As this will be platform specific, let's aim for the platforms that we currently support boot image updates. This would include AWS, GCP, Azure and vsphere. Here are a few starting points to accomplish this:

• providerConfig interface 
• operator's diff callback during sync   

(Additional context can be found in https://issues.redhat.com/browse/MCO-1007?focusedId=27603268&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-27603268)