migrationplan_controller.go

/*
Copyright 2024.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package controller

import (
	"context"
	"encoding/json"
	"fmt"
	"os"
	"os/user"
	"reflect"
	"strconv"
	"strings"
	"time"

	"github.com/go-logr/logr"
	"github.com/gophercloud/gophercloud/v2/openstack/compute/v2/flavors"
	"github.com/pkg/errors"
	vjailbreakv1alpha1 "github.com/platform9/vjailbreak/k8s/migration/api/v1alpha1"
	"github.com/platform9/vjailbreak/k8s/migration/pkg/scope"
	utils "github.com/platform9/vjailbreak/k8s/migration/pkg/utils"

	"github.com/platform9/vjailbreak/k8s/migration/pkg/verrors"
	"github.com/platform9/vjailbreak/pkg/common/constants"
	openstackpkg "github.com/platform9/vjailbreak/pkg/common/openstack"
	commonutils "github.com/platform9/vjailbreak/pkg/common/utils"
	netappsdk "github.com/platform9/vjailbreak/pkg/vpwned/sdk/storage/netapp"
	"github.com/platform9/vjailbreak/v2v-helper/pkg/k8sutils"
	"github.com/platform9/vjailbreak/v2v-helper/vcenter"

	batchv1 "k8s.io/api/batch/v1"
	corev1 "k8s.io/api/core/v1"
	apierrors "k8s.io/apimachinery/pkg/api/errors"
	"k8s.io/apimachinery/pkg/api/resource"
	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
	"k8s.io/apimachinery/pkg/runtime"
	"k8s.io/apimachinery/pkg/types"
	"k8s.io/apimachinery/pkg/util/wait"
	"k8s.io/client-go/util/retry"
	"k8s.io/utils/ptr"
	ctrl "sigs.k8s.io/controller-runtime"
	"sigs.k8s.io/controller-runtime/pkg/builder"
	"sigs.k8s.io/controller-runtime/pkg/client"
	"sigs.k8s.io/controller-runtime/pkg/controller"
	"sigs.k8s.io/controller-runtime/pkg/controller/controllerutil"
	"sigs.k8s.io/controller-runtime/pkg/event"
	"sigs.k8s.io/controller-runtime/pkg/log"
	"sigs.k8s.io/controller-runtime/pkg/predicate"

	"github.com/vmware/govmomi/object"
	"github.com/vmware/govmomi/session"
	govmomitypes "github.com/vmware/govmomi/vim25/types"
)

// VDDKDirectory is the path to VMware VDDK installation directory used for VM disk conversion
const VDDKDirectory = "/home/ubuntu/vmware-vix-disklib-distrib"

// StorageCopyMethod is the storage copy method value for Storage Accelerated copy
const StorageCopyMethod = "StorageAcceleratedCopy"

// MigrationPlanReconciler reconciles a MigrationPlan object
type MigrationPlanReconciler struct {
	client.Client
	Scheme                  *runtime.Scheme
	ctxlog                  logr.Logger
	MaxConcurrentReconciles int
}

var migrationPlanFinalizer = "migrationplan.vjailbreak.pf9.io/finalizer"

// The default image. This is replaced by Go linker flags in the Dockerfile
var v2vimage = "platform9/v2v-helper:v0.1"

// +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=core,resources=pods/status,verbs=get;update;patch
// +kubebuilder:rbac:groups=core,resources=pods/log,verbs=get;list
// +kubebuilder:rbac:groups=core,resources=configmaps,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=core,resources=configmaps/status,verbs=get;update;patch
// +kubebuilder:rbac:groups=batch,resources=jobs,verbs=get;list;watch;create;update;patch;delete

// +kubebuilder:rbac:groups=vjailbreak.k8s.pf9.io,resources=migrationplans,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=vjailbreak.k8s.pf9.io,resources=migrationplans/status,verbs=get;update;patch
// +kubebuilder:rbac:groups=vjailbreak.k8s.pf9.io,resources=migrationplans/finalizers,verbs=update
// +kubebuilder:rbac:groups=vjailbreak.k8s.pf9.io,resources=migrationtemplates,verbs=get;list;watch

// +kubebuilder:rbac:groups=vjailbreak.k8s.pf9.io,resources=migrationtemplates,verbs=get;list;watch;create;update;patch;delete
// +kubebuilder:rbac:groups=vjailbreak.k8s.pf9.io,resources=migrationtemplates/status,verbs=get;update;patch
// +kubebuilder:rbac:groups=vjailbreak.k8s.pf9.io,resources=migrationtemplates/finalizers,verbs=update
// +kubebuilder:rbac:groups=vjailbreak.k8s.pf9.io,resources=proxyvms,verbs=get;list;watch;update;patch

// Reconcile reads that state of the cluster for a MigrationPlan object and makes necessary changes
func (r *MigrationPlanReconciler) Reconcile(ctx context.Context, req ctrl.Request) (_ ctrl.Result, reterr error) {
	r.ctxlog = log.FromContext(ctx)
	migrationplan := &vjailbreakv1alpha1.MigrationPlan{}

	if err := r.Get(ctx, req.NamespacedName, migrationplan); err != nil {
		if apierrors.IsNotFound(err) {
			return ctrl.Result{}, nil
		}
		r.ctxlog.Error(err, fmt.Sprintf("failed to read MigrationPlan '%s'", migrationplan.Name))
		return ctrl.Result{}, errors.Wrapf(err, "failed to read MigrationPlan '%s'", migrationplan.Name)
	}

	err := utils.ValidateMigrationPlan(migrationplan)
	if err != nil {
		return ctrl.Result{}, errors.Wrap(err, "failed to validate MigrationPlan")
	}

	// Set default migration type if not provided
	if migrationplan.Spec.MigrationStrategy.Type == "" {
		vjailbreakSettings, err := k8sutils.GetVjailbreakSettings(ctx, r.Client)
		if err != nil {
			r.ctxlog.Error(err, "Failed to get vjailbreak settings")
			return ctrl.Result{}, errors.Wrap(err, "failed to get vjailbreak settings")
		}
		migrationplan.Spec.MigrationStrategy.Type = vjailbreakSettings.DefaultMigrationMethod
		// Update the spec
		if err := r.Update(ctx, migrationplan); err != nil {
			return ctrl.Result{}, errors.Wrap(err, "failed to update migration plan with default type")
		}
	}

	migrationPlanScope, err := scope.NewMigrationPlanScope(scope.MigrationPlanScopeParams{
		Logger:        r.ctxlog,
		Client:        r.Client,
		MigrationPlan: migrationplan,
	})
	if err != nil {
		return ctrl.Result{}, errors.Wrap(err, "failed to create scope")
	}

	// Always close the scope when exiting this function such that we can persist any MigrationPlan changes.
	defer func() {
		if err := migrationPlanScope.Close(); err != nil && reterr == nil {
			reterr = err
		}
	}()

	// examine DeletionTimestamp to determine if object is under deletion or not
	if !migrationplan.DeletionTimestamp.IsZero() {
		return r.reconcileDelete(ctx, migrationPlanScope)
	}

	return r.reconcileNormal(ctx, migrationPlanScope)
}

func (r *MigrationPlanReconciler) reconcileNormal(ctx context.Context, scope *scope.MigrationPlanScope) (ctrl.Result, error) {
	migrationplan := scope.MigrationPlan
	log := scope.Logger

	log.Info(fmt.Sprintf("Reconciling MigrationPlan '%s'", migrationplan.Name))

	controllerutil.AddFinalizer(migrationplan, migrationPlanFinalizer)

	res, err := r.ReconcileMigrationPlanJob(ctx, migrationplan, scope)
	if err != nil {
		return res, errors.Wrap(err, "failed to reconcile migration plan job")
	}
	return res, nil
}

//nolint:unparam //future use
func (r *MigrationPlanReconciler) reconcileDelete(
	ctx context.Context,
	scope *scope.MigrationPlanScope,
) (ctrl.Result, error) {
	migrationplan := scope.MigrationPlan
	ctxlog := log.FromContext(ctx).WithName(constants.MigrationControllerName)

	// The object is being deleted
	ctxlog.Info(fmt.Sprintf("MigrationPlan '%s' CR is being deleted", migrationplan.Name))

	// Now that the finalizer has completed deletion tasks, we can remove it
	// to allow deletion of the Migration object
	controllerutil.RemoveFinalizer(migrationplan, migrationPlanFinalizer)
	if err := r.Update(ctx, migrationplan); err != nil {
		return ctrl.Result{}, errors.Wrap(err, "failed to remove finalizer")
	}

	return ctrl.Result{}, nil
}

func (r *MigrationPlanReconciler) getMigrationTemplateAndCreds(
	ctx context.Context,
	migrationplan *vjailbreakv1alpha1.MigrationPlan,
) (*vjailbreakv1alpha1.MigrationTemplate, *vjailbreakv1alpha1.VMwareCreds, *corev1.Secret, error) {
	ctxlog := log.FromContext(ctx)

	migrationtemplate := &vjailbreakv1alpha1.MigrationTemplate{}
	if err := r.Get(ctx, types.NamespacedName{
		Name:      migrationplan.Spec.MigrationTemplate,
		Namespace: migrationplan.Namespace,
	}, migrationtemplate); err != nil {
		ctxlog.Error(err, "Failed to get MigrationTemplate")
		return nil, nil, nil, errors.Wrap(err, "failed to get MigrationTemplate")
	}

	vmwcreds := &vjailbreakv1alpha1.VMwareCreds{}
	if ok, err := r.checkStatusSuccess(ctx, migrationtemplate.Namespace, migrationtemplate.Spec.Source.VMwareRef, true, vmwcreds); !ok {
		return nil, nil, nil, errors.Wrap(err, "VMwareCreds not validated")
	}

	secret := &corev1.Secret{}
	if err := r.Get(ctx, types.NamespacedName{
		Name:      vmwcreds.Spec.SecretRef.Name,
		Namespace: migrationplan.Namespace,
	}, secret); err != nil {
		return nil, nil, nil, errors.Wrap(err, "failed to get vCenter Secret")
	}

	return migrationtemplate, vmwcreds, secret, nil
}

func (r *MigrationPlanReconciler) reconcilePostMigration(ctx context.Context, scope *scope.MigrationPlanScope, vm string) error {
	migrationplan := scope.MigrationPlan
	ctxlog := log.FromContext(ctx).WithName(constants.MigrationControllerName)

	ctxlog.Info("Starting post-migration reconciliation for VM", "vm", vm, "migrationplan", migrationplan.Name)

	if migrationplan.Spec.PostMigrationAction == nil {
		ctxlog.Info("No post-migration actions configured for VM", "vm", vm)
		return nil
	}

	if migrationplan.Spec.PostMigrationAction.RenameVM == nil &&
		migrationplan.Spec.PostMigrationAction.MoveToFolder == nil {
		ctxlog.Info("No post-migration actions enabled for VM", "vm", vm)
		return nil
	}

	ctxlog.Info("Post-migration actions configured for VM",
		"vm", vm,
		"renameVM", migrationplan.Spec.PostMigrationAction.RenameVM,
		"moveToFolder", migrationplan.Spec.PostMigrationAction.MoveToFolder,
		"suffix", migrationplan.Spec.PostMigrationAction.Suffix,
		"folderName", migrationplan.Spec.PostMigrationAction.FolderName)

	// Get required resources
	migrationtemplate, vmwcreds, secret, err := r.getMigrationTemplateAndCreds(ctx, migrationplan)
	if err != nil {
		return errors.Wrap(err, "failed to get migration resources")
	}

	vmMachine, err := GetVMwareMachineForVM(ctx, r, vm, migrationtemplate, vmwcreds)
	if err != nil {
		return errors.Wrapf(err, "failed to resolve VMwareMachine for post-migration actions on VM %s", vm)
	}
	vcenterVMName := vmMachine.Spec.VMInfo.Name
	vmid := vmMachine.Spec.VMInfo.VMID
	ctxlog.Info("Resolved vCenter VM for post-migration", "vmKey", vm, "vcenterName", vcenterVMName, "vmid", vmid)

	// Extract and validate credentials
	username, password, host, err := extractVCenterCredentials(secret)
	if err != nil {
		return errors.Wrap(err, "invalid vCenter credentials")
	}

	// Create vCenter client (datacenter is auto-detected from VM during move operation)
	vcClient, _, err := createVCenterClientAndDC(ctx, host, username, password, vmwcreds.Spec.DataCenter)
	if err != nil {
		return errors.Wrap(err, "failed to create vCenter client")
	}
	defer func() {
		if vcClient.VCClient != nil {
			sessionManager := session.NewManager(vcClient.VCClient)
			err = sessionManager.Logout(ctx) // Best effort logout
			if err != nil {
				ctxlog.Error(err, "Failed to logout from vCenter")
			}
		}
	}()

	if migrationplan.Spec.PostMigrationAction.RenameVM != nil && *migrationplan.Spec.PostMigrationAction.RenameVM {
		if err := r.renameVM(ctx, vcClient, migrationplan, vmid); err != nil {
			return errors.Wrap(err, "failed to rename VM")
		}
	}

	if migrationplan.Spec.PostMigrationAction.MoveToFolder != nil && *migrationplan.Spec.PostMigrationAction.MoveToFolder {
		if err := r.moveVMToFolder(ctx, vcClient, migrationplan, vmid); err != nil {
			return errors.Wrap(err, "failed to move VM to folder")
		}
	}

	return nil
}

func (*MigrationPlanReconciler) renameVM(
	ctx context.Context,
	vcClient *vcenter.VCenterClient,
	migrationplan *vjailbreakv1alpha1.MigrationPlan,
	vmid string,
) error {
	ctxlog := log.FromContext(ctx)
	suffix := migrationplan.Spec.PostMigrationAction.Suffix
	if suffix == "" {
		suffix = "_migrated_to_pcd"
		ctxlog.Info("Using default suffix", "suffix", suffix)
	}
	vmObj := vcClient.GetVMByMOID(vmid)
	currentName, err := vmObj.ObjectName(ctx)
	if err != nil {
		return errors.Wrapf(err, "failed to fetch current VM name for moid %s", vmid)
	}
	newVMName := currentName + suffix
	ctxlog.Info("Starting VM rename operation", "oldName", currentName, "newName", newVMName, "vmid", vmid, "migrationplan", migrationplan.Name)
	err = vcClient.RenameVM(ctx, vmid, newVMName)
	if err != nil {
		if strings.Contains(strings.ToLower(err.Error()), "not found") {
			ctxlog.Info("VM not found for rename; possibly already processed or deleted", "oldName", currentName, "newName", newVMName)
			return nil
		}
		ctxlog.Error(err, "Failed to rename VM", "oldName", currentName, "newName", newVMName, "migrationplan", migrationplan.Name)
		return err
	}
	ctxlog.Info("Successfully renamed VM", "oldName", currentName, "newName", newVMName, "migrationplan", migrationplan.Name)
	return nil
}

func (*MigrationPlanReconciler) moveVMToFolder(
	ctx context.Context,
	vcClient *vcenter.VCenterClient,
	migrationplan *vjailbreakv1alpha1.MigrationPlan,
	vmid string,
) error {
	ctxlog := log.FromContext(ctx)
	folderName := migrationplan.Spec.PostMigrationAction.FolderName
	if folderName == "" {
		folderName = "vjailbreakedVMs"
		ctxlog.Info("Using default folder name", "folderName", folderName)
	}

	datacenterName := ""
	vmObj := vcClient.GetVMByMOID(vmid)
	if currentName, nameErr := vmObj.ObjectName(ctx); nameErr == nil {
		if _, dc, dcErr := vcClient.GetVMWithDatacenter(ctx, currentName); dcErr == nil {
			datacenterName = dc.Name()
		} else {
			ctxlog.Info("Could not resolve datacenter for VM, proceeding without datacenter context", "vmid", vmid, "err", dcErr)
		}
	} else {
		ctxlog.Info("Could not get VM name for datacenter lookup, proceeding without datacenter context", "vmid", vmid, "err", nameErr)
	}

	ctxlog.Info("Starting VM move to folder operation", "vmid", vmid, "datacenter", datacenterName, "folder", folderName, "migrationplan", migrationplan.Name)

	if err := vcClient.MovetoFolder(ctx, vmid, datacenterName, folderName); err != nil {
		if strings.Contains(strings.ToLower(err.Error()), "not found") {
			ctxlog.Info("VM not found for move; possibly already processed or deleted", "vmid", vmid)
			return nil
		}
		ctxlog.Error(err, "VM move failed", "vmid", vmid, "folder", folderName, "migrationplan", migrationplan.Name)
		return errors.Wrapf(err, "failed to move VM (moid=%s) to folder '%s'", vmid, folderName)
	}
	ctxlog.Info("Successfully moved VM to folder", "vmid", vmid, "folder", folderName, "migrationplan", migrationplan.Name)
	return nil
}

func createVCenterClientAndDC(
	ctx context.Context,
	host, username, password, datacenterName string,
) (*vcenter.VCenterClient, *object.Datacenter, error) {
	ctxlog := log.FromContext(ctx)
	ctxlog.Info("Creating vCenter client...", "host", host, "insecure", true)

	vcClient, err := vcenter.VCenterClientBuilder(ctx, username, password, host, true)
	if err != nil {
		ctxlog.Error(err, "Failed to create vCenter client")
		return nil, nil, errors.Wrapf(err, "failed to create vCenter client")
	}
	ctxlog.Info("vCenter client created successfully")

	if datacenterName == "" {
		ctxlog.Info("No datacenter specified, returning client without datacenter scope")
		return vcClient, nil, nil
	}

	ctxlog.Info("Using datacenter", "datacenter", datacenterName)
	dc, err := vcClient.VCFinder.Datacenter(ctx, datacenterName)
	if err != nil {
		ctxlog.Error(err, "Failed to find datacenter")
		return nil, nil, errors.Wrapf(err, "failed to find datacenter '%s'", datacenterName)
	}
	ctxlog.Info("Datacenter located", "datacenter", dc)

	return vcClient, dc, nil
}

func extractVCenterCredentials(secret *corev1.Secret) (username, password, host string, err error) {
	u, ok := secret.Data["VCENTER_USERNAME"]
	if !ok {
		err = errors.New("username not found in secret")
		return
	}
	p, ok := secret.Data["VCENTER_PASSWORD"]
	if !ok {
		err = errors.New("password not found in secret")
		return
	}
	h, ok := secret.Data["VCENTER_HOST"]
	if !ok {
		err = errors.New("host not found in secret")
		return
	}
	username = string(u)
	password = string(p)
	host = string(h)
	return
}

