For example, here's a VM asking the metadata service about its hostname:
$ curl http://169.254.169.254/latest/meta-data/hostname <html><body><h1>504 Gateway Time-out</h1> The server didn't respond in time. </body></html>
I'm guessing this has to do with recent firewall changes, for example
https://gerrit.wikimedia.org/r/c/operations/puppet/+/868070
or
https://gerrit.wikimedia.org/r/c/operations/puppet/+/883571
This means we can't create new working VMs at all. This is likely also breaking Magnum and Heat. Trove seems to still work, I think because it uses config-drive rather than the metadata service.