diff --git a/config_tempest/main.py b/config_tempest/main.py
index 577513b5..55ed95ea 100755
--- a/config_tempest/main.py
+++ b/config_tempest/main.py
@@ -377,7 +377,7 @@ def config_tempest(**kwargs):
 
     image = services.get_service('image')
     image.set_image_preferences(kwargs.get('create', False),
-                                kwargs.get('image_name', C.DEFAULT_IMAGE),
+                                kwargs.get('image_path', C.DEFAULT_IMAGE),
                                 kwargs.get('image_disk_format',
                                            C.DEFAULT_IMAGE_FORMAT))
     image.create_tempest_images(conf)
@@ -416,7 +416,7 @@ def main():
         cloud_creds=cloud_creds,
         debug=args.debug,
         deployer_input=args.deployer_input,
-        image_name=args.image,
+        image_path=args.image,
         image_disk_format=args.image_disk_format,
         network_id=args.network_id,
         non_admin=args.non_admin,
diff --git a/config_tempest/services/image.py b/config_tempest/services/image.py
index dadfe9f4..d9bdf10a 100644
--- a/config_tempest/services/image.py
+++ b/config_tempest/services/image.py
@@ -44,6 +44,13 @@ class ImageService(VersionedService):
         self.image_path = image_path
         self.disk_format = disk_format
 
+    def set_default_tempest_options(self, conf):
+        # When cirros is the image, set validation.image_ssh_user to cirros.
+        # The option is heavily used in CI and it's also usefull for refstack,
+        # because we don't have to specify overrides.
+        if 'cirros' in self.image_path.rsplit('/')[-1]:
+            conf.set('validation', 'image_ssh_user', 'cirros')
+
     def set_versions(self):
         super(ImageService, self).set_versions(top_level=False)
 
diff --git a/etc/default-overrides.conf b/etc/default-overrides.conf
index b7ffaa0f..599728c0 100644
--- a/etc/default-overrides.conf
+++ b/etc/default-overrides.conf
@@ -27,13 +27,6 @@ admin_project_name=admin
 
 admin_domain_name=Default
 
-[compute]
-
-# Should the tests ssh to instances? (boolean value)
-#run_ssh=false $$$ REDHAT: use true
-# This parameter is deprecated and will be removed in a future release
-image_ssh_user = cirros
-
 [identity]
 
 # Full URI of the OpenStack Identity API (Keystone), v3
@@ -69,7 +62,7 @@ admin_username=admin
 
 # Administrative Tenant name to use for Keystone API requests.
 # (string value)
-# Parameter moved to auth section as admin_project_name. Would 
+# Parameter moved to auth section as admin_project_name. Would
 # be deprecated in future releases
 admin_tenant_name=admin
 
@@ -132,6 +125,3 @@ preserve_ports=true
 [network-feature-enabled]
 # Added in juno
 ipv6_subnet_attributes=true
-
-[validation]
-image_ssh_user = cirros
diff --git a/releasenotes/notes/image_ssh_user-option-in-validation-section-7cd0a6f44a8fdc1f.yaml b/releasenotes/notes/image_ssh_user-option-in-validation-section-7cd0a6f44a8fdc1f.yaml
new file mode 100644
index 00000000..74c4bf64
--- /dev/null
+++ b/releasenotes/notes/image_ssh_user-option-in-validation-section-7cd0a6f44a8fdc1f.yaml
@@ -0,0 +1,18 @@
+---
+features:
+  - |
+    validation.image_sh_user option is heavily used in CI and it's also needed
+    in refstack. Therefor the value is set to cirros automatically from now
+    everytime when image used is cirros.
+    The hardcoded value in default-overrides.conf is removed.
+other:
+  - |
+    By this change compute.image_ssh_user is removed from
+    default-overrides.conf too, because it was deprecated. All of the
+    image_ssh_user values from different sections were moved to validation
+    section by this change:
+
+    https://review.openstack.org/#/c/434097/
+
+    Since that change, there is only one image_ssh_user value and it's the one
+    under validation section.