// GetVMwareMachineForVM fetches the VMwareMachine corresponding to a given VM name
func GetVMwareMachineForVM(ctx context.Context, r *MigrationPlanReconciler, vm string, migrationtemplate *vjailbreakv1alpha1.MigrationTemplate, vmwcreds *vjailbreakv1alpha1.VMwareCreds) (*vjailbreakv1alpha1.VMwareMachine, error) {
	// Generate the expected VMwareMachine name
	vmk8sname, err := commonutils.GetK8sCompatibleVMWareObjectName(vm, vmwcreds.Name)
	if err != nil {
		return nil, errors.Wrapf(err, "failed to get k8s compatible name for VM %s", vm)
	}

	// Fetch individual VMwareMachine
	vmMachine := &vjailbreakv1alpha1.VMwareMachine{}
	err = r.Get(ctx, types.NamespacedName{
		Name:      vmk8sname,
		Namespace: migrationtemplate.Namespace,
	}, vmMachine)
	if err != nil {
		if apierrors.IsNotFound(err) {
			return nil, errors.Errorf("VMwareMachine %s not found for VM %s", vmk8sname, vm)
		}
		return nil, errors.Wrapf(err, "failed to get VMwareMachine %s for VM %s", vmk8sname, vm)
	}

	// Verify VMwareMachine has correct VMwareCreds label
	if vmMachine.Labels == nil {
		return nil, errors.Errorf("VMwareMachine %s has no labels", vmMachine.Name)
	}

	expectedLabel := vmwcreds.Name
	actualLabel, exists := vmMachine.Labels[constants.VMwareCredsLabel]
	if !exists {
		return nil, errors.Errorf("VMwareMachine %s missing required label %s", vmMachine.Name, constants.VMwareCredsLabel)
	}

	if actualLabel != expectedLabel {
		return nil, errors.Errorf("VMwareMachine %s has incorrect VMwareCreds label: expected %s, got %s", vmMachine.Name, expectedLabel, actualLabel)
	}

	vmidSuffixed := commonutils.GetVMUniqueKey(vmMachine.Spec.VMInfo.Name, vmMachine.Spec.VMInfo.VMID)
	if vmidSuffixed != vm {
		return nil, errors.Errorf("VMwareMachine %s VM key mismatch: expected %s, got %s", vmMachine.Name, vm, vmidSuffixed)
	}
	return vmMachine, nil
}

// ReconcileMigrationPlanJob reconciles jobs created by the migration plan
//
//nolint:gocyclo
func (r *MigrationPlanReconciler) ReconcileMigrationPlanJob(ctx context.Context,
	migrationplan *vjailbreakv1alpha1.MigrationPlan,
	scope *scope.MigrationPlanScope) (ctrl.Result, error) {
	totalVMs := 0
	for _, group := range migrationplan.Spec.VirtualMachines {
		totalVMs += len(group)
	}
	allVMNames := make([]string, 0, totalVMs)
	for _, group := range migrationplan.Spec.VirtualMachines {
		allVMNames = append(allVMNames, group...)
	}

	if migrationplan.Status.MigrationStatus == corev1.PodSucceeded {
		r.ctxlog.Info("Migration already completed, skipping job reconciliation", "migrationplan", migrationplan.Name)
		return ctrl.Result{}, nil
	}

	if migrationplan.Status.MigrationStatus == corev1.PodFailed {
		// Check if any Migration objects exist for this MigrationPlan
		migrationList := &vjailbreakv1alpha1.MigrationList{}
		listOpts := []client.ListOption{
			client.InNamespace(migrationplan.Namespace),
			client.MatchingLabels{"migrationplan": migrationplan.Name},
		}
		if err := r.List(ctx, migrationList, listOpts...); err != nil {
			r.ctxlog.Error(err, "Failed to list migrations for retry check", "migrationplan", migrationplan.Name)
			return ctrl.Result{}, errors.Wrap(err, "failed to list migrations for retry check")
		}

		// Map existing migrations to detect deletions
		existingMigrationMap := make(map[string]bool)
		hasExistingFailures := false
		for _, m := range migrationList.Items {
			vmKey := m.Annotations[constants.OriginalVMNameAnnotation]
			if vmKey == "" {
				vmKey = m.Labels[constants.MigrationVMKeyLabel] // backward compat: pre-fix CRs lacked annotation
			}
			if vmKey == "" {
				vmKey = m.Spec.VMName
			}
			existingMigrationMap[vmKey] = true
			if m.Status.Phase == vjailbreakv1alpha1.VMMigrationPhaseFailed || m.Status.Phase == vjailbreakv1alpha1.VMMigrationPhaseValidationFailed {
				hasExistingFailures = true
			}
		}

		retryTriggeredByDeletion := false
		for _, name := range allVMNames {
			if !existingMigrationMap[name] {
				retryTriggeredByDeletion = true
				break
			}
		}

		// If the specific "Failed" objects are gone (user deleted them for retry),
		// but the plan still says "Failed", we reset the plan status.
		if !hasExistingFailures || retryTriggeredByDeletion {
			if strings.HasPrefix(migrationplan.Status.MigrationMessage, constants.MigrationPlanValidationFailedPrefix) {
				return ctrl.Result{}, nil
			}

			r.ctxlog.Info("Resetting Plan status for retry", "migrationplan", migrationplan.Name)

			err := retry.RetryOnConflict(retry.DefaultBackoff, func() error {
				latest := &vjailbreakv1alpha1.MigrationPlan{}
				if getErr := r.Get(ctx, types.NamespacedName{Name: migrationplan.Name, Namespace: migrationplan.Namespace}, latest); getErr != nil {
					if apierrors.IsNotFound(getErr) {
						return nil
					}
					return getErr
				}
				latest.Status.MigrationStatus = ""
				latest.Status.MigrationMessage = ""
				return r.Status().Update(ctx, latest)
			})

			if err != nil {
				return ctrl.Result{}, errors.Wrap(err, "failed to reset status for retry")
			}
			return ctrl.Result{Requeue: true}, nil
		}

		r.ctxlog.Info("Migration failures still exist, skipping reconciliation", "migrationplan", migrationplan.Name)
		return ctrl.Result{}, nil
	}

	migrationtemplate, vmwcreds, _, err := r.getMigrationTemplateAndCreds(ctx, migrationplan)
	if err != nil {
		r.ctxlog.Error(err, "Failed to get migration template and credentials")
		return ctrl.Result{}, err
	}

	terminalMigrations := make(map[string]bool)
	for _, vmName := range allVMNames {
		vmk8sname, err := commonutils.GetK8sCompatibleVMWareObjectName(vmName, vmwcreds.Name)
		if err != nil {
			r.ctxlog.Error(err, "Failed to convert VM name to k8s name", "vm", vmName)
			continue
		}
		migrationName := utils.MigrationNameFromVMName(vmk8sname)
		existingMigration := &vjailbreakv1alpha1.Migration{}
		if err := r.Get(ctx, types.NamespacedName{Name: migrationName, Namespace: migrationplan.Namespace}, existingMigration); err == nil {
			if existingMigration.Status.Phase == vjailbreakv1alpha1.VMMigrationPhaseSucceeded ||
				existingMigration.Status.Phase == vjailbreakv1alpha1.VMMigrationPhaseFailed ||
				existingMigration.Status.Phase == vjailbreakv1alpha1.VMMigrationPhaseValidationFailed ||
				existingMigration.Status.Phase == vjailbreakv1alpha1.VMMigrationPhaseDataCopied {
				terminalMigrations[vmName] = true
				r.ctxlog.Info("Skipping terminal migration from validation", "vm", vmName, "phase", existingMigration.Status.Phase)
			}
		}
	}

	// Filter out VMs with terminal migrations for validation
	vmsToValidate := []string{}
	for _, vmName := range allVMNames {
		if !terminalMigrations[vmName] {
			vmsToValidate = append(vmsToValidate, vmName)
		}
	}

	// Creds are fetched before validation because pre-flight now resolves each VM's
	// target flavor, which needs the OpenStack endpoint.
	// Fetch VMwareCreds CR
	if ok, err := r.checkStatusSuccess(ctx, migrationtemplate.Namespace, migrationtemplate.Spec.Source.VMwareRef, true, vmwcreds); !ok {
		return ctrl.Result{}, errors.Wrapf(err, "failed to check vmwarecreds status '%s'", migrationtemplate.Spec.Source.VMwareRef)
	}
	// Fetch OpenStackCreds CR
	openstackcreds := &vjailbreakv1alpha1.OpenstackCreds{}
	if ok, err := r.checkStatusSuccess(ctx, migrationtemplate.Namespace, migrationtemplate.Spec.Destination.OpenstackRef,
		false, openstackcreds); !ok {
		return ctrl.Result{}, errors.Wrapf(err, "failed to check openstackcreds status '%s'", migrationtemplate.Spec.Destination.OpenstackRef)
	}

	// Fetched once here and reused by validateMigrationPlanVMs below, so each VM
	// is looked up at most once per reconcile instead of twice.
	fetchedVMs, needsFlavorLookup := r.fetchVMsToValidate(ctx, migrationtemplate, vmwcreds, vmsToValidate)

	// One Nova call for the whole plan; skipped if every VM is pinned. A
	// failure here is just requeued, same as the creds checks above.
	var candidateFlavors []flavors.Flavor
	if needsFlavorLookup {
		var err error
		candidateFlavors, err = r.candidateFlavorsForPlan(ctx, migrationtemplate, openstackcreds)
		if err != nil {
			return ctrl.Result{}, errors.Wrap(err, "failed to list target flavors")
		}
	}

	// Non-nil maps for the no-VMs-to-validate path; nil-checked below since some
	// error paths still return a nil result.
	validation := &migrationPlanValidation{
		ResolvedFlavors: map[string]string{},
		SkipReasons:     map[string]string{},
	}
	var validationErr error
	if len(vmsToValidate) > 0 {
		// Validate VM OS types and resolve target flavors before proceeding.
		validation, validationErr = r.validateMigrationPlanVMs(ctx, migrationplan, migrationtemplate, vmwcreds, openstackcreds, vmsToValidate, fetchedVMs, candidateFlavors)
	}

	if validationErr != nil {
		r.ctxlog.Error(validationErr, "Migration plan validation failed", "migrationplan", migrationplan.Name)

		for _, vmName := range allVMNames {
			// Skip VMs with terminal migrations
			if terminalMigrations[vmName] {
				continue
			}

			vmMachine, err := GetVMwareMachineForVM(ctx, r, vmName, migrationtemplate, vmwcreds)
			if err != nil {
				r.ctxlog.Error(err, "Failed to get vmMachine for pre-creation", "vm", vmName)
				continue
			}

			migrationObj, createErr := r.CreateMigration(ctx, migrationplan, vmName, vmMachine)
			if createErr != nil {
				r.ctxlog.Error(createErr, "Failed to create migration object during validation failure documentation", "vm", vmName)
				continue
			}

			// Prefer the specific skip reason over the generic message.
			reason := "VM failed migration plan validation"
			if validation != nil {
				if specific := validation.SkipReasons[vmName]; specific != "" {
					reason = specific
				}
			}
			r.markMigrationValidationFailed(ctx, migrationObj, vmName, reason)
		}

		if err := r.UpdateMigrationPlanStatus(ctx, migrationplan, corev1.PodFailed, fmt.Sprintf("Migration plan validation failed: %v", validationErr)); err != nil {
			r.ctxlog.Error(err, "Failed to update migration plan status after validation failure")
		}
		return ctrl.Result{}, validationErr
	}

	// Every non-terminal VM in the plan gets a Migration CR, including ones that
	// failed pre-flight validation. The UI's migrations table is built purely from
	// Migration objects, so a VM without one is invisible there — no row, no
	// placeholder, and no hint as to why it never migrated.
	for _, vmName := range allVMNames {
		// Skip VMs with terminal migrations
		if terminalMigrations[vmName] {
			continue
		}

		vmMachine, err := GetVMwareMachineForVM(ctx, r, vmName, migrationtemplate, vmwcreds)
		if err != nil {
			r.ctxlog.Error(err, "Failed to get vmMachine for migration creation", "vm", vmName)
			continue
		}

		migrationObj, createErr := r.CreateMigration(ctx, migrationplan, vmName, vmMachine)
		if createErr != nil {
			r.ctxlog.Error(createErr, "Failed to create migration object", "vm", vmName)
			continue
		}

		isValid := false
		for _, v := range validation.ValidVMs {
			if commonutils.GetVMUniqueKey(v.Spec.VMInfo.Name, v.Spec.VMInfo.VMID) == vmName {
				isValid = true
				break
			}
		}

		if !isValid {
			// Prefer the specific pre-flight reason so the UI shows something
			// actionable ("no target flavor can satisfy this VM…") rather than a
			// generic validation failure.
			reason := validation.SkipReasons[vmName]
			if reason == "" {
				reason = "VM failed migration plan validation"
			}
			r.markMigrationValidationFailed(ctx, migrationObj, vmName, reason)
		}
	}

	var arraycreds *vjailbreakv1alpha1.ArrayCreds
	var proxyVM *vjailbreakv1alpha1.ProxyVM
	// Check if StorageCopyMethod is StorageAcceleratedCopy
	switch migrationtemplate.Spec.StorageCopyMethod {
	case StorageCopyMethod:
		// Fetch ArrayCredsMapping CR first
		arrayCredsMapping := &vjailbreakv1alpha1.ArrayCredsMapping{}
		if err := r.Get(ctx, types.NamespacedName{Name: migrationtemplate.Spec.ArrayCredsMapping, Namespace: migrationtemplate.Namespace}, arrayCredsMapping); err != nil {
			return ctrl.Result{}, errors.Wrapf(err, "failed to get ArrayCredsMapping '%s'", migrationtemplate.Spec.ArrayCredsMapping)
		}

		// Validate ArrayCredsMapping has mappings
		if len(arrayCredsMapping.Spec.Mappings) == 0 {
			return ctrl.Result{}, errors.Errorf("ArrayCredsMapping '%s' has no mappings defined", migrationtemplate.Spec.ArrayCredsMapping)
		}
		for _, mapping := range arrayCredsMapping.Spec.Mappings {
			arraycreds = &vjailbreakv1alpha1.ArrayCreds{}
			if err := r.Get(ctx, types.NamespacedName{Name: mapping.Target, Namespace: migrationtemplate.Namespace}, arraycreds); err != nil {
				return ctrl.Result{}, errors.Wrapf(err, "failed to get ArrayCreds '%s' from mapping", mapping.Target)
			}
			if arraycreds.Status.ArrayValidationStatus != string(corev1.PodSucceeded) {
				return ctrl.Result{}, errors.Errorf("ArrayCreds '%s' is not validated (status: %s)", mapping.Target, arraycreds.Status.ArrayValidationStatus)
			}
		}
	case constants.HotAddCopyMethod:
		if migrationtemplate.Spec.ProxyVMRef == nil {
			return ctrl.Result{}, errors.New("StorageCopyMethod is HotAdd but ProxyVMRef is not set in MigrationTemplate")
		}
		proxyVM = &vjailbreakv1alpha1.ProxyVM{}
		if err := r.Get(ctx, types.NamespacedName{Name: migrationtemplate.Spec.ProxyVMRef.Name, Namespace: migrationtemplate.Namespace}, proxyVM); err != nil {
			return ctrl.Result{}, errors.Wrapf(err, "failed to get ProxyVM '%s'", migrationtemplate.Spec.ProxyVMRef.Name)
		}
		if proxyVM.Status.ValidationStatus != constants.ProxyVMStatusReady {
			return ctrl.Result{}, errors.Errorf("ProxyVM '%s' is not ready (status: %s)", proxyVM.Name, proxyVM.Status.ValidationStatus)
		}
	default:
		arraycreds = nil
	}

