one other thing I forgot to mention: we should probably include disabling any kind of file injection here, since it won't work currently with rbd. Using cloud-init and the metadata service is preferable anyway, but it'd be good to mention disabling file injection:

libvirt_inject_password=false
libvirt_inject_key=false
libvirt_inject_partition=-2