The release of SharePoint Server 2016 comes with an important change from an infrastructure point of view: The MinRole concept. While with SharePoint Server 2013 the Streamlined Topologies were state of the art, it now changed to the MinRole concept based on server roles. The role of a server is specified when you create a new farm or join a server to an existing farm. SharePoint automatically configures the services on each server based on the server’s role. And this is where an undocumented change has its impact. While in SharePoint 2013 it was suggested to have the Central Administration on a Web Front-end Server you probably started the installation process with this server because you wanted to be able to access the Central Administration afterwards. When installing a SharePoint 2016 multi-server farm this procedure won’t work anymore.

If you start an SharePoint Server 2016 farm installation with the Web Front-end role you will get the following error:
A failure was reported when trying to invoke a service application: EndpointFailure
Service Application Uri: urn:schemas-microsoft-com:sharepoint:service:6f0278ab61144ef2944089beda8d7840#authority=urn:uuid:4faf6f9591914a41aff51d3197f89407&authority=https://webfrontendserver:32844/Topology/topology.svc
Affected Endpoint: http://webfrontendserver:32843/6f0278ab61144ef2944089beda8d7840/MetadataWebService.svc

SharePoint is not able to provision other Service Application as for example the Managed Metadata Service Application because the Topology service is not available on the Web Front-end server. But the Topology service is mandatory to complete this action.

The reason for this behavior is caused by an architectural change within MinRole. While the SecurityTokenServiceApplication is provisioned on all SharePoint server roles (Web Front-end, Application, Distributed Cache, Search, Custom, Web Front-end with Distributed Cache, Application with Search, Single server)…
2017-01-09_151333

…the Topology service is just available on the following MinRole roles: Application, Search, Custom and Application with Search.
2017-01-09_160303

See the difference?

The solution is to start the farm installation with the Application or Application with Search role. You should also provision the Central Administration on a server with the Application role.