xa4Nw17FS9ApQFJ9umLiJS4orGjm7ZzwUrwamcGQuHSzDyth9boKDaycYdDcZDuqYATXw4HFXgaqWTctW/v1HA==",
+      "dev": true,
+      "requires": {
+        "lru-cache": "^10.2.0",
+        "minipass": "^5.0.0 || ^6.0.2 || ^7.0.0"
+      },
+      "dependencies": {
+        "lru-cache": {
+          "version": "10.4.3",
+          "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-10.4.3.tgz",
+          "integrity": "sha512-JNAzZcXrCt42VGLuYz0zfAzDfAvJWW6AfYlDBQyDV5DClI2m5sAmK+OIO7s59XfsRsWHp02jAJrRadPRGTt6SQ==",
+          "dev": true
+        },
+        "minipass": {
+          "version": "7.1.3",
+          "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+          "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+          "dev": true
+        }
+      }
+    },
     "path-to-regexp": {
       "version": "0.1.7",
       "resolved": "https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.7.tgz",
@@ -17397,6 +18093,7 @@
       "version": "3.0.0",
       "resolved": "https://registry.npmjs.org/pkg-dir/-/pkg-dir-3.0.0.tgz",
       "integrity": "sha512-/E57AYkoeQ25qkxMj5PBOVgF8Kiu/h7cYS30Z5+R7WaiCCBfLq58ZI/dSeaEKb9WVJV5n/03QwrN3IeWIFllvw==",
+      "dev": true,
       "requires": {
         "find-up": "^3.0.0"
       },
@@ -17405,6 +18102,7 @@
           "version": "3.0.0",
           "resolved": "https://registry.npmjs.org/find-up/-/find-up-3.0.0.tgz",
           "integrity": "sha512-1yD6RmLI1XBfxugvORwlck6f75tYL+iR0jqwsOrOxMZyGYqUuDhJ0l4AXdO1iX/FTs9cBAMEk1gWSEx1kSbylg==",
+          "dev": true,
           "requires": {
             "locate-path": "^3.0.0"
           }
@@ -17413,6 +18111,7 @@
           "version": "3.0.0",
           "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-3.0.0.tgz",
           "integrity": "sha512-7AO748wWnIhNqAuaty2ZWHkQHRSNfPVIsPIfwEOWO22AmaoVrWavlOcMR5nzTLNYvp36X220/maaRsrec1G65A==",
+          "dev": true,
           "requires": {
             "p-locate": "^3.0.0",
             "path-exists": "^3.0.0"
@@ -17422,6 +18121,7 @@
           "version": "3.0.0",
           "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-3.0.0.tgz",
           "integrity": "sha512-x+12w/To+4GFfgJhBEpiDcLozRJGegY+Ei7/z0tSLkMmxGZNybVMSfWj9aJn8Z5Fc7dBUNJOOVgPv2H7IwulSQ==",
+          "dev": true,
           "requires": {
             "p-limit": "^2.0.0"
           }
@@ -17429,7 +18129,8 @@
         "path-exists": {
           "version": "3.0.0",
           "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-3.0.0.tgz",
-          "integrity": "sha512-bpC7GYwiDYQ4wYLe+FA8lhRjhQCMcQGuSgGGqDkg/QerRWw9CmGRT0iSOVRSZJ29NMLZgIzqaljJ63oaL4NIJQ=="
+          "integrity": "sha512-bpC7GYwiDYQ4wYLe+FA8lhRjhQCMcQGuSgGGqDkg/QerRWw9CmGRT0iSOVRSZJ29NMLZgIzqaljJ63oaL4NIJQ==",
+          "dev": true
         }
       }
     },
@@ -17482,7 +18183,8 @@
     "posix-character-classes": {
       "version": "0.1.1",
       "resolved": "https://registry.npmjs.org/posix-character-classes/-/posix-character-classes-0.1.1.tgz",
-      "integrity": "sha512-xTgYBc3fuo7Yt7JbiuFxSYGToMoz8fLoE6TC9Wx1P/u+LfeThMOAqmuyECnlBaaJb+u1m9hHiXUEtwW4OzfUJg=="
+      "integrity": "sha512-xTgYBc3fuo7Yt7JbiuFxSYGToMoz8fLoE6TC9Wx1P/u+LfeThMOAqmuyECnlBaaJb+u1m9hHiXUEtwW4OzfUJg==",
+      "dev": true
     },
     "postcss": {
       "version": "7.0.39",
@@ -18096,7 +18798,6 @@
       "version": "2.7.1",
       "resolved": "https://registry.npmjs.org/prettier/-/prettier-2.7.1.tgz",
       "integrity": "sha512-ujppO+MkdPqoVINuDFDRLClm7D78qbDt0/NR+wp5FqEZOoTNAjPHWj17QRhu7geIHJfcNhRk1XVQmF8Bp3ye+g==",
-      "dev": true,
       "optional": true
     },
     "pretty": {
@@ -18175,6 +18876,11 @@
         }
       }
     },
+    "prism-es6": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/prism-es6/-/prism-es6-1.2.0.tgz",
+      "integrity": "sha512-A8JV9G2zKM8PWksT7YJcmnaWtYO6C9hSfxM/xv0RxB2aNc8rjv30WakzIw1gWyqLi2eiqquo2KmS7orxqlm+yg=="
+    },
     "prismjs": {
       "version": "1.28.0",
       "resolved": "https://registry.npmjs.org/prismjs/-/prismjs-1.28.0.tgz",
@@ -18187,10 +18893,17 @@
       "integrity": "sha512-VvivMrbvd2nKkiG38qjULzlc+4Vx4wm/whI9pQD35YrARNnhxeiRktSOhSukRLFNlzg6Br/cJPet5J/u19r/mg==",
       "dev": true
     },
+    "proc-log": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/proc-log/-/proc-log-3.0.0.tgz",
+      "integrity": "sha512-++Vn7NS4Xf9NacaU9Xq3URUuqZETPsf8L4j5/ckhaRYsfPeRyzGw+iDjFhV/Jr3uNmTvvddEJFWh5R1gRgUH8A==",
+      "dev": true
+    },
     "process": {
       "version": "0.11.10",
       "resolved": "https://registry.npmjs.org/process/-/process-0.11.10.tgz",
-      "integrity": "sha512-cdGef/drWFoydD1JsMzuFf8100nZl+GT+yacc2bEced5f9Rjk4z+WtFUTBu9PhOi9j/jfmBPu0mMEY4wIdAF8A=="
+      "integrity": "sha512-cdGef/drWFoydD1JsMzuFf8100nZl+GT+yacc2bEced5f9Rjk4z+WtFUTBu9PhOi9j/jfmBPu0mMEY4wIdAF8A==",
+      "dev": true
     },
     "process-exists": {
       "version": "3.1.0",
@@ -18253,7 +18966,8 @@
     "prr": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/prr/-/prr-1.0.1.tgz",
-      "integrity": "sha512-yPw4Sng1gWghHQWj0B3ZggWUm4qVbPwPFcRG8KyxiU7J2OHFSoEHKS+EZ3fv5l1t9CyCiop6l/ZYeWbrgoQejw=="
+      "integrity": "sha512-yPw4Sng1gWghHQWj0B3ZggWUm4qVbPwPFcRG8KyxiU7J2OHFSoEHKS+EZ3fv5l1t9CyCiop6l/ZYeWbrgoQejw==",
+      "dev": true
     },
     "ps-list": {
       "version": "4.1.0",
@@ -18309,6 +19023,7 @@
       "version": "1.5.1",
       "resolved": "https://registry.npmjs.org/pumpify/-/pumpify-1.5.1.tgz",
       "integrity": "sha512-oClZI37HvuUJJxSKKrC17bZ9Cu0ZYhEAGPsPUy9KlMUmv9dKX2o77RUmq7f3XjIxbwyGwYzbzQ1L2Ks8sIradQ==",
+      "dev": true,
       "requires": {
         "duplexify": "^3.6.0",
         "inherits": "^2.0.3",
@@ -18319,6 +19034,7 @@
           "version": "2.0.1",
           "resolved": "https://registry.npmjs.org/pump/-/pump-2.0.1.tgz",
           "integrity": "sha512-ruPMNRkN3MHP1cWJc9OWr+T/xDP0jhXYCLfJcBuX54hhfIBnaQmAUMfDcG4DM5UMWByBbJY69QSphm3jtDKIkA==",
+          "dev": true,
           "requires": {
             "end-of-stream": "^1.1.0",
             "once": "^1.3.1"
@@ -18369,12 +19085,14 @@
     "querystring": {
       "version": "0.2.0",
       "resolved": "https://registry.npmjs.org/querystring/-/querystring-0.2.0.tgz",
-      "integrity": "sha512-X/xY82scca2tau62i9mDyU9K+I+djTMUsvwf7xnUX5GLvVzgJybOJf4Y6o9Zx3oJK/LSXg5tTZBjwzqVPaPO2g=="
+      "integrity": "sha512-X/xY82scca2tau62i9mDyU9K+I+djTMUsvwf7xnUX5GLvVzgJybOJf4Y6o9Zx3oJK/LSXg5tTZBjwzqVPaPO2g==",
+      "dev": true
     },
     "querystring-es3": {
       "version": "0.2.1",
       "resolved": "https://registry.npmjs.org/querystring-es3/-/querystring-es3-0.2.1.tgz",
-      "integrity": "sha512-773xhDQnZBMFobEiztv8LIl70ch5MSF/jUQVlhwFyBILqq96anmoctVIYz+ZRp0qbCKATTn6ev02M3r7Ga5vqA=="
+      "integrity": "sha512-773xhDQnZBMFobEiztv8LIl70ch5MSF/jUQVlhwFyBILqq96anmoctVIYz+ZRp0qbCKATTn6ev02M3r7Ga5vqA==",
+      "dev": true
     },
     "querystringify": {
       "version": "2.2.0",
@@ -18896,25 +19614,6 @@
         "rc-util": "^5.36.0"
       }
     },
-    "react": {
-      "version": "18.2.0",
-      "resolved": "https://registry.npmjs.org/react/-/react-18.2.0.tgz",
-      "integrity": "sha512-/3IjMdb2L9QbBdWiW5e3P2/npwMBaU9mHCSCUzNln0ZCYbcfTsGbTJrU/kGemdH2IWmB2ioZ+zkxtmq6g09fGQ==",
-      "peer": true,
-      "requires": {
-        "loose-envify": "^1.1.0"
-      }
-    },
-    "react-dom": {
-      "version": "18.2.0",
-      "resolved": "https://registry.npmjs.org/react-dom/-/react-dom-18.2.0.tgz",
-      "integrity": "sha512-6IMTriUmvsjHUjNtEDudZfuDQUoWXVxKHhlEGSk81n4YFS+r/Kl99wXiwlVXtPBtJenozv2P+hxDsw9eA7Xo6g==",
-      "peer": true,
-      "requires": {
-        "loose-envify": "^1.1.0",
-        "scheduler": "^0.23.0"
-      }
-    },
     "react-is": {
       "version": "16.13.1",
       "resolved": "https://registry.npmjs.org/react-is/-/react-is-16.13.1.tgz",
@@ -19084,6 +19783,7 @@
       "version": "1.0.2",
       "resolved": "https://registry.npmjs.org/regex-not/-/regex-not-1.0.2.tgz",
       "integrity": "sha512-J6SDjUgDxQj5NusnOtdFxDwN/+HWykR8GELwctJ7mdqhcyy1xEc4SRFHUXvxTp661YaVKAjfRLZ9cCqS6tn32A==",
+      "dev": true,
       "requires": {
         "extend-shallow": "^3.0.2",
         "safe-regex": "^1.1.0"
@@ -19245,12 +19945,14 @@
     "repeat-element": {
       "version": "1.1.4",
       "resolved": "https://registry.npmjs.org/repeat-element/-/repeat-element-1.1.4.tgz",
-      "integrity": "sha512-LFiNfRcSu7KK3evMyYOuCzv3L10TW7yC1G2/+StMjK8Y6Vqd2MG7r/Qjw4ghtuCOjFvlnms/iMmLqpvW/ES/WQ=="
+      "integrity": "sha512-LFiNfRcSu7KK3evMyYOuCzv3L10TW7yC1G2/+StMjK8Y6Vqd2MG7r/Qjw4ghtuCOjFvlnms/iMmLqpvW/ES/WQ==",
+      "dev": true
     },
     "repeat-string": {
       "version": "1.6.1",
       "resolved": "https://registry.npmjs.org/repeat-string/-/repeat-string-1.6.1.tgz",
-      "integrity": "sha512-PV0dzCYDNfRi1jCDbJzpW7jNNDRuCOG/jI5ctQcGKt/clZD+YcPS3yIlWuTJMmESC8aevCFmWJy5wjAFgNqN6w=="
+      "integrity": "sha512-PV0dzCYDNfRi1jCDbJzpW7jNNDRuCOG/jI5ctQcGKt/clZD+YcPS3yIlWuTJMmESC8aevCFmWJy5wjAFgNqN6w==",
+      "dev": true
     },
     "request": {
       "version": "2.88.2",
@@ -19363,7 +20065,8 @@
     "resolve-url": {
       "version": "0.2.1",
       "resolved": "https://registry.npmjs.org/resolve-url/-/resolve-url-0.2.1.tgz",
-      "integrity": "sha512-ZuF55hVUQaaczgOIwqWzkEcEidmlD/xl44x1UZnhOXcYuFN2S6+rcxpG+C1N3So0wvNI3DmJICUFfu2SxhBmvg=="
+      "integrity": "sha512-ZuF55hVUQaaczgOIwqWzkEcEidmlD/xl44x1UZnhOXcYuFN2S6+rcxpG+C1N3So0wvNI3DmJICUFfu2SxhBmvg==",
+      "dev": true
     },
     "responselike": {
       "version": "1.0.2",
@@ -19386,7 +20089,8 @@
     "ret": {
       "version": "0.1.15",
       "resolved": "https://registry.npmjs.org/ret/-/ret-0.1.15.tgz",
-      "integrity": "sha512-TTlYpa+OL+vMMNG24xSlQGEJ3B/RzEfUlLct7b5G/ytav+wPrplCpVMFuwzXbkecJrb6IYo1iFb0S9v37754mg=="
+      "integrity": "sha512-TTlYpa+OL+vMMNG24xSlQGEJ3B/RzEfUlLct7b5G/ytav+wPrplCpVMFuwzXbkecJrb6IYo1iFb0S9v37754mg==",
+      "dev": true
     },
     "retry": {
       "version": "0.12.0",
@@ -19463,6 +20167,7 @@
       "version": "1.0.3",
       "resolved": "https://registry.npmjs.org/run-queue/-/run-queue-1.0.3.tgz",
       "integrity": "sha512-ntymy489o0/QQplUDnpYAYUsO50K9SBrIVaKCWDOJzYJts0f9WH9RFJkyagebkw5+y1oi00R7ynNW/d12GBumg==",
+      "dev": true,
       "requires": {
         "aproba": "^1.1.1"
       }
@@ -19485,6 +20190,7 @@
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/safe-regex/-/safe-regex-1.1.0.tgz",
       "integrity": "sha512-aJXcif4xnaNUzvUuC5gcb46oTS7zvg4jpMTnuqtrEPlR3vFr4pxtdTwaF1Qs3Enjn9HK+ZlwQui+a7z0SywIzg==",
+      "dev": true,
       "requires": {
         "ret": "~0.1.10"
       }
@@ -19614,15 +20320,6 @@
         "xmlchars": "^2.1.1"
       }
     },
-    "scheduler": {
-      "version": "0.23.0",
-      "resolved": "https://registry.npmjs.org/scheduler/-/scheduler-0.23.0.tgz",
-      "integrity": "sha512-CtuThmgHNg7zIZWAXi3AsyIzA3n4xx7aNyjwC2VJldO2LMVDhFK+63xGqq6CsJH4rTAt6/M+N4GhZiDYPx9eUw==",
-      "peer": true,
-      "requires": {
-        "loose-envify": "^1.1.0"
-      }
-    },
     "schema-utils": {
       "version": "2.7.1",
       "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-2.7.1.tgz",
@@ -19686,12 +20383,9 @@
       }
     },
     "semver": {
-      "version": "7.3.7",
-      "resolved": "https://registry.npmjs.org/semver/-/semver-7.3.7.tgz",
-      "integrity": "sha512-QlYTucUYOews+WeEujDoEGziz4K6c47V/Bd+LjSSYcA94p+DmINdf7ncaUinThfvZyu13lN9OY1XDxt8C0Tw0g==",
-      "requires": {
-        "lru-cache": "^6.0.0"
-      }
+      "version": "7.8.4",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-7.8.4.tgz",
+      "integrity": "sha512-rUCObTnP32Q08R2uuIrt7r9PlEonuTmtuXYcW6s5kjdlj3xbnwe+21yXptAUYcMAABLkYYTtnmzb3w3EDZfueA=="
     },
     "semver-diff": {
       "version": "3.1.1",
@@ -19788,6 +20482,7 @@
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-4.0.0.tgz",
       "integrity": "sha512-GaNA54380uFefWghODBWEGisLZFj00nS5ACs6yHa9nLqlLpVLO8ChDGeKRjZnV4Nh4n0Qi7nhYZD/9fCPzEqkw==",
+      "dev": true,
       "requires": {
         "randombytes": "^2.1.0"
       }
@@ -19869,6 +20564,7 @@
       "version": "2.0.1",
       "resolved": "https://registry.npmjs.org/set-value/-/set-value-2.0.1.tgz",
       "integrity": "sha512-JxHc1weCN68wRY0fhCoXpyK55m/XPHafOmK4UWD7m2CI14GMcFypt4w/0+NV5f/ZMby2F6S2wwA7fgynh9gWSw==",
+      "dev": true,
       "requires": {
         "extend-shallow": "^2.0.1",
         "is-extendable": "^0.1.1",
@@ -19880,6 +20576,7 @@
           "version": "2.0.1",
           "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
           "integrity": "sha512-zCnTtlxNoAiDc3gqY2aYAWFx7XWWiasuF2K8Me5WbN8otHKTUKBwjPtNpRs/rbUZm7KxWAaNj7P1a/p52GbVug==",
+          "dev": true,
           "requires": {
             "is-extendable": "^0.1.0"
           }
@@ -19888,6 +20585,7 @@
           "version": "2.0.4",
           "resolved": "https://registry.npmjs.org/is-plain-object/-/is-plain-object-2.0.4.tgz",
           "integrity": "sha512-h5PpgXkWitc38BBMYawTYMWJHFZJVnBquFE57xFpjB8pJFiF6gZ+bU+WyI/yqXiFR5mdLsgYNaPe8uao6Uv9Og==",
+          "dev": true,
           "requires": {
             "isobject": "^3.0.1"
           }
@@ -19897,7 +20595,8 @@
     "setimmediate": {
       "version": "1.0.5",
       "resolved": "https://registry.npmjs.org/setimmediate/-/setimmediate-1.0.5.tgz",
-      "integrity": "sha512-MATJdZp8sLqDl/68LfQmbP8zKPLQNV6BIZoIgrscFDQ+RsvK/BxeDQOgyxKKoh0y/8h3BqVFnCqQ/gd+reiIXA=="
+      "integrity": "sha512-MATJdZp8sLqDl/68LfQmbP8zKPLQNV6BIZoIgrscFDQ+RsvK/BxeDQOgyxKKoh0y/8h3BqVFnCqQ/gd+reiIXA==",
+      "dev": true
     },
     "setprototypeof": {
       "version": "1.2.0",
@@ -20079,6 +20778,7 @@
       "version": "0.8.2",
       "resolved": "https://registry.npmjs.org/snapdragon/-/snapdragon-0.8.2.tgz",
       "integrity": "sha512-FtyOnWN/wCHTVXOMwvSv26d+ko5vWlIDD6zoUJ7LW8vh+ZBC8QdljveRP+crNrtBwioEUWy/4dMtbBjA4ioNlg==",
+      "dev": true,
       "requires": {
         "base": "^0.11.1",
         "debug": "^2.2.0",
@@ -20094,6 +20794,7 @@
           "version": "2.6.9",
           "resolved": "https://registry.npmjs.org/debug/-/debug-2.6.9.tgz",
           "integrity": "sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==",
+          "dev": true,
           "requires": {
             "ms": "2.0.0"
           }
@@ -20102,6 +20803,7 @@
           "version": "0.2.5",
           "resolved": "https://registry.npmjs.org/define-property/-/define-property-0.2.5.tgz",
           "integrity": "sha512-Rr7ADjQZenceVOAKop6ALkkRAmH1A4Gx9hV/7ZujPUN2rkATqFO0JZLZInbAjpZYoJ1gUx8MRMQVkYemcbMSTA==",
+          "dev": true,
           "requires": {
             "is-descriptor": "^0.1.0"
           }
@@ -20110,6 +20812,7 @@
           "version": "2.0.1",
           "resolved": "https://registry.npmjs.org/extend-shallow/-/extend-shallow-2.0.1.tgz",
           "integrity": "sha512-zCnTtlxNoAiDc3gqY2aYAWFx7XWWiasuF2K8Me5WbN8otHKTUKBwjPtNpRs/rbUZm7KxWAaNj7P1a/p52GbVug==",
+          "dev": true,
           "requires": {
             "is-extendable": "^0.1.0"
           }
@@ -20117,12 +20820,14 @@
         "ms": {
           "version": "2.0.0",
           "resolved": "https://registry.npmjs.org/ms/-/ms-2.0.0.tgz",
-          "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A=="
+          "integrity": "sha512-Tpp60P6IUJDTuOq/5Z8cdskzJujfwqfOTkrwIwj7IRISpnkJnT6SyJ4PCPnGMoFjC9ddhal5KVIYtAt97ix05A==",
+          "dev": true
         },
         "source-map": {
           "version": "0.5.7",
           "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.5.7.tgz",
-          "integrity": "sha512-LbrmJOMUSdEVxIKvdcJzQC+nQhe8FUZQTXQy6+I75skNgn3OoQ0DZA8YnFa7gp8tqtL3KPf1kmo0R5DoApeSGQ=="
+          "integrity": "sha512-LbrmJOMUSdEVxIKvdcJzQC+nQhe8FUZQTXQy6+I75skNgn3OoQ0DZA8YnFa7gp8tqtL3KPf1kmo0R5DoApeSGQ==",
+          "dev": true
         }
       }
     },
@@ -20130,6 +20835,7 @@
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/snapdragon-node/-/snapdragon-node-2.1.1.tgz",
       "integrity": "sha512-O27l4xaMYt/RSQ5TR3vpWCAB5Kb/czIcqUFOM/C4fYcLnbZUc1PkjTAMjof2pBWaSTwOUd6qUHcFGVGj7aIwnw==",
+      "dev": true,
       "requires": {
         "define-property": "^1.0.0",
         "isobject": "^3.0.0",
@@ -20140,6 +20846,7 @@
           "version": "1.0.0",
           "resolved": "https://registry.npmjs.org/define-property/-/define-property-1.0.0.tgz",
           "integrity": "sha512-cZTYKFWspt9jZsMscWo8sc/5lbPC9Q0N5nBLgb+Yd915iL3udB1uFgS3B8YCx66UVHq018DAVFoee7x+gxggeA==",
+          "dev": true,
           "requires": {
             "is-descriptor": "^1.0.0"
           }
@@ -20148,6 +20855,7 @@
           "version": "1.0.0",
           "resolved": "https://registry.npmjs.org/is-accessor-descriptor/-/is-accessor-descriptor-1.0.0.tgz",
           "integrity": "sha512-m5hnHTkcVsPfqx3AKlyttIPb7J+XykHvJP2B9bZDjlhLIoEq4XoK64Vg7boZlVWYK6LUY94dYPEE7Lh0ZkZKcQ==",
+          "dev": true,
           "requires": {
             "kind-of": "^6.0.0"
           }
@@ -20156,6 +20864,7 @@
           "version": "1.0.0",
           "resolved": "https://registry.npmjs.org/is-data-descriptor/-/is-data-descriptor-1.0.0.tgz",
           "integrity": "sha512-jbRXy1FmtAoCjQkVmIVYwuuqDFUbaOeDjmed1tOGPrsMhtJA4rD9tkgA0F1qJ3gRFRXcHYVkdeaP50Q5rE/jLQ==",
+          "dev": true,
           "requires": {
             "kind-of": "^6.0.0"
           }
@@ -20164,6 +20873,7 @@
           "version": "1.0.2",
           "resolved": "https://registry.npmjs.org/is-descriptor/-/is-descriptor-1.0.2.tgz",
           "integrity": "sha512-2eis5WqQGV7peooDyLmNEPUrps9+SXX5c9pL3xEB+4e9HnGuDa7mB7kHxHw4CbqS9k1T2hOH3miL8n8WtiYVtg==",
+          "dev": true,
           "requires": {
             "is-accessor-descriptor": "^1.0.0",
             "is-data-descriptor": "^1.0.0",
@@ -20176,6 +20886,7 @@
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/snapdragon-util/-/snapdragon-util-3.0.1.tgz",
       "integrity": "sha512-mbKkMdQKsjX4BAL4bRYTj21edOf8cN7XHdYUJEe+Zn99hVEYcMvKPct1IqNe7+AZPirn8BCDOQBHQZknqmKlZQ==",
+      "dev": true,
       "requires": {
         "kind-of": "^3.2.0"
       },
@@ -20184,6 +20895,7 @@
           "version": "3.2.2",
           "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
           "integrity": "sha512-NOW9QQXMoZGg/oqnVNoNTTIFEIid1627WCffUBJEdMxYApq7mNE7CpzucIPc+ZQg25Phej7IJSmX3hO+oblOtQ==",
+          "dev": true,
           "requires": {
             "is-buffer": "^1.1.5"
           }
@@ -20234,11 +20946,11 @@
       }
     },
     "socks": {
-      "version": "2.6.2",
-      "resolved": "https://registry.npmjs.org/socks/-/socks-2.6.2.tgz",
-      "integrity": "sha512-zDZhHhZRY9PxRruRMR7kMhnf3I8hDs4S3f9RecfnGxvcBHQcKcIH/oUcEWffsfl1XxdYlA7nnlGbbTvPz9D8gA==",
+      "version": "2.8.9",
+      "resolved": "https://registry.npmjs.org/socks/-/socks-2.8.9.tgz",
+      "integrity": "sha512-LJhUYUvItdQ0LkJTmPeaEObWXAqFyfmP85x0tch/ez9cahmhlBBLbIqDFnvBnUJGagb0JbIQrkBs1wJ+yRYpEw==",
       "requires": {
-        "ip": "^1.1.5",
+        "ip-address": "^10.1.1",
         "smart-buffer": "^4.2.0"
       }
     },
@@ -20286,14 +20998,15 @@
       "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g=="
     },
     "source-map-js": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.0.2.tgz",
-      "integrity": "sha512-R0XvVJ9WusLiqTCEiGCmICCMplcCkIwwR11mOSD9CR5u+IXYdiseeEuXCVAjS54zqwkLcPNnmU4OeJ6tUrWhDw=="
+      "version": "1.2.1",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
+      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA=="
     },
     "source-map-resolve": {
       "version": "0.5.3",
       "resolved": "https://registry.npmjs.org/source-map-resolve/-/source-map-resolve-0.5.3.tgz",
       "integrity": "sha512-Htz+RnsXWk5+P2slx5Jh3Q66vhQj1Cllm0zvnaY98+NFx+Dv2CF/f5O/t8x+KaNdrdIAsruNzoh/KpialbqAnw==",
+      "dev": true,
       "requires": {
         "atob": "^2.1.2",
         "decode-uri-component": "^0.2.0",
@@ -20306,6 +21019,7 @@
       "version": "0.5.21",
       "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz",
       "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==",
+      "dev": true,
       "requires": {
         "buffer-from": "^1.0.0",
         "source-map": "^0.6.0"
@@ -20314,7 +21028,8 @@
     "source-map-url": {
       "version": "0.4.1",
       "resolved": "https://registry.npmjs.org/source-map-url/-/source-map-url-0.4.1.tgz",
-      "integrity": "sha512-cPiFOTLUKvJFIg4SKVScy4ilPPW6rFgMgfuZJPNoDuMs3nC1HbMUycBoJw77xFIp6z1UJQJOfx6C9GMH80DiTw=="
+      "integrity": "sha512-cPiFOTLUKvJFIg4SKVScy4ilPPW6rFgMgfuZJPNoDuMs3nC1HbMUycBoJw77xFIp6z1UJQJOfx6C9GMH80DiTw==",
+      "dev": true
     },
     "sourcemap-codec": {
       "version": "1.4.8",
@@ -20407,6 +21122,7 @@
       "version": "3.1.0",
       "resolved": "https://registry.npmjs.org/split-string/-/split-string-3.1.0.tgz",
       "integrity": "sha512-NzNVhJDYpwceVVii8/Hu6DKfD2G+NrQHlS/V/qgv763EYudVwEcMQNxd2lh+0VrUByXN/oJkl5grOhYWvQUYiw==",
+      "dev": true,
       "requires": {
         "extend-shallow": "^3.0.0"
       }
@@ -20482,6 +21198,7 @@
       "version": "0.1.2",
       "resolved": "https://registry.npmjs.org/static-extend/-/static-extend-0.1.2.tgz",
       "integrity": "sha512-72E9+uLc27Mt718pMHt9VMNiAL4LMsmDbBva8mxWUCkT07fSzEGMYUCk0XWY6lp0j6RBAG4cJ3mWuZv2OE3s0g==",
+      "dev": true,
       "requires": {
         "define-property": "^0.2.5",
         "object-copy": "^0.1.0"
@@ -20491,6 +21208,7 @@
           "version": "0.2.5",
           "resolved": "https://registry.npmjs.org/define-property/-/define-property-0.2.5.tgz",
           "integrity": "sha512-Rr7ADjQZenceVOAKop6ALkkRAmH1A4Gx9hV/7ZujPUN2rkATqFO0JZLZInbAjpZYoJ1gUx8MRMQVkYemcbMSTA==",
+          "dev": true,
           "requires": {
             "is-descriptor": "^0.1.0"
           }
@@ -20522,6 +21240,7 @@
       "version": "2.0.2",
       "resolved": "https://registry.npmjs.org/stream-browserify/-/stream-browserify-2.0.2.tgz",
       "integrity": "sha512-nX6hmklHs/gr2FuxYDltq8fJA1GDlxKQCz8O/IM4atRqBH8OORmBNgfvW5gG10GT/qQ9u0CzIvr2X5Pkt6ntqg==",
+      "dev": true,
       "requires": {
         "inherits": "~2.0.1",
         "readable-stream": "^2.0.2"
@@ -20531,6 +21250,7 @@
       "version": "1.2.3",
       "resolved": "https://registry.npmjs.org/stream-each/-/stream-each-1.2.3.tgz",
       "integrity": "sha512-vlMC2f8I2u/bZGqkdfLQW/13Zihpej/7PmSiMQsbYddxuTsJp8vRe2x2FvVExZg7FaOds43ROAuFJwPR4MTZLw==",
+      "dev": true,
       "requires": {
         "end-of-stream": "^1.1.0",
         "stream-shift": "^1.0.0"
@@ -20540,6 +21260,7 @@
       "version": "2.8.3",
       "resolved": "https://registry.npmjs.org/stream-http/-/stream-http-2.8.3.tgz",
       "integrity": "sha512-+TSkfINHDo4J+ZobQLWiMouQYB+UVYFttRA94FpEzzJ7ZdqcL4uUUQ7WkdkI4DSozGmgBUE/a47L+38PenXhUw==",
+      "dev": true,
       "requires": {
         "builtin-status-codes": "^3.0.0",
         "inherits": "^2.0.1",
@@ -20551,7 +21272,8 @@
     "stream-shift": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/stream-shift/-/stream-shift-1.0.1.tgz",
-      "integrity": "sha512-AiisoFqQ0vbGcZgQPY1cdP2I76glaVA/RauYR4G4thNFgkTqr90yXTo4LYX60Jl+sIlPNHHdGSwo01AvbKUSVQ=="
+      "integrity": "sha512-AiisoFqQ0vbGcZgQPY1cdP2I76glaVA/RauYR4G4thNFgkTqr90yXTo4LYX60Jl+sIlPNHHdGSwo01AvbKUSVQ==",
+      "dev": true
     },
     "streamsearch": {
       "version": "0.1.2",
@@ -20565,14 +21287,6 @@
       "integrity": "sha512-R3f198pcvnB+5IpnBlRkphuE9n46WyVl8I39W/ZUTZLz4nqSP/oLYUrcnJrw462Ds8he4YKMov2efsTIw1BDGQ==",
       "dev": true
     },
-    "string_decoder": {
-      "version": "1.1.1",
-      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
-      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
-      "requires": {
-        "safe-buffer": "~5.1.0"
-      }
-    },
     "string-convert": {
       "version": "0.2.1",
       "resolved": "https://registry.npmjs.org/string-convert/-/string-convert-0.2.1.tgz",
@@ -20637,6 +21351,14 @@
         "es-abstract": "^1.19.5"
       }
     },
+    "string_decoder": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/string_decoder/-/string_decoder-1.1.1.tgz",
+      "integrity": "sha512-n/ShnvDi6FHbbVfviro+WojiFzv+s8MPMHBczVePfUpDJLwoLT0ht1l4YwBCbi8pJAveEEdnkHyPyTP/mzRfwg==",
+      "requires": {
+        "safe-buffer": "~5.1.0"
+      }
+    },
     "strip-ansi": {
       "version": "3.0.1",
       "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-3.0.1.tgz",
@@ -20915,7 +21637,8 @@
     "tapable": {
       "version": "1.1.3",
       "resolved": "https://registry.npmjs.org/tapable/-/tapable-1.1.3.tgz",
-      "integrity": "sha512-4WK/bYZmj8xLr+HUCODHGF1ZFzsYffasLUgEiMBY4fgtltdO6B4WJtlSbPaDTLpYTcGVwM2qLnFTICEcNxs3kA=="
+      "integrity": "sha512-4WK/bYZmj8xLr+HUCODHGF1ZFzsYffasLUgEiMBY4fgtltdO6B4WJtlSbPaDTLpYTcGVwM2qLnFTICEcNxs3kA==",
+      "dev": true
     },
     "tar": {
       "version": "6.1.11",
@@ -21100,6 +21823,7 @@
       "version": "4.8.0",
       "resolved": "https://registry.npmjs.org/terser/-/terser-4.8.0.tgz",
       "integrity": "sha512-EAPipTNeWsb/3wLPeup1tVPaXfIaU68xMnVdPafIL1TV05OhASArYyIfFvnvJCNrR2NIOvDVNNTFRa+Re2MWyw==",
+      "dev": true,
       "requires": {
         "commander": "^2.20.0",
         "source-map": "~0.6.1",
@@ -21109,7 +21833,8 @@
         "commander": {
           "version": "2.20.3",
           "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
-          "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ=="
+          "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
+          "dev": true
         }
       }
     },
@@ -21117,6 +21842,7 @@
       "version": "1.4.5",
       "resolved": "https://registry.npmjs.org/terser-webpack-plugin/-/terser-webpack-plugin-1.4.5.tgz",
       "integrity": "sha512-04Rfe496lN8EYruwi6oPQkG0vo8C+HT49X687FZnpPF0qMAIHONI6HEXYPKDOE8e5HjXTyKfqRd/agHtH0kOtw==",
+      "dev": true,
       "requires": {
         "cacache": "^12.0.2",
         "find-cache-dir": "^2.1.0",
@@ -21133,6 +21859,7 @@
           "version": "12.0.4",
           "resolved": "https://registry.npmjs.org/cacache/-/cacache-12.0.4.tgz",
           "integrity": "sha512-a0tMB40oefvuInr4Cwb3GerbL9xTj1D5yg0T5xrjGCGyfvbxseIXX7BAO/u/hIXdafzOI5JC3wDwHyf24buOAQ==",
+          "dev": true,
           "requires": {
             "bluebird": "^3.5.5",
             "chownr": "^1.1.1",
@@ -21154,12 +21881,14 @@
         "chownr": {
           "version": "1.1.4",
           "resolved": "https://registry.npmjs.org/chownr/-/chownr-1.1.4.tgz",
-          "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg=="
+          "integrity": "sha512-jJ0bqzaylmJtVnNgzTeSOs8DPavpbYgEr/b0YL8/2GO3xJEhInFmhKMUnEJQjZumK7KXGFhUy89PrsJWlakBVg==",
+          "dev": true
         },
         "lru-cache": {
           "version": "5.1.1",
           "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz",
           "integrity": "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==",
+          "dev": true,
           "requires": {
             "yallist": "^3.0.2"
           }
@@ -21168,6 +21897,7 @@
           "version": "0.5.6",
           "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
           "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
+          "dev": true,
           "requires": {
             "minimist": "^1.2.6"
           }
@@ -21176,6 +21906,7 @@
           "version": "2.7.1",
           "resolved": "https://registry.npmjs.org/rimraf/-/rimraf-2.7.1.tgz",
           "integrity": "sha512-uWjbaKIK3T1OSVptzX7Nl6PvQ3qAGtKEtVRjRuazjfL3Bx5eI409VZSqgND+4UNnmzLVdPj9FqFJNPqBZFve4w==",
+          "dev": true,
           "requires": {
             "glob": "^7.1.3"
           }
@@ -21184,6 +21915,7 @@
           "version": "1.0.0",
           "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-1.0.0.tgz",
           "integrity": "sha512-i27Mic4KovM/lnGsy8whRCHhc7VicJajAjTrYg11K9zfZXnYIt4k5F+kZkwjnrhKzLic/HLU4j11mjsz2G/75g==",
+          "dev": true,
           "requires": {
             "ajv": "^6.1.0",
             "ajv-errors": "^1.0.0",
@@ -21194,6 +21926,7 @@
           "version": "6.0.2",
           "resolved": "https://registry.npmjs.org/ssri/-/ssri-6.0.2.tgz",
           "integrity": "sha512-cepbSq/neFK7xB6A50KHN0xHDotYzq58wWCa5LeWqnPrHG8GzfEjO/4O8kpmcGW+oaxkvhEJCWgbgNk4/ZV93Q==",
+          "dev": true,
           "requires": {
             "figgy-pudding": "^3.5.1"
           }
@@ -21202,6 +21935,7 @@
           "version": "1.4.3",
           "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-1.4.3.tgz",
           "integrity": "sha512-lgTS3Xhv1lCOKo7SA5TjKXMjpSM4sBjNV5+q2bqesbSPs5FjGmU6jjtBSkX9b4qW87vDIsCIlUPOEhbZrMdjeQ==",
+          "dev": true,
           "requires": {
             "source-list-map": "^2.0.0",
             "source-map": "~0.6.1"
@@ -21210,12 +21944,14 @@
         "y18n": {
           "version": "4.0.3",
           "resolved": "https://registry.npmjs.org/y18n/-/y18n-4.0.3.tgz",
-          "integrity": "sha512-JKhqTOwSrqNA1NY5lSztJ1GrBiUodLMmIZuLiDaMRJ+itFd+ABVE8XBjOvIWL+rSqNDC74LCSFmlb/U4UZ4hJQ=="
+          "integrity": "sha512-JKhqTOwSrqNA1NY5lSztJ1GrBiUodLMmIZuLiDaMRJ+itFd+ABVE8XBjOvIWL+rSqNDC74LCSFmlb/U4UZ4hJQ==",
+          "dev": true
         },
         "yallist": {
           "version": "3.1.1",
           "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
-          "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g=="
+          "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==",
+          "dev": true
         }
       }
     },
@@ -21309,6 +22045,7 @@
       "version": "2.0.5",
       "resolved": "https://registry.npmjs.org/through2/-/through2-2.0.5.tgz",
       "integrity": "sha512-/mrRod8xqpA+IHSLyGCQ2s8SPHiCDEeQJSep1jqLYeEUClOFG2Qsh+4FU6G9VeqpZnGW/Su8LQGc4YKni5rYSQ==",
+      "dev": true,
       "requires": {
         "readable-stream": "~2.3.6",
         "xtend": "~4.0.1"
@@ -21330,6 +22067,7 @@
       "version": "2.0.12",
       "resolved": "https://registry.npmjs.org/timers-browserify/-/timers-browserify-2.0.12.tgz",
       "integrity": "sha512-9phl76Cqm6FhSX9Xe1ZUAMLtm1BLkKj2Qd5ApyWkXzsMRaA7dgr81kf4wJmQf/hAvg8EEyJxDo3du/0KlhPiKQ==",
+      "dev": true,
       "requires": {
         "setimmediate": "^1.0.4"
       }
@@ -21363,7 +22101,8 @@
     "to-arraybuffer": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/to-arraybuffer/-/to-arraybuffer-1.0.1.tgz",
-      "integrity": "sha512-okFlQcoGTi4LQBG/PgSYblw9VOyptsz2KJZqc6qtgGdes8VktzUQkj4BI2blit072iS8VODNcMA+tvnS9dnuMA=="
+      "integrity": "sha512-okFlQcoGTi4LQBG/PgSYblw9VOyptsz2KJZqc6qtgGdes8VktzUQkj4BI2blit072iS8VODNcMA+tvnS9dnuMA==",
+      "dev": true
     },
     "to-buffer": {
       "version": "1.1.1",
@@ -21371,16 +22110,11 @@
       "integrity": "sha512-lx9B5iv7msuFYE3dytT+KE5tap+rNYw+K4jVkb9R/asAb+pbBSM17jtunHplhBe6RRJdZx3Pn2Jph24O32mOVg==",
       "dev": true
     },
-    "to-fast-properties": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/to-fast-properties/-/to-fast-properties-2.0.0.tgz",
-      "integrity": "sha512-/OaKK0xYrs3DmxRYqL/yDc+FxFUVYhDlXMhRmv3z915w2HF1tnN1omB354j8VUGO/hbRzyD6Y3sA7v7GS/ceog==",
-      "dev": true
-    },
     "to-object-path": {
       "version": "0.3.0",
       "resolved": "https://registry.npmjs.org/to-object-path/-/to-object-path-0.3.0.tgz",
       "integrity": "sha512-9mWHdnGRuh3onocaHzukyvCZhzvr6tiflAy/JRFXcJX0TjgfWA9pk9t8CMbzmBE4Jfw58pXbkngtBtqYxzNEyg==",
+      "dev": true,
       "requires": {
         "kind-of": "^3.0.2"
       },
@@ -21389,6 +22123,7 @@
           "version": "3.2.2",
           "resolved": "https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz",
           "integrity": "sha512-NOW9QQXMoZGg/oqnVNoNTTIFEIid1627WCffUBJEdMxYApq7mNE7CpzucIPc+ZQg25Phej7IJSmX3hO+oblOtQ==",
+          "dev": true,
           "requires": {
             "is-buffer": "^1.1.5"
           }
@@ -21404,6 +22139,7 @@
       "version": "3.0.2",
       "resolved": "https://registry.npmjs.org/to-regex/-/to-regex-3.0.2.tgz",
       "integrity": "sha512-FWtleNAtZ/Ki2qtqej2CXTOayOH9bHDQF+Q48VpWyDXjbYxA4Yz8iDB31zXOBUlOHHKidDbqGVrTUvQMPmBGBw==",
+      "dev": true,
       "requires": {
         "define-property": "^2.0.2",
         "extend-shallow": "^3.0.2",
@@ -21415,6 +22151,7 @@
       "version": "2.1.1",
       "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-2.1.1.tgz",
       "integrity": "sha512-ZZWNfCjUokXXDGXFpZehJIkZqq91BcULFq/Pi7M5i4JnxXdhMKAK682z8bCW3o8Hj1wuuzoKcW3DfVzaP6VuNg==",
+      "dev": true,
       "requires": {
         "is-number": "^3.0.0",
         "repeat-string": "^1.6.1"
@@ -21576,7 +22313,8 @@
     "tty-browserify": {
       "version": "0.0.0",
       "resolved": "https://registry.npmjs.org/tty-browserify/-/tty-browserify-0.0.0.tgz",
-      "integrity": "sha512-JVa5ijo+j/sOoHGjw0sxw734b1LhBkQ3bvUGNdxnVXDCX81Yx7TFgnZygxrIIWn23hbfTaMYLwRmAxFyDuFmIw=="
+      "integrity": "sha512-JVa5ijo+j/sOoHGjw0sxw734b1LhBkQ3bvUGNdxnVXDCX81Yx7TFgnZygxrIIWn23hbfTaMYLwRmAxFyDuFmIw==",
+      "dev": true
     },
     "tunnel-agent": {
       "version": "0.6.0",
@@ -21618,7 +22356,8 @@
     "typedarray": {
       "version": "0.0.6",
       "resolved": "https://registry.npmjs.org/typedarray/-/typedarray-0.0.6.tgz",
-      "integrity": "sha512-/aCDEGatGvZ2BIk+HmLf4ifCJFwvKFNb9/JeZPMulfgFracn9QFcAf5GO8B/mweUjSoblS5In0cWhqpfs/5PQA=="
+      "integrity": "sha512-/aCDEGatGvZ2BIk+HmLf4ifCJFwvKFNb9/JeZPMulfgFracn9QFcAf5GO8B/mweUjSoblS5In0cWhqpfs/5PQA==",
+      "dev": true
     },
     "typedarray-to-buffer": {
       "version": "3.1.5",
@@ -21835,6 +22574,7 @@
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/union-value/-/union-value-1.0.1.tgz",
       "integrity": "sha512-tJfXmxMeWYnczCVs7XAEvIV7ieppALdyepWMkHkwciRpZraG/xwT+s2JN8+pr1+8jCRf80FFzvr+MpQeeoF4Xg==",
+      "dev": true,
       "requires": {
         "arr-union": "^3.1.0",
         "get-value": "^2.0.6",
@@ -21900,6 +22640,7 @@
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/unset-value/-/unset-value-1.0.0.tgz",
       "integrity": "sha512-PcA2tsuGSF9cnySLHTLSh2qrQiJ70mn+r+Glzxv2TWZblxsxCC52BDlZoPCsz7STd9pN7EZetkWZBAvk4cgZdQ==",
+      "dev": true,
       "requires": {
         "has-value": "^0.3.1",
         "isobject": "^3.0.0"
@@ -21909,6 +22650,7 @@
           "version": "0.3.1",
           "resolved": "https://registry.npmjs.org/has-value/-/has-value-0.3.1.tgz",
           "integrity": "sha512-gpG936j8/MzaeID5Yif+577c17TxaDmhuyVgSwtnL/q8UUTySg8Mecb+8Cf1otgLoD7DDH75axp86ER7LFsf3Q==",
+          "dev": true,
           "requires": {
             "get-value": "^2.0.3",
             "has-values": "^0.1.4",
@@ -21919,6 +22661,7 @@
               "version": "2.1.0",
               "resolved": "https://registry.npmjs.org/isobject/-/isobject-2.1.0.tgz",
               "integrity": "sha512-+OUdGJlgjOBZDfxnDjYYG6zp487z0JGNQq3cYQYg5f5hKR+syHMsaztzGeml/4kGG55CSpKSpWTY+jYGgsHLgA==",
+              "dev": true,
               "requires": {
                 "isarray": "1.0.0"
               }
@@ -21928,7 +22671,8 @@
         "has-values": {
           "version": "0.1.4",
           "resolved": "https://registry.npmjs.org/has-values/-/has-values-0.1.4.tgz",
-          "integrity": "sha512-J8S0cEdWuQbqD9//tlZxiMuMNmxB8PlEwvYwuxsTmR1G5RXUePEX/SJn7aD0GMLieuZYSwNH0cQuJGwnYunXRQ=="
+          "integrity": "sha512-J8S0cEdWuQbqD9//tlZxiMuMNmxB8PlEwvYwuxsTmR1G5RXUePEX/SJn7aD0GMLieuZYSwNH0cQuJGwnYunXRQ==",
+          "dev": true
         }
       }
     },
@@ -22004,12 +22748,14 @@
     "urix": {
       "version": "0.1.0",
       "resolved": "https://registry.npmjs.org/urix/-/urix-0.1.0.tgz",
-      "integrity": "sha512-Am1ousAhSLBeB9cG/7k7r2R0zj50uDRlZHPGbazid5s9rlF1F/QKYObEKSIunSjIOkJZqwRRLpvewjEkM7pSqg=="
+      "integrity": "sha512-Am1ousAhSLBeB9cG/7k7r2R0zj50uDRlZHPGbazid5s9rlF1F/QKYObEKSIunSjIOkJZqwRRLpvewjEkM7pSqg==",
+      "dev": true
     },
     "url": {
       "version": "0.11.0",
       "resolved": "https://registry.npmjs.org/url/-/url-0.11.0.tgz",
       "integrity": "sha512-kbailJa29QrtXnxgq+DdCEGlbTeYM2eJUxsz6vjZavrCYPMIFHMKQmSKYAIuUK2i7hgPm28a8piX5NTUtM/LKQ==",
+      "dev": true,
       "requires": {
         "punycode": "1.3.2",
         "querystring": "0.2.0"
@@ -22018,7 +22764,8 @@
         "punycode": {
           "version": "1.3.2",
           "resolved": "https://registry.npmjs.org/punycode/-/punycode-1.3.2.tgz",
-          "integrity": "sha512-RofWgt/7fL5wP1Y7fxE7/EmTLzQVnB0ycyibJ0OOHIlJqTNzglYFxVwETOcIoJqJmpDXJ9xImDv+Fq34F/d4Dw=="
+          "integrity": "sha512-RofWgt/7fL5wP1Y7fxE7/EmTLzQVnB0ycyibJ0OOHIlJqTNzglYFxVwETOcIoJqJmpDXJ9xImDv+Fq34F/d4Dw==",
+          "dev": true
         }
       }
     },
@@ -22088,12 +22835,14 @@
     "use": {
       "version": "3.1.1",
       "resolved": "https://registry.npmjs.org/use/-/use-3.1.1.tgz",
-      "integrity": "sha512-cwESVXlO3url9YWlFW/TA9cshCEhtu7IKJ/p5soJ/gGpj7vbvFrAY/eIioQ6Dw23KjZhYgiIo8HOs1nQ2vr/oQ=="
+      "integrity": "sha512-cwESVXlO3url9YWlFW/TA9cshCEhtu7IKJ/p5soJ/gGpj7vbvFrAY/eIioQ6Dw23KjZhYgiIo8HOs1nQ2vr/oQ==",
+      "dev": true
     },
     "util": {
       "version": "0.11.1",
       "resolved": "https://registry.npmjs.org/util/-/util-0.11.1.tgz",
       "integrity": "sha512-HShAsny+zS2TZfaXxD9tYj4HQGlBezXZMZuM/S5PKLLoZkShZiGk9o5CzukI1LVHZvjdvZ2Sj1aW/Ndn2NB/HQ==",
+      "dev": true,
       "requires": {
         "inherits": "2.0.3"
       },
@@ -22101,7 +22850,8 @@
         "inherits": {
           "version": "2.0.3",
           "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.3.tgz",
-          "integrity": "sha512-x00IRNXNy63jwGkJmzPigoySHbaqpNuzKbBOmzK+g2OdZpQ9w+sxCN+VSB3ja7IAge2OP2qpfxTjeNcyjmW1uw=="
+          "integrity": "sha512-x00IRNXNy63jwGkJmzPigoySHbaqpNuzKbBOmzK+g2OdZpQ9w+sxCN+VSB3ja7IAge2OP2qpfxTjeNcyjmW1uw==",
+          "dev": true
         }
       }
     },
@@ -22196,7 +22946,8 @@
     "vm-browserify": {
       "version": "1.1.2",
       "resolved": "https://registry.npmjs.org/vm-browserify/-/vm-browserify-1.1.2.tgz",
-      "integrity": "sha512-2ham8XPWTONajOR0ohOKOHXkm3+gaBmGut3SRuu75xLd/RRaY6vqgh8NBYYk7+RW3u5AtzPQZG8F10LHkl0lAQ=="
+      "integrity": "sha512-2ham8XPWTONajOR0ohOKOHXkm3+gaBmGut3SRuu75xLd/RRaY6vqgh8NBYYk7+RW3u5AtzPQZG8F10LHkl0lAQ==",
+      "dev": true
     },
     "vue": {
       "version": "3.2.37",
@@ -22213,8 +22964,7 @@
     "vue-chartjs": {
       "version": "4.1.2",
       "resolved": "https://registry.npmjs.org/vue-chartjs/-/vue-chartjs-4.1.2.tgz",
-      "integrity": "sha512-QSggYjeFv/L4jFSBQpX8NzrAvX0B+Ha6nDgxkTG8tEXxYOOTwKI4phRLe+B4f+REnkmg7hgPY24R0cixZJyXBg==",
-      "requires": {}
+      "integrity": "sha512-QSggYjeFv/L4jFSBQpX8NzrAvX0B+Ha6nDgxkTG8tEXxYOOTwKI4phRLe+B4f+REnkmg7hgPY24R0cixZJyXBg=="
     },
     "vue-clipboard2": {
       "version": "0.3.3",
@@ -22224,6 +22974,57 @@
         "clipboard": "^2.0.0"
       }
     },
+    "vue-code-highlight": {
+      "version": "0.7.8",
+      "resolved": "https://registry.npmjs.org/vue-code-highlight/-/vue-code-highlight-0.7.8.tgz",
+      "integrity": "sha512-jMt1W0DGisNZ3B2TASFCPLEswohVrwImX+TxzMIZINZyAUUNZ1Xth3soJw1xepTsMgxkIkhsmN/xVNpiI3bU4g==",
+      "requires": {
+        "prism-es6": "^1.2.0",
+        "vue": "^2.5.16"
+      },
+      "dependencies": {
+        "@vue/compiler-sfc": {
+          "version": "2.7.16",
+          "resolved": "https://registry.npmjs.org/@vue/compiler-sfc/-/compiler-sfc-2.7.16.tgz",
+          "integrity": "sha512-KWhJ9k5nXuNtygPU7+t1rX6baZeqOYLEforUPjgNDBnLicfHCoi48H87Q8XyLZOrNNsmhuwKqtpDQWjEFe6Ekg==",
+          "requires": {
+            "@babel/parser": "^7.23.5",
+            "postcss": "^8.4.14",
+            "prettier": "^1.18.2 || ^2.0.0",
+            "source-map": "^0.6.1"
+          }
+        },
+        "csstype": {
+          "version": "3.2.3",
+          "resolved": "https://registry.npmjs.org/csstype/-/csstype-3.2.3.tgz",
+          "integrity": "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ=="
+        },
+        "picocolors": {
+          "version": "1.1.1",
+          "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.1.1.tgz",
+          "integrity": "sha512-xceH2snhtb5M9liqDsmEw56le376mTZkEX/jEb/RxNFyegNul7eNslCXP9FDj/Lcu0X8KEyMceP2ntpaHrDEVA=="
+        },
+        "postcss": {
+          "version": "8.5.15",
+          "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.15.tgz",
+          "integrity": "sha512-FfR8sjd4em2T6fb3I2MwAJU7HWVMr9zba+enmQeeWFfCbm+UOC/0X4DS8XtpUTMwWMGbjKYP7xjfNekzyGmB3A==",
+          "requires": {
+            "nanoid": "^3.3.12",
+            "picocolors": "^1.1.1",
+            "source-map-js": "^1.2.1"
+          }
+        },
+        "vue": {
+          "version": "2.7.16",
+          "resolved": "https://registry.npmjs.org/vue/-/vue-2.7.16.tgz",
+          "integrity": "sha512-4gCtFXaAA3zYZdTp5s4Hl2sozuySsgz4jy1EnpBHNfpMa9dK1ZCG7viqBPCwXtmgc8nHqUsAu3G4gtmXkkY3Sw==",
+          "requires": {
+            "@vue/compiler-sfc": "2.7.16",
+            "csstype": "^3.1.0"
+          }
+        }
+      }
+    },
     "vue-codemod": {
       "version": "0.0.5",
       "resolved": "https://registry.npmjs.org/vue-codemod/-/vue-codemod-0.0.5.tgz",
@@ -22658,8 +23459,7 @@
     "vue-web-storage": {
       "version": "6.1.0",
       "resolved": "https://registry.npmjs.org/vue-web-storage/-/vue-web-storage-6.1.0.tgz",
-      "integrity": "sha512-Qsa6QkUyGP+Tj0oxLRc6vEATv6axY89LbwfX8eaMM3i7K/Nl9m0NTELtNp0s8Xhg9F0SkeEP4NC3+LQL3ygMQw==",
-      "requires": {}
+      "integrity": "sha512-Qsa6QkUyGP+Tj0oxLRc6vEATv6axY89LbwfX8eaMM3i7K/Nl9m0NTELtNp0s8Xhg9F0SkeEP4NC3+LQL3ygMQw=="
     },
     "vue3-clipboard": {
       "version": "1.0.0",
@@ -22672,8 +23472,7 @@
     "vue3-google-login": {
       "version": "2.0.26",
       "resolved": "https://registry.npmjs.org/vue3-google-login/-/vue3-google-login-2.0.26.tgz",
-      "integrity": "sha512-BuTSIeSjINNHNPs+BDF4COnjWvff27IfCBDxK6JPRqvm57lF8iK4B3+zcG8ud6BXfZdyuiDlxletbEDgg4/RFA==",
-      "requires": {}
+      "integrity": "sha512-BuTSIeSjINNHNPs+BDF4COnjWvff27IfCBDxK6JPRqvm57lF8iK4B3+zcG8ud6BXfZdyuiDlxletbEDgg4/RFA=="
     },
     "vuedraggable": {
       "version": "4.1.0",
@@ -22750,6 +23549,7 @@
       "version": "1.7.5",
       "resolved": "https://registry.npmjs.org/watchpack/-/watchpack-1.7.5.tgz",
       "integrity": "sha512-9P3MWk6SrKjHsGkLT2KHXdQ/9SNkyoJbabxnKOoJepsvJjJG8uYTR3yTPxPQvNDI3w4Nz1xnE0TLHK4RIVe/MQ==",
+      "dev": true,
       "requires": {
         "chokidar": "^3.4.1",
         "graceful-fs": "^4.1.2",
@@ -22904,6 +23704,7 @@
       "version": "4.46.0",
       "resolved": "https://registry.npmjs.org/webpack/-/webpack-4.46.0.tgz",
       "integrity": "sha512-6jJuJjg8znb/xRItk7bkT0+Q7AHCYjjFnvKIWQPkNIOyRqoCGvkOs0ipeQzrqz4l5FtN5ZI/ukEHroeX/o1/5Q==",
+      "dev": true,
       "requires": {
         "@webassemblyjs/ast": "1.9.0",
         "@webassemblyjs/helper-module-context": "1.9.0",
@@ -22934,6 +23735,7 @@
           "version": "1.0.1",
           "resolved": "https://registry.npmjs.org/json5/-/json5-1.0.1.tgz",
           "integrity": "sha512-aKS4WQjPenRxiQsC93MNfjx+nbF4PAdYzmd/1JIj8HYzqfbu86beTuNgXDzPknWk0n0uARlyewZo4s++ES36Ow==",
+          "dev": true,
           "requires": {
             "minimist": "^1.2.0"
           }
@@ -22942,6 +23744,7 @@
           "version": "1.4.0",
           "resolved": "https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.0.tgz",
           "integrity": "sha512-qH0WSMBtn/oHuwjy/NucEgbx5dbxxnxup9s4PVXJUDHZBQY+s0NWA9rJf53RBnQZxfch7euUui7hpoAPvALZdA==",
+          "dev": true,
           "requires": {
             "big.js": "^5.2.2",
             "emojis-list": "^3.0.0",
@@ -22952,6 +23755,7 @@
           "version": "0.5.6",
           "resolved": "https://registry.npmjs.org/mkdirp/-/mkdirp-0.5.6.tgz",
           "integrity": "sha512-FP+p8RB8OWpF3YZBCrP5gtADmtXApB5AMLn+vdyA+PyxCjrCs00mjyUozssO33cwDeT3wNGdLxJ5M//YqtHAJw==",
+          "dev": true,
           "requires": {
             "minimist": "^1.2.6"
           }
@@ -22960,6 +23764,7 @@
           "version": "1.0.0",
           "resolved": "https://registry.npmjs.org/schema-utils/-/schema-utils-1.0.0.tgz",
           "integrity": "sha512-i27Mic4KovM/lnGsy8whRCHhc7VicJajAjTrYg11K9zfZXnYIt4k5F+kZkwjnrhKzLic/HLU4j11mjsz2G/75g==",
+          "dev": true,
           "requires": {
             "ajv": "^6.1.0",
             "ajv-errors": "^1.0.0",
@@ -22970,6 +23775,7 @@
           "version": "1.4.3",
           "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-1.4.3.tgz",
           "integrity": "sha512-lgTS3Xhv1lCOKo7SA5TjKXMjpSM4sBjNV5+q2bqesbSPs5FjGmU6jjtBSkX9b4qW87vDIsCIlUPOEhbZrMdjeQ==",
+          "dev": true,
           "requires": {
             "source-list-map": "^2.0.0",
             "source-map": "~0.6.1"
@@ -23672,6 +24478,7 @@
       "version": "1.7.0",
       "resolved": "https://registry.npmjs.org/worker-farm/-/worker-farm-1.7.0.tgz",
       "integrity": "sha512-rvw3QTZc8lAxyVrqcSGVm5yP/IJ2UcB3U0graE3LCFoZ0Yn2x4EoVSqJKdB/T5M+FLcRPjz4TDacRf3OCfNUzw==",
+      "dev": true,
       "requires": {
         "errno": "~0.1.7"
       }
@@ -23761,8 +24568,7 @@
       "version": "7.5.8",
       "resolved": "https://registry.npmjs.org/ws/-/ws-7.5.8.tgz",
       "integrity": "sha512-ri1Id1WinAX5Jqn9HejiGb8crfRio0Qgu8+MtL36rlTA6RLsMdWt1Az/19A2Qij6uSHUMphEFaTKa4WG+UNHNw==",
-      "dev": true,
-      "requires": {}
+      "dev": true
     },
     "xdg-basedir": {
       "version": "4.0.0",
@@ -23821,7 +24627,8 @@
     "xtend": {
       "version": "4.0.2",
       "resolved": "https://registry.npmjs.org/xtend/-/xtend-4.0.2.tgz",
-      "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ=="
+      "integrity": "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ==",
+      "dev": true
     },
     "y18n": {
       "version": "5.0.8",
diff --git a/ui/package.json b/ui/package.json
index 9801c1b18153..7ccd4916df2b 100644
--- a/ui/package.json
+++ b/ui/package.json
@@ -65,6 +65,7 @@
     "vue": "^3.2.31",
     "vue-chartjs": "^4.0.7",
     "vue-clipboard2": "^0.3.1",
+    "vue-code-highlight": "^0.7.8",
     "vue-cropper": "^1.0.2",
     "vue-i18n": "^9.1.6",
     "vue-loader": "^16.8.3",
diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index 6ba6f458a0a2..775de26103a0 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -245,6 +245,7 @@
 "label.action.unmanage.volume": "Unmanage Volume",
 "label.action.unmanage.volumes": "Unmanage Volumes",
 "label.action.unregister.extension.resource": "Unregister extension resource",
+"label.action.update.extension.resource": "Update extension resource details",
 "label.action.update.host": "Update Host",
 "label.action.update.security.groups": "Update security groups",
 "label.action.update.offering.access": "Update offering access",
@@ -257,6 +258,7 @@
 "label.action.vmstoragesnapshot.create": "Take Instance volume Snapshot",
 "label.actions": "Actions",
 "label.active": "Active",
+"label.activeaccounts": "Active accounts",
 "label.activate.project": "Activate project",
 "label.activeviewersessions": "Active sessions",
 "label.add": "Add",
@@ -399,6 +401,8 @@
 "label.allocatedonly": "Allocated",
 "label.allocationstate": "Allocation state",
 "label.allow": "Allow",
+"label.allowextractfile": "Allow extract file",
+"label.allowquickrestore": "Allow quick restore",
 "label.allowedroletypes": "Allowed Role Types",
 "label.allow.duplicate.macaddresses": "Allow duplicate MAC addresses",
 "label.allowuserdrivenbackups": "Allow User driven backups",
@@ -472,8 +476,11 @@
 "label.backups": "Backups",
 "label.backedup": "BackedUp",
 "label.backingup": "BackingUp",
+"label.backup.isolated": "Isolated",
 "label.backup.attach.restore": "Restore and attach backup volume",
 "label.backup.configure.schedule": "Configure Backup Schedule",
+"label.backup.chain.finish": "Finish backup chain",
+"label.backupchainsize": "Backup chain size",
 "label.backup.offering.assign": "Assign Instance to backup offering",
 "label.backup.offering.remove": "Remove Instance from backup offering",
 "label.backup.offerings": "Backup Offerings",
@@ -621,6 +628,9 @@
 "label.community": "Community",
 "label.complete": "Complete",
 "label.completed": "Completed",
+"label.compress": "Compress",
+"label.compressionstatus": "Compression status",
+"label.compressionlibrary": "Compression library",
 "label.compute": "Compute",
 "label.compute.offerings": "Compute Offerings",
 "label.compute.offering.for.sharedfs.instance": "Compute Offering for Instance",
@@ -670,6 +680,7 @@
 "label.consoleproxy": "Console proxy",
 "label.console.proxy": "Console proxy",
 "label.console.proxy.vm": "Console proxy VM",
+"label.consumption": "Consumption",
 "label.contains": "Contains",
 "label.contents": "Contents",
 "label.continue": "Continue",
@@ -709,6 +720,7 @@
 "label.create.account": "Create Account",
 "label.create.asnrange": "Create AS Range",
 "label.create.backup": "Start Backup",
+"label.create.backup.offering": "Create Backup Offering",
 "label.create.extension": "Create Extension",
 "label.create.sharedfs": "Create Shared FileSystem",
 "label.create.network": "Create new Network",
@@ -742,6 +754,8 @@
 "label.nameservers": "DNS Nameservers",
 "label.publicdomainsuffix": "Public domain suffix",
 "label.credit": "Credit",
+"label.credits": "Credits",
+"label.creditor": "Creditor",
 "label.cron": "Cron expression",
 "label.cron.mode": "Cron mode",
 "label.crosszones": "Cross Zones",
@@ -1058,6 +1072,7 @@
 "label.egressdefaultpolicy": "Default egress policy",
 "label.elastic": "Elastic",
 "label.email": "Email",
+"label.emailtemplate": "Email Template",
 "label.enable.autoscale.vmgroup": "Enable AutoScaling Group",
 "label.enable.csi": "Enable CloudStack CSI Driver",
 "label.enable.custom.action": "Enable Custom Action",
@@ -1129,6 +1144,9 @@
 "label.expungevmgraceperiod": "Expunge Instance grace period (in sec)",
 "label.expunged": "Expunged",
 "label.expunging": "Expunging",
+"label.export.data.csv": "Export data as CSV",
+"label.export.details.csv": "Export details as CSV",
+"label.export.resources.csv": "Export resources as CSV",
 "label.export.rules": "Export Rules",
 "label.ext.hostname.tooltip": "External Host Name or IP Address",
 "label.extension": "Extension",
@@ -1142,6 +1160,7 @@
 "label.external.details.tooltip": "Details that will be passed to the external provisioner while deploying an instance",
 "label.externalprovisioner": "External provisioner",
 "label.external.link": "External link",
+"label.external.network.provider": "External Network Provider",
 "label.externalid": "External Id",
 "label.externalloadbalanceripaddress": "External load balancer IP address.",
 "label.extra": "Extra arguments",
@@ -1602,6 +1621,7 @@
 "label.locked": "Locked",
 "label.login": "Login",
 "label.loginfo": "Log file information",
+"label.login.external": "External",
 "label.login.portal": "Portal login",
 "label.login.single.signon": "Single sign-on",
 "label.logout": "Logout",
@@ -1800,6 +1820,7 @@
 "label.networkofferingdisplaytext": "Network Offering",
 "label.networkofferingid": "Network Offering",
 "label.networkofferingname": "Network Offering",
+"label.networkorchestrator": "Network Orchestrator",
 "label.networkrate": "Network rate (Mb/s)",
 "label.networkread": "Network read",
 "label.networks": "Networks",
@@ -1886,6 +1907,8 @@
 "label.offeringid": "Offering ID",
 "label.offeringtype": "Compute Offering type",
 "label.ok": "OK",
+"label.ssvm.open.cert.page": "Open Certificate Page",
+"label.retry.upload": "Retry Upload",
 "label.only.end.date.and.time": "Only end date and time",
 "label.only.start.date.and.time": "Only start date and time",
 "label.open.documentation": "Open documentation",
@@ -2088,29 +2111,45 @@
 "label.purpose": "Purpose",
 "label.qostype": "QoS type",
 "label.queued": "Queued",
+"label.quickrestore": "Quick Restore",
 "label.quickview": "Quick view",
 "label.quiescevm": "Quiesce Instance",
 "label.quiettime": "Quiet time (in sec)",
 "label.quota": "Quota",
 "label.quota.add.credits": "Add credits",
 "label.quota.configuration": "Quota configuration",
-"label.quota.credits": "Credits",
+"label.quota.consumed": "Quota consumed",
+"label.quota.current.balance": "Current balance",
 "label.quota.email.edit": "Edit Email Template",
 "label.quota.enforce": "Enforce Quota",
+"label.quota.filter.period": "Filtering data from <b>{startDate}</b> to <b>{endDate}</b>",
+"label.quota.last.balance": "Last balance at the day",
+"label.quota.period.today": "Today",
+"label.quota.period.this.week": "This week",
+"label.quota.period.this.month": "This month",
+"label.quota.period.last.month": "Last month",
+"label.quota.period.this.year": "This year",
+"label.quota.period.last.year": "Last year",
+"label.quota.period.custom": "Custom",
+"label.quota.select.period": "Select a period",
 "label.quota.statement": "Statement",
-"label.quota.statement.balance": "Quota balance",
-"label.quota.statement.quota": "Quota usage",
+"label.quota.statement.history": "History (non-cumulative)",
+"label.quota.statement.cumulative.history": "History (cumulative)",
 "label.quota.statement.tariff": "Quota tariff",
 "label.quota.summary": "Summary",
 "label.quota.tariff": "Tariff",
 "label.quota.tariff.activationrule": "Activation rule",
 "label.quota.tariff.effectivedate": "Effective date",
+"label.quota.tariff.hasactivationrule": "Has activation rule?",
 "label.quota.tariff.position": "Position",
 "label.quota.tariff.value": "Tariff value",
 "label.quota.total": "Total",
+"label.quota.total.consumption": "Total quota consumption",
 "label.quota.type.name": "Usage Type",
 "label.quota.type.unit": "Usage unit",
-"label.quota.usage": "Quota consumption",
+"label.quota.usage.types.summary": "Usage types summary",
+"label.quota.usage.resources.by.type": "Resources by usage type",
+"label.quota.usage.details.by.resource": "Details by resource",
 "label.quota.validate.activation.rule": "Validate activation rule",
 "label.quota.value": "Quota value",
 "label.quotastate": "Quota state",
@@ -2206,6 +2245,7 @@
 "label.remove.vpc": "Remove VPC",
 "label.remove.vpc.offering": "Remove VPC Offering",
 "label.removed": "Removed",
+"label.removedaccounts": "Removed Accounts",
 "label.removing": "Removing",
 "label.replace": "Replace",
 "label.replace.acl": "Replace ACL",
@@ -2809,7 +2849,10 @@
 "label.utilization": "Utilization",
 "label.uuid": "ID",
 "label.value": "Value",
+"label.validate": "Validate",
 "label.validationformat": "Validation Format",
+"label.validationstatus": "Validation status",
+"label.validationsteps": "Validation steps",
 "label.valueoptions": "Values Options",
 "label.vcenter": "VMware datacenter vCenter",
 "label.vcenter.datacenter": "vCenter datacenter",
@@ -3137,6 +3180,10 @@
 "message.action.primary.storage.scope.cluster": "Please confirm that you want to change the scope from Zone to the specified Cluster.<br>This operation will update the database and disconnect the storage pool from all hosts that were previously connected to the primary storage and are not part of the specified cluster.",
 "message.action.primary.storage.scope.zone": "Please confirm that you want to change the scope from Cluster to Zone.<br>This operation will update the database and connect the storage pool to all hosts of the zone running the same hypervisor as set on the storage pool.",
 "message.action.primarystorage.enable.maintenance.mode": "Warning: placing the primary storage into maintenance mode will cause all Instances using volumes from it to be stopped.  Do you want to continue?",
+"message.action.quota.credit.add.error.accountrequired": "Please, inform the account",
+"message.action.quota.credit.add.error.domainidrequired": "Please, inform the domain",
+"message.action.quota.credit.add.error.valuerequired": "Please, inform the amount of credits",
+"message.action.quota.credit.add.success": "Successfully added {credit} credits to account \"{account}\"",
 "message.action.quota.tariff.create.error.namerequired": "Please, inform a name for the quota tariff.",
 "message.action.quota.tariff.create.error.usagetyperequired": "Please, select the usage type of the quota tariff.",
 "message.action.quota.tariff.create.error.valuerequired": "Please, inform a value for the quota tariff.",
@@ -3887,6 +3934,7 @@
 "message.public.traffic.in.basic.zone": "Public traffic is generated when Instances in the cloud access the Internet or provide services to clients over the Internet. Publicly accessible IPs must be allocated for this purpose. When a Instance is created, an IP from this set of Public IPs will be allocated to the Instance in addition to the guest IP address. Static 1-1 NAT will be set up automatically between the public IP and the guest IP. End Users can also use the CloudStack UI to acquire additional IPs to implement static NAT between their Instances and the public IP.",
 "message.quota.tariff.create.success": "Successfully created quota tariff \"{quotaTariff}\"",
 "message.quota.tariff.update.success": "Successfully updated quota tariff \"{quotaTariff}\"",
+"message.quota.usage.resource.warn": "Resources that are tagged as <untraceable> do not have constant metadata (if removed, the data is deleted) and cannot be retrieved.",
 "message.read.accept.license.agreements": "Please read and accept the terms for the license agreements.",
 "message.read.admin.guide.scaling.up": "Please read the dynamic scaling section in the admin guide before scaling up.",
 "message.recover.vm": "Please confirm that you would like to recover this Instance.",
@@ -3921,6 +3969,7 @@
 "message.remove.sticky.policy.processing": "Removing sticky policy...",
 "message.remove.vpc": "Please confirm that you want to remove the VPC",
 "message.request.failed": "Request failed.",
+  "message.request.no.data": "There is no data to show.",
 "message.required.add.least.ip": "Please add at least 1 IP Range",
 "message.required.traffic.type": "All required traffic types should be added and with multiple physical networks each traffic type should have a label.",
 "message.required.tagged.physical.network": "There can only be one untagged physical network with guest traffic type.",
@@ -4221,6 +4270,9 @@
 "message.upload.iso.failed.description": "Failed to upload ISO.",
 "message.upload.template.failed.description": "Failed to upload Template",
 "message.upload.volume.failed": "Volume upload failed",
+"message.ssvm.cert.untrusted": "Unable to reach the upload server.",
+"message.ssvm.cert.trust.instructions": "The upload server may be using a self-signed or untrusted certificate. Click 'Open Certificate Page' to open the server in a new browser tab, accept the certificate warning, then return here and click 'Retry Upload'. If the server remains unreachable, contact your administrator.",
+"message.ssvm.unreachable.retry": "The upload server is still unreachable. If it uses a self-signed certificate, please accept it in the opened tab and try again.",
 "message.user.not.permitted.api": "User is not permitted to use the API",
 "message.validate.equalto": "Please enter the same value again.",
 "message.validate.max": "Please enter a value less than or equal to {0}.",
@@ -4300,6 +4352,8 @@
 "message.validate.min": "Please enter a value greater than or equal to {0}.",
 "message.action.delete.object.storage": "Please confirm that you want to delete this Object Store",
 "message.action.unregister.extension.resource": "Please confirm that you want to unregister extension with this resource",
+"message.action.update.extension.resource": "Update the extension resource registration details",
+"message.success.update.extension.resource": "Successfully updated extension resource registration",
 "message.bgp.peers.null": "Please note, if no BGP peers are selected, the VR will connect to <br> (1) dedicated BGP peers the owner can access, if the owner has dedicated BGP peers and account setting use.system.bgp.peers is set to false; <br> (2) all BGP peers the owner can access, otherwise.<br>",
 "message.bucket.delete": "Please confirm that you want to delete this Bucket",
 "migrate.from": "Migrate from",
@@ -4308,6 +4362,8 @@
 "placeholder.dns.record.name": "e.g. www",
 "placeholder.dns.record.type": "Select record type",
 "placeholder.dns.record.contents": "Type a value and hit Enter",
+"placeholder.quota.credit.add.min_balance": "Account's minimum balance",
+"placeholder.quota.credit.add.value": "Amount of credits",
 "placeholder.quota.tariff.activationrule": "Quota tariff's activation rule",
 "placeholder.quota.tariff.description": "Quota tariff's description",
 "placeholder.quota.tariff.enddate": "Quota tariff's end date",
diff --git a/ui/public/locales/pt_BR.json b/ui/public/locales/pt_BR.json
index a022769a5b0f..b3eae6eb11ce 100644
--- a/ui/public/locales/pt_BR.json
+++ b/ui/public/locales/pt_BR.json
@@ -236,6 +236,7 @@
 "label.action.vmstoragesnapshot.create": "Criar snapshot de volume da VM",
 "label.actions": "A\u00e7\u00f5es",
 "label.active": "Ativo",
+"label.activeaccounts": "Contas ativas",
 "label.activate.project": "Ativar projeto",
 "label.activeviewersessions": "Sess\u00f5es ativas",
 "label.add": "Adicionar",
@@ -435,6 +436,7 @@
 "label.back": "Voltar",
 "label.backup": "Backup",
 "label.backups": "Backups",
+"label.backup.isolated": "Isolado",
 "label.back.login": "Voltar à página de login",
 "label.backedup": "Salvo",
 "label.backingup": "Salvando",
@@ -443,6 +445,8 @@
 "label.backup.storage": "Armazenamento de backup",
 "label.backupstoragelimit": "Limite de armazenamento de backup (GiB)",
 "label.backup.configure.schedule": "Configurar Agendamento de Backup",
+"label.backup.chain.finish": "Finalizar cadeia de backup",
+"label.backupchainsize": "Tamanho da cadeia de backup",
 "label.backup.offering.assign": "Atribuir VM a oferta de backup",
 "label.backup.offering.remove": "Remover VM de oferta de backup",
 "label.backup.offerings": "Ofertas de backup",
@@ -558,7 +562,9 @@
 "label.communities": "Comunidades",
 "label.community": "Comunidade",
 "label.complete": "Complete",
+"label.compress": "Comprimir",
 "label.compressionstatus": "Estado de compress\u00e3o",
+"label.compressionlibrary": "Biblioteca de compress\u00e3o",
 "label.compute": "Computa\u00e7\u00e3o",
 "label.compute.offerings": "Oferta de computa\u00e7\u00e3o",
 "label.compute.offering.for.sharedfs.instance": "Oferta de computa\u00e7\u00e3o para Inst\u00e2ncia",
@@ -606,6 +612,7 @@
 "label.consoleproxy": "Console proxy",
 "label.console.proxy": "Console proxy",
 "label.console.proxy.vm": "VM da console proxy",
+"label.consumption": "Consumo",
 "label.continue": "Continuar",
 "label.continue.install": "Continuar com a instala\u00e7\u00e3o",
 "label.controlnodes": "Controlar nodos",
@@ -637,6 +644,7 @@
 "label.create.account": "Criar conta",
 "label.create.asnrange": "Criar faixa de número AS",
 "label.create.backup": "Iniciar backup",
+"label.create.backup.offering": "Criar oferta de backup",
 "label.create.bucket": "Criar Bucket",
 "label.create.instance": "Criar inst\u00e2ncia na nuvem",
 "label.create.instance.from.backup": "Criar nova inst\u00e2ncia a partir de backup",
@@ -667,6 +675,8 @@
 "label.creating": "Criando",
 "label.creating.iprange": "Criando intervalos de IP",
 "label.credit": "Cr\u00e9dito",
+"label.credits": "Cr\u00e9ditos",
+"label.creditor": "Credor",
 "label.cron": "Express\u00e3o Cron",
 "label.cron.mode": "Modo Cron",
 "label.crosszones": "Inter zonas",
@@ -939,7 +949,8 @@
 "label.egress.rules": "Regras de sa\u00edda",
 "label.egressdefaultpolicy": "Pol\u00edtica padr\u00e3o de egress\u00e3o",
 "label.elastic": "El\u00e1stico",
-"label.email": "Email",
+"label.email": "E-mail",
+"label.emailtemplate": "Template de e-mail",
 "label.enable.host": "Habilita host",
 "label.enable.network.offering": "Habilita oferta de rede",
 "label.enable.oauth": "Ativar Login OAuth",
@@ -1490,7 +1501,7 @@
 "label.migrate.instance.single.storage": "Migrar todo(s) o(s) volume(s) da Inst\u00e2ncia para um \u00fanico armazenamento prim\u00e1rio",
 "label.migrate.instance.specific.storages": "Migrar volume(s) da Inst\u00e2ncia para armazenamentos prim\u00e1rios espec\u00edficos",
 "label.migrate.with.storage": "Migrar com armazenamento",
-"label.min_balance": "Saldo m\u00edn",
+"label.min_balance": "Saldo m\u00ednimo",
 "label.minimumsemanticversion": "Vers\u00e3o sem\u00e2ntica m\u00ednima",
 "label.minmembers": "M\u00edn membros",
 "label.minorsequence": "Sequ\u00eancia Menor",
@@ -1830,33 +1841,50 @@
 "label.purpose": "Prop\u00f3sito",
 "label.qostype": "Tipo de QoS",
 "label.queued": "Enfileirado",
+"label.quickrestore": "Restaura\u00E7\u00e3o R\u00e1pida",
 "label.quickview": "Visualiza\u00e7\u00e3o r\u00e1pida",
 "label.quiescevm": "Quiesce VM",
 "label.quiettime": "Tempo em espera (em seg)",
 "label.quota": "Cota",
 "label.quota.add.credits": "Adicionar cr\u00e9ditos",
 "label.quota.configuration": "Configura\u00e7\u00e3o da cota",
-"label.quota.credits": "Cr\u00e9ditos",
-"label.quota.email.edit": "Editar template de email",
+"label.quota.consumed": "Cota consumida",
+"label.quota.current.balance": "Saldo atual",
+"label.quota.email.edit": "Editar template de e-mail",
+"label.quota.filter.period": "Filtrando dados entre <b>{startDate}</b> e <b>{endDate}</b>",
+"label.quota.last.balance": "Hor\u00e1rio do \u00faltimo balan\u00e7o do dia",
+"label.quota.period.today": "Hoje",
+"label.quota.period.this.week": "Essa semana",
+"label.quota.period.this.month": "Esse m\u00eas",
+"label.quota.period.last.month": "M\u00eas passado",
+"label.quota.period.this.year": "Esse ano",
+"label.quota.period.last.year": "Ano passado",
+"label.quota.period.custom": "Personalizado",
 "label.quota.enforce": "Impor cota",
+"label.quota.select.period": "Selecione um per\u00edodo",
 "label.quota.statement": "Demonstrativo",
-"label.quota.statement.balance": "Saldo",
-"label.quota.statement.quota": "Utiliza\u00e7\u00e3o",
+"label.quota.statement.history": "Hist\u00f3rico (n\u00e3o-cumulativo)",
+"label.quota.statement.cumulative.history": "Hist\u00f3rico (cumulativo)",
 "label.quota.statement.tariff": "Tarifa",
 "label.quota.summary": "Relat\u00f3rios",
-"label.quotastate": "Estado da cota",
+"label.quotastate": "Estado do Quota",
 "label.quota_enforce": "Impor Cota",
 "label.summary": "Sum\u00e1rio",
 "label.quota.tariff": "Tarifa",
 "label.quota.tariff.activationrule": "Regra de ativa\u00e7\u00e3o",
 "label.quota.tariff.effectivedate": "Data efetiva",
+"label.quota.tariff.hasactivationrule": "Possui regra de ativa\u00e7\u00e3o?",
 "label.quota.tariff.position": "Posi\u00e7\u00e3o",
 "label.quota.tariff.value": "Valor",
 "label.quota.total": "Total",
+"label.quota.total.consumption": "Consumo total",
 "label.quota.type.name": "Tipo de uso",
 "label.quota.type.unit": "Unidade do uso",
 "label.action.update.object.storage" : "Atualizar Object Storage",
 "label.quota.usage": "Consumo da cota",
+"label.quota.usage.types.summary": "Sum\u00e1rio dos tipos",
+"label.quota.usage.resources.by.type": "Recursos por tipo",
+"label.quota.usage.details.by.resource": "Detalhes por recurso",
 "label.quota.validate.activation.rule": "Validar regra de ativa\u00e7\u00e3o",
 "label.quota.value": "Valor",
 "label.rados.monitor": "Monitor RADOS",
@@ -2298,14 +2326,12 @@
 "label.tagged": "Etiquetado",
 "label.tags": "Etiquetas",
 "label.target.iqn": "IQN alvo",
-"label.tariffactions": "A\u00e7\u00f5es",
-"label.tariffvalue": "Valor da tarifa",
 "label.tcp": "TCP",
 "label.tcp.proxy": "TCP proxy",
 "label.template": "Template",
 "label.template.select.existing": "Selecione um template existente",
 "label.template.temporary.import": "Utilize um template tempor\u00e1rio para importar",
-"label.templatebody": "Corpo do email",
+"label.templatebody": "Corpo do e-mail",
 "label.templatefileupload": "Arquivo local",
 "label.templateid": "Selecione um template",
 "label.templateiso": "Template/ISO",
@@ -2492,6 +2518,9 @@
 "label.utilization": "Utiliza\u00e7\u00e3o",
 "label.uuid": "ID",
 "label.value": "Valor",
+"label.validate": "Validar",
+"label.validationstatus": "Estado de valida\u00E7\u00E3o",
+"label.validationsteps": "Passos de valida\u00E7\u00E3o",
 "label.vcenter": "vcenter",
 "label.vcenter.datacenter": "Datacenter vCenter",
 "label.vcenter.datastore": "Datastore vCenter",
@@ -2750,6 +2779,10 @@
 "message.action.primary.storage.scope.cluster": "Por favor, confirme que voc\u00ea deseja alterar o escopo de zona para o cluster especificado.<br>Esta opera\u00e7\u00e3o atualizar\u00e1 o banco de dados e desconectar\u00e1 o pool de armazenamento de todos os hosts que estavam conectados anteriormente ao armazenamento prim\u00e1rio e n\u00e3o fazem parte do cluster especificado.",
 "message.action.primary.storage.scope.zone": "Por favor, confirme que voc\u00ea deseja alterar o escopo de cluster para zona.<br>Esta opera\u00e7\u00e3o atualizar\u00e1 o banco de dados e conectar\u00e1 o pool de armazenamento a todos os hosts da zona executando o mesmo hypervisor definido no pool de armazenamento.",
 "message.action.primarystorage.enable.maintenance.mode": "Aviso: colocar o armazenamento prim\u00e1rio em modo de manuten\u00e7\u00e3o ir\u00e1 causar a parada de todas as VMs hospedadas nesta unidade. Deseja continuar?",
+"message.action.quota.credit.add.error.accountrequired": "Por favor, informe a conta",
+"message.action.quota.credit.add.error.domainidrequired": "Por favor, informe o dom\u00ednio",
+"message.action.quota.credit.add.error.valuerequired": "Por favor, informe a quantidade de cr\u00e9ditos",
+"message.action.quota.credit.add.success": "{credit} cr\u00e9ditos adicionados para a conta \"{account}\"",
 "message.action.quota.tariff.create.error.namerequired": "Por favor, informe o nome da tarifa.",
 "message.action.quota.tariff.create.error.usagetyperequired": "Por favor, selecione o tipo da tarifa.",
 "message.action.quota.tariff.create.error.valuerequired": "Por favor, informe o valor da tarifa.",
@@ -3408,6 +3441,7 @@
 "message.public.traffic.in.basic.zone": "O tr\u00e1fego p\u00fablico \u00e9 gerado quando as VMs na nuvem acessam a internet ou prestam servi\u00e7os aos clientes atrav\u00e9s da internet. Os IPs acess\u00edveis ao p\u00fablico devem ser alocados para essa finalidade. Quando uma inst\u00e2ncia \u00e9 criada, um IP a partir deste conjunto de IPs P\u00fablicos ser\u00e3o destinados \u00e0 inst\u00e2ncia, al\u00e9m do endere\u00e7o IP guest. Um NAT est\u00e1tico 1-1 ser\u00e1 criada automaticamente entre o IP p\u00fablico e IP guest. Os usu\u00e1rios finais tamb\u00e9m podem usar a interface de usu\u00e1rio CloudStack para adquirir IPs adicionais afim de se implementar NAT est\u00e1tico entre suas inst\u00e2ncias e o IP p\u00fablico.",
 "message.quota.tariff.create.success": "Tarifa \"{quotaTariff}\" criada com sucesso",
 "message.quota.tariff.update.success": "Tarifa \"{quotaTariff}\" atualizada com sucesso",
+"message.quota.usage.resource.warn": "Recursos que s\u00e3o marcados como <untraceable> n\u00e3o possuem metadados constantes (se removido, o dado \u00e9 completamente deletado) e n\u00e3o podem ser retornados.",
 "message.read.accept.license.agreements": "Leia e aceite os termos dos contratos de licen\u00e7a.",
 "message.read.admin.guide.scaling.up": "Por favor leia a sess\u00e3o sobre escalonamento din\u00e2mico no guia do administrador antes de escalonar.",
 "message.recover.vm": "Por favor, confirme a recupera\u00e7\u00e3o desta VM.",
@@ -3442,6 +3476,7 @@
 "message.remove.sticky.policy.processing": "Removendo sticky policy",
 "message.remove.vpc": "Favor confirmar que voc\u00ea deseja remover a VPC",
 "message.request.failed": "Falha na solicita\u00e7\u00e3o",
+"message.request.no.data": "N\u00e3o h\u00e1 dados para mostrar.",
 "message.required.add.least.ip": "Por favor, adicionar pelo menos UM intervalo IP",
 "message.required.tagged.physical.network": "S\u00f3 pode haver uma rede f\u00edsica n\u00e3o marcada com tipo de tr\u00e1fego convidado.",
 "message.required.traffic.type": "Erro na configura\u00e7\u00e3o! Todos os tipos de tr\u00e1fego necess\u00e1rios devem ser adicionados e com m\u00faltiplas redes f\u00edsicas cada rede deve ter uma etiqueta.",
@@ -3773,6 +3808,8 @@
 "migrate.from": "Migrar de",
 "migrate.to": "Migrar para",
 "migrationPolicy": "Pol\u00edtica de migra\u00e7\u00e3o",
+"placeholder.quota.credit.add.min_balance": "Saldo m\u00ednimo",
+"placeholder.quota.credit.add.value": "Quantidade de cr\u00e9ditos",
 "placeholder.quota.tariff.activationrule": "Regra de ativa\u00e7\u00e3o",
 "placeholder.quota.tariff.description": "Descri\u00e7\u00e3o",
 "placeholder.quota.tariff.enddate": "Data de t\u00e9rmino",
diff --git a/ui/src/api/index.js b/ui/src/api/index.js
index 5ec73a0b20e1..7959947a053a 100644
--- a/ui/src/api/index.js
+++ b/ui/src/api/index.js
@@ -33,6 +33,7 @@ const additionalGetAPICommandsList = [
   'quotatarifflist',
   'quotaisenabled',
   'quotastatement',
+  'quotaemailtemplatelist',
   'verifyoauthcodeandgetuser'
 ]
 
