On Fri, Jun 29, 2018 at 05:26:37PM -0400, Kyle Marek wrote:
Kernel updates are different. You *have* to reboot in order to run
the
new kernel (except for security updates applied with kpatch) and a
broken kernel has the potential to simply lock up without even launching
/sbin/init, for example. In these situations, administrators have to
manually reboot the machine. If this is the case, they can also pick the
kernel they want to boot from the boot menu.
No amount of unattended failed-boot-check logic in the bootloader can
run without user intervention when a broken kernel is still running/just
sitting there.
Well, your sufficiently fancy update system could detect that the
machine is still not up again after $DURATION and use some hypervisor
API (if it's a VM) or the BMC (for metal) to kill and force-reboot it.
Theoretically, the boot loader might also program a watchdog device to
make something like the above possible on a single machine without all
the distributed systems coordination stuff.