Why do I see a MetadataServiceNotEnabled error for File Storage for VPC?

Virtual Private Cloud

If your pod or PVC fails with a MetadataServiceNotEnabled error while using encryption in transit (EIT) with File Storage for VPC, use this topic to identify and resolve the cause.

When you use encryption in transit (EIT) with File Storage for VPC, your pod or PVC fails with a MetadataServiceNotEnabled error.

You see an error message similar to the following example in your pod events or describe output:

Code: MetadataServiceNotEnabled,
Description: Failed to mount target.,
Action: Metadata service might not be enabled for worker node.
  Make sure to use IKS>=1.30 or ROKS>=4.16 cluster.

This error means the EIT mount process tried to reach the instance metadata service at 169.254.169.254 but received no response. There are two independent root causes — check both.

Resolving the issue

Check the following root causes.

Root cause A — Cluster version is too old

EIT requires IKS version 1.30 or later. On older clusters, the metadata service endpoint is not available to workloads.

Check the current cluster version to confirm whether your cluster meets the minimum requirement. The output shows Pending or normal status and the Kubernetes version.

ibmcloud ks cluster get --cluster CLUSTER_ID | grep "Version"

Resolution: Upgrade the cluster to IKS version 1.30 or later.

Root cause B — Secure by Default cluster is missing the metadata outbound rule

For Secure by Default clusters, outbound traffic to 169.254.169.254 is blocked unless an explicit outbound rule is added to the kube-<clusterID> security group. Without this rule, the EIT process cannot reach the metadata service even on a supported cluster version.

This rule is added automatically for IKS clusters at version 1.33 and later. For older cluster versions, add the rule manually.

  1. Check whether the outbound rule already exists. If the command returns a line containing 169.254.169.254, the rule is present and this is not the cause.

    ibmcloud is sg kube-CLUSTER_ID | grep 169.254.169.254

  2. If the rule is absent, add it.

    ibmcloud is sg-rulec kube-CLUSTER_ID outbound \
  --protocol all \
  --remote 169.254.169.254

    Alternatively, add the rule from the IBM Cloud UI under VPC Infrastructure > Security groups > kube-<clusterID> > Outbound rules with the following values:

    Outbound rule values for metadata service access
    Field Value
    Protocol Any
    Source type Any
    Source 0.0.0.0/0
    Destination 169.254.169.254

  3. After adding the rule, retry the failing pod. No node reboot is required.

If the issue persists after both checks, open a support ticket with the IBM Cloud Container Storage team.