Re: [PATCH-SERIES many v6 00/26] migration: strict config check for intra-cluster migration

["Michael Köppl" <m.koeppl@proxmox.com>]

Tested this series on a 3-node cluster:
- Introduced a new config option for both VMs and CTs on node A (so
  it's considered valid there), then set the option for VM 100 and
  attempted to migrate to node B. Checked that the migration was
  rejected and that the config of VM 100 remained on node A. Checked
  that this also holds with `--force 1`, since it should only work with
  `--skip-config-check 1`. Did this for both running and stopped VMs.
- Checked that the migration is possible with `--skip-config-check 1`,
  both online and offline. The option will then be dropped, as
  before.
- Repeated the above for CTs. Used `--restart` here instead of
  `--online` for the migration and checked that an aborted migration
  due to the strict config check leaves the container running.
- Simulated a lower version on node B and attempted to migrate. Checked
  that the migration was successful even with the added option due to
  the config check being skipped.
- Ran migrations through the GUI with both 'Config check' on and off.
  Checked that the request had the fields set correctly and that the
  `skip-config-check` flag could also be used by non-root users, as
  opposed to --force.
- Ran a migration on a HA-managed VM with `--with-conntrack-state 1`
  and checked that {"with-conntrack-state":"1"} showed up in the CRM
  command and checked the task log to ensure that the migration of
  conntrack state entries was performed.
- Checked that `ha-manager help migrate` showed the correct parameters
  depending on the resource type and that `ha-manager migrate` rejected
  parameters that aren't valid for that resource type (used
  `--with-conntrack-state 1` for a CT).
- Using `ha-manager migrate`, checked that HA-based migration is also
  aborted if a property is unknown to the target node. Then used
  `qm migrate ... --skip-config-check 1` for that HA-managed VM and
  checked that the migration was performed even with the additional
  property.
- Added a positive affinity rule for VM 100 and CT 101. Then used
  `ha-manager migrate vm:100 node-b --with-conntrack-state 1` that
  the CT could also successfully be migrated even with the VM-only
  option supplied.

I haven't noticed anything that hasn't been noticed before (e.g. that
for CTs, the option will remain in the config when using
`--skip-config-check 1` and will show warnings, whereas for VMs, it
will be dropped). Overall, this seems to be in a pretty good state
already. I noticed a few minor things, which I noted on the individual
patches, but other than that, the series seems very solid to me and I
think it's a very good addition.

Consider this:
Reviewed-by: Michael Köppl <m.koeppl@proxmox.com>
Tested-by: Michael Köppl <m.koeppl@proxmox.com>

On Tue Nov 3, 2026 at 1:47 PM CET, Fiona Ebner wrote:
> Changes in v6:
> * Use 'return' instead of 'next' in handle_crm_json_command().
> * Adapt version helpers, where David's version was recently applied
>   which moved the pvecfg_min_version helper to the Tools module
>   instead.
> * Bump pve-manager version in version checks.
>
> Changes in v5 (thanks @Dano!):
> * Add PVE::Cluster include in patch "resources: add
>   migrate_json_properties() method".
> * Initialize plugin-specific migrate json properties once on module
>   load.

[snip]