providing custom metadata to a vm on creation

I'm building a service that comprises a secure option and a public option, using the same VM step.

Specifically, each VM needs to:

- clone a secure git repo to bring itself up to date with any new image files

- connect to a secure job queue and run the next task in the queue, (or timeout/die trying)

I'd like to provide the same VM image for both secure and public options, and use custom metadata provided at boot time to trigger different behaviours.

How can I pass metadata to the VM, in a way that is only done at VM instantiation time? Storing ssh / git / job queue privileges in the VM itself is not an option.