diff --git a/ui/src/components/view/DetailsTab.vue b/ui/src/components/view/DetailsTab.vue
index ff8258b8138d..3119e4d57545 100644
--- a/ui/src/components/view/DetailsTab.vue
+++ b/ui/src/components/view/DetailsTab.vue
@@ -100,6 +100,9 @@
           <div v-else-if="['created', 'sent', 'lastannotated', 'collectiontime', 'lastboottime', 'lastserverstart', 'lastserverstop', 'removed', 'effectiveDate', 'endDate', 'startdate', 'enddate'].includes(item)">
             {{ $toLocaleDate(dataResource[item]) }}
           </div>
+          <code-highlight v-else-if="['activationRule'].includes(item)" language="javascript">
+            {{ dataResource[item] }}
+          </code-highlight>
           <div style="white-space: pre-wrap;" v-else-if="$route.meta.name === 'quotatariff' && item === 'description'">{{ dataResource[item] }}</div>
           <div v-else-if="$route.meta.name === 'userdata' && item === 'userdata'">
             <div style="white-space: pre-wrap;"> {{ decodeUserData(dataResource.userdata)}} </div>
@@ -147,6 +150,21 @@
           <div v-else>{{ dataResource[item] }}</div>
         </div>
       </a-list-item>
+      <a-list-item v-else-if="item === 'secretkey' && dataResource[item]">
+        <div>
+          <strong>{{ $t('label.secretkey') }}</strong>
+          <tooltip-button
+            tooltipPlacement="right"
+            :tooltip="$t('label.copy') + ' ' + $t('label.secretkey')"
+            icon="CopyOutlined"
+            type="dashed"
+            size="small"
+            @onClick="$message.success($t('label.copied.clipboard'))"
+            :copyResource="dataResource[item]" />
+          <br/>
+          <div>{{ dataResource[item].substring(0, 20) }}...</div>
+        </div>
+      </a-list-item>
       <a-list-item v-else-if="item === 'ip6address' && ipV6Address && ipV6Address.length > 0">
         <div>
           <strong>{{ $t('label.' + String(item).toLowerCase()) }}</strong>
@@ -214,6 +232,19 @@
           <div>{{ dataResource[item] }}</div>
         </div>
       </a-list-item>
+      <div v-else-if="item === 'backupofferingdetails'">
+        <a-list-item
+          v-for="(value, key) in dataResource[item]"
+          :key="key">
+          <div>
+            <strong>{{ $t('label.' + String(key).toLowerCase()) }}</strong>
+            <br/>
+            <div>
+              {{ value }}
+            </div>
+          </div>
+        </a-list-item>
+      </div>
       <external-configuration-details
         v-else-if="item === 'externaldetails' && (['host', 'computeoffering'].includes($route.meta.name) || (['cluster'].includes($route.meta.name) && dataResource.extensionid))"
         :resource="dataResource" />
@@ -230,7 +261,10 @@ import HostInfo from '@/views/infra/HostInfo'
 import VmwareData from './VmwareData'
 import ObjectListTable from '@/components/view/ObjectListTable'
 import ExternalConfigurationDetails from '@/views/extension/ExternalConfigurationDetails'
+import TooltipButton from '@/components/widgets/TooltipButton'
 import { genericCompare } from '@/utils/sort'
+import CodeHighlight from 'vue-code-highlight/src/CodeHighlight.vue'
+import 'vue-code-highlight/themes/prism-okaidia.css'
 
