"Insufficient vSphere HA failover resources" alarm may occur when restoring vCenter from a file-based backup after patching

Products

• VMware vCenter Server

Issue/Introduction

In certain scenarios, an "Insufficient vSphere HA failover resources" alarm may be triggered after restoring a vCenter Server from a file-based backup.
This typically occurs under the following conditions:

 - vCenter was restored to a previous version from a file-based backup after a patch had been applied.
 - The password for the vpxuser account (which vCenter uses to manage ESXi hosts) was updated after the backup was taken.
 - An ESXi host disconnect and reconnect was performed to resolve a synchronization failure caused by the vpxuser password mismatch.
 - vSphere HA Admission Control is configured to Dedicated failover hosts.
 - vCLS virtual machines deployed after the patch remain on the dedicated failover host.

Cause

When a vCenter patch is applied, the vCLS virtual machines are updated and redeployed.
If the vCenter Server is subsequently restored from a backup, these recently redeployed virtual machines are discovered by the vCenter Server.
When an ESXi host is reconnected to resolve the vpxuser password mismatch, the original vCLS VMs (from before the redeployment) enter an "orphaned" state, while the newer vCLS VMs (redeployed after the patch) are left behind without being cleaned up.
Because the system does not recognize these uncleaned vCLS VMs as agent VMs, they are incorrectly identified as standard VMs running on the dedicated failover host, which triggers the resource alarm.

Resolution

Perform the following steps to clean up the stale vCLS VMs:

   1. Select the cluster from the vSphere Client inventory.
   2. Navigate to Configure > vSphere Cluster Services > General.
   3. Click EDIT VCLS MODE, select Retreat Mode, and click OK.
       Note: This action will delete the orphaned vCLS VMs.
   4. Click EDIT VCLS MODE again, select System Managed, and click OK.
   5. Connect to the vCenter Server via SSH.
   6. Restart the ESX Agent Manager (eam) service by executing the following command:
      service-control --restart eam
      Note: Discovered vCLS VMs deployed after patching the vCenter Server will now be deleted.

If the "Insufficient vSphere HA failover resources" alarm persists after performing the operations above, disable and re-enable vSphere HA:

   1. Select the cluster from the inventory.
   2. Navigate to Configure > Services > vSphere Availability.
   3. Click EDIT, toggle off vSphere HA, and click OK.
   4. Click EDIT again, toggle on vSphere HA, and click OK.