With most modern Linux distros, the kernel is distributed as a package, just like any other piece of software/library. Therefore, with Ansible as the example, you can have a task such as:
- name: Ensure that latest kernel is installed
notify: reboot_server # You would need a corresponding handler that reboots the system
and this will ensure that each time the play is run, the latest kernel package will be installed.
The kernel is however different to most other software packages in that:
- Multiple versions can be installed simultaneously, so you need to manage the removal of older versions. You don't necessarily want to do this automatically because:
- To enable a newly installed kernel, you need to reboot the system, so that needs to be managed, both from a business process POV and also technically. This is not an entirely risk free operation, so dependent on the nature of the system architecture, is often not seen as being an appropriate task to simply automate.
There are methods to activate a newly installed kernel without a reboot, but they are still not really a mainstream approach.
As to whether you should do kernel updates, in general yes. Given the litany of high profile security failures as a result of out of date software (and the high profile failures likely being just the tip of the iceberg), all software should be kept up to date. The recent Meltdown and Spectre vulnerabilities underline that the kernel is not special, and needs to be kept up to date like any other package.
Maintaining an effective patching policy needs serious thought given the trade off between the failures that can occur during the process, versus the failures that can occur if it is not done. Automation can certainly help, but each environment is different so you have to examine your own requirements to assess to what extent it is appropriate in your own case.
Either way, if when you say:
(a system where the distro itself - its kernel, shell(s) and internal
utilities aren't changed at all)
you mean that once installed, you never revisit and patch/update/upgrade those elements, you are significantly increasing the risk of your system being compromised.