diff --git a/contrib/ansible/group_vars/all.yml b/contrib/ansible/group_vars/all.yml
index ae2fbc8c954..19047befdd6 100644
--- a/contrib/ansible/group_vars/all.yml
+++ b/contrib/ansible/group_vars/all.yml
@@ -1,3 +1,11 @@
+# Account name of remote user. Ansible will use this user account to ssh into
+# the managed machines. The user must be able to use sudo without asking
+# for password unless ansible_sudo_pass is set
 ansible_ssh_user: root
+
+# password for the ansible_ssh_user. If this is unset you will need to set up
+# ssh keys so a password is not needed.
 #ansible_ssh_pass: password
+
+# If a password is needed to sudo to root that password must be set here
 #ansible_sudo_pass: password
diff --git a/contrib/ansible/group_vars/masters.yml b/contrib/ansible/group_vars/masters.yml
index f03cd1d3196..afc9ff04b42 100644
--- a/contrib/ansible/group_vars/masters.yml
+++ b/contrib/ansible/group_vars/masters.yml
@@ -1 +1,5 @@
-kube_service_addresses: 10.254.0.0/16 # MUST be defined as a range not used in your infrastructure
+# Kubernetes internal network for services.
+# Kubernetes services will get fake IP addresses from this range.
+# This range must not conflict with anything in your infrastructure. These
+# addresses do not need to be routable and must just be an unused block of space.
+kube_service_addresses: 10.254.0.0/16