 export default {
   name: 'DetailsTab',
@@ -239,7 +273,9 @@ export default {
     HostInfo,
     VmwareData,
     ObjectListTable,
-    ExternalConfigurationDetails
+    ExternalConfigurationDetails,
+    TooltipButton,
+    CodeHighlight
   },
   props: {
     resource: {
@@ -277,7 +313,7 @@ export default {
   },
   computed: {
     customDisplayItems () {
-      var items = ['ip4routes', 'ip6routes', 'privatemtu', 'publicmtu', 'provider', 'details', 'parameters']
+      var items = ['ip4routes', 'ip6routes', 'privatemtu', 'publicmtu', 'provider', 'details', 'parameters', 'secretkey', 'backupofferingdetails']
       if (this.$route.meta.name === 'webhookdeliveries') {
         items.push('startdate')
         items.push('enddate')
diff --git a/ui/src/components/view/InfoCard.vue b/ui/src/components/view/InfoCard.vue
index ba7ff0dc27bb..45ba348e4edf 100644
--- a/ui/src/components/view/InfoCard.vue
+++ b/ui/src/components/view/InfoCard.vue
@@ -548,7 +548,7 @@
                 </span>
                 <project-outlined v-else />
                 <router-link v-if="!isStatic && resource.projectid" :to="{ path: '/project/' + resource.projectid }">{{ resource.project || resource.projectname || resource.projectid }}</router-link>
-                <router-link v-else :to="{ path: '/project', query: { name: resource.projectname }}">{{ resource.projectname }}</router-link>
+                <span v-else>{{ resource.projectname || resource.projectid }}</span>
               </div>
             </div>
 
@@ -887,6 +887,18 @@
                 <span v-else>{{ resource.domain || resource.domainid }}</span>
               </div>
             </div>
+            <div class="resource-detail-item" v-if="resource.currency">
+              <div class="resource-detail-item__label">{{ $t('label.currency') }}</div>
+              <div class="resource-detail-item__details">
+                <span>{{ resource.currency }}</span>
+              </div>
+            </div>
+            <div class="resource-detail-item" v-if="resource.balance">
+              <div class="resource-detail-item__label">{{ $t('label.quota.current.balance') }}</div>
+              <div class="resource-detail-item__details">
+                <span>{{ resource.balance }}</span>
+              </div>
+            </div>
             <div class="resource-detail-item" v-if="resource.payloadurl">
               <div class="resource-detail-item__label">{{ $t('label.payloadurl') }}</div>
               <div class="resource-detail-item__details">
diff --git a/ui/src/components/view/ListView.vue b/ui/src/components/view/ListView.vue
index 37abd43e46c7..9272617900f1 100644
--- a/ui/src/components/view/ListView.vue
+++ b/ui/src/components/view/ListView.vue
@@ -205,7 +205,7 @@
         </span>
       </template>
       <template v-if="column.key === 'templatetype'">
-        <span>{{ text }}</span>
+        <router-link :to="{ path: $route.path + '/' + record.templatetype }">{{ text }}</router-link>
       </template>
       <template v-if="$route.path.startsWith('/dnsserver') && !['name', 'provider', 'state', 'ispublic'].includes(column.key)">
         <span>{{ text }}</span>
@@ -483,6 +483,12 @@
           displayText
         />
       </template>
+      <template v-if="column.key === 'compressionstatus'">
+        <status :text="text ? text : $t('label.unknown')" displayText />
+      </template>
+      <template v-if="column.key === 'validationstatus'">
+        <status :text="text ? text : $t('label.unknown')" displayText />
+      </template>
       <template v-if="column.key === 'allocationstate'">
         <status
           :text="text ? text : ''"
@@ -684,20 +690,24 @@
             </span>
           </template>
         </template>
-        <template v-if="text && !text.startsWith('PrjAcct-')">
-          <router-link
-            v-if="'quota' in record && $router.resolve(`${$route.path}/${record.account}`).matched[0].redirect !== '/exception/404'"
-            :to="{ path: `${$route.path}/${record.account}`, query: { account: record.account, domainid: record.domainid, quota: true } }"
-          >{{ text }}</router-link>
-          <router-link
-            :to="{ path: '/account/' + record.accountid }"
-            v-else-if="record.accountid"
-          >{{ text }}</router-link>
-          <router-link
-            :to="{ path: '/account', query: { name: record.account, domainid: record.domainid, dataView: true } }"
-            v-else-if="$store.getters.userInfo.roletype !== 'User'"
-          >{{ text }}</router-link>
-          <span v-else>{{ text }}</span>
+        <template v-if="text">
+          <template v-if="!text.startsWith('PrjAcct-')">
+            <router-link
+              v-if="$route.path.startsWith('/quotasummary')"
+              :to="{ path: `${$route.path}/${record.accountid}` }">{{ text }}</router-link>
+            <router-link v-else-if="record.accountid" :to="{ path: '/account/' + record.accountid }">{{ text }}</router-link>
+            <router-link
+              v-else-if="$store.getters.userInfo.roletype !== 'User'"
+              :to="{ path: '/account', query: { name: record.account, domainid: record.domainid, dataView: true } }">
+              {{ text }}
+            </router-link>
+            <span v-else>{{ text }}</span>
+          </template>
+          <template v-else-if="$route.path.startsWith('/quotasummary')">
+            <router-link :to="{ path: `${$route.path}/${record.accountid}` }">
+              {{ (record.projectname || record.account).concat(' (').concat($t('label.project')).concat(')') }}
+            </router-link>
+          </template>
         </template>
       </template>
       <template v-if="column.key === 'resource'">
@@ -1037,16 +1047,6 @@
         />
         <slot></slot>
       </template>
-      <template v-if="column.key === 'tariffActions'">
-        <tooltip-button
-          :tooltip="$t('label.edit')"
-          v-if="editableValueKey !== record.key"
-          :disabled="!('quotaTariffUpdate' in $store.getters.apis)"
-          icon="edit-outlined"
-          @onClick="editTariffValue(record)"
-        />
-        <slot></slot>
-      </template>
       <template v-if="column.key === 'scheduleActions'">
         <slot
           name="scheduleActions"
@@ -1228,8 +1228,8 @@ export default {
         'vmsnapshot', 'backup', 'guestnetwork', 'vpc', 'publicip', 'vpnuser', 'vpncustomergateway', 'vnfapp',
         'project', 'account', 'systemvm', 'router', 'computeoffering', 'systemoffering',
         'diskoffering', 'backupoffering', 'networkoffering', 'vpcoffering', 'ilbvm', 'kubernetes', 'comment', 'buckets',
-        'webhook', 'webhookdeliveries', 'sharedfs', 'ipv4subnets', 'asnumbers', 'guestos', 'gpucard', 'gpudevices', 'vgpuprofile'
-      ].includes(this.$route.name)
+        'webhook', 'webhookdeliveries', 'sharedfs', 'ipv4subnets', 'asnumbers', 'guestos', 'gpucard', 'gpudevices', 'vgpuprofile',
+        'quotatariff'].includes(this.$route.name)
     },
     getDateAtTimeZone (date, timezone) {
       return date ? moment(date).tz(timezone).format('YYYY-MM-DD HH:mm:ss') : null
@@ -1395,9 +1395,6 @@ export default {
       data.push(data.splice(index, 1)[0])
       this.updateOrder(data)
     },
-    editTariffValue (record) {
-      this.$emit('edit-tariff-action', true, record)
-    },
     ipV6Address (text, record) {
       if (!record || !record.nic || record.nic.length === 0) {
         return ''
diff --git a/ui/src/components/view/buttons/ExportToCsvButton.vue b/ui/src/components/view/buttons/ExportToCsvButton.vue
new file mode 100644
index 000000000000..cc084bdf1397
--- /dev/null
+++ b/ui/src/components/view/buttons/ExportToCsvButton.vue
@@ -0,0 +1,43 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+<template>
+  <a-button type="dashed" @click="action" class="w-100 mb-10 mt-10">
+    <download-outlined />
+    {{ $t(label) }}
+  </a-button>
+</template>
+
+<script>
+export default {
+  name: 'ExportToCsvButton',
+  props: {
+    action: {
+      type: Function,
+      required: true
+    },
+    label: {
+      type: String,
+      default: 'label.export.data.csv'
+    }
+  }
+}
+</script>
+
+<style lang="scss" scoped>
+@import '@/style/common/common.scss';
+</style>
diff --git a/ui/src/components/view/charts/BarChart.vue b/ui/src/components/view/charts/BarChart.vue
new file mode 100644
index 000000000000..a27069163d35
--- /dev/null
+++ b/ui/src/components/view/charts/BarChart.vue
@@ -0,0 +1,56 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+<template>
+  <bar
+    :chart-options="chartOptions"
+    :chart-data="chartData"
+    :width="chartWidth"
+    :height="chartHeight"
+  />
+</template>
+
+<script>
+import { Bar } from 'vue-chartjs'
+import { Chart as ChartJS, Title, Tooltip, Legend, BarElement, CategoryScale, TimeScale, LinearScale } from 'chart.js'
+import 'chartjs-adapter-moment'
+
+ChartJS.register(Title, Tooltip, Legend, BarElement, CategoryScale, TimeScale, LinearScale)
+
+export default {
+  name: 'BarChart',
+  components: { Bar },
+  props: {
+    chartData: {
+      type: Object,
+      required: true
+    },
+    chartOptions: {
+      type: Object,
+      required: true
+    },
+    chartWidth: {
+      type: Number,
+      default: 1024
+    },
+    chartHeight: {
+      type: Number,
+      default: 300
+    }
+  }
+}
+</script>
diff --git a/ui/src/components/view/stats/ResourceStatsLineChart.vue b/ui/src/components/view/stats/ResourceStatsLineChart.vue
index 399e77bebd46..f1afbefd155d 100644
--- a/ui/src/components/view/stats/ResourceStatsLineChart.vue
+++ b/ui/src/components/view/stats/ResourceStatsLineChart.vue
@@ -217,7 +217,7 @@ export default {
             data: element.data.map(d => d.stat),
             hidden: this.hideLine(element.data.map(d => d.stat)),
             pointRadius: element.pointRadius,
-            fill: 'origin'
+            fill: element.fill || 'origin'
           }
         )
       }
diff --git a/ui/src/components/widgets/Status.vue b/ui/src/components/widgets/Status.vue
index 1f6a1183e4a4..3b078b5fe3e3 100644
--- a/ui/src/components/widgets/Status.vue
+++ b/ui/src/components/widgets/Status.vue
@@ -153,6 +153,8 @@ export default {
         case 'primary':
         case 'managed':
         case 'yes':
+        case 'compressed':
+        case 'valid':
           status = 'success'
           break
         case 'alert':
@@ -169,6 +171,9 @@ export default {
         case 'failed':
         case 'unmanaged':
         case 'no':
+        case 'notvalid':
+        case 'unabletovalidate':
+        case 'compressionerror':
           status = 'error'
           break
         case 'migrating':
@@ -177,6 +182,8 @@ export default {
         case 'stopping':
         case 'upgrading':
         case 'inprogress':
+        case 'validating':
+        case 'compressing':
           status = 'processing'
           break
         case 'allocated':
@@ -193,6 +200,7 @@ export default {
         case 'warning':
         case 'backup':
         case 'partiallyallocated':
+        case 'uncompressed':
           status = 'warning'
           break
       }
diff --git a/ui/src/config/router.js b/ui/src/config/router.js
index a48c3fef81e3..b9c60bcd0c21 100644
--- a/ui/src/config/router.js
+++ b/ui/src/config/router.js
@@ -218,9 +218,9 @@ export function asyncRouterMap () {
 
       generateRouterMap(compute),
       generateRouterMap(storage),
-      generateRouterMap(kms),
       generateRouterMap(network),
       generateRouterMap(image),
+      generateRouterMap(kms),
       generateRouterMap(event),
       generateRouterMap(project),
       generateRouterMap(user),
diff --git a/ui/src/config/section/compute.js b/ui/src/config/section/compute.js
index 9262664d448e..b6e83b5eb438 100644
--- a/ui/src/config/section/compute.js
+++ b/ui/src/config/section/compute.js
@@ -301,6 +301,21 @@ export default {
             }
           }
         },
+        {
+          api: 'finishBackupChain',
+          icon: 'vertical-align-middle-outlined',
+          label: 'label.backup.chain.finish',
+          dataView: true,
+          args: ['virtualmachineid'],
+          show: (record) => {
+            return ['Running', 'Stopped', 'BackupError'].includes(record.state) && record.backupofferingid && record.backupprovider === 'kboss'
+          },
+          mapping: {
+            virtualmachineid: {
+              value: (record, params) => { return record.id }
+            }
+          }
+        },
         {
           api: 'attachIso',
           icon: 'paper-clip-outlined',
diff --git a/ui/src/config/section/config.js b/ui/src/config/section/config.js
index 2a83b25c002f..a2c12ce236ac 100644
--- a/ui/src/config/section/config.js
+++ b/ui/src/config/section/config.js
@@ -79,8 +79,8 @@ export default {
       icon: 'login-outlined',
       docHelp: 'adminguide/accounts.html#using-an-ldap-server-for-user-authentication',
       permission: ['listOauthProvider'],
-      columns: ['provider', 'enabled', 'description', 'clientid', 'secretkey', 'redirecturi'],
-      details: ['provider', 'description', 'enabled', 'clientid', 'secretkey', 'redirecturi', 'authorizeurl', 'tokenurl'],
+      columns: ['provider', 'enabled', 'description', 'clientid', 'redirecturi', 'domainpath'],
+      details: ['provider', 'description', 'enabled', 'clientid', 'secretkey', 'redirecturi', 'authorizeurl', 'tokenurl', 'domainpath'],
       actions: [
         {
           api: 'registerOauthProvider',
@@ -89,7 +89,7 @@ export default {
           listView: true,
           dataView: false,
           args: [
-            'provider', 'description', 'clientid', 'redirecturi', 'secretkey', 'authorizeurl', 'tokenurl'
+            'provider', 'description', 'clientid', 'redirecturi', 'secretkey', 'authorizeurl', 'tokenurl', 'domainid'
           ],
           mapping: {
             provider: {
@@ -103,7 +103,7 @@ export default {
           label: 'label.edit',
           dataView: true,
           popup: true,
-          args: ['description', 'clientid', 'redirecturi', 'secretkey', 'authorizeurl', 'tokenurl']
+          args: ['description', 'clientid', 'redirecturi', 'secretkey', 'authorizeurl', 'tokenurl', 'domainid']
         },
         {
           api: 'updateOauthProvider',
diff --git a/ui/src/config/section/extension.js b/ui/src/config/section/extension.js
index 5904abae30b6..8bb3ee362f60 100644
--- a/ui/src/config/section/extension.js
+++ b/ui/src/config/section/extension.js
@@ -45,7 +45,7 @@ export default {
     return fields
   },
   details: ['name', 'description', 'id', 'type', 'details', 'path', 'pathready', 'isuserdefined', 'orchestratorrequirespreparevm', 'reservedresourcedetails', 'created'],
-  filters: ['orchestrator'],
+  filters: ['Orchestrator', 'NetworkOrchestrator'],
   tabs: [{
     name: 'details',
     component: shallowRef(defineAsyncComponent(() => import('@/components/view/DetailsTab.vue')))
diff --git a/ui/src/config/section/infra/phynetworks.js b/ui/src/config/section/infra/phynetworks.js
index 0863eff6ec0b..9b7a0a83f7f3 100644
--- a/ui/src/config/section/infra/phynetworks.js
+++ b/ui/src/config/section/infra/phynetworks.js
@@ -94,7 +94,7 @@ export default {
       icon: 'edit-outlined',
       label: 'label.update.physical.network',
       dataView: true,
-      args: ['vlan', 'tags']
+      args: ['vlan', 'tags', 'externaldetails']
     },
     {
       api: 'addTrafficType',
diff --git a/ui/src/config/section/kms.js b/ui/src/config/section/kms.js
index 648a8064b5c6..3120fee54cc8 100644
--- a/ui/src/config/section/kms.js
+++ b/ui/src/config/section/kms.js
@@ -21,7 +21,7 @@ import store from '@/store'
 export default {
   name: 'kms',
   title: 'label.kms',
-  icon: 'hdd-outlined',
+  icon: 'lock-outlined',
   show: () => {
     return ['Admin'].includes(store.getters.userInfo.roletype) || store.getters.features.hashsmprofiles
   },
diff --git a/ui/src/config/section/network.js b/ui/src/config/section/network.js
index 148b2c0f2496..30608a82a98c 100644
--- a/ui/src/config/section/network.js
+++ b/ui/src/config/section/network.js
@@ -121,6 +121,14 @@ export default {
         name: 'network.permissions',
         component: shallowRef(defineAsyncComponent(() => import('@/views/network/NetworkPermissions.vue'))),
         show: (record, route, user) => { return 'listNetworkPermissions' in store.getters.apis && record.acltype === 'Account' && !('vpcid' in record) && (['Admin', 'DomainAdmin'].includes(user.roletype) || record.account === user.account) && !record.projectid }
+      }, {
+        name: 'custom.actions',
+        component: shallowRef(defineAsyncComponent(() => import('@/views/extension/RunCustomAction.vue'))),
+        show: (record) => {
+          return 'runCustomAction' in store.getters.apis &&
+            'listCustomActions' in store.getters.apis &&
+            record.service && record.service.some(s => s.name === 'CustomAction')
+        }
       },
       {
         name: 'events',
@@ -210,6 +218,19 @@ export default {
             }
           }
         },
+        {
+          api: 'runCustomAction',
+          icon: 'thunderbolt-outlined',
+          label: 'label.run.custom.action',
+          dataView: true,
+          show: (record) => {
+            return 'runCustomAction' in store.getters.apis &&
+              'listCustomActions' in store.getters.apis &&
+              record.service && record.service.some(s => s.name === 'CustomAction')
+          },
+          popup: true,
+          component: shallowRef(defineAsyncComponent(() => import('@/views/extension/RunCustomAction.vue')))
+        },
         {
           api: 'associateDnsZoneToNetwork',
           icon: 'link-outlined',
diff --git a/ui/src/config/section/offering.js b/ui/src/config/section/offering.js
index 9d7b743a70aa..afdf2605a6a8 100644
--- a/ui/src/config/section/offering.js
+++ b/ui/src/config/section/offering.js
@@ -367,7 +367,7 @@ export default {
       permission: ['listBackupOfferings'],
       searchFilters: ['zoneid', 'domainid'],
       columns: ['name', 'description', 'domain', 'zonename'],
-      details: ['name', 'id', 'description', 'externalid', 'domain', 'zone', 'allowuserdrivenbackups', 'created'],
+      details: ['name', 'id', 'description', 'externalid', 'domain', 'zone', 'allowuserdrivenbackups', 'created', 'backupofferingdetails'],
       related: [{
         name: 'vm',
         title: 'label.instances',
@@ -393,6 +393,13 @@ export default {
         listView: true,
         popup: true,
         component: shallowRef(defineAsyncComponent(() => import('@/views/offering/ImportBackupOffering.vue')))
+      }, {
+        api: 'createBackupOffering',
+        icon: 'plus-outlined',
+        label: 'label.create.backup.offering',
+        listView: true,
+        popup: true,
+        component: shallowRef(defineAsyncComponent(() => import('@/views/offering/CreateBackupOffering.vue')))
       }, {
         api: 'updateBackupOffering',
         icon: 'edit-outlined',
diff --git a/ui/src/config/section/plugin/quota.js b/ui/src/config/section/plugin/quota.js
index 630e42e4c042..162fb74f7e75 100644
--- a/ui/src/config/section/plugin/quota.js
+++ b/ui/src/config/section/plugin/quota.js
@@ -30,29 +30,38 @@ export default {
       title: 'label.quota.summary',
       icon: 'bars-outlined',
       permission: ['quotaSummary'],
-      columns: ['account',
+      customParamHandler: (params, query) => { return { ...params, ignoreproject: true } },
+      tabs: [
+        {
+          name: 'consumption',
+          component: shallowRef(defineAsyncComponent(() => import('@/views/plugins/quota/QuotaUsageTab.vue')))
+        },
         {
-          state: (record) => record.state.toLowerCase()
+          name: 'balance',
+          component: shallowRef(defineAsyncComponent(() => import('@/views/plugins/quota/QuotaBalanceTab.vue')))
         },
         {
-          quotastate: (record) => record.quotaenabled ? 'Enabled' : 'Disabled'
-        }, 'domain', 'currency', 'balance'
+          name: 'credits',
+          component: shallowRef(defineAsyncComponent(() => import('@/views/plugins/quota/QuotaCreditTab.vue')))
+        }
       ],
-      columnNames: ['account', 'accountstate', 'quotastate', 'domain', 'currency', 'currentbalance'],
-      details: ['account', 'domain', 'state', 'currency', 'balance', 'quota', 'startdate', 'enddate'],
-      component: shallowRef(() => import('@/views/plugins/quota/QuotaSummary.vue')),
-      tabs: [
+      columns: [
+        'account',
         {
-          name: 'details',
-          component: shallowRef(defineAsyncComponent(() => import('@/components/view/DetailsTab.vue')))
+          field: 'state',
+          customTitle: 'accountState',
+          state: (record) => record.accountremoved || (record.projectid && record.projectremoved) ? 'disabled' : 'enabled'
         },
         {
-          name: 'quota.statement.quota',
-          component: shallowRef(defineAsyncComponent(() => import('@/views/plugins/quota/QuotaUsage.vue')))
+          field: 'quotastate',
+          customTitle: 'quotaState',
+          quotastate: (record) => !record.quotaenabled || record.accountremoved || (record.projectid && record.projectremoved) ? 'disabled' : 'enabled'
         },
+        'domain',
+        'currency',
         {
-          name: 'quota.statement.balance',
-          component: shallowRef(defineAsyncComponent(() => import('@/views/plugins/quota/QuotaBalance.vue')))
+          field: 'balance',
+          customTitle: 'quota.current.balance'
         }
       ],
       actions: [
@@ -61,16 +70,9 @@ export default {
           icon: 'plus-outlined',
           docHelp: 'plugins/quota.html#quota-credits',
           label: 'label.quota.add.credits',
-          dataView: true,
-          args: ['value', 'min_balance', 'quota_enforce'],
-          mapping: {
-            account: {
-              value: (record) => { return record.account }
-            },
-            domainid: {
-              value: (record) => { return record.domainid }
-            }
-          }
+          listView: true,
+          popup: true,
+          component: shallowRef(defineAsyncComponent(() => import('@/views/plugins/quota/AddQuotaCredit.vue')))
         }
       ]
     },
@@ -83,7 +85,7 @@ export default {
       customParamHandler: (params, query) => {
         params.listall = false
 
-        if (['all', 'removed'].includes(query.filter) || params.id) {
+        if (['all', 'removed'].includes(query.filter) || params.uuid) {
           params.listall = true
         }
 
@@ -109,6 +111,11 @@ export default {
           field: 'tariffValue',
           customTitle: 'quota.tariff.value'
         },
+        {
+          field: 'hasActivationRule',
+          customTitle: 'quota.tariff.hasactivationrule',
+          hasActivationRule: (record) => record.activationRule ? i18n.global.t('label.yes') : i18n.global.t('label.no')
+        },
         {
           field: 'executionPosition',
           customTitle: 'quota.tariff.position',
@@ -145,7 +152,11 @@ export default {
           field: 'endDate',
           customTitle: 'end.date'
         },
-        'removed'
+        'removed',
+        {
+          field: 'activationRule',
+          customTitle: 'quota.tariff.activationrule'
+        }
       ],
       filters: ['all', 'active', 'removed'],
       searchFilters: ['usagetype'],
@@ -173,13 +184,16 @@ export default {
           label: 'label.action.quota.tariff.remove',
           message: 'message.action.quota.tariff.remove',
           dataView: true,
-          show: (record) => !record.removed
+          show: (record) => !record.removed,
+          groupAction: true,
+          popup: true,
+          groupMap: (selection) => { return selection.map(x => { return { id: x } }) }
         }
       ]
     },
     {
       name: 'quotaemailtemplate',
-      title: 'label.templatetype',
+      title: 'label.emailtemplate',
       icon: 'mail-outlined',
       permission: ['quotaEmailTemplateList'],
       columns: ['templatetype', 'templatesubject', 'templatebody'],
diff --git a/ui/src/config/section/storage.js b/ui/src/config/section/storage.js
index e3cd875a6b85..702b782690af 100644
--- a/ui/src/config/section/storage.js
+++ b/ui/src/config/section/storage.js
@@ -18,6 +18,7 @@
 import { shallowRef, defineAsyncComponent } from 'vue'
 import store from '@/store'
 import { isZoneCreated } from '@/utils/zone'
+import { isAdmin } from '@/role'
 
 export default {
   name: 'storage',
@@ -492,7 +493,7 @@ export default {
       icon: 'cloud-upload-outlined',
       permission: ['listBackups'],
       params: { listvmdetails: 'true' },
-      columns: ['name', 'status', 'size', 'virtualsize', 'virtualmachinename', 'backupofferingname', 'intervaltype', 'type', 'created', 'account', 'domain', 'zone'],
+      columns: ['name', 'status', 'compressionstatus', 'validationstatus', 'size', 'virtualsize', 'virtualmachinename', 'backupofferingname', 'intervaltype', 'type', 'created', 'account', 'domain', 'zone'],
       details: ['name', 'description', 'virtualmachinename', 'id', 'intervaltype', 'type', 'externalid', 'size', 'virtualsize', 'volumes', 'backupofferingname', 'zone', 'account', 'domain', 'created'],
       searchFilters: () => {
         var filters = ['name', 'zoneid', 'domainid', 'account', 'backupofferingid', 'status']
@@ -516,7 +517,14 @@ export default {
           label: 'label.backup.restore',
           message: 'message.backup.restore',
           dataView: true,
-          show: (record) => { return record.status === 'BackedUp' }
+          show: (record) => { return record.status === 'BackedUp' },
+          args: () => {
+            const fields = ['quickrestore']
+            if (isAdmin()) {
+              fields.push('hostid')
+            }
+            return fields
+          }
         },
         {
           api: 'restoreVolumeFromBackupAndAttachToVM',
diff --git a/ui/src/core/lazy_lib/icons_use.js b/ui/src/core/lazy_lib/icons_use.js
index 502eb5de0b63..43c6f822de31 100644
--- a/ui/src/core/lazy_lib/icons_use.js
+++ b/ui/src/core/lazy_lib/icons_use.js
@@ -183,6 +183,7 @@ import {
   UploadOutlined,
   VerticalAlignBottomOutlined,
   VerticalAlignTopOutlined,
+  VerticalAlignMiddleOutlined,
   WarningOutlined,
   WifiOutlined,
   SolutionOutlined
@@ -358,6 +359,7 @@ export default {
     app.component('UploadOutlined', UploadOutlined)
     app.component('VerticalAlignBottomOutlined', VerticalAlignBottomOutlined)
     app.component('VerticalAlignTopOutlined', VerticalAlignTopOutlined)
+    app.component('VerticalAlignMiddleOutlined', VerticalAlignMiddleOutlined)
     app.component('WarningOutlined', WarningOutlined)
     app.component('WifiOutlined', WifiOutlined)
     app.component('renderIcon', renderIcon)
diff --git a/ui/src/locales/index.js b/ui/src/locales/index.js
index 6933e05206e1..929ed410a6d5 100644
--- a/ui/src/locales/index.js
+++ b/ui/src/locales/index.js
@@ -18,46 +18,54 @@
 import { createI18n } from 'vue-i18n'
 import { vueProps } from '@/vue-app'
 
