diff --git a/README.rst b/README.rst
index da9d0b4..945aed3 100644
--- a/README.rst
+++ b/README.rst
@@ -590,6 +590,21 @@
         gateway_mode: server
 
 
+Set up metadata secret for the Vrouter
+-------------------------------------
+
+In order to get cloud-init within the instance to properly fetch 
+instance metadata, metadata_proxy_secret in the Vrouter agent config
+should match the value in nova.conf. The administrator should define
+it in the pillar:
+
+.. code-block:: yaml
+
+    opencontrail:
+      compute:
+        metadata:
+          secret: opencontrail
+
 Keystone v3
 -----------
 
diff --git a/opencontrail/files/2.2/contrail-vrouter-agent.conf b/opencontrail/files/2.2/contrail-vrouter-agent.conf
index 0e4f1fc..0aa2672 100644
--- a/opencontrail/files/2.2/contrail-vrouter-agent.conf
+++ b/opencontrail/files/2.2/contrail-vrouter-agent.conf
@@ -123,6 +123,9 @@
 [METADATA]
 # Shared secret for metadata proxy service (Optional)
 # metadata_proxy_secret=contrail
+{%- if compute.metadata is defined %}
+metadata_proxy_secret={{ compute.metadata.secret }}
+{%- endif %}
 
 [NETWORKS]
 # control-channel IP address used by WEB-UI to connect to vnswad to fetch
diff --git a/opencontrail/files/3.0/contrail-vrouter-agent.conf b/opencontrail/files/3.0/contrail-vrouter-agent.conf
index 75bfd4d..0a66be5 100644
--- a/opencontrail/files/3.0/contrail-vrouter-agent.conf
+++ b/opencontrail/files/3.0/contrail-vrouter-agent.conf
@@ -140,6 +140,9 @@
 [METADATA]
 # Shared secret for metadata proxy service (Optional)
 # metadata_proxy_secret=contrail
+{%- if compute.metadata is defined %}
+metadata_proxy_secret={{ compute.metadata.secret }}
+{%- endif %}
 
 [NETWORKS]
 # control-channel IP address used by WEB-UI to connect to vnswad to fetch
diff --git a/opencontrail/files/4.0/contrail-vrouter-agent.conf b/opencontrail/files/4.0/contrail-vrouter-agent.conf
index f23e22b..f8c6933 100644
--- a/opencontrail/files/4.0/contrail-vrouter-agent.conf
+++ b/opencontrail/files/4.0/contrail-vrouter-agent.conf
@@ -196,6 +196,9 @@
 [METADATA]
 # Shared secret for metadata proxy service (Optional)
 # metadata_proxy_secret=contrail
+{%- if compute.metadata is defined %}
+metadata_proxy_secret={{ compute.metadata.secret }}
+{%- endif %}
 
 # Metadata proxy port on which agent listens (Optional)
 # metadata_proxy_port=