	// Starting the Migrations
	if migrationplan.Status.MigrationStatus == "" {
		err := r.UpdateMigrationPlanStatus(ctx, migrationplan, corev1.PodRunning, "Migration(s) in progress")
		if err != nil {
			return ctrl.Result{}, errors.Wrap(err, "failed to update migration plan status")
		}
	}

	// vmMachinesArr is created to maintain order in which VM migration is triggered
	vmMachinesArr := validation.ValidVMs
	vmMachinesMap := make(map[string]*vjailbreakv1alpha1.VMwareMachine, len(validation.ValidVMs))
	for _, vmMachine := range validation.ValidVMs {
		vmMachinesMap[vmMachine.Spec.VMInfo.Name] = vmMachine
	}

	// Migrate RDM disks if any
	err = r.migrateRDMdisks(ctx, migrationplan, vmMachinesMap, openstackcreds)
	if err != nil {
		return r.handleRDMDiskMigrationError(ctx, migrationplan, err)
	}

	if paused, err := r.checkAndHandlePausedPlan(ctx, migrationplan); paused {
		return ctrl.Result{}, err
	}

	for _, parallelvms := range migrationplan.Spec.VirtualMachines {
		migrationobjs := &vjailbreakv1alpha1.MigrationList{}
		err := r.TriggerMigration(ctx, migrationplan, migrationobjs, openstackcreds, vmwcreds, arraycreds, migrationtemplate, vmMachinesArr, proxyVM, validation.ResolvedFlavors)
		if err != nil {
			if strings.Contains(err.Error(), "VDDK_MISSING") {
				r.ctxlog.Info("Requeuing due to missing VDDK files.")
				return ctrl.Result{RequeueAfter: 30 * time.Second}, nil
			}
			return ctrl.Result{}, errors.Wrapf(err, "failed to trigger migration")
		}

		// Fetch all migrations for this plan to catch already-completed migrations from previous reconciliations
		allMigrations := &vjailbreakv1alpha1.MigrationList{}
		listOpts := []client.ListOption{
			client.InNamespace(migrationplan.Namespace),
			client.MatchingLabels{"migrationplan": migrationplan.Name},
		}
		if err := r.List(ctx, allMigrations, listOpts...); err != nil {
			r.ctxlog.Error(err, "Failed to list all migrations for post-migration processing", "migrationplan", migrationplan.Name)
			return ctrl.Result{}, errors.Wrap(err, "failed to list migrations for post-migration processing")
		}

		outcome, err := r.processMigrationPhases(ctx, scope, migrationplan, allMigrations, parallelvms)
		if err != nil {
			return ctrl.Result{}, err
		}

		if !outcome.AllFinished {
			// Don't requeue - rely on event-driven reconciliation when Migrations reach terminal states
			return ctrl.Result{}, nil
		}

		// Every migration is terminal and at least one failed. Post-migration has
		// already run for the successful ones, so the plan can now be marked failed
		// without starving anything — a single bad VM no longer aborts the plan while
		// its siblings are still copying.
		if len(outcome.FailedVMs) > 0 {
			total := outcome.FinishedVMs + len(outcome.FailedVMs)
			msg := fmt.Sprintf("%d of %d VMs migrated successfully; %d failed: %s",
				outcome.FinishedVMs, total, len(outcome.FailedVMs), strings.Join(outcome.FailureSummaries, "; "))
			r.ctxlog.Info("MigrationPlan finished with failures", "migrationplan", migrationplan.Name, "failedVMs", outcome.FailedVMs)
			if err := r.UpdateMigrationPlanStatus(ctx, migrationplan, corev1.PodFailed, msg); err != nil {
				return ctrl.Result{}, errors.Wrap(err, "failed to update migration plan status after partial failure")
			}
			return ctrl.Result{}, nil
		}
	}

	r.ctxlog.Info(fmt.Sprintf("All VMs in MigrationPlan '%s' have been successfully migrated", migrationplan.Name))
	migrationplan.Status.MigrationStatus = corev1.PodSucceeded
	migrationplan.Status.MigrationMessage = "All migrations completed successfully"
	err = r.Status().Update(ctx, migrationplan)
	if err != nil {
		return ctrl.Result{}, errors.Wrap(err, "failed to update migration plan status")
	}

	return ctrl.Result{}, nil
}

// checkAndHandlePausedPlan checks if migration plan is paused and handles it
func (r *MigrationPlanReconciler) checkAndHandlePausedPlan(ctx context.Context, migrationplan *vjailbreakv1alpha1.MigrationPlan) (bool, error) {
	if !utils.IsMigrationPlanPaused(ctx, migrationplan.Name, r.Client) {
		return false, nil
	}
	migrationplan.Status.MigrationStatus = "Paused"
	migrationplan.Status.MigrationMessage = "Migration plan is paused"
	if err := r.Update(ctx, migrationplan); err != nil {
		return true, errors.Wrap(err, "failed to update migration plan status")
	}
	return true, nil
}

// processMigrationPhases processes migration phases for triggered migrations
func (r *MigrationPlanReconciler) processMigrationPhases(
	ctx context.Context,
	scope *scope.MigrationPlanScope,
	migrationplan *vjailbreakv1alpha1.MigrationPlan,
	migrationobjs *vjailbreakv1alpha1.MigrationList,
	parallelvms []string,
) (*migrationPhaseOutcome, error) {
	outcome := &migrationPhaseOutcome{AllFinished: true}

	r.ctxlog.Info("Processing migration phases", "migrationplan", migrationplan.Name, "totalMigrations", len(migrationobjs.Items), "currentBatch", parallelvms)

	for i := 0; i < len(migrationobjs.Items); i++ {
		migration := migrationobjs.Items[i]

		switch migration.Status.Phase {
		case vjailbreakv1alpha1.VMMigrationPhaseFailed, vjailbreakv1alpha1.VMMigrationPhaseValidationFailed:
			// Record and keep going. Returning here would abandon post-migration for
			// every healthy VM in the plan and, because ReconcileMigrationPlanJob
			// skips reconciliation for a PodFailed plan, park the plan permanently on
			// the strength of one bad VM.
			r.ctxlog.Info("Migration failed for VM", "vm", migration.Spec.VMName, "phase", migration.Status.Phase)
			outcome.FailedVMs = append(outcome.FailedVMs, migration.Spec.VMName)
			outcome.FailureSummaries = append(outcome.FailureSummaries,
				fmt.Sprintf("%s (%s)", migration.Spec.VMName, firstConditionMessage(&migration)))
			continue

		case vjailbreakv1alpha1.VMMigrationPhaseDataCopied:
			r.ctxlog.Info("Data-only migration completed for VM, skipping post-migration actions", "vm", migration.Spec.VMName, "migrationplan", migrationplan.Name)
			outcome.FinishedVMs++
			continue

		case vjailbreakv1alpha1.VMMigrationPhaseSucceeded:
			outcome.FinishedVMs++
			if migration.Annotations != nil && migration.Annotations[constants.PostMigrationCompleteAnnotation] == constants.AnnotationValueTrue {
				r.ctxlog.Info("Post-migration already completed for VM, skipping", "vm", migration.Spec.VMName)
				continue
			}

			r.ctxlog.Info("Migration succeeded for VM, applying post-migration actions", "vm", migration.Spec.VMName, "migrationplan", migrationplan.Name)
			vmKey := migration.Annotations[constants.OriginalVMNameAnnotation]
			if vmKey == "" {
				vmKey = migration.Labels[constants.MigrationVMKeyLabel] // backward compat: pre-fix CRs lacked annotation
			}
			if vmKey == "" {
				vmKey = migration.Spec.VMName
			}
			err := r.reconcilePostMigration(ctx, scope, vmKey)
			if err != nil {
				r.ctxlog.Error(err, "Post-migration actions failed for VM", "vm", migration.Spec.VMName)
				return nil, errors.Wrap(err, "failed post-migration")
			}

			migrationCopy := migration.DeepCopy()
			if migrationCopy.Annotations == nil {
				migrationCopy.Annotations = make(map[string]string)
			}
			migrationCopy.Annotations[constants.PostMigrationCompleteAnnotation] = constants.AnnotationValueTrue
			if err := r.Update(ctx, migrationCopy); err != nil {
				r.ctxlog.Error(err, "Failed to set post-migration complete annotation", "vm", migration.Spec.VMName)
			}

			r.ctxlog.Info("Post-migration actions completed for VM", "vm", migration.Spec.VMName, "migrationplan", migrationplan.Name)
			continue

		default:
			r.ctxlog.Info("VM migration still in progress",
				"vm", migration.Spec.VMName,
				"phase", migration.Status.Phase,
				"currentBatch", parallelvms)
			outcome.AllFinished = false
		}
	}
	return outcome, nil
}

// migrationPhaseOutcome summarises one pass over a plan's Migration objects.
type migrationPhaseOutcome struct {
	// AllFinished is true when no migration is still in a non-terminal phase.
	AllFinished bool
	// FinishedVMs counts migrations that reached Succeeded or DataCopied.
	FinishedVMs int
	// FailedVMs names the migrations in Failed or ValidationFailed.
	FailedVMs []string
	// FailureSummaries pairs each failed VM with its reason, for the plan status
	// message.
	FailureSummaries []string
}

// firstConditionMessage returns a human-readable reason for a migration's current
// state, preferring the most recently transitioned condition. Guards against an
// empty Conditions slice, which would otherwise panic on Conditions[0].
func firstConditionMessage(migration *vjailbreakv1alpha1.Migration) string {
	if len(migration.Status.Conditions) == 0 {
		return string(migration.Status.Phase)
	}

	newest := migration.Status.Conditions[0]
	for _, condition := range migration.Status.Conditions[1:] {
		if condition.LastTransitionTime.After(newest.LastTransitionTime.Time) {
			newest = condition
		}
	}
	if newest.Message == "" {
		return string(migration.Status.Phase)
	}
	return newest.Message
}

// handleRDMDiskMigrationError handles errors that occur during RDM disk migration
func (r *MigrationPlanReconciler) handleRDMDiskMigrationError(ctx context.Context, migrationplan *vjailbreakv1alpha1.MigrationPlan, err error) (ctrl.Result, error) {
	if err == verrors.ErrRDMDiskNotMigrated {
		delay := 25 * time.Second
		r.ctxlog.Info("RDM disk not migrated yet, requeuing MigrationPlan for polling.", "requeueAfter", delay)

		// Refetch the migration plan to get the latest version before updating
		if err := r.Get(ctx, types.NamespacedName{Name: migrationplan.Name, Namespace: migrationplan.Namespace}, migrationplan); err != nil {
			r.ctxlog.Error(err, "Failed to refetch MigrationPlan before updating status")
			return ctrl.Result{RequeueAfter: delay}, nil
		}
		newMessage := "RDM disk not migrated yet, requeuing MigrationPlan."
		if migrationplan.Status.MigrationMessage != newMessage || migrationplan.Status.MigrationStatus != corev1.PodPending {
			if err := r.UpdateMigrationPlanStatus(ctx, migrationplan, corev1.PodPending, newMessage); err != nil {
				r.ctxlog.Error(err, "Failed to update MigrationPlan status")
			}
		}

		return ctrl.Result{RequeueAfter: delay}, nil
	}
	// Handle any other RDM disk migration errors
	r.ctxlog.Info("RDM disk migration failed, failing MigrationPlan.", "error", err.Error())

	migrationList := &vjailbreakv1alpha1.MigrationList{}
	listOpts := []client.ListOption{
		client.InNamespace(migrationplan.Namespace),
		client.MatchingLabels{"migrationplan": migrationplan.Name},
	}
	if listErr := r.List(ctx, migrationList, listOpts...); listErr != nil {
		r.ctxlog.Error(listErr, "Failed to list migrations for RDM disk failure handling", "migrationplan", migrationplan.Name)
	} else {
		message := fmt.Sprintf("RDM disk migration failed: %s", err)
		for i := range migrationList.Items {
			m := migrationList.Items[i]
			if m.Status.Phase == vjailbreakv1alpha1.VMMigrationPhaseSucceeded ||
				m.Status.Phase == vjailbreakv1alpha1.VMMigrationPhaseFailed ||
				m.Status.Phase == vjailbreakv1alpha1.VMMigrationPhaseValidationFailed ||
				m.Status.Phase == vjailbreakv1alpha1.VMMigrationPhaseDataCopied {
				continue
			}
			r.markMigrationValidationFailed(ctx, &m, m.Spec.VMName, message)
		}
	}

	// Refetch the migration plan to get the latest version before updating
	if refetchErr := r.Get(ctx, types.NamespacedName{Name: migrationplan.Name, Namespace: migrationplan.Namespace}, migrationplan); refetchErr != nil {
		r.ctxlog.Error(refetchErr, "Failed to refetch MigrationPlan before failing")
		return ctrl.Result{}, fmt.Errorf("failed to refetch MigrationPlan: %w", refetchErr)
	}

	migrationplan.Status.MigrationStatus = corev1.PodFailed
	migrationplan.Status.MigrationMessage = fmt.Sprintf("RDM disk migration failed. Reason : %s", err)
	if err := r.UpdateMigrationPlanStatus(ctx, migrationplan, corev1.PodFailed, fmt.Sprintf("RDM disk migration failed. Reason : %s", err)); err != nil {
		return ctrl.Result{}, fmt.Errorf("failed to update MigrationPlan status: %w", err)
	}
	return ctrl.Result{}, err
}

// UpdateMigrationPlanStatus updates the status of a MigrationPlan
func (r *MigrationPlanReconciler) UpdateMigrationPlanStatus(ctx context.Context,
	migrationplan *vjailbreakv1alpha1.MigrationPlan, status corev1.PodPhase, message string,
) error {
	return retry.RetryOnConflict(retry.DefaultBackoff, func() error {
		// Get the latest version of the MigrationPlan
		latest := &vjailbreakv1alpha1.MigrationPlan{}
		if err := r.Get(ctx, types.NamespacedName{
			Name:      migrationplan.Name,
			Namespace: migrationplan.Namespace,
		}, latest); err != nil {
			return err
		}

		// Only update if the status is different to prevent unnecessary updates
		if latest.Status.MigrationStatus == status && latest.Status.MigrationMessage == message {
			return nil
		}

		// Update the status
		latest.Status.MigrationStatus = status
		latest.Status.MigrationMessage = message

		// Use Status().Update() for status subresource
		if err := r.Status().Update(ctx, latest); err != nil {
			return err
		}

		return nil
	})
}

// CreateMigration creates a new Migration resource
func (r *MigrationPlanReconciler) CreateMigration(ctx context.Context,
	migrationplan *vjailbreakv1alpha1.MigrationPlan,
	vm string, vmMachine *vjailbreakv1alpha1.VMwareMachine,
) (*vjailbreakv1alpha1.Migration, error) {
	ctxlog := r.ctxlog.WithValues("vm", vm)

	vmwarecreds, err := utils.GetVMwareCredsNameFromMigrationPlan(ctx, r.Client, migrationplan)
	if err != nil {
		return nil, errors.Wrap(err, "failed to get vmware credentials")
	}
	vmk8sname, err := commonutils.GetK8sCompatibleVMWareObjectName(vm, vmwarecreds)
	if err != nil {
		return nil, errors.Wrap(err, "failed to get vm name")
	}
	vminfo := &vmMachine.Spec.VMInfo

	// Get network overrides for this VM from the migration plan
	networkOverrides := ""
	if migrationplan.Spec.NetworkOverridesPerVM != nil {
		if overrides, ok := migrationplan.Spec.NetworkOverridesPerVM[vm]; ok && len(overrides) > 0 {
			overridesJSON, err := json.Marshal(overrides)
			if err != nil {
				return nil, errors.Wrapf(err, "failed to marshal network overrides for VM %s", vm)
			}
			networkOverrides = string(overridesJSON)
		}
	}

	migrationobj := &vjailbreakv1alpha1.Migration{}
	err = r.Get(ctx, types.NamespacedName{Name: utils.MigrationNameFromVMName(vmk8sname), Namespace: migrationplan.Namespace}, migrationobj)
	if err != nil && apierrors.IsNotFound(err) {
		migrationobj = &vjailbreakv1alpha1.Migration{
			ObjectMeta: metav1.ObjectMeta{
				Name:      utils.MigrationNameFromVMName(vmk8sname),
				Namespace: migrationplan.Namespace,
				Labels: map[string]string{
					"migrationplan":               migrationplan.Name,
					constants.NumberOfDisksLabel:  strconv.Itoa(len(vminfo.Disks)),
					constants.MigrationVMKeyLabel: commonutils.SanitizeLabelValue(vm),
				},
				Annotations: map[string]string{
					constants.OriginalVMNameAnnotation: vm,
				},
			},
			Spec: vjailbreakv1alpha1.MigrationSpec{
				MigrationPlan: migrationplan.Name,
				VMName:        vmMachine.Spec.VMInfo.Name,
				// PodRef will be set in the migration controller
				InitiateCutover:         migrationplan.Spec.MigrationStrategy.AdminInitiatedCutOver,
				DisconnectSourceNetwork: migrationplan.Spec.MigrationStrategy.DisconnectSourceNetwork,
				NetworkOverrides:        networkOverrides,
				MigrationType:           migrationplan.Spec.MigrationStrategy.Type,
				PreserveSourceTags:      migrationplan.Spec.PreserveSourceTags,
				DataOnly:                migrationplan.Spec.MigrationStrategy.DataOnly,
			},
			Status: vjailbreakv1alpha1.MigrationStatus{
				Phase:      vjailbreakv1alpha1.VMMigrationPhasePending,
				TotalDisks: len(vminfo.Disks),
			},
		}
		migrationobj.Labels = MergeLabels(migrationobj.Labels, migrationplan.Labels)
		err = r.createResource(ctx, migrationplan, migrationobj)
		if err != nil {
			return nil, errors.Wrapf(err, "failed to create Migration for VM %s", vm)
		}