+const FALLBACK_LANG = 'en'
 const loadedLanguage = []
 const messages = {}
 
 export const i18n = createI18n({
-  locale: 'en',
-  fallbackLocale: 'en',
+  locale: FALLBACK_LANG,
+  fallbackLocale: FALLBACK_LANG,
   silentTranslationWarn: true,
   messages: messages,
   silentFallbackWarn: true,
   warnHtmlInMessage: 'off'
 })
 
-export function loadLanguageAsync (lang) {
-  if (!lang) {
-    const locale = vueProps.$localStorage.get('LOCALE')
-    lang = (!locale || typeof locale === 'object') ? 'en' : locale
+function applyMessages (lang, message) {
+  if (message && Object.keys(message).length > 0) {
+    i18n.global.setLocaleMessage(lang, message)
+    messages[lang] = message
   }
-  if (loadedLanguage.includes(lang)) {
-    return Promise.resolve(setLanguage(lang))
+  if (!loadedLanguage.includes(lang)) {
+    loadedLanguage.push(lang)
   }
+}
 
+function fetchLocale (lang) {
   return fetch(`locales/${lang}.json?ts=${Date.now()}`)
     .then(response => response.json())
-    .then(json => Promise.resolve(setLanguage(lang, json)))
+    .then(json => applyMessages(lang, json))
 }
 
-function setLanguage (lang, message) {
-  if (i18n) {
-    i18n.global.locale = lang
-
-    if (message && Object.keys(message).length > 0) {
-      i18n.global.setLocaleMessage(lang, message)
-    }
+export function loadLanguageAsync (lang) {
+  if (!lang) {
+    const locale = vueProps.$localStorage.get('LOCALE')
+    lang = (!locale || typeof locale === 'object') ? FALLBACK_LANG : locale
   }
 
-  if (!loadedLanguage.includes(lang)) {
-    loadedLanguage.push(lang)
-  }
+  // Always keep the fallback locale's messages loaded so $t() degrades
+  // to readable English instead of raw keys when a translation is missing.
+  const ensureFallback = loadedLanguage.includes(FALLBACK_LANG)
+    ? Promise.resolve()
+    : fetchLocale(FALLBACK_LANG)
 
-  if (message && Object.keys(message).length > 0) {
-    messages[lang] = message
-  }
+  const ensureTarget = (lang === FALLBACK_LANG || loadedLanguage.includes(lang))
+    ? ensureFallback
+    : ensureFallback.then(() => fetchLocale(lang))
+
+  // Activate locale after messages are in place so the first render
+  // already has the translations and avoids a flash of raw keys.
+  return ensureTarget.then(() => {
+    i18n.global.locale = lang
+  })
 }
diff --git a/ui/src/permission.js b/ui/src/permission.js
index a5984245eeba..b0ed66365e68 100644
--- a/ui/src/permission.js
+++ b/ui/src/permission.js
@@ -173,7 +173,7 @@ router.beforeEach((to, from, next) => {
       }
     }
   } else {
-    if (window.location.href.includes('verifyOauth') && to.name === undefined) {
+    if (window.location.search.includes('verifyOauth') && to.name !== 'VerifyOauth') {
       currentURL = new URL(window.location.href)
       urlParams = new URLSearchParams(currentURL.search)
       code = urlParams.get('code')
diff --git a/ui/src/style/common/common.scss b/ui/src/style/common/common.scss
new file mode 100644
index 000000000000..39dcb46457e7
--- /dev/null
+++ b/ui/src/style/common/common.scss
@@ -0,0 +1,37 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+.w-100 {
+  width: 100%;
+}
+
+.mt-10 {
+  margin-top: 10px;
+}
+
+.mb-10 {
+  margin-bottom: 10px;
+}
+
+.m-20-0 {
+  margin: 20px 0;
+}
+
+.dotted-underline {
+  text-decoration: underline dotted;
+  cursor: default;
+}
diff --git a/ui/src/style/vars.less b/ui/src/style/vars.less
index de2d494c878f..133244473e2e 100644
--- a/ui/src/style/vars.less
+++ b/ui/src/style/vars.less
@@ -355,7 +355,7 @@ a {
   text-align: right;
   padding-top: 15px;
 
-  button {
+  button, a.ant-btn {
     margin-right: 5px;
   }
 }
diff --git a/ui/src/utils/chart.js b/ui/src/utils/chart.js
new file mode 100644
index 000000000000..a4e78d896163
--- /dev/null
+++ b/ui/src/utils/chart.js
@@ -0,0 +1,70 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+import { TIME_UNITS } from './units'
+
+export const defaultDisplayFormats = {
+  day: 'DD MMM YYYY',
+  week: 'DD MMM YYYY',
+  month: 'MMM YYYY',
+  quarter: 'MMM YYYY',
+  year: 'YYYY'
+}
+
+export const getUnitToTimeCartesianAxis = (baseUnit, dataLength) => {
+  const maxLabels = 15
+  if (dataLength <= maxLabels) {
+    return baseUnit
+  }
+
+  const units = [
+    'millisecond',
+    'second',
+    'minute',
+    'hour',
+    'day',
+    'week',
+    'month',
+    'quarter',
+    'year'
+  ]
+
+  let index = units.indexOf(baseUnit)
+
+  let unitToReturn = baseUnit
+  if (index >= 0 && index < units.length) {
+    let unitTime = 0
+    for (index; index < units.length; index++) {
+      unitTime = TIME_UNITS[units[index]]
+      const nextUnitTime = TIME_UNITS[units[index + 1]]
+
+      if ((dataLength / (nextUnitTime / unitTime)) <= maxLabels) {
+        return units[index + 1]
+      }
+
+      unitToReturn = units[index]
+    }
+  }
+
+  return unitToReturn
+}
+
+export const getChartColorObject = (hexColor = '#1890FF') => ({
+  backgroundColor: hexColor.concat('80'),
+  borderColor: hexColor,
+  borderWidth: 1.5
+})
diff --git a/ui/src/utils/date.js b/ui/src/utils/date.js
index 216dfde1303b..bd2ea64e32fa 100644
--- a/ui/src/utils/date.js
+++ b/ui/src/utils/date.js
@@ -65,16 +65,21 @@ export function parseDateToDatePicker (value) {
 }
 
 export function toLocalDate ({ date, timezoneoffset = store.getters.timezoneoffset, usebrowsertimezone = store.getters.usebrowsertimezone }) {
-  if (usebrowsertimezone) {
-    // Since GMT+530 is returned as -330 (minutes to GMT)
-    timezoneoffset = new Date().getTimezoneOffset() / -60
-  }
+  timezoneoffset = getTimezoneOffset({ timezoneoffset, usebrowsertimezone })
 
   const milliseconds = Date.parse(date)
   // e.g. "Tue, 08 Jun 2010 19:13:49 GMT"; "Tue, 25 May 2010 12:07:01 UTC"
   return new Date(milliseconds + (timezoneoffset * 60 * 60 * 1000))
 }
 
+export function getTimezoneOffset ({ timezoneoffset = store.getters.timezoneoffset, usebrowsertimezone = store.getters.usebrowsertimezone }) {
+  if (!usebrowsertimezone) {
+    return timezoneoffset
+  }
+  // Since GMT+530 is returned as -330 (mins to GMT)
+  return new Date().getTimezoneOffset() / -60
+}
+
 export function toLocaleDate ({ date, timezoneoffset = store.getters.timezoneoffset, usebrowsertimezone = store.getters.usebrowsertimezone, dateOnly = false, hourOnly = false }) {
   if (!date) {
     return null
diff --git a/ui/src/utils/quota.js b/ui/src/utils/quota.js
index b8adbb93518a..c23deb8d13b1 100644
--- a/ui/src/utils/quota.js
+++ b/ui/src/utils/quota.js
@@ -19,106 +19,135 @@
 export const QUOTA_TYPES = [
   {
     id: 1,
-    type: 'RUNNING_VM'
+    type: 'RUNNING_VM',
+    chartColor: '#1890ff'
   },
   {
     id: 2,
-    type: 'ALLOCATED_VM'
+    type: 'ALLOCATED_VM',
+    chartColor: '#fadb14'
   },
   {
     id: 3,
-    type: 'IP_ADDRESS'
+    type: 'IP_ADDRESS',
+    chartColor: '#ffd6e7'
   },
   {
     id: 4,
-    type: 'NETWORK_BYTES_SENT'
+    type: 'NETWORK_BYTES_SENT',
+    chartColor: '#adc6ff'
   },
   {
     id: 5,
-    type: 'NETWORK_BYTES_RECEIVED'
+    type: 'NETWORK_BYTES_RECEIVED',
+    chartColor: '#10239e'
   },
   {
     id: 6,
-    type: 'VOLUME'
+    type: 'VOLUME',
+    chartColor: '#722ed1'
   },
   {
     id: 7,
-    type: 'TEMPLATE'
+    type: 'TEMPLATE',
+    chartColor: '#08979c'
   },
   {
     id: 8,
-    type: 'ISO'
+    type: 'ISO',
+    chartColor: '#87e8de'
   },
   {
     id: 9,
-    type: 'SNAPSHOT'
+    type: 'SNAPSHOT',
+    chartColor: '#f5222d'
   },
   {
     id: 10,
-    type: 'SECURITY_GROUP'
+    type: 'SECURITY_GROUP',
+    chartColor: '#d46b08'
   },
   {
     id: 11,
-    type: 'LOAD_BALANCER_POLICY'
+    type: 'LOAD_BALANCER_POLICY',
+    chartColor: '#ffd666'
   },
   {
     id: 12,
-    type: 'PORT_FORWARDING_RULE'
+    type: 'PORT_FORWARDING_RULE',
+    chartColor: '#7cb305'
   },
   {
     id: 13,
-    type: 'NETWORK_OFFERING'
+    type: 'NETWORK_OFFERING',
+    chartColor: '#ffbb96'
   },
   {
     id: 14,
-    type: 'VPN_USERS'
+    type: 'VPN_USERS',
+    chartColor: '#95de64'
   },
   {
     id: 21,
-    type: 'VM_DISK_IO_READ'
+    type: 'VM_DISK_IO_READ',
+    chartColor: '#ffe7ba'
   },
   {
     id: 22,
-    type: 'VM_DISK_IO_WRITE'
+    type: 'VM_DISK_IO_WRITE',
+    chartColor: '#5b8c00'
   },
   {
     id: 23,
-    type: 'VM_DISK_BYTES_READ'
+    type: 'VM_DISK_BYTES_READ',
+    chartColor: '#0050b3'
   },
   {
     id: 24,
-    type: 'VM_DISK_BYTES_WRITE'
+    type: 'VM_DISK_BYTES_WRITE',
+    chartColor: '#520339'
   },
   {
     id: 25,
-    type: 'VM_SNAPSHOT'
+    type: 'VM_SNAPSHOT',
+    chartColor: '#9e1068'
   },
   {
     id: 26,
-    type: 'VOLUME_SECONDARY'
+    type: 'VOLUME_SECONDARY',
+    chartColor: '#061178'
   },
   {
     id: 27,
-    type: 'VM_SNAPSHOT_ON_PRIMARY'
+    type: 'VM_SNAPSHOT_ON_PRIMARY',
+    chartColor: '#ad2102'
   },
   {
     id: 28,
-    type: 'BACKUP'
+    type: 'BACKUP',
+    chartColor: '#00474f'
   },
   {
     id: 29,
-    type: 'BUCKET'
+    type: 'BUCKET',
+    chartColor: '#13a8a8'
   },
   {
     id: 30,
-    type: 'NETWORK'
+    type: 'NETWORK',
+    chartColor: '#c75314'
   },
   {
     id: 31,
-    type: 'VPC'
+    type: 'VPC',
+    chartColor: '#018391'
   }
 ]
 
 export const getQuotaTypes = () => {
   return QUOTA_TYPES.sort((a, b) => a.type.localeCompare(b.type))
 }
+
+export const getQuotaTypeByName = (type) => {
+  return QUOTA_TYPES.find(quotaType => quotaType.type === type)
+}
diff --git a/ui/src/utils/ssvmProbe.js b/ui/src/utils/ssvmProbe.js
new file mode 100644
index 000000000000..55690aea8981
--- /dev/null
+++ b/ui/src/utils/ssvmProbe.js
@@ -0,0 +1,30 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+const SSVM_PROBE_TIMEOUT_MS = 5000
+export async function probeSsvmCert (origin) {
+  const controller = new AbortController()
+  const timeoutId = setTimeout(() => controller.abort(), SSVM_PROBE_TIMEOUT_MS)
+  try {
+    await fetch(origin, { method: 'HEAD', mode: 'no-cors', signal: controller.signal })
+    return true
+  } catch (e) {
+    return false
+  } finally {
+    clearTimeout(timeoutId)
+  }
+}
diff --git a/ui/src/utils/units.js b/ui/src/utils/units.js
new file mode 100644
index 000000000000..712b4d8426c3
--- /dev/null
+++ b/ui/src/utils/units.js
@@ -0,0 +1,28 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+export const TIME_UNITS = {
+  millisecond: 1,
+  second: 1000,
+  minute: 60 * 1000,
+  hour: 60 * 60 * 1000,
+  day: 24 * 60 * 60 * 1000,
+  week: 7 * 24 * 60 * 60 * 1000,
+  month: 30 * 24 * 60 * 60 * 1000,
+  quarter: 91 * 24 * 60 * 60 * 1000,
+  year: 365 * 24 * 60 * 60 * 1000
+}
diff --git a/ui/src/utils/util.js b/ui/src/utils/util.js
index 3c51096ac53e..94fbaa14c0af 100644
--- a/ui/src/utils/util.js
+++ b/ui/src/utils/util.js
@@ -15,6 +15,7 @@
 // specific language governing permissions and limitations
 // under the License.
 
+import dayjs from 'dayjs'
 import semver from 'semver'
 
 export function timeFix () {
@@ -79,13 +80,13 @@ export function getParsedVersion (version) {
   return version
 }
 
-export function toCsv ({ keys = null, data = null, columnDelimiter = ',', lineDelimiter = '\n' }) {
-  if (data === null || !data.length) {
+export function toCsv ({ keys = null, data = null, columnDelimiter = ',', lineDelimiter = '\n', headers = null, dateFormat = undefined }) {
+  if (data === null || !data.length || keys === null || !keys.filter(key => key !== null && key !== '').length) {
     return null
   }
 
   let result = ''
-  result += keys.join(columnDelimiter)
+  result += (headers || keys).join(columnDelimiter)
   result += lineDelimiter
 
   data.forEach(item => {
@@ -93,7 +94,15 @@ export function toCsv ({ keys = null, data = null, columnDelimiter = ',', lineDe
       if (item[key] === undefined) {
         item[key] = ''
       }
-      result += typeof item[key] === 'string' && item[key].includes(columnDelimiter) ? `"${item[key]}"` : item[key]
+
+      if (typeof item[key] === 'string' && item[key].includes(columnDelimiter)) {
+        result += `"${item[key]}"`
+      } else if (dateFormat && dayjs.isDayjs(item[key])) {
+        result += `"${item[key].format(dateFormat)}"`
+      } else {
+        result += item[key]
+      }
+
       result += columnDelimiter
     })
     result = result.slice(0, -1)
@@ -103,6 +112,20 @@ export function toCsv ({ keys = null, data = null, columnDelimiter = ',', lineDe
   return result
 }
 
+export function downloadDataAsCsv ({ data = null, keys = null, headers = null, columnDelimiter = ',', lineDelimiter = '\n', fileName = 'data', dateFormat = undefined }) {
+  const dataParsed = toCsv({ keys, data, columnDelimiter, lineDelimiter, headers, dateFormat })
+  if (dataParsed === null) {
+    return
+  }
+
+  const hiddenElement = document.createElement('a')
+  hiddenElement.href = 'data:text/csv;charset=utf-8,' + encodeURI(dataParsed)
+  hiddenElement.target = '_blank'
+  hiddenElement.download = `${fileName}.csv`
+  hiddenElement.click()
+  hiddenElement.remove()
+}
+
 export function isValidIPv4Cidr (rule, value) {
   return new Promise((resolve, reject) => {
     if (!value) {
diff --git a/ui/src/views/AutogenView.vue b/ui/src/views/AutogenView.vue
index 7ddec48b85cf..8b492d507a2e 100644
--- a/ui/src/views/AutogenView.vue
+++ b/ui/src/views/AutogenView.vue
@@ -512,7 +512,7 @@
                   :placeholder="field.description"
                 />
                 <a-input-password
-                  v-else-if="field.name==='password' || field.name==='currentpassword' || field.name==='confirmpassword'"
+                  v-else-if="field.name==='password' || field.name==='currentpassword' || field.name==='confirmpassword' || field.name==='secretkey'"
                   v-model:value="form[field.name]"
                   :placeholder="field.description"
                   @blur="($event) => handleConfirmBlur($event, field.name)"
@@ -558,7 +558,7 @@
       <div v-if="dataView">
         <slot
           name="resource"
-          v-if="$route.path.startsWith('/quotasummary') || $route.path.startsWith('/publicip')"
+          v-if="$route.path.startsWith('/publicip')"
         ></slot>
         <resource-view
           v-else
@@ -1067,7 +1067,7 @@ export default {
       const customRender = {}
       for (var columnKey of this.columnKeys) {
         let key = columnKey
-        let title = columnKey === 'cidr' && this.columnKeys.includes('ip6cidr') ? 'ipv4.cidr' : columnKey
+        let title = columnKey === 'cidr' && this.columnKeys.includes('ip6cidr') ? 'ipv4.cidr' : key
         if (typeof columnKey === 'object') {
           if ('customTitle' in columnKey && 'field' in columnKey) {
             key = columnKey.field
@@ -1075,7 +1075,7 @@ export default {
             customRender[key] = columnKey[key]
           } else {
             key = Object.keys(columnKey)[0]
-            title = Object.keys(columnKey)[0]
+            title = (typeof title === 'object') ? key : title
             customRender[key] = columnKey[key]
           }
         }
@@ -1120,6 +1120,13 @@ export default {
         params.details = 'group,nics,secgrp,tmpl,servoff,diskoff,iso,volume,affgrp,backoff'
       }
 
+      if (this.apiName === 'quotaTariffList' && !('quotaTariffCreate' in store.getters.apis || 'quotaTariffUpdate' in store.getters.apis)) {
+        const index = this.columns.findIndex(col => col.dataIndex === 'hasActivationRule')
+        if (index >= 0) {
+          this.columns.splice(index, 1)
+        }
+      }
+
       this.loading = true
       if (this.$route.path.startsWith('/cniconfiguration')) {
         params.forcks = true
@@ -1160,6 +1167,14 @@ export default {
         if (this.$route.path.startsWith('/tungstenfirewallpolicy/')) {
           params.firewallpolicyuuid = this.$route.params.id
         }
+        if (this.apiName === 'quotaSummary' && params.id) {
+          params.accountid = params.id
+          delete params.id
+        }
+        if (this.apiName === 'quotaEmailTemplateList' && params.id) {
+          params.templatetype = params.id
+          delete params.id
+        }
       }
 
       if (this.$store.getters.listAllProjects && !this.projectView) {
@@ -1206,7 +1221,11 @@ export default {
           break
         }
 
-        if ('id' in this.$route.params && this.$route.params.id !== params.id) {
+        const idFromRouteMatchesApiParameter = this.$route.params.id === params.id ||
+          this.apiName === 'quotaSummary' && this.$route.params.id === params.accountid ||
+          this.apiName === 'quotaEmailTemplateList' && this.$route.params.id === params.templatetype
+
+        if ('id' in this.$route.params && !idFromRouteMatchesApiParameter) {
           console.log('DEBUG - Discarding API response as its `id` does not match the uuid on the browser path')
           return
         }
@@ -1248,6 +1267,16 @@ export default {
           })
         }
 
+        if (this.apiName === 'listBackups') {
+          const kbossFields = ['compressionstatus', 'validationstatus']
+          const hasKbossData = this.items.some(backup => kbossFields.some(field => backup[field]))
+          if (!hasKbossData) {
+            this.columns = this.columns.filter(col => !kbossFields.includes(col.dataIndex))
+            this.allColumns = this.allColumns.filter(col => !kbossFields.includes(col.dataIndex))
+            this.selectedColumns = this.selectedColumns.filter(key => !kbossFields.includes(key))
+          }
+        }
+
         for (let idx = 0; idx < this.items.length; idx++) {
           this.items[idx].key = idx
           for (const key in customRender) {
@@ -1534,6 +1563,10 @@ export default {
         params.isofilter = 'executable'
       } else if (possibleApi === 'listHosts') {
         params.type = 'routing'
+        if (this.currentAction?.api === 'restoreBackup') {
+          params.resourcestate = 'enabled'
+          params.state = 'up'
+        }
       } else if (possibleApi === 'listNetworkOfferings' && this.resource) {
         if (this.resource.type) {
           params.guestiptype = this.resource.type
diff --git a/ui/src/views/auth/Login.vue b/ui/src/views/auth/Login.vue
index 202ae20f16fd..9dcc8b4f34c2 100644
--- a/ui/src/views/auth/Login.vue
+++ b/ui/src/views/auth/Login.vue
@@ -27,6 +27,7 @@
   >
     <a-tabs
       class="tab-center"
+      :key="$i18n.locale"
       :activeKey="customActiveKey"
       size="large"
       :tabBarStyle="{ textAlign: 'center', borderBottom: 'unset' }"
@@ -150,9 +151,82 @@
           </a-select>
         </a-form-item>
       </a-tab-pane>
+      <a-tab-pane key="oauth" :disabled="!socialLogin">
+        <template #tab>
+          <span style="display: inline-flex; align-items: center; gap: 4px; color: inherit;">
+            <img src="/assets/github.svg" alt="GitHub" class="oauth-tab-icon" :class="{ 'oauth-tab-icon--disabled': !socialLogin }" style="width: 16px; height: 16px; display: block;" />
+            <img src="/assets/google.svg" alt="Google" class="oauth-tab-icon" :class="{ 'oauth-tab-icon--disabled': !socialLogin }" style="width: 16px; height: 16px; display: block;" />
+            <span>{{ $t('label.login.external') }}</span>
+          </span>
+        </template>
+        <a-form-item name="oauthDomain">
+          <a-input
+            size="large"
+            type="text"
+            :placeholder="$t('label.domain')"
+            v-model:value="form.oauthDomain"
+            @pressEnter="handleOauthDomainSubmit"
+            @blur="handleOauthDomainSubmit"
+          >
+            <template #prefix>
+              <project-outlined />
+            </template>
+          </a-input>
+        </a-form-item>
+        <div
+          v-if="(oauthGithubProvider || oauthGoogleProvider || oauthKeycloakProvider) && !form.oauthDomain"
+          style="text-align: center; color: #999; font-size: 12px; margin-bottom: 8px;">
+          Enter your domain to see domain-specific providers
+        </div>
+        <div class="center" v-if="oauthGithubProvider || oauthGoogleProvider || oauthKeycloakProvider">
+          <div class="social-auth" v-if="oauthGithubProvider">
+            <a-button
+              @click="handleGithubProviderAndDomain"
+              tag="a"
+              color="primary"
+              :href="getGitHubUrl(from)"
+              class="auth-btn github-auth"
+              style="height: 38px; width: 185px; padding: 0; margin-bottom: 5px;" >
+              <img src="/assets/github.svg" alt="GitHub" style="width: 32px; padding: 5px" />
+              <a-typography-text>Sign in with GitHub</a-typography-text>
+            </a-button>
+          </div>
+          <div class="social-auth" v-if="oauthGoogleProvider">
+            <a-button
+              @click="handleGoogleProviderAndDomain"
+              tag="a"
+              color="primary"
+              :href="getGoogleUrl(from)"
+              class="auth-btn google-auth"
+              style="height: 38px; width: 185px; padding: 0; margin-bottom: 5px;" >
+              <img src="/assets/google.svg" alt="Google" style="width: 32px; padding: 5px" />
+              <a-typography-text>Sign in with Google</a-typography-text>
+            </a-button>
+          </div>
+          <div class="social-auth" v-if="oauthKeycloakProvider">
+            <a-button
+              @click="handleKeycloakProviderAndDomain"
+              tag="a"
+              color="primary"
+              :href="getKeycloakUrl(from)"
+              class="auth-btn keycloak-auth"
+              style="height: 38px; width: 185px; padding: 0" >
+              <img src="/assets/keycloak.svg" alt="Keycloak" style="width: 32px; padding: 5px" />
+              <a-typography-text>Sign in with Keycloak</a-typography-text>
+            </a-button>
+          </div>
+        </div>
+        <div v-else-if="oauthLoading" style="text-align: center; padding: 20px 0;">
+          <a-spin />
+        </div>
+        <div v-else style="text-align: center; color: #999; padding: 20px 0;">
+          <span v-if="oauthDomainQueried && form.oauthDomain">No OAuth providers configured for this domain</span>
+          <span v-else>Enter your domain to see available providers</span>
+        </div>
+      </a-tab-pane>
     </a-tabs>
 
-    <a-form-item>
+    <a-form-item v-if="customActiveKey !== 'oauth'">
       <a-button
         size="large"
         type="primary"
@@ -174,47 +248,6 @@
         </router-link>
       </a-col>
     </a-row>
-    <div class="content" v-if="socialLogin">
-      <p class="or">or</p>
-    </div>
-    <div class="center">
-      <div class="social-auth" v-if="githubprovider">
-        <a-button
-          @click="handleGithubProviderAndDomain"
-          tag="a"
-          color="primary"
-          :href="getGitHubUrl(from)"
-          class="auth-btn github-auth"
-          style="height: 38px; width: 185px; padding: 0; margin-bottom: 5px;" >
-          <img src="/assets/github.svg" alt="GitHub" style="width: 32px; padding: 5px" />
-          <a-typography-text>Sign in with GitHub</a-typography-text>
-        </a-button>
-      </div>
-      <div class="social-auth" v-if="googleprovider">
-        <a-button
-          @click="handleGoogleProviderAndDomain"
-          tag="a"
-          color="primary"
-          :href="getGoogleUrl(from)"
-          class="auth-btn google-auth"
-          style="height: 38px; width: 185px; padding: 0" >
-          <img src="/assets/google.svg" alt="Google" style="width: 32px; padding: 5px" />
-          <a-typography-text>Sign in with Google</a-typography-text>
-        </a-button>
-      </div>
-      <div class="social-auth" v-if="keycloakprovider">
-        <a-button
-          @click="handleKeycloakProviderAndDomain"
-          tag="a"
-          color="primary"
-          :href="getKeycloakUrl(from)"
-          class="auth-btn keycloak-auth"
-          style="height: 38px; width: 185px; padding: 0" >
-          <img src="/assets/keycloak.svg" alt="Keycloak" style="width: 32px; padding: 5px" />
-          <a-typography-text>Sign in with Keycloak</a-typography-text>
-        </a-button>
-      </div>
-    </div>
   </a-form>
 </template>
 
@@ -251,6 +284,18 @@ export default {
       githubclientid: '',
       keycloakclientid: '',
       keycloakauthorizeurl: '',
+      oauthGoogleProvider: false,
+      oauthGithubProvider: false,
+      oauthKeycloakProvider: false,
+      oauthGoogleClientId: '',
+      oauthGithubClientId: '',
+      oauthKeycloakClientId: '',
+      oauthGoogleRedirectUri: '',
+      oauthGithubRedirectUri: '',
+      oauthKeycloakRedirectUri: '',
+      oauthKeycloakAuthorizeUrl: '',
+      oauthLoading: false,
+      oauthDomainQueried: false,
       loginType: 0,
       state: {
         time: 60,
@@ -285,6 +330,7 @@ export default {
         server: (this.server.apiHost || '') + this.server.apiBase,
         username: this.$route.query?.username || '',
         domain: this.$route.query?.domain || '',
+        oauthDomain: '',
         project: null
       })
       this.rules = reactive({})
@@ -327,30 +373,7 @@ export default {
           this.form.idp = this.idps[0].id || ''
         }
       })
-      getAPI('listOauthProvider', {}).then(response => {
-        if (response) {
-          const oauthproviders = response.listoauthproviderresponse.oauthprovider || []
-          oauthproviders.forEach(item => {
-            if (item.provider === 'google') {
-              this.googleprovider = item.enabled
-              this.googleclientid = item.clientid
-              this.googleredirecturi = item.redirecturi
-            }
-            if (item.provider === 'github') {
-              this.githubprovider = item.enabled
-              this.githubclientid = item.clientid
-              this.githubredirecturi = item.redirecturi
-            }
-            if (item.provider === 'keycloak') {
-              this.keycloakprovider = item.enabled
-              this.keycloakclientid = item.clientid
-              this.keycloakredirecturi = item.redirecturi
-              this.keycloakauthorizeurl = item.authorizeurl
-            }
-          })
-          this.socialLogin = this.googleprovider || this.githubprovider || this.keycloakprovider
-        }
-      })
+      this.fetchOauthProviders()
       postAPI('forgotPassword', {}).then(response => {
         this.forgotPasswordEnabled = response.forgotpasswordresponse.enabled
       }).catch((err) => {
@@ -361,6 +384,74 @@ export default {
         }
       })
     },
+    fetchOauthProviders (domain) {
+      const params = {}
+      if (domain) {
+        params.domain = domain
+        this.oauthLoading = true
+      }
+      getAPI('listOauthProvider', params).then(response => {
+        if (response) {
+          const oauthproviders = response.listoauthproviderresponse.oauthprovider || []
+          if (!domain) {
+            oauthproviders.forEach(item => {
+              if (item.provider === 'google') {
+                this.googleprovider = item.enabled
+                this.googleclientid = item.clientid
+                this.googleredirecturi = item.redirecturi
+              }
+              if (item.provider === 'github') {
+                this.githubprovider = item.enabled
+                this.githubclientid = item.clientid
+                this.githubredirecturi = item.redirecturi
+              }
+              if (item.provider === 'keycloak') {
+                this.keycloakprovider = item.enabled
+                this.keycloakclientid = item.clientid
+                this.keycloakredirecturi = item.redirecturi
+                this.keycloakauthorizeurl = item.authorizeurl
+              }
+            })
+            const totalCount = response.listoauthproviderresponse.count || 0
+            this.socialLogin = totalCount > 0
+            this.oauthGithubProvider = this.githubprovider
+            this.oauthGoogleProvider = this.googleprovider
+            this.oauthKeycloakProvider = this.keycloakprovider
+            this.oauthGithubClientId = this.githubclientid
+            this.oauthGoogleClientId = this.googleclientid
+            this.oauthKeycloakClientId = this.keycloakclientid
+            this.oauthGithubRedirectUri = this.githubredirecturi
+            this.oauthGoogleRedirectUri = this.googleredirecturi
+            this.oauthKeycloakRedirectUri = this.keycloakredirecturi
+            this.oauthKeycloakAuthorizeUrl = this.keycloakauthorizeurl
+          } else {
+            this.oauthGithubProvider = false
+            this.oauthGoogleProvider = false
+            this.oauthKeycloakProvider = false
+            oauthproviders.forEach(item => {
+              if (item.provider === 'google') {
+                this.oauthGoogleProvider = item.enabled
+                this.oauthGoogleClientId = item.clientid
+                this.oauthGoogleRedirectUri = item.redirecturi
+              }
+              if (item.provider === 'github') {
+                this.oauthGithubProvider = item.enabled
+                this.oauthGithubClientId = item.clientid
+                this.oauthGithubRedirectUri = item.redirecturi
+              }
+              if (item.provider === 'keycloak') {
+                this.oauthKeycloakProvider = item.enabled
+                this.oauthKeycloakClientId = item.clientid
+                this.oauthKeycloakRedirectUri = item.redirecturi
+                this.oauthKeycloakAuthorizeUrl = item.authorizeurl
+              }
+            })
+          }
+        }
+      }).finally(() => {
+        this.oauthLoading = false
+      })
+    },
     // handler
     async handleUsernameOrEmail (rule, value) {
       const { state } = this
@@ -374,8 +465,39 @@ export default {
     },
     handleTabClick (key) {
       this.customActiveKey = key
+      if (key === 'oauth') {
+        this.oauthGithubProvider = this.githubprovider
+        this.oauthGoogleProvider = this.googleprovider
+        this.oauthKeycloakProvider = this.keycloakprovider
+        this.oauthGithubClientId = this.githubclientid
+        this.oauthGoogleClientId = this.googleclientid
+        this.oauthKeycloakClientId = this.keycloakclientid
+        this.oauthGithubRedirectUri = this.githubredirecturi
+        this.oauthGoogleRedirectUri = this.googleredirecturi
+        this.oauthKeycloakRedirectUri = this.keycloakredirecturi
+        this.oauthKeycloakAuthorizeUrl = this.keycloakauthorizeurl
+      }
       this.setRules()
     },
+    handleOauthDomainSubmit () {
+      const domain = this.form.oauthDomain
+      if (domain) {
+        this.oauthDomainQueried = true
+        this.fetchOauthProviders(domain)
+      } else {
+        this.oauthDomainQueried = false
+        this.oauthGithubProvider = this.githubprovider
+        this.oauthGoogleProvider = this.googleprovider
+        this.oauthKeycloakProvider = this.keycloakprovider
+        this.oauthGithubClientId = this.githubclientid
+        this.oauthGoogleClientId = this.googleclientid
+        this.oauthKeycloakClientId = this.keycloakclientid
+        this.oauthGithubRedirectUri = this.githubredirecturi
+        this.oauthGoogleRedirectUri = this.googleredirecturi
+        this.oauthKeycloakRedirectUri = this.keycloakredirecturi
+        this.oauthKeycloakAuthorizeUrl = this.keycloakauthorizeurl
+      }
+    },
     handleGithubProviderAndDomain () {
       this.handleDomain()
       this.$store.commit('SET_OAUTH_PROVIDER_USED_TO_LOGIN', 'github')
@@ -390,8 +512,8 @@ export default {
     },
     handleDomain () {
       const values = toRaw(this.form)
-      const domain = this.getLoginDomain(values.domain)
-      this.$store.commit('SET_DOMAIN_USED_TO_LOGIN', domain)
+      const domain = this.customActiveKey === 'oauth' ? values.oauthDomain : values.domain
+      this.$store.commit('SET_DOMAIN_USED_TO_LOGIN', this.getLoginDomain(domain))
     },
     getLoginDomain (domain) {
       if (this.$config.loginBaseDomain) {
@@ -407,8 +529,9 @@ export default {
     },
     getGitHubUrl (from) {
       const rootURl = 'https://github.com/login/oauth/authorize'
+      const clientId = this.customActiveKey === 'oauth' ? this.oauthGithubClientId : this.githubclientid
       const options = {
-        client_id: this.githubclientid,
+        client_id: clientId,
         scope: 'user:email',
         state: 'cloudstack'
       }
@@ -419,9 +542,11 @@ export default {
     },
     getGoogleUrl (from) {
       const rootUrl = 'https://accounts.google.com/o/oauth2/v2/auth'
+      const redirectUri = this.customActiveKey === 'oauth' ? this.oauthGoogleRedirectUri : this.googleredirecturi
+      const clientId = this.customActiveKey === 'oauth' ? this.oauthGoogleClientId : this.googleclientid
       const options = {
-        redirect_uri: this.googleredirecturi,
-        client_id: this.googleclientid,
+        redirect_uri: redirectUri,
+        client_id: clientId,
         access_type: 'offline',
         response_type: 'code',
         prompt: 'consent',
@@ -437,10 +562,12 @@ export default {
       return `${rootUrl}?${qs.toString()}`
     },
     getKeycloakUrl (from) {
-      const rootURl = this.keycloakauthorizeurl
+      const rootURl = this.customActiveKey === 'oauth' ? this.oauthKeycloakAuthorizeUrl : this.keycloakauthorizeurl
+      const redirectUri = this.customActiveKey === 'oauth' ? this.oauthKeycloakRedirectUri : this.keycloakredirecturi
+      const clientId = this.customActiveKey === 'oauth' ? this.oauthKeycloakClientId : this.keycloakclientid
       const options = {
-        redirect_uri: this.keycloakredirecturi,
-        client_id: this.keycloakclientid,
+        redirect_uri: redirectUri,
+        client_id: clientId,
         response_type: 'code',
         scope: 'openid email',
         state: 'cloudstack'
@@ -562,12 +689,21 @@ export default {
 
 <style lang="less" scoped>
 .user-layout-login {
-  min-width: 260px;
-  width: 368px;
+  min-width: 300px;
+  width: 500px;
   margin: 0 auto;
 
