---
name: containers-ts-storage-vpc-file-eit-metadata
title: Why do I see a `MetadataServiceNotEnabled` error for File Storage for VPC?
description: If your pod or PVC fails with a `MetadataServiceNotEnabled` error while using encryption in transit (EIT) with File Storage for VPC, use this topic to identify and resolve the cause.
last-updated: 2026-08-06
---

> ## Documentation Index
> The table of contents for this documentation set is at https://cloud.ibm.com/docs/containers?format=markdown
> The index for all IBM Cloud docs is at: https://cloud.ibm.com/docs/llms.txt
> Use these files to discover more information as needed.

# Why do I see a `MetadataServiceNotEnabled` error for File Storage for VPC?
{: #ts-storage-vpc-file-eit-metadata}

[Virtual Private Cloud]{: tag-vpc}

If your pod or PVC fails with a `MetadataServiceNotEnabled` error while using encryption in transit (EIT) with File Storage for VPC, use this topic to identify and resolve the cause.
{: shortdesc}

When you use encryption in transit (EIT) with File Storage for VPC, your pod or PVC fails with a `MetadataServiceNotEnabled` error.
{: tsSymptoms}

You see an error message similar to the following example in your pod events or describe output:

```sh
Code: MetadataServiceNotEnabled,
Description: Failed to mount target.,
Action: Metadata service might not be enabled for worker node.
  Make sure to use IKS>=1.30 or ROKS>=4.16 cluster.
```
{: screen}

This error means the EIT mount process tried to reach the instance metadata service at `169.254.169.254` but received no response. There are two independent root causes — check both.
{: tsCauses}

## Resolving the issue
{: #ts-storage-vpc-file-eit-metadata-resolve}

Check the following root causes.
{: tsResolve}

### Root cause A — Cluster version is too old
{: #ts-storage-vpc-file-eit-metadata-root-cause-a}

EIT requires IKS version 1.30 or later. On older clusters, the metadata service endpoint is not available to workloads.

Check the current cluster version to confirm whether your cluster meets the minimum requirement. The output shows `Pending` or `normal` status and the Kubernetes version.

```sh
ibmcloud ks cluster get --cluster CLUSTER_ID | grep "Version"
```
{: pre}

**Resolution:** Upgrade the cluster to IKS version 1.30 or later.

### Root cause B — Secure by Default cluster is missing the metadata outbound rule
{: #ts-storage-vpc-file-eit-metadata-root-cause-b}

For Secure by Default clusters, outbound traffic to `169.254.169.254` is blocked unless an explicit outbound rule is added to the `kube-<clusterID>` security group. Without this rule, the EIT process cannot reach the metadata service even on a supported cluster version.

This rule is added automatically for IKS clusters at version 1.33 and later. For older cluster versions, add the rule manually.
{: note}

1. Check whether the outbound rule already exists. If the command returns a line containing `169.254.169.254`, the rule is present and this is not the cause.

    ```sh
    ibmcloud is sg kube-CLUSTER_ID | grep 169.254.169.254
    ```
    {: pre}

1. If the rule is absent, add it.

    ```sh
    ibmcloud is sg-rulec kube-CLUSTER_ID outbound \
      --protocol all \
      --remote 169.254.169.254
    ```
    {: pre}

    Alternatively, add the rule from the IBM Cloud UI under **VPC Infrastructure > Security groups > `kube-<clusterID>` > Outbound rules** with the following values:

    | Field | Value |
    |---|---|
    | Protocol | Any |
    | Source type | Any |
    | Source | `0.0.0.0/0` |
    | Destination | `169.254.169.254` |
    {: caption="Outbound rule values for metadata service access" caption-side="bottom"}

1. After adding the rule, retry the failing pod. No node reboot is required.

If the issue persists after both checks, [open a support ticket](https://cloud.ibm.com/docs/get-support?topic=get-support-open-case&format=markdown) with the IBM Cloud Container Storage team.

## Related topics
{: #ts-storage-vpc-file-eit-metadata-related}

- [Setting up encryption in-transit (EIT)](https://cloud.ibm.com/docs/containers?topic=containers-storage-file-vpc-apps&format=markdown#storage-file-vpc-apps-eit)
- [Why do I see an `UnresponsiveMountHelperContainerUtility` error?](https://cloud.ibm.com/docs/containers?topic=containers-ts-storage-vpc-file-eit-unresponsive&format=markdown)