		// Set retryable status based on whether VM has RDM disks
		// VMs with RDM disks cannot be retried through UI because shared RDM disk state
		// prevents automatic retry (RDMDisk CR may be in Error or Managed state)
		hasRDMDisks := len(vmMachine.Spec.VMInfo.RDMDisks) > 0
		retryable := !hasRDMDisks

		err = retry.RetryOnConflict(retry.DefaultRetry, func() error {
			latest := &vjailbreakv1alpha1.Migration{}
			if getErr := r.Get(ctx, types.NamespacedName{Name: migrationobj.Name, Namespace: migrationobj.Namespace}, latest); getErr != nil {
				return getErr
			}
			latest.Status.Phase = vjailbreakv1alpha1.VMMigrationPhasePending
			latest.Status.Retryable = &retryable
			return r.Status().Update(ctx, latest)
		})
		if err != nil {
			ctxlog.Error(err, "Failed to set retryable status", "retryable", retryable, "hasRDMDisks", hasRDMDisks)
			// Don't fail migration creation if status update fails, just log the error
		} else {
			ctxlog.Info("Set migration retryable status", "retryable", retryable, "hasRDMDisks", hasRDMDisks)
		}
	} else if err == nil {
		// Migration already exists — update NetworkOverrides from the MigrationPlan
		// in case the user changed them before retrying.
		err = retry.RetryOnConflict(retry.DefaultRetry, func() error {
			latest := &vjailbreakv1alpha1.Migration{}
			if getErr := r.Get(ctx, types.NamespacedName{Name: migrationobj.Name, Namespace: migrationobj.Namespace}, latest); getErr != nil {
				return getErr
			}
			latest.Spec.NetworkOverrides = networkOverrides
			latest.Spec.PreserveSourceTags = migrationplan.Spec.PreserveSourceTags
			latest.Spec.DataOnly = migrationplan.Spec.MigrationStrategy.DataOnly
			if updateErr := r.Update(ctx, latest); updateErr != nil {
				return updateErr
			}
			migrationobj = latest
			return nil
		})
		if err != nil {
			return nil, errors.Wrapf(err, "failed to update Migration spec for VM %s", vm)
		}
		ctxlog.Info("Updated migration spec from MigrationPlan", "networkOverrides", networkOverrides, "preserveSourceTags", migrationplan.Spec.PreserveSourceTags)
	}
	return migrationobj, nil
}

// CreateJob creates a job to run v2v-helper
func (r *MigrationPlanReconciler) CreateJob(ctx context.Context,
	migrationplan *vjailbreakv1alpha1.MigrationPlan,
	migrationobj *vjailbreakv1alpha1.Migration,
	vm string,
	firstbootconfigMapName string,
	vmwareSecretRef string,
	openstackSecretRef string,
	arrayCredsSecretRef string,
) error {
	vmwarecreds, err := utils.GetVMwareCredsNameFromMigrationPlan(ctx, r.Client, migrationplan)
	if err != nil {
		return errors.Wrap(err, "failed to get vmware credentials")
	}
	vmk8sname, err := commonutils.GetK8sCompatibleVMWareObjectName(vm, vmwarecreds)
	if err != nil {
		return errors.Wrap(err, "failed to get vm name")
	}
	jobName, err := utils.GetJobNameForVMName(vm, vmwarecreds)
	if err != nil {
		return errors.Wrap(err, "failed to get job name")
	}
	pointtrue := true
	cutoverlabel := "yes"
	if migrationplan.Spec.MigrationStrategy.AdminInitiatedCutOver {
		cutoverlabel = "no"
	}
	envVars := []corev1.EnvVar{
		{
			Name: "POD_NAME",
			ValueFrom: &corev1.EnvVarSource{
				FieldRef: &corev1.ObjectFieldSelector{
					FieldPath: "metadata.name",
				},
			},
		},
		{
			Name:  "VMWARE_MACHINE_OBJECT_NAME",
			Value: vmk8sname,
		},
	}

	// Get vjailbreak settings for pod resource configuration
	vjailbreakSettings, err := k8sutils.GetVjailbreakSettings(ctx, r.Client)
	if err != nil {
		return errors.Wrap(err, "failed to get vjailbreak settings for pod resources")
	}

	job := &batchv1.Job{}
	err = r.Get(ctx, types.NamespacedName{Name: jobName, Namespace: migrationplan.Namespace}, job)
	if err != nil && apierrors.IsNotFound(err) {
		r.ctxlog.Info(fmt.Sprintf("Creating new Job '%s' for VM '%s'", jobName, vm))
		job = &batchv1.Job{
			ObjectMeta: metav1.ObjectMeta{
				Name:      jobName,
				Namespace: migrationplan.Namespace,
			},
			Spec: batchv1.JobSpec{
				PodFailurePolicy: &batchv1.PodFailurePolicy{
					Rules: []batchv1.PodFailurePolicyRule{
						{
							Action: batchv1.PodFailurePolicyActionFailJob,
							OnExitCodes: &batchv1.PodFailurePolicyOnExitCodesRequirement{
								Values:   []int32{0},
								Operator: batchv1.PodFailurePolicyOnExitCodesOpNotIn,
							},
						},
					},
				},
				TTLSecondsAfterFinished: nil,
				Template: corev1.PodTemplateSpec{
					ObjectMeta: metav1.ObjectMeta{
						Labels: map[string]string{
							constants.VMNameLabel: vmk8sname,
							"startCutover":        cutoverlabel,
						},
					},
					Spec: corev1.PodSpec{
						RestartPolicy:                 corev1.RestartPolicyNever,
						ServiceAccountName:            "migration-controller-manager",
						TerminationGracePeriodSeconds: ptr.To(constants.TerminationPeriod),
						HostNetwork:                   true,
						DNSPolicy:                     corev1.DNSClusterFirstWithHostNet,
						DNSConfig: &corev1.PodDNSConfig{
							Options: []corev1.PodDNSConfigOption{
								{
									Name:  "ndots",
									Value: ptr.To("1"),
								},
							},
						},
						Containers: []corev1.Container{
							{
								Name:            "fedora",
								Image:           v2vimage,
								ImagePullPolicy: corev1.PullIfNotPresent,
								Command:         []string{"/home/fedora/manager"},
								SecurityContext: &corev1.SecurityContext{
									Privileged: &pointtrue,
								},
								Env: envVars,
								EnvFrom: func() []corev1.EnvFromSource {
									envFrom := []corev1.EnvFromSource{
										{
											SecretRef: &corev1.SecretEnvSource{
												LocalObjectReference: corev1.LocalObjectReference{
													Name: vmwareSecretRef,
												},
											},
										},
										{
											SecretRef: &corev1.SecretEnvSource{
												LocalObjectReference: corev1.LocalObjectReference{
													Name: openstackSecretRef,
												},
											},
										},
									}
									if arrayCredsSecretRef != "" {
										envFrom = append(envFrom, corev1.EnvFromSource{
											SecretRef: &corev1.SecretEnvSource{
												LocalObjectReference: corev1.LocalObjectReference{
													Name: arrayCredsSecretRef,
												},
											},
										})
									}
									envFrom = append(envFrom, corev1.EnvFromSource{
										ConfigMapRef: &corev1.ConfigMapEnvSource{
											LocalObjectReference: corev1.LocalObjectReference{
												Name: "pf9-env",
											},
										},
									})
									return envFrom
								}(),
								VolumeMounts: []corev1.VolumeMount{
									{
										Name:      "vddk",
										MountPath: "/home/fedora/vmware-vix-disklib-distrib",
									},
									{
										Name:      "dev",
										MountPath: "/dev",
									},
									{
										Name:      "firstboot",
										MountPath: "/home/fedora/scripts",
									},
									{
										Name:      "logs",
										MountPath: "/var/log/pf9",
									},
									{
										Name:      "virtio-driver",
										MountPath: "/home/fedora/virtio-win",
									},
									{
										Name:      "ssh-key",
										MountPath: "/home/fedora/.ssh",
										ReadOnly:  true,
									},
								},
								Resources: corev1.ResourceRequirements{
									Requests: corev1.ResourceList{
										corev1.ResourceCPU:              resource.MustParse(vjailbreakSettings.V2VHelperPodCPURequest),
										corev1.ResourceMemory:           resource.MustParse(vjailbreakSettings.V2VHelperPodMemoryRequest),
										corev1.ResourceEphemeralStorage: resource.MustParse(vjailbreakSettings.V2VHelperPodEphemeralStorageRequest),
									},
									Limits: corev1.ResourceList{
										corev1.ResourceCPU:              resource.MustParse(vjailbreakSettings.V2VHelperPodCPULimit),
										corev1.ResourceMemory:           resource.MustParse(vjailbreakSettings.V2VHelperPodMemoryLimit),
										corev1.ResourceEphemeralStorage: resource.MustParse(vjailbreakSettings.V2VHelperPodEphemeralStorageLimit),
									},
								},
							},
						},
						Volumes: []corev1.Volume{
							{
								Name: "vddk",
								VolumeSource: corev1.VolumeSource{
									HostPath: &corev1.HostPathVolumeSource{
										Path: "/home/ubuntu/vmware-vix-disklib-distrib",
										Type: utils.NewHostPathType("Directory"),
									},
								},
							},
							{
								Name: "dev",
								VolumeSource: corev1.VolumeSource{
									HostPath: &corev1.HostPathVolumeSource{
										Path: "/dev",
										Type: utils.NewHostPathType("Directory"),
									},
								},
							},
							{
								Name: "firstboot",
								VolumeSource: corev1.VolumeSource{
									ConfigMap: &corev1.ConfigMapVolumeSource{
										LocalObjectReference: corev1.LocalObjectReference{
											Name: firstbootconfigMapName,
										},
									},
								},
							},
							{
								Name: "logs",
								VolumeSource: corev1.VolumeSource{
									HostPath: &corev1.HostPathVolumeSource{
										Path: "/var/log/pf9",
										Type: utils.NewHostPathType("DirectoryOrCreate"),
									},
								},
							},
							{
								Name: "virtio-driver",
								VolumeSource: corev1.VolumeSource{
									HostPath: &corev1.HostPathVolumeSource{
										Path: "/home/ubuntu/virtio-win",
										Type: utils.NewHostPathType("DirectoryOrCreate"),
									},
								},
							},
							{
								Name: "ssh-key",
								VolumeSource: corev1.VolumeSource{
									HostPath: &corev1.HostPathVolumeSource{
										Path: "/home/ubuntu/.ssh",
										Type: utils.NewHostPathType("DirectoryOrCreate"),
									},
								},
							},
						},
					},
				},
			},
		}
		if err := r.createResource(ctx, migrationobj, job); err != nil {
			r.ctxlog.Error(err, fmt.Sprintf("Failed to create Job '%s'", jobName))
			return errors.Wrap(err, fmt.Sprintf("failed to create job '%s'", jobName))
		}
	}
	return nil
}

// CreateFirstbootConfigMap creates a firstboot config map for migration
func (r *MigrationPlanReconciler) CreateFirstbootConfigMap(ctx context.Context,
	migrationplan *vjailbreakv1alpha1.MigrationPlan, migrationobj *vjailbreakv1alpha1.Migration, vm string,
) (*corev1.ConfigMap, error) {
	vmwarecreds, err := utils.GetVMwareCredsNameFromMigrationPlan(ctx, r.Client, migrationplan)
	if err != nil {
		return nil, errors.Wrap(err, "failed to get vmware credentials")
	}
	vmname, err := commonutils.GetK8sCompatibleVMWareObjectName(vm, vmwarecreds)
	if err != nil {
		return nil, errors.Wrap(err, "failed to get vm name")
	}
	configMapName := utils.GetFirstbootConfigMapName(vmname)
	configMap := &corev1.ConfigMap{}
	err = r.Get(ctx, types.NamespacedName{Name: configMapName, Namespace: migrationplan.Namespace}, configMap)
	if err != nil && apierrors.IsNotFound(err) {
		r.ctxlog.Info(fmt.Sprintf("Creating new ConfigMap '%s' for VM '%s'", configMapName, vmname))
		configMap = &corev1.ConfigMap{
			ObjectMeta: metav1.ObjectMeta{
				Name:      configMapName,
				Namespace: migrationplan.Namespace,
			},
			Data: map[string]string{
				"user_firstboot.sh": migrationplan.Spec.FirstBootScript,
			},
		}
		err = r.createResource(ctx, migrationobj, configMap)
		if err != nil {
			r.ctxlog.Error(err, fmt.Sprintf("Failed to create ConfigMap '%s'", configMapName))
			return nil, errors.Wrapf(err, "failed to create config map '%s'", configMapName)
		}
	}
	return configMap, nil
}

// CreateMigrationConfigMap creates a config map for migration
func (r *MigrationPlanReconciler) CreateMigrationConfigMap(ctx context.Context,
	migrationplan *vjailbreakv1alpha1.MigrationPlan,
	migrationtemplate *vjailbreakv1alpha1.MigrationTemplate,
	migrationobj *vjailbreakv1alpha1.Migration,
	openstackcreds *vjailbreakv1alpha1.OpenstackCreds,
	vmwcreds *vjailbreakv1alpha1.VMwareCreds, vm string, vmMachine *vjailbreakv1alpha1.VMwareMachine,
	arraycreds *vjailbreakv1alpha1.ArrayCreds,
	proxyVM *vjailbreakv1alpha1.ProxyVM,
	resolvedFlavors map[string]string,
) (*corev1.ConfigMap, error) {
	vmname, err := commonutils.GetK8sCompatibleVMWareObjectName(vm, vmwcreds.Name)
	if err != nil {
		return nil, errors.Wrap(err, "failed to get vm name")
	}
	configMapName := utils.GetMigrationConfigMapName(vmname)

	configMap := &corev1.ConfigMap{}
	err = r.Get(ctx, types.NamespacedName{Name: configMapName, Namespace: migrationplan.Namespace}, configMap)
	if err != nil && apierrors.IsNotFound(err) {
		configMap, err = r.buildNewMigrationConfigMap(ctx, migrationplan, migrationtemplate, migrationobj, openstackcreds, vmwcreds, vm, vmname, configMapName, vmMachine, arraycreds, proxyVM, resolvedFlavors)
		if err != nil {
			return nil, err
		}
	} else if err == nil {
		if err = r.updateMigrationConfigMap(ctx, configMap, migrationplan, migrationobj, vmMachine, configMapName); err != nil {
			return nil, err
		}
	}
	return configMap, nil
}

func (r *MigrationPlanReconciler) buildNewMigrationConfigMap(ctx context.Context,
	migrationplan *vjailbreakv1alpha1.MigrationPlan,
	migrationtemplate *vjailbreakv1alpha1.MigrationTemplate,
	migrationobj *vjailbreakv1alpha1.Migration,
	openstackcreds *vjailbreakv1alpha1.OpenstackCreds,
	vmwcreds *vjailbreakv1alpha1.VMwareCreds,
	vm, vmname, configMapName string,
	vmMachine *vjailbreakv1alpha1.VMwareMachine,
	arraycreds *vjailbreakv1alpha1.ArrayCreds,
	proxyVM *vjailbreakv1alpha1.ProxyVM,
	resolvedFlavors map[string]string,
) (*corev1.ConfigMap, error) {
	r.ctxlog.Info(fmt.Sprintf("Creating new ConfigMap '%s' for VM '%s'", configMapName, vmname))

	virtiodrivers := resolveVirtioDriverURL(migrationtemplate)

	openstacknws, openstackvolumetypes, err := r.reconcileMapping(ctx, migrationtemplate, openstackcreds, vmwcreds, vm)
	if err != nil {
		return nil, errors.Wrap(err, "failed to reconcile mapping")
	}

	openstackports, err := r.processAdvancedOptions(ctx, migrationplan, openstackcreds, &openstacknws, &openstackvolumetypes)
	if err != nil {
		return nil, err
	}

	sourceVMKey := computeSourceVMKey(vmMachine, migrationplan.Spec.VirtualMachines)
	configMapData := r.buildBaseConfigMapData(migrationplan, migrationobj, vmMachine, sourceVMKey, virtiodrivers, openstacknws, openstackports, openstackvolumetypes)