+  :deep(.tab-center .ant-tabs-tab) {
+    margin: 0 16px 0 0;
+  }
+
+  .oauth-tab-icon--disabled {
+    filter: grayscale(100%);
+    opacity: 0.45;
+  }
+
   .mobile & {
-    max-width: 368px;
+    max-width: 500px;
     width: 98%;
   }
 
diff --git a/ui/src/views/compute/DeployVnfAppliance.vue b/ui/src/views/compute/DeployVnfAppliance.vue
index be154221675e..05f804ef4eac 100644
--- a/ui/src/views/compute/DeployVnfAppliance.vue
+++ b/ui/src/views/compute/DeployVnfAppliance.vue
@@ -272,7 +272,7 @@
                 </template>
               </a-step>
               <a-step
-                v-else-if="vm.templateid && template.templatetype !== 'VNF'"
+                v-else-if="vm.templateid && template && template.templatetype !== 'VNF'"
                 :title="imageType === 'templateid' ? $t('label.data.disk') : $t('label.disk.size')"
                 :status="zoneSelected ? 'process' : 'wait'">
                 <template #description>
diff --git a/ui/src/views/compute/InstanceTab.vue b/ui/src/views/compute/InstanceTab.vue
index 5550d95349d8..d125995e3e1c 100644
--- a/ui/src/views/compute/InstanceTab.vue
+++ b/ui/src/views/compute/InstanceTab.vue
@@ -74,7 +74,9 @@
           apiName="listBackups"
           :resource="resource"
           :params="{virtualmachineid: dataResource.id}"
-          :columns="['name', 'status', 'size', 'virtualsize', 'type', 'intervaltype', 'created']"
+          :columns="dataResource.backupprovider === 'kboss'
+            ? ['name', 'status', 'compressionstatus', 'validationstatus', 'size', 'virtualsize', 'type', 'intervaltype', 'created']
+            : ['name', 'status', 'size', 'virtualsize', 'type', 'intervaltype', 'created']"
           :routerlinks="(record) => { return { name: '/backup/' + record.id } }"
           :showSearch="false"/>
       </a-tab-pane>
diff --git a/ui/src/views/compute/StartBackup.vue b/ui/src/views/compute/StartBackup.vue
index de2680d14476..834989e44489 100644
--- a/ui/src/views/compute/StartBackup.vue
+++ b/ui/src/views/compute/StartBackup.vue
@@ -40,12 +40,18 @@
             <a-input v-model:value="form.description"/>
           </a-form-item>
         </div>
-        <a-form-item v-if="provider === 'nas'" name="quiescevm" ref="quiescevm">
+        <a-form-item v-if="['nas', 'kboss'].includes(provider)" name="quiescevm" ref="quiescevm">
           <a-switch v-model:checked="form.quiescevm" />
           <template #label>
             <tooltip-label :title="$t('label.quiescevm')" :tooltip="apiParams.quiescevm.description"/>
           </template>
         </a-form-item>
+        <a-form-item v-if="provider === 'kboss'" name="isolated" ref="isolated">
+          <a-switch v-model:checked="form.isolated" />
+          <template #label>
+            <tooltip-label :title="$t('label.backup.isolated')" :tooltip="apiParams.isolated.description"/>
+          </template>
+        </a-form-item>
       </a-form>
       <div :span="24" class="action-button">
         <a-button @click="closeModal">{{ $t('label.cancel') }}</a-button>
@@ -88,7 +94,7 @@ export default {
   },
   computed: {
     canSetNameAndDescription () {
-      return ['nas', 'dummy'].includes(this.provider)
+      return ['nas', 'dummy', 'kboss'].includes(this.provider)
     }
   },
   methods: {
@@ -119,7 +125,8 @@ export default {
           virtualmachineid: this.resource.id,
           name: this.form.name,
           description: this.form.description,
-          quiescevm: this.form.quiescevm
+          quiescevm: this.form.quiescevm,
+          isolated: this.form.isolated
         }
         this.loading = true
         postAPI('createBackup', data).then(response => {
diff --git a/ui/src/views/compute/backup/BackupSchedule.vue b/ui/src/views/compute/backup/BackupSchedule.vue
index b3e894ec9821..526cd03b7ee4 100644
--- a/ui/src/views/compute/backup/BackupSchedule.vue
+++ b/ui/src/views/compute/backup/BackupSchedule.vue
@@ -67,6 +67,9 @@
         <template v-if="column.key === 'timezone'" :name="text">
           <label>{{ getTimeZone(record.timezone) }}</label>
         </template>
+        <template v-if="column.key === 'isolated'" :name="text">
+          <label>{{ record.isolated ? $t('label.yes') : $t('label.no') }}</label>
+        </template>
         <template v-if="column.key === 'actions'" class="account-button-action" :name="text">
           <tooltip-button
             tooltipPlacement="top"
@@ -157,6 +160,11 @@ export default {
           title: this.$t('label.timezone'),
           dataIndex: 'timezone'
         },
+        {
+          key: 'isolated',
+          title: this.$t('label.backup.isolated'),
+          dataIndex: 'isolated'
+        },
         {
           key: 'actions',
           title: this.$t('label.actions'),
diff --git a/ui/src/views/compute/backup/FormSchedule.vue b/ui/src/views/compute/backup/FormSchedule.vue
index 7d951deaf205..811e302b884f 100644
--- a/ui/src/views/compute/backup/FormSchedule.vue
+++ b/ui/src/views/compute/backup/FormSchedule.vue
@@ -143,6 +143,15 @@
                   <tooltip-label :title="$t('label.quiescevm')" :tooltip="apiParams.quiescevm.description"/>
                 </template>
               </a-form-item>
+              <a-form-item name="isolated" ref="isolated">
+                <template #label>
+                  <tooltip-label
+                    :title="$t('label.isolated')"
+                    :tooltip="apiParams.isolated?.description"
+                  />
+                </template>
+                <a-switch v-model:checked="form.isolated" />
+              </a-form-item>
             </a-col>
           </a-row>
           <div :span="24" class="action-button">
@@ -260,7 +269,8 @@ export default {
     initForm () {
       this.formRef = ref()
       this.form = reactive({
-        intervaltype: 'hourly'
+        intervaltype: 'hourly',
+        isolated: false
       })
       this.rules = reactive({
         time: [{ type: 'number', required: true, message: this.$t('message.error.required.input') }],
@@ -360,6 +370,7 @@ export default {
         if (values.quiescevm) {
           params.quiescevm = values.quiescevm
         }
+        params.isolated = values.isolated
         switch (values.intervaltype) {
           case 'hourly':
             params.schedule = values.time
diff --git a/ui/src/views/compute/wizard/OwnershipSelection.vue b/ui/src/views/compute/wizard/OwnershipSelection.vue
index 484ffdb690fc..decf196f8400 100644
--- a/ui/src/views/compute/wizard/OwnershipSelection.vue
+++ b/ui/src/views/compute/wizard/OwnershipSelection.vue
@@ -151,6 +151,10 @@ export default {
   props: {
     override: {
       type: Object
+    },
+    accountState: {
+      type: String,
+      default: 'Enabled'
     }
   },
   created () {
@@ -199,7 +203,7 @@ export default {
         response: 'json',
         domainId: this.selectedDomain,
         showicon: true,
-        state: 'Enabled',
+        state: this.accountState,
         isrecursive: false
       })
         .then((response) => {
diff --git a/ui/src/views/dashboard/VerifyOauth.vue b/ui/src/views/dashboard/VerifyOauth.vue
index a4734aa5127a..a8d9f1c1f0d7 100644
--- a/ui/src/views/dashboard/VerifyOauth.vue
+++ b/ui/src/views/dashboard/VerifyOauth.vue
@@ -47,7 +47,7 @@ export default {
       const code = params.get('code')
       const provider = this.$localStorage.get(OAUTH_PROVIDER)
       this.state.loginBtn = true
-      getAPI('verifyOAuthCodeAndGetUser', { provider: provider, secretcode: code }).then(response => {
+      getAPI('verifyOAuthCodeAndGetUser', { provider: provider, secretcode: code, domain: this.$localStorage.get(OAUTH_DOMAIN) }).then(response => {
         const email = response.verifyoauthcodeandgetuserresponse.oauthemail.email
         const loginParams = {}
         loginParams.email = email
diff --git a/ui/src/views/extension/AddCustomAction.vue b/ui/src/views/extension/AddCustomAction.vue
index f74255fa8de3..160e1efa8f65 100644
--- a/ui/src/views/extension/AddCustomAction.vue
+++ b/ui/src/views/extension/AddCustomAction.vue
@@ -34,8 +34,25 @@
             api="listExtensions"
             :apiParams="extensionsApiParams"
             resourceType="extension"
+            @change-option="updateResourceTypeByExtension"
             defaultIcon="appstore-add-outlined" />
       </a-form-item>
+      <a-form-item name="resourcetype" ref="resourcetype">
+        <template #label>
+          <tooltip-label :title="$t('label.resourcetype')" :tooltip="apiParams.resourcetype.description"/>
+        </template>
+        <a-select
+          v-model:value="form.resourcetype"
+          :placeholder="apiParams.resourcetype.description"
+          optionFilterProp="label"
+          :filterOption="(input, option) => {
+            return option.label.toLowerCase().indexOf(input.toLowerCase()) >= 0
+          }" >
+          <a-select-option v-for="opt in resourceTypeOptions" :key="opt" :label="opt">
+            {{ opt }}
+          </a-select-option>
+        </a-select>
+      </a-form-item>
       <a-form-item name="name" ref="name">
         <template #label>
           <tooltip-label :title="$t('label.name')" :tooltip="apiParams.name.description"/>
@@ -152,6 +169,7 @@ export default {
   data () {
     return {
       roleTypes: [],
+      resourceTypeOptions: ['VirtualMachine', 'Network', 'Vpc'],
       loading: false
     }
   },
@@ -165,6 +183,7 @@ export default {
     this.initForm()
     if (this.extension) {
       this.form.extensionid = this.extension.id
+      this.updateResourceTypeByExtension(this.extension)
     }
     this.roleTypes = this.$fetchCustomActionRoleTypes()
   },
@@ -173,13 +192,30 @@ export default {
       this.formRef = ref()
       this.form = reactive({
         enabled: true,
-        timeout: 5
+        timeout: 5,
+        resourcetype: 'VirtualMachine'
       })
       this.rules = reactive({
         extensionid: [{ required: true, message: `${this.$t('message.error.select')}` }],
-        name: [{ required: true, message: `${this.$t('message.error.name')}` }]
+        name: [{ required: true, message: `${this.$t('message.error.name')}` }],
+        resourcetype: [{ required: true, message: `${this.$t('message.error.select')}` }]
       })
     },
+    updateResourceTypeByExtension (selectedExtension) {
+      const type = selectedExtension?.type
+      if (type === 'NetworkOrchestrator') {
+        this.resourceTypeOptions = ['Network', 'Vpc']
+        this.form.resourcetype = 'Network'
+      } else if (type === 'Orchestrator') {
+        this.resourceTypeOptions = ['VirtualMachine']
+        this.form.resourcetype = 'VirtualMachine'
+      } else {
+        this.resourceTypeOptions = ['VirtualMachine', 'Network', 'Vpc']
+        if (!this.form.resourcetype) {
+          this.form.resourcetype = 'VirtualMachine'
+        }
+      }
+    },
     handleSubmit (e) {
       e.preventDefault()
       if (this.loading) return
@@ -189,6 +225,7 @@ export default {
         const params = {
           extensionid: values.extensionid || this.extension.id,
           name: values.name,
+          resourcetype: values.resourcetype,
           enabled: values.enabled
         }
         const keys = ['description', 'allowedroletypes', 'successmessage', 'errormessage', 'timeout']
diff --git a/ui/src/views/extension/CreateExtension.vue b/ui/src/views/extension/CreateExtension.vue
index 3baae81174e9..fc2e8c237fdb 100644
--- a/ui/src/views/extension/CreateExtension.vue
+++ b/ui/src/views/extension/CreateExtension.vue
@@ -162,7 +162,7 @@ export default {
     },
     fetchExtensionTypes () {
       this.extensionTypes = []
-      const extensionTypesList = ['Orchestrator']
+      const extensionTypesList = ['Orchestrator', 'NetworkOrchestrator']
       extensionTypesList.forEach((item) => {
         this.extensionTypes.push({
           id: item,
diff --git a/ui/src/views/extension/ExtensionResourcesTab.vue b/ui/src/views/extension/ExtensionResourcesTab.vue
index c69c79306c8f..6c577e66584e 100644
--- a/ui/src/views/extension/ExtensionResourcesTab.vue
+++ b/ui/src/views/extension/ExtensionResourcesTab.vue
@@ -34,6 +34,14 @@
           {{ text && $toLocaleDate(text) }}
         </template>
         <template v-if="column.key === 'actions'">
+          <span style="margin-right: 5px">
+            <tooltip-button
+              v-if="'updateRegisteredExtension' in $store.getters.apis"
+              :tooltip="$t('label.action.update.extension.resource')"
+              type="default"
+              icon="edit-outlined"
+              @onClick="openUpdateModal(record)" />
+          </span>
           <span style="margin-right: 5px">
             <a-popconfirm
               v-if="'unregisterExtension' in $store.getters.apis"
@@ -59,6 +67,20 @@
           :data-map="record.details" />
       </template>
     </a-table>
+    <a-modal
+      v-if="updateModalVisible"
+      :visible="updateModalVisible"
+      :width="600"
+      :title="$t('label.action.update.extension.resource')"
+      :closable="true"
+      :footer="null"
+      @cancel="closeUpdateModal">
+      <update-registered-extension
+        :resource="resource"
+        :extension-resource="selectedResource"
+        @refresh-data="handleRefreshData"
+        @close-action="closeUpdateModal" />
+    </a-modal>
   </div>
 </template>
 
@@ -67,13 +89,16 @@ import { postAPI } from '@/api'
 import eventBus from '@/config/eventBus'
 import ObjectListTable from '@/components/view/ObjectListTable.vue'
 import TooltipButton from '@/components/widgets/TooltipButton'
+import UpdateRegisteredExtension from '@/views/extension/UpdateRegisteredExtension'
 
 export default {
   name: 'ExtensionResourcesTab',
   components: {
     ObjectListTable,
-    TooltipButton
+    TooltipButton,
+    UpdateRegisteredExtension
   },
+  inject: ['parentFetchData'],
   props: {
     resource: {
       type: Object,
@@ -103,7 +128,9 @@ export default {
           title: this.$t('label.actions')
         }
       ],
-      unregisterLoading: false
+      unregisterLoading: false,
+      updateModalVisible: false,
+      selectedResource: null
     }
   },
   computed: {
@@ -112,13 +139,27 @@ export default {
     }
   },
   methods: {
+    openUpdateModal (record) {
+      this.selectedResource = record
+      this.updateModalVisible = true
+    },
+    closeUpdateModal () {
+      this.updateModalVisible = false
+      this.selectedResource = null
+    },
+    handleRefreshData () {
+      if (this.parentFetchData) {
+        this.parentFetchData()
+      }
+    },
     unregisterExtension (record) {
       const params = {
         extensionid: this.resource.id,
         resourceid: record.id,
         resourcetype: record.type
       }
-      postAPI('unregisterExtension', params).then(json => {
+      this.unregisterLoading = true
+      postAPI('unregisterExtension', params).then(() => {
         eventBus.emit('async-job-complete', null)
         this.$notification.success({
           message: this.$t('label.unregister.extension'),
@@ -127,7 +168,7 @@ export default {
       }).catch(error => {
         this.$notifyError(error)
       }).finally(() => {
-        this.deleteLoading = false
+        this.unregisterLoading = false
       })
     }
   }
diff --git a/ui/src/views/extension/JsonViewer.vue b/ui/src/views/extension/JsonViewer.vue
new file mode 100644
index 000000000000..8d5bd9de5028
--- /dev/null
+++ b/ui/src/views/extension/JsonViewer.vue
@@ -0,0 +1,268 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+<script>
+import { defineComponent, ref, h, provide, inject, watch } from 'vue'
+
+const INDENT = 18 // px per depth level
+
+const C = {
+  key: '#0451a5',
+  string: '#a31515',
+  number: '#098658',
+  boolean: '#0000ff',
+  null: '#767676',
+  punct: '#333333',
+  arrow: '#888888',
+  summary: '#888888'
+}
+
+const JsonNode = defineComponent({
+  name: 'JsonNode',
+  props: {
+    data: {},
+    keyName: { type: String, default: null },
+    depth: { type: Number, default: 0 },
+    isLast: { type: Boolean, default: true }
+  },
+  setup (props) {
+    // jeExpandMode tracks the last toolbar action so newly-mounted children
+    // (revealed when their parent expands) pick up the correct initial state.
+    const expandMode = inject('jeExpandMode', ref(null)) // null | 'expanded' | 'collapsed'
+    const collapsed = ref(expandMode.value === 'expanded' ? false : props.depth >= 2)
+    const toggle = () => { collapsed.value = !collapsed.value }
+
+    const expandSignal = inject('jeExpand', ref(0))
+    const collapseSignal = inject('jeCollapse', ref(0))
+    watch(expandSignal, () => { collapsed.value = false })
+    watch(collapseSignal, () => { collapsed.value = props.depth >= 2 })
+
+    return () => {
+      const { data, keyName, depth, isLast } = props
+      const pl = `${depth * INDENT}px`
+
+      // Key fragment: "name":·
+      const keyFrag = keyName !== null
+        ? [
+          h('span', { style: { color: C.key } }, `"${keyName}"`),
+          h('span', { style: { color: C.punct } }, ': ')
+        ]
+        : []
+
+      const comma = !isLast ? h('span', { style: { color: C.punct } }, ',') : null
+
+      // null
+      if (data === null) {
+        return h('div', { style: { paddingLeft: pl } }, [
+          ...keyFrag,
+          h('span', { style: { color: C.null } }, 'null'),
+          comma
+        ])
+      }
+
+      const type = Array.isArray(data) ? 'array' : typeof data
+
+      // Object / Array
+      if (type === 'object' || type === 'array') {
+        const entries = type === 'array'
+          ? data.map((v, i) => [i, v])
+          : Object.entries(data)
+        const count = entries.length
+        const open = type === 'array' ? '[' : '{'
+        const close = type === 'array' ? ']' : '}'
+
+        if (count === 0) {
+          return h('div', { style: { paddingLeft: pl } }, [
+            ...keyFrag,
+            h('span', { style: { color: C.punct } }, `${open}${close}`),
+            comma
+          ])
+        }
+
+        const arrowSt = {
+          display: 'inline-block',
+          width: '14px',
+          color: C.arrow,
+          cursor: 'pointer',
+          userSelect: 'none',
+          fontSize: '9px',
+          verticalAlign: 'middle'
+        }
+        const summary = type === 'array'
+          ? `${count} item${count !== 1 ? 's' : ''}`
+          : `${count} key${count !== 1 ? 's' : ''}`
+
+        if (collapsed.value) {
+          return h('div', {
+            style: { paddingLeft: pl, cursor: 'pointer', whiteSpace: 'nowrap' },
+            onClick: toggle
+          }, [
+            h('span', { style: arrowSt }, '▶'),
+            ...keyFrag,
+            h('span', { style: { color: C.punct } }, `${open} `),
+            h('span', { style: { color: C.summary, fontStyle: 'italic' } }, summary),
+            h('span', { style: { color: C.punct } }, ` ${close}`),
+            comma
+          ])
+        }
+
+        return h('div', {}, [
+          // Opening line with toggle
+          h('div', { style: { paddingLeft: pl, cursor: 'pointer' }, onClick: toggle }, [
+            h('span', { style: arrowSt }, '▼'),
+            ...keyFrag,
+            h('span', { style: { color: C.punct } }, open)
+          ]),
+          // Children — each child provides its own paddingLeft via (depth+1)*INDENT
+          ...entries.map(([k, v], i) =>
+            h(JsonNode, {
+              key: String(k),
+              data: v,
+              keyName: type === 'array' ? null : String(k),
+              depth: depth + 1,
+              isLast: i === count - 1
+            })
+          ),
+          // Closing bracket at same indentation as the opening line
+          h('div', { style: { paddingLeft: pl } }, [
+            h('span', { style: { color: C.punct } }, close),
+            comma
+          ])
+        ])
+      }
+
+      // Primitives
+      let valueEl
+      if (type === 'string') {
+        valueEl = h('span', { style: { color: C.string } }, `"${data}"`)
+      } else if (type === 'number') {
+        valueEl = h('span', { style: { color: C.number } }, String(data))
+      } else {
+        // boolean
+        valueEl = h('span', { style: { color: C.boolean } }, String(data))
+      }
+
+      return h('div', { style: { paddingLeft: pl } }, [
+        ...keyFrag,
+        valueEl,
+        comma
+      ])
+    }
+  }
+})
+
+export default defineComponent({
+  name: 'JsonViewer',
+  components: { JsonNode },
+  props: {
+    data: { required: true }
+  },
+  setup (props) {
+    const expandSignal = ref(0)
+    const collapseSignal = ref(0)
+    const expandMode = ref(null) // tracks last toolbar action for newly-mounted nodes
+    provide('jeExpand', expandSignal)
+    provide('jeCollapse', collapseSignal)
+    provide('jeExpandMode', expandMode)
+
+    const copyDone = ref(false)
+
+    const copyJson = () => {
+      const text = JSON.stringify(props.data, null, 2)
+      if (navigator.clipboard) {
+        navigator.clipboard.writeText(text).then(() => {
+          copyDone.value = true
+          setTimeout(() => { copyDone.value = false }, 1500)
+        })
+      }
+    }
+
+    return () => h('div', {
+      style: {
+        position: 'relative',
+        fontFamily: "'Consolas', 'Courier New', monospace",
+        fontSize: '12px',
+        lineHeight: '1.7',
+        backgroundColor: '#fafafa',
+        border: '1px solid #e0e0e0',
+        borderRadius: '4px',
+        maxHeight: '60vh',
+        overflow: 'auto',
+        padding: '10px 10px 10px 6px'
+      }
+    }, [
+      // Toolbar (top-right, sticky): Expand All · Collapse All · Copy
+      h('div', {
+        style: {
+          position: 'sticky',
+          top: 0,
+          float: 'right',
+          zIndex: 1,
+          marginBottom: '-20px',
+          display: 'flex',
+          gap: '4px'
+        }
+      }, [
+        h('span', {
+          onClick: () => { expandMode.value = 'expanded'; expandSignal.value++ },
+          title: 'Expand all nodes',
+          style: {
+            cursor: 'pointer',
+            fontSize: '11px',
+            padding: '2px 8px',
+            backgroundColor: '#e8e8e8',
+            border: '1px solid #ccc',
+            borderRadius: '3px',
+            color: '#555',
+            userSelect: 'none'
+          }
+        }, '⊞ Expand all'),
+        h('span', {
+          onClick: () => { expandMode.value = 'collapsed'; collapseSignal.value++ },
+          title: 'Collapse to default view (2 levels)',
+          style: {
+            cursor: 'pointer',
+            fontSize: '11px',
+            padding: '2px 8px',
+            backgroundColor: '#e8e8e8',
+            border: '1px solid #ccc',
+            borderRadius: '3px',
+            color: '#555',
+            userSelect: 'none'
+          }
+        }, '⊟ Collapse all'),
+        h('span', {
+          onClick: copyJson,
+          title: 'Copy JSON',
+          style: {
+            cursor: 'pointer',
+            fontSize: '11px',
+            padding: '2px 8px',
+            backgroundColor: copyDone.value ? '#d4edda' : '#e8e8e8',
+            border: '1px solid #ccc',
+            borderRadius: '3px',
+            color: copyDone.value ? '#155724' : '#555',
+            userSelect: 'none'
+          }
+        }, copyDone.value ? '✓ Copied' : 'Copy')
+      ]),
+      // Tree root
+      h(JsonNode, { data: props.data, depth: 0, keyName: null, isLast: true })
+    ])
+  }
+})
+</script>
diff --git a/ui/src/views/extension/RegisterExtension.vue b/ui/src/views/extension/RegisterExtension.vue
index f856c181f8cd..393e465c62b6 100644
--- a/ui/src/views/extension/RegisterExtension.vue
+++ b/ui/src/views/extension/RegisterExtension.vue
@@ -120,7 +120,7 @@ export default {
     },
     fetchExtensionResourceTypes () {
       this.resourceTypes = []
-      const resourceTypesList = ['Cluster']
+      const resourceTypesList = ['Cluster', 'PhysicalNetwork']
       resourceTypesList.forEach((item) => {
         this.resourceTypes.push({
           id: item,
diff --git a/ui/src/views/extension/RunCustomAction.vue b/ui/src/views/extension/RunCustomAction.vue
index bd26cf7f3750..898744d80601 100644
--- a/ui/src/views/extension/RunCustomAction.vue
+++ b/ui/src/views/extension/RunCustomAction.vue
@@ -103,6 +103,7 @@ import { ref, reactive, toRaw, h } from 'vue'
 import { getAPI, postAPI } from '@/api'
 import TooltipLabel from '@/components/widgets/TooltipLabel'
 import DetailsInput from '@/components/widgets/DetailsInput'
+import JsonViewer from '@/views/extension/JsonViewer.vue'
 
 export default {
   name: 'RunCustomAction',
@@ -277,75 +278,88 @@ export default {
               } catch (_) {}
               const modalType = success ? this.$success : this.$error
               const contentElements = [h('p', `${message}`)]
-              if (extensionMessage && !Array.isArray(extensionMessage) && typeof extensionMessage === 'object' && Object.keys(extensionMessage).length > 0) {
-                extensionMessage = [extensionMessage]
-              }
-              if (Array.isArray(extensionMessage) && extensionMessage.length > 0 && printExtensionMessage) {
-                contentElements.push(
-                  h('div', {
-                    style: {
-                      marginTop: '1em',
-                      maxHeight: '50vh',
-                      maxWidth: '100%',
-                      overflow: 'auto',
-                      backgroundColor: '#f6f6f6',
-                      border: '1px solid #ddd',
-                      borderRadius: '4px',
-                      display: 'block'
-                    }
-                  }, [
-                    h('table', {
+              if (printExtensionMessage && extensionMessage !== null && extensionMessage !== undefined) {
+                const isArray = Array.isArray(extensionMessage)
+                // A "flat" array has only primitive values — safe to render as a table.
+                const isFlatArray = isArray && extensionMessage.length > 0 &&
+                  extensionMessage.every(row =>
+                    typeof row === 'object' && row !== null &&
+                    Object.values(row).every(v => v === null || typeof v !== 'object')
+                  )
+                if (isFlatArray) {
+                  contentElements.push(
+                    h('div', {
                       style: {
-                        width: '100%',
-                        minWidth: 'max-content',
-                        borderCollapse: 'collapse',
-                        whiteSpace: 'pre-wrap'
+                        marginTop: '1em',
+                        maxHeight: '50vh',
+                        maxWidth: '100%',
+                        overflow: 'auto',
+                        backgroundColor: '#f6f6f6',
+                        border: '1px solid #ddd',
+                        borderRadius: '4px',
+                        display: 'block'
                       }
                     }, [
-                      h('thead', [
-                        h('tr', Object.keys(extensionMessage[0]).map(key =>
-                          h('th', {
-                            style: {
-                              padding: '8px',
-                              border: '1px solid #ddd',
-                              textAlign: 'left',
-                              fontWeight: 'bold',
-                              backgroundColor: '#fafafa'
-                            }
-                          }, key)
-                        ))
-                      ]),
-                      h('tbody', extensionMessage.map(row =>
-                        h('tr', Object.values(row).map(value =>
-                          h('td', {
-                            style: {
-                              padding: '8px',
-                              border: '1px solid #ddd',
-                              fontFamily: 'monospace'
-                            }
-                          }, String(value))
+                      h('table', {
+                        style: {
+                          width: '100%',
+                          minWidth: 'max-content',
+                          borderCollapse: 'collapse',
+                          whiteSpace: 'pre-wrap'
+                        }
+                      }, [
+                        h('thead', [
+                          h('tr', Object.keys(extensionMessage[0]).map(key =>
+                            h('th', {
+                              style: {
+                                padding: '8px',
+                                border: '1px solid #ddd',
+                                textAlign: 'left',
+                                fontWeight: 'bold',
+                                backgroundColor: '#fafafa'
+                              }
+                            }, key)
+                          ))
+                        ]),
+                        h('tbody', extensionMessage.map(row =>
+                          h('tr', Object.values(row).map(value =>
+                            h('td', {
+                              style: {
+                                padding: '8px',
+                                border: '1px solid #ddd',
+                                fontFamily: 'monospace'
+                              }
+                            }, String(value))
+                          ))
                         ))
-                      ))
+                      ])
+                    ])
+                  )
+                } else if (typeof extensionMessage === 'string') {
+                  contentElements.push(
+                    h('div', {
+                      style: {
+                        marginTop: '1em',
+                        maxHeight: '50vh',
+                        padding: '10px',
+                        overflowY: 'auto',
+                        backgroundColor: '#f6f6f6',
+                        border: '1px solid #ddd',
+                        borderRadius: '4px',
+                        fontFamily: 'monospace',
+                        whiteSpace: 'pre-wrap',
+                        wordBreak: 'break-word'
+                      }
+                    }, extensionMessage)
+                  )
+                } else {
+                  // Complex object or non-flat array — render as interactive JSON tree.
+                  contentElements.push(
+                    h('div', { style: { marginTop: '1em' } }, [
+                      h(JsonViewer, { data: extensionMessage })
                     ])
-                  ])
-                )
-              } else if (printExtensionMessage === 'true') {
-                contentElements.push(
-                  h('div', {
-                    style: {
-                      marginTop: '1em',
-                      maxHeight: '50vh',
-                      padding: '10px',
-                      overflowY: 'auto',
-                      backgroundColor: '#f6f6f6',
-                      border: '1px solid #ddd',
-                      borderRadius: '4px',
-                      fontFamily: 'monospace',
-                      whiteSpace: 'pre-wrap',
-                      wordBreak: 'break-word'
-                    }
-                  }, String(extensionMessage))
-                )
+                  )
+                }
               }
 
               modalType({
diff --git a/ui/src/views/extension/UpdateRegisteredExtension.vue b/ui/src/views/extension/UpdateRegisteredExtension.vue
new file mode 100644
index 000000000000..d1aa39942cc1
--- /dev/null
+++ b/ui/src/views/extension/UpdateRegisteredExtension.vue
@@ -0,0 +1,131 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+<template>
+  <div class="form-layout" v-ctrl-enter="handleSubmit">
+    <a-form
+      :ref="formRef"
+      :model="form"
+      :loading="loading"
+      layout="vertical"
+      @finish="handleSubmit">
+      <a-form-item name="details" ref="details">
+        <template #label>
+          <tooltip-label :title="$t('label.details')" :tooltip="$t('message.add.extension.resource.details')"/>
+        </template>
+        <div style="margin-bottom: 10px">{{ $t('message.add.extension.resource.details') }}</div>
+        <details-input
+          v-model:value="form.details" />
+      </a-form-item>
+      <div :span="24" class="action-button">
+        <a-button @click="closeAction">{{ $t('label.cancel') }}</a-button>
+        <a-button :loading="loading" ref="submit" type="primary" @click="handleSubmit">{{ $t('label.ok') }}</a-button>
+      </div>
+    </a-form>
+  </div>
+</template>
+
+<script>
+import { ref, reactive, toRaw } from 'vue'
+import { postAPI } from '@/api'
+import TooltipLabel from '@/components/widgets/TooltipLabel'
+import DetailsInput from '@/components/widgets/DetailsInput'
+
+export default {
+  name: 'UpdateRegisteredExtension',
+  components: {
+    TooltipLabel,
+    DetailsInput
+  },
+  props: {
+    resource: {
+      type: Object,
+      required: true
+    },
+    extensionResource: {
+      type: Object,
+      required: true
+    }
+  },
+  data () {
+    return {
+      loading: false
+    }
+  },
+  created () {
+    this.initForm()
+  },
+  methods: {
+    initForm () {
+      this.formRef = ref()
+      this.form = reactive({
+        details: this.extensionResource.details ? { ...this.extensionResource.details } : {}
+      })
+    },
+    handleSubmit (e) {
+      e.preventDefault()
+      if (this.loading) return
+      this.formRef.value.validate().then(() => {
+        const values = toRaw(this.form)
+        this.loading = true
+        const params = {
+          extensionid: this.resource.id,
+          resourceid: this.extensionResource.id,
+          resourcetype: this.extensionResource.type
+        }
+        if (values.details && Object.keys(values.details).length > 0) {
+          Object.entries(values.details).forEach(([key, value]) => {
+            params['details[0].' + key] = value
+          })
+        } else {
+          params.cleanupdetails = true
+        }
+        postAPI('updateRegisteredExtension', params).then(() => {
+          this.$emit('refresh-data')
+          this.$notification.success({
+            message: this.$t('label.action.update.extension.resource'),
+            description: this.$t('message.success.update.extension.resource')
+          })
+          this.closeAction()
+        }).catch(error => {
+          this.$notification.error({
+            message: this.$t('message.request.failed'),
+            description: (error.response && error.response.headers && error.response.headers['x-description']) || error.message,
+            duration: 0
+          })
+        }).finally(() => {
+          this.loading = false
+        })
+      }).catch(error => {
+        this.$notifyError(error)
+      })
+    },
+    closeAction () {
+      this.$emit('close-action')
+    }
+  }
+}
+</script>
+
+<style scoped lang="less">
+.form-layout {
+  width: 80vw;
+  @media (min-width: 600px) {
+    width: 550px;
+  }
+}
+</style>
diff --git a/ui/src/views/image/RegisterOrUploadIso.vue b/ui/src/views/image/RegisterOrUploadIso.vue
index e8ce5add61b8..eb19379dc8e2 100644
--- a/ui/src/views/image/RegisterOrUploadIso.vue
+++ b/ui/src/views/image/RegisterOrUploadIso.vue
@@ -19,11 +19,27 @@
   <div
     class="form-layout"
     @keyup.ctrl.enter="handleSubmit">
-    <span v-if="uploadPercentage > 0">
+    <span v-if="uploading">
       <loading-outlined />
       {{ $t('message.upload.file.processing') }}
       <a-progress :percent="uploadPercentage" />
     </span>
+    <div v-else-if="ssvmCertUntrusted" class="ssvm-cert-warning">
+      <a-alert
+        type="warning"
+        show-icon
+        :message="$t('message.ssvm.cert.untrusted')"
+        :description="$t('message.ssvm.cert.trust.instructions')" />
+      <div :span="24" class="action-button">
+        <a-button @click="closeAction">{{ $t('label.cancel') }}</a-button>
+        <a-button :href="ssvmOrigin" target="_blank" rel="noopener noreferrer">
+          {{ $t('label.ssvm.open.cert.page') }}
+        </a-button>
+        <a-button type="primary" :loading="loading" @click="retryUpload">
+          {{ $t('label.retry.upload') }}
+        </a-button>
+      </div>
+    </div>
     <a-spin :spinning="loading" v-else>
       <a-form
         :ref="formRef"
@@ -311,6 +327,7 @@ import { getAPI, postAPI } from '@/api'
 import store from '@/store'
 import { axios } from '../../utils/request'
 import { mixinForm } from '@/utils/mixin'
+import { probeSsvmCert } from '@/utils/ssvmProbe'
 import ResourceIcon from '@/components/view/ResourceIcon'
 import TooltipLabel from '@/components/widgets/TooltipLabel'
 
@@ -343,9 +360,12 @@ export default {
       userdatapolicy: null,
       userdatapolicylist: {},
       loading: false,
+      uploading: false,
       allowed: false,
       uploadParams: null,
       uploadPercentage: 0,
+      ssvmCertUntrusted: false,
+      ssvmOrigin: '',
       currentForm: ['plus-outlined', 'PlusOutlined'].includes(this.action.currentAction.icon) ? 'Create' : 'Upload',
       domains: [],
       accounts: [],
@@ -489,6 +509,17 @@ export default {
       this.form.file = file
       return false
     },
+    async retryUpload () {
+      this.loading = true
+      const reachable = await probeSsvmCert(this.ssvmOrigin)
+      this.loading = false
+      if (!reachable) {
+        this.$message.warning(this.$t('message.ssvm.unreachable.retry'))
+        return
+      }
+      this.ssvmCertUntrusted = false
+      this.handleUpload()
+    },
     handleUpload () {
       const { fileList } = this
       if (this.fileList.length > 1) {
@@ -502,6 +533,7 @@ export default {
       fileList.forEach(file => {
         formData.append('files[]', file)
       })
+      this.uploading = true
       this.uploadPercentage = 0
       axios.post(this.uploadParams.postURL,
         formData,
@@ -529,6 +561,8 @@ export default {
           description: `${this.$t('message.upload.iso.failed.description')} -  ${e}`,
           duration: 0
         })
+      }).finally(() => {
+        this.uploading = false
       })
     },
     handleSubmit (e) {
@@ -583,18 +617,18 @@ export default {
           }
           params.format = 'ISO'
           this.loading = true
-          getAPI('getUploadParamsForIso', params).then(json => {
+          getAPI('getUploadParamsForIso', params).then(async json => {
             this.uploadParams = (json.postuploadisoresponse && json.postuploadisoresponse.getuploadparams) ? json.postuploadisoresponse.getuploadparams : ''
-            const response = this.handleUpload()
             if (this.userdataid !== null) {
               this.linkUserdataToTemplate(this.userdataid, json.postuploadisoresponse.iso[0].id)
             }
-            if (response === 'upload successful') {
-              this.$notification.success({
-                message: this.$t('message.success.upload'),
-                description: this.$t('message.success.upload.iso.description')
-              })
+            this.ssvmOrigin = new URL(this.uploadParams.postURL).origin
+            const trusted = await probeSsvmCert(this.ssvmOrigin)
+            if (!trusted) {
+              this.ssvmCertUntrusted = true
+              return
             }
+            this.handleUpload()
           }).catch(error => {
             this.$notifyError(error)
           }).finally(() => {
diff --git a/ui/src/views/image/RegisterOrUploadTemplate.vue b/ui/src/views/image/RegisterOrUploadTemplate.vue
index 00b060727939..8a3626a70b1e 100644
--- a/ui/src/views/image/RegisterOrUploadTemplate.vue
+++ b/ui/src/views/image/RegisterOrUploadTemplate.vue
@@ -19,11 +19,27 @@
   <div
     :class="'form-layout'"
     @keyup.ctrl.enter="handleSubmit">
-    <span v-if="uploadPercentage > 0">
+    <span v-if="uploading">
       <loading-outlined />
       {{ $t('message.upload.file.processing') }}
       <a-progress :percent="uploadPercentage" />
     </span>
+    <div v-else-if="ssvmCertUntrusted" class="ssvm-cert-warning">
+      <a-alert
+        type="warning"
+        show-icon
+        :message="$t('message.ssvm.cert.untrusted')"
+        :description="$t('message.ssvm.cert.trust.instructions')" />
+      <div :span="24" class="action-button">
+        <a-button @click="closeAction">{{ $t('label.cancel') }}</a-button>
+        <a-button :href="ssvmOrigin" target="_blank" rel="noopener noreferrer">
+          {{ $t('label.ssvm.open.cert.page') }}
+        </a-button>
+        <a-button type="primary" :loading="loading" @click="retryUpload">
+          {{ $t('label.retry.upload') }}
+        </a-button>
+      </div>
+    </div>
     <a-spin :spinning="loading" v-else>
       <a-form
         :ref="formRef"
@@ -505,6 +521,7 @@ import { getAPI, postAPI } from '@/api'
 import store from '@/store'
 import { axios } from '../../utils/request'
 import { mixinForm } from '@/utils/mixin'
+import { probeSsvmCert } from '@/utils/ssvmProbe'
 import ResourceIcon from '@/components/view/ResourceIcon'
 import TooltipLabel from '@/components/widgets/TooltipLabel'
 import DetailsInput from '@/components/widgets/DetailsInput'
@@ -532,6 +549,8 @@ export default {
       uploadPercentage: 0,
       uploading: false,
       fileList: [],
+      ssvmCertUntrusted: false,
+      ssvmOrigin: '',
       zones: {},
       defaultZone: '',
       hyperVisor: {},
@@ -649,12 +668,24 @@ export default {
       this.form.file = file
       return false
     },
+    async retryUpload () {
+      this.loading = true
+      const reachable = await probeSsvmCert(this.ssvmOrigin)
+      this.loading = false
+      if (!reachable) {
+        this.$message.warning(this.$t('message.ssvm.unreachable.retry'))
+        return
+      }
+      this.ssvmCertUntrusted = false
+      this.handleUpload()
+    },
     handleUpload () {
       const { fileList } = this
       const formData = new FormData()
       fileList.forEach(file => {
         formData.append('files[]', file)
       })
+      this.uploading = true
       this.uploadPercentage = 0
       axios.post(this.uploadParams.postURL,
         formData,
@@ -678,6 +709,8 @@ export default {
         this.closeAction()
       }).catch(e => {
         this.$notifyError(e)
+      }).finally(() => {
+        this.uploading = false
       })
     },
     fetchCustomHypervisorName () {
@@ -706,6 +739,7 @@ export default {
       }
       this.loading = true
       getAPI('listExtensions', {
+        type: 'Orchestrator'
       }).then(response => {
         this.extensionsList = response.listextensionsresponse.extension || []
       }).catch(error => {
@@ -1175,12 +1209,18 @@ export default {
               duration: 0
             })
           }
-          getAPI('getUploadParamsForTemplate', params).then(json => {
+          getAPI('getUploadParamsForTemplate', params).then(async json => {
             this.uploadParams = (json.postuploadtemplateresponse && json.postuploadtemplateresponse.getuploadparams) ? json.postuploadtemplateresponse.getuploadparams : ''
-            this.handleUpload()
             if (this.userdataid !== null) {
               this.linkUserdataToTemplate(this.userdataid, json.postuploadtemplateresponse.template[0].id)
             }
+            this.ssvmOrigin = new URL(this.uploadParams.postURL).origin
+            const trusted = await probeSsvmCert(this.ssvmOrigin)
+            if (!trusted) {
+              this.ssvmCertUntrusted = true
+              return
+            }
+            this.handleUpload()
           }).catch(error => {
             this.$notifyError(error)
           }).finally(() => {
diff --git a/ui/src/views/infra/ClusterAdd.vue b/ui/src/views/infra/ClusterAdd.vue
index be561832f31b..500ab591760d 100644
--- a/ui/src/views/infra/ClusterAdd.vue
+++ b/ui/src/views/infra/ClusterAdd.vue
@@ -302,6 +302,7 @@ export default {
     fetchExtensionsList () {
       this.loading = true
       getAPI('listExtensions', {
+        type: 'Orchestrator'
       }).then(response => {
         this.extensionsList = response.listextensionsresponse.extension || []
       }).catch(error => {
diff --git a/ui/src/views/infra/network/IpRangesTabPublic.vue b/ui/src/views/infra/network/IpRangesTabPublic.vue
index dc6ef671e7ce..806dc5951a66 100644
--- a/ui/src/views/infra/network/IpRangesTabPublic.vue
+++ b/ui/src/views/infra/network/IpRangesTabPublic.vue
@@ -613,6 +613,10 @@ export default {
     handleShowAccountFields () {
       if (this.showAccountFields) {
         this.fetchDomains()
+      } else {
+        this.form.account = null
+        this.form.domain = null
+        this.form.forsystemvms = false
       }
     },
     handleOpenAddIpRangeModal () {
diff --git a/ui/src/views/infra/network/ServiceProvidersTab.vue b/ui/src/views/infra/network/ServiceProvidersTab.vue
index f659ce1f0167..709f6ac2d0e4 100644
--- a/ui/src/views/infra/network/ServiceProvidersTab.vue
+++ b/ui/src/views/infra/network/ServiceProvidersTab.vue
@@ -22,6 +22,7 @@
         :tabPosition="device === 'mobile' ? 'top' : 'left'"
         :animated="false"
         @change="onTabChange">
+        <!-- Hardcoded NSP tabs -->
         <a-tab-pane
           class="custom-tab-pane"
           v-for="item in hardcodedNsps"
@@ -41,8 +42,29 @@
             :zoneId="resource.zoneid"
             :tabKey="tabKey"/>
         </a-tab-pane>
+        <!-- Dynamic extension-based provider tabs (one per registered NetworkOrchestrator extension) -->
+        <a-tab-pane
+          class="custom-tab-pane"
+          v-for="ext in registeredExtensions"
+          :key="ext.name">
+          <template #tab>
+            <span>
+              {{ ext.name }}
+              <status :text="nsps[ext.name] ? nsps[ext.name].state : $t('label.not.added')" style="margin-bottom: 6px; margin-left: 6px" />
+            </span>
+          </template>
+          <provider-item
+            v-if="tabKey === ext.name"
+            :loading="loading"
+            :itemNsp="extensionNspItem(ext.name)"
+            :nsp="nsps[ext.name]"
+            :resourceId="resource.id"
+            :zoneId="resource.zoneid"
+            :tabKey="tabKey"/>
+        </a-tab-pane>
       </a-tabs>
     </a-spin>
+
     <div v-if="showFormAction">
       <keep-alive v-if="currentAction.component">
         <a-modal
@@ -170,7 +192,8 @@ export default {
       actionLoading: false,
       showFormAction: false,
       currentAction: {},
-      tabKey: 'BaremetalDhcpProvider'
+      tabKey: 'BaremetalDhcpProvider',
+      registeredExtensions: []
     }
   },
   computed: {
@@ -848,7 +871,7 @@ export default {
               listView: true,
               label: 'label.enable.provider',
               confirm: 'message.confirm.enable.provider',
-              show: (record) => { return (record && record.id && record.state === 'Disabled') },
+              show: (record) => { return record && record.id && record.state === 'Disabled' },
               mapping: {
                 state: {
                   value: (record) => { return 'Enabled' }
@@ -1148,6 +1171,53 @@ export default {
         return
       }
       this.fetchServiceProvider()
+      this.fetchRegisteredExtensions()
+    },
+    fetchRegisteredExtensions () {
+      // Load NetworkOrchestrator extensions registered to this physical network
+      getAPI('listExtensions', {
+        type: 'NetworkOrchestrator',
+        details: 'resource'
+      }).then(json => {
+        const exts = (json?.listextensionsresponse?.extension) || []
+        this.registeredExtensions = exts.filter(ext =>
+          (ext.resources || []).some(r => r.type === 'PhysicalNetwork' && r.id === this.resource.id)
+        )
+      }).catch(() => {
+        this.registeredExtensions = []
+      })
+    },
+    extensionNspItem (extName) {
+      // Build a ProviderItem-compatible itemNsp descriptor for extension-backed NSPs.
+      // Mirrors the structure of hardcoded entries in hardcodedNsps.
+      return {
+        title: extName,
+        details: ['name', 'state', 'id', 'physicalnetworkid', 'servicelist'],
+        actions: [
+          {
+            api: 'updateNetworkServiceProvider',
+            icon: 'play-circle-outlined',
+            listView: true,
+            label: 'label.enable.provider',
+            confirm: 'message.confirm.enable.provider',
+            show: (record) => record && record.id && record.state === 'Disabled',
+            mapping: {
+              state: { value: () => 'Enabled' }
+            }
+          },
+          {
+            api: 'updateNetworkServiceProvider',
+            icon: 'stop-outlined',
+            listView: true,
+            label: 'label.disable.provider',
+            confirm: 'message.confirm.disable.provider',
+            show: (record) => record && record.id && record.state === 'Enabled',
+            mapping: {
+              state: { value: () => 'Disabled' }
+            }
+          }
+        ]
+      }
     },
     fetchServiceProvider (name) {
       this.fetchLoading = true
diff --git a/ui/src/views/infra/network/providers/ProviderListView.vue b/ui/src/views/infra/network/providers/ProviderListView.vue
index ced682aeaac3..7b4cb0f8bb5b 100644
--- a/ui/src/views/infra/network/providers/ProviderListView.vue
+++ b/ui/src/views/infra/network/providers/ProviderListView.vue
@@ -25,7 +25,7 @@
       :loading="loading"
       :columns="listCols"
       :dataSource="dataSource"
-      :rowKey="record => record.id || record.name || record.nvpdeviceid || record.resourceid"
+      :rowKey="record => record.id || record.name || record.nvpdeviceid || record.resourceid || record.physicalnetworkid"
       :pagination="false"
       :scroll="scrollable">
       <template #bodyCell="{ column, text, record }">
@@ -86,6 +86,12 @@
               @onClick="onDelete(record)"/>
           </a-tooltip>
         </template>
+        <template v-if="column.key === 'details'">
+          <span v-if="text && typeof text === 'object'">
+            <a-tag v-for="(val, key) in text" :key="key" style="margin-bottom: 2px;">{{ key }}: {{ val }}</a-tag>
+          </span>
+          <span v-else>{{ text }}</span>
+        </template>
         <template v-if="column.key === 'lbdevicestate'">
           <status :text="text ? text : ''" displayText />
         </template>
diff --git a/ui/src/views/network/PublicIpResource.vue b/ui/src/views/network/PublicIpResource.vue
index 0540e7f292a8..15c423071575 100644
--- a/ui/src/views/network/PublicIpResource.vue
+++ b/ui/src/views/network/PublicIpResource.vue
@@ -136,23 +136,39 @@ export default {
       }
       if (this.resource && this.resource.vpcid) {
         const vpc = await this.fetchVpc()
+        const hasFirewallCapability = this.hasVpcFirewallCapability(vpc)
 
