Why the Standard vMotion Method Doesn’t Work
VMs managed by the vSphere Supervisor (also known as VM Service) are no longer part of the normal vCenter inventory management. Since they are directly managed by the Supervisor control plane, vCenter blocks the usual vMotion operations – a failed attempt to place the VM into maintenance mode or manually move it can damage the Supervisor status.
Logging in to vCenter with the Supervisor Credentials
To query the secret, a connection to the Supervisor VM or the Supervisor VM cluster is required. For this, its access credentials must first be retrieved on the vCenter using
/usr/lib/vmware-wcp/decryptK8Pwd.py
The output might look like this:
Read key from file
Connected to PSQL
Cluster: domain-c9:0a263106-e111-459d-b184-c9b123a2d2ef
IP: 10.x.x.x
PWD: <password>
------------------------------------------------------------
Using these credentials, a connection to the Supervisor VM can then be established.
The vSphere Supervisor has a service account that contains the credentials for a vCenter. These are stored in the secret wcp-vmop-sa-vc-auth in the namespace vmware-system-vmop.
The retrieval is done via:
kubectl get secret -n vmware-system-vmop wcp-vmop-sa-vc-auth \
-o jsonpath='{.data.vc_token}' | base64 --decode
Decoding the secret shows the username and password that you can use to log in to the vSphere Client or via PowerCLI. A typical excerpt looks like this:
username: wcp-vmop-user-052ffbc6-6ad6-47f8-8ccb-a27bbdc075bf-f721ecb0-6fde-4e35-8764-71a7860b06e4@vsphere.local
password: <password>
Performing the vMotion Operation
- Open the vSphere Client and log in with the extracted username and password.
- Identify the VM in the Supervisor that you want to move (it usually appears under “VM Service” and not in the regular vCenter inventory).
- Right-click the VM and select Actions → Migrate….
- Select the destination host or cluster that should accommodate the VM, and confirm the migration.
If you prefer automation, PowerCLI can use the same credentials:
$cred = Get-Credential -UserName $username -Password $password
Connect-VIServer -Server <vcenter-fqdn> -Credential $cred
Move-VM -VM $vm -Destination $dstHost
When Should You Do This?
- Troubleshooting: Move a problematic VM to another host to isolate CPU or memory issues without putting the entire cluster into maintenance mode.
- Maintenance: Perform updates on a host while keeping the Supervisor VMs active.
- Load balancing: Distribute the workload evenly when a host is overloaded.
Security Notes
- The service account is valid globally within a Supervisor; secure the secret accordingly.
- Monitor the Supervisor status before and after the migration for anomalies.
References
https://fojta.wordpress.com/2026/07/10/how-to-vmotion-vms-managed-by-the-vsphere-supervisor/