	vjailbreakSettings, err := k8sutils.GetVjailbreakSettings(ctx, r.Client)
	if err != nil {
		r.ctxlog.Error(err, "Failed to get vjailbreak settings for HTTP timeout, using default")
		configMapData[constants.HTTPTimeoutSecondsKey] = strconv.Itoa(constants.HTTPTimeoutSeconds)
	} else {
		configMapData[constants.HTTPTimeoutSecondsKey] = strconv.Itoa(vjailbreakSettings.HTTPTimeoutSeconds)
	}

	if utils.IsOpenstackPCD(*openstackcreds) {
		configMapData["TARGET_AVAILABILITY_ZONE"] = migrationtemplate.Spec.TargetPCDClusterName
	}

	r.setMigrationSpecificFields(configMapData, migrationobj)

	if err := r.determineAndSetTargetFlavor(ctx, configMapData, vmMachine, migrationtemplate, openstackcreds, resolvedFlavors); err != nil {
		return nil, err
	}

	if err := r.setMigrationEnv(configMapData, vmMachine, migrationtemplate, arraycreds, proxyVM); err != nil {
		return nil, err
	}

	if err := r.setImageMetadataFromProfiles(ctx, configMapData, migrationplan, migrationobj, vmMachine, migrationtemplate); err != nil {
		return nil, err
	}

	if err := setTagsAndCustomMetadata(configMapData, migrationplan, migrationobj, vmMachine); err != nil {
		return nil, err
	}

	configMap := &corev1.ConfigMap{
		ObjectMeta: metav1.ObjectMeta{
			Name:      configMapName,
			Namespace: migrationplan.Namespace,
		},
		Data: configMapData,
	}

	err = r.createResource(ctx, migrationobj, configMap)
	if err != nil {
		r.ctxlog.Error(err, fmt.Sprintf("Failed to create ConfigMap '%s'", configMapName))
		return nil, errors.Wrapf(err, "failed to create config map '%s'", configMapName)
	}

	return configMap, nil
}

func resolveVirtioDriverURL(migrationtemplate *vjailbreakv1alpha1.MigrationTemplate) string {
	if migrationtemplate.Spec.VirtioWinDriver == "" {
		return "https://fedorapeople.org/groups/virt/virtio-win/direct-downloads/stable-virtio/virtio-win.iso"
	}
	return migrationtemplate.Spec.VirtioWinDriver
}

func (r *MigrationPlanReconciler) processAdvancedOptions(ctx context.Context,
	migrationplan *vjailbreakv1alpha1.MigrationPlan,
	openstackcreds *vjailbreakv1alpha1.OpenstackCreds,
	openstacknws *[]string,
	openstackvolumetypes *[]string,
) ([]string, error) {
	openstackports := []string{}

	if reflect.DeepEqual(migrationplan.Spec.AdvancedOptions, vjailbreakv1alpha1.AdvancedOptions{}) {
		return openstackports, nil
	}

	if len(migrationplan.Spec.AdvancedOptions.GranularNetworks) > 0 {
		if err := utils.VerifyNetworks(ctx, r.Client, openstackcreds, migrationplan.Spec.AdvancedOptions.GranularNetworks); err != nil {
			return nil, errors.Wrap(err, "failed to verify networks in advanced mapping")
		}
		*openstacknws = migrationplan.Spec.AdvancedOptions.GranularNetworks
	}

	if len(migrationplan.Spec.AdvancedOptions.GranularVolumeTypes) > 0 {
		if err := utils.VerifyStorage(ctx, r.Client, openstackcreds, migrationplan.Spec.AdvancedOptions.GranularVolumeTypes); err != nil {
			return nil, errors.Wrap(err, "failed to verify volume types in advanced mapping")
		}
		*openstackvolumetypes = migrationplan.Spec.AdvancedOptions.GranularVolumeTypes
	}

	if len(migrationplan.Spec.AdvancedOptions.GranularPorts) > 0 {
		if err := utils.VerifyPorts(ctx, r.Client, openstackcreds, migrationplan.Spec.AdvancedOptions.GranularPorts); err != nil {
			return nil, errors.Wrap(err, "failed to verify ports in advanced mapping")
		}
		openstackports = migrationplan.Spec.AdvancedOptions.GranularPorts
	}

	return openstackports, nil
}

// computeSourceVMKey returns the name to use for OpenStack resource naming.
// If another VM in the plan shares the same display name, the MOID suffix is appended
// to disambiguate (e.g. "vmname-31090")
func computeSourceVMKey(vmMachine *vjailbreakv1alpha1.VMwareMachine, allGroups [][]string) string {
	displayName := vmMachine.Spec.VMInfo.Name
	currentKey := commonutils.GetVMUniqueKey(displayName, vmMachine.Spec.VMInfo.VMID)
	for _, group := range allGroups {
		for _, vmKey := range group {
			if vmKey == currentKey {
				continue
			}
			if vmKeyDisplayName(vmKey) == displayName {
				return currentKey
			}
		}
	}
	return displayName
}

// vmKeyDisplayName extracts the display name from a vmKey of the form "name-<moid>".
// The moid suffix is purely numeric, so we strip the last "-<digits>" segment.
func vmKeyDisplayName(vmKey string) string {
	idx := strings.LastIndex(vmKey, "-")
	if idx == -1 {
		return vmKey
	}
	suffix := vmKey[idx+1:]
	for _, c := range suffix {
		if c < '0' || c > '9' {
			return vmKey
		}
	}
	return vmKey[:idx]
}

func (r *MigrationPlanReconciler) buildBaseConfigMapData(
	migrationplan *vjailbreakv1alpha1.MigrationPlan,
	migrationobj *vjailbreakv1alpha1.Migration,
	vmMachine *vjailbreakv1alpha1.VMwareMachine,
	sourceVMKey string,
	virtiodrivers string,
	openstacknws, openstackports, openstackvolumetypes []string,
) map[string]string {
	removeVMwareTools := true
	if migrationplan.Spec.AdvancedOptions.RemoveVMwareTools != nil {
		removeVMwareTools = *migrationplan.Spec.AdvancedOptions.RemoveVMwareTools
	}
	return map[string]string{
		"SOURCE_VM_NAME":                    vmMachine.Spec.VMInfo.Name,
		"SOURCE_VM_ID":                      vmMachine.Spec.VMInfo.VMID,
		"SOURCE_VM_KEY":                     sourceVMKey,
		"CONVERT":                           "true",
		"TYPE":                              migrationplan.Spec.MigrationStrategy.Type,
		"DATACOPYSTART":                     migrationplan.Spec.MigrationStrategy.DataCopyStart.Format(time.RFC3339),
		"CUTOVERSTART":                      migrationplan.Spec.MigrationStrategy.VMCutoverStart.Format(time.RFC3339),
		"CUTOVEREND":                        migrationplan.Spec.MigrationStrategy.VMCutoverEnd.Format(time.RFC3339),
		"NEUTRON_NETWORK_NAMES":             strings.Join(openstacknws, ","),
		"NEUTRON_PORT_IDS":                  strings.Join(openstackports, ","),
		"CINDER_VOLUME_TYPES":               strings.Join(openstackvolumetypes, ","),
		"VIRTIO_WIN_DRIVER":                 virtiodrivers,
		"PERFORM_HEALTH_CHECKS":             strconv.FormatBool(migrationplan.Spec.MigrationStrategy.PerformHealthChecks),
		"HEALTH_CHECK_PORT":                 migrationplan.Spec.MigrationStrategy.HealthCheckPort,
		"VMWARE_MACHINE_OBJECT_NAME":        vmMachine.Name,
		"SECURITY_GROUPS":                   strings.Join(migrationplan.Spec.SecurityGroups, ","),
		"SERVER_GROUP":                      migrationplan.Spec.ServerGroup,
		"RDM_DISK_NAMES":                    strings.Join(vmMachine.Spec.VMInfo.RDMDisks, ","),
		"FALLBACK_TO_DHCP":                  strconv.FormatBool(migrationplan.Spec.FallbackToDHCP),
		"PERIODIC_SYNC_INTERVAL":            migrationplan.Spec.AdvancedOptions.PeriodicSyncInterval,
		"PERIODIC_SYNC_ENABLED":             strconv.FormatBool(migrationplan.Spec.AdvancedOptions.PeriodicSyncEnabled),
		"NETWORK_PERSISTENCE":               strconv.FormatBool(migrationplan.Spec.AdvancedOptions.NetworkPersistence),
		"REMOVE_VMWARE_TOOLS":               strconv.FormatBool(removeVMwareTools),
		"ACKNOWLEDGE_NETWORK_CONFLICT_RISK": strconv.FormatBool(migrationplan.Spec.AdvancedOptions.AcknowledgeNetworkConflictRisk),
		"DISCONNECT_SOURCE_NETWORK":         strconv.FormatBool(migrationobj.Spec.DisconnectSourceNetwork),
	}
}

func (r *MigrationPlanReconciler) setMigrationSpecificFields(configMapData map[string]string, migrationobj *vjailbreakv1alpha1.Migration) {
	if migrationobj.Spec.NetworkOverrides != "" {
		configMapData["NETWORK_OVERRIDES"] = migrationobj.Spec.NetworkOverrides
	}
	configMapData["DATA_ONLY"] = strconv.FormatBool(migrationobj.Spec.DataOnly)
}

// fetchVMsToValidate fetches each VM in vmsToValidate once, so
// validateMigrationPlanVMs can reuse the result instead of fetching again. It
// also reports whether any VM lacks a pinned TargetFlavorID (or couldn't be
// fetched — a safe default; the real fetch error surfaces when
// validateMigrationPlanVMs re-fetches that one VM itself).
func (r *MigrationPlanReconciler) fetchVMsToValidate(
	ctx context.Context,
	migrationtemplate *vjailbreakv1alpha1.MigrationTemplate,
	vmwcreds *vjailbreakv1alpha1.VMwareCreds,
	vmsToValidate []string,
) (map[string]*vjailbreakv1alpha1.VMwareMachine, bool) {
	fetched := make(map[string]*vjailbreakv1alpha1.VMwareMachine, len(vmsToValidate))
	needsLookup := false
	for _, vm := range vmsToValidate {
		vmMachine, err := GetVMwareMachineForVM(ctx, r, vm, migrationtemplate, vmwcreds)
		if err != nil {
			needsLookup = true
			continue
		}
		fetched[vm] = vmMachine
		if vmMachine.Spec.TargetFlavorID == "" {
			needsLookup = true
		}
	}
	return fetched, needsLookup
}

// candidateFlavorsForPlan returns the plan's eligible flavors, filtered to its
// target availability zone. Called once per plan and reused across VMs.
//
// In PCD, a flavor's `availability_zone` extra_spec binds it to one cluster;
// flavors without it are global.
func (r *MigrationPlanReconciler) candidateFlavorsForPlan(ctx context.Context,
	migrationtemplate *vjailbreakv1alpha1.MigrationTemplate,
	openstackcreds *vjailbreakv1alpha1.OpenstackCreds,
) ([]flavors.Flavor, error) {
	allFlavors, err := utils.ListAllFlavors(ctx, r.Client, openstackcreds)
	if err != nil {
		return nil, errors.Wrap(err, "failed to list all flavors")
	}

	if utils.IsOpenstackPCD(*openstackcreds) {
		allFlavors = openstackpkg.FilterFlavorsByAvailabilityZone(allFlavors, migrationtemplate.Spec.TargetPCDClusterName)
	}

	return allFlavors, nil
}

// resolveTargetFlavorID picks the target flavor for a single VM out of an
// already-fetched candidate set. It is pure (no API calls) so that pre-flight
// validation and the config-map build path share one implementation and cannot
// drift apart on the GPU/AZ filtering rules.
//
// A shape that no candidate satisfies is returned as ErrNoSuitableFlavor, which
// callers classify with errors.Is to decide skip-vs-fail.
func resolveTargetFlavorID(
	vmMachine *vjailbreakv1alpha1.VMwareMachine,
	migrationtemplate *vjailbreakv1alpha1.MigrationTemplate,
	openstackcreds *vjailbreakv1alpha1.OpenstackCreds,
	candidateFlavors []flavors.Flavor,
) (string, error) {
	// Explicit operator override always wins and is never second-guessed.
	if vmMachine.Spec.TargetFlavorID != "" {
		return vmMachine.Spec.TargetFlavorID, nil
	}

	useGPUFlavor := migrationtemplate.Spec.UseGPUFlavor && utils.IsOpenstackPCD(*openstackcreds)
	passthroughGPUCount := vmMachine.Spec.VMInfo.GPU.PassthroughCount
	vgpuCount := vmMachine.Spec.VMInfo.GPU.VGPUCount

	flavor, err := openstackpkg.GetClosestFlavour(
		vmMachine.Spec.VMInfo.CPU,
		vmMachine.Spec.VMInfo.Memory,
		passthroughGPUCount,
		vgpuCount,
		candidateFlavors,
		useGPUFlavor,
	)
	if err != nil {
		return "", err
	}

	if flavor == nil {
		// Defensive: GetClosestFlavour returns a non-nil error in this case today,
		// but keep the sentinel wrapped so a future change cannot turn a nil flavor
		// into a hard plan failure.
		gpuInfo := " without GPU"
		if passthroughGPUCount > 0 || vgpuCount > 0 {
			gpuInfo = fmt.Sprintf(", %d passthrough GPU(s), and %d vGPU(s)", passthroughGPUCount, vgpuCount)
		}
		return "", fmt.Errorf("%w for %d vCPUs, %d MB RAM%s",
			openstackpkg.ErrNoSuitableFlavor, vmMachine.Spec.VMInfo.CPU, vmMachine.Spec.VMInfo.Memory, gpuInfo)
	}

	return flavor.ID, nil
}

// isNoSuitableFlavorErr reports whether err was ultimately caused by a VM shape
// that no target flavor can satisfy. Used to keep that one condition
// non-blocking while every other failure still aborts and requeues.
func isNoSuitableFlavorErr(err error) bool {
	return errors.Is(err, openstackpkg.ErrNoSuitableFlavor)
}

// shouldSkipVMForFlavor reports whether the trigger loop must skip a VM because
// pre-flight validation did not resolve a target flavor for it.
func shouldSkipVMForFlavor(vmMachine *vjailbreakv1alpha1.VMwareMachine, resolvedFlavors map[string]string) bool {
	if vmMachine.Spec.TargetFlavorID != "" {
		return false
	}
	flavorID, ok := resolvedFlavors[vmMachine.Name]
	return !ok || flavorID == ""
}

func (r *MigrationPlanReconciler) determineAndSetTargetFlavor(ctx context.Context,
	configMapData map[string]string,
	vmMachine *vjailbreakv1alpha1.VMwareMachine,
	migrationtemplate *vjailbreakv1alpha1.MigrationTemplate,
	openstackcreds *vjailbreakv1alpha1.OpenstackCreds,
	resolvedFlavors map[string]string,
) error {
	flavorID, err := r.targetFlavorForVM(ctx, vmMachine, migrationtemplate, openstackcreds, resolvedFlavors)
	if err != nil {
		return err
	}

	configMapData[constants.TargetFlavorIDKey] = flavorID
	return nil
}

// targetFlavorForVM returns the flavor ID to migrate a VM onto, preferring an
// operator override, then the ID pre-flight validation already resolved, and only
// then falling back to querying Nova.
func (r *MigrationPlanReconciler) targetFlavorForVM(ctx context.Context,
	vmMachine *vjailbreakv1alpha1.VMwareMachine,
	migrationtemplate *vjailbreakv1alpha1.MigrationTemplate,
	openstackcreds *vjailbreakv1alpha1.OpenstackCreds,
	resolvedFlavors map[string]string,
) (string, error) {
	if vmMachine.Spec.TargetFlavorID != "" {
		return vmMachine.Spec.TargetFlavorID, nil
	}

	// Fast path: pre-flight validation already resolved this VM, so no Nova call.
	if flavorID, ok := resolvedFlavors[vmMachine.Name]; ok && flavorID != "" {
		return flavorID, nil
	}

