Comment 3 for bug 1870228

@Slawek - The route wasn't the issue (it was present) but client access to the metadata service was timing out. I noticed cloud-init fallback to the DHCP server IP, which was then refused and led me to the patch you referenced.

In the end, we found the client had aggressively modified EGRESS security group rules which inadvertently removed access to 169.254.169.254. If anything, maybe a docs update mentioning this scenario would be more appropriate. Thanks again.