         // VPC IPs with source nat have only VPN when VPC offering conserve mode = false
         if (this.resource.issourcenat && vpc?.vpcofferingconservemode === false) {
-          this.tabs = this.defaultTabs.concat(this.$route.meta.tabs.filter(tab => tab.name === 'vpn'))
+          const tabs = this.defaultTabs.concat(this.$route.meta.tabs.filter(tab => tab.name === 'vpn'))
+          this.tabs = hasFirewallCapability ? this.addFirewallTab(tabs) : tabs
           return
         }
 
-        // VPC IPs with static nat have nothing
+        // VPC IPs with static nat keep existing VPN behavior; show firewall only when capability exists
         if (this.resource.isstaticnat) {
-          if (this.resource.virtualmachinetype === 'DomainRouter') {
-            this.tabs = this.defaultTabs.concat(this.$route.meta.tabs.filter(tab => tab.name === 'vpn'))
+          let tabs = this.$route.meta.tabs
+          if (hasFirewallCapability) {
+            tabs = this.addFirewallTab(tabs).map(tab => {
+              if (tab.name !== 'firewall') {
+                return tab
+              }
+              const staticNatFirewallTab = { ...tab }
+              delete staticNatFirewallTab.networkServiceFilter
+              return staticNatFirewallTab
+            })
+          } else {
+            tabs = tabs.filter(tab => tab.name !== 'firewall')
           }
+          this.tabs = tabs
           return
         }
 
-        // VPC IPs don't have firewall
-        let tabs = this.$route.meta.tabs.filter(tab => tab.name !== 'firewall')
+        // VPC IPs have all tabs; firewall is shown only if VPC has firewall capability
+        let tabs = this.$route.meta.tabs
+        if (!hasFirewallCapability) {
+          tabs = tabs.filter(tab => tab.name !== 'firewall')
+        }
 
         const network = await this.fetchNetwork()
         if (network && network.networkofferingconservemode) {
@@ -168,12 +184,12 @@ export default {
         this.portFWRuleCount = await this.fetchPortFWRule()
         this.loadBalancerRuleCount = await this.fetchLoadBalancerRule()
 
-        // VPC IPs with PF only have PF
+        // VPC IPs with PF only have PF (and firewall)
         if (this.portFWRuleCount > 0) {
           tabs = tabs.filter(tab => tab.name !== 'loadbalancing')
         }
 
-        // VPC IPs with LB rules only have LB
+        // VPC IPs with LB rules only have LB (and firewall)
         if (this.loadBalancerRuleCount > 0) {
           tabs = tabs.filter(tab => tab.name !== 'portforwarding')
         }
@@ -200,6 +216,17 @@ export default {
     fetchAction () {
       this.actions = this.$route.meta.actions || []
     },
+    addFirewallTab (tabs) {
+      const firewallTab = this.$route.meta.tabs.find(tab => tab.name === 'firewall')
+      if (!firewallTab || tabs.some(tab => tab.name === 'firewall')) {
+        return tabs
+      }
+      return tabs.concat(firewallTab)
+    },
+    hasVpcFirewallCapability (vpc) {
+      const services = vpc?.service || []
+      return Array.isArray(services) && services.some(service => (service?.name || '').toLowerCase() === 'firewall')
+    },
     fetchVpc () {
       if (!this.resource.vpcid) {
         return null
diff --git a/ui/src/views/network/VpcTab.vue b/ui/src/views/network/VpcTab.vue
index 12e21cd8ec94..1a73342d5766 100644
--- a/ui/src/views/network/VpcTab.vue
+++ b/ui/src/views/network/VpcTab.vue
@@ -405,6 +405,9 @@
       <a-tab-pane :tab="$t('label.vnf.appliances')" key="vnf" v-if="'deployVnfAppliance' in $store.getters.apis">
         <VnfAppliancesTab :resource="resource" :loading="loading" />
       </a-tab-pane>
+      <a-tab-pane :tab="$t('label.custom.actions')" key="customactions" v-if="'runCustomAction' in $store.getters.apis && 'listCustomActions' in $store.getters.apis && resource.service && resource.service.some(s => s.name === 'CustomAction')">
+        <RunCustomAction :resource="resource" />
+      </a-tab-pane>
       <a-tab-pane :tab="$t('label.events')" key="events" v-if="'listEvents' in $store.getters.apis">
         <events-tab :resource="resource" resourceType="Vpc" :loading="loading" />
       </a-tab-pane>
@@ -433,6 +436,7 @@ import AnnotationsTab from '@/components/view/AnnotationsTab'
 import ResourceIcon from '@/components/view/ResourceIcon'
 import BgpPeersTab from '@/views/infra/zone/BgpPeersTab.vue'
 import StaticRoutesTab from './StaticRoutesTab'
+import RunCustomAction from '@/views/extension/RunCustomAction'
 
 export default {
   name: 'VpcTab',
@@ -445,6 +449,7 @@ export default {
     VpcTiersTab,
     VnfAppliancesTab,
     StaticRoutesTab,
+    RunCustomAction,
     EventsTab,
     AnnotationsTab,
     ResourceIcon
diff --git a/ui/src/views/offering/AddNetworkOffering.vue b/ui/src/views/offering/AddNetworkOffering.vue
index d1bbb0f7304f..995b81ce68c6 100644
--- a/ui/src/views/offering/AddNetworkOffering.vue
+++ b/ui/src/views/offering/AddNetworkOffering.vue
@@ -739,6 +739,23 @@ export default {
     isSupportedServiceObject (obj) {
       return (obj !== null && obj !== undefined && Object.keys(obj).length > 0 && obj.constructor === Object && 'provider' in obj)
     },
+    isVpcCoreProvider (providerName, serviceName) {
+      if (['VpcVirtualRouter', 'Netscaler', 'BigSwitchBcf', 'ConfigDrive'].includes(providerName)) {
+        return true
+      }
+      return serviceName === 'Connectivity' && ['NiciraNvp', 'Ovs', 'JuniperContrailVpcRouter'].includes(providerName)
+    },
+    isBuiltInNetworkProvider (providerName) {
+      const builtInProviders = [
+        'VirtualRouter', 'JuniperContrailRouter', 'JuniperContrailVpcRouter', 'JuniperSRX', 'PaloAlto',
+        'F5BigIp', 'Netscaler', 'ExternalDhcpServer', 'ExternalGateWay', 'ElasticLoadBalancerVm',
+        'SecurityGroupProvider', 'VpcVirtualRouter', 'None', 'NiciraNvp', 'InternalLbVm', 'CiscoVnmc',
+        'Ovs', 'Opendaylight', 'BrocadeVcs', 'GloboDns', 'BigSwitchBcf', 'ConfigDrive', 'Tungsten',
+        'Nsx', 'Netris', 'BaremetalDhcpProvider', 'BaremetalPxeProvider', 'BaremetalUserdataProvider',
+        'StratosphereSsp'
+      ]
+      return builtInProviders.includes(providerName)
+    },
     fetchDomainData () {
       const params = {}
       params.listAll = true
@@ -854,6 +871,9 @@ export default {
           for (var j in this.supportedServices[i].provider) {
             var provider = this.supportedServices[i].provider[j]
             provider.description = provider.name
+            provider.displaytext = this.isBuiltInNetworkProvider(provider.name)
+              ? provider.name
+              : `${provider.name} (${this.$t('label.extension')})`
             provider.enabled = true
             if (provider.name === 'VpcVirtualRouter') {
               provider.enabled = false
@@ -917,11 +937,18 @@ export default {
             var providers = svc.provider
             providers.forEach(function (provider, providerIndex) {
               if (self.forVpc) { // *** vpc ***
-                var enabledProviders = ['VpcVirtualRouter', 'Netscaler', 'BigSwitchBcf', 'ConfigDrive']
-                if (self.lbType === 'internalLb') {
-                  enabledProviders.push('InternalLbVm')
+                // Keep the known VPC-safe providers allowlisted and only additionally enable
+                // extension providers, which listSupportedNetworkServices() already only returns
+                // for a service once the extension is confirmed to support it.
+                if (provider.name === 'InternalLbVm') {
+                  provider.enabled = self.lbType === 'internalLb' && svc.name === 'Lb'
+                } else {
+                  provider.enabled = self.isVpcCoreProvider(provider.name, svc.name) ||
+                    !self.isBuiltInNetworkProvider(provider.name)
+                }
+                if (svc.name === 'Firewall' && provider.name === 'VpcVirtualRouter') {
+                  provider.enabled = false
                 }
-                provider.enabled = enabledProviders.includes(provider.name)
               } else { // *** non-vpc ***
                 provider.enabled = !['InternalLbVm', 'VpcVirtualRouter', 'Nsx', 'Netris'].includes(provider.name)
               }
diff --git a/ui/src/views/offering/AddVpcOffering.vue b/ui/src/views/offering/AddVpcOffering.vue
index 509109c91c26..780da6638f8e 100644
--- a/ui/src/views/offering/AddVpcOffering.vue
+++ b/ui/src/views/offering/AddVpcOffering.vue
@@ -154,7 +154,7 @@
                     :checkBoxLabel="item.description"
                     :forExternalNetProvider="form.provider === 'NSX' || form.provider === 'Netris'"
                     :defaultCheckBoxValue="form.provider === 'NSX' || form.provider === 'Netris'"
-                    :selectOptions="item.provider"
+                    :selectOptions="item.provider || []"
                     @handle-checkselectpair-change="handleSupportedServiceChange"/>
                 </a-list-item>
               </template>
@@ -431,6 +431,26 @@ export default {
         this.zoneLoading = false
       })
     },
+    isVpcCoreProvider (providerName, serviceName) {
+      if (serviceName === 'Firewall') {
+        return ['VpcVirtualRouter'].includes(providerName)
+      }
+      if (['VpcVirtualRouter', 'Netscaler', 'BigSwitchBcf', 'ConfigDrive'].includes(providerName)) {
+        return true
+      }
+      return serviceName === 'Connectivity' && ['NiciraNvp', 'Ovs', 'JuniperContrailVpcRouter'].includes(providerName)
+    },
+    isBuiltInNetworkProvider (providerName) {
+      const builtInProviders = [
+        'VirtualRouter', 'JuniperContrailRouter', 'JuniperContrailVpcRouter', 'JuniperSRX', 'PaloAlto',
+        'F5BigIp', 'Netscaler', 'ExternalDhcpServer', 'ExternalGateWay', 'ElasticLoadBalancerVm',
+        'SecurityGroupProvider', 'VpcVirtualRouter', 'None', 'NiciraNvp', 'InternalLbVm', 'CiscoVnmc',
+        'Ovs', 'Opendaylight', 'BrocadeVcs', 'GloboDns', 'BigSwitchBcf', 'ConfigDrive', 'Tungsten',
+        'Nsx', 'Netris', 'BaremetalDhcpProvider', 'BaremetalPxeProvider', 'BaremetalUserdataProvider',
+        'StratosphereSsp'
+      ]
+      return builtInProviders.includes(providerName)
+    },
     fetchSupportedServiceData () {
       var services = []
       if (this.provider === 'NSX') {
@@ -520,82 +540,54 @@ export default {
           provider: [{ name: 'VpcVirtualRouter' }]
         })
       } else {
-        services.push({
-          name: 'Dhcp',
-          provider: [
-            { name: 'VpcVirtualRouter' },
-            { name: 'ConfigDrive' }
-          ]
-        })
-        services.push({
-          name: 'Dns',
-          provider: [
-            { name: 'VpcVirtualRouter' },
-            { name: 'ConfigDrive' }
-          ]
-        })
-        services.push({
-          name: 'Lb',
-          provider: [
-            { name: 'VpcVirtualRouter' },
-            { name: 'InternalLbVm' }
-          ]
-        })
-        services.push({
-          name: 'Gateway',
-          provider: [
-            { name: 'VpcVirtualRouter' },
-            { name: 'BigSwitchBcf' }
-          ]
-        })
-        services.push({
-          name: 'StaticNat',
-          provider: [
-            { name: 'VpcVirtualRouter' },
-            { name: 'BigSwitchBcf' }
-          ]
-        })
-        services.push({
-          name: 'SourceNat',
-          provider: [
-            { name: 'VpcVirtualRouter' },
-            { name: 'BigSwitchBcf' }
-          ]
-        })
-        services.push({
-          name: 'NetworkACL',
-          provider: [
-            { name: 'VpcVirtualRouter' },
-            { name: 'BigSwitchBcf' }
-          ]
-        })
-        services.push({
-          name: 'PortForwarding',
-          provider: [{ name: 'VpcVirtualRouter' }]
-        })
-        services.push({
-          name: 'UserData',
-          provider: [
-            { name: 'VpcVirtualRouter' },
-            { name: 'ConfigDrive' }
-          ]
-        })
-        services.push({
-          name: 'Vpn',
-          provider: [
-            { name: 'VpcVirtualRouter' },
-            { name: 'BigSwitchBcf' }
-          ]
-        })
-        services.push({
-          name: 'Connectivity',
-          provider: [
-            { name: 'BigSwitchBcf' },
-            { name: 'NiciraNvp' },
-            { name: 'Ovs' },
-            { name: 'JuniperContrailVpcRouter' }
-          ]
+        this.supportedServices = []
+        this.supportedServiceLoading = true
+        getAPI('listSupportedNetworkServices').then(json => {
+          const vpcServices = ['Dhcp', 'Dns', 'Lb', 'Gateway', 'StaticNat', 'SourceNat', 'NetworkACL', 'PortForwarding', 'UserData', 'Vpn', 'Connectivity', 'CustomAction', 'Firewall']
+          services = (json?.listsupportednetworkservicesresponse?.networkservice || [])
+            .filter(service => vpcServices.includes(service.name))
+            .map(service => {
+              const providerMap = {}
+              const providers = [...(service.provider || []), ...(service.name === 'Lb' ? [{ name: 'InternalLbVm' }] : [])]
+                .map(provider => {
+                  const providerName = provider.name === 'VirtualRouter' ? 'VpcVirtualRouter' : provider.name
+                  const isExtension = !this.isBuiltInNetworkProvider(providerName)
+                  const enabled = providerName === 'InternalLbVm'
+                    ? service.name === 'Lb'
+                    : this.isVpcCoreProvider(providerName, service.name) || isExtension
+                  return {
+                    name: providerName,
+                    description: providerName,
+                    displaytext: isExtension ? `${providerName} (${this.$t('label.extension')})` : providerName,
+                    enabled
+                  }
+                })
+                .filter(provider => {
+                  if (providerMap[provider.name]) {
+                    return false
+                  }
+                  providerMap[provider.name] = true
+                  return true
+                })
+              return {
+                ...service,
+                description: service.name,
+                provider: providers
+              }
+            })
+
+          this.supportedServices = []
+          if (this.networkmode === 'ROUTED') {
+            services = services.filter(service => !['SourceNat', 'StaticNat', 'Lb', 'PortForwarding', 'Vpn', 'Firewall'].includes(service.name))
+          }
+          this.supportedServices = services
+        }).catch(error => {
+          this.supportedServices = []
+          this.$notifyError(error)
+        }).finally(() => {
+          this.supportedServiceLoading = false
         })
+        return
       }
       this.supportedServices = []
       if (this.networkmode === 'ROUTED') {
@@ -647,7 +639,7 @@ export default {
       if (service === 'SourceNat') {
         this.sourceNatServiceChecked = checked
       }
-      if (checked && provider != null & provider !== undefined) {
+      if (checked && provider != null && provider !== undefined) {
         this.selectedServiceProviderMap[service] = provider
       } else {
         delete this.selectedServiceProviderMap[service]
diff --git a/ui/src/views/offering/CloneVpcOffering.vue b/ui/src/views/offering/CloneVpcOffering.vue
index cecc0c600b57..6adbfafad611 100644
--- a/ui/src/views/offering/CloneVpcOffering.vue
+++ b/ui/src/views/offering/CloneVpcOffering.vue
@@ -523,6 +523,7 @@ export default {
       return [
         { name: 'Dhcp', provider: [{ name: 'VpcVirtualRouter' }, { name: 'ConfigDrive' }] },
         { name: 'Dns', provider: [{ name: 'VpcVirtualRouter' }, { name: 'ConfigDrive' }] },
+        { name: 'Firewall', provider: [{ name: 'VpcVirtualRouter' }] },
         { name: 'Lb', provider: [{ name: 'VpcVirtualRouter' }, { name: 'InternalLbVm' }] },
         { name: 'Gateway', provider: [{ name: 'VpcVirtualRouter' }, { name: 'BigSwitchBcf' }] },
         { name: 'StaticNat', provider: [{ name: 'VpcVirtualRouter' }, { name: 'BigSwitchBcf' }] },
diff --git a/ui/src/views/offering/CreateBackupOffering.vue b/ui/src/views/offering/CreateBackupOffering.vue
new file mode 100644
index 000000000000..c9e22949f061
--- /dev/null
+++ b/ui/src/views/offering/CreateBackupOffering.vue
@@ -0,0 +1,297 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+<template>
+  <div class="form-layout" v-ctrl-enter="handleSubmit">
+    <a-form
+      layout="vertical"
+      :ref="formRef"
+      :model="form"
+      :rules="rules"
+      @finish="handleSubmit"
+    >
+      <a-form-item name="name" ref="name">
+        <template #label>
+          <tooltip-label :title="$t('label.name')" :tooltip="apiParams.name.description"/>
+        </template>
+        <a-input
+          v-focus="true"
+          v-model:value="form.name"/>
+      </a-form-item>
+      <a-form-item name="description" ref="description">
+        <template #label>
+          <tooltip-label :title="$t('label.description')" :tooltip="apiParams.description.description"/>
+        </template>
+        <a-input v-model:value="form.description"/>
+      </a-form-item>
+      <a-form-item name="zoneid" ref="zoneid">
+        <template #label>
+          <tooltip-label :title="$t('label.zoneid')" :tooltip="apiParams.zoneid.description"/>
+        </template>
+        <a-select
+          allowClear
+          v-model:value="form.zoneid"
+          :loading="zones.loading"
+          showSearch
+          optionFilterProp="label"
+          :filterOption="(input, option) => {
+            return option.label.toLowerCase().indexOf(input.toLowerCase()) >= 0
+          }" >
+          <a-select-option v-for="zone in zones.opts" :key="zone.name" :label="zone.name">
+            <span>
+              <resource-icon v-if="zone.icon" :image="zone.icon.base64image" size="1x" style="margin-right: 5px"/>
+              <global-outlined v-else style="margin-right: 5px"/>
+              {{ zone.name }}
+            </span>
+          </a-select-option>
+        </a-select>
+      </a-form-item>
+      <a-form-item name="allowuserdrivenbackups" ref="allowuserdrivenbackups">
+        <template #label>
+          <tooltip-label :title="$t('label.allowuserdrivenbackups')" :tooltip="apiParams.allowuserdrivenbackups.description"/>
+        </template>
+        <a-switch v-model:checked="form.allowuserdrivenbackups"/>
+      </a-form-item>
+      <a-form-item name="ispublic" ref="ispublic" :label="$t('label.ispublic')" v-if="isAdmin()">
+        <a-switch v-model:checked="form.ispublic" />
+      </a-form-item>
+      <a-form-item name="domainid" ref="domainid" v-if="!form.ispublic">
+        <template #label>
+          <tooltip-label :title="$t('label.domainid')" :tooltip="apiParams.domainid.description"/>
+        </template>
+        <a-select
+          mode="multiple"
+          :getPopupContainer="(trigger) => trigger.parentNode"
+          v-model:value="form.domainid"
+          showSearch
+          optionFilterProp="label"
+          :filterOption="(input, option) => {
+              return option.label.toLowerCase().indexOf(input.toLowerCase()) >= 0
+            }"
+          :loading="domains.loading"
+          :placeholder="apiParams.domainid.description">
+          <a-select-option v-for="(opt, optIndex) in domains.opts" :key="optIndex" :label="opt.path || opt.name || opt.description">
+              <span>
+                <resource-icon v-if="opt && opt.icon" :image="opt.icon.base64image" size="1x" style="margin-right: 5px"/>
+                <block-outlined v-else style="margin-right: 5px" />
+                {{ opt.path || opt.name || opt.description }}
+              </span>
+          </a-select-option>
+        </a-select>
+      </a-form-item>
+      <a-form-item name="compress" ref="compress" :label="$t('label.compress')">
+        <a-switch v-model:checked="form.compress" />
+      </a-form-item>
+      <a-form-item name="compressionlibrary" ref="compressionlibrary" v-if="form.compress">
+        <template #label>
+          <tooltip-label :title="$t('label.compressionlibrary')" :tooltip="apiParams.compressionlibrary.description"/>
+        </template>
+        <a-select
+          v-model:value="form.compressionlibrary"
+          :placeholder="apiParams.compressionlibrary.description">
+          <a-select-option
+            v-for="item in compressionlibraryopts"
+            :key="item"
+            :value="item">
+            {{ item }}
+          </a-select-option>
+        </a-select>
+      </a-form-item>
+      <a-form-item name="validate" ref="validate" :label="$t('label.validate')">
+        <a-switch v-model:checked="form.validate" />
+      </a-form-item>
+      <a-form-item name="validationsteps" ref="validationsteps" v-if="form.validate">
+        <template #label>
+          <tooltip-label :title="$t('label.validationsteps')" :tooltip="apiParams.validationsteps.description"/>
+        </template>
+        <a-select
+          mode="tags"
+          showSearch
+          :options="validationstepsoptions"
+          v-model:value="form.validationsteps"
+          :placeholder="apiParams.validationsteps.description">
+        </a-select>
+      </a-form-item>
+      <a-form-item name="allowextractfile" ref="allowextractfile" :label="$t('label.allowextractfile')">
+        <a-switch v-model:checked="form.allowextractfile" />
+      </a-form-item>
+      <a-form-item name="allowquickrestore" ref="allowquickrestore" :label="$t('label.allowquickrestore')">
+        <a-switch v-model:checked="form.allowquickrestore" />
+      </a-form-item>
+      <a-form-item ref="backupchainsize" name="backupchainsize">
+        <template #label>
+          <tooltip-label :title="$t('label.backupchainsize')" :tooltip="apiParams.backupchainsize.description"/>
+        </template>
+        <a-input
+          v-model:value="form.backupchainsize"/>
+      </a-form-item>
+      <div :span="24" class="action-button">
+        <a-button :loading="loading" @click="closeAction">{{ this.$t('label.cancel') }}</a-button>
+        <a-button :loading="loading" ref="submit" type="primary" @click="handleSubmit">{{ this.$t('label.ok') }}</a-button>
+      </div>
+    </a-form>
+  </div>
+</template>
+
+<script>
+import { ref, reactive, toRaw } from 'vue'
+import { getAPI, postAPI } from '@/api'
+import { isAdmin } from '@/role'
+import ResourceIcon from '@/components/view/ResourceIcon'
+import TooltipLabel from '@/components/widgets/TooltipLabel'
+
+export default {
+  name: 'CreateBackupOffering',
+  components: {
+    TooltipLabel,
+    ResourceIcon
+  },
+  data () {
+    return {
+      loading: false,
+      domains: {
+        loading: false,
+        opts: []
+      },
+      zones: {
+        loading: false,
+        opts: []
+      },
+      compressionlibraryopts: ['zlib', 'zstd'],
+      validationstepsoptions: [
+        { value: 'wait_for_boot', label: 'wait_for_boot' },
+        { value: 'screenshot', label: 'screenshot' },
+        { value: 'execute_command', label: 'execute_command' }
+      ]
+    }
+  },
+  beforeCreate () {
+    this.apiParams = this.$getApiParams('createBackupOffering')
+  },
+  created () {
+    this.initForm()
+    this.fetchData()
+  },
+  methods: {
+    initForm () {
+      this.formRef = ref()
+      this.form = reactive({
+        allowuserdrivenbackups: true,
+        ispublic: true,
+        compress: false,
+        validate: false,
+        allowquickrestore: true,
+        allowextractfile: true,
+        backupchainsize: null,
+        validationsteps: [],
+        compressionlibrary: null
+      })
+      this.rules = reactive({
+        name: [{ required: true, message: this.$t('message.error.required.input') }],
+        description: [{ required: true, message: this.$t('message.error.required.input') }],
+        zoneid: [{ required: true, message: this.$t('message.error.select') }],
+        domainid: [{ type: 'array', message: this.$t('message.error.select') }]
+      })
+    },
+    isAdmin () {
+      return isAdmin()
+    },
+    fetchData () {
+      this.fetchZone()
+      this.fetchDomainData()
+    },
+    fetchZone () {
+      this.zones.loading = true
+      getAPI('listZones', { available: true, showicon: true }).then(json => {
+        this.zones.opts = json.listzonesresponse.zone || []
+      }).catch(error => {
+        this.$notifyError(error)
+      }).finally(f => {
+        this.zones.loading = false
+      })
+    },
+    fetchDomainData () {
+      const params = {}
+      params.listAll = true
+      params.details = 'min'
+      this.domains.loading = true
+      getAPI('listDomains', params).then(json => {
+        this.domains.opts = json.listdomainsresponse.domain || []
+      }).catch(error => {
+        this.$notifyError(error)
+      }).finally(() => {
+        this.domains.loading = false
+      })
+    },
+    handleSubmit (e) {
+      e.preventDefault()
+      if (this.loading) return
+      this.formRef.value.validate().then(() => {
+        const values = toRaw(this.form)
+        const params = {}
+        for (const key in values) {
+          const input = values[key]
+          if (key === 'zoneid') {
+            params[key] = this.zones.opts.filter(zone => zone.name === input)[0].id || null
+          } else if (input !== null && key !== 'validationsteps') {
+            params[key] = input
+          }
+        }
+        if (values.ispublic !== true) {
+          var domainIndexes = values.domainid
+          var domainId = null
+          if (domainIndexes && domainIndexes.length > 0) {
+            var domainIds = []
+            for (var i = 0; i < domainIndexes.length; i++) {
+              domainIds = domainIds.concat(this.domains.opts[domainIndexes[i]].id)
+            }
+            domainId = domainIds.join(',')
+          }
+          if (domainId) {
+            params.domainid = domainId
+          }
+        }
+        if (values.validationsteps.length !== 0) {
+          params.validationsteps = values.validationsteps.join(',')
+        }
+        this.loading = true
+        postAPI('createBackupOffering', params).then(json => {
+          this.closeAction()
+          this.loading = false
+        }).catch(error => {
+          this.$notifyError(error)
+          this.loading = false
+        })
+      })
+    },
+    closeAction () {
+      this.$emit('close-action')
+      this.$emit('refresh-data')
+    }
+  }
+}
+</script>
+
+<style scoped lang="less">
+.form-layout {
+  width: 30vw;
+
+  @media (min-width: 500px) {
+    width: 450px;
+  }
+}
+</style>
diff --git a/ui/src/views/plugins/quota/AddQuotaCredit.vue b/ui/src/views/plugins/quota/AddQuotaCredit.vue
new file mode 100644
index 000000000000..51a2d84bb803
--- /dev/null
+++ b/ui/src/views/plugins/quota/AddQuotaCredit.vue
@@ -0,0 +1,163 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+<template>
+  <a-spin :spinning="loading">
+    <a-form
+      class="form"
+      layout="vertical"
+      :ref="formRef"
+      :model="form"
+      :rules="rules"
+      @finish="handleSubmit"
+      v-ctrl-enter="handleSubmit">
+      <ownership-selection @fetch-owner="fetchOwnerOptions" :account-state="null"/>
+      <a-form-item ref="value" name="value">
+        <template #label>
+          <tooltip-label :title="$t('label.value')" :tooltip="apiParams.value.description"/>
+        </template>
+        <a-input-number
+          v-model:value="form.value"
+          :placeholder="$t('placeholder.quota.credit.add.value')" />
+      </a-form-item>
+      <a-form-item ref="min_balance" name="min_balance">
+        <template #label>
+          <tooltip-label :title="$t('label.min_balance')" :tooltip="apiParams.min_balance.description"/>
+        </template>
+        <a-input-number
+          v-model:value="form.min_balance"
+          :placeholder="$t('placeholder.quota.credit.add.min_balance')" />
+      </a-form-item>
+      <a-form-item ref="quota_enforce" name="quota_enforce">
+        <template #label>
+          <tooltip-label :title="$t('label.quota.enforce')" :tooltip="apiParams.quota_enforce.description"/>
+        </template>
+        <a-switch
+          v-model:checked="form.quota_enforce" />
+      </a-form-item>
+      <div :span="24" class="action-button">
+        <a-button @click="closeModal">{{ $t('label.cancel') }}</a-button>
+        <a-button type="primary" ref="submit" @click="handleSubmit">{{ $t('label.ok') }}</a-button>
+      </div>
+    </a-form>
+  </a-spin>
+</template>
+
+<script>
+import { getAPI } from '@/api'
+import OwnershipSelection from '@/views/compute/wizard/OwnershipSelection.vue'
+import TooltipLabel from '@/components/widgets/TooltipLabel'
+import { ref, reactive, toRaw } from 'vue'
+import { mixinForm } from '@/utils/mixin'
+import store from '@/store'
+
+export default {
+  name: 'AddQuotaCredit',
+  mixins: [mixinForm],
+  components: {
+    OwnershipSelection,
+    TooltipLabel
+  },
+  data () {
+    return {
+      loading: false,
+      domainList: [],
+      accountList: [],
+      domainId: undefined,
+      domainLoading: false,
+      domainError: false,
+      owner: {
+        projectid: store.getters.project?.id,
+        domainid: store.getters.project?.id ? null : store.getters.userInfo.domainid,
+        account: store.getters.project?.id ? null : store.getters.userInfo.account,
+        name: store.getters.project?.id ? store.getters.project.name : store.getters.userInfo.account
+      }
+    }
+  },
+  inject: ['parentFetchData'],
+  beforeCreate () {
+    this.apiParams = this.$getApiParams('quotaCredits')
+  },
+  created () {
+    this.initForm()
+  },
+  methods: {
+    initForm () {
+      this.formRef = ref()
+      this.form = reactive({})
+      this.rules = reactive({
+        value: [{ required: true, message: this.$t('message.action.quota.credit.add.error.valuerequired') }]
+      })
+    },
+    handleSubmit (e) {
+      e.preventDefault()
+      if (this.loading) return
+
+      this.formRef.value.validate().then(() => {
+        const formRaw = toRaw(this.form)
+        const values = this.handleRemoveFields(formRaw)
+        values.ignoreproject = true
+
+        if (this.owner.projectid) {
+          values.projectid = this.owner.projectid
+        } else {
+          values.account = this.owner.account
+          values.domainid = this.owner.domainid
+        }
+
+        this.loading = true
+        getAPI('quotaCredits', values).then(response => {
+          this.$message.success(this.$t('message.action.quota.credit.add.success',
+            { credit: response.quotacreditsresponse.quotacredits.credit, account: this.owner.name }))
+          this.parentFetchData()
+          this.closeModal()
+        }).catch(error => {
+          this.$notifyError(error)
+        }).finally(() => {
+          this.loading = false
+        })
+      }).catch((error) => {
+        this.formRef.value.scrollToField(error.errorFields[0].name)
+      })
+    },
+    closeModal () {
+      this.$emit('close-action')
+    },
+    fetchOwnerOptions (ownerOptions) {
+      this.owner = {}
+      if (ownerOptions.selectedAccountType === 'Account') {
+        if (!ownerOptions.selectedAccount) {
+          return
+        }
+        this.owner.account = ownerOptions.selectedAccount
+        this.owner.domainid = ownerOptions.selectedDomain
+        this.owner.name = ownerOptions.selectedAccount
+      } else if (ownerOptions.selectedAccountType === 'Project') {
+        if (!ownerOptions.selectedProject) {
+          return
+        }
+        this.owner.projectid = ownerOptions.selectedProject
+        this.owner.name = ownerOptions.projects.find(p => p.id === ownerOptions.selectedProject).name
+      }
+    }
+  }
+}
+</script>
+
+<style lang="scss" scoped>
+@import '@/style/objects/form.scss';
+</style>
diff --git a/ui/src/views/plugins/quota/CreateQuotaTariff.vue b/ui/src/views/plugins/quota/CreateQuotaTariff.vue
index 18086aca2af0..3262c61b7351 100644
--- a/ui/src/views/plugins/quota/CreateQuotaTariff.vue
+++ b/ui/src/views/plugins/quota/CreateQuotaTariff.vue
@@ -62,7 +62,6 @@
           <tooltip-label :title="$t('label.quota.tariff.value')" :tooltip="apiParams.value.description"/>
         </template>
         <a-input-number
-          class="full-width-input"
           v-model:value="form.value"
           :placeholder="$t('placeholder.quota.tariff.value')" />
       </a-form-item>
@@ -85,7 +84,6 @@
           <tooltip-label :title="$t('label.quota.tariff.position')" :tooltip="apiParams.position.description" />
         </template>
         <a-input-number
-          class="full-width-input"
           v-model:value="form.position"
           :placeholder="$t('placeholder.quota.tariff.position')" />
       </a-form-item>
@@ -94,7 +92,6 @@
           <tooltip-label :title="$t('label.start.date')" :tooltip="apiParams.startdate.description"/>
         </template>
         <a-date-picker
-          class="full-width-input"
           v-model:value="form.startDate"
           :disabled-date="disabledStartDate"
           :placeholder="$t('placeholder.quota.tariff.startdate')"
diff --git a/ui/src/views/plugins/quota/EditQuotaTariff.vue b/ui/src/views/plugins/quota/EditQuotaTariff.vue
index b456dc539fc5..496a25c0240d 100644
--- a/ui/src/views/plugins/quota/EditQuotaTariff.vue
+++ b/ui/src/views/plugins/quota/EditQuotaTariff.vue
@@ -38,7 +38,6 @@
           <tooltip-label :title="$t('label.quota.tariff.value')" :tooltip="apiParams.value.description"/>
         </template>
         <a-input-number
-          class="full-width-input"
           v-model:value="form.value"
           :placeholder="$t('placeholder.quota.tariff.value')" />
       </a-form-item>
@@ -61,7 +60,6 @@
          <tooltip-label :title="$t('label.quota.tariff.position')" :tooltip="apiParams.position.description"/>
        </template>
        <a-input-number
-          class="full-width-input"
           v-model:value="form.position"
           :placeholder="$t('placeholder.quota.tariff.position')" />
       </a-form-item>
@@ -70,7 +68,6 @@
           <tooltip-label :title="$t('label.end.date')" :tooltip="apiParams.enddate.description"/>
         </template>
         <a-date-picker
-          class="full-width-input"
           v-model:value="form.endDate"
           :disabled-date="disabledEndDate"
           :placeholder="$t('placeholder.quota.tariff.enddate')"
diff --git a/ui/src/views/plugins/quota/EditTariffValueWizard.vue b/ui/src/views/plugins/quota/EditTariffValueWizard.vue
deleted file mode 100644
index 4387170aca43..000000000000
--- a/ui/src/views/plugins/quota/EditTariffValueWizard.vue
+++ /dev/null
@@ -1,145 +0,0 @@
-// Licensed to the Apache Software Foundation (ASF) under one
-// or more contributor license agreements.  See the NOTICE file
-// distributed with this work for additional information
-// regarding copyright ownership.  The ASF licenses this file
-// to you under the Apache License, Version 2.0 (the
-// "License"); you may not use this file except in compliance
-// with the License.  You may obtain a copy of the License at
-//
-//   http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing,
-// software distributed under the License is distributed on an
-// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied.  See the License for the
-// specific language governing permissions and limitations
-// under the License.
-
-<template>
-  <a-modal
-    v-if="showAction"
-    style="top: 20px;"
-    centered
-    :confirmLoading="loading"
-    :title="$t('label.quota.configuration')"
-    :closable="true"
-    :maskClosable="false"
-    :visible="showAction"
-    :footer="null"
-    @cancel="onClose"
-  >
-    <a-form
-      :ref="formRef"
-      :model="form"
-      :rules="rules"
-      layout="vertical"
-      @finish="submitTariff"
-      v-ctrl-enter="submitTariff"
-     >
-      <a-form-item name="value" ref="value" :label="$t('label.quota.value')">
-        <a-input
-          v-focus="true"
-          v-model:value="form.value"></a-input>
-      </a-form-item>
-      <a-form-item name="startdate" ref="startdate" :label="$t('label.quota.tariff.effectivedate')">
-        <a-date-picker
-          :disabledDate="disabledDate"
-          style="width: 100%"
-          v-model:value="form.startdate"></a-date-picker>
-      </a-form-item>
-
-      <div :span="24" class="action-button">
-        <a-button @click="onClose">{{ $t('label.cancel') }}</a-button>
-        <a-button type="primary" ref="submit" @click="submitTariff">{{ $t('label.ok') }}</a-button>
-      </div>
-    </a-form>
-  </a-modal>
-</template>
-
-<script>
-import { ref, reactive, toRaw } from 'vue'
-import { postAPI } from '@/api'
-import moment from 'moment'
-
-export default {
-  name: 'EditTariffValueWizard',
-  props: {
-    showAction: {
-      type: Boolean,
-      default: () => false
-    },
-    resource: {
-      type: Object,
-      required: true
-    }
-  },
-  data () {
-    return {
-      loading: false,
-      pattern: 'YYYY-MM-DD'
-    }
-  },
-  inject: ['parentFetchData'],
-  created () {
-    this.initForm()
-  },
-  methods: {
-    initForm () {
-      this.formRef = ref()
-      this.form = reactive({
-        value: this.resource.tariffValue
-      })
-      this.rules = reactive({
-        value: [{ required: true, message: this.$t('message.error.required.input') }],
-        startdate: [{ type: 'object', required: true, message: this.$t('message.error.date') }]
-      })
-    },
-    onClose () {
-      this.$emit('edit-tariff-action', false)
-    },
-    submitTariff (e) {
-      e.preventDefault()
-      if (this.loading) return
-      this.formRef.value.validate().then(() => {
-        const values = toRaw(this.form)
-
-        const params = {}
-        params.usageType = this.resource.usageType
-        params.value = values.value
-        params.startdate = values.startdate.format(this.pattern)
-
-        this.loading = true
-
-        postAPI('quotaTariffUpdate', params).then(json => {
-          const tariffResponse = json.quotatariffupdateresponse.quotatariff || {}
-          if (Object.keys(tariffResponse).length > 0) {
-            const effectiveDate = moment(tariffResponse.effectiveDate).format(this.pattern)
-            const query = this.$route.query
-            if (query.startdate !== effectiveDate) {
-              this.$router.replace({ path: 'quotatariff', query: { startdate: effectiveDate } })
-            }
-            this.parentFetchData()
-          }
-          this.$message.success(`${this.$t('message.setting.updated')} ${this.resource.description}`)
-          this.onClose()
-        }).catch(error => {
-          this.$notification.error({
-            message: this.$t('message.request.failed'),
-            description: (error.response && error.response.headers && error.response.headers['x-description']) || error.message
-          })
-        }).finally(() => {
-          this.loading = false
-        })
-      }).catch((error) => {
-        this.formRef.value.scrollToField(error.errorFields[0].name)
-      })
-    },
-    disabledDate (current) {
-      return current && current < moment().endOf('day')
-    }
-  }
-}
-</script>
-
-<style scoped>
-</style>
diff --git a/ui/src/views/plugins/quota/EmailTemplateDetails.vue b/ui/src/views/plugins/quota/EmailTemplateDetails.vue
index 0644fa55b69d..a048cdd7188d 100644
--- a/ui/src/views/plugins/quota/EmailTemplateDetails.vue
+++ b/ui/src/views/plugins/quota/EmailTemplateDetails.vue
@@ -63,9 +63,14 @@ import { postAPI } from '@/api'
 