	// Slow path: no cached entry — e.g. a ConfigMap being rebuilt for a plan that
	// was validated by an older controller version. Resolve on demand.
	candidateFlavors, err := r.candidateFlavorsForPlan(ctx, migrationtemplate, openstackcreds)
	if err != nil {
		return "", err
	}

	flavorID, err := resolveTargetFlavorID(vmMachine, migrationtemplate, openstackcreds, candidateFlavors)
	if err != nil {
		// errors.Wrapf preserves the chain, so isNoSuitableFlavorErr still matches
		// at the trigger-loop call site.
		return "", errors.Wrapf(err, "failed to determine target flavor for VM %s", vmMachine.Name)
	}

	return flavorID, nil
}

func (r *MigrationPlanReconciler) setMigrationEnv(
	configMapData map[string]string,
	vmMachine *vjailbreakv1alpha1.VMwareMachine,
	migrationtemplate *vjailbreakv1alpha1.MigrationTemplate,
	arraycreds *vjailbreakv1alpha1.ArrayCreds,
	proxyVM *vjailbreakv1alpha1.ProxyVM,
) error {
	if vmMachine.Spec.VMInfo.OSFamily == "" {
		return errors.Errorf(
			"OSFamily is not available for the VM '%s', "+
				"cannot perform the migration. Please set OSFamily explicitly in the VMwareMachine CR",
			vmMachine.Name)
	}

	configMapData["OS_FAMILY"] = vmMachine.Spec.VMInfo.OSFamily

	if migrationtemplate.Spec.OSFamily != "" {
		configMapData["OS_FAMILY"] = migrationtemplate.Spec.OSFamily
	}

	if migrationtemplate.Spec.StorageCopyMethod == StorageCopyMethod {
		configMapData["STORAGE_COPY_METHOD"] = StorageCopyMethod
		configMapData["VENDOR_TYPE"] = arraycreds.Spec.VendorType
		configMapData["ARRAY_CREDS_MAPPING"] = migrationtemplate.Spec.ArrayCredsMapping
		if arraycreds.Spec.VendorType == netappsdk.VendorName && arraycreds.Spec.NetAppConfig != nil {
			configMapData["NETAPP_SVM"] = arraycreds.Spec.NetAppConfig.SVM
			configMapData["NETAPP_FLEXVOL"] = arraycreds.Spec.NetAppConfig.FlexVol
		}
	} else if migrationtemplate.Spec.StorageCopyMethod == constants.HotAddCopyMethod && proxyVM != nil {
		configMapData["STORAGE_COPY_METHOD"] = constants.HotAddCopyMethod
		configMapData["PROXY_VM_IP"] = proxyVM.Status.IPAddress
		configMapData["PROXY_VM_NAME"] = proxyVM.Spec.VMName
		configMapData["PROXY_VM_K8S_NAME"] = proxyVM.Name
	}

	return nil
}

// setImageMetadataFromProfiles resolves the VolumeImageProfile names referenced on the MigrationPlan
func (r *MigrationPlanReconciler) setImageMetadataFromProfiles(ctx context.Context,
	configMapData map[string]string,
	migrationplan *vjailbreakv1alpha1.MigrationPlan,
	migrationobj *vjailbreakv1alpha1.Migration,
	vmMachine *vjailbreakv1alpha1.VMwareMachine,
	migrationtemplate *vjailbreakv1alpha1.MigrationTemplate,
) error {
	profileNames := migrationplan.Spec.AdvancedOptions.ImageProfiles
	if len(profileNames) == 0 {
		return nil
	}
	r.ctxlog.Info("Resolving VolumeImageProfiles for migration",
		"migration", migrationobj.Name,
		"vm", vmMachine.Name,
		"requestedProfiles", profileNames)

	// Prefer the migration template's override when set, otherwise fall back to detected OS family.
	effectiveOSFamily := strings.TrimSpace(vmMachine.Spec.VMInfo.OSFamily)
	if migrationtemplate.Spec.OSFamily != "" {
		effectiveOSFamily = strings.TrimSpace(migrationtemplate.Spec.OSFamily)
	}

	merged, err := r.resolveImageProfiles(ctx, migrationplan.Namespace, profileNames, effectiveOSFamily)
	if err != nil {
		return errors.Wrap(err, "failed to resolve image profiles")
	}
	if len(merged) == 0 {
		return nil
	}

	// Persist merged metadata on the Migration spec so the v2v-helper pod can read it directly.
	if !reflect.DeepEqual(migrationobj.Spec.ImageMetadata, merged) {
		err = retry.RetryOnConflict(retry.DefaultRetry, func() error {
			latest := &vjailbreakv1alpha1.Migration{}
			if getErr := r.Get(ctx, types.NamespacedName{Name: migrationobj.Name, Namespace: migrationobj.Namespace}, latest); getErr != nil {
				return getErr
			}
			latest.Spec.ImageMetadata = merged
			if updateErr := r.Update(ctx, latest); updateErr != nil {
				return updateErr
			}
			migrationobj.Spec.ImageMetadata = merged
			return nil
		})
		if err != nil {
			return errors.Wrapf(err, "failed to persist ImageMetadata on Migration %s", migrationobj.Name)
		}
	}

	payload, err := json.Marshal(merged)
	if err != nil {
		return errors.Wrap(err, "failed to marshal merged image metadata")
	}
	configMapData["IMAGE_METADATA"] = string(payload)
	return nil
}

// resolveImageProfiles fetches VolumeImageProfiles by name in the requested order, drops any
// that don't match the VM's OS family (profiles with osFamily "any" always apply).
func (r *MigrationPlanReconciler) resolveImageProfiles(ctx context.Context,
	namespace string,
	profileNames []string,
	osFamily string,
) (map[string]string, error) {
	merged := map[string]string{}
	contributedBy := map[string]string{}
	for _, name := range profileNames {
		name = strings.TrimSpace(name)
		if name == "" {
			continue
		}
		profile := &vjailbreakv1alpha1.VolumeImageProfile{}
		if err := r.Get(ctx, types.NamespacedName{Name: name, Namespace: namespace}, profile); err != nil {
			if apierrors.IsNotFound(err) {
				r.ctxlog.Info("Skipping VolumeImageProfile not found", "profile", name, "namespace", namespace)
				continue
			}
			return nil, errors.Wrapf(err, "failed to get VolumeImageProfile %s", name)
		}
		profileOS := profile.Spec.OSFamily
		if profileOS != "any" && profileOS != "" && profileOS != osFamily {
			r.ctxlog.Info("Skipping VolumeImageProfile; OS family does not match VM",
				"profile", profile.Name,
				"profileOSFamily", profileOS,
				"vmOSFamily", osFamily)
			continue
		}
		r.ctxlog.Info("Applying VolumeImageProfile",
			"profile", profile.Name,
			"profileOSFamily", profileOS,
			"vmOSFamily", osFamily,
			"properties", profile.Spec.Properties)
		for k, v := range profile.Spec.Properties {
			if prev, exists := merged[k]; exists && prev != v {
				r.ctxlog.Info("VolumeImageProfile key conflict; later profile wins",
					"key", k,
					"previousValue", prev,
					"previousProfile", contributedBy[k],
					"newValue", v,
					"newProfile", profile.Name)
			}
			merged[k] = v
			contributedBy[k] = profile.Name
		}
	}
	if len(merged) > 0 {
		r.ctxlog.Info("Resolved VolumeImageProfile metadata",
			"requestedProfiles", profileNames,
			"vmOSFamily", osFamily,
			"mergedMetadata", merged,
			"contributedBy", contributedBy)
	}
	return merged, nil
}

// setTagsAndCustomMetadata writes the preserve-source-tags toggle, the exact resolved
// source tag/attribute metadata, and the plan's custom metadata into the migration
// ConfigMap so the v2v-helper can apply them as instance metadata on the target VM.
func setTagsAndCustomMetadata(configMapData map[string]string,
	migrationplan *vjailbreakv1alpha1.MigrationPlan,
	migrationobj *vjailbreakv1alpha1.Migration,
	vmMachine *vjailbreakv1alpha1.VMwareMachine,
) error {
	configMapData["PRESERVE_SOURCE_TAGS"] = strconv.FormatBool(migrationobj.Spec.PreserveSourceTags)
	delete(configMapData, "SOURCE_TAGS_METADATA")
	delete(configMapData, "CUSTOM_METADATA")

	if migrationobj.Spec.PreserveSourceTags {
		sourceMetadata := utils.BuildSourceTagsMetadata(vmMachine.Spec.VMInfo.Tags, vmMachine.Spec.VMInfo.CustomAttributes)
		if len(sourceMetadata) > 0 {
			payload, err := json.Marshal(sourceMetadata)
			if err != nil {
				return errors.Wrap(err, "failed to marshal source tags metadata")
			}
			configMapData["SOURCE_TAGS_METADATA"] = string(payload)
		}
	}

	if len(migrationplan.Spec.CustomMetadata) > 0 {
		payload, err := json.Marshal(migrationplan.Spec.CustomMetadata)
		if err != nil {
			return errors.Wrap(err, "failed to marshal custom metadata")
		}
		configMapData["CUSTOM_METADATA"] = string(payload)
	}
	return nil
}

// updateMigrationConfigMap updates the mutable fields of an existing migration ConfigMap.
func (r *MigrationPlanReconciler) updateMigrationConfigMap(ctx context.Context, configMap *corev1.ConfigMap,
	migrationplan *vjailbreakv1alpha1.MigrationPlan, migrationobj *vjailbreakv1alpha1.Migration,
	vmMachine *vjailbreakv1alpha1.VMwareMachine, configMapName string,
) error {
	if migrationobj.Spec.NetworkOverrides != "" {
		configMap.Data["NETWORK_OVERRIDES"] = migrationobj.Spec.NetworkOverrides
	} else {
		delete(configMap.Data, "NETWORK_OVERRIDES")
	}
	if len(migrationobj.Spec.ImageMetadata) > 0 {
		payload, err := json.Marshal(migrationobj.Spec.ImageMetadata)
		if err != nil {
			return errors.Wrap(err, "failed to marshal image metadata")
		}
		configMap.Data["IMAGE_METADATA"] = string(payload)
	} else {
		delete(configMap.Data, "IMAGE_METADATA")
	}
	if err := setTagsAndCustomMetadata(configMap.Data, migrationplan, migrationobj, vmMachine); err != nil {
		return err
	}
	if err := r.Update(ctx, configMap); err != nil {
		r.ctxlog.Error(err, fmt.Sprintf("Failed to update ConfigMap '%s'", configMapName))
		return errors.Wrapf(err, "failed to update config map '%s'", configMapName)
	}
	return nil
}

func (r *MigrationPlanReconciler) createResource(ctx context.Context, owner metav1.Object, controlled client.Object) error {
	err := ctrl.SetControllerReference(owner, controlled, r.Scheme)
	if err != nil {
		return errors.Wrap(err, "failed to set controller reference")
	}
	err = r.Create(ctx, controlled)
	if err != nil {
		return errors.Wrap(err, "failed to create resource")
	}
	return nil
}

//nolint:dupl // Same logic to migrationtemplate reconciliation, excluding from linting to keep both reconcilers separate
func (r *MigrationPlanReconciler) checkStatusSuccess(ctx context.Context,
	namespace, credsname string,
	isvmware bool,
	credsobj client.Object,
) (bool, error) {
	client := r.Client
	err := client.Get(ctx, types.NamespacedName{Name: credsname, Namespace: namespace}, credsobj)
	if err != nil {
		return false, errors.Wrap(err, "failed to get Creds")
	}

	if isvmware {
		vmwareCreds, ok := credsobj.(*vjailbreakv1alpha1.VMwareCreds)
		if !ok {
			return false, errors.Wrap(err, "failed to convert credentials to VMwareCreds")
		}
		if vmwareCreds.Status.VMwareValidationStatus != string(corev1.PodSucceeded) {
			return false, errors.Errorf("vmwarecreds '%s' CR is not validated", vmwareCreds.Name)
		}
	} else {
		openstackCreds, ok := credsobj.(*vjailbreakv1alpha1.OpenstackCreds)
		if !ok {
			return false, errors.Wrap(err, "failed to convert credentials to OpenstackCreds")
		}
		if openstackCreds.Status.OpenStackValidationStatus != string(corev1.PodSucceeded) {
			return false, errors.Errorf("openstackcreds '%s' CR is not validated", openstackCreds.Name)
		}
	}
	return true, nil
}

func (r *MigrationPlanReconciler) reconcileMapping(ctx context.Context,
	migrationtemplate *vjailbreakv1alpha1.MigrationTemplate,
	openstackcreds *vjailbreakv1alpha1.OpenstackCreds,
	vmwcreds *vjailbreakv1alpha1.VMwareCreds,
	vm string,
) (openstacknws, openstackvolumetypes []string, err error) {
	vmMachine, err := GetVMwareMachineForVM(ctx, r, vm, migrationtemplate, vmwcreds)
	if err != nil {
		return nil, nil, errors.Wrapf(err, "failed to get VMwareMachine for VM %s", vm)
	}
	if vmMachine.Annotations == nil {
		return nil, nil, fmt.Errorf("VMwareMachine %s has no annotations, cannot find datacenter", vmMachine.Name)
	}
	datacenter, exists := vmMachine.Annotations[constants.VMwareDatacenterLabel]
	if !exists || datacenter == "" {
		return nil, nil, fmt.Errorf("VMwareMachine %s has no datacenter annotation", vmMachine.Name)
	}
	openstacknws, err = r.reconcileNetwork(ctx, migrationtemplate, openstackcreds, vmMachine.Spec.VMInfo.Networks)
	if err != nil {
		return nil, nil, errors.Wrap(err, "failed to reconcile network")
	}
	// Skip storage mapping reconciliation for StorageCopyMethod storage copy method
	// as it uses ArrayCredsMapping instead of StorageMapping
	if migrationtemplate.Spec.StorageCopyMethod != StorageCopyMethod {
		vmDatastores := getDatastoresForVolumeMapping(vmMachine)
		openstackvolumetypes, err = r.reconcileStorage(ctx, migrationtemplate, openstackcreds, vmDatastores)
		if err != nil {
			return nil, nil, errors.Wrap(err, "failed to reconcile storage")
		}
		return openstacknws, openstackvolumetypes, nil
	}
	return openstacknws, openstackvolumetypes, nil
}

// getDatastoresForVolumeMapping returns datastores in per-disk order so
// StorageMapping produces one Cinder volume type for each virtual disk.
func getDatastoresForVolumeMapping(vmMachine *vjailbreakv1alpha1.VMwareMachine) []string {
	if len(vmMachine.Spec.VMInfo.Disks) > 0 {
		vmds := make([]string, 0, len(vmMachine.Spec.VMInfo.Disks))
		for _, disk := range vmMachine.Spec.VMInfo.Disks {
			vmds = append(vmds, disk.Datastore)
		}
		if len(vmds) > 0 {
			return vmds
		}
	}

	return vmMachine.Spec.VMInfo.Datastores
}

//nolint:dupl // Similar logic to storages reconciliation, excluding from linting to keep it readable
func (r *MigrationPlanReconciler) reconcileNetwork(ctx context.Context,
	migrationtemplate *vjailbreakv1alpha1.MigrationTemplate,
	openstackcreds *vjailbreakv1alpha1.OpenstackCreds,
	vmnws []string,
) ([]string, error) {
	// If the VM has no networks attached and no NetworkMapping is configured on
	// the template, there is nothing to reconcile. This supports submitting
	// migrations for VMs with no NICs where the UI also skipped creating a
	// NetworkMapping resource.
	if len(vmnws) == 0 && migrationtemplate.Spec.NetworkMapping == "" {
		return []string{}, nil
	}

	// A NetworkMapping must exist if the VM has at least one network.
	if migrationtemplate.Spec.NetworkMapping == "" {
		return nil, errors.Errorf(
			"VM has %d network(s) but MigrationTemplate %s has no NetworkMapping configured",
			len(vmnws), migrationtemplate.Name,
		)
	}

	var err error
	// Fetch the networkmap
	networkmap := &vjailbreakv1alpha1.NetworkMapping{}
	err = r.Get(ctx, types.NamespacedName{Name: migrationtemplate.Spec.NetworkMapping, Namespace: migrationtemplate.Namespace}, networkmap)
	if err != nil {
		return nil, errors.Wrap(err, "failed to retrieve NetworkMapping CR")
	}

	openstacknws := []string{}
	// Process each VM network (including duplicates for multiple NICs)
	// Map each NIC's network to the corresponding target network
	for _, vmnw := range vmnws {
		found := false
		for _, nwm := range networkmap.Spec.Networks {
			if vmnw == nwm.Source {
				openstacknws = append(openstacknws, nwm.Target)
				found = true
				break // Use the first matching mapping
			}
		}
		if !found {
			return nil, errors.Errorf("VMware network %q not found in NetworkMapping", vmnw)
		}
	}

	// Get unique networks for validation
	uniqueTargets := make(map[string]bool)
	for _, target := range openstacknws {
		uniqueTargets[target] = true
	}
	//nolint:prealloc // Preallocating the slice is not possible as the length is unknown
	var uniqueTargetList []string
	for target := range uniqueTargets {
		uniqueTargetList = append(uniqueTargetList, target)
	}

	if networkmap.Status.NetworkmappingValidationStatus != string(corev1.PodSucceeded) {
		err = utils.VerifyNetworks(ctx, r.Client, openstackcreds, uniqueTargetList)
		if err != nil {
			return nil, errors.Wrap(err, "failed to verify networks")
		}
		networkmap.Status.NetworkmappingValidationStatus = string(corev1.PodSucceeded)
		networkmap.Status.NetworkmappingValidationMessage = "NetworkMapping validated"
		err = r.Status().Update(ctx, networkmap)
		if err != nil {
			return nil, errors.Wrap(err, "failed to update networkmapping status")
		}
	}
	return openstacknws, nil
}

