@ControllerConfiguration(
        maxReconciliationInterval =
                @MaxReconciliationInterval(interval = 1, timeUnit = TimeUnit.HOURS),
        finalizerName = LDAPServiceAccount.FINALIZER)
@Workflow(
        dependents = {
            @Dependent(type = SecretDependent.class, name = "ldap-secret"),
            @Dependent(
                    type = LDAPServiceAccountResourceDependent.class,
                    name = "service-account",
                    dependsOn = "ldap-secret"),
        })
@RBACRule(apiGroups = LDAPServiceAccount.GROUP, resources = LDAPServiceAccount.PLURAL, verbs = RBACRule.ALL)
@RateLimited(maxReconciliations = 1, within = 30, unit = TimeUnit.SECONDS)
public class LDAPServiceAccountReconcilier extends AbstractConditionsReconcilier<LDAPServiceAccount, LDAPServiceAccountStatus> {

    @Override
    public UpdateControl<LDAPServiceAccount> reconcile(
            LDAPServiceAccount resource, Context<LDAPServiceAccount> context) {

        LDAPServiceAccountStatus status = resource.getStatus();
        ObjectMeta metadata = resource.getMetadata();
        LDAPServiceAccountSpec spec = resource.getSpec();

        StatusBuilder statusBuilder = new StatusBuilder();
        
        // shouldSkip skip if the status is done for the given generation
        if (shouldSkip(resource, status) || context.getSecondaryResource(LDAPServiceAccountResource.class).isEmpty()) {
            return UpdateControl.noUpdate();
        }

        statusBuilder.addDone(resource, "Reconciled");
        resource.setStatus(build(resource, statusBuilder));
        return UpdateControl.patchStatus(createForStatusUpdate(resource));
    }

    @Override
    protected LDAPServiceAccount createForStatusUpdate(LDAPServiceAccount resource) {
        LDAPServiceAccount copy = new LDAPServiceAccount();
        copy.setMetadata(new ObjectMetaBuilder()
                .withName(resource.getMetadata().getName())
                .withNamespace(resource.getMetadata().getNamespace())
                .build());
        copy.setStatus(resource.getStatus());
        return copy;
    }

@KubernetesDependent
public class SecretDependent extends KubernetesDependentResource<Secret, LDAPServiceAccount>
        implements Creator<Secret, LDAPServiceAccount>, GarbageCollected<LDAPServiceAccount> {

    ....

    public SecretDependent() {
        super(Secret.class);
    }

    @Override
    protected Secret desired(LDAPServiceAccount primary, Context<LDAPServiceAccount> context) {
        String groupName = primary.getSpec().group();
        String secretName = serviceAccountSecretName(primary);
        String serviceAccountName = ldapService.getServiceAccountName(LDAPService.GroupResponse.of(groupName));
        String password = ldapService.generatePassword();
        LOG.info(
                "Desired Secret with new random password '{}' for LDAP Service Account '{}'",
                secretName,
                serviceAccountName);
        LDAPService.ServiceAccountResponse serviceAccount =
                LDAPService.ServiceAccountResponse.of(serviceAccountName, LDAPService.DESCRIPTION);
        return kubernetesService.buildSecret(secretName, serviceAccount.email(), password, secretLabels(primary));
    }

    @Override
    public Matcher.Result<Secret> match(
            Secret actual, LDAPServiceAccount primary, Context<LDAPServiceAccount> context) {
        String secretName = serviceAccountSecretName(primary);
        LOG.info(
                "Matching Secret '{}' to LDAP Service Account '{}' in namespace '{}'",
                actual.getMetadata().getName(),
                primary.getMetadata().getName(),
                primary.getMetadata().getNamespace());
        String secretName = serviceAccountSecretName(primary);
        Matcher.Result<Secret> result =
                Matcher.Result.nonComputed(actual.getMetadata().getName().equals(secretName)
                        && actual.getMetadata()
                                .getNamespace()
                                .equals(primary.getMetadata().getNamespace()));
        return result;
    }

    private Map<String, String> secretLabels(LDAPServiceAccount resource) {
        return Map.of(
                "app.kubernetes.io/managed-by", "on-prem-operator",
                "app.kubernetes.io/instance", resource.getMetadata().getName(),
                "app.kubernetes.io/component", "ldap-service-account");
    }

    private String serviceAccountSecretName(LDAPServiceAccount resource) {
        return "ldap-sa-%s".formatted(resource.getMetadata().getName());
    }
}

public class LDAPServiceAccountResourceDependent
        extends PerResourcePollingDependentResource<LDAPServiceAccountResource, LDAPServiceAccount>
        implements Creator<LDAPServiceAccountResource, LDAPServiceAccount>, Deleter<LDAPServiceAccount> {

    public LDAPServiceAccountResourceDependent() {
        super(LDAPServiceAccountResource.class, Duration.ofHours(1));
    }

    @Override
    protected LDAPServiceAccountResource desired(LDAPServiceAccount primary, Context<LDAPServiceAccount> context) {
        String serviceAccountName = ldapService.getServiceAccountName(
                LDAPService.GroupResponse.of(primary.getSpec().group()));
        return new LDAPServiceAccountResource(serviceAccountName, LDAPService.DESCRIPTION);
    }

    @Override
    public void delete(LDAPServiceAccount primary, Context<LDAPServiceAccount> context) {
        // Not relevant
    }

    @Override
    public LDAPServiceAccountResource create(
            LDAPServiceAccountResource resource, LDAPServiceAccount primary, Context<LDAPServiceAccount> context) {
        // Not relevant
    }

    @Override
    public Set<LDAPServiceAccountResource> fetchResources(LDAPServiceAccount primary) {
        // Not relevant
    }
}