I tried it at the top the other week and it didn't work, I can't recall the exact reason right now. Clearly going even further up the stack is likely to have the same issue. I'll look into it but I've no access to Openstack for the next few days...

user_data here is the actual template, which has been rendered and added to compute_attributes (since compute_attributes is what we send to Fog in the create_vm call). You are correct that the flag is on the image, buty that's not what we're testing :)