//nolint:dupl // Similar logic to networks reconciliation, excluding from linting to keep it readable
func (r *MigrationPlanReconciler) reconcileStorage(ctx context.Context,
	migrationtemplate *vjailbreakv1alpha1.MigrationTemplate,
	openstackcreds *vjailbreakv1alpha1.OpenstackCreds,
	vmds []string,
) ([]string, error) {
	var err error
	// Fetch the StorageMap
	storagemap := &vjailbreakv1alpha1.StorageMapping{}
	err = r.Get(ctx, types.NamespacedName{Name: migrationtemplate.Spec.StorageMapping, Namespace: migrationtemplate.Namespace}, storagemap)
	if err != nil {
		return nil, errors.Wrap(err, "failed to retrieve StorageMapping CR")
	}

	openstackvolumetypes := []string{}
	for diskIdx, vmdatastore := range vmds {
		if vmdatastore == "" {
			return nil, errors.Errorf("VMware datastore is empty for disk index %d", diskIdx)
		}
		found := false
		for _, storagemaptype := range storagemap.Spec.Storages {
			if vmdatastore == storagemaptype.Source {
				openstackvolumetypes = append(openstackvolumetypes, storagemaptype.Target)
				found = true
				break
			}
		}
		if !found {
			return nil, errors.Errorf("VMware datastore %q not found in StorageMapping for disk index %d", vmdatastore, diskIdx)
		}
	}
	if storagemap.Status.StoragemappingValidationStatus != string(corev1.PodSucceeded) {
		err = utils.VerifyStorage(ctx, r.Client, openstackcreds, openstackvolumetypes)
		if err != nil {
			return nil, errors.Wrap(err, "failed to verify datastores")
		}
		storagemap.Status.StoragemappingValidationStatus = string(corev1.PodSucceeded)
		storagemap.Status.StoragemappingValidationMessage = "StorageMapping validated"
		err = r.Status().Update(ctx, storagemap)
		if err != nil {
			return nil, errors.Wrap(err, "failed to update storagemapping status")
		}
	}
	return openstackvolumetypes, nil
}

// TriggerMigration triggers a migration process
func (r *MigrationPlanReconciler) TriggerMigration(ctx context.Context,
	migrationplan *vjailbreakv1alpha1.MigrationPlan,
	migrationobjs *vjailbreakv1alpha1.MigrationList,
	openstackcreds *vjailbreakv1alpha1.OpenstackCreds,
	vmwcreds *vjailbreakv1alpha1.VMwareCreds,
	arraycreds *vjailbreakv1alpha1.ArrayCreds,
	migrationtemplate *vjailbreakv1alpha1.MigrationTemplate,
	parallelvms []*vjailbreakv1alpha1.VMwareMachine,
	proxyVM *vjailbreakv1alpha1.ProxyVM,
	resolvedFlavors map[string]string,
) error {
	ctxlog := r.ctxlog.WithValues("migrationplan", migrationplan.Name)
	var fbcm *corev1.ConfigMap

	vmKeyForMachine := make(map[string]string)
	for _, group := range migrationplan.Spec.VirtualMachines {
		for _, planVMKey := range group {
			k8sName, k8sErr := commonutils.GetK8sCompatibleVMWareObjectName(planVMKey, vmwcreds.Name)
			if k8sErr == nil {
				vmKeyForMachine[k8sName] = planVMKey
			}
		}
	}

	nodeList := &corev1.NodeList{}
	err := r.List(ctx, nodeList)
	if err != nil {
		return errors.Wrap(err, "failed to list nodes")
	}
	counter := len(nodeList.Items)
	for _, vmMachineObj := range parallelvms {
		if vmMachineObj == nil {
			return errors.Wrapf(err, "VM not found in VMwareMachine")
		}
		vm, ok := vmKeyForMachine[vmMachineObj.Name]
		if !ok {
			vm = vmMachineObj.Spec.VMInfo.Name
		}

		migrationobj, err := r.CreateMigration(ctx, migrationplan, vm, vmMachineObj)
		if err != nil {
			return errors.Wrapf(err, "failed to create Migration for VM %s", vm)
		}

		// Belt-and-braces: pre-flight validation resolved a flavor for every VM it
		// put in parallelvms, so a missing entry means the VM is unschedulable. Mark
		// it terminal instead of aborting the loop, and never leave it Pending —
		// a Pending Migration nobody will ever advance stops the plan from ever
		// reporting as finished.
		if shouldSkipVMForFlavor(vmMachineObj, resolvedFlavors) {
			ctxlog.Info("Marking VM as ValidationFailed: no schedulable target flavor", "vm", vm)
			r.markMigrationValidationFailed(ctx, migrationobj, vm,
				flavorSkipReason(vmMachineObj, migrationtemplate, openstackcreds))
			migrationobjs.Items = append(migrationobjs.Items, *migrationobj)
			continue
		}

		if migrationobj.Status.Phase == vjailbreakv1alpha1.VMMigrationPhaseSucceeded ||
			migrationobj.Status.Phase == vjailbreakv1alpha1.VMMigrationPhaseFailed ||
			migrationobj.Status.Phase == vjailbreakv1alpha1.VMMigrationPhaseValidationFailed ||
			migrationobj.Status.Phase == vjailbreakv1alpha1.VMMigrationPhaseDataCopied {
			ctxlog.Info("Skipping VM with terminal migration status", "vm", vm, "phase", migrationobj.Status.Phase)
			migrationobjs.Items = append(migrationobjs.Items, *migrationobj)
			continue
		}

		migrationobjs.Items = append(migrationobjs.Items, *migrationobj)

		_, err = r.CreateMigrationConfigMap(ctx, migrationplan, migrationtemplate, migrationobj, openstackcreds, vmwcreds, vm, vmMachineObj, arraycreds, proxyVM, resolvedFlavors)
		if err != nil {
			// Defence in depth. The shouldSkipVMForFlavor check above means every VM
			// reaching here has a flavor, so determineAndSetTargetFlavor takes a fast
			// path and cannot raise this. The branch exists so that removing that
			// check later degrades to skipping one VM rather than silently restoring
			// the old behaviour of aborting the loop and starving every VM behind it.
			// Every other error still aborts and requeues.
			if isNoSuitableFlavorErr(err) {
				ctxlog.Error(err, "Marking VM as ValidationFailed: no schedulable target flavor", "vm", vm)
				r.markMigrationValidationFailed(ctx, migrationobj, vm,
					flavorSkipReason(vmMachineObj, migrationtemplate, openstackcreds))
				continue
			}
			return errors.Wrapf(err, "failed to create ConfigMap for VM %s", vm)
		}
		fbcm, err = r.CreateFirstbootConfigMap(ctx, migrationplan, migrationobj, vm)
		if err != nil {
			return errors.Wrapf(err, "failed to create Firstboot ConfigMap for VM %s", vm)
		}
		// VDDK is only used by the default ("normal") CBT/NBD copy method; skip
		// the precheck for StorageAcceleratedCopy and HotAdd, which don't need it.
		if requiresVDDK(migrationtemplate.Spec.StorageCopyMethod) {
			//nolint:gocritic // err is already declared above
			if err = r.validateVDDKPresence(ctx, migrationobj, ctxlog); err != nil {
				return err
			}
		}

		arraycredsSecretRef := ""
		if arraycreds != nil {
			arraycredsSecretRef = arraycreds.Spec.SecretRef.Name
		}

		err = r.CreateJob(ctx,
			migrationplan,
			migrationobj,
			vm,
			fbcm.Name,
			vmwcreds.Spec.SecretRef.Name,
			openstackcreds.Spec.SecretRef.Name,
			arraycredsSecretRef)
		if err != nil {
			return errors.Wrap(err, fmt.Sprintf("failed to create Job for VM %s", vm))
		}
		counter--

		if counter == 0 {
			// Control the number of VMs in parallel
			counter = len(nodeList.Items)
			time.Sleep(constants.MigrationTriggerDelay)
		}
	}

	return nil
}

// SetupWithManager sets up the controller with the Manager.
func (r *MigrationPlanReconciler) SetupWithManager(mgr ctrl.Manager) error {
	return ctrl.NewControllerManagedBy(mgr).
		For(&vjailbreakv1alpha1.MigrationPlan{}).
		Owns(&vjailbreakv1alpha1.Migration{}, builder.WithPredicates(
			predicate.Funcs{
				// Only reconcile on Migration create, delete of non-terminal migrations, or when phase changes to terminal state
				UpdateFunc: func(e event.UpdateEvent) bool {
					oldMigration, oldOk := e.ObjectOld.(*vjailbreakv1alpha1.Migration)
					newMigration, newOk := e.ObjectNew.(*vjailbreakv1alpha1.Migration)

					if !oldOk || !newOk {
						return false
					}

					// Reconcile if phase changed to a terminal state
					isTerminal := newMigration.Status.Phase == vjailbreakv1alpha1.VMMigrationPhaseSucceeded ||
						newMigration.Status.Phase == vjailbreakv1alpha1.VMMigrationPhaseFailed ||
						newMigration.Status.Phase == vjailbreakv1alpha1.VMMigrationPhaseValidationFailed ||
						newMigration.Status.Phase == vjailbreakv1alpha1.VMMigrationPhaseDataCopied

					// Reconcile if phase changed to AwaitingAdminCutOver (so UI can show cutover status)
					isAwaitingCutover := newMigration.Status.Phase == vjailbreakv1alpha1.VMMigrationPhaseAwaitingAdminCutOver

					phaseChanged := oldMigration.Status.Phase != newMigration.Status.Phase

					// Reconcile if phase changed AND it's now in a terminal state or awaiting admin cutover
					return phaseChanged && (isTerminal || isAwaitingCutover)
				},
				CreateFunc: func(_ event.CreateEvent) bool {
					return true
				},
			},
		)).
		WithOptions(controller.Options{MaxConcurrentReconciles: r.MaxConcurrentReconciles}).
		Complete(r)
}

// requiresVDDK reports whether the given MigrationTemplate storage copy method
// needs the VDDK library. Only the default ("normal", i.e. empty/unset) CBT/NBD
// copy method invokes nbdkit's vddk plugin against the ESXi/vCenter NFC service.
// StorageAcceleratedCopy clones disks array-side via SSH+XCOPY, and HotAdd
// ("vJailbreak Accelerated Copy") streams via qemu-nbd on the Proxy VM — neither
// touches the VDDK library.
func requiresVDDK(storageCopyMethod string) bool {
	return storageCopyMethod != StorageCopyMethod && storageCopyMethod != constants.HotAddCopyMethod
}

func (r *MigrationPlanReconciler) validateVDDKPresence(
	ctx context.Context,
	migrationobj *vjailbreakv1alpha1.Migration,
	logger logr.Logger,
) error {
	currentUser, err := user.Current()
	whoami := "unknown"
	if err == nil {
		whoami = currentUser.Username
	}

	oldConditions := migrationobj.Status.Conditions

	files, err := os.ReadDir(VDDKDirectory)
	if err != nil {
		logger.Error(err, "VDDK directory could not be read")

		migrationobj.Status.Phase = vjailbreakv1alpha1.VMMigrationPhasePending
		setCondition := corev1.PodCondition{
			Type:               "VDDKCheck",
			Status:             corev1.ConditionFalse,
			Reason:             "VDDKDirectoryMissing",
			Message:            "VDDK directory is missing. Please create and upload the required files.",
			LastTransitionTime: metav1.Now(),
		}

		newConditions := []corev1.PodCondition{}
		for _, c := range migrationobj.Status.Conditions {
			if c.Type != "VDDKCheck" {
				newConditions = append(newConditions, c)
			}
		}
		newConditions = append(newConditions, setCondition)
		migrationobj.Status.Conditions = newConditions

		if err = r.Status().Update(ctx, migrationobj); err != nil {
			return errors.Wrap(err, "failed to update migration status after missing VDDK dir")
		}

		return errors.Wrap(err, "VDDK_MISSING: directory could not be read")
	}

	if len(files) == 0 {
		logger.Info("VDDK directory is empty, skipping Job creation. Will retry in 30s.",
			"path", VDDKDirectory,
			"whoami", whoami)

		migrationobj.Status.Phase = vjailbreakv1alpha1.VMMigrationPhasePending
		migrationobj.Status.Conditions = append(migrationobj.Status.Conditions, corev1.PodCondition{
			Type:               "VDDKCheck",
			Status:             corev1.ConditionFalse,
			Reason:             "VDDKDirectoryEmpty",
			Message:            "VDDK directory is empty. Please upload the required files.",
			LastTransitionTime: metav1.Now(),
		})

		if !reflect.DeepEqual(migrationobj.Status.Conditions, oldConditions) {
			if err = r.Status().Update(ctx, migrationobj); err != nil {
				return errors.Wrap(err, "failed to update migration status after empty VDDK dir")
			}
		}

		return errors.Wrap(err, "VDDK_MISSING: directory is empty")
	}

	// Clear previous VDDKCheck condition if directory is valid
	cleanedConditions := []corev1.PodCondition{}
	for _, c := range migrationobj.Status.Conditions {
		if c.Type != "VDDKCheck" {
			cleanedConditions = append(cleanedConditions, c)
		}
	}

	// Only update conditions if they changed - don't force phase to Pending
	// Let the Migration controller manage phase progression naturally
	if !reflect.DeepEqual(migrationobj.Status.Conditions, oldConditions) {
		err = retry.RetryOnConflict(retry.DefaultRetry, func() error {
			currentMigration := &vjailbreakv1alpha1.Migration{}
			if getErr := r.Get(ctx, types.NamespacedName{Name: migrationobj.Name, Namespace: migrationobj.Namespace}, currentMigration); getErr != nil {
				return fmt.Errorf("failed to get Migration %s/%s during retry: %w", migrationobj.Namespace, migrationobj.Name, getErr)
			}

			// Only update conditions, don't modify the phase
			currentMigration.Status.Conditions = cleanedConditions

			return r.Status().Update(ctx, currentMigration)
		})
		if err != nil {
			return errors.Wrap(err, "failed to update migration status after validating VDDK presence")
		}
	}
	return nil
}

// MergeLabels combines two label maps into a single map, with values from b overriding values from a if keys conflict.
// This function is used to create a complete set of labels for Kubernetes resources created during migration.
func MergeLabels(a, b map[string]string) map[string]string {
	result := make(map[string]string)
	for k, v := range a {
		result[k] = v
	}
	for k, v := range b {
		result[k] = v
	}
	return result
}

//nolint:gocyclo
func (r *MigrationPlanReconciler) migrateRDMdisks(ctx context.Context, migrationplan *vjailbreakv1alpha1.MigrationPlan, vmMachines map[string]*vjailbreakv1alpha1.VMwareMachine, openstackcreds *vjailbreakv1alpha1.OpenstackCreds) error {
	allRDMDisks := []*vjailbreakv1alpha1.RDMDisk{}
	rdmDiskCRToBeUpdated := make([]vjailbreakv1alpha1.RDMDisk, 0)
	for _, vmMachine := range vmMachines {
		if len(vmMachine.Spec.VMInfo.RDMDisks) > 0 {
			// Check if VM is powered off
			if vmMachine.Status.PowerState != string(govmomitypes.VirtualMachineGuestStateNotRunning) {
				return fmt.Errorf("VM %s is not powered off, cannot migrate RDM disks", vmMachine.Name)
			}
			for _, rdmDisk := range vmMachine.Spec.VMInfo.RDMDisks {
				// Get RDMDisk CR
				rdmDiskCR := &vjailbreakv1alpha1.RDMDisk{}
				err := r.Get(ctx, types.NamespacedName{
					Name:      strings.TrimSpace(rdmDisk),
					Namespace: migrationplan.Namespace,
				}, rdmDiskCR)
				if err != nil {
					return fmt.Errorf("failed to get RDMDisk CR: %w", err)
				}
				// Validate that all ownerVMs are present in parallelVMs or have
				// already succeeded as part of this migration plan.
				vjailbreakSettings, err := k8sutils.GetVjailbreakSettings(ctx, r.Client)
				switch err {
				case nil:
					if vjailbreakSettings.ValidateRDMOwnerVMs {
						for _, ownerVM := range rdmDiskCR.Spec.OwnerVMs {
							if _, ok := vmMachines[ownerVM]; !ok {
								if !r.isVMSucceededInPlan(ctx, migrationplan, ownerVM) {
									log.FromContext(ctx).Error(fmt.Errorf("ownerVM %q in RDM disk %s not found in migration plan", ownerVM, rdmDisk), "verify migration plan")
									return fmt.Errorf("ownerVM %q in RDM disk %s not found in migration plan", ownerVM, rdmDisk)
								}
							}
						}
					} else {
						log.FromContext(ctx).Info("RDM disk owner VM validation disabled via vjailbreak-settings", "rdmDisk", rdmDisk)
					}
				default:
					log.FromContext(ctx).Error(err, "Failed to get vjailbreak settings, using default validation behavior")
					for _, ownerVM := range rdmDiskCR.Spec.OwnerVMs {
						if _, ok := vmMachines[ownerVM]; !ok {
							if !r.isVMSucceededInPlan(ctx, migrationplan, ownerVM) {
								log.FromContext(ctx).Error(fmt.Errorf("ownerVM %q in RDM disk %s not found in migration plan", ownerVM, rdmDisk), "verify migration plan")
								return fmt.Errorf("ownerVM %q in RDM disk %s not found in migration plan", ownerVM, rdmDisk)
							}
						}
					}
				}
				// Update existing RDMDisk CR
				err = ValidateRDMDiskFields(rdmDiskCR)
				if err != nil {
					return fmt.Errorf("failed to validate RDMDisk CR: %w", err)
				}
				// collect RDM disks that need to be updated (to be imported to Cinder)
				if !rdmDiskCR.Spec.ImportToCinder {
					rdmDiskCRToBeUpdated = append(rdmDiskCRToBeUpdated, *rdmDiskCR)
				}
				allRDMDisks = append(allRDMDisks, rdmDiskCR)
			}
		}
	}
	// Update all RDMDisk CRs that need to be updated
	for _, rdmDiskCR := range rdmDiskCRToBeUpdated {
		if rdmDiskCR.Status.Phase == RDMPhaseManaging || rdmDiskCR.Status.Phase == RDMPhaseManaged || rdmDiskCR.Status.Phase == RDMPhaseError {
			log.FromContext(ctx).Info("Skipping update for RDMDisk CR as it is already being managed or in error state", "rdmDiskName", rdmDiskCR.Name, "phase", rdmDiskCR.Status.Phase)
			continue
		}

