You can find the cloud-config in :

• /var/lib/coreos-install/user_data for baremetal
• /var/lib/coreos-vagrant/vagrant-user-data for vagrant

update it, reboot, if no error, the new configuration should be done.
I don't know if it's the good way but it seems to work.

@bgrayburn you can update ssh keys without doing anything crazy: https://github.com/coreos/init/blob/master/bin/update-ssh-keys

I have a script that I use to push them out across my fleet:

$ cat fleetctl-inject-ssh.sh
#!/bin/bash -x

# Usage:
#   cat public.key | fleetctl-inject-ssh.sh keyname

name=$1
if [ -z $name ]; then
  echo "Provide a name for the injected SSH key"
  exit 1
fi

shift 1

pubkey=$(cat)

for machine in $(fleetctl -strict-host-key-checking=false $@ list-machines --no-legend --full | awk '{ print $1;}'); do
  fleetctl  -strict-host-key-checking=false $@ ssh $machine "echo '${pubkey}' | update-ssh-keys -a $name -n"
done

so to run you could do something like:

echo 'THE_CONTENTS_OF_PUBKEY' |  ./fleetctl-inject-ssh.sh <SOME_INTELLIGENT_NAME_FOR_KEY>

or

cat <PUBKEY> | ./fleetctl-inject-ssh.sh <SOME_INTELLIGENT_NAME_FOR_KEY>

I have found a solution for updating cloud-config.yml!

The file /usr/share/oem/cloud-config.yml is writable by root user, so you can change it.
I first tried to change it to read yml from file (--from-file), but it was not working.
I discovered in the source of coreos-cloudinit, that it gets the user-data from DO's metadata API, but also get network information as well, and coreos-cloudinit sets up the network. So if you just change the line in the cloud-config.yml, the network won't work.
I also discovered that coreos-cloudinit 1st read the userdata and then read the network info. The "--oem=digitalocean" param is just a shortcut for the "--from-digitalocean-metadata http://169.254.169.254/ --convert-netconf digitalocean" parameters.

So the solution is to change the API to localhost and simulate it this way:

until /bin/curl -s -i -o /tmp/v1 http://169.254.169.254/metadata/v1/; do sleep 1; done \
&& until /bin/curl -s -o /tmp/v1.json http://169.254.169.254/metadata/v1.json; do sleep 1; done \
&& ((cat /tmp/v1 | ncat -lp 80 \
&& echo -e "HTTP/1.1 200 OK\r\n\r" | cat - /home/core/cloud-config.yml | ncat -lp 80 \
&& echo -e "HTTP/1.1 200 OK\r\n\r" | cat - /tmp/v1.json | ncat -lp 80) &>/dev/null &) \
&& /usr/bin/coreos-cloudinit --from-digitalocean-metadata http://localhost/ --convert-netconf digitalocean \
&& rm /tmp/v1 && rm /tmp/v1.json

• Download the needed answers from metadata service to /tmp. The "untils" are very important, because the metadata API is not accessible just a little bit later, so we need to wait for it.
• Start netcats on localhost port 80 to simulate HTTP webserver, we will have 3 requests, so start 3 netcats in order
• 1st http request is checking metadata api: http://169.254.169.254/metadata/v1/
• 2nd request is the new cloud-config.yml from /home/core/cloud-config.yml
• 3rd request is a JSON with the needed network data (it also contains the user-data, but not used, so we don't care): http://169.254.169.254/metadata/v1.json
• So, netcats are waiting for requests one-by-one, we can start coreos-cloudinit with localhost as metadata URL, it will get our new cloud-config.yml
• After successfull initialization we can delete the downloaded answers from /tmp

The full cloud-config is this:

#cloud-config

coreos:
    units:
      - name: 99-public-interface.network
        runtime: yes
        content: |
          [Match]
          Path=*:03.0

          [Network]
          IPv4LL=true
      - name: systemd-networkd.service
        command: restart
      - name: oem-cloudinit.service
        command: restart
        runtime: yes
        content: |
          [Unit]
          Description=Cloudinit from DigitalOcean metadata

          [Service]
          Type=oneshot
          ExecStart=/bin/sh -c 'until /bin/curl -s -i -o /tmp/v1 http://169.254.169.254/metadata/v1/; do sleep 1; done && until /bin/curl -s -o /tmp/v1.json http://169.254.169.254/metadata/v1.json; do sleep 1; done && ((cat /tmp/v1 | ncat -lp 80 && echo -e "HTTP/1.1 200 OK\r\n\r" | cat - /home/core/cloud-config.yml | ncat -lp 80 && echo -e "HTTP/1.1 200 OK\r\n\r" | cat - /tmp/v1.json | ncat -lp 80) &>/dev/null &) && /usr/bin/coreos-cloudinit --from-digitalocean-metadata http://localhost/ --convert-netconf digitalocean && rm /tmp/v1 && rm /tmp/v1.json'
    oem:
      id: digitalocean
      name: DigitalOcean
      version-id: 0.0.4
      home-url: https://www.digitalocean.com/
      bug-report-url: https://github.com/coreos/bugs/issues

It is a hacky way, but works very good. You only need to upload the new config into /home/core/cloud-config.yml and all your changes are alive after reboot.

Has anyone able to update the user-data without using @Wallner solution?