Short answer: vSphere has no setting that keeps vCLS VMs off one specific host, such as a dedicated vSphere HA failover host. The practical options are indirect: limit External vCLS to datastores that the failover host cannot see, or take vCLS out of the cluster with Retreat Mode. On vSphere 9.0 and later, Retreat Mode has no impact on DRS or HA, so it is usually the cleanest answer. On 7.0 and 8.0 it stops DRS.
Why vCLS VMs end up on the failover host
vSphere Cluster Services (vCLS) runs small agent VMs in each cluster so DRS keeps working even when vCenter is down. vCenter places them on hosts in the cluster by itself. With the Dedicated failover hosts admission control policy, you want that host to stay empty until a failure happens, and a vCLS VM sitting there looks like a policy violation and makes capacity reports harder to read. If you need a refresher on vCLS itself, see Introduction to vSphere Clustering Service (vCLS).
Your options
| Option | Keeps vCLS off the host? | Trade-off |
|---|---|---|
| Allowed datastores for External vCLS (Cluster > Configure > vSphere Cluster Services > Datastores) | Yes, if the failover host has no access to those datastores | Needs storage the failover host can’t see. If only the failover host survives, vCLS can’t start there and DRS stops. Applies to External vCLS only. |
| vCLS VM anti-affinity compute policy | No | Keeps vCLS away from tagged VMs, not hosts |
| Retreat Mode | Yes, vCLS VMs are removed | 7.0/8.0: DRS stops and HA placement is not optimal. 9.0+: no impact on DRS or HA |
The datastore approach works because a VM can only run on a host that sees its datastore. Broadcom documents the allowed-datastores setting in External vCLS Datastore Placement. The anti-affinity policy (see vCLS VM Anti-Affinity Policies) is useful when you want critical workloads and vCLS on different hosts, but it can’t target a host.
Embedded vCLS in 8.0 Update 3 and later
When both vCenter and ESXi run 8.0 U3 or later, vCLS switches to Embedded vCLS. You get two VMs per cluster instead of three, and when a host is evacuated its vCLS VM is destroyed and recreated on another host instead of being migrated. The datastore trick is documented only for External vCLS, so on Embedded vCLS Retreat Mode is the lever that works.
Which option to pick
- vSphere 9.0 or later: use Retreat Mode. Broadcom states that on 9.0 vCLS can be disabled with no impact on DRS or HA. The 9.0 docs also mark vCLS as deprecated.
- vSphere 7.0 / 8.0 with External vCLS: if you can present a datastore to every host except the failover host, restrict vCLS to it. If you can’t, accept that vCLS may run on the failover host. The VMs are small.
- vSphere 7.0 / 8.0, Retreat Mode: use it only for a short maintenance task. DRS doesn’t work while it is on.
The step-by-step procedure for every version (vSphere Client, the config.vcls.clusters.domain-c<number>.enabled advanced setting, and the bulk script) is in vCLS Retreat Mode: How to Disable vCLS on a vSphere Cluster.
Further reading
- Duncan Epping: How to stop vCLS VMs from running on a vSphere HA Failover Host? (the original post)
- Broadcom KB 312147: vSphere Cluster Services (vCLS) in vSphere 7.0 Update 1 and newer versions
- Broadcom TechDocs: Putting a Cluster in Retreat Mode