		// Use retry to handle resourceVersion conflicts gracefully,
		// on error it will re-fetch the latest version and before
		// retrying update will check importToCinder flag again.
		err := retry.RetryOnConflict(retry.DefaultRetry, func() error {
			rdmDisk := &vjailbreakv1alpha1.RDMDisk{}
			if err := r.Get(ctx, types.NamespacedName{
				Name:      strings.TrimSpace(rdmDiskCR.Name),
				Namespace: migrationplan.Namespace,
			}, rdmDisk); err != nil {
				return err
			}
			// Idempotent guard - check if already marked for import
			if rdmDisk.Spec.ImportToCinder {
				log.FromContext(ctx).Info("Skipping update, already marked for import",
					"rdmDisk", rdmDisk.Name)
				return nil
			}

			// Migration Plan controller only sets ImportToCinder to
			// true, the RDMDisk controller ensures that RDM disk is
			// managed and imported to Cinder
			rdmDisk.Spec.ImportToCinder = true
			rdmDisk.Spec.OpenstackVolumeRef.OpenstackCreds = openstackcreds.GetName()

			if err := r.Update(ctx, rdmDisk); err != nil {
				if apierrors.IsConflict(err) {
					log.FromContext(ctx).Info("Conflict detected while updating RDMDisk — another controller updated it first",
						"rdmDisk", rdmDisk.Name)
					// RetryOnConflict will re-fetch and retry
					return err
				}
				return fmt.Errorf("failed to update RDMDisk CR: %w", err)
			}

			log.FromContext(ctx).Info("Updated RDMDisk CR to import into Cinder",
				"rdmDisk", rdmDisk.Name,
				"openstackCreds", openstackcreds.GetName())

			return nil
		})
		if err != nil {
			// if still failing after retries, bubble up
			return err
		}
	}

	// Check if all RDM disks are migrated after the delay
	for _, rdmDiskCR := range allRDMDisks {
		reFetchedRDMDiskCR := &vjailbreakv1alpha1.RDMDisk{}
		err := r.Get(ctx, types.NamespacedName{
			Name:      strings.TrimSpace(rdmDiskCR.Name),
			Namespace: migrationplan.Namespace,
		}, reFetchedRDMDiskCR)
		if err != nil {
			return err
		}
		if reFetchedRDMDiskCR.Status.Phase == RDMPhaseError {
			msg := "RDM disk is in Error phase"
			if len(reFetchedRDMDiskCR.Status.Conditions) > 0 {
				lastCond := reFetchedRDMDiskCR.Status.Conditions[len(reFetchedRDMDiskCR.Status.Conditions)-1]
				if lastCond.Message != "" {
					msg = lastCond.Message
				}
			}
			return fmt.Errorf("RDM disk %s failed to import to Cinder: %s", reFetchedRDMDiskCR.Name, msg)
		}
		if reFetchedRDMDiskCR.Status.Phase != RDMPhaseManaged || reFetchedRDMDiskCR.Status.CinderVolumeID == "" {
			// Log which disk is not ready
			r.ctxlog.Info("RDM disk not yet managed, will retry", "diskName", reFetchedRDMDiskCR.Name, "phase", reFetchedRDMDiskCR.Status.Phase, "cinderVolumeID", reFetchedRDMDiskCR.Status.CinderVolumeID)
			return verrors.ErrRDMDiskNotMigrated
		}
	}
	return nil
}

// validates that the VM has a valid OS type
func (r *MigrationPlanReconciler) validateVMOS(vmMachine *vjailbreakv1alpha1.VMwareMachine) (bool, bool, error) {
	validOSTypes := []string{"windowsGuest", "linuxGuest"}
	osFamily := strings.TrimSpace(vmMachine.Spec.VMInfo.OSFamily)

	if osFamily == "" || osFamily == "unknown" {
		r.ctxlog.Info("VM has unknown or unspecified OS type and will be skipped",
			"vmName", vmMachine.Spec.VMInfo.Name)
		return false, true, nil
	}

	for _, validOS := range validOSTypes {
		if osFamily == validOS {
			return true, false, nil
		}
	}

	return false, false, fmt.Errorf("vm '%s' has an unsupported OS type: %s",
		vmMachine.Spec.VMInfo.Name, osFamily)
}

// migrationPlanValidation is the outcome of pre-flight validation for a plan.
type migrationPlanValidation struct {
	// ValidVMs passed every pre-flight check and should be triggered.
	ValidVMs []*vjailbreakv1alpha1.VMwareMachine
	// OSSkippedVMs were skipped because their guest OS is unknown or unsupported.
	OSSkippedVMs []*vjailbreakv1alpha1.VMwareMachine
	// FlavorSkippedVMs were skipped because no target flavor can satisfy their
	// CPU/memory/GPU shape. They still get a Migration CR in ValidationFailed so
	// they remain visible in the UI, whose migrations table is populated purely
	// from Migration objects — a VM with no CR shows no row at all.
	FlavorSkippedVMs []*vjailbreakv1alpha1.VMwareMachine
	// ResolvedFlavors maps a VMwareMachine object name to the flavor ID chosen for
	// it, so the config-map build path does not re-query Nova per VM.
	ResolvedFlavors map[string]string
	// SkipReasons maps a plan VM key to the operator-facing reason it was skipped.
	// Surfaced as the Migration's condition message, which the UI renders in the
	// progress tooltip, the events tab and the error card.
	SkipReasons map[string]string
}

// flavorSkipReason builds the operator-facing explanation shown against a VM that
// no target flavor can accommodate. It names the shape that could not be placed
// and the action that fixes it, and calls out the availability-zone restriction
// when one is in force — a mistyped or under-provisioned target PCD cluster is a
// common cause of an otherwise puzzling "no flavor" result.
func flavorSkipReason(
	vmMachine *vjailbreakv1alpha1.VMwareMachine,
	migrationtemplate *vjailbreakv1alpha1.MigrationTemplate,
	openstackcreds *vjailbreakv1alpha1.OpenstackCreds,
) string {
	shape := fmt.Sprintf("%d vCPUs, %d MB RAM", vmMachine.Spec.VMInfo.CPU, vmMachine.Spec.VMInfo.Memory)
	if vmMachine.Spec.VMInfo.GPU.HasGPU() {
		shape += fmt.Sprintf(", %d passthrough GPU(s), %d vGPU(s)",
			vmMachine.Spec.VMInfo.GPU.PassthroughCount, vmMachine.Spec.VMInfo.GPU.VGPUCount)
	}

	reason := fmt.Sprintf("No target flavor can satisfy this VM (%s). "+
		"Create a suitable flavor, or set spec.targetFlavorId on the VMwareMachine to pin one, then retry.", shape)

	if utils.IsOpenstackPCD(*openstackcreds) && migrationtemplate.Spec.TargetPCDClusterName != "" {
		reason += fmt.Sprintf(" Only flavors available in PCD cluster %q were considered.",
			migrationtemplate.Spec.TargetPCDClusterName)
	}

	return reason
}

// vmDisplayNames returns the VM display names of a set of machines, for logging
// and plan status messages.
func vmDisplayNames(vmMachines []*vjailbreakv1alpha1.VMwareMachine) []string {
	names := make([]string, len(vmMachines))
	for i, vm := range vmMachines {
		names[i] = vm.Spec.VMInfo.Name
	}
	return names
}

// validates all VMs in the migration plan
func (r *MigrationPlanReconciler) validateMigrationPlanVMs(
	ctx context.Context,
	migrationplan *vjailbreakv1alpha1.MigrationPlan,
	migrationtemplate *vjailbreakv1alpha1.MigrationTemplate,
	vmwcreds *vjailbreakv1alpha1.VMwareCreds,
	openstackcreds *vjailbreakv1alpha1.OpenstackCreds,
	vmsToValidate []string,
	fetchedVMs map[string]*vjailbreakv1alpha1.VMwareMachine,
	candidateFlavors []flavors.Flavor,
) (*migrationPlanValidation, error) {
	result := &migrationPlanValidation{
		ResolvedFlavors: map[string]string{},
		SkipReasons:     map[string]string{},
	}

	if len(vmsToValidate) == 0 {
		r.ctxlog.Info("No VMs left to validate; all in terminal states or plan complete")
		return result, nil
	}

	result.ValidVMs = make([]*vjailbreakv1alpha1.VMwareMachine, 0, len(vmsToValidate))
	result.OSSkippedVMs = make([]*vjailbreakv1alpha1.VMwareMachine, 0, len(vmsToValidate))
	result.FlavorSkippedVMs = make([]*vjailbreakv1alpha1.VMwareMachine, 0, len(vmsToValidate))

	for _, vm := range vmsToValidate {
		vmMachine, ok := fetchedVMs[vm]
		if !ok {
			var err error
			vmMachine, err = GetVMwareMachineForVM(ctx, r, vm, migrationtemplate, vmwcreds)
			if err != nil {
				return nil, fmt.Errorf("failed to get VMwareMachine for VM %s: %w", vm, err)
			}
		}

		_, skipped, err := r.validateVMOS(vmMachine)
		if err != nil {
			return nil, err
		}
		if skipped {
			result.OSSkippedVMs = append(result.OSSkippedVMs, vmMachine)
			result.SkipReasons[vm] = fmt.Sprintf(
				"Guest OS is unknown or unsupported (OSFamily: %q). Set OSFamily explicitly on the VMwareMachine CR, then retry.",
				vmMachine.Spec.VMInfo.OSFamily)
			continue
		}

		// An operator-pinned flavor needs no lookup at all.
		if vmMachine.Spec.TargetFlavorID != "" {
			result.ResolvedFlavors[vmMachine.Name] = vmMachine.Spec.TargetFlavorID
			result.ValidVMs = append(result.ValidVMs, vmMachine)
			continue
		}

		// Any error here is this VM's problem alone (bad shape, or no candidates
		// after AZ filtering) — skip it and keep validating the rest of the batch.
		flavorID, err := resolveTargetFlavorID(vmMachine, migrationtemplate, openstackcreds, candidateFlavors)
		if err != nil {
			r.ctxlog.Info("VM has no schedulable target flavor and will be skipped",
				"vm", vmMachine.Spec.VMInfo.Name,
				"cpu", vmMachine.Spec.VMInfo.CPU,
				"memoryMB", vmMachine.Spec.VMInfo.Memory,
				"passthroughGPUs", vmMachine.Spec.VMInfo.GPU.PassthroughCount,
				"vGPUs", vmMachine.Spec.VMInfo.GPU.VGPUCount,
				"reason", err.Error())
			result.FlavorSkippedVMs = append(result.FlavorSkippedVMs, vmMachine)
			result.SkipReasons[vm] = flavorSkipReason(vmMachine, migrationtemplate, openstackcreds)
			continue
		}

		result.ResolvedFlavors[vmMachine.Name] = flavorID
		result.ValidVMs = append(result.ValidVMs, vmMachine)
	}

	osSkippedMsg := ""
	if len(result.OSSkippedVMs) > 0 {
		osSkippedMsg = fmt.Sprintf("Skipped VMs due to unsupported or unknown OS: %v", vmDisplayNames(result.OSSkippedVMs))
	}
	flavorSkippedMsg := ""
	if len(result.FlavorSkippedVMs) > 0 {
		flavorSkippedMsg = fmt.Sprintf("Skipped VMs with no schedulable target flavor: %v", vmDisplayNames(result.FlavorSkippedVMs))
	}

	skipMsgs := make([]string, 0, 2)
	for _, msg := range []string{osSkippedMsg, flavorSkippedMsg} {
		if msg != "" {
			skipMsgs = append(skipMsgs, msg)
		}
	}

	if len(result.ValidVMs) == 0 {
		for _, msg := range skipMsgs {
			r.ctxlog.Info(msg)
		}
		// result still carries per-VM SkipReasons for the caller to use.
		// Name every reason that applies, so a plan mixing unsupported OSes
		// with unschedulable shapes doesn't report only one of them.
		switch {
		case len(result.OSSkippedVMs) > 0 && len(result.FlavorSkippedVMs) > 0:
			return result, fmt.Errorf("no migrations to run: every VM was skipped for an unsupported OS or for having no schedulable target flavor")
		case len(result.FlavorSkippedVMs) > 0:
			return result, fmt.Errorf("no VM in the plan has a schedulable target flavor; no migrations to run")
		default:
			return result, fmt.Errorf("all VMs have unknown or unsupported OS types; no migrations to run")
		}
	}

	// Deliberately not written to the plan status. Each skipped VM now carries its
	// own ValidationFailed Migration with a specific reason, which is what the UI
	// actually renders; and setting the plan to PodPending here would suppress the
	// PodRunning transition below, which only fires on an empty status.
	if len(skipMsgs) > 0 {
		r.ctxlog.Info(strings.Join(skipMsgs, "; "), "migrationplan", migrationplan.Name)
	}

	return result, nil
}

// updateMigrationPhaseWithRetry updates a Migration's phase and condition with retry logic
func (r *MigrationPlanReconciler) updateMigrationPhaseWithRetry(
	ctx context.Context,
	migrationObj *vjailbreakv1alpha1.Migration,
	phase vjailbreakv1alpha1.VMMigrationPhase,
	condition corev1.PodCondition,
	identifier string,
) error {
	migration := &vjailbreakv1alpha1.Migration{}
	pollErr := wait.PollUntilContextTimeout(
		ctx,
		200*time.Millisecond,
		5*time.Second,
		true,
		func(pctx context.Context) (bool, error) {
			getErr := r.Get(pctx, types.NamespacedName{
				Name:      migrationObj.Name,
				Namespace: migrationObj.Namespace,
			}, migration)

			if apierrors.IsNotFound(getErr) {
				return false, nil
			}
			return getErr == nil, getErr
		},
	)

	if pollErr != nil {
		r.ctxlog.Error(pollErr, "Migration object never appeared in API server", "identifier", identifier)
		return pollErr
	}

	latest := &vjailbreakv1alpha1.Migration{}
	retryErr := retry.RetryOnConflict(retry.DefaultRetry, func() error {
		latest = &vjailbreakv1alpha1.Migration{}
		if err := r.Get(ctx, types.NamespacedName{Name: migrationObj.Name, Namespace: migrationObj.Namespace}, latest); err != nil {
			return err
		}

		latest.Status.Phase = phase
		latest.Status.Conditions = append(latest.Status.Conditions, condition)
		return r.Status().Update(ctx, latest)
	})

	if retryErr != nil {
		r.ctxlog.Error(retryErr, "Failed to update migration phase after retries", "phase", phase, "identifier", identifier)
		return retryErr
	}

	// Reflect the persisted state back onto the caller's copy, from `latest`
	// rather than re-appending onto migrationObj's own (possibly stale) slice.
	migrationObj.Status.Phase = latest.Status.Phase
	migrationObj.Status.Conditions = latest.Status.Conditions

	return nil
}

// markMigrationValidationFailed updates a Migration status to ValidationFailed
// isVMSucceededInPlan returns true if the given VM name has a Succeeded migration
// in this plan. Used to allow ownerVM validation to pass for VMs that already
// completed migration as part of the same plan.
func (r *MigrationPlanReconciler) isVMSucceededInPlan(ctx context.Context, migrationplan *vjailbreakv1alpha1.MigrationPlan, vmName string) bool {
	migrationList := &vjailbreakv1alpha1.MigrationList{}
	if err := r.List(ctx, migrationList,
		client.InNamespace(migrationplan.Namespace),
		client.MatchingLabels{"migrationplan": migrationplan.Name},
	); err != nil {
		return false
	}
	for _, m := range migrationList.Items {
		if m.Spec.VMName == vmName && m.Status.Phase == vjailbreakv1alpha1.VMMigrationPhaseSucceeded {
			return true
		}
	}
	return false
}

func (r *MigrationPlanReconciler) markMigrationValidationFailed(ctx context.Context, migrationObj *vjailbreakv1alpha1.Migration, vmName string, message string) {
	condition := corev1.PodCondition{
		Type:               "Validated",
		Status:             corev1.ConditionFalse,
		Reason:             "VMValidationFailed",
		Message:            message,
		LastTransitionTime: metav1.Now(),
	}
	if err := r.updateMigrationPhaseWithRetry(ctx, migrationObj, vjailbreakv1alpha1.VMMigrationPhaseValidationFailed, condition, vmName); err != nil {
		r.ctxlog.Error(err, "Failed to mark migration as ValidationFailed", "vm", vmName)
	}
}