 export default {
   name: 'EmailTemplateDetails',
+  props: {
+    resource: {
+      type: Object,
+      required: true
+    }
+  },
   data () {
     return {
-      resource: {},
       formModel: {
         templatesubject: null,
         templatebody: null
@@ -74,29 +79,10 @@ export default {
     }
   },
   created () {
-    this.fetchData()
+    this.formModel.templatesubject = this.resource.templatesubject || null
+    this.formModel.templatebody = this.resource.templatebody || null
   },
   methods: {
-    fetchData () {
-      this.loading = true
-      const params = {}
-      params.templatetype = this.$route.params.id
-
-      postAPI('quotaEmailTemplateList', params).then(json => {
-        const listTemplates = json.quotaemailtemplatelistresponse.quotaemailtemplate || []
-        this.resource = listTemplates && listTemplates.length > 0 ? listTemplates[0] : {}
-        this.preFillDataValues()
-      }).catch(e => {
-        this.$notifyError(e)
-      }).finally(() => {
-        this.loading = false
-      })
-    },
-    preFillDataValues () {
-      console.log(this.resource)
-      this.formModel.templatesubject = this.resource.templatesubject || null
-      this.formModel.templatebody = this.resource.templatebody || null
-    },
     handleSubmit () {
       if (this.loading) return
       const params = {}
diff --git a/ui/src/views/plugins/quota/FilterQuotaDataByPeriodView.vue b/ui/src/views/plugins/quota/FilterQuotaDataByPeriodView.vue
new file mode 100644
index 000000000000..3e4839b21aa2
--- /dev/null
+++ b/ui/src/views/plugins/quota/FilterQuotaDataByPeriodView.vue
@@ -0,0 +1,161 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+<template>
+  <div>
+    <a-modal
+      v-model:visible="showFilterQuotaDataByPeriodModal"
+      :title="$t('label.quota.select.period')"
+      :maskClosable="false"
+      :footer="null">
+      <a-form
+        class="form-layout"
+        :model="form"
+        @finish="handleSubmit"
+        v-ctrl-enter="handleSubmit">
+        <a-form-item ref="dates" name="dates" style="width: 100%">
+          <a-range-picker
+            class="w-100"
+            v-model:value="form.dates"
+            show-time />
+        </a-form-item>
+        <div :span="24" class="action-button">
+          <a-button @click="closeFilterQuotaDataByPeriodModal">{{ this.$t('label.cancel') }}</a-button>
+          <a-button ref="submit" type="primary" @click="handleSubmit">{{ this.$t('label.ok') }}</a-button>
+        </div>
+      </a-form>
+    </a-modal>
+
+    <div class="chart-row">
+      <a-space direction="vertical">
+        <div>
+          <a-radio-group
+            v-model:value="periodSelected"
+            buttonStyle="solid"
+            @change="handlePeriodChange">
+            <a-radio-button value="day">
+              {{ $t('label.quota.period.today') }}
+            </a-radio-button>
+            <a-radio-button value="week">
+              {{ $t('label.quota.period.this.week') }}
+            </a-radio-button>
+            <a-radio-button value="month">
+              {{ $t('label.quota.period.this.month') }}
+            </a-radio-button>
+            <a-radio-button value="lastmonth">
+              {{ $t('label.quota.period.last.month') }}
+            </a-radio-button>
+            <a-radio-button value="year">
+              {{ $t('label.quota.period.this.year') }}
+            </a-radio-button>
+            <a-radio-button value="lastyear">
+              {{ $t('label.quota.period.last.year') }}
+            </a-radio-button>
+            <a-radio-button value="custom" @click="openFilterQuotaDataByPeriodModal">
+              {{ $t('label.quota.period.custom') }}
+            </a-radio-button>
+          </a-radio-group>
+        </div>
+      </a-space>
+      <div class="mt-10">
+        <filter-outlined style="margin-right: 5px"/>
+        <span v-html="getPeriodToString()" />
+      </div>
+    </div>
+  </div>
+</template>
+
+<script>
+
+import { dayjs, parseDayJsObject, toLocaleDate } from '@/utils/date'
+import { reactive, toRaw } from 'vue'
+
+export default {
+  name: 'FilterQuotaDataByPeriodView',
+  data () {
+    return {
+      periodSelected: 'month',
+      showFilterQuotaDataByPeriodModal: false,
+      startDate: undefined,
+      endDate: undefined
+    }
+  },
+  created () {
+    this.initForm()
+    this.handlePeriodChange()
+  },
+  methods: {
+    initForm () {
+      this.form = reactive({ dates: [this.startDate, this.endDate] })
+    },
+    handlePeriodChange () {
+      let end = dayjs()
+      let start
+      switch (this.periodSelected) {
+        case 'day':
+        case 'week':
+        case 'month':
+        case 'year':
+          start = dayjs().startOf(this.periodSelected)
+          break
+        case 'lastmonth': {
+          const lastMonth = dayjs().subtract(1, 'months')
+          start = dayjs(lastMonth).startOf('month')
+          end = dayjs(lastMonth).endOf('month')
+          break
+        }
+        case 'lastyear': {
+          const lastYear = dayjs().subtract(1, 'years')
+          start = dayjs(lastYear).startOf('year')
+          end = dayjs(lastYear).endOf('year')
+          break
+        }
+        default:
+          return
+      }
+      this.triggerFetchData([start, end])
+    },
+    openFilterQuotaDataByPeriodModal () {
+      this.showFilterQuotaDataByPeriodModal = true
+    },
+    closeFilterQuotaDataByPeriodModal () {
+      this.showFilterQuotaDataByPeriodModal = false
+    },
+    getPeriodToString () {
+      return this.$t('label.quota.filter.period', {
+        startDate: toLocaleDate({ date: parseDayJsObject({ value: this.startDate, keepMoment: true, format: false }) }),
+        endDate: toLocaleDate({ date: parseDayJsObject({ value: this.endDate, keepMoment: true, format: false }) })
+      })
+    },
+    handleSubmit () {
+      const formRaw = toRaw(this.form)
+      this.triggerFetchData(formRaw.dates)
+    },
+    triggerFetchData (values) {
+      this.startDate = values[0]
+      this.endDate = values[1]
+      this.initForm()
+      this.closeFilterQuotaDataByPeriodModal()
+      this.$emit('fetchData', this.startDate, this.endDate)
+    }
+  }
+}
+</script>
+
+<style lang="scss" scoped>
+@import '@/style/common/common.scss';
+</style>
diff --git a/ui/src/views/plugins/quota/QuotaBalance.vue b/ui/src/views/plugins/quota/QuotaBalance.vue
deleted file mode 100644
index f1cf640f6aaa..000000000000
--- a/ui/src/views/plugins/quota/QuotaBalance.vue
+++ /dev/null
@@ -1,173 +0,0 @@
-// Licensed to the Apache Software Foundation (ASF) under one
-// or more contributor license agreements.  See the NOTICE file
-// distributed with this work for additional information
-// regarding copyright ownership.  The ASF licenses this file
-// to you under the Apache License, Version 2.0 (the
-// "License"); you may not use this file except in compliance
-// with the License.  You may obtain a copy of the License at
-//
-//   http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing,
-// software distributed under the License is distributed on an
-// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied.  See the License for the
-// specific language governing permissions and limitations
-// under the License.
-
-<template>
-  <div>
-    <a-table
-      size="small"
-      :loading="loading"
-      :columns="columns"
-      :dataSource="dataSource"
-      :rowKey="record => record.name"
-      :pagination="false"
-      :scroll="{ y: '55vh' }"
-    >
-      <template #bodyCell="{ column, text }">
-        <template v-if="column.key === 'quota'">
-          <span v-if="text!==null">{{ `${currency} ${text}` }}</span>
-        </template>
-        <template v-if="column.key === 'credit'">
-          <span v-if="text!==null">{{ `${currency} ${text}` }}</span>
-        </template>
-      </template>
-    </a-table>
-  </div>
-</template>
-
-<script>
-import { getAPI } from '@/api'
-import moment from 'moment'
-
-export default {
-  name: 'QuotaBalance',
-  props: {
-    resource: {
-      type: Object,
-      required: true
-    },
-    tab: {
-      type: String,
-      default: () => ''
-    }
-  },
-  data () {
-    return {
-      loading: false,
-      pattern: 'YYYY-MM-DD',
-      currency: '',
-      dataSource: [],
-      account: null
-    }
-  },
-  computed: {
-    columns () {
-      return [
-        {
-          key: 'date',
-          title: this.$t('label.date'),
-          dataIndex: 'date',
-          width: 'calc(100% / 3)'
-        },
-        {
-          key: 'quota',
-          title: this.$t('label.quota.value'),
-          dataIndex: 'quota',
-          width: 'calc(100% / 3)'
-        },
-        {
-          key: 'credit',
-          title: this.$t('label.credit'),
-          dataIndex: 'credit',
-          width: 'calc(100% / 3)'
-        }
-      ]
-    }
-  },
-  watch: {
-    tab () {
-      if (this.tab === 'quota.statement.balance') {
-        this.fetchData()
-      }
-    }
-  },
-  created () {
-    this.fetchData()
-  },
-  methods: {
-    async fetchData () {
-      this.dataSource = []
-      this.loading = true
-      this.account = this.$route.query && this.$route.query.account ? this.$route.query.account : null
-
-      try {
-        const resource = await this.fetchResource()
-        const quotaBalance = await this.quotaBalance(resource)
-        this.currency = quotaBalance.currency
-        this.dataSource = await this.createDataSource(quotaBalance)
-        this.loading = false
-      } catch (e) {
-        console.log(e)
-        this.loading = false
-      }
-    },
-    createDataSource (quotaBalance) {
-      const dataSource = []
-      const credits = quotaBalance.credits || []
-
-      dataSource.push({
-        date: moment(quotaBalance.enddate).format(this.pattern),
-        quota: quotaBalance.endquota,
-        credit: null
-      })
-      dataSource.push({
-        date: moment(quotaBalance.startdate).format(this.pattern),
-        quota: quotaBalance.startquota,
-        credit: null
-      })
-      credits.map(item => {
-        dataSource.push({
-          date: moment(item.updated_on).format(this.pattern),
-          quota: null,
-          credit: item.credits
-        })
-      })
-
-      return dataSource
-    },
-    fetchResource () {
-      return new Promise((resolve, reject) => {
-        const params = {}
-        params.domainid = this.resource.domainid
-        params.account = this.account
-
-        getAPI('quotaBalance', params).then(json => {
-          const quotaBalance = json.quotabalanceresponse.balance || {}
-          resolve(quotaBalance)
-        }).catch(error => {
-          reject(error)
-        })
-      })
-    },
-    quotaBalance (resource) {
-      return new Promise((resolve, reject) => {
-        const params = {}
-        params.domainid = this.resource.domainid
-        params.account = this.account
-        params.startdate = moment(this.resource.startdate).format(this.pattern)
-        params.enddate = moment(resource.startdate).format(this.pattern)
-
-        getAPI('quotaBalance', params).then(json => {
-          const quotaBalance = json.quotabalanceresponse.balance || {}
-          resolve(quotaBalance)
-        }).catch(error => {
-          reject(error)
-        })
-      })
-    }
-  }
-}
-</script>
diff --git a/ui/src/views/plugins/quota/QuotaBalanceTab.vue b/ui/src/views/plugins/quota/QuotaBalanceTab.vue
new file mode 100644
index 000000000000..46c2e03d8fe9
--- /dev/null
+++ b/ui/src/views/plugins/quota/QuotaBalanceTab.vue
@@ -0,0 +1,204 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+<template>
+  <div>
+    <filter-quota-data-by-period-view @fetchData="fetchData"/>
+
+    <div v-if="dataSource.length > 0">
+      <export-to-csv-button :action="exportDataToCsv" />
+      <bar-chart :chart-options="getBalancesChartOptions()" :chart-data="getBalancesChartData()"/>
+      <a-table
+        size="small"
+        :loading="loading"
+        :columns="columns"
+        :dataSource="dataSource"
+        :rowKey="record => record.date"
+        :pagination="false"
+        :scroll="{ y: '55vh' }">
+        <template #title>
+          {{ $t('label.currency') }}: <b>{{ currency }}</b>
+        </template>
+        <template #date="{ text }">
+          {{ text }}
+        </template>
+        <template #lastBalanceHour="{ text }">
+          {{ text }}
+        </template>
+        <template #balance="{ text }">
+          {{ parseFloat(text).toFixed(2) }}
+        </template>
+      </a-table>
+    </div>
+  </div>
+</template>
+
+<script>
+import { getAPI } from '@/api'
+import BarChart from '@/components/view/charts/BarChart.vue'
+import * as dateUtils from '@/utils/date'
+import { downloadDataAsCsv } from '@/utils/util.js'
+import FilterQuotaDataByPeriodView from './FilterQuotaDataByPeriodView.vue'
+import ExportToCsvButton from '@/components/view/buttons/ExportToCsvButton.vue'
+import * as chartUtils from '@/utils/chart'
+
+export default {
+  name: 'QuotaBalance',
+  components: {
+    FilterQuotaDataByPeriodView,
+    BarChart,
+    ExportToCsvButton
+  },
+  data () {
+    return {
+      loading: false,
+      currency: '',
+      dataSource: [],
+      startDate: undefined,
+      endDate: undefined
+    }
+  },
+  computed: {
+    columns () {
+      return [
+        {
+          title: this.$t('label.date'),
+          dataIndex: 'date',
+          width: 'calc(100% / 3)',
+          slots: { customRender: 'date' },
+          sorter: (a, b) => a.lastBalance.localeCompare(b.lastBalance),
+          defaultSortOrder: 'descend'
+        },
+        {
+          title: this.$t('label.quota.last.balance'),
+          dataIndex: 'lastBalanceHour',
+          width: 'calc(100% / 3)',
+          slots: { customRender: 'lastBalanceHour' },
+          sorter: (a, b) => a.lastBalance.localeCompare(b.lastBalance),
+          defaultSortOrder: 'descend'
+        },
+        {
+          title: this.$t('label.balance'),
+          dataIndex: 'balance',
+          width: 'calc(100% / 3)',
+          slots: { customRender: 'balance' },
+          sorter: (a, b) => a.balance - b.balance
+        }
+      ]
+    }
+  },
+  methods: {
+    async fetchData (startDate, endDate) {
+      if (this.loading) return
+
+      this.startDate = dateUtils.parseDayJsObject({ value: startDate })
+      this.endDate = dateUtils.parseDayJsObject({ value: endDate })
+      this.dataSource = []
+      this.loading = true
+
+      try {
+        const data = await this.getQuotaBalance() || {}
+        this.currency = data.currency
+        this.dataSource = this.getLastBalanceOfEachDate(data.balances)
+      } finally {
+        this.loading = false
+      }
+    },
+    async getQuotaBalance () {
+      const params = {
+        accountid: this.$route.params?.id,
+        startdate: this.startDate,
+        enddate: this.endDate
+      }
+
+      return await getAPI('quotaBalance', params)
+        .then(json => json.quotabalanceresponse.balance)
+        .catch(error => { error && this.$notification.info({ message: this.$t('message.request.no.data') }) })
+    },
+    getLastBalanceOfEachDate (data) {
+      if (!data) return []
+
+      return data.reduce((reduced, currentItem) => {
+        const lastBalance = dateUtils.parseDayJsObject({ value: currentItem.date, keepMoment: false })
+        const balance = currentItem.balance
+        const date = dateUtils.toLocaleDate({ date: lastBalance, dateOnly: true })
+        const lastBalanceHour = dateUtils.toLocaleDate({ date: lastBalance, hourOnly: true })
+        const found = reduced.find(item => item.date === date)
+
+        if (!found) {
+          reduced.push({ lastBalance, balance, date, lastBalanceHour })
+        } else {
+          if (found.lastBalance < lastBalance) {
+            found.balance = balance
+            found.lastBalance = lastBalance
+            found.date = date
+            found.lastBalanceHour = lastBalanceHour
+          }
+        }
+        return reduced
+      }, [])
+    },
+    exportDataToCsv () {
+      downloadDataAsCsv({
+        data: this.dataSource,
+        headers: ['date', 'balance'],
+        keys: ['lastBalance', 'balance'],
+        fileName: `quota-balances-of-user-${this.$route.params.id}-between-${this.startDate}-and-${this.endDate}`
+      })
+    },
+    getBalancesChartData () {
+      const datasets = []
+
+      datasets.push({
+        label: this.$t('label.balance'),
+        data: this.dataSource.map(row => row.balance),
+        ...chartUtils.getChartColorObject()
+      })
+
+      return {
+        labels: this.dataSource.map(row => row.date),
+        datasets
+      }
+    },
+    getBalancesChartOptions () {
+      return {
+        scales: {
+          xAxis: {
+            type: 'time',
+            time: {
+              unit: chartUtils.getUnitToTimeCartesianAxis('day', this.dataSource.length),
+              displayFormats: chartUtils.defaultDisplayFormats
+            }
+          }
+        },
+        plugins: {
+          tooltip: {
+            callbacks: {
+              title: (tooltipItem) => dateUtils.dayjs(tooltipItem[0].label).format(chartUtils.defaultDisplayFormats.day),
+              label: (tooltipItem) => parseFloat(tooltipItem.raw).toFixed(2)
+            }
+          }
+        }
+      }
+    }
+  }
+}
+</script>
+
+<style lang="scss" scoped>
+@import '@/style/common/common.scss';
+</style>
diff --git a/ui/src/views/plugins/quota/QuotaCreditTab.vue b/ui/src/views/plugins/quota/QuotaCreditTab.vue
new file mode 100644
index 000000000000..3ae32a02d526
--- /dev/null
+++ b/ui/src/views/plugins/quota/QuotaCreditTab.vue
@@ -0,0 +1,230 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+<template>
+  <div>
+    <filter-quota-data-by-period-view @fetchData="fetchData"/>
+
+    <div v-if="dataSource.length > 0">
+      <export-to-csv-button :action="exportDataToCsv" />
+      <bar-chart :chart-options="getCreditsChartOptions()" :chart-data="getCreditsChartData()"/>
+
+      <a-table
+        size="small"
+        :loading="loading"
+        :columns="columns"
+        :dataSource="dataSource"
+        :rowKey="record => record.creditedon"
+        :pagination="false"
+        :scroll="{ y: '55vh' }">
+        <template #title>
+          {{ $t('label.currency') }}: <b>{{ currency }}</b>
+        </template>
+        <template #creditedOn="{ text }">
+          {{ $toLocaleDate(text) }}
+        </template>
+        <template #credit="{ text }">
+          {{ parseFloat(text).toFixed(2) }}
+        </template>
+        <template #creditor="{ text, record }">
+          <router-link v-if="this.userAccess[record.creditoruserid]" :to="{ path: '/accountuser/' + record.creditoruserid }">
+            {{ text }}
+          </router-link>
+          <span v-else>{{ text }}</span>
+        </template>
+      </a-table>
+    </div>
+  </div>
+</template>
+
+<script>
+import { getAPI } from '@/api'
+import BarChart from '@/components/view/charts/BarChart.vue'
+import * as dateUtils from '@/utils/date'
+import { downloadDataAsCsv } from '@/utils/util.js'
+import FilterQuotaDataByPeriodView from './FilterQuotaDataByPeriodView.vue'
+import ExportToCsvButton from '@/components/view/buttons/ExportToCsvButton.vue'
+import * as chartUtils from '@/utils/chart'
+
+export default {
+  name: 'QuotaCreditTab',
+  components: {
+    FilterQuotaDataByPeriodView,
+    BarChart,
+    ExportToCsvButton
+  },
+  data () {
+    return {
+      loading: false,
+      currency: '',
+      dataSource: [],
+      startDate: undefined,
+      endDate: undefined,
+      userAccess: {}
+    }
+  },
+  computed: {
+    columns () {
+      return [
+        {
+          title: this.$t('label.date'),
+          dataIndex: 'creditedon',
+          width: 'calc(100% / 3)',
+          sorter: (a, b) => a.creditedon.localeCompare(b.creditedon),
+          defaultSortOrder: 'descend',
+          slots: { customRender: 'creditedOn' }
+        },
+        {
+          title: this.$t('label.credit'),
+          dataIndex: 'credit',
+          width: 'calc(100% / 3)',
+          sorter: (a, b) => a.credit - b.credit,
+          slots: { customRender: 'credit' }
+        },
+        {
+          title: this.$t('label.creditor'),
+          dataIndex: 'creditorusername',
+          width: 'calc(100% / 3)',
+          sorter: (a, b) => a.creditorusername.localeCompare(b.creditorusername),
+          slots: { customRender: 'creditor' }
+        }
+      ]
+    }
+  },
+  methods: {
+    async fetchData (startDate, endDate) {
+      if (this.loading) return
+
+      this.startDate = dateUtils.parseDayJsObject({ value: startDate })
+      this.endDate = dateUtils.parseDayJsObject({ value: endDate })
+      this.dataSource = []
+      this.loading = true
+
+      try {
+        const data = await this.getQuotaCreditsList()
+        if (!data) {
+          return
+        }
+        this.currency = data[0]?.currency
+        this.dataSource = data.map(row => ({
+          ...row,
+          date: dateUtils.parseDayJsObject({ value: row.creditedon, keepMoment: false })
+        }))
+        const uniqueCreditorUserIds = [...new Set(
+          this.dataSource
+            .map(row => row.creditoruserid)
+            .filter(Boolean)
+        )]
+        await Promise.all(uniqueCreditorUserIds.map(userid => this.checkUserAccess(userid)))
+      } finally {
+        this.loading = false
+      }
+    },
+    async getQuotaCreditsList () {
+      const params = {
+        accountid: this.$route.params?.id,
+        startdate: this.startDate,
+        enddate: this.endDate
+      }
+
+      return await getAPI('quotaCreditsList', params)
+        .then(json => json.quotacreditslistresponse.credit || [])
+        .catch(error => { error && this.$notification.info({ message: this.$t('message.request.no.data') }) })
+    },
+    async checkUserAccess (userid) {
+      if (userid === undefined) {
+        return
+      }
+      if (Object.prototype.hasOwnProperty.call(this.userAccess, userid)) {
+        return
+      }
+      if (this.$router.resolve('/accountuser/' + userid).matched[0].redirect === '/exception/404') {
+        return
+      }
+
+      const params = { id: userid }
+      const json = await getAPI('listUsers', params)
+      const response = json.listusersresponse.user || []
+      if (response?.[0]) {
+        this.userAccess[userid] = true
+      } else {
+        this.userAccess[userid] = false
+      }
+    },
+    exportDataToCsv () {
+      downloadDataAsCsv({
+        data: this.dataSource,
+        keys: ['date', 'credit', 'creditorusername'],
+        fileName: `credits-of-account-${this.$route.params.id}-between-${this.startDate}-and-${this.endDate}`
+      })
+    },
+    getCreditsChartData () {
+      const datasets = []
+
+      const data = []
+      const res = {}
+      this.dataSource.map(value => {
+        const date = this.$toLocalDate(value.creditedon).split('T')[0]
+
+        if (!res[date]) {
+          res[date] = { date, credit: 0 }
+          data.push(res[date])
+        }
+
+        res[date].credit += value.credit
+        return res
+      })
+
+      datasets.push({
+        label: this.$t('label.credit'),
+        data: data.map(row => row.credit),
+        ...chartUtils.getChartColorObject()
+      })
+
+      return {
+        labels: data.map(row => row.date),
+        datasets
+      }
+    },
+    getCreditsChartOptions () {
+      return {
+        scales: {
+          xAxis: {
+            type: 'time',
+            time: {
+              unit: chartUtils.getUnitToTimeCartesianAxis('day', this.dataSource.length),
+              displayFormats: chartUtils.defaultDisplayFormats
+            }
+          }
+        },
+        plugins: {
+          tooltip: {
+            callbacks: {
+              title: (tooltipItem) => dateUtils.dayjs(tooltipItem[0].label).format(chartUtils.defaultDisplayFormats.day),
+              label: (tooltipItem) => parseFloat(tooltipItem.raw).toFixed(2)
+            }
+          }
+        }
+      }
+    }
+  }
+}
+</script>
+
+<style lang="scss" scoped>
+@import '@/style/common/common.scss';
+</style>
diff --git a/ui/src/views/plugins/quota/QuotaSummary.vue b/ui/src/views/plugins/quota/QuotaSummary.vue
deleted file mode 100644
index 5bfa72a8abae..000000000000
--- a/ui/src/views/plugins/quota/QuotaSummary.vue
+++ /dev/null
@@ -1,65 +0,0 @@
-// Licensed to the Apache Software Foundation (ASF) under one
-// or more contributor license agreements.  See the NOTICE file
-// distributed with this work for additional information
-// regarding copyright ownership.  The ASF licenses this file
-// to you under the Apache License, Version 2.0 (the
-// "License"); you may not use this file except in compliance
-// with the License.  You may obtain a copy of the License at
-//
-//   http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing,
-// software distributed under the License is distributed on an
-// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied.  See the License for the
-// specific language governing permissions and limitations
-// under the License.
-
-<template>
-  <div>
-    <autogen-view
-      @change-resource="changeResource"/>
-    <quota-summary-resource
-      v-if="isSummaryResource"
-      :resource="resource"
-      :tabs="$route.meta.tabs"/>
-  </div>
-</template>
-
-<script>
-import AutogenView from '@/views/AutogenView.vue'
-import QuotaSummaryResource from '@/views/plugins/quota/QuotaSummaryResource'
-
-export default {
-  name: 'QuotaSummary',
-  components: {
-    AutogenView,
-    QuotaSummaryResource
-  },
-  data () {
-    return {
-      resource: {}
-    }
-  },
-  provide: function () {
-    return {
-      parentChangeResource: this.changeResource
-    }
-  },
-  computed: {
-    isSummaryResource () {
-      if (this.$route.path.startsWith('/quotasummary')) {
-        if (this.$route.query && 'quota' in this.$route.query && this.$route.query.quota) {
-          return true
-        }
-      }
-      return false
-    }
-  },
-  methods: {
-    changeResource (resource) {
-      this.resource = resource
-    }
-  }
-}
-</script>
diff --git a/ui/src/views/plugins/quota/QuotaSummaryResource.vue b/ui/src/views/plugins/quota/QuotaSummaryResource.vue
deleted file mode 100644
index c6acf30676fc..000000000000
--- a/ui/src/views/plugins/quota/QuotaSummaryResource.vue
+++ /dev/null
@@ -1,98 +0,0 @@
-// Licensed to the Apache Software Foundation (ASF) under one
-// or more contributor license agreements.  See the NOTICE file
-// distributed with this work for additional information
-// regarding copyright ownership.  The ASF licenses this file
-// to you under the Apache License, Version 2.0 (the
-// "License"); you may not use this file except in compliance
-// with the License.  You may obtain a copy of the License at
-//
-//   http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing,
-// software distributed under the License is distributed on an
-// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied.  See the License for the
-// specific language governing permissions and limitations
-// under the License.
-
-<template>
-  <resource-view
-    :loading="loading"
-    :resource="quotaResource"
-    :tabs="tabs"
-    :historyTab="activeTab"
-    @onTabChange="(tab) => { activeTab = tab }"/>
-</template>
-
-<script>
-import { getAPI } from '@/api'
-import moment from 'moment'
-
-import ResourceView from '@/components/view/ResourceView'
-
-export default {
-  name: 'QuotaSummaryResource',
-  components: {
-    ResourceView
-  },
-  props: {
-    resource: {
-      type: Object,
-      default: () => {}
-    },
-    tabs: {
-      type: Array,
-      default: () => []
-    }
-  },
-  data () {
-    return {
-      loading: false,
-      quotaResource: {},
-      networkService: null,
-      pattern: 'YYYY-MM-DD',
-      activeTab: ''
-    }
-  },
-  created () {
-    this.fetchData()
-  },
-  watch: {
-    resource: {
-      deep: true,
-      handler () {
-        if (Object.keys(this.resource).length === 0) {
-          this.fetchData()
-        }
-      }
-    }
-  },
-  inject: ['parentChangeResource'],
-  methods: {
-    fetchData () {
-      const params = {}
-      if (Object.keys(this.$route.query).length > 0) {
-        Object.assign(params, this.$route.query)
-      }
-      this.loading = true
-
-      getAPI('quotaBalance', params).then(json => {
-        const quotaBalance = json.quotabalanceresponse.balance || {}
-        if (Object.keys(quotaBalance).length > 0) {
-          quotaBalance.currency = `${quotaBalance.currency} ${quotaBalance.startquota}`
-          quotaBalance.startdate = moment(quotaBalance.startdate).format(this.pattern)
-          quotaBalance.account = this.$route.params.id ? this.$route.params.id : null
-          quotaBalance.domainid = this.$route.query.domainid ? this.$route.query.domainid : null
-        }
-        this.quotaResource = Object.assign({}, this.quotaResource, quotaBalance)
-        this.parentChangeResource(this.quotaResource)
-      }).finally(() => {
-        this.loading = false
-      })
-    }
-  }
-}
-</script>
-
-<style scoped>
-</style>
diff --git a/ui/src/views/plugins/quota/QuotaUsage.vue b/ui/src/views/plugins/quota/QuotaUsage.vue
deleted file mode 100644
index 6c55a728bd1c..000000000000
--- a/ui/src/views/plugins/quota/QuotaUsage.vue
+++ /dev/null
@@ -1,158 +0,0 @@
-// Licensed to the Apache Software Foundation (ASF) under one
-// or more contributor license agreements.  See the NOTICE file
-// distributed with this work for additional information
-// regarding copyright ownership.  The ASF licenses this file
-// to you under the Apache License, Version 2.0 (the
-// "License"); you may not use this file except in compliance
-// with the License.  You may obtain a copy of the License at
-//
-//   http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing,
-// software distributed under the License is distributed on an
-// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied.  See the License for the
-// specific language governing permissions and limitations
-// under the License.
-
-<template>
-  <div>
-    <a-table
-      size="small"
-      :loading="loading"
-      :columns="columns"
-      :dataSource="dataSource"
-      :rowKey="record => record.name"
-      :pagination="false"
-      :scroll="{ y: '55vh' }"
-    >
-      <template #bodyCell="{ column, text }">
-        <template v-if="column.key === 'quota'">
-          <span v-if="text!==undefined">{{ `${currency} ${text}` }}</span>
-        </template>
-      </template>
-    </a-table>
-  </div>
-</template>
-
-<script>
-import { getAPI } from '@/api'
-import moment from 'moment'
-
-export default {
-  name: 'QuotaUsage',
-  props: {
-    resource: {
-      type: Object,
-      required: true
-    },
-    tab: {
-      type: String,
-      default: () => ''
-    }
-  },
-  data () {
-    return {
-      loading: false,
-      dataSource: [],
-      pattern: 'YYYY-MM-DD',
-      currency: '',
-      totalQuota: 0,
-      account: null
-    }
-  },
-  computed: {
-    columns () {
-      return [
-        {
-          key: 'name',
-          title: this.$t('label.quota.type.name'),
-          dataIndex: 'name',
-          width: 'calc(100% / 3)'
-        },
-        {
-          key: 'unit',
-          title: this.$t('label.quota.type.unit'),
-          dataIndex: 'unit',
-          width: 'calc(100% / 3)'
-        },
-        {
-          key: 'quota',
-          title: this.$t('label.quota.usage'),
-          dataIndex: 'quota',
-          width: 'calc(100% / 3)'
-        }
-      ]
-    }
-  },
-  watch: {
-    tab () {
-      if (this.tab === 'quota.statement.quota') {
-        this.fetchData()
-      }
-    }
-  },
-  created () {
-    this.fetchData()
-  },
-  methods: {
-    async fetchData () {
-      this.loading = true
-      this.dataSource = []
-      this.account = this.$route.query && this.$route.query.account ? this.$route.query.account : null
-
-      try {
-        const resource = await this.quotaBalance()
-        const quotaStatement = await this.quotaStatement(resource)
-        const quotaUsage = quotaStatement.quotausage
-        this.dataSource = this.dataSource.concat(quotaUsage)
-        this.currency = quotaStatement.currency
-        this.totalQuota = quotaStatement.totalquota
-        this.dataSource.push({
-          name: `${this.$t('label.quota.total')}: `,
-          quota: this.totalQuota
-        })
-        this.dataSource.unshift({
-          type: 0,
-          name: `${this.$t('startdate')}: ${moment(this.resource.startdate).format(this.pattern)}`,
-          unit: `${this.$t('enddate')}: ${moment(this.resource.enddate).format(this.pattern)}`
-        })
-        this.loading = false
-      } catch (e) {
-        console.log(e)
-        this.loading = false
-      }
-    },
-    quotaBalance () {
-      return new Promise((resolve, reject) => {
-        const params = {}
-        params.domainid = this.resource.domainid
-        params.account = this.account
-
-        getAPI('quotaBalance', params).then(json => {
-          const quotaBalance = json.quotabalanceresponse.balance || {}
-          resolve(quotaBalance)
-        }).catch(error => {
-          reject(error)
-        })
-      })
-    },
-    quotaStatement (resource) {
-      return new Promise((resolve, reject) => {
-        const params = {}
-        params.domainid = this.resource.domainid
-        params.account = this.account
-        params.startdate = moment(this.resource.startdate).format(this.pattern)
-        params.enddate = moment(resource.startdate).format(this.pattern)
-
-        getAPI('quotaStatement', params).then(json => {
-          const quotaStatement = json.quotastatementresponse.statement || {}
-          resolve(quotaStatement)
-        }).catch(error => {
-          reject(error)
-        })
-      })
-    }
-  }
-}
-</script>
diff --git a/ui/src/views/plugins/quota/QuotaUsageTab.vue b/ui/src/views/plugins/quota/QuotaUsageTab.vue
new file mode 100644
index 000000000000..cefc169c8d4a
--- /dev/null
+++ b/ui/src/views/plugins/quota/QuotaUsageTab.vue
@@ -0,0 +1,731 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+<template>
+  <div>
+    <filter-quota-data-by-period-view @fetchData="fetchData"/>
+
+    <div v-if="dataSource.length > 0">
+      <hr class="m-20-0" />
+      <div class="chart-row">
+        <a-space direction="vertical">
+          <div>
+            <a-radio-group
+              v-model:value="graphType"
+              buttonStyle="solid">
+              <a-radio-button value="bar_chart">
+                {{ $t('label.total') }}
+              </a-radio-button>
+              <a-radio-button value="line_chart">
+                {{ $t('label.quota.statement.history') }}
+              </a-radio-button>
+              <a-radio-button value="incremental_chart">
+                {{ $t('label.quota.statement.cumulative.history') }}
+              </a-radio-button>
+            </a-radio-group>
+          </div>
+        </a-space>
+      </div>
+      <div style="font-size: 18px">
+        <strong> {{ $t('label.quota.usage.types.summary') }} </strong>
+      </div>
+      <export-to-csv-button :action="exportDataToCsv" />
+      <bar-chart v-if="graphType === 'bar_chart'" :chart-options="getBarChartOptions()" :chart-data="getUsageTypeBarChartData()"/>
+      <resource-stats-line-chart
+        v-else
+        :chart-labels="usageLineChartLabels"
+        :chart-data="getEntryForCurrentGraphType(this.usageLineChartData)"
+        :yAxisIncrementValue="getYAxisIncrement(getEntryForCurrentGraphType(this.YAxisMax.usageTypes))"
+        :yAxisMeasurementUnit="''"
+      />
+      <a-table
+        size="small"
+        :loading="loading"
+        :columns="columns"
+        :dataSource="dataSource.filter(row => row.quota > 0)"
+        :rowKey="record => record.name"
+        :pagination="false"
+        :scroll="{ y: '55vh' }">
+        <template #bodyCell="{ column, text, record }">
+          <template v-if="column.dataIndex === 'name'">
+            <a @click="handleSelectedTypeChange(`${record.type}-${record.name}`)">{{ $t(text) }}</a>
+          </template>
+          <template v-if="column.dataIndex === 'unit'">
+            {{ $t(text) }}
+          </template>
+          <template v-if="column.dataIndex === 'quota'">
+            <a-tooltip placement="right">
+            <template #title>
+              {{ text }}
+            </template>
+            <span class="dotted-underline">{{ parseFloat(text).toFixed(2) }}</span>
+          </a-tooltip>
+          </template>
+        </template>
+        <template #footer >
+          <div style="text-align: right;">
+            {{ $t('label.currency') }}: <b>{{ currency }}</b><br/>
+            {{ $t('label.quota.total.consumption') }}:
+            <a-tooltip placement="bottom">
+              <template #title>
+                {{ totalQuota }}
+              </template>
+              <b class="dotted-underline">{{ parseFloat(totalQuota).toFixed(2) }}</b>
+            </a-tooltip>
+          </div>
+        </template>
+      </a-table>
+
+      <hr class="m-20-0" id="resource-by-type" />
+      <strong>
+        <tooltip-label style="font-size: 18px" :title="$t('label.quota.usage.resources.by.type')" :tooltip="$t('message.quota.usage.resource.warn')"/>
+      </strong>
+      <a-select
+        v-model:value="selectedType"
+        class="w-100"
+        style="margin: 5px 0 10px 0px"
+        show-search
+        @change="handleSelectedTypeChange">
+        <a-select-option
+          v-for="quotaType of getQuotaTypesFiltered()"
+          :value="`${quotaType.id}-${quotaType.type}`"
+          :key="quotaType.id">
+          {{ $t(quotaType.type) }}
+        </a-select-option>
+      </a-select>
+      <export-to-csv-button v-if="dataSourceResource.length > 0" :action="exportResourcesToCsv" :label="`label.export.resources.csv`" />
+      <bar-chart v-if="dataSourceResource.length > 0 && graphType === 'bar_chart'" :chart-options="getBarChartOptions()" :chart-data="getResourceBarChartData()"/>
+      <resource-stats-line-chart
+        v-else-if="dataSourceResource.length > 0 && graphType !== 'bar_chart'"
+        :chart-labels="resourceLineChartLabels"
+        :chart-data="getEntryForCurrentGraphType(this.resourceLineChartData)"
+        :yAxisIncrementValue="getYAxisIncrement(getEntryForCurrentGraphType(this.YAxisMax.resources))"
+        :yAxisMeasurementUnit="''"
+      />
+      <a-table
+        size="small"
+        :loading="loadingResources"
+        :columns="resourceColumns"
+        :dataSource="dataSourceResource"
+        :rowKey="(record) => record.displayname"
+        :pagination="false"
+        :scroll="{ y: '55vh' }">
+        <template #title v-if="dataSourceResource.length > 0">
+          <div>{{ $t('label.currency') }}: <b>{{ currency }}</b></div>
+        </template>
+        <template #bodyCell="{ column, text, record }">
+          <template v-if="column.dataIndex === 'displayname'">
+            <span v-if="!text">
+              -
+            </span>
+            <span v-if="text === '<untraceable>' || !record.resourceid">
+              {{ text }}
+            </span>
+            <a v-else @click="handleSelectedResourceChange(record.resourceid)">
+              {{ text }}
+            </a>
+          </template>
+          <template v-if="column.dataIndex === 'quotaconsumed'">
+            <a-tooltip placement="right">
+            <template #title>
+              {{ text }}
+            </template>
+            <span class="dotted-underline">{{ parseFloat(text).toFixed(2) }}</span>
+          </a-tooltip>
+          </template>
+        </template>
+      </a-table>
+
+      <hr class="m-20-0" id="details-by-resource" />
+      <strong>
+        <tooltip-label style="font-size: 18px" :title="$t('label.quota.usage.details.by.resource')"/>
+      </strong>
+      <a-select
+        v-model:value="selectedResource"
+        class="w-100"
+        style="margin: 5px 0 10px 0px"
+        show-search
+        @change="handleSelectedResourceChange"
+        :disabled="getResources().length == 0">
+        <a-select-option
+          v-for="item of getResources()"
+          :value="item.id"
+          :key="item.id">
+          {{ $t(item.name) }}
+        </a-select-option>
+      </a-select>
+      <export-to-csv-button v-if="dataSourceTariffs.length > 0" :action="exportResourceDetailsToCsv" :label="`label.export.details.csv`" />
+      <bar-chart v-if="dataSourceTariffs.length > 0 && graphType === 'bar_chart'" :chart-options="getBarChartOptions()" :chart-data="getTariffsBarChartData()"/>
+      <resource-stats-line-chart
+        v-else-if="dataSourceTariffs.length > 0 && graphType !== 'bar_chart'"
+        :chart-labels="tariffLineChartLabels"
+        :chart-data="getEntryForCurrentGraphType(this.tariffLineChartData)"
+        :yAxisIncrementValue="getYAxisIncrement(getEntryForCurrentGraphType(this.YAxisMax.tariffs))"
+        :yAxisMeasurementUnit="''"
+      />
+      <a-table
+        size="small"
+        :loading="loadingTariffs"
+        :columns="resourceDetailsColumns"
+        :dataSource="dataSourceTariffs"
+        :rowKey="record => record.tariffname + '-' + record.startdate"
+        :pagination="false"
+        :scroll="{ y: '55vh' }">
+          <template #title v-if="dataSourceTariffs.length > 0">
+            <div>{{ $t('label.currency') }}: <b>{{ currency }}</b></div>
+          </template>
+          <template #bodyCell="{ column, text, record }">
+            <template v-if="column.dataIndex === 'tariffname'">
+              <a v-if="'quotaTariffList' in $store.getters.apis" :href="`#/quotatariff/${record.tariffid}`" target="_blank">
+                {{ text }}
+              </a>
+              <span v-else>
+                {{ text }}
+              </span>
+            </template>
+            <template v-if="column.dataIndex === 'enddate'">
+              {{ $toLocaleDate(text) }}
+            </template>
+            <template v-if="column.dataIndex === 'startdate'">
+              {{ $toLocaleDate(text) }}
+            </template>
+            <template v-if="column.dataIndex === 'quotaconsumed'">
+              <a-tooltip placement="right">
+              <template #title>
+                {{ text }}
+              </template>
+              <span class="dotted-underline">{{ parseFloat(text).toFixed(2) }}</span>
+            </a-tooltip>
+            </template>
+          </template>
+      </a-table>
+    </div>
+  </div>
+</template>
+
+<script>
+import { getAPI } from '@/api'
+import FilterQuotaDataByPeriodView from './FilterQuotaDataByPeriodView.vue'
+import BarChart from '@/components/view/charts/BarChart.vue'
+import ResourceStatsLineChart from '@/components/view/stats/ResourceStatsLineChart.vue'
+import ExportToCsvButton from '@/components/view/buttons/ExportToCsvButton.vue'
+import { getChartColorObject } from '@/utils/chart'
+import { getQuotaTypeByName, getQuotaTypes } from '@/utils/quota'
+import TooltipLabel from '@/components/widgets/TooltipLabel'
+import { downloadDataAsCsv } from '@/utils/util.js'
+import * as dateUtils from '@/utils/date'
+
+export default {
+  name: 'QuotaUsageTab',
+  components: {
+    FilterQuotaDataByPeriodView,
+    BarChart,
+    ExportToCsvButton,
+    ResourceStatsLineChart,
+    TooltipLabel
+  },
+  data () {
+    return {
+      dataSource: [],
+      selectedType: '',
+      loadingResources: false,
+      dataSourceResource: [],
+      selectedResource: '',
+      loadingTariffs: false,
+      dataSourceTariffs: [],
+      startDate: undefined,
+      endDate: undefined,
+      graphType: 'bar_chart',
+      usageLineChartLabels: [],
+      resourceLineChartLabels: [],
+      tariffLineChartLabels: [],
+      usageLineChartData: {},
+      resourceLineChartData: {},
+      tariffLineChartData: {},
+      YAxisMax: {}
+    }
+  },
+  watch: {
+    graphType (newGraphType) {
+      if (newGraphType === 'bar_chart') {
+        return
+      }
+      this.prepareDataForUsageTypeLineGraph()
+      if (!this.selectedType) {
+        return
+      }
+      this.prepareDataForResourceLineGraph()
+      if (!this.selectedResource) {
+        return
+      }
+      this.prepareDataForTariffLineGraph()
+    }
+  },
+  computed: {
+    columns () {
+      return [
+        {
+          title: this.$t('label.quota.type.name'),
+          dataIndex: 'name',
+          width: 'calc(100% / 3)',
+          sorter: (a, b) => a.name.localeCompare(b.name)
+        },
+        {
+          title: this.$t('label.quota.type.unit'),
+          dataIndex: 'unit',
+          width: 'calc(100% / 3)',
+          sorter: (a, b) => a.unit.localeCompare(b.unit)
+        },
+        {
+          title: this.$t('label.quota.consumed'),
+          dataIndex: 'quota',
+          width: 'calc(100% / 3)',
+          sorter: (a, b) => a.quota - b.quota,
+          defaultSortOrder: 'descend'
+        }
+      ]
+    },
+    resourceColumns () {
+      return [
+        {
+          title: this.$t('label.resource'),
+          dataIndex: 'displayname',
+          width: '50%',
+          sorter: (a, b) => a.displayname.localeCompare(b.displayname),
+          defaultSortOrder: 'ascend'
+        },
+        {
+          title: this.$t('label.quota.consumed'),
+          dataIndex: 'quotaconsumed',
+          width: '50%',
+          sorter: (a, b) => a.quotaconsumed - b.quotaconsumed
+        }
+      ]
+    },
+    resourceDetailsColumns () {
+      return [
+        {
+          title: this.$t('label.quota.tariff'),
+          dataIndex: 'tariffname',
+          sorter: (a, b) => a.tariffname.localeCompare(b.tariffname)
+        },
+        {
+          title: this.$t('label.start.date'),
+          dataIndex: 'startdate',
+          sorter: (a, b) => a.startdate.localeCompare(b.startdate),
+          defaultSortOrder: 'descend'
+        },
+        {
+          title: this.$t('label.end.date'),
+          dataIndex: 'enddate',
+          sorter: (a, b) => a.enddate.localeCompare(b.enddate)
+        },
+        {
+          title: this.$t('label.quota.consumed'),
+          dataIndex: 'quotaconsumed',
+          sorter: (a, b) => a.quotaconsumed - b.quotaconsumed
+        }
+      ]
+    }
+  },
+  methods: {
+    async fetchData (startDate, endDate, keepMoment = true) {
+      if (this.loading) return
+
+      this.startDate = dateUtils.parseDayJsObject({ value: startDate, keepMoment: keepMoment })
+      this.endDate = dateUtils.parseDayJsObject({ value: endDate, keepMoment: keepMoment })
+      this.loading = true
+      this.dataSource = []
+      this.dataSourceResource = []
+      this.dataSourceTariffs = []
+      this.selectedResource = ''
+      this.selectedType = ''
+
+      try {
+        const quotaStatement = await this.getQuotaStatement({
+          startdate: this.startDate,
+          enddate: this.endDate
+        })
+
+        if (!quotaStatement) {
+          return
+        }
+
+        this.dataSource = quotaStatement.quotausage.filter(row => row.quota !== 0)
+        if (this.dataSource.length === 0) {
+          this.$notification.info({ message: this.$t('message.request.no.data') })
+        }
+
+        this.currency = quotaStatement.currency
+        this.totalQuota = quotaStatement.totalquota
+        if (this.graphType !== 'bar_chart') {
+          this.prepareDataForUsageTypeLineGraph()
+        }
+      } finally {
+        this.loading = false
+      }
+    },
+    async fetchResourceData () {
+      if (this.selectedType === '' || this.loadingResources) return
+
+      this.dataSourceResource = []
+      this.loadingResources = true
+
+      try {
+        const quotaStatement = await this.getQuotaStatement({
+          startdate: this.startDate,
+          enddate: this.endDate,
+          showresources: true,
+          type: this.selectedType.split('-')[0]
+        })
+
+        this.dataSourceResource = quotaStatement.quotausage[0].resources.filter(row => row.quotaconsumed !== 0)
+        if (this.dataSourceResource.length === 0) {
+          this.$notification.info({ message: this.$t('message.request.no.data') })
+        }
+
+        if (this.graphType !== 'bar_chart') {
+          this.prepareDataForResourceLineGraph()
+        }
+      } finally {
+        this.loadingResources = false
+      }
+    },
+    async fetchTariffData () {
+      if (this.selectedResource === '' || this.loadingTariffs) return
+
+      this.dataSourceTariffs = []
+      this.loadingTariffs = true
+
+      try {
+        const quotaResourceStatement = await getAPI('quotaResourceStatement', {
+          startdate: this.startDate,
+          enddate: this.endDate,
+          usagetype: this.selectedType.split('-')[0],
+          id: this.selectedResource,
+          accountid: this.$route.params?.id,
+          ignoreproject: true
+        }).then(json => json.quotaresourcestatementresponse?.quotaresourcestatement?.items || [])
+
+        this.dataSourceTariffs = quotaResourceStatement.map(quotaUsage => ({
+          ...quotaUsage,
+          startdate: dateUtils.parseDayJsObject({ value: quotaUsage.startdate, keepMoment: false }),
+          enddate: dateUtils.parseDayJsObject({ value: quotaUsage.enddate, keepMoment: false })
+        })).filter(row => row.quotaconsumed !== 0)
+        if (this.dataSourceTariffs.length === 0) {
+          this.$notification.info({ message: this.$t('message.request.no.data') })
+        }
+
+        if (this.graphType !== 'bar_chart') {
+          this.prepareDataForTariffLineGraph()
+        }
+      } finally {
+        this.loadingTariffs = false
+      }
+    },
+    async getQuotaStatement (apiParams) {
+      const params = {
+        ignoreproject: true,
+        accountid: this.$route.params?.id,
+        ...apiParams
+      }
+
+      return await getAPI('quotaStatement', params)
+        .then(json => json.quotastatementresponse.statement || {})
+    },
+    getBarChartOptions () {
+      return { responsive: true }
+    },
+    getUsageTypeBarChartData () {
+      const datasets = []
+      for (const row of this.dataSource) {
+        datasets.push({
+          label: this.$t(row.name),
+          data: [row.quota],
+          ...this.getColor(row)
+        })
+      }
+      return { labels: [this.$t('label.quota.type.name')], datasets }
+    },
+    getResourceBarChartData () {
+      const datasets = []
+      for (const row of this.dataSourceResource) {
+        datasets.push({
+          label: row.displayname,
+          data: [row.quotaconsumed],
+          ...this.getColor(row)
+        })
+      }
+      return { labels: [this.$t('label.resource')], datasets }
+    },
+    getTariffsBarChartData () {
+      const aggregatedTariffs = this.aggregateTariffQuotas()
+      const datasets = []
+      for (const key in aggregatedTariffs) {
+        datasets.push({
+          label: key,
+          data: [aggregatedTariffs[key]],
+          ...this.getColor({ tariffname: key })
+        })
+      }
+      return { labels: [this.$t('label.quota.tariff')], datasets }
+    },
+    aggregateTariffQuotas () {
+      const tariffs = {}
+      for (const row of this.dataSourceTariffs) {
+        const currentValue = tariffs[row.tariffname] ?? 0
+        tariffs[row.tariffname] = currentValue + row.quotaconsumed
+      }
+      return tariffs
+    },
+    setUsageTypeLineChartData () {
+      this.usageLineChartLabels = this.getLineChartLabelsForData(this.dataSource)
+      this.usageLineChartData = this.prepareLineChartData(this.dataSource, this.usageLineChartLabels)
+    },
+    setResourceLineChartData () {
+      this.resourceLineChartLabels = this.getLineChartLabelsForData(this.dataSourceResource)
+      this.resourceLineChartData = this.prepareLineChartData(this.dataSourceResource, this.resourceLineChartLabels)
+    },
+    setTariffLineChartData () {
+      this.dataSourceTariffs.sort((a, b) => new Date(a.enddate) - new Date(b.enddate))
+      const usageGroupedByTariffName = this.groupUsageByTariffName()
+
+      const transformedData = Object.values(usageGroupedByTariffName)
+      this.tariffLineChartLabels = this.getLineChartLabelsForData(transformedData)
+      this.tariffLineChartData = this.prepareLineChartData(transformedData, this.tariffLineChartLabels)
+    },
+    groupUsageByTariffName () {
+      const groupedData = {}
+      this.dataSourceTariffs.forEach((obj) => {
+        if (!(obj.tariffname in groupedData)) {
+          groupedData[obj.tariffname] = { tariffname: obj.tariffname, history: [] }
+        }
+        groupedData[obj.tariffname].history.push(obj)
+      })
+      return groupedData
+    },
+    getLineChartLabelForDate (date) {
+      return this.$toLocalDate(date)
+    },
+    getLineChartLabelsForData (data) {
+      const lineChartLabels = [this.getLineChartLabelForDate(this.startDate)]
+
+      for (const row of data) {
+        let isPreviousZero = true
+        for (let i = 0; i < row.history.length; i++) {
+          const item = row.history[i]
+          const isCurrentZero = item.quotaconsumed === 0
+
+          if (isCurrentZero && isPreviousZero) {
+            continue
+          }
+
+          if (isPreviousZero) {
+            // Previous was zero, but we current is not. Push our startdate to have an accurate curve
+            this.pushDateToLabelsIfNotPresent(lineChartLabels, this.getLineChartLabelForDate(item.startdate))
+          }
+
+          this.pushDateToLabelsIfNotPresent(lineChartLabels, this.getLineChartLabelForDate(item.enddate))
+          isPreviousZero = isCurrentZero
+        }
+      }
+
+      lineChartLabels.sort((a, b) => new Date(a) - new Date(b))
+      return lineChartLabels
+    },
+    pushDateToLabelsIfNotPresent (lineChartLabels, date) {
+      const hasNearDate = lineChartLabels.some(d => {
+        const diff = Math.abs(new Date(date) - new Date(d).getTime())
+        return diff < 5 * 1000 * 60 // Do not push the label if there is already one within 5 minutes
+      })
+      if (!hasNearDate) {
+        lineChartLabels.push(date)
+        return true
+      }
+      return false
+    },
+    calculatePaddedMax (values) {
+      return Math.ceil(Math.max(...values) * 1.2)
+    },
+    getChartDataMaxValues (chartData) {
+      return Object.values(chartData).map(item => Math.max(...item.data.map(obj => obj.stat)))
+    },
+    setYAxisMaxForUsageTypes () {
+      this.YAxisMax.usageTypes = {
+        incremental: this.calculatePaddedMax(this.getChartDataMaxValues(this.usageLineChartData.incremental)),
+        history: this.calculatePaddedMax(this.getChartDataMaxValues(this.usageLineChartData.history))
+      }
+    },
+    setYAxisMaxForResources () {
+      this.YAxisMax.resources = {
+        incremental: this.calculatePaddedMax(this.getChartDataMaxValues(this.resourceLineChartData.incremental)),
+        history: this.calculatePaddedMax(this.getChartDataMaxValues(this.resourceLineChartData.history))
+      }
+    },
+    setYAxisMaxForTariffs () {
+      this.YAxisMax.tariffs = {
+        incremental: this.calculatePaddedMax(this.getChartDataMaxValues(this.tariffLineChartData.incremental)),
+        history: this.calculatePaddedMax(this.getChartDataMaxValues(this.tariffLineChartData.history))
+      }
+    },
+    getEntryForCurrentGraphType (data) {
+      if (this.graphType === 'line_chart') {
+        return data.history
+      }
+      return data.incremental
+    },
+    prepareDataForUsageTypeLineGraph () {
+      this.setUsageTypeLineChartData()
+      this.setYAxisMaxForUsageTypes()
+    },
+    prepareDataForResourceLineGraph () {
+      this.setResourceLineChartData()
+      this.setYAxisMaxForResources()
+    },
+    prepareDataForTariffLineGraph () {
+      this.setTariffLineChartData()
+      this.setYAxisMaxForTariffs()
+    },
+    prepareLineChartData (data, lineChartLabels) {
+      const chartData = { history: [], incremental: [] }
+
+      for (const row of data) {
+        const datasetName = this.$t(this.getName(row))
+        const color = this.getColor(row)
+
+        const historyDataset = { label: datasetName, data: [], fill: false, ...color }
+        const incrementalDataset = { label: datasetName, data: [], fill: false, ...color }
+
+        let historyIndex = 0
+        let accumulatedQuota = 0
+
+        for (const label of lineChartLabels) {
+          const periodQuota = this.calculateQuotaForPeriod(row.history, label, historyIndex)
+          historyIndex = periodQuota.nextIndex
+
+          accumulatedQuota += periodQuota.value
+          historyDataset.data.push({ stat: periodQuota.value })
+          incrementalDataset.data.push({ stat: accumulatedQuota })
+        }
+
+        chartData.history.push(historyDataset)
+        chartData.incremental.push(incrementalDataset)
+      }
+
+      return chartData
+    },
+    calculateQuotaForPeriod (historyItems, label, startIndex) {
+      let quota = 0
+      let currentIndex = startIndex
+
+      while (currentIndex < historyItems.length) {
+        const item = historyItems[currentIndex]
+        if (this.getLineChartLabelForDate(item.enddate) > label) {
+          break
+        }
+        quota += item.quotaconsumed
+        currentIndex++
+      }
+
+      return { value: quota, nextIndex: currentIndex }
+    },
+    getColor (row) {
+      const quotaType = getQuotaTypeByName(row.name)
+      if (quotaType?.chartColor) {
+        return getChartColorObject(quotaType.chartColor)
+      }
+      return getChartColorObject(this.textToDeterministicColor(this.getName(row)))
+    },
+    textToDeterministicColor (text) {
+      let hash = 0
+
+      for (let i = text.length - 1; i >= 0; i--) {
+        hash = ((hash << 5) - hash) + text.charCodeAt(i)
+        hash = hash & hash
+      }
+
+      const hash1 = Math.abs(hash)
+      const hash2 = Math.abs(hash * 73)
+      const hash3 = Math.abs(hash * 97)
+
+      let color = '#'
+      color += (hash1 & 0xFF).toString(16).padStart(2, '0')
+      color += (hash2 & 0xFF).toString(16).padStart(2, '0')
+      color += (hash3 & 0xFF).toString(16).padStart(2, '0')
+
+      return color
+    },
+    getName (row) {
+      if (row.name) {
+        // Translate the usage type's name
+        return this.$t(row.name)
+      }
+      return row.displayname || row.tariffname
+    },
+    getYAxisIncrement (max) {
+      if (max < 1) {
+        return 1
+      }
+      return Math.pow(10, Math.floor(Math.log10(max)))
+    },
+    exportDataToCsv () {
+      downloadDataAsCsv({
+        data: this.dataSource,
+        keys: ['type', 'name', 'unit', 'quota'],
+        fileName: `quota-usage-of-account-${this.$route.params.id}-between-${this.startDate}-and-${this.endDate}`
+      })
+    },
+    exportResourcesToCsv () {
+      downloadDataAsCsv({
+        data: this.dataSourceResource.map(row => ({ ...row, name: row.displayname })),
+        keys: ['resourceid', 'name', 'quotaconsumed'],
+        fileName: `quota-usage-of-resources-of-type-${this.selectedType}-of-account-${this.$route.params.id}-between-${this.startDate}-and-${this.endDate}`
+      })
+    },
+    exportResourceDetailsToCsv () {
+      downloadDataAsCsv({
+        data: this.dataSourceTariffs,
+        keys: ['tariffid', 'tariffname', 'startdate', 'enddate', 'quotaconsumed'],
+        fileName: `detailed-quota-usage-of-resource-${this.selectedResource}-of-type-${this.selectedType}-of-account-${this.$route.params.id}-between-${this.startDate}-and-${this.endDate}`
+      })
+    },
+    getQuotaTypesFiltered () {
+      const quotaTypesRetrieved = this.dataSource.map(item => item.name)
+      return getQuotaTypes().filter((item) => quotaTypesRetrieved.includes(item.type))
+    },
+    getResources () {
+      return this.dataSourceResource.filter(item => item.resourceid).map(item => ({ id: item.resourceid, name: item.displayname }))
+    },
+    async handleSelectedTypeChange (value) {
+      this.selectedType = value
+      this.selectedResource = ''
+      this.dataSourceTariffs = []
+      document.getElementById('resource-by-type').scrollIntoView({ behavior: 'smooth' })
+      await this.fetchResourceData()
+    },
+    async handleSelectedResourceChange (value) {
+      this.selectedResource = value
+      document.getElementById('details-by-resource').scrollIntoView({ behavior: 'smooth' })
+      await this.fetchTariffData()
+    }
+  }
+}
+</script>
+
+<style lang="scss" scoped>
+@import '@/style/common/common.scss';
+</style>
diff --git a/ui/src/views/setting/ConfigurationValue.vue b/ui/src/views/setting/ConfigurationValue.vue
index 5a6f0b025cac..0979c3c03cbe 100644
--- a/ui/src/views/setting/ConfigurationValue.vue
+++ b/ui/src/views/setting/ConfigurationValue.vue
@@ -295,6 +295,9 @@ export default {
         params[this.scopeKey] = this.resource?.id
       }
       postAPI('updateConfiguration', params).then(json => {
+        // The updateConfiguration response can return a stale value for
+        // non-global scopes (server-side issue). Trust the value the user
+        // just submitted — the API returned success, so we know it was persisted.
         const apiRecord = json.updateconfigurationresponse.configuration
         configRecordEntry = { ...apiRecord, value: String(newValue) }
         this.editableValue = this.getEditableValue(configRecordEntry)
diff --git a/ui/src/views/storage/CreateVMFromBackup.vue b/ui/src/views/storage/CreateVMFromBackup.vue
index 891e8fe96420..50fee4ea5429 100644
--- a/ui/src/views/storage/CreateVMFromBackup.vue
+++ b/ui/src/views/storage/CreateVMFromBackup.vue
@@ -35,6 +35,12 @@
             <tooltip-label :title="$t('label.use.backup.ip.address')" :tooltip="$t('label.use.backup.ip.address.tooltip')"/>
           </template>
         </a-form-item>
+        <a-form-item name="quickRestore" ref="quickRestore" >
+          <template #label>
+            <tooltip-label :title="$t('label.quickrestore')" :tooltip="apiParams.quickrestore?.description"/>
+          </template>
+          <a-switch v-model:checked="form.quickRestore" />
+        </a-form-item>
       </a-form>
       <div class="card-footer">
         <a-button @click="closeAction">
@@ -81,6 +87,7 @@ export default {
       loading: true,
       form: {
         name: '',
+        quickRestore: false,
         preserveIpAddresses: false
       }
     }
@@ -91,6 +98,9 @@ export default {
       required: true
     }
   },
+  beforeCreate () {
+    this.apiParams = this.$getApiParams('createVMFromBackup')
+  },
   async created () {
     await Promise.all([
       this.fetchServiceOffering(),
@@ -203,7 +213,7 @@ export default {
         args.name = this.form.name
         args.displayname = this.form.name
       }
-
+      args.quickRestore = this.form.quickRestore
       if (this.form.preserveIpAddresses) {
         args.preserveip = this.form.preserveIpAddresses
       }
diff --git a/ui/src/views/storage/RestoreAttachBackupVolume.vue b/ui/src/views/storage/RestoreAttachBackupVolume.vue
index 54c7bb3eb5bb..99a6305a5b65 100644
--- a/ui/src/views/storage/RestoreAttachBackupVolume.vue
+++ b/ui/src/views/storage/RestoreAttachBackupVolume.vue
@@ -25,7 +25,10 @@
       @finish="handleSubmit"
       v-ctrl-enter="handleSubmit"
      >
-      <a-form-item name="volumeid" ref="volumeid" :label="$t('label.volume')">
+      <a-form-item name="volumeid" ref="volumeid">
+        <template #label>
+          <tooltip-label :title="$t('label.volume')" :tooltip="apiParams.volumeid?.description"/>
+        </template>
         <a-select
           allowClear
           v-model:value="form.volumeid"
@@ -33,6 +36,7 @@
           v-focus="true"
           showSearch
           optionFilterProp="label"
+          :placeholder="apiParams.volumeid?.description"
           :filterOption="(input, option) => {
             return option.label.toLowerCase().indexOf(input.toLowerCase()) >= 0
           }" >
@@ -44,13 +48,17 @@
           </a-select-option>
         </a-select>
       </a-form-item>
-      <a-form-item name="virtualmachineid" ref="virtualmachineid" :label="$t('label.vm')">
+      <a-form-item name="virtualmachineid" ref="virtualmachineid">
+        <template #label>
+          <tooltip-label :title="$t('label.vm')" :tooltip="apiParams.virtualmachineid?.description"/>
+        </template>
         <a-select
           allowClear
           v-model:value="form.virtualmachineid"
           :loading="virtualMachineOptions.loading"
           showSearch
           optionFilterProp="value"
+          :placeholder="apiParams.virtualmachineid?.description"
           :filterOption="(input, option) => {
             return option.value.toLowerCase().indexOf(input.toLowerCase()) >= 0
           }" >
@@ -61,6 +69,33 @@
           </a-select-option>
         </a-select>
       </a-form-item>
+      <a-form-item name="quickRestore" ref="quickRestore" >
+        <template #label>
+          <tooltip-label :title="$t('label.quickrestore')" :tooltip="apiParams.quickrestore?.description"/>
+        </template>
+        <a-switch v-model:checked="form.quickRestore" />
+      </a-form-item>
+      <a-form-item name="hostId" ref="hostId" v-if="isAdmin()">
+        <template #label>
+          <tooltip-label :title="$t('label.hostid')" :tooltip="apiParams.hostid?.description"/>
+        </template>
+        <a-select
+          allowClear
+          v-model:value="form.hostId"
+          :loading="hostOptions.loading"
+          showSearch
+          optionFilterProp="value"
+          :placeholder="apiParams.hostid?.description"
+          :filterOption="(input, option) => {
+            return option.value.toLowerCase().includes(input.toLowerCase())
+          }" >
+          <a-select-option
+            v-for="(host) in hostOptions.opts"
+            :key="host.id">
+            {{ host.name }}
+          </a-select-option>
+        </a-select>
+      </a-form-item>
       <div :span="24" class="action-button">
         <a-button :loading="loading || actionLoading" @click="closeAction">{{ $t('label.cancel') }}</a-button>
         <a-button :loading="loading || actionLoading" ref="submit" type="primary" @click="handleSubmit">{{ $t('label.ok') }}</a-button>
@@ -72,9 +107,12 @@
 <script>
 import { ref, reactive, toRaw } from 'vue'
 import { getAPI, postAPI } from '@/api'
+import TooltipLabel from '@/components/widgets/TooltipLabel.vue'
+import { isAdmin } from '@/role'
 
