Comment 13 for bug 2075968

> If so, when doing a release upgrade, cloud-init will see a new python version, clear it's cache, then run as if it was first boot again.

Ahh the cleared cache is what triggers cloud-init to re-run thereby reapplying any user-data it detects on that subsequent boot. Since default system configuration in this image /etc/cloud/cloud.cfg is to lock_passwd cloud-init happily locks down that passwd access with that leading ! in /etc/shadow