Make kubelet_load_modules always present but false.

Update code and docs for that assumption.

inventory/group_vars/all.yml

@@ -51,10 +51,10 @@ kube_api_anonymous_auth: false
 #
 # For some things, kubelet needs to load kernel modules.  For example, dynamic kernel services are needed
 # for mounting persistent volumes into containers.  These may not be loaded by preinstall kubernetes
-# processes.  For example, ceph and rbd backed volumes.  Uncomment to allow kubelet to load kernel
+# processes.  For example, ceph and rbd backed volumes.  Set to true to allow kubelet to load kernel
 # modules.
 #
-#kubelet_load_modules: true
+kubelet_load_modules: false
 
 # Users to create for basic auth in Kubernetes API via HTTP
 kube_api_pwd: "changeme"

roles/kubernetes/node/defaults/main.yml

@@ -33,3 +33,5 @@ etcd_config_dir: /etc/ssl/etcd
 # A port range to reserve for services with NodePort visibility.
 # Inclusive at both ends of the range.
 kube_apiserver_node_port_range: "30000-32767"
+
+kubelet_load_modules: false

roles/kubernetes/node/templates/kubelet-container.j2

@@ -14,7 +14,7 @@
   {% for dir in ssl_ca_dirs -%}
   -v {{ dir }}:{{ dir }}:ro \
   {% endfor -%}
-  {% if kubelet_load_modules is defined and kubelet_load_modules == true -%}
+  {% if kubelet_load_modules -%}
   -v /lib/modules:/lib/modules:ro \
   {% endif -%}
   -v /sys:/sys:ro \