Added a kernel patching role, which we ought to make more optional