Veja a resposta no rastreador de problemas do CoreOS github: link
There might be a simpler way in future, but for now you can simply write a unit to invoke systemd-sysctl during cloudinit; it'll be started after any files specified in write_files are written:
#cloud-config .... coreos: units: - name: update-sysctl.service command: start content: | [Unit] Description=Update sysctl values written by cloud-config [Service] ExecStart=/usr/lib/systemd/systemd-sysctl ...