 export default {
   name: 'RestoreAttachBackupVolume',
+  components: { TooltipLabel },
   props: {
     loading: {
       type: Boolean,
@@ -95,18 +133,28 @@ export default {
         loading: false,
         opts: []
       },
+      hostOptions: {
+        loading: false,
+        opts: []
+      },
       actionLoading: false
     }
   },
+  beforeCreate () {
+    this.apiParams = this.$getApiParams('restoreVolumeFromBackupAndAttachToVM')
+  },
   created () {
     this.initForm()
     this.fetchData()
   },
   inject: ['parentFetchData'],
   methods: {
+    isAdmin,
     initForm () {
       this.formRef = ref()
-      this.form = reactive({})
+      this.form = reactive({
+        quickRestore: false
+      })
       this.rules = reactive({
         volumeid: [{ required: true, message: this.$t('message.error.select') }],
         virtualmachineid: [{ required: true, message: this.$t('message.error.select') }]
@@ -115,6 +163,7 @@ export default {
     fetchData () {
       this.fetchVirtualMachine()
       this.fetchVolumes()
+      this.fetchHosts()
     },
     fetchVirtualMachine () {
       this.virtualMachineOptions.loading = true
@@ -143,6 +192,23 @@ export default {
       })
       this.volumeOptions.loading = false
     },
+    async fetchHosts () {
+      this.hostOptions.loading = true
+      const args = {
+        zoneid: this.resource.zoneid,
+        type: 'routing',
+        resourcestate: 'enabled',
+        state: 'up'
+      }
+      const hosts = (await getAPI('listHosts', args))?.listhostsresponse?.host ?? []
+      this.hostOptions.opts = hosts.map((host) => {
+        return {
+          id: host.id,
+          name: host.name
+        }
+      })
+      this.hostOptions.loading = false
+    },
     handleSubmit (e) {
       e.preventDefault()
       if (this.actionLoading) return
@@ -153,6 +219,8 @@ export default {
         params.backupid = this.resource.id
         params.volumeid = values.volumeid
         params.virtualmachineid = this.virtualMachineOptions.opts.filter(opt => opt.name === values.virtualmachineid)[0].id || null
+        params.quickrestore = values.quickRestore
+        params.hostid = values.hostId
 
         this.actionLoading = true
         const title = this.$t('label.restore.volume.attach')
diff --git a/ui/src/views/storage/UploadLocalVolume.vue b/ui/src/views/storage/UploadLocalVolume.vue
index 5e6a5b4fc27b..b936ebdfac7c 100644
--- a/ui/src/views/storage/UploadLocalVolume.vue
+++ b/ui/src/views/storage/UploadLocalVolume.vue
@@ -16,13 +16,29 @@
 // under the License.
 
 <template>
-  <div class="form-layout" v-ctrl-enter="handleSubmit">
-    <span v-if="uploadPercentage > 0">
+  <div class="form-layout">
+    <span v-if="uploading">
       <loading-outlined />
       {{ $t('message.upload.file.processing') }}
       <a-progress :percent="uploadPercentage" />
     </span>
-    <a-spin :spinning="loading" v-else>
+    <div v-else-if="ssvmCertUntrusted" class="ssvm-cert-warning">
+      <a-alert
+        type="warning"
+        show-icon
+        :message="$t('message.ssvm.cert.untrusted')"
+        :description="$t('message.ssvm.cert.trust.instructions')" />
+      <div :span="24" class="action-button">
+        <a-button @click="closeAction">{{ $t('label.cancel') }}</a-button>
+        <a-button :href="ssvmOrigin" target="_blank" rel="noopener noreferrer">
+          {{ $t('label.ssvm.open.cert.page') }}
+        </a-button>
+        <a-button type="primary" :loading="loading" @click="retryUpload">
+          {{ $t('label.retry.upload') }}
+        </a-button>
+      </div>
+    </div>
+    <a-spin :spinning="loading" v-else v-ctrl-enter="handleSubmit">
       <a-form
         :ref="formRef"
         :model="form"
@@ -156,6 +172,7 @@ import { ref, reactive, toRaw } from 'vue'
 import { getAPI } from '@/api'
 import { axios } from '../../utils/request'
 import { mixinForm } from '@/utils/mixin'
+import { probeSsvmCert } from '@/utils/ssvmProbe'
 import ResourceIcon from '@/components/view/ResourceIcon'
 import TooltipLabel from '@/components/widgets/TooltipLabel'
 import InfiniteScrollSelect from '@/components/widgets/InfiniteScrollSelect.vue'
@@ -178,7 +195,10 @@ export default {
       customDiskOffering: false,
       isCustomizedDiskIOps: false,
       loading: false,
-      uploadPercentage: 0
+      uploading: false,
+      uploadPercentage: 0,
+      ssvmCertUntrusted: false,
+      ssvmOrigin: ''
     }
   },
   beforeCreate () {
@@ -267,6 +287,63 @@ export default {
       this.form.account = accountName
       this.account = accountName
     },
+    async retryUpload () {
+      this.loading = true
+      const reachable = await probeSsvmCert(this.ssvmOrigin)
+      this.loading = false
+      if (!reachable) {
+        this.$message.warning(this.$t('message.ssvm.unreachable.retry'))
+        return
+      }
+      this.ssvmCertUntrusted = false
+      this.handleUpload()
+    },
+    handleUpload () {
+      if (this.fileList.length > 1) {
+        this.$notification.error({
+          message: this.$t('message.upload.volume.failed'),
+          description: this.$t('message.upload.file.limit'),
+          duration: 0
+        })
+        return
+      }
+      const { fileList } = this
+      const formData = new FormData()
+      fileList.forEach(file => {
+        formData.append('files[]', file)
+      })
+      this.uploading = true
+      this.uploadPercentage = 0
+      axios.post(this.uploadParams.postURL,
+        formData,
+        {
+          headers: {
+            'content-type': 'multipart/form-data',
+            'x-signature': this.uploadParams.signature,
+            'x-expires': this.uploadParams.expires,
+            'x-metadata': this.uploadParams.metadata
+          },
+          onUploadProgress: (progressEvent) => {
+            this.uploadPercentage = Number(parseFloat(100 * progressEvent.loaded / progressEvent.total).toFixed(1))
+          },
+          timeout: 86400000
+        }).then((json) => {
+        this.$notification.success({
+          message: this.$t('message.success.upload'),
+          description: this.$t('message.success.upload.volume.description')
+        })
+        this.closeAction()
+      }).catch(e => {
+        this.$notification.error({
+          message: this.$t('message.upload.failed'),
+          description: `${this.$t('message.upload.volume.failed')} -  ${e}`,
+          duration: 0
+        })
+      }).finally(() => {
+        this.uploading = false
+        this.loading = false
+      })
+    },
     handleSubmit (e) {
       e.preventDefault()
       if (this.loading) return
@@ -286,49 +363,15 @@ export default {
         }
         params.domainId = this.domainId
         this.loading = true
-        getAPI('getUploadParamsForVolume', params).then(json => {
+        getAPI('getUploadParamsForVolume', params).then(async json => {
           this.uploadParams = json.postuploadvolumeresponse?.getuploadparams || ''
-          const { fileList } = this
-          if (this.fileList.length > 1) {
-            this.$notification.error({
-              message: this.$t('message.upload.volume.failed'),
-              description: this.$t('message.upload.file.limit'),
-              duration: 0
-            })
+          this.ssvmOrigin = new URL(this.uploadParams.postURL).origin
+          const trusted = await probeSsvmCert(this.ssvmOrigin)
+          if (!trusted) {
+            this.ssvmCertUntrusted = true
+            return
           }
-          const formData = new FormData()
-          fileList.forEach(file => {
-            formData.append('files[]', file)
-          })
-          this.uploadPercentage = 0
-          axios.post(this.uploadParams.postURL,
-            formData,
-            {
-              headers: {
-                'content-type': 'multipart/form-data',
-                'x-signature': this.uploadParams.signature,
-                'x-expires': this.uploadParams.expires,
-                'x-metadata': this.uploadParams.metadata
-              },
-              onUploadProgress: (progressEvent) => {
-                this.uploadPercentage = Number(parseFloat(100 * progressEvent.loaded / progressEvent.total).toFixed(1))
-              },
-              timeout: 86400000
-            }).then((json) => {
-            this.$notification.success({
-              message: this.$t('message.success.upload'),
-              description: this.$t('message.success.upload.volume.description')
-            })
-            this.closeAction()
-          }).catch(e => {
-            this.$notification.error({
-              message: this.$t('message.upload.failed'),
-              description: `${this.$t('message.upload.volume.failed')} -  ${e}`,
-              duration: 0
-            })
-          }).finally(() => {
-            this.loading = false
-          })
+          this.handleUpload()
         }).catch(e => {
           this.$notification.error({
             message: this.$t('message.upload.failed'),
diff --git a/utils/src/main/java/com/cloud/utils/DateUtil.java b/utils/src/main/java/com/cloud/utils/DateUtil.java
index 00ae5565dadc..985a309bba34 100644
--- a/utils/src/main/java/com/cloud/utils/DateUtil.java
+++ b/utils/src/main/java/com/cloud/utils/DateUtil.java
@@ -346,4 +346,10 @@ public static ZonedDateTime getZoneDateTime(Date date, ZoneId tzId) {
     public static int getHoursInCurrentMonth(Date date) {
         return YearMonth.of(date.getYear(), date.getMonth() + 1).lengthOfMonth() * 24;
     }
+
+    public static String getDateInSystemTimeZone() {
+        ZonedDateTime nowInLocalZone = ZonedDateTime.now(ZoneId.systemDefault());
+        return nowInLocalZone.format(DateTimeFormatter.ISO_OFFSET_DATE_TIME);
+    }
+
 }
diff --git a/utils/src/main/java/com/cloud/utils/exception/BackupException.java b/utils/src/main/java/com/cloud/utils/exception/BackupException.java
new file mode 100644
index 000000000000..ff7ffecda424
--- /dev/null
+++ b/utils/src/main/java/com/cloud/utils/exception/BackupException.java
@@ -0,0 +1,42 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+package com.cloud.utils.exception;
+
+public class BackupException extends RuntimeException {
+
+    private final boolean isVmConsistent;
+
+    public BackupException(String message, Throwable cause, boolean isVmConsistent) {
+        super(message, cause);
+        this.isVmConsistent = isVmConsistent;
+    }
+
+    public BackupException(String message, boolean isVmConsistent) {
+        super(message);
+        this.isVmConsistent = isVmConsistent;
+    }
+
+    /**
+     * If false, the backup process met an error that could not be recovered from automatically and manual intervention is needed. If true, the backup process did not make the
+     * VM inconsistent, but it might have already been inconsistent from another process.
+     * */
+    public boolean isVmConsistent() {
+        return isVmConsistent;
+    }
+}
diff --git a/utils/src/main/java/com/cloud/utils/exception/BackupProviderException.java b/utils/src/main/java/com/cloud/utils/exception/BackupProviderException.java
new file mode 100644
index 000000000000..01e82584d1ee
--- /dev/null
+++ b/utils/src/main/java/com/cloud/utils/exception/BackupProviderException.java
@@ -0,0 +1,33 @@
+//
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+//
+package com.cloud.utils.exception;
+
+/**
+ * Backup provider specific exceptions which should be returned to the user.
+ * */
+public class BackupProviderException extends RuntimeException {
+
+    public BackupProviderException(String message) {
+        super(message);
+    }
+
+    public BackupProviderException(String message, Throwable cause) {
+        super(message, cause);
+    }
+}