diff --git a/etc/tempest.conf.sample b/etc/tempest.conf.sample
index b63b077..cc84994 100644
--- a/etc/tempest.conf.sample
+++ b/etc/tempest.conf.sample
@@ -1,36 +1,90 @@
 [identity]
-use_ssl=False
-host=127.0.0.1
-port=5000
-api_version=v2.0
-path=tokens
-nonadmin_user1=user1
-nonadmin_user1_password=password
-nonadmin_user1_tenant_name=user1-project
-nonadmin_user2=user2
-nonadmin_user2_password=password
-nonadmin_user2_tenant_name=user2-project
-strategy=keystone
+# This section contains configuration options that a variety of Tempest
+# test clients use when authenticating with different user/tenant
+# combinations
+
+# Set to True if your test environment's Keystone authentication service should
+# be accessed over HTTPS
+use_ssl = False
+# This is the main host address of the authentication service API
+host = 127.0.0.1
+# Port that the authentication service API is running on
+port = 5000
+# Version of the authentication service API (a string)
+api_version = v2.0
+# Path to the authentication service tokens resource (do not modify unless you
+# have a custom authentication API and are not using Keystone)
+path = tokens
+# Should typically be left as keystone unless you have a non-Keystone
+# authentication API service
+strategy = keystone
 
 [compute]
+# This section contains configuration options used when executing tests
+# against the OpenStack Compute API.
+
+# This should be the username of a user WITHOUT administrative privileges
+username = {$USERNAME}
+# The above non-administrative user's password
+password = {$PASSWORD}
+# The above non-administrative user's tenant name
+tenant_name = {$TENANT_NAME}
+
+# This should be the username of an alternate user WITHOUT
+# administrative privileges
+alt_username = {$ALT_USERNAME}
+# The above non-administrative user's password
+alt_password = {$ALT_PASSWORD}
+# The above non-administrative user's tenant name
+alt_tenant_name = {$ALT_TENANT_NAME}
+
 # Reference data for tests. The ref and ref_alt should be
 # distinct images/flavors.
-image_ref=e7ddc02e-92fa-4f82-b36f-59b39bf66a67
-image_ref_alt=346f4039-a81e-44e0-9223-4a3d13c92a07
-flavor_ref=1
-flavor_ref_alt=2
-ssh_timeout=300
-build_interval=10
-build_timeout=600
-catalog_type=compute
-create_image_enabled=true
+image_ref = {$IMAGE_ID}
+image_ref_alt = {$IMAGE_ID_ALT}
+flavor_ref = 1
+flavor_ref_alt = 2
+
+# Number of seconds to wait while looping to check the status of an
+# instance or volume that is building.
+build_interval = 10
+
+# Number of seconds to time out on waiting for an instance or volume
+# to build or reach an expected status
+build_timeout = 600
+
+# The type of endpoint for a Compute API service. Unless you have a
+# custom Keystone service catalog implementation, you probably want to leave
+# this value as "compute"
+catalog_type = compute
+
+# Does the Compute API support creation of images?
+create_image_enabled = true
+
 # For resize to work with libvirt/kvm, one of the following must be true:
 # Single node: allow_resize_to_same_host=True must be set in nova.conf
 # Cluster: the 'nova' user must have scp access between cluster nodes
-resize_available=true
+resize_available = true
 
 [image]
-username=admin
-password=********
-tenant=admin
-auth_url=http://localhost:5000/v2.0
+# This section contains configuration options used when executing tests
+# against the OpenStack Images API
+
+# This should be the username of a user WITHOUT administrative privileges
+username = {$USERNAME}
+# The above non-administrative user's password
+password = {$PASSWORD}
+# The above non-administrative user's tenant name
+tenant_name = {$TENANT_NAME}
+
+[compute-admin]
+# This section contains configuration options for an administrative
+# user of the Compute API. These options are used in tests that stress
+# the admin-only parts of the Compute API
+
+# This should be the username of a user WITH administrative privileges
+username = {$ADMIN_USERNAME}
+# The above administrative user's password
+password = {$ADMIN_PASSWORD}
+# The above administrative user's tenant name
+tenant_name = {$ADMIN_TENANT_NAME}